docs: define local-first model scope

dev/ACTIVE_TASK.json

@@ -1,5 +1,5 @@
 {
-  "task_file": "dev/tasks/DEV-000268-configurable-gpu-qualification-timeout.json",
-  "task_id": "DEV-000268",
+  "task_file": "dev/tasks/DEV-000270-local-first-model-scope.json",
+  "task_id": "DEV-000270",
   "task_revision": 1
 }

dev/tasks/DEV-000270-local-first-model-scope.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000270",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "29dad40",
+  "risk_tier": "E",
+  "intent": "Record the approved local-first operating scope: one local conversational model, Qwen3-8B or Gemma-4 when available locally, is sufficient for the current phase, with the local Lifeboat as recovery fallback; external model qualification is deferred until explicitly requested, while external capability remains optional and non-blocking.",
+  "requirement_ids": ["local-first model operation", "hardware-neutral routing", "explicit scope decisions"],
+  "allowed_change_scope": {"modules": ["cognitive-worker", "deployment-governance"], "paths": ["docs/MODEL_FLEET_POLICY.md", "docs/PROJECT_STATUS.md", "docs/evidence/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000270-local-first-model-scope.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "contracts/**", "LLM-local/**", "cmd/**", "deploy/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing local CPU provider route", "existing local Lifeboat route"], "may_change": ["documentation and evidence projection only"]},
+  "semantic_owner": "cognitive-worker model routing policy remains hardware-neutral; this task records the current operating scope",
+  "canonical_state": ["existing local provider and Lifeboat runtime state", "this explicit scope decision"],
+  "state_transitions": ["external model qualification is deferred, not promoted or removed"],
+  "side_effects_and_privileges": [],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["local CPU route remains primary; local Lifeboat remains recovery fallback", "durable reflexes, skills, and local executors continue work when external models are unavailable"],
+  "assumptions": ["external providers may be added later by a separate explicit task", "GPU presence does not imply quality or priority"],
+  "acceptance_scenarios": ["policy names one local Qwen3-8B or Gemma-4 conversational model as current primary candidate", "policy names local Lifeboat as fallback", "external qualification is clearly deferred", "external unavailability does not block local/reflex/skill execution", "no external model probe is required for this task"],
+  "required_tests": ["go test ./...", "go vet ./...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl/independent", "git diff --check", "local runtime health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_CONFLICT"]
+}

docs/MODEL_FLEET_POLICY.md

@@ -5,6 +5,31 @@ Hardware and endpoint identity are operational observations only. A model is
 eligible for routing only after the existing qualification and activation
 gates pass.
 
+## Current operating scope: LOCAL_FIRST_V1
+
+For the current development phase, one local CPU model is sufficient and is the
+authoritative working route. The local Lifeboat is the recovery fallback. GPU
+and other external providers are optional extensions, not prerequisites for the
+core Domovoy experience.
+
+External-model capability must remain supported, but external availability must
+never block the Domovoy runtime. When an external model is absent, slow, or
+temporarily unavailable, work continues through the local model, local
+Lifeboat, durable reflexes, registered skills, and local executors. The result
+may be slower or narrower, but the task is not abandoned merely because a more
+capable provider is unavailable.
+
+The first-stage conversational candidate is one locally available Qwen3-8B
+(the user's shorthand “Qwen3.8” is normalized here to Qwen3-8B) or Gemma-4.
+The runtime chooses whichever approved candidate is actually present locally;
+this policy does not claim that either candidate is installed unless live runtime
+evidence confirms it.
+
+External model discovery, qualification, ranking, and promotion are explicitly
+deferred until a separate task requests them. Their absence or unrated state is
+not a failure of the current local-first scope, and no external probe is
+required while this scope is active.
+
 `FAST`, `MEDIUM`, and `HEAVY` are capability service classes, not hardware
 claims. A CPU model may be the best available quality model, and a GPU model
 may be unavailable, degraded, or unrated.
@@ -18,7 +43,7 @@ The Capability owner derives a provider-neutral `ModelRating` from evidence:
 
