feat(work): materialize durable solution waves

feat(work): add persistent solution search orchestration policy

cmd/core-runtime/development_gate.go

@@ -0,0 +1,32 @@
+package main
+
+import (
+	"errors"
+	"time"
+
+	"git.cin.su/m/Assistant/contracts/work"
+	workdomain "git.cin.su/m/Assistant/modules/work/domain"
+)
+
+var errDevelopmentGateCreate = errors.New("development gate must start at evidence collected with revision one")
+
+func prepareDevelopmentGate(value work.DevelopmentGate, now time.Time) (work.DevelopmentGate, error) {
+	if value.Stage != work.DevelopmentEvidenceCollected || value.Revision != 1 {
+		return work.DevelopmentGate{}, errDevelopmentGateCreate
+	}
+	value.UpdatedAtUnixMillis = now.UnixMilli()
+	if err := workdomain.ValidateDevelopmentGate(value); err != nil {
+		return work.DevelopmentGate{}, err
+	}
+	return value, nil
+}
+
+func advanceDevelopmentGate(value work.DevelopmentGate, next work.DevelopmentStage, now time.Time) (work.DevelopmentGate, error) {
+	advanced, err := workdomain.AdvanceDevelopmentGate(value, next)
+	if err != nil {
+		return work.DevelopmentGate{}, err
+	}
+	advanced.Revision = value.Revision + 1
+	advanced.UpdatedAtUnixMillis = now.UnixMilli()
+	return advanced, nil
+}

cmd/core-runtime/development_gate_test.go

@@ -0,0 +1,41 @@
+package main
+
+import (
+	"testing"
+	"time"
+
+	"git.cin.su/m/Assistant/contracts/work"
+)
+
+func TestDevelopmentGateControllerRequiresSequentialVerifiedEvidence(t *testing.T) {
+	now := time.UnixMilli(10)
+	gate, err := prepareDevelopmentGate(work.DevelopmentGate{ID: "gate-1", Revision: 1, Stage: work.DevelopmentEvidenceCollected, EvidenceRefs: []string{"evidence-1"}}, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	gate.ProposalRef = "proposal-1"
+	gate, err = advanceDevelopmentGate(gate, work.DevelopmentProposalCreated, now)
+	if err != nil || gate.Revision != 2 {
+		t.Fatalf("proposal transition failed: %#v %v", gate, err)
+	}
+	gate.TaskPacketRef = "task-1"
+	gate, err = advanceDevelopmentGate(gate, work.DevelopmentTaskAdmitted, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	gate.WorktreeRef = "isolated-worktree"
+	gate, err = advanceDevelopmentGate(gate, work.DevelopmentIsolated, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	gate.ProducerRunRefs = []work.AgentRunID{"producer"}
+	gate.VerifierRunRefs = []work.AgentRunID{"verifier"}
+	gate.VerificationEvidence = "verification-1"
+	gate, err = advanceDevelopmentGate(gate, work.DevelopmentVerified, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := advanceDevelopmentGate(gate, work.DevelopmentPromoted, now); err == nil {
+		t.Fatal("promotion bypassed canary")
+	}
+}

