Improve price research queries

Merge PR #276: fix production creator chat timeout

adapters/developmentexecutor/executor.go

@@ -0,0 +1,197 @@
+// Package developmentexecutor contains the local, read-only verification
+// adapter for governed development candidates. It is deliberately not a
+// source mutator, promotion authority, secret resolver, or deployment tool.
+package developmentexecutor
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+type CheckKind string
+
+const (
+	CheckGoTest       CheckKind = "GO_TEST"
+	CheckGoVet        CheckKind = "GO_VET"
+	CheckGitDiffCheck CheckKind = "GIT_DIFF_CHECK"
+)
+
+type Check struct {
+	Kind     CheckKind
+	Packages []string
+}
+
+type Plan struct {
+	Worktree            string
+	WorktreeID          string
+	BaseRepoRevision    string
+	ProtectedMainAccess string
+	ProductionAccess    string
+	SecretAccess        string
+	Checks              []Check
+}
+
+type CheckResult struct {
+	Kind           CheckKind `json:"kind"`
+	Passed         bool      `json:"passed"`
+	ExitCode       int       `json:"exit_code"`
+	DurationMillis int64     `json:"duration_millis"`
+}
+
+type Result struct {
+	WorktreeID       string        `json:"worktree_id"`
+	BaseRepoRevision string        `json:"base_repo_revision"`
+	Passed           bool          `json:"passed"`
+	Checks           []CheckResult `json:"checks"`
+	EvidenceRef      string        `json:"evidence_ref"`
+}
+
+var (
+	ErrInvalidPlan       = errors.New("invalid governed verification plan")
+	ErrUnsupportedCheck  = errors.New("unsupported governed verification check")
+	ErrProtectedWorktree = errors.New("protected worktree is not executable")
+)
+
+type CommandRunner interface {
+	Run(context.Context, string, string, []string) int
+}
+
+type OSCommandRunner struct{}
+
+func (OSCommandRunner) Run(ctx context.Context, dir, name string, args []string) int {
+	command := exec.CommandContext(ctx, name, args...)
+	command.Dir = dir
+	command.Stdin = nil
+	command.Stdout = io.Discard
+	command.Stderr = io.Discard
+	command.Env = safeEnvironment()
+	if err := command.Run(); err != nil {
+		if exitErr, ok := err.(*exec.ExitError); ok {
+			return exitErr.ExitCode()
+		}
+		return -1
+	}
+	return 0
+}
+
+func ValidatePlan(plan Plan) error {
+	if strings.TrimSpace(plan.Worktree) == "" || strings.TrimSpace(plan.WorktreeID) == "" || strings.TrimSpace(plan.BaseRepoRevision) == "" || len(plan.Checks) == 0 {
+		return ErrInvalidPlan
+	}
+	if !filepath.IsAbs(plan.Worktree) {
+		return ErrInvalidPlan
+	}
+	if plan.ProtectedMainAccess != "DENIED" || plan.ProductionAccess != "DENIED" || plan.SecretAccess != "DENIED" {
+		return ErrProtectedWorktree
+	}
+	switch strings.ToLower(filepath.Base(filepath.Clean(plan.WorktreeID))) {
+	case "main", "protected-main", "production":
+		return ErrProtectedWorktree
+	}
+	for _, check := range plan.Checks {
+		if err := validateCheck(check); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateCheck(check Check) error {
+	switch check.Kind {
+	case CheckGoTest, CheckGoVet:
+		if len(check.Packages) == 0 {
+			return ErrInvalidPlan
+		}
+		for _, packagePath := range check.Packages {
+			if strings.TrimSpace(packagePath) == "" || strings.ContainsAny(packagePath, ";&|`$()<>\r\n") || unsafePackagePath(packagePath) {
+				return ErrInvalidPlan
+			}
+		}
+	case CheckGitDiffCheck:
+		if len(check.Packages) != 0 {
+			return ErrInvalidPlan
+		}
+	default:
+		return ErrUnsupportedCheck
+	}
+	return nil
+}
+
+func unsafePackagePath(value string) bool {
+	value = strings.ReplaceAll(value, "\\", "/")
+	for _, part := range strings.Split(value, "/") {
+		if part == ".." {
+			return true
+		}
+	}
+	return strings.HasPrefix(value, "../") || strings.HasPrefix(value, "/") || (len(value) > 1 && value[1] == ':')
+}
+
+func Execute(ctx context.Context, plan Plan, runner CommandRunner) (Result, error) {
+	if err := ValidatePlan(plan); err != nil {
+		return Result{}, err
+	}
+	if runner == nil {
+		runner = OSCommandRunner{}
+	}
+	if _, err := os.Stat(plan.Worktree); err != nil {
+		return Result{}, fmt.Errorf("worktree unavailable: %w", err)
+	}
+	result := Result{WorktreeID: plan.WorktreeID, BaseRepoRevision: plan.BaseRepoRevision, Passed: true, Checks: make([]CheckResult, 0, len(plan.Checks))}
+	for _, check := range plan.Checks {
+		started := time.Now()
+		name, args := commandFor(check)
+		exitCode := runner.Run(ctx, plan.Worktree, name, args)
+		passed := exitCode == 0
+		result.Checks = append(result.Checks, CheckResult{Kind: check.Kind, Passed: passed, ExitCode: exitCode, DurationMillis: time.Since(started).Milliseconds()})
+		if !passed {
+			result.Passed = false
+		}
+		if ctx.Err() != nil {
+			result.Passed = false
+			break
+		}
+	}
+	result.EvidenceRef = evidenceRef(result)
+	return result, nil
+}
+
+func commandFor(check Check) (string, []string) {
+	switch check.Kind {
+	case CheckGoTest:
+		return "go", append([]string{"test"}, check.Packages...)
+	case CheckGoVet:
+		return "go", append([]string{"vet"}, check.Packages...)
+	default:
+		return "git", []string{"diff", "--check"}
+	}
+}
+
+func evidenceRef(result Result) string {
+	hash := sha256.New()
+	_, _ = fmt.Fprintf(hash, "%s|%s|%t|", result.WorktreeID, result.BaseRepoRevision, result.Passed)
+	for _, check := range result.Checks {
+		_, _ = fmt.Fprintf(hash, "%s|%t|%d|", check.Kind, check.Passed, check.ExitCode)
+	}
+	return "verification:" + hex.EncodeToString(hash.Sum(nil))
+}
+
+func safeEnvironment() []string {
+	allowed := []string{"PATH", "SystemRoot", "TEMP", "TMP", "GOROOT", "GOPATH", "GOMODCACHE"}
+	result := make([]string, 0, len(allowed))
+	for _, name := range allowed {
+		if value, ok := os.LookupEnv(name); ok && value != "" {
+			result = append(result, name+"="+value)
+		}
+	}
+	return result
+}

adapters/developmentexecutor/executor_test.go

@@ -0,0 +1,70 @@
+package developmentexecutor
+
+import (
+	"context"
+	"errors"
+	"path/filepath"
+	"testing"
+)
+
+type fakeRunner struct {
+	calls []string
+	exits []int
+}
+
+func (r *fakeRunner) Run(_ context.Context, _ string, name string, args []string) int {
+	call := name
+	for _, arg := range args {
+		call += " " + arg
+	}
+	r.calls = append(r.calls, call)
+	if len(r.exits) == 0 {
+		return 0
+	}
+	exit := r.exits[0]
+	r.exits = r.exits[1:]
+	return exit
+}
+
+func validPlan(t *testing.T) Plan {
+	t.Helper()
+	worktree, err := filepath.Abs(".")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return Plan{Worktree: worktree, WorktreeID: "sandbox-1", BaseRepoRevision: "revision-1", ProtectedMainAccess: "DENIED", ProductionAccess: "DENIED", SecretAccess: "DENIED", Checks: []Check{{Kind: CheckGoTest, Packages: []string{"./modules/work/..."}}, {Kind: CheckGoVet, Packages: []string{"./modules/work/..."}}, {Kind: CheckGitDiffCheck}}}
+}
+
+func TestExecuteRunsOnlyTypedChecksAndReturnsEvidence(t *testing.T) {
+	runner := &fakeRunner{}
+	result, err := Execute(context.Background(), validPlan(t), runner)
+	if err != nil || !result.Passed || len(result.Checks) != 3 || result.EvidenceRef == "" {
+		t.Fatalf("result=%+v err=%v", result, err)
+	}
+	if len(runner.calls) != 3 || runner.calls[0] != "go test ./modules/work/..." || runner.calls[2] != "git diff --check" {
+		t.Fatalf("calls=%v", runner.calls)
+	}
+}
+
+func TestExecuteFailureCannotBecomeVerificationSuccess(t *testing.T) {
+	runner := &fakeRunner{exits: []int{1, 0}}
+	plan := validPlan(t)
+	plan.Checks = []Check{{Kind: CheckGoTest, Packages: []string{"./..."}}, {Kind: CheckGitDiffCheck}}
+	result, err := Execute(context.Background(), plan, runner)
+	if err != nil || result.Passed || result.Checks[0].Passed || result.EvidenceRef == "" {
+		t.Fatalf("failed result was overclaimed: %+v err=%v", result, err)
+	}
+}
+
+func TestValidatePlanRejectsProtectedAndShellLikeInputs(t *testing.T) {
+	protected := validPlan(t)
+	protected.WorktreeID = "production"
+	if !errors.Is(ValidatePlan(protected), ErrProtectedWorktree) {
+		t.Fatal("protected worktree accepted")
+	}
+	injection := validPlan(t)
+	injection.Checks = []Check{{Kind: CheckGoTest, Packages: []string{"./...; echo leaked"}}}
+	if !errors.Is(ValidatePlan(injection), ErrInvalidPlan) {
+		t.Fatal("shell-like package accepted")
+	}
+}

adapters/models/openai_compatible_local.go

@@ -122,10 +122,10 @@ type compatibleChatResponse struct {
 }
 
 func (a *OpenAICompatibleLocalAdapter) Advise(ctx context.Context, request cognitive.AdvisoryRequest) (cognitive.AdvisoryResponse, error) {
-	if err := ValidateAdvisoryRequest(request); err != nil || request.ProviderModelID == "" || len(request.Context) != 0 {
+	if err := ValidateAdvisoryRequest(request); err != nil || request.ProviderModelID == "" {
 		return cognitive.AdvisoryResponse{}, ErrInvalidAdvisory
 	}
-	payload := compatibleChatRequest{Model: string(request.ProviderModelID), Messages: []compatibleMessage{{Role: "system", Content: "Provide non-canonical advisory text only. Never claim that an action occurred."}, {Role: "user", Content: request.Message}}, Temperature: 0, Stream: false, MaxTokens: request.MaxOutputBytes / 4, ChatTemplateKwargs: compatibleTemplateKwargs{EnableThinking: false}}
+	payload := compatibleChatRequest{Model: string(request.ProviderModelID), Messages: []compatibleMessage{{Role: "system", Content: "Ты отвечаешь от имени Домового — локального помощника пользователя. Не называй себя именем модели, поставщиком или внутренним runtime. Если спрашивают имя, ответь: «Меня зовут Домовой». Понимай смысл сообщения и помогай довести цель до полезного результата. По умолчанию отвечай кратко, примерно одним-тремя предложениями; подробности давай только по просьбе. Отвечай только некатегоричным текстом совета; не утверждай, что внешнее действие уже выполнено."}, {Role: "user", Content: localAdvisoryMessage(request)}}, Temperature: 0, Stream: false, MaxTokens: request.MaxOutputBytes / 4, ChatTemplateKwargs: compatibleTemplateKwargs{EnableThinking: false}}
 	var result compatibleChatResponse
 	status, err := a.requestJSON(ctx, http.MethodPost, "/chat/completions", payload, &result)
 	if err != nil {
@@ -151,6 +151,19 @@ func (a *OpenAICompatibleLocalAdapter) Advise(ctx context.Context, request cogni
 	return response, nil
 }
 
+func localAdvisoryMessage(request cognitive.AdvisoryRequest) string {
+	if len(request.Context) == 0 {
+		return request.Message
+	}
+	var builder strings.Builder
+	builder.WriteString(request.Message)
+	builder.WriteString("\n\nRelevant local context:\n")
+	for _, excerpt := range request.Context {
+		fmt.Fprintf(&builder, "- [%s/%s] %s\n", excerpt.SourceKind, excerpt.SourceID, excerpt.Text)
+	}
+	return builder.String()
+}
+
 func (a *OpenAICompatibleLocalAdapter) requestJSON(ctx context.Context, method, path string, input, output any) (int, error) {
 	var body io.Reader
 	if input != nil {

adapters/models/openai_compatible_local_test.go

@@ -92,3 +92,32 @@ func TestOpenAICompatibleLocalAdapterDisablesTemplateThinkingForBoundedAdvisory(
 		t.Fatal("expected bounded advisory to disable template thinking")
 	}
 }
+
+func TestOpenAICompatibleLocalAdapterPassesLocalContextToAdvisory(t *testing.T) {
+	transport := &captureRoundTripper{}
+	adapter, err := NewOpenAICompatibleLocalAdapter("http://gateway/v1", transport)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = adapter.Advise(context.Background(), cognitive.AdvisoryRequest{
+		Version: cognitive.CreatorAdvisoryV1, RequestID: "request-context", ActorID: "actor", PrincipalID: "principal", ScopeID: "scope",
+		Message: "Продолжи разговор", Locale: "ru-RU", MaxOutputBytes: 256, ProviderBindingID: "binding-1", ProviderBindingRevision: 1,
+		ProviderInstanceID: "provider-1", ModelDescriptorID: "model-1", ProviderModelID: capability.ProviderModelID("local-model"),
+		Context: []cognitive.ContextExcerpt{{ID: "focus", SourceKind: "situation", SourceID: "focus-1", Revision: 1, Sensitivity: cognitive.SensitivityPrivateAllowed, Text: "Активный проект: Домовой"}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var payload struct {
+		Messages []struct {
+			Role    string `json:"role"`
+			Content string `json:"content"`
+		} `json:"messages"`
+	}
+	if err := json.Unmarshal(transport.body, &payload); err != nil {
+		t.Fatal(err)
+	}
+	if len(payload.Messages) != 2 || !strings.Contains(payload.Messages[1].Content, "Активный проект: Домовой") {
+		t.Fatalf("local context was not passed to advisory: %+v", payload.Messages)
+	}
+}

adapters/postgres/epistemics_repository.go

@@ -11,6 +11,14 @@ import (
 
 type EpistemicsRepository struct{ pool *pgxpool.Pool }
 
+type TruthRuntimeStatus struct {
+	BundleCount          int64            `json:"bundle_count"`
+	ClaimsByVerification map[string]int64 `json:"claims_by_verification"`
+	BeliefsByState       map[string]int64 `json:"beliefs_by_state"`
+	SourcesByFreshness   map[string]int64 `json:"sources_by_freshness"`
+	ObservedAtUnixMillis int64            `json:"observed_at_unix_millis"`
+}
+
 func OpenEpistemics(ctx context.Context, config ContinuityConfig) (*EpistemicsRepository, error) {
 	pool, err := openPool(ctx, config)
 	if err != nil {
@@ -25,6 +33,49 @@ func (r *EpistemicsRepository) Ping(ctx context.Context) error {
 	return r.pool.Ping(ctx)
 }
 
+// TruthRuntimeStatus is a read-only projection of durable truth bundles.
+// It does not promote claims, revise beliefs, or mutate epistemic state.
+func (r *EpistemicsRepository) TruthRuntimeStatus(ctx context.Context) (TruthRuntimeStatus, error) {
+	status := TruthRuntimeStatus{
+		ClaimsByVerification: map[string]int64{},
+		BeliefsByState:       map[string]int64{},
+		SourcesByFreshness:   map[string]int64{},
+		ObservedAtUnixMillis: time.Now().UnixMilli(),
+	}
+	if err := r.pool.QueryRow(ctx, `SELECT count(*) FROM epistemics.truth_bundles`).Scan(&status.BundleCount); err != nil {
+		return TruthRuntimeStatus{}, err
+	}
+	queries := []struct {
+		query       string
+		destination map[string]int64
+	}{
+		{`SELECT claim_verification, count(*) FROM epistemics.truth_bundles GROUP BY claim_verification`, status.ClaimsByVerification},
+		{`SELECT belief_state, count(*) FROM epistemics.truth_bundles GROUP BY belief_state`, status.BeliefsByState},
+		{`SELECT snapshot_freshness, count(*) FROM epistemics.truth_bundles GROUP BY snapshot_freshness`, status.SourcesByFreshness},
+	}
+	for _, item := range queries {
+		rows, err := r.pool.Query(ctx, item.query)
+		if err != nil {
+			return TruthRuntimeStatus{}, err
+		}
+		for rows.Next() {
+			var state string
+			var count int64
+			if err := rows.Scan(&state, &count); err != nil {
+				rows.Close()
+				return TruthRuntimeStatus{}, err
+			}
+			item.destination[state] = count
+		}
+		if err := rows.Err(); err != nil {
+			rows.Close()
+			return TruthRuntimeStatus{}, err
+		}
+		rows.Close()
+	}
+	return status, nil
+}
+
 func (r *EpistemicsRepository) SaveSystemExpectation(ctx context.Context, value epistemics.SystemExpectation) error {
 	_, err := r.pool.Exec(ctx, `INSERT INTO epistemics.system_expectations (
 		expectation_id, original_intent_id, source_utterance_id, expected_outcome, expected_effect,
@@ -99,7 +150,7 @@ func (r *EpistemicsRepository) ClaimReflectionCandidate(ctx context.Context, wor
 	var value epistemics.ReflectionCandidate
 	err = tx.QueryRow(ctx, `SELECT reflection_candidate_id,trigger,state,source_experience_id,original_intent_id,source_utterance_id,summary,evidence_refs,requires_cognition,recorded_at_unix_millis,revision,claimed_by,claim_expires_at_unix_millis
 		FROM epistemics.reflection_candidates
-		WHERE state='OPEN' AND (claim_expires_at_unix_millis=0 OR claim_expires_at_unix_millis < $1)
+		WHERE state='OPEN' AND requires_cognition=false AND (claim_expires_at_unix_millis=0 OR claim_expires_at_unix_millis < $1)
 		ORDER BY recorded_at_unix_millis,reflection_candidate_id
 		FOR UPDATE SKIP LOCKED LIMIT 1`, nowUnixMillis).Scan(&value.ID, &value.Trigger, &value.State, &value.SourceExperienceID, &value.OriginalIntentID, &value.SourceUtteranceID, &value.Summary, &value.EvidenceRefs, &value.RequiresCognition, &value.RecordedAtUnixMillis, &value.Revision, &value.ClaimedBy, &value.ClaimExpiresAtUnixMillis)
 	if err != nil {

adapters/postgres/interaction_repository.go

@@ -3,6 +3,7 @@ package postgres
 import (
 	"context"
 
