fix: authenticate fleet readiness probe

cmd/cognitive-worker/fleet_status.go

@@ -17,6 +17,7 @@ type fleetEndpoint struct {
 	ModelID    string
 	Tier       capability.FleetTier
 	URL        string
+	Headers    map[string]string
 }
 
 type fleetStatusResponse struct {
@@ -37,6 +38,9 @@ func fleetReadinessHandler(client *http.Client, preferred capability.FleetTier,
 			}
 			request, err := http.NewRequestWithContext(r.Context(), http.MethodGet, endpoint.URL, nil)
 			if err == nil {
+				for name, value := range endpoint.Headers {
+					request.Header.Set(name, value)
+				}
 				response, requestErr := client.Do(request)
 				if requestErr == nil {
 					response.Body.Close()

cmd/cognitive-worker/fleet_status_test.go

@@ -25,3 +25,22 @@ func TestFleetReadinessSelectsLifeboatWhenPrimaryTiersUnavailable(t *testing.T)
 		t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String())
 	}
 }
+
+func TestFleetReadinessSendsConfiguredProviderHeaders(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Authorization") != "Bearer fleet-key" {
+			t.Fatalf("authorization=%q", r.Header.Get("Authorization"))
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+	handler := fleetReadinessHandler(server.Client(), capability.FleetTierFast, []fleetEndpoint{{
+		ProviderID: "cpu", ModelID: "cpu-model", Tier: capability.FleetTierFast, URL: server.URL,
+		Headers: map[string]string{"Authorization": "Bearer fleet-key"},
+	}})
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/v1/fleet/readiness", nil))
+	if recorder.Code != http.StatusOK || !strings.Contains(recorder.Body.String(), `"ready":true`) {
+		t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String())
+	}
+}

cmd/cognitive-worker/main.go

@@ -94,8 +94,12 @@ func main() {
 	}})
 	fleetClient := &http.Client{Timeout: 2 * time.Second}
 	preferredFleet := capability.FleetTier(envOr("COGNITIVE_PREFERRED_FLEET_TIER", string(capability.FleetTierHeavy)))
+	cpuFleetHeaders := map[string]string{}
+	if cpuAPIKey != "" {
+		cpuFleetHeaders["Authorization"] = "Bearer " + cpuAPIKey
+	}
 	mux.Handle("/v1/fleet/readiness", fleetReadinessHandler(fleetClient, preferredFleet, []fleetEndpoint{
-		{ProviderID: "local-cpu-primary", ModelID: "local-cpu-model", Tier: capability.FleetTierFast, URL: strings.TrimRight(envOr("LOCAL_CPU_PROVIDER_URL", "http://docker.cin.su:18082/v1"), "/") + "/models"},
+		{ProviderID: "local-cpu-primary", ModelID: "local-cpu-model", Tier: capability.FleetTierFast, URL: strings.TrimRight(envOr("LOCAL_CPU_PROVIDER_URL", "http://docker.cin.su:18082/v1"), "/") + "/models", Headers: cpuFleetHeaders},
 		{ProviderID: "local-medium-unconfigured", ModelID: "medium-unconfigured", Tier: capability.FleetTierMedium},
 		{ProviderID: "local-gpu-opportunistic", ModelID: "gpu-opportunistic", Tier: capability.FleetTierHeavy, URL: strings.TrimRight(envOr("LOCAL_GPU_PROVIDER_URL", "http://192.168.220.91:11434"), "/") + "/api/tags"},
 		{ProviderID: "cognitive-lifeboat", ModelID: "qwen3-8b-lifeboat", Tier: capability.FleetTierLifeboat, URL: lifeboatURL},

dev/ACTIVE_TASK.json

@@ -1,5 +1,5 @@
 {
-  "task_file": "dev/tasks/DEV-000161-completion-audit-matrix.json",
-  "task_id": "DEV-000161",
+  "task_file": "dev/tasks/DEV-000164-authorized-fleet-readiness.json",
+  "task_id": "DEV-000164",
   "task_revision": 1
 }