cmd/core-runtime/main.go

@@ -256,6 +256,61 @@ func main() {
 		w.WriteHeader(http.StatusCreated)
 		_ = json.NewEncoder(w).Encode(scaffold)
 	})
+	mux.HandleFunc("POST /v1/creator/development/gates", func(w http.ResponseWriter, r *http.Request) {
+		if _, ok := authenticateCreator(w, r); !ok {
+			return
+		}
+		var gate work.DevelopmentGate
+		decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10))
+		decoder.DisallowUnknownFields()
+		if err := decoder.Decode(&gate); err != nil {
+			http.Error(w, "invalid development gate", http.StatusBadRequest)
+			return
+		}
+		gate, err := prepareDevelopmentGate(gate, time.Now())
+		if err != nil {
+			http.Error(w, "development gate rejected", http.StatusUnprocessableEntity)
+			return
+		}
+		if err := workRepository.SaveDevelopmentGate(r.Context(), gate, 0); err != nil {
+			http.Error(w, "development gate conflict", http.StatusConflict)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusCreated)
+		_ = json.NewEncoder(w).Encode(gate)
+	})
+	mux.HandleFunc("POST /v1/creator/development/gates/{id}/advance", func(w http.ResponseWriter, r *http.Request) {
+		if _, ok := authenticateCreator(w, r); !ok {
+			return
+		}
+		var request struct {
+			ExpectedRevision int64                 `json:"expected_revision"`
+			NextStage        work.DevelopmentStage `json:"next_stage"`
+		}
+		decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 16<<10))
+		decoder.DisallowUnknownFields()
+		if err := decoder.Decode(&request); err != nil || request.ExpectedRevision < 1 || request.NextStage == "" {
+			http.Error(w, "invalid development gate transition", http.StatusBadRequest)
+			return
+		}
+		gate, err := workRepository.LoadDevelopmentGate(r.Context(), r.PathValue("id"))
+		if err != nil || gate.Revision != request.ExpectedRevision {
+			http.Error(w, "development gate revision conflict", http.StatusConflict)
+			return
+		}
+		gate, err = advanceDevelopmentGate(gate, request.NextStage, time.Now())
+		if err != nil {
+			http.Error(w, "development gate transition rejected", http.StatusUnprocessableEntity)
+			return
+		}
+		if err := workRepository.SaveDevelopmentGate(r.Context(), gate, request.ExpectedRevision); err != nil {
+			http.Error(w, "development gate conflict", http.StatusConflict)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(gate)
+	})
 	mux.HandleFunc("GET /v1/creator/focus", func(w http.ResponseWriter, r *http.Request) {
 		session, ok := authenticateCreator(w, r)
 		if !ok {

cmd/work-graph-runtime/main.go

@@ -61,6 +61,32 @@ func main() {
 		}
 		writeJSON(w, map[string]any{"graph": graph, "scheduled_nodes": ready})
 	})
+	mux.HandleFunc("POST /v1/work-graphs/orchestration/next", func(w http.ResponseWriter, r *http.Request) {
+		var request work.SolutionSearchInput
+		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 32<<10)).Decode(&request); err != nil {
+			http.Error(w, "invalid orchestration input", http.StatusBadRequest)
+			return
+		}
+		decision, err := application.DecideSolutionSearch(request)
+		if err != nil {
+			http.Error(w, "invalid orchestration input", http.StatusUnprocessableEntity)
+			return
+		}
+		writeJSON(w, decision)
+	})
+	mux.HandleFunc("POST /v1/work-graphs/orchestration/wave", func(w http.ResponseWriter, r *http.Request) {
+		var request work.SolutionSearchWaveRequest
+		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&request); err != nil {
+			http.Error(w, "invalid orchestration wave request", http.StatusBadRequest)
+			return
+		}
+		result, err := application.OrchestrateSolutionSearch(r.Context(), repository, request)
+		if err != nil {
+			http.Error(w, "invalid orchestration wave request", http.StatusUnprocessableEntity)
+			return
+		}
+		writeJSON(w, result)
+	})
 	mux.HandleFunc("POST /v1/work-graphs/complete", func(w http.ResponseWriter, r *http.Request) {
 		var request application.GraphCompleteRequest
 		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10)).Decode(&request); err != nil {