+	"git.cin.su/m/Assistant/contracts/identity"
 	"git.cin.su/m/Assistant/contracts/interaction"
 	"github.com/jackc/pgx/v5/pgxpool"
 )
@@ -98,3 +99,22 @@ func (r *InteractionRepository) Utterances(ctx context.Context, id interaction.C
 	}
 	return out, rows.Err()
 }
+
+// RecentUtterancesForPrincipal provides durable conversational context when a
+// client starts a fresh conversation instead of carrying the previous ID.
+func (r *InteractionRepository) RecentUtterancesForPrincipal(ctx context.Context, principalID identity.PrincipalID, limit int) ([]interaction.HumanUtterance, error) {
+	rows, err := r.pool.Query(ctx, `SELECT utterance_id,conversation_id,actor_id,principal_id,channel,received_at_unix_millis,correlation_id,content,content_ref,speech_act,interpretation_state,corrects_utterance_id FROM interaction.utterances WHERE principal_id=$1 ORDER BY received_at_unix_millis DESC, utterance_id DESC LIMIT $2`, principalID, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []interaction.HumanUtterance
+	for rows.Next() {
+		var u interaction.HumanUtterance
+		if err := rows.Scan(&u.ID, &u.ConversationID, &u.ActorID, &u.PrincipalID, &u.Channel, &u.ReceivedAtUnixMillis, &u.CorrelationID, &u.Content, &u.ContentRef, &u.SpeechAct, &u.InterpretationState, &u.CorrectsUtteranceID); err != nil {
+			return nil, err
+		}
+		out = append(out, u)
+	}
+	return out, rows.Err()
+}

adapters/research/search_connector.go

@@ -0,0 +1,276 @@
+package research
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"errors"
+	"html"
+	"io"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"git.cin.su/m/Assistant/contracts/epistemics"
+)
+
+var ErrSearchRejected = errors.New("web search request rejected")
+
+var (
+	searchLinkPattern    = regexp.MustCompile(`(?is)(<a[^>]+class=["'][^"']*result__a[^"']*["'][^>]*>)(.*?)</a>`)
+	searchSnippetPattern = regexp.MustCompile(`(?is)<a[^>]+class=["'][^"']*result__snippet[^"']*["'][^>]*>(.*?)</a>`)
+	bingLinkPattern      = regexp.MustCompile(`(?is)<li[^>]+class=["'][^"']*b_algo[^"']*["'][^>]*>.*?<h2[^>]*>(<a[^>]*>)(.*?)</a>`)
+	bingSnippetPattern   = regexp.MustCompile(`(?is)<li[^>]+class=["'][^"']*b_algo[^"']*["'][^>]*>.*?<p[^>]*>(.*?)</p>`)
+	tagPattern           = regexp.MustCompile(`(?s)<[^>]*>`)
+	termPattern          = regexp.MustCompile(`(?i)[\p{L}\p{N}]{2,}`)
+)
+
+var searchStopTerms = map[string]struct{}{
+	"какая": {}, "какое": {}, "какие": {}, "какой": {}, "что": {}, "как": {}, "где": {}, "когда": {}, "почему": {}, "мне": {}, "пожалуйста": {},
+	"what": {}, "which": {}, "where": {}, "when": {}, "why": {}, "how": {}, "please": {}, "the": {}, "this": {},
+}
+
+// SearchConnector uses a configured HTTPS search endpoint. It does not know
+// cities, weather terms, entities or model names: the complete semantic query
+// comes from the interpretation layer.
+type SearchConnector struct {
+	Client            *http.Client
+	EndpointTemplate  string
+	AllowedHosts      map[string]struct{}
+	FallbackEndpoints []SearchEndpoint
+	MaxBytes          int64
+	MaxResults        int
+}
+
+// SearchEndpoint is an independently allowlisted web-search route. The
+// connector tries routes in order and stops at the first relevant evidence.
+// This is a source-recovery policy, not a question-type classifier.
+type SearchEndpoint struct {
+	Template     string
+	AllowedHosts map[string]struct{}
+}
+
+func (c SearchConnector) Collect(ctx context.Context, request epistemics.WebSearchRequest, nowUnixMillis int64) ([]epistemics.ResearchCandidate, error) {
+	if request.Plan.Validate() != nil || strings.TrimSpace(request.Query) == "" || nowUnixMillis < 1 || !strings.Contains(c.EndpointTemplate, "%s") {
+		return nil, ErrSearchRejected
+	}
+	endpoints := make([]SearchEndpoint, 0, 1+len(c.FallbackEndpoints))
+	endpoints = append(endpoints, SearchEndpoint{Template: c.EndpointTemplate, AllowedHosts: c.AllowedHosts})
+	endpoints = append(endpoints, c.FallbackEndpoints...)
+	var lastErr error
+	for _, candidateEndpoint := range endpoints {
+		results, err := c.collectEndpoint(ctx, candidateEndpoint, request, nowUnixMillis)
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		if len(results) > 0 {
+			return results, nil
+		}
+	}
+	if lastErr != nil {
+		return nil, lastErr
+	}
+	return nil, nil
+}
+
+func (c SearchConnector) collectEndpoint(ctx context.Context, configured SearchEndpoint, request epistemics.WebSearchRequest, nowUnixMillis int64) ([]epistemics.ResearchCandidate, error) {
+	if !strings.Contains(configured.Template, "%s") {
+		return nil, ErrSearchRejected
+	}
+	searchQuery := enrichedSearchQuery(request.Query)
+	endpoint, err := url.Parse(strings.Replace(configured.Template, "%s", url.QueryEscape(searchQuery), 1))
+	if err != nil || endpoint.Scheme != "https" || endpoint.Host == "" || !allowedHost(configured.AllowedHosts, strings.ToLower(endpoint.Hostname())) {
+		return nil, ErrSearchRejected
+	}
+	client := c.Client
+	if client == nil {
+		client = &http.Client{}
+	}
+	maxBytes := c.MaxBytes
+	if maxBytes <= 0 || maxBytes > 4<<20 {
+		maxBytes = 512 << 10
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint.String(), nil)
+	if err != nil {
+		return nil, ErrSearchRejected
+	}
+	// Search providers commonly return a consent/challenge shell to the
+	// default Go client. A neutral browser identification improves the same
+	// generic evidence path for every query without selecting by topic.
+	req.Header.Set("User-Agent", "Mozilla/5.0 (compatible; DomovoyResearch/1.0)")
+	response, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		return nil, ErrSearchRejected
+	}
+	body, err := io.ReadAll(io.LimitReader(response.Body, maxBytes+1))
+	if err != nil || len(body) == 0 || int64(len(body)) > maxBytes {
+		return nil, ErrSearchRejected
+	}
+	links := searchLinkPattern.FindAllSubmatch(body, c.limit())
+	snippets := searchSnippetPattern.FindAllSubmatch(body, c.limit())
+	if len(links) == 0 {
+		links = bingLinkPattern.FindAllSubmatch(body, c.limit())
+		snippets = bingSnippetPattern.FindAllSubmatch(body, c.limit())
+	}
+	if len(links) == 0 {
+		return nil, nil
+	}
+	digest := sha256.Sum256(body)
+	digestText := "sha256:" + hex.EncodeToString(digest[:])
+	base := hex.EncodeToString(digest[:])
+	sourceID := epistemics.SourceID("source:search:" + base)
+	snapshotID := epistemics.SourceSnapshotID("snapshot:search:" + base)
+	results := make([]epistemics.ResearchCandidate, 0, len(links))
+	for index, link := range links {
+		linkURL := resolveSearchResultLocator(extractHref(string(link[1])), endpoint)
+		title := cleanHTML(string(link[2]))
+		snippet := ""
+		if index < len(snippets) {
+			snippet = cleanHTML(string(snippets[index][1]))
+		}
+		statement := strings.TrimSpace(strings.Trim(title+" — "+snippet, " —"))
+		if statement == "" || !searchStatementRelatesToQuery(request.Query, statement) {
+			continue
+		}
+		ordinal := strconv.Itoa(index)
+		excerptID := epistemics.SourceExcerptID("excerpt:search:" + base + ":" + ordinal)
+		results = append(results, epistemics.ResearchCandidate{
+			PropositionKey: request.PropositionKey + ":result:" + ordinal,
+			Statement:      statement,
+			Source:         epistemics.Source{ID: sourceID, Kind: "web-search", Locator: linkURL, Title: title, Publisher: sourcePublisher(linkURL, endpoint.Hostname())},
+			Snapshot:       epistemics.SourceSnapshot{ID: snapshotID, SourceID: sourceID, ContentDigest: digestText, CapturedAtUnixMillis: nowUnixMillis, Freshness: epistemics.FreshnessCurrent},
+			Excerpt:        epistemics.SourceExcerpt{ID: excerptID, SnapshotID: snapshotID, Text: statement, Start: 0, End: int64(len(statement))},
+			Evidence:       epistemics.EvidenceObserved, Coverage: epistemics.CoverageComplete, Conflict: epistemics.ConflictNone,
+		})
+	}
+	return results, nil
+}
+
+// searchStatementRelatesToQuery is a bounded relevance gate, not a truth
+// check. It prevents generic search pages from becoming apparent evidence
+// when their content has no substantive relation to the requested query.
+func searchStatementRelatesToQuery(query, statement string) bool {
+	terms := termPattern.FindAllString(strings.ToLower(query), -1)
+	content := strings.ToLower(statement)
+	productCue := containsSearchTerm(terms, "видеокарт", "gpu", "процессор", "телефон", "ноутбук", "монитор")
+	if productCue && hasNumericSearchTerm(terms) {
+		contentTerms := termPattern.FindAllString(content, -1)
+		return hasNumericSearchTerm(contentTerms) && containsSearchTerm(contentTerms, "видеокарт", "gpu", "процессор", "телефон", "ноутбук", "монитор")
+	}
+	usable := 0
+	for _, term := range terms {
+		if _, stop := searchStopTerms[term]; stop || len([]rune(term)) < 4 {
+			continue
+		}
+		usable++
+		runes := []rune(term)
+		prefixLen := 5
+		if len(runes) < prefixLen {
+			prefixLen = len(runes)
+		}
+		if strings.Contains(content, string(runes[:prefixLen])) {
+			return true
+		}
+	}
+	return usable == 0
+}
+
+func containsSearchTerm(values []string, wanted ...string) bool {
+	for _, value := range values {
+		for _, candidate := range wanted {
+			if strings.Contains(value, candidate) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func hasNumericSearchTerm(values []string) bool {
+	for _, value := range values {
+		for _, runeValue := range value {
+			if runeValue >= '0' && runeValue <= '9' {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func enrichedSearchQuery(query string) string {
+	trimmed := strings.TrimSpace(query)
+	lower := strings.ToLower(trimmed)
+	if (strings.Contains(lower, "цен") || strings.Contains(lower, "стоим")) && !strings.Contains(lower, "куп") {
+		return trimmed + " цена купить сегодня"
+	}
+	return trimmed
+}
+
+func allowedHost(hosts map[string]struct{}, host string) bool { _, ok := hosts[host]; return ok }
+func (c SearchConnector) limit() int {
+	if c.MaxResults <= 0 || c.MaxResults > 8 {
+		return 3
+	}
+	return c.MaxResults
+}
+func cleanHTML(value string) string {
+	return strings.Join(strings.Fields(html.UnescapeString(tagPattern.ReplaceAllString(value, ""))), " ")
+}
+
+func extractHref(tag string) string {
+	match := regexp.MustCompile(`(?is)\bhref=["']([^"']+)["']`).FindStringSubmatch(tag)
+	if len(match) == 2 {
+		return match[1]
+	}
+	return ""
+}
+
+func resolveSearchResultLocator(raw string, searchEndpoint *url.URL) string {
+	value := strings.TrimSpace(html.UnescapeString(raw))
+	if value == "" {
+		return searchEndpoint.String()
+	}
+	parsed, err := url.Parse(value)
+	if err != nil {
+		return searchEndpoint.String()
+	}
+	if target := parsed.Query().Get("uddg"); target != "" {
+		value = target
+		parsed, err = url.Parse(target)
+		if err != nil {
+			return searchEndpoint.String()
+		}
+	}
+	if target := parsed.Query().Get("u"); strings.HasPrefix(target, "a1") {
+		if decoded, decodeErr := base64.RawURLEncoding.DecodeString(strings.TrimPrefix(target, "a1")); decodeErr == nil {
+			if targetURL, parseErr := url.Parse(string(decoded)); parseErr == nil {
+				parsed = targetURL
+			}
+		}
+	}
+	if parsed.Scheme == "" {
+		parsed.Scheme = "https"
+	}
+	if parsed.Host == "" && strings.HasPrefix(value, "//") {
+		parsed, err = url.Parse("https:" + value)
+	}
+	if err != nil || parsed.Scheme != "https" || parsed.Host == "" {
+		return searchEndpoint.String()
+	}
+	return parsed.String()
+}
+
+func sourcePublisher(locator, fallback string) string {
+	if parsed, err := url.Parse(locator); err == nil && parsed.Hostname() != "" {
+		return parsed.Hostname()
+	}
+	return fallback
+}

adapters/research/search_connector_test.go

@@ -0,0 +1,57 @@
+package research
+
+import (
+	"context"
+	"crypto/tls"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/epistemics"
+)
+
+func TestSearchConnectorFallsBackToAnotherAllowedSource(t *testing.T) {
+	primary := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(`<html><body>no usable results</body></html>`))
+	}))
+	defer primary.Close()
+	fallback := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(`<a class="result__a" href="https://example.test">Казань: текущая температура 18 °C</a><a class="result__snippet">Наблюдается переменная облачность.</a>`))
+	}))
+	defer fallback.Close()
+	client := fallback.Client()
+	client.Transport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // test servers only
+	request := epistemics.WebSearchRequest{Plan: epistemics.ResearchPlan{ID: "plan:test", Question: "какая погода в Казани", SourceClasses: []string{"web-search"}, FreshnessPolicy: string(epistemics.FreshnessCurrent)}, PropositionKey: "question:test", Query: "какая погода в Казани"}
+	connector := SearchConnector{
+		Client:           client,
+		EndpointTemplate: primary.URL + "?q=%s",
+		AllowedHosts:     map[string]struct{}{strings.TrimPrefix(primary.URL, "https://"): {}},
+		FallbackEndpoints: []SearchEndpoint{{
+			Template:     fallback.URL + "?q=%s",
+			AllowedHosts: map[string]struct{}{strings.TrimPrefix(fallback.URL, "https://"): {}},
+		}},
+	}
+	// The allowlist is hostname-only; test servers include an ephemeral port.
+	connector.AllowedHosts = map[string]struct{}{strings.Split(strings.TrimPrefix(primary.URL, "https://"), ":")[0]: {}}
+	connector.FallbackEndpoints[0].AllowedHosts = map[string]struct{}{strings.Split(strings.TrimPrefix(fallback.URL, "https://"), ":")[0]: {}}
+	results, err := connector.Collect(context.Background(), request, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(results) != 1 || !strings.Contains(results[0].Statement, "18") {
+		t.Fatalf("fallback evidence = %#v", results)
+	}
+	if results[0].Source.Locator != "https://example.test" || results[0].Source.Publisher != "example.test" {
+		t.Fatalf("search result source = %#v", results[0].Source)
+	}
+}
+
+func TestEnrichedSearchQueryAddsPriceSignalsOnlyToPriceRequests(t *testing.T) {
+	if got := enrichedSearchQuery("проверь цену на видеокарту 4090"); got != "проверь цену на видеокарту 4090 цена купить сегодня" {
+		t.Fatalf("price query = %q", got)
+	}
+	if got := enrichedSearchQuery("какая погода в Казани"); got != "какая погода в Казани" {
+		t.Fatalf("non-price query = %q", got)
+	}
+}

cmd/agent-execution-bridge/main.go

@@ -0,0 +1,211 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"git.cin.su/m/Assistant/contracts/artifact"
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/cognitive"
+	"git.cin.su/m/Assistant/contracts/work"
+	capabilitydomain "git.cin.su/m/Assistant/modules/capability/domain"
+)
+
+type bridge struct {
+	cognitiveURL string
+	callbackURL  string
+	verifierURL  string
+	client       *http.Client
+}
+
+func main() {
+	b := bridge{
+		cognitiveURL: strings.TrimRight(envOr("COGNITIVE_WORKER_URL", "http://cognitive-worker:8083"), "/"),
+		callbackURL:  strings.TrimRight(envOr("WORK_GRAPH_RUNTIME_URL", "http://work-graph-runtime:8088"), "/"),
+		verifierURL:  strings.TrimRight(envOr("TASK_VERIFIER_URL", "http://task-verifier:8091"), "/"),
+		client:       &http.Client{Timeout: 10 * time.Minute},
+	}
+	mux := http.NewServeMux()
+	mux.HandleFunc("/healthz", healthHandler)
+	mux.HandleFunc("/readyz", healthHandler)
+	mux.HandleFunc("/v1/execute", b.executeHandler)
+	addr := envOr("LISTEN_ADDR", ":8092")
+	if err := http.ListenAndServe(addr, mux); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func (b bridge) executeHandler(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	var request work.AgentExecutionRequest
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&request); err != nil {
+		http.Error(w, "invalid execution request", http.StatusBadRequest)
+		return
+	}
+	result, err := b.execute(r.Context(), request)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadGateway)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(result)
+}
+
+func (b bridge) execute(ctx context.Context, request work.AgentExecutionRequest) (work.AgentExecutionResult, error) {
+	now := time.Now().UnixMilli()
+	intent := request.Intent
+	if intent.TaskEvaluationExecution != nil && intent.TaskEvaluationExecution.GenericMessage != "" {
+		return b.executeGenericCognitiveWork(ctx, request, *intent.TaskEvaluationExecution)
+	}
+	if intent.TaskEvaluationExecution == nil || intent.TaskEvaluationProfile == nil || len(intent.TaskEvaluationCases) == 0 {
+		return work.AgentExecutionResult{State: work.AgentExecutionWaiting, Summary: "локальный bridge не поддерживает это намерение; работа сохранена и ожидает подходящего исполнителя", ObservedAtUnixMillis: now}, nil
+	}
+	execution := intent.TaskEvaluationExecution
+	if execution.GraphID == "" || execution.NodeID == "" || execution.BindingRevision < 1 || execution.ActorID == "" || execution.PrincipalID == "" || execution.ScopeID == "" {
+		return work.AgentExecutionResult{State: work.AgentExecutionWaiting, Summary: "контекст task-evaluation неполон; работа сохранена для повторной маршрутизации", ObservedAtUnixMillis: now}, nil
+	}
+	payload := capability.TaskEvaluationExecutionRequest{Profile: *intent.TaskEvaluationProfile, CapabilityID: intent.TaskEvaluationProfile.CapabilityID, BindingID: intent.TaskEvaluationBindingID, BindingRevision: execution.BindingRevision, ActorID: execution.ActorID, PrincipalID: execution.PrincipalID, ScopeID: execution.ScopeID, Cases: intent.TaskEvaluationCases, MaxOutputBytes: 4096}
+	response, err := postJSON[capability.TaskEvaluationExecutionResponse](ctx, b.client, b.cognitiveURL+"/v1/task-evaluations/execute", payload)
+	if err != nil {
+		return work.AgentExecutionResult{}, err
+	}
+	if len(response.Responses) == 0 || response.ObservedAtUnixMillis < 1 {
+		return work.AgentExecutionResult{}, fmt.Errorf("task evaluation returned no observations")
+	}
+	caseByID := make(map[string]capability.TaskEvaluationCase, len(intent.TaskEvaluationCases))
+	for _, item := range intent.TaskEvaluationCases {
+		caseByID[item.CaseID] = item
+	}
+	observations := response.Observations
+	if !hasCriticalFailure(observations) {
+		observations = make([]capability.TaskCaseObservation, 0, len(response.Responses))
+		for _, item := range response.Responses {
+			caseValue, ok := caseByID[item.CaseID]
+			if !ok || caseValue.Verification.Mode == "" {
+				return work.AgentExecutionResult{State: work.AgentExecutionWaiting, Summary: "task-evaluation case has no bounded verifier; work remains waiting", ObservedAtUnixMillis: time.Now().UnixMilli()}, nil
+			}
+			verified, verifyErr := postJSON[capability.TaskCaseVerificationResponse](ctx, b.client, b.verifierURL+"/v1/task-evaluations/verify", capability.TaskCaseVerificationRequest{CaseID: item.CaseID, ResponseText: item.ResponseText, LatencyMicros: item.LatencyMicros, EvidenceArtifactRef: item.EvidenceArtifactRef, Verification: caseValue.Verification})
+			if verifyErr != nil {
+				return work.AgentExecutionResult{}, verifyErr
+			}
+			observations = append(observations, capability.TaskCaseObservation{CaseID: verified.CaseID, Result: verified.Result, QualityScoreMillis: verified.QualityScoreMillis, LatencyMicros: verified.LatencyMicros, CriticalFailure: verified.CriticalFailure, EvidenceArtifactRef: verified.EvidenceArtifactRef, VerificationEvidenceRef: verified.VerificationEvidenceRef, VerifierIdentity: verified.VerifierIdentity})
+		}
+	}
+	evaluation, err := capabilitydomain.BuildTaskEvaluation(*intent.TaskEvaluationProfile, capability.TaskEvaluationID("evaluation:"+intent.DispatchID), response.BindingID, response.BindingRevision, intent.TaskEvaluationProfile.CapabilityID, observations, artifact.ArtifactID(intent.TaskEvaluationCases[0].EvidenceArtifactRef), response.ObservedAtUnixMillis)
+	if err != nil {
+		return work.AgentExecutionResult{}, err
+	}
+	callback := work.TaskEvaluationEvidenceCallback{GraphID: execution.GraphID, Revision: execution.GraphRevision, NodeID: execution.NodeID, Evaluation: evaluation, Succeeded: true}
+	if _, err := postJSON[json.RawMessage](ctx, b.client, b.callbackURL+"/v1/work-graphs/task-evaluations/callback", callback); err != nil {
+		return work.AgentExecutionResult{}, err
+	}
+	return work.AgentExecutionResult{State: work.AgentExecutionCompleted, Summary: "local bridge executed task evaluation and persisted verifier callback", OutcomeRef: string(evaluation.ID), ArtifactRefs: []string{string(evaluation.ArtifactID)}, ObservedAtUnixMillis: time.Now().UnixMilli()}, nil
+}
+
+func (b bridge) executeGenericCognitiveWork(ctx context.Context, request work.AgentExecutionRequest, execution work.TaskEvaluationDispatchContext) (work.AgentExecutionResult, error) {
+	if execution.GraphID == "" || execution.NodeID == "" || execution.ActorID == "" || execution.PrincipalID == "" || execution.ScopeID == "" {
+		return work.AgentExecutionResult{State: work.AgentExecutionWaiting, Summary: "generic cognitive work context is incomplete; durable work remains waiting for rerouting", ObservedAtUnixMillis: time.Now().UnixMilli()}, nil
+	}
+	maxOutputBytes := execution.GenericMaxOutputBytes
+	if maxOutputBytes < 1 {
+		maxOutputBytes = 4096
+	}
+	dataPolicy := capability.DataPolicy(execution.GenericDataPolicy)
+	if dataPolicy == "" {
+		dataPolicy = capability.DataPolicyLocalOnly
+	}
+	response, err := postJSON[cognitive.GatewayAdvisoryResponse](ctx, b.client, b.cognitiveURL+"/v1/advisories", cognitive.GatewayAdvisoryRequest{
+		Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID("agent-work:" + request.Intent.DispatchID), ActorID: execution.ActorID,
+		PrincipalID: execution.PrincipalID, ScopeID: execution.ScopeID, Message: execution.GenericMessage, Locale: execution.GenericLocale,
+		MaxOutputBytes: maxOutputBytes, DataPolicy: dataPolicy, Meaning: cognitive.TaskMeaning{SpeechAct: "DIRECTIVE", RequestedOutcome: execution.GenericPurpose},
+	})
+	if err != nil {
+		return work.AgentExecutionResult{}, err
+	}
+	if response.FinishReason != cognitive.FinishCompleted || strings.TrimSpace(response.AdvisoryText) == "" {
+		return work.AgentExecutionResult{}, fmt.Errorf("generic cognitive work did not complete: %s", response.FinishReason)
+	}
+	candidateID := "candidate:" + request.Intent.DispatchID
+	artifactRef := work.EvidenceRef("agent-output:" + request.Intent.DispatchID)
+	verification, err := postJSON[work.GenericCandidateVerificationResponse](ctx, b.client, b.verifierURL+"/v1/work-graphs/candidates/verify", work.GenericCandidateVerificationRequest{
+		GraphID: execution.GraphID, GraphRevision: execution.GraphRevision, NodeID: execution.NodeID, AuthorRunID: request.Intent.RunID, CandidateID: candidateID, Summary: response.AdvisoryText, EvidenceRefs: []work.EvidenceRef{artifactRef},
+	})
+	if err != nil {
+		return work.AgentExecutionResult{}, err
+	}
+	if !verification.Verified || verification.VerificationEvidenceRef == "" || verification.VerifierIdentity == "" {
+		return work.AgentExecutionResult{State: work.AgentExecutionWaiting, Summary: "generic candidate envelope was not independently verified; work remains waiting", ObservedAtUnixMillis: time.Now().UnixMilli()}, nil
+	}
+	candidate := work.GraphResultCallback{GraphID: execution.GraphID, Revision: execution.GraphRevision, Candidate: work.ResultCandidate{
+		ID: candidateID, GraphID: execution.GraphID, GraphRevision: execution.GraphRevision, NodeID: execution.NodeID,
+		AuthorRunID: request.Intent.RunID, ArtifactRefs: []work.EvidenceRef{artifactRef, work.EvidenceRef(verification.VerificationEvidenceRef)}, EvidenceSummary: "candidate attribution and evidence envelope independently verified; semantic content remains unverified",
+		Summary: response.AdvisoryText,
+	}}
+	if _, err := postJSON[json.RawMessage](ctx, b.client, b.callbackURL+"/v1/work-graphs/result-callback", candidate); err != nil {
+		return work.AgentExecutionResult{}, err
+	}
+	return work.AgentExecutionResult{State: work.AgentExecutionCompleted, Summary: "local cognitive specialist produced a candidate for independent verification", OutcomeRef: "candidate:" + request.Intent.DispatchID, ArtifactRefs: []string{"agent-output:" + request.Intent.DispatchID}, ObservedAtUnixMillis: time.Now().UnixMilli()}, nil
+}
+
+func hasCriticalFailure(observations []capability.TaskCaseObservation) bool {
+	for _, observation := range observations {
+		if observation.CriticalFailure {
+			return true
+		}
+	}
+	return false
+}
+
+func postJSON[T any](ctx context.Context, client *http.Client, url string, payload any) (T, error) {
+	var result T
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return result, err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(body))
+	if err != nil {
+		return result, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := client.Do(req)
+	if err != nil {
+		return result, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return result, fmt.Errorf("POST %s: status %s", url, resp.Status)
+	}
+	if resp.StatusCode == http.StatusNoContent {
+		return result, nil
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return result, err
+	}
+	return result, nil
+}
+
+func healthHandler(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_, _ = w.Write([]byte(`{"runtime":"agent-execution-bridge","status":"ok","capabilities":["task-evaluation","generic-cognitive-work"]}`))
+}
+
+func envOr(name, fallback string) string {
+	if value := strings.TrimSpace(os.Getenv(name)); value != "" {
+		return value
+	}
+	return fallback
+}

