architecture: accept creator advisory boundary

architecture/adrs/ADR-0006-creator-advisory-boundary.md

@@ -0,0 +1,31 @@
+# ADR-0006 — Creator advisory boundary
+
+Status: Accepted  
+Date: 2026-08-16  
+Accepted under: ARCH-000008
+
+## Decision
+
+1. The first cognitive product slice is `creator-advisory-v1`: ephemeral advisory text for an authenticated Creator.
+2. Advisory output is non-canonical, has no tools or Executor access, and cannot create or mutate any semantic object or external state.
+3. The provider-neutral request/response boundary, data-denial rules, isolation, telemetry and promotion lifecycle are those specified by `docs/COGNITIVE_PROVIDER_PROPOSAL.md`.
+4. Initial hard limits are: user message 16 KiB; at most 8 context excerpts; each excerpt 8 KiB; combined context 48 KiB; response 16 KiB; request timeout 30 seconds; at most 2 concurrent requests per Principal; at most 20 accepted requests per Principal per rolling hour.
+5. Context sensitivity is fail closed. Only explicitly selected `PUBLIC` or `PRIVATE_ALLOWED` excerpts may enter the gateway; `SECRET`, `UNKNOWN` and omitted classifications are rejected.
+6. V1 has no server-side advisory conversation persistence, provider memory, automatic context crawling, automatic retries, tool calls or conversion of an answer into an ActionProposal.
+7. The deterministic fake remains the initial and test binding. External provider egress is disabled until a later accepted decision names the provider/API/model family and its retention/training/data-egress policy.
+8. A real provider binding cannot promote unless all deterministic boundary/safety tests pass, its evaluation corpus is recorded, and the Creator explicitly enables a fixed binding revision. A new model revision never inherits promotion.
+
+## Consequences
+
+- Provider-neutral gateway contracts and a fake adapter may now be implemented without canonical storage or new privileges.
+- Cognitive worker continues with no database role and no Commit/Executor credentials.
+- Provider-specific HTTP, credentials, outbound network access, production activation and content egress remain prohibited until separately accepted.
+- Loss of cognition affects only advisory availability; Continuity, Commit and existing Creator commands remain correct.
+
+## Revisit triggers
+
+- A concrete provider/API/model is selected.
+- Conversation persistence or provider memory is requested.
+- Advisory text should become a typed command candidate.
+- Context must be compiled automatically from canonical owners.
+- Limits or cost controls need production adjustment.

architecture/adrs/README.md

@@ -3,3 +3,5 @@
 Accepted architecture decisions live here. Normal implementation tasks may read but not create/change accepted ADRs unless explicitly authorized.
 
 Use `ADR-XXXX-title.md` with: problem, evidence, alternatives, decision, rationale, consequences, validity conditions, revisit triggers, migration/rollback, status.
+
+Current decisions include `ADR-0006-creator-advisory-boundary.md`, the fail-closed provider-neutral advisory boundary.

deploy/docker-compose.prod.yml

@@ -4,6 +4,7 @@ services:
     build:
       context: ..
       dockerfile: deploy/images/postgres.Dockerfile
+      args: { SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" }
     restart: unless-stopped
     environment:
       POSTGRES_DB: ${POSTGRES_DB:-assistant}
@@ -31,7 +32,7 @@ services:
     volumes: ["assistant_nats:/data"]
 
   notification-receiver:
-    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: notification-receiver } }
+    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: notification-receiver, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
     restart: unless-stopped
     environment:
       LISTEN_ADDR: ":8085"
@@ -50,7 +51,7 @@ services:
       retries: 10
 
   core-runtime:
-    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: core-runtime } }
+    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: core-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
     restart: unless-stopped
     environment:
       LISTEN_ADDR: ":8080"
@@ -74,7 +75,7 @@ services:
       - assistant_core_secrets:/run/secrets:ro
 
   continuity-runtime:
-    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: continuity-runtime } }
+    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: continuity-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
     restart: unless-stopped
     environment:
       LISTEN_ADDR: ":8081"
@@ -87,7 +88,7 @@ services:
       COMMIT_EXECUTOR_TOKEN: ${COMMIT_EXECUTOR_TOKEN}
 
   commit-runtime:
-    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: commit-runtime } }
+    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: commit-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
     restart: unless-stopped
     environment:
       LISTEN_ADDR: ":8082"
@@ -109,12 +110,12 @@ services:
       - assistant_notification_writer_secret:/run/notification-writer:ro
 
   cognitive-worker:
-    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: cognitive-worker } }
+    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: cognitive-worker, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
     restart: unless-stopped
     environment: { LISTEN_ADDR: ":8083" }
 
   creator-web:
-    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: creator-web } }
+    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: creator-web, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
     restart: unless-stopped
     environment:
       LISTEN_ADDR: ":8084"

deploy/images/postgres.Dockerfile

@@ -1,4 +1,7 @@
 FROM postgres:18.6-alpine
+ARG SOURCE_REVISION=unknown
+LABEL org.opencontainers.image.revision=$SOURCE_REVISION \
+      org.opencontainers.image.source="https://git.cin.su/m/Assistant.git"
 
 COPY database/bootstrap/001_roles_and_schemas.sql /docker-entrypoint-initdb.d/001_roles_and_schemas.sql
 COPY deploy/images/002_owner_passwords.sh /docker-entrypoint-initdb.d/002_owner_passwords.sh

deploy/images/runtime.Dockerfile

@@ -7,6 +7,9 @@ ARG TARGET
 RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /out/runtime ./cmd/${TARGET}
 
 FROM alpine:3.23
+ARG SOURCE_REVISION=unknown
+LABEL org.opencontainers.image.revision=$SOURCE_REVISION \
+      org.opencontainers.image.source="https://git.cin.su/m/Assistant.git"
 RUN addgroup -S assistant && adduser -S -G assistant assistant
 USER assistant
 COPY --from=build /out/runtime /usr/local/bin/assistant-runtime

deploy/windows/Confirm-DomovoyProductionArtifact.ps1

@@ -0,0 +1,56 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)]
+    [ValidatePattern('^[0-9a-f]{40}$')]
+    [string]$Revision,
+    [string]$DockerContext = 'docker-prod',
+    [string]$LocalManifestPath = "$env:LOCALAPPDATA\Domovoy\monitoring\deployment-manifest.json",
+    [string]$NasManifestPath = '\\nas\MST\codex\_monitoring\domovoy\deployment-manifest.json',
+    [string[]]$ExpectedContainers = @(
+        'assistant-postgres-1',
+        'assistant-notification-receiver-1',
+        'assistant-core-runtime-1',
+        'assistant-continuity-runtime-1',
+        'assistant-commit-runtime-1',
+        'assistant-cognitive-worker-1',
+        'assistant-creator-web-1'
+    )
+)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+
+function Write-AtomicJson([string]$Path, [string]$Json) {
+    $directory = Split-Path -Parent $Path
+    New-Item -ItemType Directory -Force -Path $directory | Out-Null
+    $partial = Join-Path $directory ('.' + [IO.Path]::GetFileName($Path) + ".${PID}.partial")
+    try {
+        [IO.File]::WriteAllText($partial, $Json + "`n", [Text.UTF8Encoding]::new($false))
+        Move-Item -LiteralPath $partial -Destination $Path -Force
+    }
+    finally {
+        if (Test-Path -LiteralPath $partial) { Remove-Item -LiteralPath $partial -Force }
+    }
+}
+
+$artifacts = foreach ($container in $ExpectedContainers) {
+    $raw = ((& docker.exe --context $DockerContext inspect $container --format '{{json .}}') -join '').Trim()
+    if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($raw)) { throw "Cannot inspect $container" }
+    $inspect = $raw | ConvertFrom-Json
+    $actual = [string]$inspect.Config.Labels.'org.opencontainers.image.revision'
+    if ($actual -ne $Revision) { throw "$container revision mismatch: expected=$Revision actual=$actual" }
+    if ($inspect.State.Status -ne 'running') { throw "$container is not running" }
+    [ordered]@{ container = $container; image_id = [string]$inspect.Image; revision = $actual }
+}
+
+$manifest = [ordered]@{
+    version = 1
+    project = 'domovoy'
+    revision = $Revision
+    promoted_at_utc = [DateTime]::UtcNow.ToString('o')
+    artifacts = @($artifacts)
+}
+$json = $manifest | ConvertTo-Json -Depth 5
+Write-AtomicJson $LocalManifestPath $json
+Write-AtomicJson $NasManifestPath $json
+Write-Output "Production artifact confirmed: revision=$Revision containers=$($artifacts.Count)"

deploy/windows/Test-DomovoyProductionHealth.ps1

@@ -7,6 +7,7 @@ param(
     [string]$NasBackupRoot = '\\nas\MST\codex\_backups\domovoy\postgres',
     [string]$NasStatusPath = '\\nas\MST\codex\_monitoring\domovoy\status.json',
     [string]$LocalStatusPath = "$env:LOCALAPPDATA\Domovoy\monitoring\status.json",
+    [string]$DeploymentManifestPath = "$env:LOCALAPPDATA\Domovoy\monitoring\deployment-manifest.json",
     [double]$MaxProductionBackupAgeHours = 30,
     [double]$MaxNasBackupAgeHours = 36,
     [int]$MinimumCertificateDays = 21,
@@ -60,6 +61,21 @@ foreach ($container in $ExpectedContainers) {
     catch { Add-Check "container:$container" $false $_.Exception.Message }
 }
 