 The score combines quality, reliability, latency and evidence coverage. Missing
 measurements remain explicit. A model can change category after a new immutable
-qualification/performance revision. The current CPU route is an operational
-choice, not a permanent hardware assumption. CPU is preferred in the current
-deployment; if it is unavailable, the policy tries another ready class before
-using the Lifeboat recovery path.
+qualification/performance revision. The current CPU route is the operational
+choice for this phase. If it is unavailable, the policy uses the local Lifeboat
+recovery path. Additional providers may be added later without changing the
+local-first contract.

docs/PROJECT_STATUS.md

@@ -1,6 +1,8 @@
 # Assistant project status
 
-## Current audit delta — 2026-08-23
+## Current audit delta — 2026-08-24
+
+- `CURRENT_MODEL_SCOPE = LOCAL_FIRST_V1`; one locally available Qwen3-8B or Gemma-4 conversational model is sufficient for the first stage, with the local Lifeboat as recovery fallback. External models remain supported as optional capability, but their absence must not block work: reflexes, skills and local executors provide degraded continuation. External/GPU qualification and promotion are intentionally deferred by DEV-000270.
 
 - `LAST_COMPLETED = DEV-000260`; the governed self-development path, provider-neutral reachability rating, bounded authenticated operations smoke, responsive static regression guard and deep authenticated acceptance evidence are live. Mobile visual UI remains explicitly unverified because the current browser control surface cannot emulate a 390x844 viewport.
 
@@ -8,7 +10,7 @@
 - `FAST_PROVIDER_STATUS = LIVE_SMOKE_SUPPORTED`: local CPU gateway authentication is configured through a protected file reference; four bounded local-only advisory cases completed through cognitive-worker. Evidence: `docs/evidence/wp-601-fast-gateway-live-smoke-2026-08-22-v1.json`.
 - `MEDIUM_PROVIDER_STATUS = LIVE_BOUNDED_SMOKE_SUPPORTED_UNPROMOTED`; four bounded local-provider cases passed with template thinking disabled. This is availability/response-shape evidence only; lifecycle qualification, activation and promotion remain unclaimed. Evidence: `docs/evidence/medium-live-bounded-smoke-2026-08-23-v1.json`.
 - `HEAVY_PROVIDER_STATUS = LIVE_BOUNDED_INVOCATION_SUPPORTED_UNPROMOTED`; the exact Domovoy adapter payload produced one bounded Qwen completion in 0.583s. Quality is not assessed, lifecycle promotion is not performed, and GPU availability is not treated as intelligence or routing priority. Evidence: `docs/evidence/gpu-discovery-2026-08-23-v1.json`, `docs/evidence/gpu-invocation-qualification-2026-08-23-v1.json`.
-- `GPU_QUALIFICATION_STATUS = LIVE_UNRATED_TIMEOUT`; after increasing the GPU adapter to a bounded configurable `60s` window, Domovoy probed all four discovered models in parallel and all four still timed out without output. Quality remains `UNRATED`, no promotion occurred, and CPU/LIFEBOAT fallback remains authoritative. Evidence: `docs/evidence/gpu-qualification-runtime-2026-08-24-v2.json`.
+- `EXTERNAL_MODEL_STATUS = DEFERRED_BY_SCOPE`; previous bounded GPU timeout evidence remains historical diagnostic evidence, but no external model is part of the current operating route and no further external probes are planned in this phase.
 - `AGENT_EXECUTION_STATUS = DURABLE_DRY_RUN_CANARY_VERIFIED`; the explicit production canary persisted a dispatch intent, an ACTIVE lease and callback head sequence 2. No independently operated bridge endpoint is configured, so bridge-backed execution remains unavailable. Evidence: `docs/evidence/agent-execution-dry-run-canary-2026-08-23-v1.json`.
 - `ADDITIONAL_EVALUATION_STATUS = LIVE_TYPED_HANDOFF`; Capability-owned unresolved evaluation decisions can now be handed to Work through a typed production endpoint. Work preserves parent evidence lineage and schedules the bounded additional profile through the existing durable graph/dispatch path; model/provider selection remains outside Work. Evidence: `docs/evidence/additional-evaluation-runtime-live-2026-08-23-v1.json` and DEV-000261.
 - `FLEET_EXECUTION_EVIDENCE = docs/evidence/audit-runtime-status-2026-08-23-v1.json`; FAST, MEDIUM and LIFEBOAT are ready, HEAVY is explicitly degraded by provider timeout, FAST remains preferred/selected, and LIFEBOAT is the fallback tier.
@@ -30,4 +32,4 @@
 - `LINEAGE_DECISION = docs/GOVERNANCE_LINEAGE_DECISION_2026-08-22.md`; historical packets remain provenance and are not current authority.
 - `REGISTRY_STATUS = YAML and JSON semantic mirrors agree`
 - `PRODUCTION_DOMAIN = docker.cin.su`; shared docker-test is not used for this project.
-- `NEXT_WORK = add and qualify further local capabilities for generic agent work; obtain a viewport-capable browser for real mobile visual acceptance; separately qualify/promote GPU quality.`
+- `NEXT_WORK = strengthen local CPU/Lifeboat capabilities and generic local agent work; obtain a viewport-capable browser for real mobile visual acceptance; add external providers later under an explicit task.`

docs/evidence/audit-completion-matrix-2026-08-24-v9.json

@@ -0,0 +1,12 @@
+{
+  "evidence_id": "audit-completion-matrix-2026-08-24-v9",
+  "captured_at": "2026-08-24T00:00:00Z",
+  "production_revision": "9160654",
+  "supersedes": "docs/evidence/audit-completion-matrix-2026-08-24-v8.json",
+  "overall_status": "NOT_COMPLETE",
+  "completed_areas": ["agent execution durable lease/recovery", "bounded independent local agent execution bridge", "multi-agent work graph", "truth/research runtime", "learning reflection loop", "local-first model scope", "adaptive additional task evaluation scheduling", "governed gate verification/transitions", "authenticated desktop operations fast smoke", "responsive static regression guard"],
+  "remaining_gaps": ["universal generic/Codex Agent Execution capability is unavailable", "real mobile authenticated visual acceptance is unavailable in the current browser surface", "external model qualification and promotion are deferred by explicit scope decision"],
+  "live_facts": {"model_scope": "LOCAL_FIRST_V1", "primary_route": "local CPU", "fallback_route": "local Lifeboat", "external_probe_required": false},
+  "responsive_guard": "CI PASS: cmd/creator-web responsive regression test",
+  "secrets": "No secret values included."
+}

docs/evidence/local-first-model-scope-2026-08-24-v1.json

@@ -0,0 +1,13 @@
+{
+  "evidence_id": "local-first-model-scope-2026-08-24-v1",
+  "captured_at": "2026-08-24T00:00:00Z",
+  "task_id": "DEV-000270",
+  "decision": "LOCAL_FIRST_V1",
+  "primary_route": "one locally available Qwen3-8B or Gemma-4 conversational model",
+  "fallback_route": "local Lifeboat",
+  "external_models": {"status": "OPTIONAL_DEFERRED", "qualification_required_now": false, "promotion_allowed_now": false, "availability_blocks_local_work": false},
+  "degraded_continuation": ["local CPU model", "local Lifeboat", "durable reflexes", "registered skills", "local executors"],
+  "routing_principle": "GPU or endpoint identity does not imply intelligence, quality, or priority.",
+  "scope": "The core Domovoy workflow must remain useful using the local CPU model and local Lifeboat alone.",
+  "secrets": "No secret values included."
+}