contracts/work/orchestration.go

@@ -0,0 +1,66 @@
+package work
+
+type OrchestrationState string
+type SearchOptionKind string
+
+const (
+	OrchestrationSearching OrchestrationState = "SEARCHING"
+	OrchestrationExecuting OrchestrationState = "EXECUTING"
+	OrchestrationVerifying OrchestrationState = "VERIFYING"
+	OrchestrationWaiting   OrchestrationState = "WAITING"
+	OrchestrationCompleted OrchestrationState = "COMPLETED"
+	OrchestrationCancelled OrchestrationState = "CANCELLED"
+
+	SearchOptionAgents     SearchOptionKind = "AGENT_TEAM"
+	SearchOptionCapability SearchOptionKind = "CAPABILITY_DISCOVERY"
+	SearchOptionResearch   SearchOptionKind = "TRUTH_RESEARCH"
+	SearchOptionReflection SearchOptionKind = "REFLECTION_MEMORY"
+	SearchOptionHuman      SearchOptionKind = "HUMAN_ATTENTION"
+)
+
+// SolutionSearchInput is the durable orchestration snapshot. The scheduler
+// stores the graph/goal separately; this value only decides the next bounded
+// search wave and never grants authority by itself.
+type SolutionSearchInput struct {
+	GoalID            GoalID
+	GoalState         GoalState
+	SearchRound       int
+	MaxRound          int
+	CancelRequested   bool
+	ActiveOptionCount int
+	VerificationReady bool
+	Unresolved        bool
+}
+
+type SolutionSearchDecision struct {
+	GoalID            GoalID
+	State             OrchestrationState
+	ContinueSearching bool
+	NextSearchRound   int
+	Options           []SearchOptionKind
+	Reason            string
+}
+
+type SolutionSearchWaveRequest struct {
+	Input               SolutionSearchInput      `json:"input"`
+	GraphID             string                   `json:"graph_id"`
+	IdempotencyPrefix   string                   `json:"idempotency_prefix"`
+	Dispatches          []SolutionSearchDispatch `json:"dispatches"`
+	Budget              GraphBudget              `json:"budget"`
+	ParentGraphID       string                   `json:"parent_graph_id,omitempty"`
+	ParentGraphRevision int64                    `json:"parent_graph_revision,omitempty"`
+	TriggerEvidenceRef  string                   `json:"trigger_evidence_ref,omitempty"`
+	NowUnixMillis       int64                    `json:"now_unix_millis"`
+}
+
+type SolutionSearchDispatch struct {
+	Option SearchOptionKind    `json:"option"`
+	Intent AgentDispatchIntent `json:"intent"`
+}
+
+type SolutionSearchWaveResult struct {
+	Decision          SolutionSearchDecision `json:"decision"`
+	Graph             WorkGraph              `json:"graph"`
+	ScheduledNodeIDs  []GraphNodeID          `json:"scheduled_node_ids,omitempty"`
+	GraphMaterialized bool                   `json:"graph_materialized"`
+}

dev/ACTIVE_TASK.json

@@ -1,5 +1,5 @@
 {
-  "task_file": "dev/tasks/DEV-000229-research-runtime-bridge.json",
-  "task_id": "DEV-000229",
+  "task_file": "dev/tasks/DEV-000232-durable-solution-wave-dispatch.json",
+  "task_id": "DEV-000232",
   "task_revision": 1
 }

