ICPI Handoff Plan

Goal

This plan defines the safest real sequence for lifting ICPI out of svc-tenders while keeping:

• gateway behavior unchanged
• auth behavior unchanged
• route contracts unchanged

Shared Shell Contract

ICPI should continue to rely on a very small shared shell during and immediately after extraction:

• gateway proxying in services/api/src/routes/icpi.ts
• gateway auth middleware in services/api/src/auth/middleware.ts
• shared auth/identity resolution behind service-side auth ingress

Everything else should be treated as ICPI-owned move material unless later evidence says otherwise.

Safest Extraction Sequence

1. Create the new ICPI-owned runtime/package location