+try {
+    $manifest = Get-Content -LiteralPath $DeploymentManifestPath -Raw | ConvertFrom-Json
+    if ($manifest.version -ne 1 -or $manifest.revision -notmatch '^[0-9a-f]{40}$') { throw 'invalid deployment manifest' }
+    if (@($manifest.artifacts).Count -ne 7) { throw 'deployment manifest artifact count mismatch' }
+    foreach ($artifact in $manifest.artifacts) {
+        $raw = ((& docker.exe --context $DockerContext inspect $artifact.container --format '{{json .}}') -join '').Trim()
+        if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($raw)) { throw "cannot inspect $($artifact.container)" }
+        $inspect = $raw | ConvertFrom-Json
+        $label = [string]$inspect.Config.Labels.'org.opencontainers.image.revision'
+        if ($label -ne $manifest.revision -or [string]$inspect.Image -ne [string]$artifact.image_id) { throw "artifact drift: $($artifact.container)" }
+    }
+    Add-Check 'deployment-artifact' $true "revision=$($manifest.revision) containers=$(@($manifest.artifacts).Count)"
+}
+catch { Add-Check 'deployment-artifact' $false $_.Exception.Message }
+
 try {
     $response = Invoke-RestMethod -Uri $Endpoint -TimeoutSec 15
     $ok = $response.status -eq 'ok'

dev/ACTIVE_TASK.json

@@ -1,5 +1,5 @@
 {
-  "task_file": "dev/tasks/DEV-000043-production-notification-delivery.json",
-  "task_id": "DEV-000043",
+  "task_file": "dev/tasks/ARCH-000008-accept-cognitive-advisory-boundary.json",
+  "task_id": "ARCH-000008",
   "task_revision": 1
 }

dev/tasks/ARCH-000007-cognitive-provider-proposal.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "ARCH-000007",
+  "task_revision": 1,
+  "architecture_revision": "generation-1",
+  "base_repo_revision": "43d1ef58213938c7ad8761375705849eec8fd901",
+  "risk_tier": "E",
+  "intent": "Produce a proposal-only decision for Domovoy's first real cognitive provider slice: authenticated Creator advisory responses with explicit data boundaries, replaceable provider binding, evaluation/promotion rules, and mechanically absent canonical or external mutation authority.",
+  "requirement_ids": ["FD-001", "FD-009", "FD-023", "FD-025", "INV-EPI-001", "USER-CONTINUE-PROJECT"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/COGNITIVE_PROVIDER_PROPOSAL.md", "dev/ACTIVE_TASK.json", "dev/tasks/ARCH-000007-cognitive-provider-proposal.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "ci/**", ".gitea/**", "contracts/**", "modules/**", "adapters/**", "cmd/**", "database/**", "deploy/**", "security/**", "tests/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0},
+  "contracts": {"consume": ["FD-001", "FD-009", "FD-023", "FD-025", "existing authenticated Creator session"], "may_change": []},
+  "semantic_owner": "proposal-only; no architecture decision is accepted by this task",
+  "canonical_state": [],
+  "state_transitions": [],
+  "side_effects_and_privileges": ["select this proposal in the active task pointer", "no provider call, credential creation, deployment, canonical mutation or external action"],
+  "persistence_and_migrations": [],
+  "failure_retry_restart": ["proposal defines timeout and provider-unavailable as explicit advisory failures", "advisory requests are not silently retried", "loss of cognition does not affect continuity or integrity"],
+  "assumptions": ["the first cognitive slice is advisory text, not autonomous action", "the user has not yet accepted a provider, data policy or retention policy", "docker-test remains prohibited"],
+  "acceptance_scenarios": ["proposal defines a provider-neutral typed advisory contract", "proposal defines allowed and forbidden context data", "model output has no canonical write or Executor path", "proposal defines secret isolation and log redaction", "proposal defines deterministic validation, timeout, rate and size limits", "proposal defines fake/eval/shadow/canary/promotion and rollback", "proposal identifies the minimum decisions requiring explicit user acceptance", "no runtime, protected architecture, credential or deployment state changes"],
+  "required_tests": ["task schema", "architecture preflight", "exact diff scope", "documentation review", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/ARCH-000008-accept-cognitive-advisory-boundary.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "ARCH-000008",
+  "task_revision": 1,
+  "architecture_revision": "generation-1",
+  "base_repo_revision": "78862ffe05f162fd397b688c3baefc0ad3a56a21",
+  "risk_tier": "E",
+  "intent": "Accept the provider-neutral Creator advisory boundary from ARCH-000007 with fail-closed no-egress defaults, fixed initial limits, no persistence/tools/actions, and no selected external provider.",
+  "requirement_ids": ["FD-001", "FD-009", "FD-023", "FD-025", "INV-EPI-001", "USER-CONTINUATION-AFTER-ARCH-000007"],
+  "allowed_change_scope": {"modules": [], "paths": ["architecture/adrs/ADR-0006-creator-advisory-boundary.md", "architecture/adrs/README.md", "docs/COGNITIVE_PROVIDER_PROPOSAL.md", "dev/ACTIVE_TASK.json", "dev/tasks/ARCH-000008-accept-cognitive-advisory-boundary.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/ARCHITECTURE_CONSTITUTION.md", "architecture/architecture-registry.yaml", "architecture/architecture-registry.json", "architecture/CORE_SEMANTIC_MODEL_V1.md", "ci/**", ".gitea/**", "contracts/**", "modules/**", "adapters/**", "cmd/**", "database/**", "deploy/**", "security/**", "tests/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0},
+  "contracts": {"consume": ["ARCH-000007 proposal", "existing authenticated Creator session"], "may_change": []},
+  "semantic_owner": "architecture decision only; cognitive worker owns no canonical semantics",
+  "canonical_state": [],
+  "state_transitions": [],
+  "side_effects_and_privileges": ["accept ADR-0006", "no provider call, credential, deployment or runtime mutation"],
+  "persistence_and_migrations": [],
+  "failure_retry_restart": ["external egress remains disabled until a provider decision", "advisory requests are ephemeral and never retried automatically", "provider absence returns explicit unavailable state"],
+  "assumptions": ["the user's continuation after receiving ARCH-000007 accepts the recommended advisory-only boundary", "provider choice and external data egress remain unaccepted, so fail closed", "docker-test remains prohibited"],
+  "acceptance_scenarios": ["ADR accepts provider-neutral contract and deterministic limits", "no external provider or data egress is accepted", "no canonical persistence, tools or automatic actions are permitted", "fake gateway implementation becomes authorized under a separate task", "real adapter remains blocked until provider/data policy acceptance"],
+  "required_tests": ["task schema", "architecture preflight", "exact diff scope", "independent protected-path review", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000044-post-notification-production-audit.json

@@ -0,0 +1,32 @@
+{
+  "task_id": "DEV-000044",
+  "task_revision": 3,
+  "architecture_revision": "ADR-0005",
+  "base_repo_revision": "759328972a7ae583f27eec5b97a7a8dea9df2ce7",
+  "risk_tier": "E",
+  "intent": "Re-audit the exact merged Assistant artifact after the first production notification operation, update repository status evidence, and identify remaining work without inventing unapproved product or architecture scope; docker-test remains prohibited.",
+  "requirement_ids": ["ADR-0005", "INV-AUTH-001", "INV-OWN-001", "INV-CONT-001", "INV-TOPO-001", "USER-DOCKER-PROD-ONLY"],
+  "allowed_change_scope": {
+    "modules": [],
+    "paths": [
+      "docs/FOUNDATION_EXIT_AUDIT.md",
+      "docs/PROJECT_STATUS.md",
+      "tests/creator_commit/verify-remote.ps1",
+      "dev/ACTIVE_TASK.json",
+      "dev/tasks/DEV-000044-post-notification-production-audit.json"
+    ]
+  },
+  "forbidden_change_scope": {"paths": ["architecture/**", "ci/**", ".gitea/**", "contracts/**", "modules/**", "adapters/**", "cmd/**", "database/**", "deploy/**", "security/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0},
+  "contracts": {"consume": ["ADR-0005", "DEV-000041", "DEV-000042", "DEV-000043", "existing production verification scripts"], "may_change": []},
+  "semantic_owner": "none-verification",
+  "canonical_state": [],
+  "state_transitions": [],
+  "side_effects_and_privileges": ["read-only production verification", "authenticated smoke may create only its documented disposable test evidence through the existing Commit path"],
+  "persistence_and_migrations": [],
+  "failure_retry_restart": ["audit records failures as gaps and does not weaken checks", "no production mutation outside existing verification harness semantics"],
+  "assumptions": ["origin/main is the deployed exact artifact", "docker.cin.su SSH alias docker remains the production host", "docker-test remains prohibited"],
+  "acceptance_scenarios": ["local deterministic tests and architecture checks pass", "production stack and Windows tasks are healthy", "notification HTTPS authorization and durable receipt path pass", "Creator remote smoke passes through a Windows/Docker CLI-safe command invocation", "production artifact provenance is either proven or recorded as an explicit gap", "repository documents completed post-foundation work and remaining product decisions"],
+  "required_tests": ["task schema", "architecture preflight", "exact diff scope", "go test", "go vet", "production health", "authenticated Creator notification smoke", "docker-test absence"],
+  "terminal_gap_states": ["BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_CONFLICT", "BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000045-production-artifact-provenance.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000045",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0005",
+  "base_repo_revision": "959c89d47bf231dbcfb7a05e7b63b0e8579e3f0c",
+  "risk_tier": "E",
+  "intent": "Stamp project-built production images with the immutable Git revision, record promoted image digests in an external deployment manifest, and make production health reject provenance drift without using docker-test.",
+  "requirement_ids": ["INV-TOPO-001", "DEV-000044-FINDING-ARTIFACT-PROVENANCE", "USER-DOCKER-PROD-ONLY"],
+  "allowed_change_scope": {"modules": [], "paths": ["deploy/docker-compose.prod.yml", "deploy/images/runtime.Dockerfile", "deploy/images/postgres.Dockerfile", "deploy/windows/Confirm-DomovoyProductionArtifact.ps1", "deploy/windows/Test-DomovoyProductionHealth.ps1", "docs/DEPLOYMENT.md", "docs/PROJECT_STATUS.md", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000045-production-artifact-provenance.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "ci/**", ".gitea/**", "contracts/**", "modules/**", "adapters/**", "cmd/**", "database/**", "security/**", "tests/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0},
+  "contracts": {"consume": ["existing production Compose topology", "Docker OCI image metadata"], "may_change": []},
+  "semantic_owner": "none-operational-verification",
+  "canonical_state": [],
+  "state_transitions": [],
+  "side_effects_and_privileges": ["rebuild and replace project-owned production containers with exact merged source", "write non-secret deployment manifest to local profile and private NAS monitoring directory"],
+  "persistence_and_migrations": ["non-secret external deployment manifest only"],
+  "failure_retry_restart": ["manifest is published atomically only after all expected labels and digests verify", "failed verification leaves previous manifest intact", "health becomes degraded on revision or digest drift"],
+  "assumptions": ["docker context docker-prod is the production endpoint", "Git HEAD is merged origin/main before promotion", "docker-test remains prohibited"],
+  "acceptance_scenarios": ["every project-built image has the merged Git revision OCI label", "manifest records revision and exact image digests", "health verifies running labels and digests against the manifest", "production remains healthy after exact-artifact promotion"],
+  "required_tests": ["PowerShell parser", "task schema", "architecture preflight", "exact diff scope", "go test", "go vet", "Compose config", "production artifact confirmation", "production health", "CI", "docker-test absence"],
+  "terminal_gap_states": ["BLOCKED_BY_CONFLICT", "BLOCKED_BY_MISSING_CAPABILITY"]
+}