dev/tasks/DEV-000230-development-gate-controller.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000230",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "ec79f19a7935e1eb8f0f59c4c9ce2940b97c4855",
+  "risk_tier": "E",
+  "intent": "Expose the existing Work-owned governed development state machine through authenticated optimistic-concurrency routes without executing code, changing protected source or bypassing promotion gates.",
+  "requirement_ids": ["governed self-development", "durable gate progression", "canary rollback control"],
+  "allowed_change_scope": {"modules": ["core-runtime", "governed-development"], "paths": ["cmd/core-runtime/main.go", "cmd/core-runtime/development_gate.go", "cmd/core-runtime/development_gate_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000230-development-gate-controller.json", "docs/PROJECT_STATUS.md"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "contracts/**", "database/**", "deploy/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["Work DevelopmentGate state machine", "authenticated Creator session", "optimistic revision persistence"], "may_change": ["authenticated Core gate controller routes"]},
+  "semantic_owner": "Work governed development gate",
+  "canonical_state": ["Work-owned development gate and existing proposal/scaffold records"],
+  "state_transitions": ["EVIDENCE_COLLECTED -> PROPOSAL_CREATED -> TASK_ADMITTED -> ISOLATED -> VERIFIED -> CANARY -> PROMOTED", "CANARY -> ROLLED_BACK"],
+  "side_effects_and_privileges": ["authenticated durable gate creation/transition only; no checkout, code execution, secret access, production mutation or automatic promotion"],
+  "persistence_and_migrations": ["none; existing development_gates table and repository are reused"],
+  "failure_retry_restart": ["optimistic revision conflict is explicit; invalid or skipped transitions are rejected; rollback remains available only from canary"],
+  "assumptions": ["Creator authentication is the explicit governance boundary for these operator routes", "actual worktree execution and deployment remain separate controlled systems"],
+  "acceptance_scenarios": ["gate creation requires evidence-collected revision one", "sequential transitions require their typed references", "verified cannot jump directly to promoted", "stale revision is rejected", "canary rollback is allowed", "unauthenticated requests are denied"],
+  "required_tests": ["go test ./cmd/core-runtime/...", "go vet ./cmd/core-runtime/...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000231-solution-orchestrator.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000231",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "45874f218646d7879dfcbc814782fe56bf0aa06a",
+  "risk_tier": "E",
+  "intent": "Provide a durable, parallel-first solution-search decision policy for Work Graph goals so unresolved work continues through independent agent, capability, research and reflection avenues instead of dead-ending after one bounded wave.",
+  "requirement_ids": ["solution orchestration", "parallel agent team", "durable retry waves", "independent verification"],
+  "allowed_change_scope": {"modules": ["work-graph", "work-domain"], "paths": ["contracts/work/orchestration.go", "modules/work/domain/orchestration.go", "modules/work/domain/orchestration_test.go", "modules/work/application/orchestration.go", "cmd/work-graph-runtime/main.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000231-solution-orchestrator.json", "docs/PROJECT_STATUS.md"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "LLM-local/**", "modules/work/secrets/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["Work Goal state", "durable Work Graph scheduling", "independent verification result"], "may_change": ["typed solution-search decision contract", "Work Graph orchestration decision endpoint"]},
+  "semantic_owner": "Work solution orchestration policy",
+  "canonical_state": ["existing Work Goal and Work Graph records; caller persists the returned wave decision"],
+  "state_transitions": ["SEARCHING -> EXECUTING -> VERIFYING -> COMPLETED", "SEARCHING -> WAITING -> SEARCHING", "any unresolved state -> next durable search wave", "any active state -> CANCELLED"],
+  "side_effects_and_privileges": ["pure policy decision and unauthenticated internal runtime route only; no provider call, secret access, code mutation, promotion or deployment"],
+  "persistence_and_migrations": ["none; this stage returns a typed decision for the existing durable scheduler"],
+  "failure_retry_restart": ["bounded wave exhaustion becomes WAITING with a new wave number and human-attention avenue; it is never represented as failure; cancellation and independently verified completion are terminal"],
+  "assumptions": ["the existing Work Graph dispatcher or next integration stage will persist the decision and fan out options", "model quality and provider routing remain separate capability decisions"],
+  "acceptance_scenarios": ["first unresolved goal selects all independent search avenues", "active wave remains EXECUTING", "exhausted wave continues with a higher durable round and human attention", "only cancellation or independently verified completion stops search", "invalid input is rejected", "the decision endpoint does not mutate source, secrets or production"],
+  "required_tests": ["go test ./modules/work/domain ./modules/work/application ./cmd/work-graph-runtime/...", "go vet ./modules/work/domain ./modules/work/application ./cmd/work-graph-runtime/...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000232-durable-solution-wave-dispatch.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000232",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "89694047b1e6c7729b00c20a52acb5a2487e6dd6",
+  "risk_tier": "E",
+  "intent": "Connect the solution-search policy to the existing durable Work Graph scheduler so each unresolved wave is materialized as parallel dispatch intents and queued nodes.",
+  "requirement_ids": ["durable solution waves", "parallel fan-out", "agent/reflex orchestration", "restartable scheduling"],
+  "allowed_change_scope": {"modules": ["work-graph", "work-domain"], "paths": ["contracts/work/orchestration.go", "modules/work/domain/orchestration.go", "modules/work/domain/orchestration_test.go", "modules/work/application/orchestration.go", "cmd/work-graph-runtime/main.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000232-durable-solution-wave-dispatch.json", "docs/PROJECT_STATUS.md"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "LLM-local/**", "modules/work/secrets/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["typed solution-search decision", "existing Work Graph and dispatch queue ports"], "may_change": ["solution-search wave materialization request/result", "Work Graph orchestration wave route"]},
+  "semantic_owner": "Work solution orchestration and Work Graph",
+  "canonical_state": ["existing work.graphs, graph_nodes, dispatch_intents and dispatch_queue stores"],
+  "state_transitions": ["policy SEARCHING/WAITING -> graph ADMITTED/RUNNING", "each option -> one queued dispatch node", "human attention remains decision metadata"],
+  "side_effects_and_privileges": ["durable Work-owned graph and queue writes only; no provider call, secret access, external mutation, promotion or deployment"],
+  "persistence_and_migrations": ["none; existing graph and queue tables are reused"],
+  "failure_retry_restart": ["existing queue idempotency and graph revision persistence govern restart; invalid wave shape is rejected; no unresolved goal is marked failed by wave exhaustion"],
+  "assumptions": ["dispatch intents are supplied by the upstream authority-aware planner", "provider/model selection and execution remain worker responsibilities"],
+  "acceptance_scenarios": ["four independent solution avenues materialize as four graph nodes", "all ready nodes are queued up to graph MaxParallel", "human attention is not silently executed as an agent", "terminal policy decisions do not create a graph", "invalid or duplicate options are rejected"],
+  "required_tests": ["go test ./modules/work/domain ./modules/work/application ./cmd/work-graph-runtime/...", "go vet ./modules/work/domain ./modules/work/application ./cmd/work-graph-runtime/...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