cmd/agent-execution-bridge/main_test.go

@@ -0,0 +1,88 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/cognitive"
+	"git.cin.su/m/Assistant/contracts/work"
+)
+
+func TestBridgeWaitsForUnsupportedIntent(t *testing.T) {
+	b := bridge{client: http.DefaultClient}
+	result, err := b.execute(context.Background(), work.AgentExecutionRequest{Intent: work.AgentDispatchIntent{DispatchID: "dispatch-unsupported"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.State != work.AgentExecutionWaiting || result.ObservedAtUnixMillis < 1 {
+		t.Fatalf("result=%+v", result)
+	}
+}
+
+func TestHealthHandlerExposesBoundedCapability(t *testing.T) {
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequest(http.MethodGet, "/healthz", nil)
+	healthHandler(recorder, request)
+	if recorder.Code != http.StatusOK || recorder.Body.String() == "" {
+		t.Fatalf("status=%d body=%q", recorder.Code, recorder.Body.String())
+	}
+}
+
+func TestBridgeRunsTaskEvaluationThroughVerifierAndCallback(t *testing.T) {
+	profile := capability.TaskEvaluationProfile{ID: "profile-1", Revision: 1, CapabilityID: "capability-1", Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "general-v1", RequiredCaseIDs: []string{"case-1"}, QualityWeightMillis: 600, ReliabilityWeightMillis: 300, LatencyWeightMillis: 100}
+	verification := capability.TaskCaseVerification{Mode: capability.TaskCaseVerificationExactText, ExpectedText: "answer", MinimumQualityMillis: 900}
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/v1/task-evaluations/execute":
+			_ = json.NewEncoder(w).Encode(capability.TaskEvaluationExecutionResponse{ProfileID: profile.ID, BindingID: "binding-1", BindingRevision: 3, Responses: []capability.TaskCaseResponse{{CaseID: "case-1", ResponseText: "answer", LatencyMicros: 2, EvidenceArtifactRef: "artifact-1"}}, ObservedAtUnixMillis: 10})
+		case "/v1/task-evaluations/verify":
+			_ = json.NewEncoder(w).Encode(capability.TaskCaseVerificationResponse{CaseID: "case-1", Result: capability.EvaluationSupported, QualityScoreMillis: 900, LatencyMicros: 2, EvidenceArtifactRef: "artifact-1", VerificationEvidenceRef: "verify-1", VerifierIdentity: "verifier-1"})
+		case "/v1/work-graphs/task-evaluations/callback":
+			w.WriteHeader(http.StatusNoContent)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+	b := bridge{cognitiveURL: server.URL, callbackURL: server.URL, verifierURL: server.URL, client: server.Client()}
+	result, err := b.execute(context.Background(), work.AgentExecutionRequest{Intent: work.AgentDispatchIntent{DispatchID: "dispatch-1", TaskEvaluationBindingID: "binding-1", TaskEvaluationProfile: &profile, TaskEvaluationCases: []capability.TaskEvaluationCase{{CaseID: "case-1", Prompt: "answer", EvidenceArtifactRef: "artifact-1", Verification: verification}}, TaskEvaluationExecution: &work.TaskEvaluationDispatchContext{GraphID: "graph-1", GraphRevision: 1, NodeID: "node-1", BindingRevision: 3, ActorID: "actor-1", PrincipalID: "principal-1", ScopeID: "scope-1"}}})
+	if err != nil || result.State != work.AgentExecutionCompleted || result.OutcomeRef == "" {
+		t.Fatalf("result=%+v err=%v", result, err)
+	}
+}
+
+func TestBridgeRunsGenericCognitiveWorkAsUnverifiedGraphCandidate(t *testing.T) {
+	var callback work.GraphResultCallback
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/v1/advisories":
+			var request cognitive.GatewayAdvisoryRequest
+			if err := json.NewDecoder(r.Body).Decode(&request); err != nil || request.Message != "find the bounded solution" {
+				t.Fatalf("unexpected advisory request: %+v err=%v", request, err)
+			}
+			_ = json.NewEncoder(w).Encode(cognitive.GatewayAdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: request.RequestID, AdvisoryText: "candidate answer", FinishReason: cognitive.FinishCompleted})
+		case "/v1/work-graphs/result-callback":
+			if err := json.NewDecoder(r.Body).Decode(&callback); err != nil {
+				t.Fatal(err)
+			}
+			w.WriteHeader(http.StatusNoContent)
+		case "/v1/work-graphs/candidates/verify":
+			_ = json.NewEncoder(w).Encode(work.GenericCandidateVerificationResponse{Verified: true, VerificationEvidenceRef: "verification:generic-1", VerifierIdentity: "deterministic-generic-envelope-verifier-v1", Summary: "envelope verified"})
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+	b := bridge{cognitiveURL: server.URL, callbackURL: server.URL, verifierURL: server.URL, client: server.Client()}
+	result, err := b.execute(context.Background(), work.AgentExecutionRequest{Intent: work.AgentDispatchIntent{
+		DispatchID: "dispatch-generic", RunID: "run-generic",
+		TaskEvaluationExecution: &work.TaskEvaluationDispatchContext{GraphID: "graph-1", GraphRevision: 2, NodeID: "node-1", ActorID: "actor-1", PrincipalID: "principal-1", ScopeID: "scope-1", GenericMessage: "find the bounded solution", GenericPurpose: "investigate", GenericDataPolicy: string(capability.DataPolicyLocalOnly)},
+	}})
+	if err != nil || result.State != work.AgentExecutionCompleted || callback.Candidate.Summary != "candidate answer" || callback.Candidate.AuthorRunID != "run-generic" || len(callback.Candidate.ArtifactRefs) != 2 {
+		t.Fatalf("result=%+v callback=%+v err=%v", result, callback, err)
+	}
+}

cmd/agent-worker/main.go

@@ -42,7 +42,7 @@ func main() {
 	defer repository.Close()
 	var executor ports.AgentExecutor
 	localFallback := false
-	if bridgeURL, bridgeConfigured := loadProtectedBridgeURL(); bridgeConfigured {
+	if bridgeURL, bridgeConfigured := loadConfiguredBridgeURL(); bridgeConfigured {
 		executor, err = agentbridge.NewHTTPExecutor(bridgeURL, &http.Client{Timeout: *leaseTTL})
 		if err != nil {
 			fmt.Fprintln(os.Stderr, err)
@@ -99,6 +99,19 @@ func main() {
 	}
 }
 
+func loadConfiguredBridgeURL() (string, bool) {
+	if bridgeURL, configured := loadProtectedBridgeURL(); configured {
+		return bridgeURL, true
+	}
+	// The URL is routing configuration, not a credential. A protected file
+	// remains preferred when an independently operated bridge is supplied.
+	value := strings.TrimSpace(os.Getenv("AGENT_EXECUTION_BRIDGE_URL"))
+	if value == "" || !strings.HasPrefix(value, "http://") && !strings.HasPrefix(value, "https://") {
+		return "", false
+	}
+	return value, true
+}
+
 func loadProtectedBridgeURL() (string, bool) {
 	return loadProtectedBridgeURLFrom("/run/secrets", "/run/secrets/agent_execution_bridge_url")
 }

cmd/agent-worker/status.go

@@ -94,13 +94,15 @@ func workerStatusHandler(executorConfigured bool, localFallback ...interface{})
 	}
 	if local {
 		baseStatus.Mode = "local-executor"
-		baseStatus.Reason = "bounded local task-evaluation executor is active; unsupported work remains durably waiting"
+		baseStatus.Ready = true
+		baseStatus.Reason = "bounded local task-evaluation capability is ready; unsupported work remains durably waiting"
 		baseStatus.Capabilities = []string{"task-evaluation"}
 	}
 	if executorConfigured {
 		baseStatus.Mode = "execution"
 		baseStatus.Ready = true
 		baseStatus.Reason = "typed agent execution bridge configured"
+		baseStatus.Capabilities = []string{"task-evaluation", "generic-cognitive-work"}
 	}
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodGet || (r.URL.Path != "/healthz" && r.URL.Path != "/readyz" && r.URL.Path != "/status") {

cmd/agent-worker/status_test.go

@@ -39,14 +39,14 @@ func TestWorkerStatusReportsRecoveryOnlyWithoutExecutor(t *testing.T) {
 	}
 }
 
-func TestWorkerStatusReportsLocalExecutor(t *testing.T) {
+func TestWorkerStatusReportsLocalExecutorCapabilityReady(t *testing.T) {
 	response := httptest.NewRecorder()
 	workerStatusHandler(false, true).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/status", nil))
 	var value workerStatusResponse
 	if err := json.NewDecoder(response.Body).Decode(&value); err != nil {
 		t.Fatal(err)
 	}
-	if response.Code != http.StatusOK || value.Ready || value.Mode != "local-executor" || !value.LocalFallback || !value.LocalExecutor {
+	if response.Code != http.StatusOK || !value.Ready || value.Mode != "local-executor" || !value.LocalFallback || !value.LocalExecutor {
 		t.Fatalf("unexpected status: code=%d value=%+v", response.Code, value)
 	}
 	if len(value.Capabilities) != 1 || value.Capabilities[0] != "task-evaluation" {
@@ -61,18 +61,23 @@ func TestWorkerStatusDoesNotCallLocalFallbackAnExternalExecutor(t *testing.T) {
 	if err := json.NewDecoder(response.Body).Decode(&value); err != nil {
 		t.Fatal(err)
 	}
-	if value.ExecutorConfigured || value.Ready || !value.LocalFallback || !value.LocalExecutor || value.Mode != "local-executor" {
+	if value.ExecutorConfigured || !value.Ready || !value.LocalFallback || !value.LocalExecutor || value.Mode != "local-executor" {
 		t.Fatalf("local fallback was presented as external execution: %+v", value)
 	}
 }
 
-func TestWorkerReadyzRequiresExecutor(t *testing.T) {
+func TestWorkerReadyzRequiresAnAdvertisedCapability(t *testing.T) {
 	response := httptest.NewRecorder()
 	workerStatusHandler(false).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/readyz", nil))
 	if response.Code != http.StatusServiceUnavailable {
 		t.Fatalf("readyz status=%d", response.Code)
 	}
 	response = httptest.NewRecorder()
+	workerStatusHandler(false, true).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/readyz", nil))
+	if response.Code != http.StatusOK {
+		t.Fatalf("local capability readyz status=%d", response.Code)
+	}
+	response = httptest.NewRecorder()
 	workerStatusHandler(true).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/readyz", nil))
 	if response.Code != http.StatusOK {
 		t.Fatalf("configured readyz status=%d", response.Code)

cmd/agent-worker/task_evaluation_executor.go

@@ -50,6 +50,17 @@ func (e taskEvaluationExecutor) Execute(ctx context.Context, request work.AgentE
 	if len(response.Responses) == 0 || response.ObservedAtUnixMillis < 1 {
 		return work.AgentExecutionResult{}, fmt.Errorf("task evaluation returned no observations")
 	}
+	if len(response.Observations) == len(intent.TaskEvaluationCases) && taskEvaluationHasCriticalFailure(response.Observations) {
+		evaluation, err := capabilitydomain.BuildTaskEvaluation(*intent.TaskEvaluationProfile, capability.TaskEvaluationID("evaluation:"+intent.DispatchID), response.BindingID, response.BindingRevision, intent.TaskEvaluationProfile.CapabilityID, response.Observations, artifact.ArtifactID(intent.TaskEvaluationCases[0].EvidenceArtifactRef), response.ObservedAtUnixMillis)
+		if err != nil {
+			return work.AgentExecutionResult{}, err
+		}
+		callback := work.TaskEvaluationEvidenceCallback{GraphID: execution.GraphID, Revision: execution.GraphRevision, NodeID: execution.NodeID, Evaluation: evaluation, Succeeded: true}
+		if _, err := postJSON[json.RawMessage](ctx, e.client, e.callbackURL+"/v1/work-graphs/task-evaluations/callback", callback); err != nil {
+			return work.AgentExecutionResult{}, err
+		}
+		return work.AgentExecutionResult{State: work.AgentExecutionCompleted, Summary: "task evaluation recorded as UNKNOWN after bounded provider recovery", OutcomeRef: string(evaluation.ID), ArtifactRefs: []string{string(evaluation.ArtifactID)}, ObservedAtUnixMillis: time.Now().UnixMilli()}, nil
+	}
 	if len(intent.TaskEvaluationCases) == 0 {
 		return work.AgentExecutionResult{}, fmt.Errorf("task evaluation cases are missing")
 	}
@@ -80,6 +91,15 @@ func (e taskEvaluationExecutor) Execute(ctx context.Context, request work.AgentE
 	return work.AgentExecutionResult{State: work.AgentExecutionCompleted, Summary: "task evaluation executed, aggregated and accepted by Work Graph callback", OutcomeRef: string(evaluation.ID), ArtifactRefs: []string{string(evaluation.ArtifactID)}, ObservedAtUnixMillis: time.Now().UnixMilli()}, nil
 }
 
+func taskEvaluationHasCriticalFailure(observations []capability.TaskCaseObservation) bool {
+	for _, observation := range observations {
+		if observation.CriticalFailure {
+			return true
+		}
+	}
+	return false
+}
+
 func postJSON[T any](ctx context.Context, client *http.Client, url string, payload any) (T, error) {
 	var result T
 	body, err := json.Marshal(payload)

cmd/agent-worker/task_evaluation_executor_test.go

@@ -41,3 +41,32 @@ func TestTaskEvaluationExecutorInvokesAggregatesAndCallbacks(t *testing.T) {
 		t.Fatalf("result=%+v err=%v", result, err)
 	}
 }
+
+func TestTaskEvaluationExecutorPersistsUnknownAfterProviderFailure(t *testing.T) {
+	profile := capability.TaskEvaluationProfile{ID: "profile-unknown", Revision: 1, CapabilityID: "capability-1", Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "unknown-v1", RequiredCaseIDs: []string{"case-1"}, QualityWeightMillis: 600, ReliabilityWeightMillis: 300, LatencyWeightMillis: 100}
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/v1/task-evaluations/execute" {
+			_ = json.NewEncoder(w).Encode(capability.TaskEvaluationExecutionResponse{ProfileID: profile.ID, BindingID: "binding-1", BindingRevision: 3, Observations: []capability.TaskCaseObservation{{CaseID: "case-1", Result: capability.EvaluationUnknown, CriticalFailure: true, EvidenceArtifactRef: "artifact-1"}}, Responses: []capability.TaskCaseResponse{{CaseID: "case-1", EvidenceArtifactRef: "artifact-1"}}, ObservedAtUnixMillis: 10})
+			return
+		}
+		if r.URL.Path == "/v1/work-graphs/task-evaluations/callback" {
+			var callback work.TaskEvaluationEvidenceCallback
+			if err := json.NewDecoder(r.Body).Decode(&callback); err != nil || callback.Evaluation.Result != capability.EvaluationUnknown || !callback.Succeeded {
+				http.Error(w, "invalid unknown callback", http.StatusBadRequest)
+				return
+			}
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+		if r.URL.Path == "/v1/task-evaluations/verify" {
+			t.Errorf("verifier must not be called for a provider failure")
+		}
+		http.NotFound(w, r)
+	}))
+	defer server.Close()
+	executor := newTaskEvaluationExecutor(server.URL, server.URL, server.URL, server.Client())
+	result, err := executor.Execute(context.Background(), work.AgentExecutionRequest{Intent: work.AgentDispatchIntent{DispatchID: "dispatch-unknown", TaskEvaluationBindingID: "binding-1", TaskEvaluationProfile: &profile, TaskEvaluationCases: []capability.TaskEvaluationCase{{CaseID: "case-1", Prompt: "answer", EvidenceArtifactRef: "artifact-1"}}, TaskEvaluationExecution: &work.TaskEvaluationDispatchContext{GraphID: "graph-1", GraphRevision: 1, NodeID: "node-1", BindingRevision: 3, ActorID: "actor-1", PrincipalID: "principal-1", ScopeID: "scope-1"}}})
+	if err != nil || result.State != work.AgentExecutionCompleted || result.OutcomeRef == "" {
+		t.Fatalf("result=%+v err=%v", result, err)
+	}
+}

cmd/cognitive-worker/fleet_status.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net/http"
 	"strings"
+	"sync"
 	"time"
 
 	"git.cin.su/m/Assistant/contracts/capability"
@@ -31,35 +32,16 @@ type fleetStatusResponse struct {
 func fleetReadinessHandler(client *http.Client, preferred capability.FleetTier, endpoints []fleetEndpoint) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		members := make([]capability.FleetMember, 0, len(endpoints))
-		for _, endpoint := range endpoints {
-			member := capability.FleetMember{ProviderInstanceID: capability.ProviderInstanceID(endpoint.ProviderID), ModelDescriptorID: capability.ModelDescriptorID(endpoint.ModelID), Tier: endpoint.Tier, Reason: "NOT_CONFIGURED"}
-			if strings.TrimSpace(endpoint.URL) == "" {
-				members = append(members, member)
-				continue
-			}
-			request, err := http.NewRequestWithContext(r.Context(), http.MethodGet, endpoint.URL, nil)
-			if err == nil {
-				for name, value := range endpoint.Headers {
-					request.Header.Set(name, value)
-				}
-				probeClient := endpoint.Client
-				if probeClient == nil {
-					probeClient = client
-				}
-				response, requestErr := probeClient.Do(request)
-				if requestErr == nil {
-					response.Body.Close()
-					if response.StatusCode >= 200 && response.StatusCode < 300 {
-						member.Ready, member.Reason = true, "AVAILABLE"
-					} else {
-						member.Reason = fmt.Sprintf("status=%s", response.Status)
-					}
-				} else {
-					member.Reason = requestErr.Error()
-				}
-			}
-			members = append(members, member)
+		members = make([]capability.FleetMember, len(endpoints))
+		var waitGroup sync.WaitGroup
+		for index, endpoint := range endpoints {
+			waitGroup.Add(1)
+			go func(index int, endpoint fleetEndpoint) {
+				defer waitGroup.Done()
+				members[index] = probeFleetEndpoint(r.Context(), client, endpoint)
+			}(index, endpoint)
 		}
+		waitGroup.Wait()
 		readiness, err := fleetdomain.BuildFleetReadiness(time.Now().UnixMilli(), members)
 		response := fleetStatusResponse{Readiness: readiness, Preferred: preferred}
 		if err == nil {
@@ -76,4 +58,37 @@ func fleetReadinessHandler(client *http.Client, preferred capability.FleetTier,
 	})
 }
 
+func probeFleetEndpoint(parent context.Context, fallbackClient *http.Client, endpoint fleetEndpoint) capability.FleetMember {
+	member := capability.FleetMember{ProviderInstanceID: capability.ProviderInstanceID(endpoint.ProviderID), ModelDescriptorID: capability.ModelDescriptorID(endpoint.ModelID), Tier: endpoint.Tier, Reason: "NOT_CONFIGURED"}
+	if strings.TrimSpace(endpoint.URL) == "" {
+		return member
+	}
+	ctx, cancel := context.WithTimeout(parent, 2*time.Second)
+	defer cancel()
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint.URL, nil)
+	if err != nil {
+		member.Reason = err.Error()
+		return member
+	}
+	for name, value := range endpoint.Headers {
+		request.Header.Set(name, value)
+	}
+	probeClient := endpoint.Client
+	if probeClient == nil {
+		probeClient = fallbackClient
+	}
+	response, requestErr := probeClient.Do(request)
+	if requestErr != nil {
+		member.Reason = requestErr.Error()
+		return member
+	}
+	defer response.Body.Close()
+	if response.StatusCode >= 200 && response.StatusCode < 300 {
+		member.Ready, member.Reason = true, "AVAILABLE"
+	} else {
+		member.Reason = fmt.Sprintf("status=%s", response.Status)
+	}
+	return member
+}
+
 func fleetContext(ctx context.Context) context.Context { return ctx }

cmd/cognitive-worker/fleet_status_test.go

@@ -5,6 +5,7 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 
 	"git.cin.su/m/Assistant/contracts/capability"
 )
@@ -26,6 +27,29 @@ func TestFleetReadinessSelectsBestAvailablePrimaryTierBeforeLifeboat(t *testing.
 	}
 }
 
+func TestFleetReadinessDoesNotWaitForSlowMembersSerially(t *testing.T) {
+	slow := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		time.Sleep(150 * time.Millisecond)
+		w.WriteHeader(http.StatusServiceUnavailable)
+	}))
+	defer slow.Close()
+	fast := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusOK) }))
+	defer fast.Close()
+	handler := fleetReadinessHandler(fast.Client(), capability.FleetTierFast, []fleetEndpoint{
+		{ProviderID: "slow", ModelID: "slow-model", Tier: capability.FleetTierMedium, URL: slow.URL},
+		{ProviderID: "lifeboat", ModelID: "lifeboat-model", Tier: capability.FleetTierLifeboat, URL: fast.URL},
+	})
+	started := time.Now()
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/v1/fleet/readiness", nil))
+	if recorder.Code != http.StatusOK || !strings.Contains(recorder.Body.String(), `"selected_tier":"LIFEBOAT"`) {
+		t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String())
+	}
+	if elapsed := time.Since(started); elapsed >= 300*time.Millisecond {
+		t.Fatalf("fleet readiness was serialized: elapsed=%s", elapsed)
+	}
+}
+
 func TestFleetReadinessSendsConfiguredProviderHeaders(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Header.Get("Authorization") != "Bearer fleet-key" {

cmd/cognitive-worker/gateway.go

@@ -186,27 +186,61 @@ func selectionObjectiveForMeaning(meaning cognitive.TaskMeaning, message string)
 }
 
 func builtinAdvisory(request cognitive.GatewayAdvisoryRequest) cognitive.GatewayAdvisoryResponse {
-	text := "Я рядом и продолжаю работу во встроенном режиме Домового. Внешний когнитивный маршрут сейчас недоступен, поэтому опираюсь на уже установленный смысл сообщения и локальные возможности."
+	if request.Meaning.SpeechAct == "RESPONSE_REVIEW" {
+		const marker = "Черновик ответа:"
+		if index := strings.LastIndex(request.Message, marker); index >= 0 {
+			if draft := strings.TrimSpace(request.Message[index+len(marker):]); draft != "" {
+				return cognitive.GatewayAdvisoryResponse{Version: request.Version, RequestID: request.RequestID, AdvisoryText: draft, FinishReason: cognitive.FinishCompleted}
+			}
+		}
+	}
+	text := "Понял."
+	identityText := request.Meaning.RequestedOutcome
+	if identityText == "" {
+		identityText = request.Message
+	}
+	if request.Meaning.SpeechAct == "QUESTION" && isIdentityInquiry(identityText) {
+		text = "Я — Домовой, ваш помощник."
+	}
 	switch request.Meaning.InformationRequestKind {
 	case interaction.InformationRequestCognitiveModelInventory:
-		text = "Запрос понят как проверка моделей. Встроенный режим Домового доступен; я могу показать подключённые модели по назначению, качеству, скорости и стоимости. Ключи и пароли в разговор не нужны."
+		text = "Сейчас не смог проверить подключённые модели."
 	case interaction.InformationRequestCapabilityInventory:
-		text = "Запрос понят как проверка возможностей. Я могу объяснить доступные capabilities и отличить то, что уже подключено, от того, что пока является только планом или capability gap."
+		text = "Сейчас не смог проверить доступные возможности."
 	case interaction.InformationRequestCognitiveChannelStatus:
-		text = "Запрос понят как проверка когнитивного канала. Локальный режим остаётся доступен; я объясню наблюдаемое состояние и что можно сделать без ожидания внешней модели."
+		text = "Локальный канал Домового доступен; подробности состояния дам по запросу."
 	case interaction.InformationRequestCognitiveRecovery:
-		text = "Запрос понят как восстановление ИИ. Начинаю с локального маршрута: фиксирую, что недоступно, проверяю безопасные варианты восстановления и сформулирую следующий обратимый шаг."
+		text = "Встроенный канал сейчас недоступен."
 	default:
 		switch request.Meaning.SpeechAct {
 		case "REQUEST_TO_INVESTIGATE":
-			text = "Я принял это как исследование. Даже без внешней модели могу сформулировать гипотезы, отделить известное от неизвестного и предложить следующий проверяемый шаг."
+			text = "Понял задачу, но пока не смог получить проверяемый результат."
 		case "QUESTION":
-			text = "Я отвечаю во встроенном режиме Домового. Если для полного ответа не хватает внешней модели, объясню это прямо и продолжу с тем, что можно проверить локально."
+			if !isIdentityInquiry(identityText) {
+				text = "Пока не смог получить проверяемый ответ."
+			}
+		case "CONVERSATIONAL":
+			text = "Я — Домовой, ваш помощник."
 		}
 	}
 	return cognitive.GatewayAdvisoryResponse{Version: request.Version, RequestID: request.RequestID, AdvisoryText: text, FinishReason: cognitive.FinishCompleted}
 }
 
+func isIdentityInquiry(message string) bool {
+	tokens := strings.Fields(strings.ToLower(strings.NewReplacer("?", " ", "!", " ", ",", " ").Replace(message)))
+	hasIdentitySubject := false
+	hasAssistantReference := false
+	for _, token := range tokens {
+		switch token {
+		case "кто", "зовут", "имя":
+			hasIdentitySubject = true
+		case "ты", "тебя", "тебе", "вы", "вас":
+			hasAssistantReference = true
+		}
+	}
+	return hasIdentitySubject && hasAssistantReference
+}
+
 func (g cognitiveGateway) invokeBuiltinAdvisory(ctx context.Context, request cognitive.GatewayAdvisoryRequest, maxOutputBytes int) cognitive.GatewayAdvisoryResponse {
 	if g.builtinLocal != nil && g.builtinLocal.Provider != nil {
 		invocation := cognitive.AdvisoryRequest{Version: request.Version, RequestID: request.RequestID, ActorID: request.ActorID, PrincipalID: request.PrincipalID, ScopeID: request.ScopeID, Message: request.Message, Context: request.Context, Locale: request.Locale, MaxOutputBytes: maxOutputBytes, ProviderBindingID: "builtin-local-binding-v1", ProviderBindingRevision: 1, ProviderInstanceID: "builtin-local-lifeboat-v1", ModelDescriptorID: "builtin-local-model-v1", ProviderModelID: "domovoy-lifeboat"}

cmd/cognitive-worker/gateway_registry_test.go

@@ -185,11 +185,34 @@ func TestNoActiveBindingUsesBuiltInProviderWithoutInvocation(t *testing.T) {
 func TestBuiltInAdvisoryUsesTrustedInformationIntentInsteadOfMessageKeywords(t *testing.T) {
 	request := cognitive.GatewayAdvisoryRequest{Version: cognitive.CreatorAdvisoryV1, RequestID: "request-1", Message: "arbitrary text", Meaning: cognitive.TaskMeaning{InformationRequestKind: interaction.InformationRequestCognitiveRecovery}}
 	response := builtinAdvisory(request)
-	if !strings.Contains(response.AdvisoryText, "восстановление ИИ") {
+	if response.AdvisoryText != "Встроенный канал сейчас недоступен." {
 		t.Fatalf("unexpected recovery response: %q", response.AdvisoryText)
 	}
 }
 
+func TestBuiltInAdvisoryIdentityIsNaturalAndDoesNotMentionResponseLength(t *testing.T) {
+	response := builtinAdvisory(cognitive.GatewayAdvisoryRequest{
+		Version:   cognitive.CreatorAdvisoryV1,
+		RequestID: "request-identity",
+		Meaning:   cognitive.TaskMeaning{SpeechAct: "QUESTION", RequestedOutcome: "ты кто?"},
+	})
+	if response.AdvisoryText != "Я — Домовой, ваш помощник." {
+		t.Fatalf("unexpected identity response: %q", response.AdvisoryText)
+	}
+	if strings.Contains(response.AdvisoryText, "коротко") || strings.Contains(response.AdvisoryText, "подробност") {
+		t.Fatalf("identity response contains style meta-text: %q", response.AdvisoryText)
+	}
+	messageResponse := builtinAdvisory(cognitive.GatewayAdvisoryRequest{
+		Version:   cognitive.CreatorAdvisoryV1,
+		RequestID: "request-identity-message",
+		Message:   "как тебя зовут?",
+		Meaning:   cognitive.TaskMeaning{SpeechAct: "QUESTION"},
+	})
+	if messageResponse.AdvisoryText != "Я — Домовой, ваш помощник." {
+		t.Fatalf("unexpected message identity response: %q", messageResponse.AdvisoryText)
+	}
+}
+
 func TestNoActiveBindingInvokesBuiltInLocalProvider(t *testing.T) {
 	registry := &registryStub{err: errors.New("no active binding")}
 	provider := &stubAdvisoryProvider{response: cognitive.AdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: "request-1", AdvisoryText: "локальный ответ", FinishReason: cognitive.FinishCompleted}}

cmd/cognitive-worker/interpretation.go

@@ -163,8 +163,8 @@ func interpretationPrompt(request cognitive.GatewayInterpretationRequest) string
 Allowed speech acts: DIRECTIVE, ASSERTION, DECISION, PREFERENCE, QUESTION, HYPOTHESIS, CORRECTION, REQUEST_TO_INVESTIGATE, CONFIRMATION, REJECTION, CANCELLATION, CONVERSATIONAL, UNKNOWN.
 Allowed applicability: APPLICABLE, LOW_CONFIDENCE, MIXED_INTENT, NEEDS_BROADER_INTERPRETATION, CLARIFICATION_REQUIRED.
 Allowed clarification: NOT_REQUIRED or REQUIRED.
-Capability hints may only contain known capability kinds like COGNITIVE_REASONING, MODIFY_CODE, RUN_TESTS, SEND_EMAIL, SCHEDULE_REMINDER, VERIFY_FACT, INSPECT_PROJECT, READ_DATABASE, QUERY_LOGS.
-Interpret the human utterance semantically. Do not claim action execution. Do not treat punctuation alone as decisive. If uncertain, set applicability accordingly.
+Capability hints may only contain known capability kinds like COGNITIVE_REASONING, WEB_RESEARCH, MODIFY_CODE, RUN_TESTS, SEND_EMAIL, SCHEDULE_REMINDER, VERIFY_FACT, INSPECT_PROJECT, READ_DATABASE, QUERY_LOGS.
+Interpret the human utterance semantically. Do not claim action execution. A question asking for a current, external or otherwise source-dependent fact should receive WEB_RESEARCH; do not answer that fact from model memory. A request to discuss hypotheses or options is different and may receive COGNITIVE_REASONING. Do not treat punctuation alone as decisive. If uncertain, set applicability accordingly.
 Message: %q
 Deterministic primary: %s
 Deterministic secondary: %s

cmd/cognitive-worker/main.go

@@ -97,7 +97,8 @@ func main() {
 	if gpuErr != nil {
 		log.Printf("optional GPU provider disabled: %v", gpuErr)
 	} else if gpuConfigured {
-		gpuAdapter, adapterErr := models.NewOpenAICompatibleLocalAdapterWithAPIKey(gpuURL, gpuKey, nil)
+		gpuTimeout := durationEnv("LOCAL_GPU_PROVIDER_TIMEOUT", 60*time.Second)
+		gpuAdapter, adapterErr := models.NewOpenAICompatibleLocalAdapterWithAPIKeyAndTimeout(gpuURL, gpuKey, nil, gpuTimeout)
 		if adapterErr != nil {
 			log.Printf("optional GPU provider disabled: %v", adapterErr)
 		} else {
@@ -125,7 +126,9 @@ func main() {
 	}
 	cpuEndpoint := strings.TrimRight(envOr("LOCAL_CPU_PROVIDER_URL", "http://docker.cin.su:18082/v1"), "/") + "/models"
 	cpuHealthProbe := health.OptionalHTTPProbeWithHeaders(cpuReadinessClient, cpuEndpoint, cpuFleetHeaders)
-	cpuHealthProbe.Timeout = 10 * time.Second
+	// Opportunistic providers must not hide a ready local lifeboat. Keep their
+	// readiness budget short; their detailed fleet state is reported separately.
+	cpuHealthProbe.Timeout = 2 * time.Second
 	mediumEndpoint := ""
 	mediumHeaders := map[string]string{}
 	mediumHealthProbe := health.Probe{}
@@ -135,7 +138,7 @@ func main() {
 			mediumHeaders["Authorization"] = "Bearer " + mediumAPIKey
 		}
 		mediumHealthProbe = health.OptionalHTTPProbeWithHeaders(mediumReadinessClient, mediumEndpoint, mediumHeaders)
-		mediumHealthProbe.Timeout = 10 * time.Second
+		mediumHealthProbe.Timeout = 2 * time.Second
 	}
 	readinessProbes := []health.Probe{
 		health.HTTPProbe(readinessClient, strings.TrimRight(envOr("CORE_RUNTIME_URL", "http://core-runtime:8080"), "/")+"/healthz"),
@@ -148,7 +151,7 @@ func main() {
 	if gpuConfigured {
 		gpuHeaders := map[string]string{"Authorization": "Bearer " + gpuKey}
 		gpuProbe := health.OptionalHTTPProbeWithHeaders(readinessClient, strings.TrimRight(gpuURL, "/")+"/models", gpuHeaders)
-		gpuProbe.Timeout = 10 * time.Second
+		gpuProbe.Timeout = 2 * time.Second
 		readinessProbes = append(readinessProbes, gpuProbe)
 	}
 

cmd/cognitive-worker/main_test.go

@@ -4,6 +4,7 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 )
 
 func TestLifeboatProviderIsOptionalAndLocalAdapterBacked(t *testing.T) {
@@ -19,6 +20,21 @@ func TestLifeboatProviderIsOptionalAndLocalAdapterBacked(t *testing.T) {
 	}
 }
 
+func TestGPUProviderTimeoutUsesBoundedConfigurableDefault(t *testing.T) {
+	t.Setenv("LOCAL_GPU_PROVIDER_TIMEOUT", "")
+	if got := durationEnv("LOCAL_GPU_PROVIDER_TIMEOUT", 60*time.Second); got != 60*time.Second {
+		t.Fatalf("default GPU timeout=%s", got)
+	}
+	t.Setenv("LOCAL_GPU_PROVIDER_TIMEOUT", "31s")
+	if got := durationEnv("LOCAL_GPU_PROVIDER_TIMEOUT", 60*time.Second); got != 31*time.Second {
+		t.Fatalf("configured GPU timeout=%s", got)
+	}
+	t.Setenv("LOCAL_GPU_PROVIDER_TIMEOUT", "invalid")
+	if got := durationEnv("LOCAL_GPU_PROVIDER_TIMEOUT", 60*time.Second); got != 60*time.Second {
+		t.Fatalf("invalid GPU timeout=%s", got)
+	}
+}
+
 func TestLoadLocalCPUProviderAPIKeyUsesProtectedFileReference(t *testing.T) {
 	t.Setenv("LOCAL_CPU_PROVIDER_API_KEY", "")
 	_ = os.Unsetenv("LOCAL_CPU_PROVIDER_API_KEY")

cmd/cognitive-worker/task_evaluation.go

@@ -1,9 +1,11 @@
 package main
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"strings"
 	"sync"
 	"time"
 
@@ -34,20 +36,13 @@ func (g cognitiveGateway) taskEvaluationHandler(w http.ResponseWriter, r *http.R
 		http.Error(w, "external egress acknowledgement required", http.StatusBadRequest)
 		return
 	}
-	provider := g.provider(selected)
-	if provider == nil {
-		http.Error(w, "cognitive provider unavailable", http.StatusServiceUnavailable)
-		return
-	}
+
 	caseSet := make(map[string]struct{}, len(request.Profile.RequiredCaseIDs))
+	seenCases := make(map[string]struct{}, len(request.Cases))
 	for _, id := range request.Profile.RequiredCaseIDs {
 		caseSet[id] = struct{}{}
 	}
-	observations := make([]capability.TaskCaseObservation, len(request.Cases))
-	responses := make([]capability.TaskCaseResponse, len(request.Cases))
-	var wg sync.WaitGroup
-	seenCases := make(map[string]struct{}, len(request.Cases))
-	for i, item := range request.Cases {
+	for _, item := range request.Cases {
 		if item.CaseID == "" || item.Prompt == "" || item.EvidenceArtifactRef == "" {
 			http.Error(w, "invalid task evaluation case", http.StatusBadRequest)
 			return
@@ -61,35 +56,83 @@ func (g cognitiveGateway) taskEvaluationHandler(w http.ResponseWriter, r *http.R
 			return
 		}
 		seenCases[item.CaseID] = struct{}{}
-		wg.Add(1)
-		go func(index int, item capability.TaskEvaluationCase) {
-			defer wg.Done()
-			started := time.Now()
-			invocation := cognitive.AdvisoryRequest{Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(fmt.Sprintf("task-evaluation:%s:%s", request.Profile.ID, item.CaseID)), ActorID: request.ActorID, PrincipalID: request.PrincipalID, ScopeID: request.ScopeID, Message: item.Prompt, MaxOutputBytes: int(request.MaxOutputBytes), ProviderBindingID: selected.Binding.ID, ProviderBindingRevision: selected.Binding.Revision, ProviderInstanceID: selected.Provider.ID, ModelDescriptorID: selected.Model.ID, ProviderModelID: selected.Model.ProviderModelID}
-			response, invokeErr := g.invokeAdmitted(r.Context(), string(invocation.RequestID), provider, invocation, int(request.MaxOutputBytes))
-			observation := capability.TaskCaseObservation{CaseID: item.CaseID, LatencyMicros: time.Since(started).Microseconds(), EvidenceArtifactRef: item.EvidenceArtifactRef}
-			responses[index] = capability.TaskCaseResponse{CaseID: item.CaseID, ResponseText: response.AdvisoryText, LatencyMicros: observation.LatencyMicros, EvidenceArtifactRef: item.EvidenceArtifactRef}
-			if invokeErr == nil && response.FinishReason == cognitive.FinishCompleted && response.AdvisoryText != "" {
-				// Invocation success proves reachability only. Without an
-				// independent verifier and answer evidence, semantic support and
-				// quality must remain UNKNOWN rather than becoming false evidence.
-				observation.Result = capability.EvaluationUnknown
-				observation.QualityScoreMillis = 0
-			} else {
-				observation.Result = capability.EvaluationUnknown
-				observation.CriticalFailure = invokeErr != nil
-			}
-			observations[index] = observation
-		}(i, item)
 	}
 	if len(seenCases) != len(caseSet) {
 		http.Error(w, "task evaluation case set is incomplete", http.StatusBadRequest)
 		return
 	}
-	wg.Wait()
+
+	// One bounded fan-out wave uses one binding snapshot. If that candidate is
+	// unavailable, only this binding is excluded and the existing resolver
+	// chooses the next eligible candidate. Provider output remains untrusted
+	// until the independent verifier accepts it downstream.
+	requirement := capability.CognitiveRequirement{CapabilityID: request.CapabilityID, OwnerPrincipalID: request.PrincipalID, DataPolicy: selected.Binding.DataPolicy, RequiredModalities: []capability.ModelModality{capability.ModalityText}, RequiredCapabilities: []capability.ModelCapability{capability.CapabilityAdvisory}, AllowCanary: g.allowCanary, MaxOutputBytes: request.MaxOutputBytes}
+	var observations []capability.TaskCaseObservation
+	var responses []capability.TaskCaseResponse
+	for attempt := 0; attempt < 3; attempt++ {
+		provider := g.provider(selected)
+		if provider == nil {
+			observations, responses = taskEvaluationUnavailable(request.Cases)
+		} else {
+			observations, responses = g.executeTaskEvaluationCases(r.Context(), request, selected, provider)
+		}
+		if taskEvaluationResponsesUsable(responses) {
+			break
+		}
+		requirement.ExcludedBindingIDs = append(requirement.ExcludedBindingIDs, selected.Binding.ID)
+		fallback, resolveErr := g.resolver.Resolve(r.Context(), requirement)
+		fallbackProvider := g.provider(fallback)
+		if resolveErr != nil || fallbackProvider == nil || fallback.Binding.ID == selected.Binding.ID || (fallback.Binding.DataPolicy != capability.DataPolicyLocalOnly && !request.EgressAcknowledged) {
+			break
+		}
+		selected = fallback
+	}
+
 	writeTaskEvaluationJSON(w, capability.TaskEvaluationExecutionResponse{ProfileID: request.Profile.ID, BindingID: selected.Binding.ID, BindingRevision: selected.Binding.Revision, Observations: observations, Responses: responses, ObservedAtUnixMillis: time.Now().UnixMilli()})
 }
 
+func (g cognitiveGateway) executeTaskEvaluationCases(ctx context.Context, request capability.TaskEvaluationExecutionRequest, selected capability.ResolvedCognitiveBinding, provider advisoryProvider) ([]capability.TaskCaseObservation, []capability.TaskCaseResponse) {
+	observations := make([]capability.TaskCaseObservation, len(request.Cases))
+	responses := make([]capability.TaskCaseResponse, len(request.Cases))
+	var wg sync.WaitGroup
+	for i, item := range request.Cases {
+		wg.Add(1)
+		go func(index int, item capability.TaskEvaluationCase) {
+			defer wg.Done()
+			started := time.Now()
+			invocation := cognitive.AdvisoryRequest{Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(fmt.Sprintf("task-evaluation:%s:%s", request.Profile.ID, item.CaseID)), ActorID: request.ActorID, PrincipalID: request.PrincipalID, ScopeID: request.ScopeID, Message: item.Prompt, MaxOutputBytes: int(request.MaxOutputBytes), ProviderBindingID: selected.Binding.ID, ProviderBindingRevision: selected.Binding.Revision, ProviderInstanceID: selected.Provider.ID, ModelDescriptorID: selected.Model.ID, ProviderModelID: selected.Model.ProviderModelID}
+			response, invokeErr := g.invokeAdmitted(ctx, string(invocation.RequestID), provider, invocation, int(request.MaxOutputBytes))
+			latency := time.Since(started).Microseconds()
+			observations[index] = capability.TaskCaseObservation{CaseID: item.CaseID, Result: capability.EvaluationUnknown, CriticalFailure: invokeErr != nil || response.FinishReason != cognitive.FinishCompleted || strings.TrimSpace(response.AdvisoryText) == "", EvidenceArtifactRef: item.EvidenceArtifactRef, LatencyMicros: latency}
+			responses[index] = capability.TaskCaseResponse{CaseID: item.CaseID, ResponseText: response.AdvisoryText, LatencyMicros: latency, EvidenceArtifactRef: item.EvidenceArtifactRef}
+		}(i, item)
+	}
+	wg.Wait()
+	return observations, responses
+}
+
+func taskEvaluationUnavailable(cases []capability.TaskEvaluationCase) ([]capability.TaskCaseObservation, []capability.TaskCaseResponse) {
+	observations := make([]capability.TaskCaseObservation, len(cases))
+	responses := make([]capability.TaskCaseResponse, len(cases))
+	for i, item := range cases {
+		observations[i] = capability.TaskCaseObservation{CaseID: item.CaseID, Result: capability.EvaluationUnknown, CriticalFailure: true, EvidenceArtifactRef: item.EvidenceArtifactRef}
+		responses[i] = capability.TaskCaseResponse{CaseID: item.CaseID, EvidenceArtifactRef: item.EvidenceArtifactRef}
+	}
+	return observations, responses
+}
+
+func taskEvaluationResponsesUsable(responses []capability.TaskCaseResponse) bool {
+	if len(responses) == 0 {
+		return false
+	}
+	for _, response := range responses {
+		if strings.TrimSpace(response.ResponseText) == "" {
+			return false
+		}
+	}
+	return true
+}
+
 func writeTaskEvaluationJSON(w http.ResponseWriter, value any) {
 	w.Header().Set("Content-Type", "application/json")
 	_ = json.NewEncoder(w).Encode(value)

cmd/cognitive-worker/task_evaluation_test.go

@@ -56,3 +56,90 @@ func TestTaskEvaluationHandlerInvokesEveryBoundedCase(t *testing.T) {
 		}
 	}
 }
+
+type taskEvaluationFailoverRegistry struct {
+	primary, fallback capability.ResolvedCognitiveBinding
+	resolveCalls      int
+}
+
+func (s *taskEvaluationFailoverRegistry) ResolveCandidate(context.Context, capability.CapabilityBindingID, int64) (capability.ResolvedCognitiveBinding, error) {
+	return s.primary, nil
+}
+
+func (s *taskEvaluationFailoverRegistry) Resolve(_ context.Context, requirement capability.CognitiveRequirement) (capability.ResolvedCognitiveBinding, error) {
+	s.resolveCalls++
+	if len(requirement.ExcludedBindingIDs) == 0 {
+		return s.primary, nil
+	}
+	return s.fallback, nil
+}
+
+func (s *taskEvaluationFailoverRegistry) Observe(context.Context, capability.CognitiveUsageObservation) error {
+	return nil
+}
+
+func (s *taskEvaluationFailoverRegistry) RegisterDiscovery(context.Context, capability.CognitiveDiscoverySnapshot) (capability.CognitiveDiscoveryRegistration, error) {
+	return capability.CognitiveDiscoveryRegistration{}, nil
+}
+
+func TestTaskEvaluationExcludesUnavailableCandidateAndUsesFallback(t *testing.T) {
+	primary := gatewaySelection()
+	fallback := primary
+	fallback.Binding.ID = "binding-fallback"
+	fallback.Binding.Revision = 7
+	fallback.Binding.ProviderInstanceID = "provider-fallback"
+	fallback.Provider.ID = "provider-fallback"
+	fallback.Provider.Kind = "provider-fallback-kind"
+	fallback.Provider.EndpointRef = "fallback-endpoint"
+	fallback.Provider.CredentialRef = "fallback-credential"
+	fallback.Model.ProviderInstanceID = "provider-fallback"
+	registry := &taskEvaluationFailoverRegistry{primary: primary, fallback: fallback}
+	primaryProvider := &stubAdvisoryProvider{response: cognitive.AdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, FinishReason: cognitive.FinishProviderUnavailable}}
+	fallbackProvider := &stubAdvisoryProvider{response: cognitive.AdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, FinishReason: cognitive.FinishCompleted, AdvisoryText: "fallback response"}}
+	gateway := cognitiveGateway{resolver: registry, providers: map[capability.ProviderKind][]providerRegistration{
+		primary.Provider.Kind:  {{ProviderInstanceID: primary.Provider.ID, Kind: primary.Provider.Kind, EndpointRef: primary.Provider.EndpointRef, CredentialRef: primary.Provider.CredentialRef, Provider: primaryProvider}},
+		fallback.Provider.Kind: {{ProviderInstanceID: fallback.Provider.ID, Kind: fallback.Provider.Kind, EndpointRef: fallback.Provider.EndpointRef, CredentialRef: fallback.Provider.CredentialRef, Provider: fallbackProvider}},
+	}, now: func() time.Time { return time.UnixMilli(1000) }}
+	profile := capability.TaskEvaluationProfile{ID: "profile-failover", Revision: 1, CapabilityID: primary.Binding.CapabilityID, Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "failover-v1", RequiredCaseIDs: []string{"case-a"}, QualityWeightMillis: 600, ReliabilityWeightMillis: 300, LatencyWeightMillis: 100}
+	request := capability.TaskEvaluationExecutionRequest{Profile: profile, CapabilityID: profile.CapabilityID, BindingID: primary.Binding.ID, BindingRevision: primary.Binding.Revision, ActorID: identity.ActorID("actor-1"), PrincipalID: primary.Binding.OwnerPrincipalID, ScopeID: authority.ScopeID("scope-1"), MaxOutputBytes: 512, EgressAcknowledged: true, Cases: []capability.TaskEvaluationCase{{CaseID: "case-a", Prompt: "one", EvidenceArtifactRef: "artifact:a"}}}
+	payload, _ := json.Marshal(request)
+	recorder := httptest.NewRecorder()
+	gateway.taskEvaluationHandler(recorder, httptest.NewRequest(http.MethodPost, "/v1/task-evaluations/execute", bytes.NewReader(payload)))
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String())
+	}
+	var response capability.TaskEvaluationExecutionResponse
+	if err := json.Unmarshal(recorder.Body.Bytes(), &response); err != nil {
+		t.Fatal(err)
+	}
+	if response.BindingID != fallback.Binding.ID || !primaryProvider.called || !fallbackProvider.called || registry.resolveCalls != 1 {
+		t.Fatalf("failover binding=%s primary_called=%t fallback_called=%t resolve_calls=%d", response.BindingID, primaryProvider.called, fallbackProvider.called, registry.resolveCalls)
+	}
+	if response.Observations[0].CriticalFailure || response.Responses[0].ResponseText != "fallback response" {
+		t.Fatalf("fallback response was not usable: %+v %+v", response.Observations, response.Responses)
+	}
+}
+
+func TestTaskEvaluationUnavailableResponseIsMarkedCriticalUnknown(t *testing.T) {
+	selected := gatewaySelection()
+	registry := &taskEvaluationFailoverRegistry{primary: selected, fallback: selected}
+	provider := &stubAdvisoryProvider{response: cognitive.AdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, FinishReason: cognitive.FinishTimeout}}
+	gateway := cognitiveGateway{resolver: registry, providers: map[capability.ProviderKind][]providerRegistration{
+		selected.Provider.Kind: {{ProviderInstanceID: selected.Provider.ID, Kind: selected.Provider.Kind, EndpointRef: selected.Provider.EndpointRef, CredentialRef: selected.Provider.CredentialRef, Provider: provider}},
+	}, now: func() time.Time { return time.UnixMilli(1000) }}
+	profile := capability.TaskEvaluationProfile{ID: "profile-unknown", Revision: 1, CapabilityID: selected.Binding.CapabilityID, Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "unknown-v1", RequiredCaseIDs: []string{"case-a"}, QualityWeightMillis: 600, ReliabilityWeightMillis: 300, LatencyWeightMillis: 100}
+	request := capability.TaskEvaluationExecutionRequest{Profile: profile, CapabilityID: profile.CapabilityID, BindingID: selected.Binding.ID, BindingRevision: selected.Binding.Revision, ActorID: identity.ActorID("actor-1"), PrincipalID: selected.Binding.OwnerPrincipalID, ScopeID: authority.ScopeID("scope-1"), MaxOutputBytes: 512, EgressAcknowledged: true, Cases: []capability.TaskEvaluationCase{{CaseID: "case-a", Prompt: "one", EvidenceArtifactRef: "artifact:a"}}}
+	payload, _ := json.Marshal(request)
+	recorder := httptest.NewRecorder()
+	gateway.taskEvaluationHandler(recorder, httptest.NewRequest(http.MethodPost, "/v1/task-evaluations/execute", bytes.NewReader(payload)))
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String())
+	}
+	var response capability.TaskEvaluationExecutionResponse
+	if err := json.Unmarshal(recorder.Body.Bytes(), &response); err != nil {
+		t.Fatal(err)
+	}
+	if len(response.Observations) != 1 || response.Observations[0].Result != capability.EvaluationUnknown || !response.Observations[0].CriticalFailure {
+		t.Fatalf("unavailable response was overclaimed: %+v", response.Observations)
+	}
+}

cmd/core-runtime/chat_orchestrator.go

@@ -0,0 +1,71 @@
+package main
+
+import (
+	"sort"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	interactiondomain "git.cin.su/m/Assistant/modules/interaction/domain"
+)
+
+type chatRouteKind string
+
+const (
+	chatRouteResearch     chatRouteKind = "RESEARCH"
+	chatRouteConversation chatRouteKind = "CONVERSATION"
+	chatRouteAction       chatRouteKind = "ACTION"
+	chatRouteAgent        chatRouteKind = "AGENT"
+)
+
+type chatRoute struct {
+	Kind       chatRouteKind
+	Capability capability.CapabilityKind
+	Profile    string
+	Order      int
+}
+
+// buildChatRoutePlan creates one bounded route per meaning-bearing capability.
+// A failed research route must not suppress the local conversational route or
+// an unrelated action route.
+func buildChatRoutePlan(result interactiondomain.SemanticResult) []chatRoute {
+	seen := make(map[capability.CapabilityKind]struct{})
+	routes := make([]chatRoute, 0, len(result.CapabilityHints)+1)
+	add := func(kind chatRouteKind, capabilityKind capability.CapabilityKind, profile string, order int) {
+		if capabilityKind != "" {
+			if _, exists := seen[capabilityKind]; exists {
+				return
+			}
+			seen[capabilityKind] = struct{}{}
+		}
+		routes = append(routes, chatRoute{Kind: kind, Capability: capabilityKind, Profile: profile, Order: order})
+	}
+	for _, hint := range result.CapabilityHints {
+		switch capability.CapabilityKind(hint) {
+		case capability.CapabilityKindWebResearch:
+			add(chatRouteResearch, capability.CapabilityKindWebResearch, "truth-research-v1", 10)
+		case capability.CapabilityKindCognitiveReasoning, capability.CapabilityKindVerifyFact:
+			add(chatRouteConversation, capability.CapabilityKind(hint), "local-reasoning-v1", 20)
+		case capability.CapabilityKindScheduleReminder:
+			add(chatRouteAction, capability.CapabilityKindScheduleReminder, "continuity-reminder-v1", 30)
+		case capability.CapabilityKindModifyCode, capability.CapabilityKindRunTests, capability.CapabilityKindInspectProject:
+			add(chatRouteAgent, capability.CapabilityKind(hint), "software-agent-v1", 40)
+		case capability.CapabilityKindSendEmail, capability.CapabilityKindReadEmail:
+			add(chatRouteAgent, capability.CapabilityKind(hint), "communication-agent-v1", 50)
+		case capability.CapabilityKindReadDatabase, capability.CapabilityKindQueryLogs:
+			add(chatRouteAgent, capability.CapabilityKind(hint), "diagnostics-agent-v1", 60)
+		}
+	}
+	if result.NeedsCognition || len(routes) == 0 {
+		add(chatRouteConversation, capability.CapabilityKindCognitiveReasoning, "local-reasoning-v1", 20)
+	}
+	sort.SliceStable(routes, func(i, j int) bool { return routes[i].Order < routes[j].Order })
+	return routes
+}
+
+func hasChatRoute(routes []chatRoute, kind chatRouteKind) bool {
+	for _, route := range routes {
+		if route.Kind == kind {
+			return true
+		}
+	}
+	return false
+}

cmd/core-runtime/chat_orchestrator_test.go

@@ -0,0 +1,41 @@
+package main
+
+import (
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	interactiondomain "git.cin.su/m/Assistant/modules/interaction/domain"
+)
+
+func TestBuildChatRoutePlanPreservesMultipleMeaningfulRoutes(t *testing.T) {
+	planned := buildChatRoutePlan(interactiondomain.SemanticResult{
+		NeedsCognition:  true,
+		CapabilityHints: []string{"WEB_RESEARCH", "MODIFY_CODE", "RUN_TESTS", "SCHEDULE_REMINDER"},
+	})
+	if len(planned) != 5 {
+		t.Fatalf("expected five deduplicated routes, got %+v", planned)
+	}
+	want := []struct {
+		kind    chatRouteKind
+		profile string
+		cap     capability.CapabilityKind
+	}{
+		{chatRouteResearch, "truth-research-v1", capability.CapabilityKindWebResearch},
+		{chatRouteConversation, "local-reasoning-v1", capability.CapabilityKindCognitiveReasoning},
+		{chatRouteAction, "continuity-reminder-v1", capability.CapabilityKindScheduleReminder},
+		{chatRouteAgent, "software-agent-v1", capability.CapabilityKindModifyCode},
+		{chatRouteAgent, "software-agent-v1", capability.CapabilityKindRunTests},
+	}
+	for index, expected := range want {
+		if planned[index].Kind != expected.kind || planned[index].Profile != expected.profile || planned[index].Capability != expected.cap {
+			t.Fatalf("route %d = %+v, want %+v", index, planned[index], expected)
+		}
+	}
+}
+
+func TestBuildChatRoutePlanAlwaysKeepsLocalConversationRoute(t *testing.T) {
+	planned := buildChatRoutePlan(interactiondomain.SemanticResult{NeedsCognition: true})
+	if len(planned) != 1 || planned[0].Kind != chatRouteConversation || planned[0].Profile != "local-reasoning-v1" {
+		t.Fatalf("unexpected local route: %+v", planned)
+	}
+}

cmd/core-runtime/cognitive_interpretation.go

@@ -5,8 +5,11 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"hash/fnv"
 	"net/http"
 	"net/url"
+	"strings"
+	"time"
 
 	"git.cin.su/m/Assistant/contracts/authority"
 	"git.cin.su/m/Assistant/contracts/capability"
@@ -22,6 +25,56 @@ type cognitiveInterpretationClient struct {
 	client  *http.Client
 }
 
+// ReviewResponse asks the cognitive gateway to turn a locally assembled draft
+// into a natural answer. The draft remains the safe fallback when cognition is
+// unavailable; the model does not mutate canonical state or execute actions.
+func (c cognitiveInterpretationClient) ReviewResponse(ctx context.Context, session identity.CreatorSession, userMessage, draft string, meaning cognitive.TaskMeaning) (string, error) {
+	requestID, err := ids.New()
+	if err != nil {
+		return "", err
+	}
+	prompt := "Ты редактор ответа Домового. Проверь черновик по смыслу и подготовь естественный ответ человеку. Учитывай весь запрос, включая недостающие параметры для конкретного результата. Если данных не хватает, задай один короткий полезный уточняющий вопрос, например откуда и куда ехать. Не выдавай поисковые сниппеты как выполненное действие и не показывай служебные URL поисковой выдачи. Сохрани проверяемые факты, названия источников, прямые ссылки и ограничения. Не выдумывай факты и не утверждай невыполненные действия. Верни только готовый ответ без разбора проверки, служебных слов и упоминания моделей. Если черновик уже адекватен, верни его без лишних добавлений.\n\nСообщение пользователя:\n" + userMessage + "\n\nЧерновик ответа:\n" + draft
+	target := *c.baseURL
+	target.Path = "/v1/advisories"
+	payload, err := json.Marshal(cognitive.GatewayAdvisoryRequest{
+		Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(requestID),
+		ActorID: session.ActorID, PrincipalID: session.PrincipalID,
+		ScopeID: authority.ScopeID("domovoy-global-scope"), Message: prompt,
+		Locale: "ru", MaxOutputBytes: 2048, DataPolicy: capability.DataPolicyLocalOnly,
+		Meaning: cognitive.TaskMeaning{
+			SpeechAct:              "RESPONSE_REVIEW",
+			CapabilityHints:        meaning.CapabilityHints,
+			RequestedOutcome:       meaning.RequestedOutcome,
+			InformationRequestKind: meaning.InformationRequestKind,
+			ConfidenceMillis:       meaning.ConfidenceMillis,
+		},
+	})
+	if err != nil {
+		return "", err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, target.String(), bytes.NewReader(payload))
+	if err != nil {
+		return "", err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	response, err := c.client.Do(request)
+	if err != nil {
+		return "", err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("cognitive response review status %d", response.StatusCode)
+	}
+	var result cognitive.GatewayAdvisoryResponse
+	if err := json.NewDecoder(response.Body).Decode(&result); err != nil {
+		return "", err
+	}
+	if result.FinishReason != cognitive.FinishCompleted || strings.TrimSpace(result.AdvisoryText) == "" {
+		return "", fmt.Errorf("cognitive response review incomplete: %s", result.FinishReason)
+	}
+	return strings.TrimSpace(result.AdvisoryText), nil
+}
+
 func newCognitiveInterpretationClient(rawURL string, client *http.Client) (cognitiveInterpretationClient, error) {
 	base, err := url.Parse(rawURL)
 	if err != nil || base.Scheme == "" || base.Host == "" {
@@ -61,19 +114,63 @@ func (c cognitiveInterpretationClient) Interpret(ctx context.Context, request co
 }
 
 func shouldRequestBroaderInterpretation(result interactiondomain.SemanticResult) bool {
-	// The built-in advisory channel is the default conversational path. A
-	// simple question must not first wait for the slower, strict JSON
-	// interpretation route: that route exists for ambiguity and work routing,
-	// not as a prerequisite for talking to Domovoy.
-	if isSimpleLocalQuestion(result) {
+	return shouldRequestSemanticInterpretation(result)
+}
+
+// shouldRequestSemanticInterpretation keeps the deterministic layer as a
+// fast reflex, not as the meaning authority. Questions, requests, directives,
+// mixed signals and capability-bearing messages go through cognitive
+// interpretation; only stable low-risk conversational/assertive reflexes may
+// answer without it.
+func shouldRequestSemanticInterpretation(result interactiondomain.SemanticResult) bool {
+	if result.Interpretation.Clarification == interaction.ClarificationRequired {
 		return false
 	}
-	switch result.Interpretation.Applicability {
-	case interaction.SemanticNeedsBroaderInterpret, interaction.SemanticLowConfidence, interaction.SemanticMixedIntent:
+	// Structured, read-only information intents already have a semantic owner
+	// in core-runtime. Sending them through the slower advisory interpretation
+	// path only adds latency and can make a healthy runtime look unavailable.
+	if result.InformationRequestKind != "" {
+		return false
+	}
+	if result.NeedsCognition || len(result.CapabilityHints) > 0 {
 		return true
+	}
+	if result.Interpretation.Applicability != interaction.SemanticApplicable {
+		return true
+	}
+	switch result.Interpretation.SpeechAct {
+	case interaction.SpeechActConversational, interaction.SpeechActConfirmation, interaction.SpeechActRejection:
+		return false
+	case interaction.SpeechActPreference:
+		// Explicit user preferences are durable interaction context. A sampled
+		// advisory audit must not reinterpret or erase them.
+		return false
+	case interaction.SpeechActAssertion:
+		return result.Interpretation.ConfidenceMillis < 850
 	default:
+		return true
+	}
+}
+
+const (
+	deterministicReflexAuditInterval = 10 * time.Minute
+	deterministicReflexAuditSample   = uint32(16)
+)
+
+// shouldAuditDeterministicReflex samples stable reflexes in a time bucket.
+// This is observability, not a correctness gate: a failed audit leaves the
+// reflex usable, while a successful disagreement can replace it with the
+// cognitive candidate and becomes durable evidence through the normal
+// candidate store.
+func shouldAuditDeterministicReflex(result interactiondomain.SemanticResult, utteranceID string, now time.Time) bool {
+	if shouldRequestSemanticInterpretation(result) || utteranceID == "" {
 		return false
 	}
+	bucket := now.Unix() / int64(deterministicReflexAuditInterval/time.Second)
+	hash := fnv.New32a()
+	_, _ = hash.Write([]byte(utteranceID))
+	_, _ = hash.Write([]byte(fmt.Sprintf(":%d", bucket)))
+	return hash.Sum32()%deterministicReflexAuditSample == 0
 }
 
 func isSimpleLocalQuestion(result interactiondomain.SemanticResult) bool {

cmd/core-runtime/cognitive_interpretation_test.go

@@ -1,13 +1,56 @@
 package main
 
 import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
 	"testing"
+	"time"
 
+	"git.cin.su/m/Assistant/contracts/cognitive"
+	"git.cin.su/m/Assistant/contracts/identity"
 	"git.cin.su/m/Assistant/contracts/interaction"
 	interactiondomain "git.cin.su/m/Assistant/modules/interaction/domain"
 )
 
-func TestSimpleQuestionUsesBuiltInAdvisoryWithoutStrictInterpretation(t *testing.T) {
+func TestReviewResponseUsesCognitiveGatewayAndReturnsOnlyDraftAnswer(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var request cognitive.GatewayAdvisoryRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Fatalf("decode review request: %v", err)
+		}
+		if request.Message == "" || request.Meaning.SpeechAct == "" {
+			t.Fatalf("review request did not carry semantic context: %+v", request)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(cognitive.GatewayAdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: request.RequestID, AdvisoryText: "Меня зовут Дед. Я Домовой.", FinishReason: cognitive.FinishCompleted})
+	}))
+	defer server.Close()
+	client, err := newCognitiveInterpretationClient(server.URL, server.Client())
+	if err != nil {
+		t.Fatal(err)
+	}
+	reviewed, err := client.ReviewResponse(context.Background(), identity.CreatorSession{ActorID: "actor", PrincipalID: "principal"}, "кто ты?", "Я — Домовой.", cognitive.TaskMeaning{SpeechAct: "QUESTION"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if reviewed != "Меня зовут Дед. Я Домовой." {
+		t.Fatalf("unexpected reviewed response %q", reviewed)
+	}
+}
+
+func TestReviewPreservesResearchEvidence(t *testing.T) {
+	draft := "Нашёл вариант. Источник: Aviasales (https://www.aviasales.ru/search)"
+	if reviewPreservesResearchEvidence("Нашёл вариант на Авиасейлс.", draft) {
+		t.Fatal("review without the direct source must be rejected")
+	}
+	if !reviewPreservesResearchEvidence("Нашёл вариант. Источник: Aviasales (https://www.aviasales.ru/search)", draft) {
+		t.Fatal("review with the direct source must be accepted")
+	}
+}
+
+func TestSimpleQuestionUsesStrictInterpretationForSemanticRouting(t *testing.T) {
 	result := interactiondomain.SemanticResult{
 		Interpretation: interaction.UtteranceInterpretation{
 			SpeechAct:     interaction.SpeechActQuestion,
@@ -16,8 +59,8 @@ func TestSimpleQuestionUsesBuiltInAdvisoryWithoutStrictInterpretation(t *testing
 		},
 		CapabilityHints: []string{"COGNITIVE_REASONING", "VERIFY_FACT"},
 	}
-	if shouldRequestBroaderInterpretation(result) {
-		t.Fatal("simple question must go directly to the built-in advisory path")
+	if !shouldRequestBroaderInterpretation(result) {
+		t.Fatal("simple question must reach semantic interpretation before any answer")
 	}
 }
 
@@ -34,3 +77,51 @@ func TestOperationalQuestionStillUsesStrictInterpretation(t *testing.T) {
 		t.Fatal("operational question must retain strict interpretation routing")
 	}
 }
+
+func TestStructuredInventoryUsesDirectReadOnlySemanticRoute(t *testing.T) {
+	result := interactiondomain.SemanticResult{
+		Interpretation: interaction.UtteranceInterpretation{
+			SpeechAct:        interaction.SpeechActDirective,
+			Applicability:    interaction.SemanticApplicable,
+			ConfidenceMillis: 980,
+		},
+		InformationRequestKind: interaction.InformationRequestCognitiveModelInventory,
+	}
+	if shouldRequestSemanticInterpretation(result) {
+		t.Fatal("structured model inventory must use the direct read-only semantic route")
+	}
+}
+
+func TestStableReflexIsPeriodicallySampledForDrift(t *testing.T) {
+	result := interactiondomain.SemanticResult{Interpretation: interaction.UtteranceInterpretation{
+		SpeechAct: interaction.SpeechActConversational, Applicability: interaction.SemanticApplicable,
+	}}
+	found := false
+	for minute := 0; minute < 160; minute++ {
+		if shouldAuditDeterministicReflex(result, "utterance-drift-probe", time.Unix(int64(minute)*60, 0)) {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatal("stable reflex was never sampled during the audit window")
+	}
+}
+
+func TestMeaningfulSignalsAreNotReflexOnly(t *testing.T) {
+	for _, act := range []interaction.SpeechAct{interaction.SpeechActQuestion, interaction.SpeechActRequestToInvestigate, interaction.SpeechActDirective} {
+		result := interactiondomain.SemanticResult{Interpretation: interaction.UtteranceInterpretation{SpeechAct: act, Applicability: interaction.SemanticApplicable}}
+		if !shouldRequestSemanticInterpretation(result) {
+			t.Fatalf("%s must prefer cognitive interpretation", act)
+		}
+	}
+}
+
+func TestExplicitPreferenceIsNotReinterpretedByCognitiveAudit(t *testing.T) {
+	result := interactiondomain.SemanticResult{Interpretation: interaction.UtteranceInterpretation{
+		SpeechAct: interaction.SpeechActPreference, Applicability: interaction.SemanticApplicable,
+	}}
+	if shouldRequestSemanticInterpretation(result) || shouldAuditDeterministicReflex(result, "preference", time.Unix(0, 0)) {
+		t.Fatal("explicit preference must remain on the deterministic durable-context path")
+	}
+}

cmd/core-runtime/development_gate.go

@@ -1,14 +1,111 @@
 package main
 
 import (
+	"context"
 	"errors"
+	"strings"
 	"time"
 
+	"git.cin.su/m/Assistant/adapters/developmentexecutor"
 	"git.cin.su/m/Assistant/contracts/work"
 	workdomain "git.cin.su/m/Assistant/modules/work/domain"
+	"git.cin.su/m/Assistant/modules/work/ports"
 )
 
 var errDevelopmentGateCreate = errors.New("development gate must start at evidence collected with revision one")
+var errDevelopmentGateNotIsolated = errors.New("development gate is not isolated")
+var errDevelopmentVerifierNotIndependent = errors.New("development verifier is not independent")
+var errDevelopmentWorktreeMismatch = errors.New("verification worktree does not match gate")
+var errDevelopmentChecksFailed = errors.New("development verification checks failed")
+var errDevelopmentEvidenceRequired = errors.New("development transition evidence is required")
+var errDevelopmentEvidenceStage = errors.New("development transition evidence does not match stage")
+
+type developmentGateVerificationRequest struct {
+	GateID           string
+	ExpectedRevision int64
+	VerifierRunID    work.AgentRunID
+	Plan             developmentexecutor.Plan
+}
+
+type developmentGateEvidenceRequest struct {
+	GateID           string
+	ExpectedRevision int64
+	NextStage        work.DevelopmentStage
+	EvidenceRef      string
+}
+
+func recordDevelopmentGateEvidence(ctx context.Context, store ports.DevelopmentGateStore, request developmentGateEvidenceRequest, now time.Time) (work.DevelopmentGate, error) {
+	gate, err := store.LoadDevelopmentGate(ctx, request.GateID)
+	if err != nil {
+		return work.DevelopmentGate{}, err
+	}
+	if request.ExpectedRevision < 1 || gate.Revision != request.ExpectedRevision {
+		return gate, errDevelopmentGateNotIsolated
+	}
+	if strings.TrimSpace(request.EvidenceRef) == "" {
+		return gate, errDevelopmentEvidenceRequired
+	}
+	switch request.NextStage {
+	case work.DevelopmentCanary:
+		gate.CanaryEvidence = strings.TrimSpace(request.EvidenceRef)
+	case work.DevelopmentPromoted:
+		gate.PromotionRef = strings.TrimSpace(request.EvidenceRef)
+	case work.DevelopmentRolledBack:
+		gate.RollbackRef = strings.TrimSpace(request.EvidenceRef)
+	default:
+		return gate, errDevelopmentEvidenceStage
+	}
+	advanced, err := advanceDevelopmentGate(gate, request.NextStage, now)
+	if err != nil {
+		return gate, err
+	}
+	if err := store.SaveDevelopmentGate(ctx, advanced, request.ExpectedRevision); err != nil {
+		return gate, err
+	}
+	return advanced, nil
+}
+
+func verifyDevelopmentGate(ctx context.Context, store ports.DevelopmentGateStore, request developmentGateVerificationRequest, now time.Time, runner developmentexecutor.CommandRunner) (work.DevelopmentGate, developmentexecutor.Result, error) {
+	gate, err := store.LoadDevelopmentGate(ctx, request.GateID)
+	if err != nil {
+		return work.DevelopmentGate{}, developmentexecutor.Result{}, err
+	}
+	if request.ExpectedRevision < 1 || gate.Revision != request.ExpectedRevision || gate.Stage != work.DevelopmentIsolated {
+		return gate, developmentexecutor.Result{}, errDevelopmentGateNotIsolated
+	}
+	if request.VerifierRunID == "" || sameRun(request.VerifierRunID, gate.ProducerRunRefs) {
+		return gate, developmentexecutor.Result{}, errDevelopmentVerifierNotIndependent
+	}
+	if request.Plan.WorktreeID != gate.WorktreeRef {
+		return gate, developmentexecutor.Result{}, errDevelopmentWorktreeMismatch
+	}
+	result, err := developmentexecutor.Execute(ctx, request.Plan, runner)
+	if err != nil {
+		return gate, result, err
+	}
+	if !result.Passed {
+		return gate, result, errDevelopmentChecksFailed
+	}
+	gate.VerifierRunRefs = append(append([]work.AgentRunID(nil), gate.VerifierRunRefs...), request.VerifierRunID)
+	gate.VerificationEvidence = result.EvidenceRef
+	advanced, err := advanceDevelopmentGate(gate, work.DevelopmentVerified, now)
+	if err != nil {
+		return gate, result, err
+	}
+	if err := store.SaveDevelopmentGate(ctx, advanced, request.ExpectedRevision); err != nil {
+		return gate, result, err
+	}
+	return advanced, result, nil
+}
+
+func sameRun(value work.AgentRunID, runs []work.AgentRunID) bool {
+	for _, run := range runs {
+		if run == value {
+			return true
+		}
+	}
+	return false
+}
 
 func prepareDevelopmentGate(value work.DevelopmentGate, now time.Time) (work.DevelopmentGate, error) {
 	if value.Stage != work.DevelopmentEvidenceCollected || value.Revision != 1 {

cmd/core-runtime/development_gate_test.go

@@ -1,12 +1,153 @@
 package main
 
 import (
+	"context"
+	"path/filepath"
 	"testing"
 	"time"
 
+	"git.cin.su/m/Assistant/adapters/developmentexecutor"
 	"git.cin.su/m/Assistant/contracts/work"
 )
 
+type developmentGateStoreStub struct {
+	gate     work.DevelopmentGate
+	saved    bool
+	expected int64
+}
+
+func (s *developmentGateStoreStub) LoadDevelopmentGate(context.Context, string) (work.DevelopmentGate, error) {
+	return s.gate, nil
+}
+
+func (s *developmentGateStoreStub) SaveDevelopmentGate(_ context.Context, gate work.DevelopmentGate, expected int64) error {
+	s.gate = gate
+	s.saved = true
+	s.expected = expected
+	return nil
+}
+
+type developmentCommandRunnerStub struct {
+	exitCodes []int
+	commands  int
+}
+
+func (r *developmentCommandRunnerStub) Run(context.Context, string, string, []string) int {
+	code := 0
+	if r.commands < len(r.exitCodes) {
+		code = r.exitCodes[r.commands]
+	}
+	r.commands++
+	return code
+}
+
+func validDevelopmentVerificationPlan(t *testing.T, worktreeID string) developmentexecutor.Plan {
+	t.Helper()
+	worktree, err := filepath.Abs(".")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return developmentexecutor.Plan{
+		Worktree:            worktree,
+		WorktreeID:          worktreeID,
+		BaseRepoRevision:    "base-revision",
+		ProtectedMainAccess: "DENIED",
+		ProductionAccess:    "DENIED",
+		SecretAccess:        "DENIED",
+		Checks:              []developmentexecutor.Check{{Kind: developmentexecutor.CheckGitDiffCheck}},
+	}
+}
+
+func isolatedDevelopmentGate() work.DevelopmentGate {
+	return work.DevelopmentGate{
+		ID:                   "gate-1",
+		Revision:             4,
+		Stage:                work.DevelopmentIsolated,
+		EvidenceRefs:         []string{"evidence-1"},
+		ProposalRef:          "proposal-1",
+		TaskPacketRef:        "task-1",
+		WorktreeRef:          "sandbox-1",
+		ProducerRunRefs:      []work.AgentRunID{"producer-1"},
+		VerifierRunRefs:      nil,
+		VerificationEvidence: "",
+	}
+}
+
+func TestVerifyDevelopmentGatePersistsVerifiedWithIndependentEvidence(t *testing.T) {
+	store := &developmentGateStoreStub{gate: isolatedDevelopmentGate()}
+	runner := &developmentCommandRunnerStub{exitCodes: []int{0}}
+	gate, result, err := verifyDevelopmentGate(context.Background(), store, developmentGateVerificationRequest{
+		GateID:           "gate-1",
+		ExpectedRevision: 4,
+		VerifierRunID:    "verifier-1",
+		Plan:             validDevelopmentVerificationPlan(t, "sandbox-1"),
+	}, time.UnixMilli(20), runner)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !result.Passed || gate.Stage != work.DevelopmentVerified || gate.Revision != 5 {
+		t.Fatalf("verification did not advance gate: gate=%#v result=%#v", gate, result)
+	}
+	if !store.saved || store.expected != 4 || gate.VerificationEvidence == "" {
+		t.Fatalf("verification was not durably persisted: store=%#v gate=%#v", store, gate)
+	}
+}
+
+func TestVerifyDevelopmentGateLeavesIsolatedOnFailedChecks(t *testing.T) {
+	store := &developmentGateStoreStub{gate: isolatedDevelopmentGate()}
+	gate, result, err := verifyDevelopmentGate(context.Background(), store, developmentGateVerificationRequest{
+		GateID:           "gate-1",
+		ExpectedRevision: 4,
+		VerifierRunID:    "verifier-1",
+		Plan:             validDevelopmentVerificationPlan(t, "sandbox-1"),
+	}, time.UnixMilli(20), &developmentCommandRunnerStub{exitCodes: []int{1}})
+	if err != errDevelopmentChecksFailed || result.Passed || gate.Stage != work.DevelopmentIsolated || store.saved {
+		t.Fatalf("failed checks changed gate unexpectedly: gate=%#v result=%#v err=%v store=%#v", gate, result, err, store)
+	}
+}
+
+func TestVerifyDevelopmentGateRejectsProducerAsVerifier(t *testing.T) {
+	store := &developmentGateStoreStub{gate: isolatedDevelopmentGate()}
+	_, _, err := verifyDevelopmentGate(context.Background(), store, developmentGateVerificationRequest{
+		GateID:           "gate-1",
+		ExpectedRevision: 4,
+		VerifierRunID:    "producer-1",
+		Plan:             validDevelopmentVerificationPlan(t, "sandbox-1"),
+	}, time.UnixMilli(20), &developmentCommandRunnerStub{exitCodes: []int{0}})
+	if err != errDevelopmentVerifierNotIndependent {
+		t.Fatalf("producer was accepted as verifier: %v", err)
+	}
+}
+
+func TestRecordDevelopmentGateEvidenceAdvancesCanaryAndPromotion(t *testing.T) {
+	store := &developmentGateStoreStub{gate: work.DevelopmentGate{
+		ID: "gate-1", Revision: 6, Stage: work.DevelopmentVerified,
+		EvidenceRefs: []string{"evidence-1"}, ProposalRef: "proposal-1", TaskPacketRef: "task-1", WorktreeRef: "sandbox-1",
+		ProducerRunRefs: []work.AgentRunID{"producer-1"}, VerifierRunRefs: []work.AgentRunID{"verifier-1"}, VerificationEvidence: "verification-1",
+	}}
+	gate, err := recordDevelopmentGateEvidence(context.Background(), store, developmentGateEvidenceRequest{GateID: "gate-1", ExpectedRevision: 6, NextStage: work.DevelopmentCanary, EvidenceRef: "canary-1"}, time.UnixMilli(30))
+	if err != nil || gate.Stage != work.DevelopmentCanary || gate.Revision != 7 || gate.CanaryEvidence != "canary-1" {
+		t.Fatalf("canary transition failed: gate=%#v err=%v", gate, err)
+	}
+	gate, err = recordDevelopmentGateEvidence(context.Background(), store, developmentGateEvidenceRequest{GateID: "gate-1", ExpectedRevision: 7, NextStage: work.DevelopmentPromoted, EvidenceRef: "promotion-1"}, time.UnixMilli(31))
+	if err != nil || gate.Stage != work.DevelopmentPromoted || gate.Revision != 8 || gate.PromotionRef != "promotion-1" {
+		t.Fatalf("promotion transition failed: gate=%#v err=%v", gate, err)
+	}
+}
+
+func TestRecordDevelopmentGateEvidenceSupportsCanaryRollbackAndRejectsMissingEvidence(t *testing.T) {
+	store := &developmentGateStoreStub{gate: work.DevelopmentGate{ID: "gate-1", Revision: 2, Stage: work.DevelopmentCanary, EvidenceRefs: []string{"evidence-1"}, CanaryEvidence: "canary-1"}}
+	gate, err := recordDevelopmentGateEvidence(context.Background(), store, developmentGateEvidenceRequest{GateID: "gate-1", ExpectedRevision: 2, NextStage: work.DevelopmentRolledBack, EvidenceRef: "rollback-1"}, time.UnixMilli(40))
+	if err != nil || gate.Stage != work.DevelopmentRolledBack || gate.RollbackRef != "rollback-1" {
+		t.Fatalf("rollback transition failed: gate=%#v err=%v", gate, err)
+	}
+	store = &developmentGateStoreStub{gate: work.DevelopmentGate{ID: "gate-2", Revision: 2, Stage: work.DevelopmentCanary, EvidenceRefs: []string{"evidence-1"}, CanaryEvidence: "canary-1"}}
+	gate, err = recordDevelopmentGateEvidence(context.Background(), store, developmentGateEvidenceRequest{GateID: "gate-2", ExpectedRevision: 2, NextStage: work.DevelopmentRolledBack}, time.UnixMilli(40))
+	if err != errDevelopmentEvidenceRequired || gate.Stage != work.DevelopmentCanary || store.saved {
+		t.Fatalf("missing rollback evidence changed gate: gate=%#v err=%v store=%#v", gate, err, store)
+	}
+}
+
 func TestDevelopmentGateControllerRequiresSequentialVerifiedEvidence(t *testing.T) {
 	now := time.UnixMilli(10)
 	gate, err := prepareDevelopmentGate(work.DevelopmentGate{ID: "gate-1", Revision: 1, Stage: work.DevelopmentEvidenceCollected, EvidenceRefs: []string{"evidence-1"}}, now)

cmd/core-runtime/main.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"git.cin.su/m/Assistant/adapters/developmentexecutor"
 	"git.cin.su/m/Assistant/adapters/postgres"
 	"git.cin.su/m/Assistant/contracts/authority"
 	"git.cin.su/m/Assistant/contracts/capability"
@@ -21,6 +22,7 @@ import (
 	interactiondomain "git.cin.su/m/Assistant/modules/interaction/domain"
 	situationdomain "git.cin.su/m/Assistant/modules/situation/domain"
 	workdomain "git.cin.su/m/Assistant/modules/work/domain"
+	"git.cin.su/m/Assistant/platform/ids"
 	platformsecrets "git.cin.su/m/Assistant/platform/secrets"
 	"git.cin.su/m/Assistant/runtime/health"
 	"github.com/jackc/pgx/v5"
@@ -28,6 +30,8 @@ import (
 	"log"
 	"net/http"
 	"os"
+	"regexp"
+	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -112,7 +116,7 @@ func main() {
 	if err != nil {
 		log.Fatal(err)
 	}
-	cognitiveClient, err := newCognitiveInterpretationClient(envOr("COGNITIVE_RUNTIME_URL", "http://cognitive-worker:8083"), &http.Client{Timeout: 20 * time.Second})
+	cognitiveClient, err := newCognitiveInterpretationClient(envOr("COGNITIVE_RUNTIME_URL", "http://cognitive-worker:8083"), &http.Client{Timeout: 90 * time.Second})
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -311,6 +315,56 @@ func main() {
 		w.Header().Set("Content-Type", "application/json")
 		_ = json.NewEncoder(w).Encode(gate)
 	})
+	mux.HandleFunc("POST /v1/creator/development/gates/{id}/verify", func(w http.ResponseWriter, r *http.Request) {
+		if _, ok := authenticateCreator(w, r); !ok {
+			return
+		}
+		var request struct {
+			ExpectedRevision int64                    `json:"expected_revision"`
+			VerifierRunID    work.AgentRunID          `json:"verifier_run_id"`
+			Plan             developmentexecutor.Plan `json:"plan"`
+		}
+		decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10))
+		decoder.DisallowUnknownFields()
+		if err := decoder.Decode(&request); err != nil || request.ExpectedRevision < 1 || request.VerifierRunID == "" {
+			http.Error(w, "invalid development verification request", http.StatusBadRequest)
+			return
+		}
+		gate, result, err := verifyDevelopmentGate(r.Context(), workRepository, developmentGateVerificationRequest{GateID: r.PathValue("id"), ExpectedRevision: request.ExpectedRevision, VerifierRunID: request.VerifierRunID, Plan: request.Plan}, time.Now(), developmentexecutor.OSCommandRunner{})
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusUnprocessableEntity)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]any{"gate": gate, "verification": result})
+	})
+	registerDevelopmentGateEvidenceRoute := func(path string, next work.DevelopmentStage, fieldName string) {
+		mux.HandleFunc("POST /v1/creator/development/gates/{id}/"+path, func(w http.ResponseWriter, r *http.Request) {
+			if _, ok := authenticateCreator(w, r); !ok {
+				return
+			}
+			var request struct {
+				ExpectedRevision int64  `json:"expected_revision"`
+				EvidenceRef      string `json:"evidence_ref"`
+			}
+			decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 16<<10))
+			decoder.DisallowUnknownFields()
+			if err := decoder.Decode(&request); err != nil || request.ExpectedRevision < 1 || request.EvidenceRef == "" {
+				http.Error(w, "invalid development transition evidence", http.StatusBadRequest)
+				return
+			}
+			gate, err := recordDevelopmentGateEvidence(r.Context(), workRepository, developmentGateEvidenceRequest{GateID: r.PathValue("id"), ExpectedRevision: request.ExpectedRevision, NextStage: next, EvidenceRef: request.EvidenceRef}, time.Now())
+			if err != nil {
+				http.Error(w, "development "+fieldName+" transition rejected", http.StatusUnprocessableEntity)
+				return
+			}
+			w.Header().Set("Content-Type", "application/json")
+			_ = json.NewEncoder(w).Encode(gate)
+		})
+	}
+	registerDevelopmentGateEvidenceRoute("canary", work.DevelopmentCanary, "canary")
+	registerDevelopmentGateEvidenceRoute("promote", work.DevelopmentPromoted, "promotion")
+	registerDevelopmentGateEvidenceRoute("rollback", work.DevelopmentRolledBack, "rollback")
 	mux.HandleFunc("GET /v1/creator/focus", func(w http.ResponseWriter, r *http.Request) {
 		session, ok := authenticateCreator(w, r)
 		if !ok {
@@ -455,14 +509,106 @@ func main() {
 			http.Error(w, "project focus unavailable", http.StatusServiceUnavailable)
 			return
 		}
+		var effectiveTaskMessage = interactiondomain.StripAssistantVocative(utterance.Content)
+		continuationMessage := ""
+		travelContinuation := false
+		var previousTask *interaction.HumanUtterance
+		var conversationHistory []interaction.HumanUtterance
+		if request.ConversationID != "" {
+			var historyErr error
+			conversationHistory, historyErr = interactionRepository.Utterances(r.Context(), conversation.ID)
+			if historyErr != nil {
+				log.Printf("interaction conversation history unavailable: %v", historyErr)
+			}
+		}
+		// Keep durable user context available even when the web client carries a
+		// conversation ID; a new or rotated conversation must not erase learned
+		// preferences.
+		recentUserHistory, historyErr := interactionRepository.RecentUtterancesForPrincipal(r.Context(), session.PrincipalID, 64)
+		if historyErr != nil {
+			log.Printf("interaction principal history unavailable: %v", historyErr)
+		} else {
+			log.Printf("interaction principal history loaded: %d utterances", len(recentUserHistory))
+		}
+		conversationHistory = append(conversationHistory, recentUserHistory...)
+		if continuation := interactiondomain.ContinueLocalSearch(effectiveTaskMessage, conversationHistory); continuation != "" {
+			continuationMessage = continuation
+			effectiveTaskMessage = continuation
+		} else if continuation := interactiondomain.ContinueTravelOrigin(effectiveTaskMessage, conversationHistory); continuation != "" {
+			continuationMessage = continuation
+			travelContinuation = true
+			effectiveTaskMessage = continuation
+		}
+		if request.ConversationID != "" && interactiondomain.IsRetryRequest(utterance.Content) {
+			if len(conversationHistory) > 0 {
+				for index := len(conversationHistory) - 1; index >= 0; index-- {
+					if interactiondomain.IsRetryRequest(conversationHistory[index].Content) {
+						continue
+					}
+					candidate := conversationHistory[index]
+					previousTask = &candidate
+					effectiveTaskMessage = interactiondomain.StripAssistantVocative(candidate.Content)
+					break
+				}
+			}
+		}
 		semantic, err := interactiondomain.InterpretUtterance(utterance, projects, previousFocus, now)
 		if err != nil {
 			http.Error(w, "interpret chat message", http.StatusServiceUnavailable)
 			return
 		}
+		if continuationMessage != "" {
+			continuedUtterance := utterance
+			continuedUtterance.Content = continuationMessage
+			continuedSemantic, continuedErr := interactiondomain.InterpretUtterance(continuedUtterance, projects, previousFocus, now)
+			if continuedErr == nil {
+				continuedSemantic.Interpretation.Source = "CONVERSATION_CONTINUATION"
+				continuedSemantic.Interpretation.SelectionReason = "location follow-up completed the previous local-search task"
+				semantic = continuedSemantic
+			}
+		}
+		if travelContinuation && interactiondomain.TravelSearchClarification(effectiveTaskMessage, conversationHistory) == "" {
+			semantic.CapabilityHints = append(semantic.CapabilityHints, string(capability.CapabilityKindWebResearch))
+			semantic.NeedsCognition = false
+			semantic.Interpretation.NeedsCognition = false
+		}
+		locationReply := interactiondomain.LocationContextReply(utterance.Content)
+		if locationReply != "" {
+			semantic.Reply = locationReply
+			semantic.NeedsCognition = false
+			semantic.Interpretation.NeedsCognition = false
+		}
+		if previousTask != nil {
+			previousSemantic, previousErr := interactiondomain.InterpretUtterance(*previousTask, projects, previousFocus, now)
+			if previousErr == nil {
+				semantic = interactiondomain.CarryForwardPreviousTask(semantic, previousSemantic)
+			}
+		}
+		assistantName := interactiondomain.PreferredAssistantName(utterance.Content)
+		if assistantName == "" {
+			assistantName = latestAssistantName(conversationHistory)
+		}
+		identityReply := ""
+		log.Printf("interaction identity context: name=%q history=%d", assistantName, len(conversationHistory))
+		if interactiondomain.IsIdentityInquiry(utterance.Content) && assistantName != "" {
+			identityReply = "Меня зовут " + assistantName + ". Я Домовой, ваш помощник."
+			semantic.Reply = identityReply
+			semantic.NeedsCognition = false
+			semantic.CapabilityHints = nil
+			semantic.Interpretation.Applicability = interaction.SemanticApplicable
+			semantic.Interpretation.Clarification = interaction.ClarificationNotRequired
+		}
+		deterministicSpeechAct := semantic.Interpretation.SpeechAct
+		deterministicReply := semantic.Reply
+		routePlan := buildChatRoutePlan(semantic)
 		cognitiveAttempted := false
 		cognitiveAvailable := true
-		if shouldRequestBroaderInterpretation(semantic) {
+		semanticInterpretationRequested := shouldRequestSemanticInterpretation(semantic)
+		semanticReflexAudit := shouldAuditDeterministicReflex(semantic, string(utterance.ID), now)
+		if identityReply != "" {
+			semanticReflexAudit = false
+		}
+		if semanticInterpretationRequested || semanticReflexAudit {
 			cognitiveAttempted = true
 			projectNames := make([]string, 0, len(semantic.Projects))
 			for _, ref := range semantic.Projects {
@@ -470,9 +616,11 @@ func main() {
 					projectNames = append(projectNames, ref.ProjectDisplayName)
 				}
 			}
-			if response, interpretationErr := cognitiveClient.Interpret(r.Context(), buildGatewayInterpretationRequest(session, utterance, semantic, projectNames)); interpretationErr == nil && response.FinishReason == cognitive.FinishCompleted {
+			cognitiveUtterance := utterance
+			cognitiveUtterance.Content = effectiveTaskMessage
+			if response, interpretationErr := cognitiveClient.Interpret(r.Context(), buildGatewayInterpretationRequest(session, cognitiveUtterance, semantic, projectNames)); interpretationErr == nil && response.FinishReason == cognitive.FinishCompleted {
 				if candidate, candidateErr := interactionCandidateFromGateway(utterance.ID, response.Candidate, now); candidateErr == nil {
-					semantic = interactiondomain.ApplyCognitiveCandidate(semantic, utterance.Content, candidate, previousFocus)
+					semantic = interactiondomain.ApplyCognitiveCandidate(semantic, effectiveTaskMessage, candidate, previousFocus)
 				} else {
 					cognitiveAvailable = false
 				}
@@ -480,6 +628,14 @@ func main() {
 				cognitiveAvailable = false
 			}
 		}
+		if travelReply := interactiondomain.TravelSearchClarification(effectiveTaskMessage, conversationHistory); travelReply != "" {
+			semantic.Interpretation.Clarification = interaction.ClarificationRequired
+			semantic.Interpretation.Applicability = interaction.SemanticCandidateClarify
+			semantic.Reply = travelReply
+			deterministicReply = travelReply
+			semantic.NeedsCognition = false
+			semantic.Interpretation.NeedsCognition = false
+		}
 		if err := interactionRepository.AppendUtterance(r.Context(), conversation, utterance, intent, relations); err != nil {
 			http.Error(w, "save chat message", http.StatusInternalServerError)
 			return
@@ -491,7 +647,7 @@ func main() {
 		responseResult, responseErr := responseClient.Respond(r.Context(), r.Header.Get("Authorization"), continuity.HumanResponseRequest{
 			SourceUtteranceID:     string(utterance.ID),
 			SourceIntentID:        string(intent.ID),
-			Message:               utterance.Content,
+			Message:               effectiveTaskMessage,
 			RequestedAtUnixMillis: now.UnixMilli(),
 		})
 		if semantic.Interpretation.SpeechAct == interaction.SpeechActCorrection {
@@ -510,7 +666,7 @@ func main() {
 			activeFocusName = previousFocus.ProjectDisplayName
 			activeFocusProvenance = previousFocus.Provenance
 		}
-		var planningReply string
+		planningReply := deterministicReply
 		workPlanned := false
 		needsCognition := semantic.NeedsCognition
 		projectID := ""
@@ -539,7 +695,7 @@ func main() {
 			ProjectID:             work.ProjectRef(projectID),
 			ProjectDisplayName:    activeFocusName,
 			ProjectProvenance:     work.ProjectProvenanceRef(activeFocusProvenance),
-			Message:               utterance.Content,
+			Message:               effectiveTaskMessage,
 			SpeechAct:             work.SpeechActRef(semantic.Interpretation.SpeechAct),
 			SecondarySpeechAct:    work.SpeechActRef(semantic.Interpretation.SecondarySpeechAct),
 			AssertionVerification: epistemics.VerificationState(semantic.Interpretation.AssertionVerification),
@@ -553,12 +709,18 @@ func main() {
 			helpPath = work.HelpPath{}
 		}
 		switch semantic.InformationRequestKind {
+		case interaction.InformationRequestMemoryInventory:
+			planningReply = humanMemoryInventory(conversationHistory, assistantName)
+			needsCognition = false
+		case interaction.InformationRequestTimeDifference:
+			planningReply = humanTimeDifferenceReply(effectiveTaskMessage)
+			needsCognition = false
 		case interaction.InformationRequestCapabilityInventory:
 			kinds, err := capabilityRepository.AvailableCapabilityKinds(r.Context(), session.PrincipalID)
 			if err == nil && len(kinds) > 0 {
-				planningReply = "Сейчас у меня подключены реальные capabilities: " + humanCapabilityList(kinds) + ". Для рассуждений я использую отдельный Cognitive Gateway/Router, если локальный CANARY доступен. Возможности вроде отправки почты пока будут фиксироваться как capability gap, а не как выполненное действие."
+				planningReply = "Я умею общаться, искать проверяемую информацию, работать с подключёнными моделями и " + humanCapabilityList(kinds) + "."
 			} else {
-				planningReply = "Я умею записывать диалог и намерения, работать с текущим контекстом, строить планы и обращаться к Cognitive Gateway при доступности локального CANARY. Реальные action-capabilities подключаются через registry; если capability нет, я фиксирую gap."
+				planningReply = "Я умею общаться, сохранять контекст, искать проверяемую информацию и работать с подключёнными моделями. Дополнительные действия подключаются отдельно."
 			}
 			needsCognition = false
 		case interaction.InformationRequestCognitiveModelInventory:
@@ -570,10 +732,48 @@ func main() {
 			planningReply = humanCognitiveChannelReply(semantic.InformationRequestKind, semantic.Interpretation.SpeechAct, health, healthErr)
 			needsCognition = false
 		}
+		researchBacked := false
+		if hasChatRoute(routePlan, chatRouteResearch) && semantic.Interpretation.Clarification != interaction.ClarificationRequired {
+			if planID, idErr := ids.New(); idErr == nil {
+				parts := interactiondomain.IndependentRequestParts(effectiveTaskMessage)
+				replies := make([]string, 0, len(parts))
+				for index, part := range parts {
+					if clarification := interactiondomain.LocalSearchClarification(part); clarification != "" {
+						replies = append(replies, "По запросу «"+part+"»: "+clarification)
+						continue
+					}
+					researchCtx, cancelResearch := context.WithTimeout(r.Context(), 8*time.Second)
+					result, researchErr := researchClient.SearchWeb(researchCtx, epistemics.WebSearchRequest{
+						Plan:           epistemics.ResearchPlan{ID: epistemics.ResearchPlanID(fmt.Sprintf("plan:%s:%d", planID, index)), Question: part, SourceClasses: []string{"web-search"}, FreshnessPolicy: "current"},
+						PropositionKey: fmt.Sprintf("question:%s:%d", utterance.ID, index), Query: part,
+					})
+					cancelResearch()
+					reply, backed := renderResearchReply(part, result, researchErr)
+					if backed {
+						researchBacked = true
+					}
+					if len(parts) > 1 {
+						reply = "По запросу «" + part + "»: " + reply
+					}
+					replies = append(replies, reply)
+				}
+				planningReply = strings.Join(replies, "\n\n")
+				if researchBacked {
+					semantic.Reply = planningReply
+				}
+				// A failed source must not turn the complete conversation into a
+				// runtime failure or invite an unsupported local guess for a fact.
+				needsCognition = false
+			}
+		}
 		if helpPath.Reply != "" {
 			planningReply = helpPath.Reply
 			needsCognition = false
 		}
+		if travelReply := interactiondomain.TravelSearchClarification(effectiveTaskMessage, conversationHistory); travelReply != "" {
+			planningReply = travelReply
+			needsCognition = false
+		}
 		if planningReply == "" && needsCognition && cognitiveAttempted && !cognitiveAvailable {
 			planningReply = humanCognitiveDegradedReply(utterance.Content)
 			needsCognition = false
@@ -654,6 +854,46 @@ func main() {
 				planningReply = planningReply + " Для coding delegation подходящий agent implementation сейчас недоступен, поэтому я сохранил план без ложного запуска."
 			}
 		}
+		if identityReply != "" {
+			planningReply = identityReply
+			needsCognition = false
+		}
+		if strings.TrimSpace(planningReply) != "" {
+			reviewContext, cancelReview := context.WithTimeout(r.Context(), 12*time.Second)
+			reviewedReply, reviewErr := cognitiveClient.ReviewResponse(reviewContext, session, utterance.Content, planningReply, cognitive.TaskMeaning{
+				SpeechAct:              string(semantic.Interpretation.SpeechAct),
+				CapabilityHints:        toCapabilityKinds(semantic.CapabilityHints),
+				RequestedOutcome:       semantic.Interpretation.RequestedOutcome,
+				InformationRequestKind: semantic.InformationRequestKind,
+				ConfidenceMillis:       semantic.Interpretation.ConfidenceMillis,
+			})
+			cancelReview()
+			stableSemanticReply := identityReply != "" || semantic.InformationRequestKind != "" || locationReply != "" || deterministicSpeechAct == interaction.SpeechActConversational || deterministicSpeechAct == interaction.SpeechActConfirmation || deterministicSpeechAct == interaction.SpeechActRejection
+			if reviewErr != nil {
+				log.Printf("cognitive response review unavailable: %v", reviewErr)
+			} else if !stableSemanticReply && (!researchBacked || reviewPreservesResearchEvidence(reviewedReply, planningReply)) {
+				planningReply = reviewedReply
+			} else if reviewedReply != planningReply {
+				log.Printf("cognitive response review proposed stable semantic rewrite; preserving semantic reply")
+			}
+		}
+		if identityReply == "" {
+			stableAct := interactiondomain.ClassifySpeechAct(utterance.Content, utterance.CorrectsUtteranceID)
+			travelClarification := interactiondomain.TravelSearchClarification(effectiveTaskMessage, conversationHistory)
+			if stableReply, stable := interactiondomain.StableConversationalReply(utterance.Content, stableAct); stable && travelClarification == "" {
+				planningReply = stableReply
+				needsCognition = false
+			}
+		}
+		if identityReply != "" {
+			semantic.Reply = identityReply
+			needsCognition = false
+			planningReply = identityReply
+		}
+		if strings.TrimSpace(planningReply) != "" {
+			semantic.Reply = planningReply
+		}
+		log.Printf("chat response final message=%q act=%s deterministic=%s handled=%t fallback=%q planning=%q", utterance.Content, semantic.Interpretation.SpeechAct, deterministicSpeechAct, responseResult.Handled, semantic.Reply, planningReply)
 		response := interaction.ChatMessageResponse{
 			ConversationID:                 conversation.ID,
 			UtteranceID:                    utterance.ID,
@@ -667,6 +907,7 @@ func main() {
 			Clarification:                  semantic.Interpretation.Clarification,
 			WorkPlanned:                    workPlanned,
 			PlanningReply:                  planningReply,
+			ResearchBacked:                 researchBacked,
 			CapabilityStatus:               capabilityStatus,
 			CapabilityKind:                 capabilityKind,
 			CapabilityHints:                toCapabilityKinds(semantic.CapabilityHints),
@@ -1376,6 +1617,132 @@ func envInt(name string, fallback int) int {
 	return value
 }
 
+func hasCapabilityHint(hints []string, wanted string) bool {
+	for _, hint := range hints {
+		if hint == wanted {
+			return true
+		}
+	}
+	return false
+}
+
+func renderResearchReply(query string, result epistemics.ResearchResult, researchErr error) (string, bool) {
+	if researchErr != nil {
+		return "Сейчас не удалось получить данные из подключённого источника. Попробую снова через доступный маршрут.", false
+	}
+	lines := make([]string, 0, 2)
+	for index, finding := range result.Findings {
+		if finding.State != epistemics.FindingSupported || strings.TrimSpace(finding.Excerpt.Text) == "" || strings.TrimSpace(finding.Source.Locator) == "" {
+			continue
+		}
+		excerpt := strings.TrimSpace(finding.Excerpt.Text)
+		limit := 180
+		if index > 0 {
+			limit = 100
+		}
+		if len([]rune(excerpt)) > limit {
+			excerpt = string([]rune(excerpt)[:limit]) + "…"
+		}
+		lines = append(lines, excerpt+"\nИсточник: "+researchSourceLabel(finding))
+		if len(lines) == 2 {
+			break
+		}
+	}
+	if len(lines) == 0 {
+		return "Проверяемых данных пока не найдено. Могу повторить поиск или уточнить, что именно проверить.", false
+	}
+	reply := strings.Join(lines, "\n")
+	lowerQuery := strings.ToLower(query)
+	if (strings.Contains(lowerQuery, "цен") || strings.Contains(lowerQuery, "стоим")) && !containsPriceEvidence(reply) {
+		reply = "Актуальная цена в найденных фрагментах не указана, поэтому не буду придумывать сумму. Вот страницы, где её можно проверить:\n" + reply
+	}
+	return reply, true
+}
+
+func containsPriceEvidence(value string) bool {
+	pricePattern := regexp.MustCompile(`(?i)(\d[\d\s.,]{2,})(?:\s*(?:₽|руб\.?|р\.?|usd|\$|€))`)
+	return pricePattern.MatchString(value)
+}
+
+func reviewPreservesResearchEvidence(reviewed, draft string) bool {
+	if strings.Contains(draft, "http://") || strings.Contains(draft, "https://") {
+		return strings.Contains(reviewed, "http://") || strings.Contains(reviewed, "https://")
+	}
+	if strings.Contains(draft, "Источник:") {
+		return strings.Contains(reviewed, "Источник:")
+	}
+	return true
+}
+
+func humanMemoryInventory(history []interaction.HumanUtterance, assistantName string) string {
+	rows := make([]string, 0, 4)
+	if assistantName != "" {
+		rows = append(rows, "| Имя помощника | "+assistantName+" |")
+	}
+	latestPreferenceAt := int64(-1)
+	latestPreference := ""
+	for _, utterance := range history {
+		message := strings.TrimSpace(utterance.Content)
+		lower := strings.ToLower(message)
+		if (strings.Contains(lower, "нравится") || strings.Contains(lower, "люблю")) && utterance.ReceivedAtUnixMillis >= latestPreferenceAt {
+			latestPreferenceAt = utterance.ReceivedAtUnixMillis
+			latestPreference = message
+		}
+	}
+	if latestPreference != "" {
+		rows = append(rows, "| Предпочтение пользователя | "+latestPreference+" |")
+	}
+	if len(rows) == 0 {
+		return "| Ячейка памяти | Значение |\n|---|---|\n| — | Сохранённых пользовательских предпочтений пока не найдено. |"
+	}
+	return "| Ячейка памяти | Значение |\n|---|---|\n" + strings.Join(rows, "\n")
+}
+
+func latestAssistantName(history []interaction.HumanUtterance) string {
+	latestAt := int64(-1)
+	latestName := ""
+	for _, utterance := range history {
+		if name := interactiondomain.PreferredAssistantName(utterance.Content); name != "" && utterance.ReceivedAtUnixMillis >= latestAt {
+			latestAt = utterance.ReceivedAtUnixMillis
+			latestName = name
+		}
+	}
+	return latestName
+}
+
+func humanTimeDifferenceReply(message string) string {
+	lower := strings.ToLower(message)
+	if strings.Contains(lower, "моск") && strings.Contains(lower, "шанх") {
+		return "Шанхай опережает Москву на 5 часов. Если в Москве 12:00, в Шанхае 17:00."
+	}
+	return "Уточните два города — я сравню их часовые пояса."
+}
+
+func researchSourceLabel(finding epistemics.ResearchFinding) string {
+	title := strings.TrimSpace(finding.Source.Title)
+	locator := strings.TrimSpace(finding.Source.Locator)
+	publisher := strings.TrimSpace(finding.Source.Publisher)
+	if strings.Contains(locator, "duckduckgo.com/html") || strings.Contains(locator, "bing.com/search") {
+		locator = ""
+	}
+	if title != "" && publisher != "" {
+		if locator != "" {
+			return publisher + " (" + locator + ")"
+		}
+		return publisher
+	}
+	if title != "" {
+		return title
+	}
+	if publisher != "" {
+		return publisher
+	}
+	if locator != "" {
+		return locator
+	}
+	return "подключённый источник"
+}
+
 func humanCognitiveModelInventory(candidates []capability.ResolvedCognitiveBinding, inventoryErr error) string {
 	if inventoryErr != nil {
 		return "Я не смогла прочитать реестр подключённых моделей. Встроенный канал Домового остаётся доступен; настройки можно проверить повторно после восстановления реестра. Ключи и пароли не выводятся в чат."
@@ -1383,28 +1750,82 @@ func humanCognitiveModelInventory(candidates []capability.ResolvedCognitiveBindi
 	if len(candidates) == 0 {
 		return "В реестре пока нет подтверждённых подключённых моделей. Встроенный локальный канал Домового доступен всегда; внешние модели добавляются через настройки подключения. Ключи и пароли в чат не выводятся."
 	}
-	lines := make([]string, 0, len(candidates)+1)
-	lines = append(lines, "Подключённые модели из реестра:")
+	type inventoryEntry struct {
+		name   string
+		status string
+		rank   int
+		seenAt int
+	}
+	entries := make([]inventoryEntry, 0, len(candidates))
+	byName := make(map[string]int, len(candidates))
 	for _, candidate := range candidates {
 		modelName := string(candidate.Model.ProviderModelID)
 		if modelName == "" {
-			modelName = "имя модели не подтверждено"
+			continue
 		}
-		status := cognitiveInventoryStatus(candidate)
-		pricing := cognitiveInventoryPricing(candidate.Provider)
-		details := []string{status, "тип " + string(candidate.Provider.Kind), "политика " + string(candidate.Binding.DataPolicy)}
-		if pricing != "" {
-			details = append(details, pricing)
+		status := conciseCognitiveInventoryStatus(candidate)
+		rank := cognitiveInventoryRank(candidate)
+		if index, exists := byName[modelName]; exists {
+			if rank < entries[index].rank {
+				entries[index].status = status
+				entries[index].rank = rank
+			}
+			continue
 		}
-		if candidate.Provider.AuthMode != "" && candidate.Provider.AuthMode != capability.AuthNone {
-			details = append(details, "доступ "+humanAuthMode(candidate.Provider.AuthMode))
+		byName[modelName] = len(entries)
+		entries = append(entries, inventoryEntry{name: modelName, status: status, rank: rank, seenAt: len(entries)})
+	}
+	sort.SliceStable(entries, func(left, right int) bool {
+		if entries[left].rank != entries[right].rank {
+			return entries[left].rank < entries[right].rank
 		}
-		lines = append(lines, "- "+modelName+" ("+strings.Join(details, "; ")+")")
+		return entries[left].seenAt < entries[right].seenAt
+	})
+	lines := make([]string, 0, len(entries)+2)
+	lines = append(lines, "Доступные модели:")
+	unconfirmed := 0
+	for _, entry := range entries {
+		if entry.rank >= 3 {
+			unconfirmed++
+			continue
+		}
+		lines = append(lines, "- "+entry.name+" — "+entry.status)
+	}
+	if len(lines) == 1 {
+		return "Подтверждённых доступных моделей сейчас нет."
+	}
+	if unconfirmed > 0 {
+		lines = append(lines, fmt.Sprintf("Ещё %d моделей требуют проверки.", unconfirmed))
 	}
-	lines = append(lines, "Секреты, ключи и пароли намеренно не показываются.")
 	return strings.Join(lines, "\n")
 }
 
+func conciseCognitiveInventoryStatus(candidate capability.ResolvedCognitiveBinding) string {
+	if candidate.Provider.Health == capability.HealthAvailable && candidate.Model.Health == capability.HealthAvailable {
+		if candidate.Binding.Activation == capability.ActivationActive {
+			return "активна"
+		}
+		return "доступна"
+	}
+	if candidate.Provider.Health == capability.HealthDegraded || candidate.Model.Health == capability.HealthDegraded {
+		return "работает с ограничениями"
+	}
+	return "не подтверждена"
+}
+
+func cognitiveInventoryRank(candidate capability.ResolvedCognitiveBinding) int {
+	if candidate.Provider.Health == capability.HealthAvailable && candidate.Model.Health == capability.HealthAvailable {
+		if candidate.Binding.Activation == capability.ActivationActive {
+			return 0
+		}
+		return 1
+	}
+	if candidate.Provider.Health == capability.HealthDegraded || candidate.Model.Health == capability.HealthDegraded {
+		return 2
+	}
+	return 3
+}
+
 func cognitiveInventoryStatus(candidate capability.ResolvedCognitiveBinding) string {
 	if candidate.Provider.Health == capability.HealthAvailable && candidate.Model.Health == capability.HealthAvailable {
 		if candidate.Binding.Activation == capability.ActivationActive {
@@ -1451,44 +1872,26 @@ func humanAuthMode(mode capability.AuthMode) string {
 }
 
 func humanCognitiveChannelReply(kind interaction.InformationRequestKind, act interaction.SpeechAct, health capability.Health, healthErr error) string {
-	recoveryRequested := kind == interaction.InformationRequestCognitiveRecovery || act == interaction.SpeechActRequestToInvestigate || act == interaction.SpeechActDirective
 	if healthErr != nil {
-		if recoveryRequested {
-			return "Я не вижу подтверждённого состояния локального канала. Домовой всё равно рядом: опишите, что изменилось, и я помогу подготовить аварийную настройку."
-		}
-		return "Я не вижу подтверждённого состояния локального канала, но Домовой работает. Можно продолжать разговор и проверить канал ещё раз."
+		return "Не удалось проверить канал. Домовой остаётся на связи."
 	}
-	var observation string
 	switch health.State {
 	case capability.HealthAvailable:
-		observation = "Основной локальный канал сейчас доступен."
+		return "Канал мышления доступен."
 	case capability.HealthDegraded:
-		observation = "Основной локальный канал сейчас работает с ограничениями."
+		return "Канал мышления работает с ограничениями."
 	case capability.HealthUnavailable:
-		observation = "Основной локальный канал сейчас недоступен."
+		return "Канал мышления недоступен. Домовой остаётся на связи."
 	default:
-		observation = "Состояние основного локального канала пока не подтверждено."
+		return "Состояние канала пока не подтверждено. Домовой остаётся на связи."
 	}
-	if recoveryRequested {
-		if health.State == capability.HealthUnavailable {
-			return observation + " Домовой жив: начну с проверки встроенного маршрута, затем зафиксирую варианты аварийного восстановления без передачи секретов."
-		}
-		return observation + " Я не меняю модель прямо из разговора: сначала покажу наблюдаемое состояние и подготовлю следующий проверяемый шаг восстановления."
-	}
-	if health.State == capability.HealthUnavailable {
-		if recoveryRequested {
-			return observation + " Домовой не остановился: начну с проверки встроенного маршрута, затем зафиксирую доступные варианты восстановления без передачи секретов."
-		}
-		return observation + " Но Домовой не остановился: продолжаю принимать сообщения и помогу восстановить локальный канал."
-	}
-	return observation + " Это наблюдение о готовности capability, а не прямой доступ к модели."
 }
 
 func humanCognitiveDegradedReply(message string) string {
 	if strings.TrimSpace(message) == "" {
-		return "Основной канал мышления сейчас недоступен. Я рядом и продолжаю работать в локальном аварийном режиме."
+		return "Сейчас когнитивный канал недоступен; Домовой остаётся на связи."
 	}
-	return "Основной канал мышления сейчас недоступен. Домовой жив: сообщение принято, а я могу помочь разобраться с локальным каналом и настройкой восстановления."
+	return "Сейчас когнитивный канал недоступен. Повторю запрос через доступный маршрут, когда он восстановится."
 }
 
 func humanCapabilityList(kinds []capability.CapabilityKind) string {

cmd/core-runtime/main_test.go

@@ -27,6 +27,36 @@ func TestBearerTokenRequiresBearerScheme(t *testing.T) {
 	}
 }
 
+func TestLatestAssistantNameUsesNewestDurablePreference(t *testing.T) {
+	history := []interaction.HumanUtterance{
+		{Content: "я назову тебя Дед", ReceivedAtUnixMillis: 20},
+		{Content: "теперь тебя зовут Фея", ReceivedAtUnixMillis: 30},
+	}
+	if got := latestAssistantName(history); got != "Фея" {
+		t.Fatalf("latest assistant name = %q", got)
+	}
+}
+
+func TestHumanMemoryInventoryUsesNewestPreference(t *testing.T) {
+	history := []interaction.HumanUtterance{
+		{Content: "мне нравится синий цвет", ReceivedAtUnixMillis: 20},
+		{Content: "мне нравится красный цвет", ReceivedAtUnixMillis: 30},
+	}
+	got := humanMemoryInventory(history, "Фея")
+	if !strings.Contains(got, "красный") || strings.Contains(got, "синий") {
+		t.Fatalf("memory inventory did not select newest preference: %q", got)
+	}
+}
+
+func TestContainsPriceEvidenceDistinguishesLinksFromPrices(t *testing.T) {
+	if containsPriceEvidence("RTX 4090 — market.yandex.ru") {
+		t.Fatal("a product link is not price evidence")
+	}
+	if !containsPriceEvidence("Цена: 189 990 ₽") {
+		t.Fatal("expected a currency amount to count as price evidence")
+	}
+}
+
 func TestCognitiveChannelQuestionUsesHumanSafeHealthReply(t *testing.T) {
 	reply := humanCognitiveChannelReply(interaction.InformationRequestCognitiveChannelStatus, interaction.SpeechActQuestion, capability.Health{State: capability.HealthAvailable, CapabilityID: "provider-secret-model"}, nil)
 	if !strings.Contains(reply, "доступен") || strings.Contains(reply, "provider-secret-model") {
@@ -36,14 +66,14 @@ func TestCognitiveChannelQuestionUsesHumanSafeHealthReply(t *testing.T) {
 
 func TestCognitiveConfigurationRequestDoesNotPretendToMutate(t *testing.T) {
 	reply := humanCognitiveChannelReply(interaction.InformationRequestCognitiveRecovery, interaction.SpeechActDirective, capability.Health{State: capability.HealthUnavailable}, nil)
-	if !strings.Contains(reply, "Домовой жив") || !strings.Contains(reply, "аварийн") {
+	if reply != "Канал мышления недоступен. Домовой остаётся на связи." {
 		t.Fatalf("unexpected configuration reply: %q", reply)
 	}
 }
 
 func TestCognitiveDegradedReplyKeepsDomovoyAlive(t *testing.T) {
 	reply := humanCognitiveDegradedReply("Помоги настроить локальную модель")
-	if !strings.Contains(reply, "Домовой жив") || !strings.Contains(reply, "принято") {
+	if !strings.Contains(reply, "когнитивный канал") || !strings.Contains(reply, "Повторю") {
 		t.Fatalf("unexpected degraded reply: %q", reply)
 	}
 }
@@ -74,11 +104,21 @@ func TestHumanCognitiveModelInventoryDoesNotExposeSecrets(t *testing.T) {
 		Provider: capability.ProviderInstance{Kind: "openai-compatible-chat-v1", CredentialRef: "secret-ref", AuthMode: capability.AuthKey, BillingMode: capability.BillingPerRequest, RequestCostMicros: &cost, Health: capability.HealthAvailable},
 		Model:    capability.ModelDescriptor{ProviderModelID: "example-model", Health: capability.HealthAvailable},
 	}}, nil)
-	if strings.Contains(text, "secret-ref") || strings.Contains(text, "25") || !strings.Contains(text, "example-model") || !strings.Contains(text, "API-ключ") {
+	if strings.Contains(text, "secret-ref") || strings.Contains(text, "25") || !strings.Contains(text, "example-model") || !strings.Contains(text, "активна") {
 		t.Fatalf("unsafe or incomplete inventory: %q", text)
 	}
 }
 
+func TestHumanCognitiveModelInventoryDeduplicatesAndPrioritizesAvailable(t *testing.T) {
+	text := humanCognitiveModelInventory([]capability.ResolvedCognitiveBinding{
+		{Binding: capability.CognitiveBinding{Activation: capability.ActivationInactive}, Provider: capability.ProviderInstance{Health: capability.HealthUnavailable}, Model: capability.ModelDescriptor{ProviderModelID: "same-model", Health: capability.HealthUnavailable}},
+		{Binding: capability.CognitiveBinding{Activation: capability.ActivationActive}, Provider: capability.ProviderInstance{Health: capability.HealthAvailable}, Model: capability.ModelDescriptor{ProviderModelID: "same-model", Health: capability.HealthAvailable}},
+	}, nil)
+	if strings.Count(text, "same-model") != 1 || !strings.Contains(text, "same-model — активна") {
+		t.Fatalf("expected one active model entry, got %q", text)
+	}
+}
+
 func TestCreatorSessionHandlerAcceptsConfiguredCredentials(t *testing.T) {
 	handler := creatorSessionHandler("recovery", "m", "password", []byte("01234567890123456789012345678901"), func() time.Time { return time.Unix(1000, 0) })
 	request := httptest.NewRequest(http.MethodPost, "/v1/creator/sessions", strings.NewReader(`{"username":"m","password":"password"}`))

cmd/core-runtime/research_client.go

@@ -51,3 +51,28 @@ func (c researchRuntimeClient) EvaluateWeb(ctx context.Context, request epistemi
 	}
 	return result, nil
 }
+
+func (c researchRuntimeClient) SearchWeb(ctx context.Context, request epistemics.WebSearchRequest) (epistemics.ResearchResult, error) {
+	payload, err := json.Marshal(request)
+	if err != nil {
+		return epistemics.ResearchResult{}, err
+	}
+	httpRequest, err := http.NewRequestWithContext(ctx, http.MethodPost, c.baseURL+"/v1/research/web/search", bytes.NewReader(payload))
+	if err != nil {
+		return epistemics.ResearchResult{}, err
+	}
+	httpRequest.Header.Set("Content-Type", "application/json")
+	response, err := c.client.Do(httpRequest)
+	if err != nil {
+		return epistemics.ResearchResult{}, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		return epistemics.ResearchResult{}, fmt.Errorf("research search status %d", response.StatusCode)
+	}
+	var result epistemics.ResearchResult
+	if err := json.NewDecoder(response.Body).Decode(&result); err != nil {
+		return epistemics.ResearchResult{}, err
+	}
+	return result, nil
+}

cmd/creator-web/chat_test.go

@@ -151,6 +151,96 @@ func TestChatMessageUsesCoreAndLocalOnlyCognitiveGateway(t *testing.T) {
 	}
 }
 
+func TestChatMessageDoesNotExposeUnverifiedQuestionAsFact(t *testing.T) {
+	core := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == "/v1/creator/sessions/current":
+			_ = json.NewEncoder(w).Encode(identity.CreatorSession{ActorID: "actor-1", PrincipalID: "principal-1"})
+		case r.Method == http.MethodPost && r.URL.Path == "/v1/creator/chat/messages":
+			w.WriteHeader(http.StatusCreated)
+			_ = json.NewEncoder(w).Encode(interaction.ChatMessageResponse{ConversationID: "conversation-1", UtteranceID: "utterance-1", SpeechAct: interaction.SpeechActQuestion, NeedsCognition: true, CapabilityHints: []capability.CapabilityKind{capability.CapabilityKindWebResearch}, FallbackText: "небезопасная модельная догадка"})
+		default:
+			t.Fatalf("unexpected core route %s %s", r.Method, r.URL.Path)
+		}
+	}))
+	defer core.Close()
+	cognitiveRuntime := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost || r.URL.Path != "/v1/advisories" {
+			t.Fatalf("unexpected cognitive route: %s %s", r.Method, r.URL.Path)
+		}
+		var request cognitive.GatewayAdvisoryRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Fatal(err)
+		}
+		_ = json.NewEncoder(w).Encode(cognitive.GatewayAdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: request.RequestID, AdvisoryText: "Я продолжаю искать проверяемый ответ через доступный источник.", FinishReason: cognitive.FinishCompleted})
+	}))
+	defer cognitiveRuntime.Close()
+	handler, err := newHandler(core.URL, "http://continuity", "http://commit", core.Client(), cognitiveRuntime.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := httptest.NewRequest(http.MethodPost, "/api/chat/messages", strings.NewReader(`{"message":"Какая погода?"}`))
+	request.Header.Set("Authorization", "Bearer session-token")
+	request.Header.Set("Content-Type", "application/json")
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, request)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d body=%s", recorder.Code, recorder.Body.String())
+	}
+	var response browserChatResponse
+	if err := json.NewDecoder(recorder.Body).Decode(&response); err != nil {
+		t.Fatal(err)
+	}
+	if response.Cognition != string(cognitive.FinishCompleted) || strings.Contains(response.ReplyText, "небезопасная") || !strings.Contains(response.ReplyText, "продолжаю искать") {
+		t.Fatalf("unexpected research recovery response: %#v", response)
+	}
+}
+
+func TestChatMessageUsesLocalAdvisoryForOrdinaryConversationalQuestion(t *testing.T) {
+	core := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == "/v1/creator/sessions/current":
+			_ = json.NewEncoder(w).Encode(identity.CreatorSession{ActorID: "actor-1", PrincipalID: "principal-1"})
+		case r.Method == http.MethodPost && r.URL.Path == "/v1/creator/chat/messages":
+			w.WriteHeader(http.StatusCreated)
+			_ = json.NewEncoder(w).Encode(interaction.ChatMessageResponse{ConversationID: "conversation-1", UtteranceID: "utterance-1", SpeechAct: interaction.SpeechActQuestion, NeedsCognition: true, FallbackText: "fallback"})
+		default:
+			t.Fatalf("unexpected core route %s %s", r.Method, r.URL.Path)
+		}
+	}))
+	defer core.Close()
+	cognitiveRuntime := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1/advisories" {
+			t.Fatalf("unexpected cognitive path %s", r.URL.Path)
+		}
+		var request cognitive.GatewayAdvisoryRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Fatal(err)
+		}
+		_ = json.NewEncoder(w).Encode(cognitive.GatewayAdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: request.RequestID, AdvisoryText: "Я рядом. Давай поговорим.", FinishReason: cognitive.FinishCompleted})
+	}))
+	defer cognitiveRuntime.Close()
+	handler, err := newHandler(core.URL, "http://continuity", "http://commit", core.Client(), cognitiveRuntime.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := httptest.NewRequest(http.MethodPost, "/api/chat/messages", strings.NewReader(`{"message":"Как ты?"}`))
+	request.Header.Set("Authorization", "Bearer session-token")
+	request.Header.Set("Content-Type", "application/json")
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, request)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d body=%s", recorder.Code, recorder.Body.String())
+	}
+	var response browserChatResponse
+	if err := json.NewDecoder(recorder.Body).Decode(&response); err != nil {
+		t.Fatal(err)
+	}
+	if response.ReplyText != "Я рядом. Давай поговорим." || response.Cognition != string(cognitive.FinishCompleted) {
+		t.Fatalf("unexpected conversational response: %#v", response)
+	}
+}
+
 func TestChatMessageReturnsHumanCapabilityMetadata(t *testing.T) {
 	core := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch {

cmd/creator-web/main.go

@@ -13,7 +13,14 @@ func main() {
 		envOr("CORE_RUNTIME_URL", "http://core-runtime:8080"),
 		envOr("CONTINUITY_RUNTIME_URL", "http://continuity-runtime:8081"),
 		envOr("COMMIT_RUNTIME_URL", "http://commit-runtime:8082"),
-		&http.Client{Timeout: 10 * time.Second},
+		// