docs(fleet): record CPU to lifeboat failover

fix(cognitive): resolve providers by stable instance identity

cmd/cognitive-worker/gateway.go

@@ -298,12 +298,21 @@ func fallbackEligible(reason cognitive.FinishReason) bool {
 }
 
 func (g cognitiveGateway) provider(selected capability.ResolvedCognitiveBinding) advisoryProvider {
+	var byStableID advisoryProvider
 	for _, registration := range g.providers[selected.Provider.Kind] {
 		if registration.EndpointRef == selected.Provider.EndpointRef && registration.CredentialRef == selected.Provider.CredentialRef {
 			return registration.Provider
 		}
+		// Capability revisions can legitimately retain an older credential
+		// reference while the protected runtime has rotated or reloaded the
+		// current credential. ProviderInstanceID is the stable owner identity;
+		// use it after exact metadata matching so stale non-secret metadata does
+		// not force an unnecessary builtin fallback.
+		if byStableID == nil && registration.ProviderInstanceID == selected.Provider.ID && registration.Kind == selected.Provider.Kind {
+			byStableID = registration.Provider
+		}
 	}
-	return nil
+	return byStableID
 }
 
 func writeGatewayResponse(w http.ResponseWriter, response cognitive.GatewayAdvisoryResponse) {

cmd/cognitive-worker/gateway_registry_test.go

@@ -88,6 +88,19 @@ func TestActiveRegistryBindingReachesProviderAdapter(t *testing.T) {
 	}
 }
 
+func TestProviderUsesStableInstanceWhenCredentialMetadataIsStale(t *testing.T) {
+	provider := &stubAdvisoryProvider{}
+	gateway := cognitiveGateway{providers: map[capability.ProviderKind][]providerRegistration{
+		"provider-kind-1": {{ProviderInstanceID: "provider-1", Kind: "provider-kind-1", EndpointRef: "current-endpoint", CredentialRef: "current-credential", Provider: provider}},
+	}}
+	selected := gatewaySelection()
+	selected.Provider.EndpointRef = "old-endpoint"
+	selected.Provider.CredentialRef = ""
+	if got := gateway.provider(selected); got != provider {
+		t.Fatalf("stable provider identity was not used for stale metadata")
+	}
+}
+
 func TestCanaryFlagIsForwardedToCapabilityResolver(t *testing.T) {
 	registry := &registryStub{err: errors.New("stop after resolve")}
 	gateway := cognitiveGateway{resolver: registry, providers: map[capability.ProviderKind][]providerRegistration{}, now: time.Now, allowCanary: true}

cmd/cognitive-worker/model_qualification.go

@@ -89,7 +89,7 @@ func qualifyModels(ctx context.Context, registration providerRegistration, owner
 		go func(index int, model models.DiscoveredModel) {
 			defer wg.Done()
 			started := time.Now()
-			request := cognitive.AdvisoryRequest{Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(fmt.Sprintf("qualification:%s:%d", model.ProviderModelID, started.UnixNano())), ActorID: identity.ActorID("qualification-runtime"), PrincipalID: identity.PrincipalID(owner), ScopeID: authority.ScopeID("qualification-scope"), Message: prompt, MaxOutputBytes: maxOutputBytes, ProviderBindingID: "qualification-binding-v1", ProviderBindingRevision: 1, ProviderInstanceID: registration.ProviderInstanceID, ModelDescriptorID: capability.ModelDescriptorID("qualification-" + string(model.ProviderModelID)), ProviderModelID: model.ProviderModelID}
+			request := cognitive.AdvisoryRequest{Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(fmt.Sprintf("qualification:%s:%d", model.ProviderModelID, started.UnixNano())), ActorID: identity.ActorID("qualification-runtime"), PrincipalID: identity.PrincipalID(owner), ScopeID: authority.ScopeID("qualification-scope"), Message: prompt, Locale: "en-US", MaxOutputBytes: maxOutputBytes, ProviderBindingID: "qualification-binding-v1", ProviderBindingRevision: 1, ProviderInstanceID: registration.ProviderInstanceID, ModelDescriptorID: capability.ModelDescriptorID("qualification-" + string(model.ProviderModelID)), ProviderModelID: model.ProviderModelID}
 			response, err := registration.Provider.Advise(ctx, request)
 			result := modelQualificationResult{ProviderModelID: model.ProviderModelID, LatencyMillis: time.Since(started).Milliseconds(), QualityAssessed: false, Category: capability.ModelRatingUnrated}
 			if err != nil {

cmd/cognitive-worker/model_qualification_test.go

@@ -21,6 +21,9 @@ func (qualificationProvider) Discover(context.Context) ([]models.DiscoveredModel
 	return []models.DiscoveredModel{{ProviderModelID: "model-a"}, {ProviderModelID: "model-b"}}, models.ProviderProbe{Health: capability.HealthAvailable}
 }
 func (qualificationProvider) Advise(_ context.Context, request cognitive.AdvisoryRequest) (cognitive.AdvisoryResponse, error) {
+	if err := models.ValidateAdvisoryRequest(request); err != nil {
+		return cognitive.AdvisoryResponse{}, err
+	}
 	return cognitive.AdvisoryResponse{Version: request.Version, RequestID: request.RequestID, AdvisoryText: "reachable", FinishReason: cognitive.FinishCompleted}, nil
 }
 

dev/ACTIVE_TASK.json

@@ -1,5 +1,5 @@
 {
-  "task_file": "dev/tasks/DEV-000235-model-qualification-probe.json",
-  "task_id": "DEV-000235",
+  "task_file": "dev/tasks/DEV-000240-cpu-lifeboat-failover-evidence.json",
+  "task_id": "DEV-000240",
   "task_revision": 1
 }

dev/tasks/DEV-000236-qualification-locale-fix.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000236",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "risk_tier": "E",
+  "base_repo_revision": "b20611590a075e3574efddbdba6e1ace312d11a8",
+  "intent": "Make the bounded model qualification invocation satisfy the canonical advisory contract and keep a regression test for the required locale.",
+  "requirement_ids": ["model qualification smoke", "advisory contract"],
+  "allowed_change_scope": {"modules": ["cognitive-worker"], "paths": ["cmd/cognitive-worker/model_qualification.go", "cmd/cognitive-worker/model_qualification_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000236-qualification-locale-fix.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "LLM-local/**", "modules/work/secrets/**", "contracts/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["Creator advisory request validation"], "may_change": []},
+  "semantic_owner": "Cognitive worker qualification observation",
+  "canonical_state": ["none; qualification remains an operational observation"],
+  "state_transitions": ["invalid advisory invocation -> valid bounded invocation"],
+  "side_effects_and_privileges": ["read-only bounded provider invocation; no promotion or routing mutation"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["one bounded probe failure remains isolated"],
+  "assumptions": ["provider credentials remain protected inside cognitive-worker"],
+  "acceptance_scenarios": ["live qualification invocation passes advisory validation", "quality remains UNRATED"],
+  "required_tests": ["go test ./cmd/cognitive-worker/...", "go vet ./cmd/cognitive-worker/...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000237-ui-authenticated-section-smoke.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000237",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "be01b6b883c2ce6e9bb47bc851505fe222c46d14",
+  "risk_tier": "E",
+  "intent": "Record current authenticated quick acceptance for the five creator-console sections without mutating production state.",
+  "requirement_ids": ["WP-800", "WP-804", "authenticated UI quick acceptance"],
+  "allowed_change_scope": {"modules": ["creator-web", "evidence"], "paths": ["docs/evidence/authenticated-ui-section-smoke-2026-08-23-v1.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000237-ui-authenticated-section-smoke.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "LLM-local/**", "modules/work/secrets/**", "contracts/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["authenticated creator-console UI"], "may_change": []},
+  "semantic_owner": "Creator-web acceptance evidence",
+  "canonical_state": ["evidence only; no runtime state mutation"],
+  "state_transitions": ["unverified current section -> observed authenticated quick acceptance"],
+  "side_effects_and_privileges": ["read-only browser inspection; no mutation"],
+  "persistence_and_migrations": ["evidence artifact only"],
+  "failure_retry_restart": ["recheck is idempotent and does not change product state"],
+  "assumptions": ["the authenticated browser session belongs to the authorized creator"],
+  "acceptance_scenarios": ["five admin sections load authenticated", "no visible section error is present", "full mobile/accessibility/chaos acceptance remains explicitly unclaimed"],
+  "required_tests": ["go test ./cmd/creator-web/...", "go vet ./cmd/creator-web/...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "independent", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000238-local-fallback-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000238",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "0609561dfefb6dce302f56d50bb56bd5a222fb64",
+  "risk_tier": "E",
+  "intent": "Record a bounded live proof that the advisory gateway keeps a local lifeboat path when the normal model route cannot be used.",
+  "requirement_ids": ["Agent Execution local recovery", "model fleet fallback", "false completion prevention"],
+  "allowed_change_scope": {"modules": ["evidence"], "paths": ["docs/evidence/local-fallback-gateway-live-2026-08-23-v1.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000238-local-fallback-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "LLM-local/**", "modules/work/secrets/**", "contracts/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["creator advisory gateway", "durable cognitive usage observation"], "may_change": []},
+  "semantic_owner": "Evidence only",
+  "canonical_state": ["no runtime state mutation; read-only evidence capture"],
+  "state_transitions": ["normal route unavailable or not eligible -> builtin local lifeboat response"],
+  "side_effects_and_privileges": ["bounded local advisory request; no external egress and no secret exposure"],
+  "persistence_and_migrations": ["existing cognitive usage observation only"],
+  "failure_retry_restart": ["live request is bounded and idempotent in effect"],
+  "assumptions": ["the production database observation is the authoritative route attribution"],
+  "acceptance_scenarios": ["local response is COMPLETED", "usage evidence identifies builtin-local-lifeboat-v1", "no claim of external bridge or multi-model failover"],
+  "required_tests": ["go test ./cmd/core-runtime/...", "go vet ./cmd/core-runtime/...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "independent", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000239-stable-provider-resolution.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000239",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "6061eb5c13e46cec1e60fc104b022394f0d94dee",
+  "risk_tier": "E",
+  "intent": "Resolve a registered provider by its stable instance identity when a persisted Capability revision contains stale non-secret endpoint credential metadata, while preserving exact metadata matching first.",
+  "requirement_ids": ["model fleet/failover", "credential rotation compatibility", "local fallback attribution"],
+  "allowed_change_scope": {"modules": ["cognitive-worker"], "paths": ["cmd/cognitive-worker/gateway.go", "cmd/cognitive-worker/gateway_registry_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000239-stable-provider-resolution.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "LLM-local/**", "modules/work/secrets/**", "contracts/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["Capability ResolvedCognitiveBinding", "protected provider registration"], "may_change": ["internal provider lookup fallback order"]},
+  "semantic_owner": "Cognitive worker provider adapter boundary",
+  "canonical_state": ["no new durable state"],
+  "state_transitions": ["exact provider metadata match -> stable provider identity match -> no provider"],
+  "side_effects_and_privileges": ["provider lookup only; secret values remain in protected runtime"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["missing provider remains explicit and uses existing builtin fallback"],
+  "assumptions": ["ProviderInstanceID is the stable Capability-owned provider identity"],
+  "acceptance_scenarios": ["stale credential metadata still reaches current registered adapter", "exact metadata match retains priority", "no provider remains nil"],
+  "required_tests": ["go test ./cmd/cognitive-worker/...", "go vet ./cmd/cognitive-worker/...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "independent", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000240-cpu-lifeboat-failover-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000240",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "383d4c6e4fd53bb0c34ed358e0d1be6a416da6cc",
+  "risk_tier": "E",
+  "intent": "Record live durable evidence of CPU model failure followed by successful local Lifeboat failover after stable provider resolution was deployed.",
+  "requirement_ids": ["model fleet/failover", "durable usage evidence", "false completion prevention"],
+  "allowed_change_scope": {"modules": ["evidence"], "paths": ["docs/evidence/cpu-lifeboat-failover-2026-08-23-v1.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000240-cpu-lifeboat-failover-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "LLM-local/**", "modules/work/secrets/**", "contracts/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["cognitive advisory gateway", "cognitive usage observations"], "may_change": []},
+  "semantic_owner": "Evidence only",
+  "canonical_state": ["no runtime state mutation; evidence captures existing durable observations"],
+  "state_transitions": ["CPU MODEL_UNAVAILABLE -> builtin local Lifeboat COMPLETED"],
+  "side_effects_and_privileges": ["bounded LOCAL_ONLY advisory request; no external egress"],
+  "persistence_and_migrations": ["existing usage observation persistence only"],
+  "failure_retry_restart": ["the fallback is selected within the bounded gateway request"],
+  "assumptions": ["provider_instance_id and result_class in capability usage observations are authoritative route attribution"],
+  "acceptance_scenarios": ["primary failure is durably observed", "fallback completion is durably observed", "HTTP gateway returns COMPLETED", "public health remains OK"],
+  "required_tests": ["go test ./cmd/cognitive-worker/...", "go vet ./cmd/cognitive-worker/...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "independent", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