dev/tasks/DEV-000162-status-after-completion-matrix.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000162",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "bda71caecece67e5ef225ac250a7a80c4bc84d94",
+  "risk_tier": "E",
+  "intent": "Refresh current production revision in project status and completion evidence after the audit matrix deployment.",
+  "requirement_ids": ["AUDIT-TRUTHFUL-STATUS"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/PROJECT_STATUS.md", "docs/evidence/audit-completion-matrix-2026-08-22-v1.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000162-status-after-completion-matrix.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/**", "modules/**", "contracts/**", "adapters/**", "database/**", "deploy/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["current production revision", "completion matrix evidence"], "may_change": []},
+  "semantic_owner": "none; documentation projection",
+  "canonical_state": [],
+  "state_transitions": ["evidence projection only"],
+  "side_effects_and_privileges": ["none"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["not applicable"],
+  "assumptions": ["matrix remains NOT_COMPLETE until external gaps are actually verified"],
+  "acceptance_scenarios": ["status and matrix point to bda71ca", "no completion claim is widened", "no secret value appears"],
+  "required_tests": ["JSON validation", "go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000163-operations-ui-contract-refresh.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000163",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "c25a6346d0615f66ddb411450fcc7a36c62d2b48",
+  "risk_tier": "E",
+  "intent": "Extend authenticated cabinet contract tests to cover truthful model-fleet and Agent Execution status surfaces already implemented in Creator Web.",
+  "requirement_ids": ["WP-801", "WP-802", "WP-805", "Authenticated cabinet acceptance"],
+  "allowed_change_scope": {"modules": ["creator-web"], "paths": ["tests/creator_web/cabinet_acceptance_contract_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000163-operations-ui-contract-refresh.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "deploy/**", "database/**", "cmd/**", "contracts/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing authenticated Creator Web status routes and static cabinet"], "may_change": ["acceptance tests only"]},
+  "semantic_owner": "creator-web",
+  "canonical_state": ["none; tests inspect existing UI contract"],
+  "state_transitions": ["authenticated session gates truthful status requests"],
+  "side_effects_and_privileges": ["no external mutation; no credentials embedded"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["missing status surface fails CI"],
+  "assumptions": ["live authenticated browser visual acceptance remains a separate production verification"],
+  "acceptance_scenarios": ["fleet and executor status controls exist", "server exposes authenticated routes", "console renders actual selected tier and worker mode", "responsive/reduced-motion tests remain active"],
+  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_AUTHENTICATED_BROWSER_SESSION", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000164-authorized-fleet-readiness.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000164",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "65a60d5f068e3d8f70733c4ee96bfbb9d9943d5e",
+  "risk_tier": "E",
+  "intent": "Make live model-fleet readiness use the existing file-backed CPU provider API key so FAST status reflects the authenticated provider path.",
+  "requirement_ids": ["WP-601", "Model fleet/failover"],
+  "allowed_change_scope": {"modules": ["cognitive-worker", "capability"], "paths": ["cmd/cognitive-worker/main.go", "cmd/cognitive-worker/fleet_status.go", "cmd/cognitive-worker/fleet_status_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000164-authorized-fleet-readiness.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "adapters/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing provider API key resolver", "fleet readiness response"], "may_change": ["fleet readiness probe request headers"]},
+  "semantic_owner": "capability/cognitive-worker",
+  "canonical_state": [],
+  "state_transitions": ["authenticated provider probe -> truthful FAST readiness"],
+  "side_effects_and_privileges": ["uses existing in-memory resolved key only for the internal provider probe; no key logging or persistence"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["401 remains a typed unavailable result when key is absent or rejected; GPU/Medium behavior unchanged"],
+  "assumptions": ["OpenAI-compatible local provider uses Bearer authentication as the existing model adapter does"],
+  "acceptance_scenarios": ["fleet readiness sends Bearer header when CPU key is configured", "FAST is ready when authenticated /models succeeds", "no Authorization header is sent without a key", "Lifeboat fallback remains unchanged"],
+  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production fleet readiness"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