docs/COGNITIVE_PROVIDER_PROPOSAL.md

@@ -0,0 +1,121 @@
+# Cognitive provider proposal — Creator advisory V1
+
+Status: advisory boundary accepted by `ADR-0006`. Provider traffic, credentials, external data egress and deployment remain unaccepted.
+
+## 1. Product slice
+
+The first real cognitive feature should be `creator-advisory-v1`: an authenticated Creator asks a question and receives an advisory text response. The response is explicitly non-canonical and cannot itself create or change a Goal, Task, Commitment, Prospective item, Authority grant, Capability binding, ActionProposal or external effect.
+
+This slice is useful before autonomous behavior: Domovoy can explain current information and help formulate a possible next step while every durable or external change remains an explicit existing Creator command through its semantic owner and, where required, Commit/Executor.
+
+## 2. Typed boundary
+
+The provider-neutral Cognitive Gateway request should contain only:
+
+- contract version `creator-advisory-v1`;
+- request ID generated by the gateway;
+- authenticated Actor ID, Principal ID and Scope ID supplied by the trusted server, never chosen by the browser;
+- user message as bounded UTF-8 text;
+- a bounded list of typed context excerpts with source kind, source ID, revision, sensitivity class and exact text;
+- locale and response-size limit;
+- provider binding ID and revision resolved by Capability, not supplied by the browser.
+
+The response should contain:
+
+- request ID and binding revision;
+- advisory text;
+- references only to supplied context excerpt IDs;
+- finish reason from a closed enum: `COMPLETED | LENGTH_LIMIT | CONTENT_REJECTED | PROVIDER_UNAVAILABLE | TIMEOUT | INVALID_PROVIDER_RESPONSE`;
+- provider usage counters when available, treated as operational metadata;
+- no tool call, executable command, authority claim or canonical object mutation.
+
+Free-form provider JSON must not cross into Core contracts. A provider adapter translates its wire response into this closed gateway response and rejects unknown executable/tool fields.
+
+## 3. Data policy
+
+V1 should be data-minimal:
+
+- allowed by default: the current user message plus context the authenticated Creator explicitly selected for this request;
+- denied by default: passwords, tokens, secret files, credential paths, environment variables, private keys, database connection strings, raw logs, browser storage, notification credentials and backup recovery material;
+- no automatic repository, filesystem, email, calendar, network or database crawling;
+- no implicit conversation history or provider-side memory;
+- no full canonical table dump; each context excerpt is bounded, typed and scope-checked by its owner-facing query before gateway assembly;
+- request and response bodies are not written to ordinary application logs;
+- persistence is absent in the first slice. If conversation history is later requested, it requires an Artifact/Epistemics ownership and retention decision rather than provider memory.
+
+Provider retention/training behavior is a deployment acceptance condition. A binding may become active only when its configured data-handling mode matches the accepted deployment policy.
+
+## 4. Authority and isolation
+
+The cognitive worker remains outside canonical ownership and receives no database role, Commit Executor credential, notification writer token, Creator password/session signing key or filesystem secret beyond its single provider credential.
+
+Creator Web calls a server-side gateway endpoint after session validation. The browser never receives the provider key, provider base URL, model identifier override, system instruction or binding secret reference. The cognitive worker may call only the fixed origin in the active Capability binding; redirects, browser-supplied URLs and ambient proxy credentials are denied.
+
+The advisory response is displayed as untrusted assistance. It is never automatically converted to an ActionProposal. A later “use this suggestion” flow must parse into a typed owner command and obtain explicit Creator confirmation under a separate task.
+
+## 5. Deterministic controls
+
+Before a provider call:
+
+- require a valid Creator session and exact Scope binding;
+- enforce request and per-excerpt byte limits, excerpt count, total context limit and UTF-8 validity;
+- reject secret-classified or unknown-classified context;
+- resolve an active Capability binding and exact revision;
+- apply a fixed timeout, concurrency ceiling and per-Principal rate budget;
+- build fixed system instructions in server code, not from browser fields.
+
+After a provider call:
+
+- cap response bytes and validate UTF-8;
+- reject tool calls, executable fields and unknown response shapes;
+- allow citations only to supplied excerpt IDs;
+- report timeout/provider failure distinctly; do not fabricate an answer;
+- do not silently retry, because a second paid request is a distinct attempt even though no external world mutation occurs.
+
+## 6. Provider binding and secrets
+
+Capability owns the binding lifecycle and health, including provider adapter kind, fixed HTTPS origin, model identifier, data-handling mode, limits and secret reference. Provider-specific wire types stay under `adapters/models`; domain packages do not import a provider SDK.
+
+The provider credential is generated or supplied outside Git and PostgreSQL, mounted read-only only into the cognitive worker, and referenced by an opaque secret reference. It is absent from Creator responses, logs, task packets, image layers, health payloads, browser storage and cognitive context.
+
+V1 should use the standard library HTTP client unless an accepted provider requires functionality that cannot be implemented safely without a dependency. TLS verification is mandatory; redirects are disabled; the origin is fixed by the binding.
+
+## 7. Evaluation and promotion
+
+Promotion follows `fake → offline evaluation → shadow (optional) → explicit canary → active`:
+
+1. Keep the deterministic fake as the contract test oracle and degraded fallback indicator, not as a fabricated real answer.
+2. Run a versioned, secret-free evaluation corpus covering scope leakage, prompt injection, secret requests, unsupported citations, oversized input, timeout and malformed responses.
+3. A shadow provider result is never shown or committed and must use only data approved for shadow processing.
+4. Canary is explicit for the Creator Principal, with a fixed binding revision and immediate disable switch.
+5. Promotion records the evaluated adapter/model/binding revisions and thresholds. A stronger/newer model never inherits promotion automatically.
+6. Rollback retires the binding and returns explicit `PROVIDER_UNAVAILABLE`; continuity, Commit and existing deterministic product commands remain operational.
+
+## 8. Failure and observability
+
+Operational telemetry may record request ID, binding ID/revision, timings, byte counts, finish reason, HTTP status class and usage totals. It must not record prompt, context, response or credentials. Provider 429/5xx, timeout, invalid TLS, redirect and invalid response are separate health evidence.
+
+There is no durable semantic obligation to finish an advisory request after process loss. The caller may explicitly submit a new request. Background retry queues and unmanaged goroutines are not introduced.
+
+## 9. Implementation slices after acceptance
+
+1. Accept a decision record specifying the contract, deployment data policy and initial provider binding class.
+2. Add provider-neutral gateway types and fake contract tests without changing canonical modules.
+3. Add one provider adapter using fixed-origin HTTPS and an external secret file; add adversarial fake-server tests.
+4. Add authenticated Creator advisory endpoint and UI with no persistence or action conversion.
+5. Add Capability health/binding deployment, evaluation evidence and canary controls.
+6. Deploy on `docker.cin.su`, mount the provider secret only into cognitive worker, then verify no-LLM degraded operation and rollback.
+
+## 10. Decisions requiring explicit acceptance
+
+Implementation remains blocked until the Creator explicitly accepts:
+
+1. advisory-only first slice, with no tools and no automatic actions;
+2. initial provider/API and model family;
+3. whether any user/context content may leave the private infrastructure;
+4. provider retention/training policy required for the binding;
+5. initial hard limits for message/context/output and request rate;
+6. no server-side conversation persistence in V1;
+7. evaluation/canary thresholds and acceptable operating cost.
+
+No choice above is inferred from possession of credentials or broad machine access.