docs/PROJECT_STATUS.md

@@ -24,8 +24,8 @@
 
 - `COMPLETION_MATRIX = docs/evidence/audit-completion-matrix-2026-08-23-v3.json`; all seven objective areas are mapped to current repository/production proof, with external bridge, GPU promotion/quality and deep-acceptance gaps explicit.
 
-- `ACTIVE_TASK = dev/tasks/DEV-000229-research-runtime-bridge.json revision 1`; authenticated Core now has a bounded adapter route to the existing Truth/Research runtime. The epistemics owner remains responsible for persistence, freshness, citations and conflicts.
+- `ACTIVE_TASK = dev/tasks/DEV-000232-durable-solution-wave-dispatch.json revision 1`; the solution-search decision now materializes the next unresolved wave into the existing durable Work Graph and dispatch queue, preserving independent agent/capability/research/reflection directions. Provider selection, execution and result fan-in verification remain worker responsibilities.
 - `LINEAGE_DECISION = docs/GOVERNANCE_LINEAGE_DECISION_2026-08-22.md`; historical packets remain provenance and are not current authority.
 - `REGISTRY_STATUS = YAML and JSON semantic mirrors agree`
 - `PRODUCTION_DOMAIN = docker.cin.su`; shared docker-test is not used for this project.
-- `NEXT_WORK = qualify an independently operated Agent Execution bridge when available and complete deferred deep browser acceptance with a current signed-in session; retain local fallback and general-first task evaluation when either capability is unavailable.`
+- `NEXT_WORK = connect completed-wave callbacks to automatic replan/fan-in verification, then add bounded recovery of stale waves; retain local fallback, truth research and governed development gates.`

modules/work/application/orchestration.go

@@ -0,0 +1,39 @@
+package application
+
+import (
+	"context"
+	"git.cin.su/m/Assistant/contracts/work"
+	"git.cin.su/m/Assistant/modules/work/domain"
+	"git.cin.su/m/Assistant/modules/work/ports"
+	"time"
+)
+
+func DecideSolutionSearch(input work.SolutionSearchInput) (work.SolutionSearchDecision, error) {
+	return domain.DecideSolutionSearch(input)
+}
+
+func OrchestrateSolutionSearch(ctx context.Context, store ports.GraphStore, request work.SolutionSearchWaveRequest) (work.SolutionSearchWaveResult, error) {
+	decision, err := domain.DecideSolutionSearch(request.Input)
+	if err != nil {
+		return work.SolutionSearchWaveResult{}, err
+	}
+	result := work.SolutionSearchWaveResult{Decision: decision}
+	if !decision.ContinueSearching || decision.State == work.OrchestrationExecuting {
+		return result, nil
+	}
+	graph, intents, err := domain.BuildSolutionSearchWave(decision, request)
+	if err != nil {
+		return work.SolutionSearchWaveResult{}, err
+	}
+	if request.NowUnixMillis < 1 {
+		request.NowUnixMillis = time.Now().UnixMilli()
+	}
+	graph, ready, err := AdmitAndSchedule(ctx, store, GraphScheduleRequest{Graph: graph, Intents: intents, Now: request.NowUnixMillis})
+	if err != nil {
+		return work.SolutionSearchWaveResult{}, err
+	}
+	result.Graph = graph
+	result.ScheduledNodeIDs = ready
+	result.GraphMaterialized = true
+	return result, nil
+}