docs/PROJECT_STATUS.md

@@ -2,7 +2,7 @@
 
 ## Current audit delta — 2026-08-22
 
-- `CURRENT_PRODUCTION_REVISION = ada2da0c6c93d630f7699bd05abd32031c11544c`; public `/healthz` is healthy.
+- `CURRENT_PRODUCTION_REVISION = bda71caecece67e5ef225ac250a7a80c4bc84d94`; public `/healthz` is healthy.
 - `FAST_PROVIDER_STATUS = LIVE_SMOKE_SUPPORTED`: local CPU gateway authentication is configured through a protected file reference; four bounded local-only advisory cases completed through cognitive-worker. Evidence: `docs/evidence/wp-601-fast-gateway-live-smoke-2026-08-22-v1.json`.
 - `MEDIUM_PROVIDER_STATUS = NOT_CONFIGURED`; no medium runtime is registered in production.
 - `HEAVY_PROVIDER_STATUS = UNAVAILABLE`; GPU endpoint `192.168.220.91:11434` timed out during live discovery.

docs/evidence/audit-completion-matrix-2026-08-22-v1.json

@@ -1,7 +1,7 @@
 {
   "evidence_id": "audit-completion-matrix-2026-08-22-v1",
   "captured_at": "2026-08-22",
-  "production_revision": "3cf44ada8afd75fb008cf8d5965caf9c3f5b0462",
+  "production_revision": "bda71caecece67e5ef225ac250a7a80c4bc84d94",
   "objective": "Dovести оставшиеся пункты аудита Domovoy до проверяемого состояния",
   "matrix": [
     {"area":"Agent Execution runtime and recovery","status":"PARTIAL_EXTERNAL_GAP","repository_proof":["dev/tasks/DEV-000145-agent-execution-bridge-runtime.json","adapters/agentbridge/http.go","cmd/agent-worker/main.go"],"production_proof":["docs/evidence/wp-200-wp-301-fleet-execution-status-2026-08-22-v1.json"],"missing":"independently operated bridge endpoint is not configured; live worker is recovery-only"},

tests/creator_web/cabinet_acceptance_contract_test.go

@@ -52,3 +52,41 @@ func TestCreatorCabinetResponsiveAndReducedMotionRulesExist(t *testing.T) {
 		}
 	}
 }
+
+func TestCreatorCabinetExposesFleetAndExecutorTruthfulStatusSurfaces(t *testing.T) {
+	markupBytes, err := os.ReadFile("../../cmd/creator-web/static/index.html")
+	if err != nil {
+		t.Fatal(err)
+	}
+	markup := string(markupBytes)
+	for _, marker := range []string{
+		`id="fleet-summary"`, `id="fleet-selected"`, `id="fleet-list"`,
+		`id="agent-worker-state"`, `id="agent-worker-message"`,
+	} {
+		if !strings.Contains(markup, marker) {
+			t.Fatalf("operations cabinet missing truthful status surface %q", marker)
+		}
+	}
+
+	serverBytes, err := os.ReadFile("../../cmd/creator-web/server.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	server := string(serverBytes)
+	for _, marker := range []string{`r.URL.Path == "/api/fleet/readiness"`, `r.URL.Path == "/api/agent-worker/status"`} {
+		if !strings.Contains(server, marker) {
+			t.Fatalf("creator server missing authenticated status route %q", marker)
+		}
+	}
+
+	consoleBytes, err := os.ReadFile("../../cmd/creator-web/static/assets/console.js")
+	if err != nil {
+		t.Fatal(err)
+	}
+	console := string(consoleBytes)
+	for _, marker := range []string{`request("/api/fleet/readiness")`, `request("/api/agent-worker/status")`, `result.selected_tier || "не выбран"`, `status.mode || "UNKNOWN"`} {
+		if !strings.Contains(console, marker) {
+			t.Fatalf("console missing truthful status rendering %q", marker)
+		}
+	}
+}