docs/DEPLOYMENT.md

@@ -14,6 +14,15 @@ Temporal is intentionally **not** the canonical owner of future obligations. If/
 
 The initial stack definition is `deploy/docker-compose.prod.yml`. Portainer may deploy it from Git after the repository has been pushed.
 
+Project-built production images receive `org.opencontainers.image.revision` and `org.opencontainers.image.source` OCI labels. Promotion must set `ASSISTANT_SOURCE_REVISION` to the full merged `origin/main` SHA before `docker compose build/up`; the default `unknown` is intentionally rejected by artifact confirmation. After all project containers are running, execute:
+
+```powershell
+$revision = git rev-parse origin/main
+powershell -ExecutionPolicy Bypass -File .\deploy\windows\Confirm-DomovoyProductionArtifact.ps1 -Revision $revision -DockerContext docker-prod
+```
+
+The confirmation script accepts the promotion only when every project-built container has that revision label, then atomically records its exact Docker image ID in `%LOCALAPPDATA%\Domovoy\monitoring\deployment-manifest.json` and the private NAS monitoring directory. Production health compares every running label and image ID to this manifest and becomes degraded on drift. The manifest is non-secret operational evidence; it is not canonical Assistant state.
+
 The first external operation adds `assistant-notification-receiver-1` on production host port `18081`. Caddy applies `deploy/caddy/assistent.caddy`, routing only `https://assistent.cin.su/delivery/*` to that port and all other paths to Creator Web on `18080`. The receiver has an isolated durable volume and no Assistant database access. Commit success means an immutable receiver receipt exists; Windows display and human reading are not Commit outcomes.
 