docs/evidence/authenticated-ui-section-smoke-2026-08-23-v1.json

@@ -0,0 +1,18 @@
+{
+  "evidence_id": "authenticated-ui-section-smoke-2026-08-23-v1",
+  "observed_at": "2026-08-23",
+  "source": "current authenticated in-app browser session against https://assistant.cin.su/admin",
+  "production_revision_checked": "be01b6b883c2ce6e9bb47bc851505fe222c46d14",
+  "authenticated": true,
+  "sections": {
+    "overview": {"loaded": true, "expected_regions": ["Сводка состояния", "Подтвердить исполнение"], "visible_error_count": 0},
+    "diagnostics": {"loaded": true, "expected_regions": ["Диагностика кабинета", "Спросить Домового"], "visible_error_count": 0},
+    "operations": {"loaded": true, "expected_regions": ["Реестр ожиданий", "Модели и fallback", "Агентская работа", "Журнал действий"], "visible_error_count": 0},
+    "learning": {"loaded": true, "expected_regions": ["Опыт и reflection", "Experience", "Reflection", "Skills"], "visible_error_count": 0},
+    "settings": {"loaded": true, "expected_regions": ["Настройки рабочего кабинета"], "visible_error_count": 0}
+  },
+  "mutations_performed": false,
+  "secrets_exposed": false,
+  "status": "AUTHENTICATED_QUICK_SECTION_SMOKE_PASS",
+  "not_proven": ["full mobile and accessibility acceptance", "offline/session-expiry acceptance", "delegation-specific mutation", "external bridge availability"]
+}

docs/evidence/cpu-lifeboat-failover-2026-08-23-v1.json

@@ -0,0 +1,15 @@
+{
+  "evidence_id": "cpu-lifeboat-failover-2026-08-23-v1",
+  "observed_at": "2026-08-23",
+  "production_revision": "383d4c6e4fd53bb0c34ed358e0d1be6a416da6cc",
+  "request": {"surface": "internal cognitive-worker advisory gateway", "data_policy": "LOCAL_ONLY", "max_output_bytes": 128, "prompt_class": "bounded readiness response"},
+  "http_result": {"status": 200, "finish_reason": "COMPLETED", "output_observed": true},
+  "durable_route_observations": [
+    {"provider_instance_id": "local-cpu-primary", "result_class": "MODEL_UNAVAILABLE", "failure_type": "MODEL_UNAVAILABLE", "latency_millis": 580},
+    {"provider_instance_id": "builtin-local-lifeboat-v1", "result_class": "COMPLETED", "failure_type": null, "latency_millis": 455}
+  ],
+  "public_health": {"url": "https://assistant.cin.su/healthz", "status": 200, "runtime": "creator-web"},
+  "status": "CPU_TO_LIFEBOAT_FAILOVER_LIVE_PASS",
+  "secrets_exposed": false,
+  "remaining": ["medium/GPU validated multi-model failover", "quality-based promotion", "long-running failover and restart chaos"]
+}

docs/evidence/local-fallback-gateway-live-2026-08-23-v1.json

@@ -0,0 +1,12 @@
+{
+  "evidence_id": "local-fallback-gateway-live-2026-08-23-v1",
+  "observed_at": "2026-08-23",
+  "production_revision": "0609561dfefb6dce302f56d50bb56bd5a222fb64",
+  "request": {"surface": "internal cognitive-worker advisory gateway", "data_policy": "LOCAL_ONLY", "max_output_bytes": 128, "prompt_class": "bounded readiness response"},
+  "http_result": {"status": 200, "finish_reason": "COMPLETED", "output_observed": true, "output_content": "готов"},
+  "durable_usage_observation": {"provider_instance_id": "builtin-local-lifeboat-v1", "model_descriptor_id": "builtin-local-model-v1", "result_class": "COMPLETED", "failure_type": null, "latency_millis": 665},
+  "status": "LOCAL_FALLBACK_LIVE_PASS",
+  "proves": ["local lifeboat path can answer when normal route is not eligible", "completion is durably attributed to the local fallback"],
+  "does_not_prove": ["external Agent Execution bridge", "multi-model failover between validated provider bindings", "GPU quality or promotion", "long-running recovery"],
+  "secrets_exposed": false
+}