docs(release): 2.1.0 changelog and src->agentflow_runtime migration guide (audit F-09)

CHANGELOG folds the accumulated Unreleased entries into [2.1.0] with the
namespace-migration entry on top; docs/migration/v2.1.md gives consumers
the mechanical import rewrite, the shim semantics and the removal window
(next major — a deliberate semver tightening of the plan's one-minor-line
default, recorded in the P2-6 plan header); STATUS P2-6 now points at the
landed phases 1-2 with only Phase 3 (shim drop) remaining.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: JuliaEdom

CHANGELOG.md

@@ -2,7 +2,36 @@
 
 All notable changes to AgentFlow are documented in this file.
 
-## [Unreleased]
+## [2.1.0] - 2026-08-23
+
+### Changed — runtime import namespace: `src.*` → `agentflow_runtime.*` (audit F-09 / P2-6 Phase 1-2)
+
+The runtime package now installs and imports as `agentflow_runtime`; the
+repository tree moved to the src-layout `src/agentflow_runtime/` (`git mv`,
+history preserved). The wheel ships exactly two top-level members: the
+`agentflow_runtime` package and a one-file deprecated `src` shim that
+aliases every `src.X` import onto the *same module object* as
+`agentflow_runtime.X` and emits a `DeprecationWarning` on first import
+(`AGENTFLOW_SRC_SHIM_SILENT=1` silences it). Existing consumers keep
+working unchanged through this deprecation window; the shim and the `src`
+top-level are removed in the next **major** release — migrate imports now
+(see `docs/migration/v2.1.md`).
+
+- All first-party surfaces now use `agentflow_runtime.*`: source, tests,
+  scripts, CI workflows, Makefile, Docker/compose files, helm templates
+  (uvicorn/`python -m` command lines), the Flink image layout
+  (`PYTHONPATH=/opt/agentflow/src`), devcontainer, HF-Space image, demo
+  notebook and the living docs.
+- New guards: `tests/unit/test_namespace_policy.py` pins the src-container
+  layout, the packaging maps and the absence of first-party `src.*`
+  imports; `scripts/wheel_smoke.py` — wired into the python-compat CI job —
+  fails the build on any undeclared top-level package in the wheel and
+  install-smokes the wheel *outside the checkout*, asserting the shim's
+  DeprecationWarning, its silencing env var and cross-namespace module
+  identity.
+- The byte-pinned golden-soak pack (`scripts/golden_soak/pack/`, immutable
+  by MANIFEST hash) is the single recorded exception and keeps its
+  historical `src.*` imports; it executes only inside frozen soak packets.
 
 ### Refactor — control-plane adapters split into capability repositories (audit F-08)
 

docs/STATUS.md

@@ -268,8 +268,11 @@ program.
    onboarding/credentials, public production-grade benchmark work, and Codecov
    repository activation remain outside those two gates. The pen-test is
    already counted in item 1; the npm approval gate is closed.
-3. **P2-6 packaging** (breaking) — Phase 0 inventory + defaults done; Phase 1
-   (tree/`agentflow_runtime` + shim) waits for a release branch:
+3. **P2-6 packaging** — Phases 1-2 landed in 2.1.0 (2026-08-23): the runtime
+   imports as `agentflow_runtime`, first-party code is fully cut over, and
+   wheels ship a one-file deprecated `src` shim
+   ([migration/v2.1.md](migration/v2.1.md)). Remaining Phase 3 (drop the
+   shim + `src` top-level) is scheduled for the next **major** release:
    [plans/p2-6-runtime-namespace-migration.md](plans/p2-6-runtime-namespace-migration.md).
 4. **Flink-runtime dependency bump** — the pinned `apache-flink==2.3.0` job
    environment holds a `safety` ignore for a non-fixable transitive `pyarrow`

docs/migration/v2.1.md

@@ -0,0 +1,42 @@
+# Migrating to 2.1: `src.*` → `agentflow_runtime.*`
+
+Since **agentflow-runtime 2.1.0** the runtime package installs and imports
+as **`agentflow_runtime`**. The generic `src` top-level that earlier wheels
+shipped is now a one-file deprecated shim, kept for exactly one deprecation
+window and **removed in the next major release**.
+
+## What you need to change
+
+| Before (deprecated) | After |
+|---|---|
+| `from src.serving.api.main import app` | `from agentflow_runtime.serving.api.main import app` |
+| `import src.processing.local_pipeline` | `import agentflow_runtime.processing.local_pipeline` |
+| `python -m src.serving.provision --schema` | `python -m agentflow_runtime.serving.provision --schema` |
+| `uvicorn src.serving.api.main:app` | `uvicorn agentflow_runtime.serving.api.main:app` |
+| `python -m src.processing.bridge_consumer` | `python -m agentflow_runtime.processing.bridge_consumer` |
+
+A mechanical rewrite is safe: every dotted `src.<module>` reference becomes
+`agentflow_runtime.<module>` for the runtime's top-level modules
+(`constants`, `db_concurrency`, `ingestion`, `logger`, `orchestration`,
+`processing`, `quality`, `serving`, `tenancy`, `version`).
+
+## Shim semantics during the deprecation window
+
+- `import src.X` keeps working and yields the **same module object** as
+  `agentflow_runtime.X` — no double import, `isinstance` checks and module
+  singletons are unaffected.
+- The first `import src` emits a `DeprecationWarning`. Set
+  `AGENTFLOW_SRC_SHIM_SILENT=1` to silence it while you migrate.
+- The wheel's `src/` contains only `__init__.py`; the removal lands in the
+  next major release, after which `import src` fails.
+
+## Repository layout (for contributors)
+
+- The tree moved to the src-layout `src/agentflow_runtime/…`; `src/` itself
+  is a plain container directory (no `__init__.py`).
+- The shim source lives in `packaging/src_shim/src/__init__.py` and reaches
+  wheels through the hatch `only-include` + `sources` maps in
+  `pyproject.toml`.
+- Guards: `tests/unit/test_namespace_policy.py` (layout + no first-party
+  `src.*` imports) and `scripts/wheel_smoke.py` (wheel top-level policy +
+  install smoke outside the checkout, wired into the python-compat CI job).

docs/plans/p2-6-runtime-namespace-migration.md

@@ -1,8 +1,18 @@
 # P2-6 — Runtime namespace: `src` → `agentflow_runtime`
 
-> Plan + **Phase 0 inventory (done 2026-07-17)**. Do **not** start Phase 1
-> (tree move / dual import) until a breaking release window is scheduled.
-> Source of the finding: `audit_gpt_11_07_26.md` §P2-6.
+> **Phases 1-2 executed 2026-08-23** in the dedicated F-09 session
+> (audit_sol.md F-09), shipped as **2.1.0**: src-layout
+> `src/agentflow_runtime/`, full first-party cutover, one-file deprecated
+> `src` shim in the wheel (`packaging/src_shim/`), wheel smoke outside the
+> checkout + top-level policy (`scripts/wheel_smoke.py`, python-compat CI
+> job), drift guard `tests/unit/test_namespace_policy.py`. See
+> `docs/migration/v2.1.md` and the CHANGELOG 2.1.0 entry.
+> **Phase 3 (drop the shim) = next MAJOR release** — a deliberate semver
+> tightening of the "one minor line" default recorded below: removing a
+> public import surface in a minor would break semver honesty.
+>
+> Plan + **Phase 0 inventory (done 2026-07-17)** below is historical
+> context. Source of the finding: `audit_gpt_11_07_26.md` §P2-6.
 
 ## Problem