 Migrations `010_capability_notification_binding.sql` and `011_commit_notification_envelope.sql` must be applied before the new runtimes start. The initial Capability binding is owner-local for `domovoy-creator-principal`, revision 1, capability `prospective-notification-delivery`, origin `https://assistent.cin.su`, delivery path `/delivery/v1/deliveries`, receipt path `/delivery/v1/receipts`, protocol `IDEMPOTENT_RECEIPT_V1`, and secret reference `domovoy-notification-write-v1`.

docs/FOUNDATION_EXIT_AUDIT.md

@@ -21,8 +21,10 @@ Status is based on executed repository tests and Docker-stack verification on 20
 
 Foundation V1 is eligible for freeze. Creator session authentication was also completed as DEV-000019 and does not carry Authority.
 
-Post-foundation product work is intentionally separate:
+The three original post-foundation gates are complete:
 
-1. Choose and specify the first real external operation before adding a production Executor credential.
-2. Build Creator API/UI only through validated Identity, Authority and Commit boundaries.
-3. Add exact diff-to-task scope comparison to promotion CI when the first Git baseline exists.
+1. `ADR-0005` specifies the first real external operation, prospective notification delivery.
+2. DEV-000024 through DEV-000032 and DEV-000040 through DEV-000043 provide the authenticated Creator API/UI and external operation only through the validated Identity, Authority, Continuity, Capability and Commit boundaries.
+3. `ADR-0004` and ARCH-000004 implement exact diff-to-task scope comparison.
+
+DEV-000044 re-ran local architecture/unit checks and the production Creator-to-receiver smoke on 2026-08-16. The deployed stack and Windows operational tasks were healthy. Current product status and explicitly uncommitted future scope are recorded in `docs/PROJECT_STATUS.md`.

docs/PROJECT_STATUS.md

@@ -0,0 +1,29 @@
+# Assistant project status
+
+Audit date: 2026-08-16. Active audit: DEV-000044 revision 3.
+
+## Delivered
+
+- Foundation V1 is frozen and all exit criteria pass.
+- The single Creator account authenticates at `https://assistent.cin.su`; authentication does not imply Authority.
+- Creator can inspect the bounded operational view, register and satisfy Continuity prospective items, inspect action history, and explicitly request the accepted notification operation.
+- `deliver-prospective-notification-v1` executes only through Capability binding, current Authority and Commit/Executor validation. Its success evidence is an immutable receiver receipt.
+- Production runs on `docker.cin.su`; the project does not use the shared test Docker host.
+- PostgreSQL backup/restore, encrypted off-host backup, production health monitoring and the current-user Windows notification projection are installed and healthy.
+
+## Evidence from DEV-000044
+
+- `go test ./...`, `go vet ./...`, architecture preflight/checks and PowerShell parsing pass.
+- `Test-DomovoyProductionHealth.ps1` reports `healthy` for the production stack, HTTPS/DNS/TLS, backups and registered Windows tasks.
+- `tests/creator_commit/verify-remote.ps1` passes the authenticated Creator → Commit → notification receiver receipt flow on `docker-prod`.
+- The smoke harness was corrected to preserve HTTP Authorization headers under Windows PowerShell 5.1 native-command argument handling.
+
+## Remaining work requiring a new task decision
+
+1. **Cognitive provider:** the cognitive worker intentionally remains the deterministic fake. Selecting a real model/provider, data policy and allowed proposal contract requires a separate capability/architecture decision; it must not gain canonical mutation authority.
+2. **Product breadth:** notification delivery is the only accepted real external operation. Any additional operation needs its own proposal, authority model, idempotency/reconciliation semantics and Capability binding.
+3. **Artifact and Epistemics product behavior:** their ownership boundaries exist, but no product task has yet specified durable user-facing workflows for them.
+
+DEV-000045 closes the DEV-000044 artifact-provenance finding for new promotions by stamping the merged Git revision into OCI labels, recording exact promoted image IDs outside the repository, and making production monitoring reject label or digest drift. Images that predate DEV-000045 remain historically unverifiable from the image alone.
+
+These are explicit scope decisions, not hidden incomplete steps in DEV-000043. No production secret is stored in the repository.

tests/creator_commit/verify-remote.ps1

@@ -29,7 +29,7 @@ function Creator-Post([string]$url, [object]$body, [string]$token) {
     try {
         [IO.File]::WriteAllText($local, $json, [Text.UTF8Encoding]::new($false))
         docker --context $DockerContext cp $local "${commitContainer}:$remote" | Out-Null
-        $result = docker --context $DockerContext exec --env "CREATOR_TEST_SESSION=$token" $commitContainer sh -c 'wget -qO- --header="Content-Type: application/json" --header="Authorization: Bearer $CREATOR_TEST_SESSION" --post-file "$1" "$2"' sh $remote $url
+        $result = docker --context $DockerContext exec --env "CREATOR_TEST_SESSION=$token" $commitContainer sh -c 'auth=Authorization:\ Bearer\ $CREATOR_TEST_SESSION; IFS=; wget -qO- --header=Content-Type:application/json --header=$auth --post-file=$1 $2' sh $remote $url
         if ($LASTEXITCODE -ne 0) { throw "Creator POST $url failed" }
         return ($result -join "`n")
     } finally {
@@ -39,7 +39,7 @@ function Creator-Post([string]$url, [object]$body, [string]$token) {
 }
 