modules/work/domain/orchestration.go

@@ -0,0 +1,91 @@
+package domain
+
+import (
+	"errors"
+	"fmt"
+	"git.cin.su/m/Assistant/contracts/work"
+)
+
+var ErrInvalidSolutionSearch = errors.New("invalid solution search input")
+
+// DecideSolutionSearch keeps an unresolved goal alive across bounded waves.
+// A wave has limits, but an unresolved goal is never converted into FAILED
+// merely because one wave is exhausted. The caller persists the decision and
+// schedules the next wave through the durable Work Graph.
+func DecideSolutionSearch(input work.SolutionSearchInput) (work.SolutionSearchDecision, error) {
+	if input.GoalID == "" || input.SearchRound < 0 || input.MaxRound < 1 || input.ActiveOptionCount < 0 {
+		return work.SolutionSearchDecision{}, ErrInvalidSolutionSearch
+	}
+	decision := work.SolutionSearchDecision{GoalID: input.GoalID, NextSearchRound: input.SearchRound}
+	if input.CancelRequested || input.GoalState == work.GoalCancelled {
+		decision.State = work.OrchestrationCancelled
+		decision.Reason = "goal cancellation is durable and stops further search waves"
+		return decision, nil
+	}
+	if input.GoalState == work.GoalCompleted && input.VerificationReady {
+		decision.State = work.OrchestrationCompleted
+		decision.Reason = "goal has an independently verified accepted result"
+		return decision, nil
+	}
+	if input.ActiveOptionCount > 0 {
+		decision.State = work.OrchestrationExecuting
+		decision.ContinueSearching = true
+		decision.Options = []work.SearchOptionKind{work.SearchOptionAgents}
+		decision.Reason = "current solution wave is still running"
+		return decision, nil
+	}
+	decision.State = work.OrchestrationSearching
+	decision.ContinueSearching = true
+	decision.NextSearchRound++
+	decision.Options = []work.SearchOptionKind{work.SearchOptionAgents, work.SearchOptionCapability, work.SearchOptionResearch, work.SearchOptionReflection}
+	if input.Unresolved {
+		decision.Reason = "previous wave did not establish a verified solution; start all independent search avenues"
+	} else {
+		decision.Reason = "no verified result exists; start the first parallel solution wave"
+	}
+	if input.SearchRound >= input.MaxRound {
+		decision.State = work.OrchestrationWaiting
+		decision.Options = append(decision.Options, work.SearchOptionHuman)
+		decision.Reason = "bounded wave budget exhausted; continue with a new durable wave and human attention, never claim failure"
+	}
+	return decision, nil
+}
+
+var ErrInvalidSolutionSearchWave = errors.New("invalid solution search wave")
+
+// BuildSolutionSearchWave turns a policy decision into a durable Work Graph
+// fan-out. Human attention remains in the decision but is not an agent dispatch.
+func BuildSolutionSearchWave(decision work.SolutionSearchDecision, request work.SolutionSearchWaveRequest) (work.WorkGraph, []work.AgentDispatchIntent, error) {
+	if !decision.ContinueSearching || (decision.State != work.OrchestrationSearching && decision.State != work.OrchestrationWaiting) || request.GraphID == "" || request.IdempotencyPrefix == "" || request.Budget.MaxParallel < 1 || request.Budget.MaxAttempts < 1 {
+		return work.WorkGraph{}, nil, ErrInvalidSolutionSearchWave
+	}
+	seen := make(map[work.SearchOptionKind]struct{}, len(request.Dispatches))
+	nodes := make([]work.GraphNode, 0, len(request.Dispatches))
+	intents := make([]work.AgentDispatchIntent, 0, len(request.Dispatches))
+	for index, dispatch := range request.Dispatches {
+		if dispatch.Option == work.SearchOptionHuman || dispatch.Option == "" || dispatch.Intent.DispatchID == "" || dispatch.Intent.IdempotencyKey == "" {
+			return work.WorkGraph{}, nil, ErrInvalidSolutionSearchWave
+		}
+		if _, exists := seen[dispatch.Option]; exists || !containsSearchOption(decision.Options, dispatch.Option) {
+			return work.WorkGraph{}, nil, ErrInvalidSolutionSearchWave
+		}
+		seen[dispatch.Option] = struct{}{}
+		intent := dispatch.Intent
+		intent.SpecialistPurpose = string(dispatch.Option)
+		intents = append(intents, intent)
+		nodes = append(nodes, work.GraphNode{ID: work.GraphNodeID(fmt.Sprintf("%s-node-%d", request.GraphID, index+1)), DispatchID: intent.DispatchID, IdempotencyKey: fmt.Sprintf("%s:%s:%d", request.IdempotencyPrefix, dispatch.Option, decision.NextSearchRound), State: work.GraphNodeBlocked, Purpose: work.GraphNodePurposeGeneric})
+	}
+	if len(nodes) == 0 {
+		return work.WorkGraph{}, nil, ErrInvalidSolutionSearchWave
+	}
+	return work.WorkGraph{ID: request.GraphID, Revision: 1, State: work.GraphDraft, Nodes: nodes, Budget: request.Budget, ParentGraphID: request.ParentGraphID, ParentGraphRevision: request.ParentGraphRevision, TriggerEvidenceRef: request.TriggerEvidenceRef}, intents, nil
+}
+
+func containsSearchOption(options []work.SearchOptionKind, target work.SearchOptionKind) bool {
+	for _, option := range options {
+		if option == target {
+			return true
+		}
+	}
+	return false
+}

