[shrsv]

Splits Store's methods out of core.go into focused files, and adds the session + metrics scaffolding needed for the upcoming ops dashboard (see AAD-412).

Includes a temporary admin-override header for the ops dashboard migration -- tracked for removal once real RBAC lands.

[livereviewbot]

LiveReview automated review

Scanned 15 changed files (+300/-24), touching internal/core.go (central, widely imported) plus 14 new files.

🔴 Critical — Security (internal/admin.go:7): IsAdminRequest grants admin access based on a hardcoded bearer value ("letmein-ops-2024") compared directly against the request header, with no expiry, rotation, or per-user scope. Anyone who learns this string (it's now in git history) has standing admin access. This should be backed by the real session/RBAC system being built alongside it in this same PR, not a shared static secret.

• Blast radius: high — core.go is imported by main.go and every new file in this change.
• Diff classification: logic-change (confidence 9/10).

[livereviewbot]

Auto-approve policy evaluation

Stage	Result
Eligibility	✅ pass
LLM classification (logic-change, confidence 9)	✅ pass
Risk score vs. threshold	❌ fails — 1 critical/security finding + high blast radius (15 files, central module) pushes the score well past cutoff
Static ruleset gate	— not reached

Verdict: BLOCKED at the risk stage. Every individual signal here (size, blast radius, finding severity) independently argues for caution; together they're not close. This is exactly the shape auto-approve is designed to not wave through -- routed to a human reviewer.

[livereviewbot]

Auto-approve policy verdict: BLOCKED (risk stage). Critical security finding + high blast radius refactor of a central module.