Deprecate keep-common after the keep-core release and remaining-consumer review

[mswilkison]

Decision: deprecate the standalone Threshold fork

The agreed direction is to retire threshold-network/keep-common, preserve its existing coordinates and immutable releases, and track remaining consumers. Do not rename it to threshold-common or publish a replacement module.

Verified baseline (2026-09-16)

• keep-core dev at a90ce1bf0738a35e4e3881f634f07520c2b8529e absorbed both runtime packages and generators in keep-core #4327. go.mod, go.sum, imports, and generation commands no longer consume keep-common. The final code is flattened into keep-core, not left under pkg/keepcommon.
• The only keep-common reference left on dev is the original upstream issue #117 link describing an ABI workaround. Keep that historical link unchanged.
• keep-core #4256 will bring dev to main before retirement. Do not add a temporary module migration to old main or reintroduce the dependency into dev.
• Other organization-private release/tooling repositories still pin the fork's v1.7.1-tlabs.0 or v1.7.1-tlabs.1 through replacements. Their detailed inventory and live repository-monitoring references are tracked privately. Default-branch search is not proof that every consumer has been found.
• This repository contains one root Go module, including generators. It has no separate npm/Python/Rust package or container publication configured. The v* workflow publishes GitHub releases.

Completion checklist

• Merge deprecation documentation PR #35: README notice, retention/maintenance policy, and the detailed retirement sequence.
• Verify the keep-core release candidate has landed on main and that no external runtime or generator dependency returned.
• Complete the private consumer inventory, including maintained non-default branches and nested tools. Record an active-vs-historical classification and a retain/migrate decision for each consumer.
• Active keep-core forks that should converge on the new release carry forward its in-tree implementation and generators through a reviewed release merge. Independently maintained tools require actual import/build analysis. Retained historical snapshots keep exact version pins and checksums.
• Preserve the existing repository name, github.com/keep-network/keep-common module declaration, all tags, commits, and releases. Do not delete/move tags, hand-edit checksums, retract valid releases solely for deprecation, or publish a gratuitous new module identity.
• Keep CI/dependency monitoring active while consumer review is open. Agree any required maintenance releases and support expectations with the remaining consumer owners.
• Decide whether a Go-tool-visible deprecation notice adds value. A comment in this fork's go.mod does not itself change the separate original upstream; test actual replacement/version-resolution behavior and approve any final metadata release separately. README-only deprecation requires no tag.
• Once outstanding work, release rollout, and consumer decisions are complete, update operational repository inventories/monitoring. An administrator may then archive the repository as a separate step; merging the documentation does not archive it.

Scope boundaries

This applies only to the Threshold fork. Original upstream keep-network/keep-common and other organizations' forks remain under their owners' policies. keep-core's in-tree code is not a drop-in replacement module for arbitrary applications.

Related: keep-core #4221, reviewed against dev.

References: Go module deprecation and replacement, GitHub archive behavior.

[linear]

ENG-768