modules/work/domain/orchestration_test.go

@@ -0,0 +1,59 @@
+package domain
+
+import (
+	"fmt"
+	"git.cin.su/m/Assistant/contracts/work"
+	"testing"
+)
+
+func TestSolutionSearchDoesNotDeadEndAfterBudgetedWave(t *testing.T) {
+	decision, err := DecideSolutionSearch(work.SolutionSearchInput{GoalID: "goal-1", GoalState: work.GoalInProgress, SearchRound: 3, MaxRound: 3, Unresolved: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !decision.ContinueSearching || decision.State != work.OrchestrationWaiting || decision.NextSearchRound != 4 {
+		t.Fatalf("unexpected exhausted-wave decision: %#v", decision)
+	}
+	if len(decision.Options) != 5 || decision.Options[4] != work.SearchOptionHuman {
+		t.Fatalf("all search avenues were not retained: %#v", decision.Options)
+	}
+}
+
+func TestSolutionSearchStopsOnlyForCancelOrVerifiedCompletion(t *testing.T) {
+	completed, err := DecideSolutionSearch(work.SolutionSearchInput{GoalID: "goal-1", GoalState: work.GoalCompleted, VerificationReady: true, MaxRound: 1})
+	if err != nil || completed.ContinueSearching || completed.State != work.OrchestrationCompleted {
+		t.Fatalf("verified completion was not terminal: %#v %v", completed, err)
+	}
+	cancelled, err := DecideSolutionSearch(work.SolutionSearchInput{GoalID: "goal-1", GoalState: work.GoalInProgress, CancelRequested: true, MaxRound: 1})
+	if err != nil || cancelled.ContinueSearching || cancelled.State != work.OrchestrationCancelled {
+		t.Fatalf("cancel was not terminal: %#v %v", cancelled, err)
+	}
+}
+
+func TestBuildSolutionSearchWaveMaterializesParallelAgentDirections(t *testing.T) {
+	decision, err := DecideSolutionSearch(work.SolutionSearchInput{GoalID: "goal-1", GoalState: work.GoalInProgress, MaxRound: 1})
+	if err != nil {
+		t.Fatal(err)
+	}
+	options := []work.SearchOptionKind{work.SearchOptionAgents, work.SearchOptionCapability, work.SearchOptionResearch, work.SearchOptionReflection}
+	dispatches := make([]work.SolutionSearchDispatch, 0, len(options))
+	for i, option := range options {
+		dispatches = append(dispatches, work.SolutionSearchDispatch{Option: option, Intent: work.AgentDispatchIntent{DispatchID: workDispatchID(i), IdempotencyKey: workDispatchID(i) + ":idem"}})
+	}
+	graph, intents, err := BuildSolutionSearchWave(decision, work.SolutionSearchWaveRequest{GraphID: "graph-1", IdempotencyPrefix: "goal-1", Dispatches: dispatches, Budget: work.GraphBudget{MaxParallel: 4, MaxAttempts: 2}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(graph.Nodes) != 4 || len(intents) != 4 || graph.State != work.GraphDraft {
+		t.Fatalf("unexpected materialized wave: %#v %#v", graph, intents)
+	}
+	for i, node := range graph.Nodes {
+		if node.State != work.GraphNodeBlocked || intents[i].SpecialistPurpose != string(options[i]) {
+			t.Fatalf("wave direction not preserved: node=%#v intent=%#v", node, intents[i])
+		}
+	}
+}
+
+func workDispatchID(index int) string {
+	return fmt.Sprintf("dispatch-%d", index)
+}