 function Creator-Get([string]$url, [string]$token) {
-    $result = docker --context $DockerContext exec --env "CREATOR_TEST_SESSION=$token" $commitContainer sh -c 'wget -qO- --header="Authorization: Bearer $CREATOR_TEST_SESSION" "$1"' sh $url
+    $result = docker --context $DockerContext exec --env "CREATOR_TEST_SESSION=$token" $commitContainer sh -c 'auth=Authorization:\ Bearer\ $CREATOR_TEST_SESSION; IFS=; wget -qO- --header=$auth $1' sh $url
     if ($LASTEXITCODE -ne 0) { throw "Creator GET $url failed" }
     return ($result -join "`n")
 }
@@ -53,7 +53,7 @@ function Expect-CreatorStatus([string]$url, [object]$body, [string]$token, [int]
         docker --context $DockerContext cp $local "${commitContainer}:$remote" | Out-Null
         $previous = $ErrorActionPreference
         $ErrorActionPreference = "Continue"
-        $result = (docker --context $DockerContext exec --env "CREATOR_TEST_SESSION=$token" $commitContainer sh -c 'wget -S -O /dev/null --header="Content-Type: application/json" --header="Authorization: Bearer $CREATOR_TEST_SESSION" --post-file "$1" "$2"' sh $remote $url 2>&1) -join "`n"
+        $result = (docker --context $DockerContext exec --env "CREATOR_TEST_SESSION=$token" $commitContainer sh -c 'auth=Authorization:\ Bearer\ $CREATOR_TEST_SESSION; IFS=; wget -S -O /dev/null --header=Content-Type:application/json --header=$auth --post-file=$1 $2' sh $remote $url 2>&1) -join "`n"
         $ErrorActionPreference = $previous
         if ($result -notmatch "HTTP/1\.[01] $status") { throw "Creator POST $url did not return $status" }
     } finally {
@@ -62,12 +62,7 @@ function Expect-CreatorStatus([string]$url, [object]$body, [string]$token, [int]
     }
 }
 
-$sessionResponse = docker --context $DockerContext exec $coreContainer sh -c '
-token="$CREATOR_BOOTSTRAP_TOKEN"
-if [ -n "$CREATOR_BOOTSTRAP_TOKEN_FILE" ]; then token=$(cat "$CREATOR_BOOTSTRAP_TOKEN_FILE"); fi
-if [ -z "$token" ]; then exit 7; fi
-wget -qO- --header="Authorization: Bearer $token" --post-data="" "$1/v1/creator/sessions"
-' sh http://localhost:8080
+$sessionResponse = docker --context $DockerContext exec $coreContainer sh -c 'token=$CREATOR_BOOTSTRAP_TOKEN; if test x$CREATOR_BOOTSTRAP_TOKEN_FILE != x; then token=$(cat $CREATOR_BOOTSTRAP_TOKEN_FILE); fi; if test x$token = x; then exit 7; fi; header=Authorization:\ Bearer\ $token; IFS=; wget -qO- --header=$header --post-data={} http://localhost:8080/v1/creator/sessions'
 if ($LASTEXITCODE -ne 0) { throw "Creator session issuance failed" }
 $creatorSession = ($sessionResponse | ConvertFrom-Json).Token
 
@@ -120,7 +115,7 @@ $notificationAction = Creator-Post http://localhost:8082/v1/creator/continuity/n
 if ($notificationAction.State -ne 'SUCCEEDED' -or -not $notificationAction.ActionIntentID) { throw 'Creator notification did not produce a successful receipt' }
 $notificationItem = docker --context $DockerContext exec $continuityContainer wget -qO- "http://localhost:8081/v1/prospective-items/$notificationProspective" | ConvertFrom-Json
 if ($notificationItem.State -ne 'DELIVERED' -or $notificationItem.Revision -ne 1) { throw 'Notification changed Continuity canonical state' }
-$receiptRaw = docker --context $DockerContext exec $receiverContainer sh -c 'token=$(tr -d "\r\n" < /run/notification-reader/token); wget -qO- --header="Authorization: Bearer $token" "$1"' sh "http://localhost:8085/delivery/v1/receipts/$($notificationAction.ActionIntentID)"
+$receiptRaw = docker --context $DockerContext exec $receiverContainer sh -c 'token=$(cat /run/notification-reader/token); auth=Authorization:\ Bearer\ $token; IFS=; wget -qO- --header=$auth $1' sh "http://localhost:8085/delivery/v1/receipts/$($notificationAction.ActionIntentID)"
 if ($LASTEXITCODE -ne 0) { throw 'Notification receipt lookup failed' }
 $receipt = ($receiptRaw -join "`n") | ConvertFrom-Json
 if ($receipt.action_intent_id -ne $notificationAction.ActionIntentID -or $receipt.request_digest -notmatch '^[0-9a-f]{64}$') { throw 'Notification receipt evidence mismatch' }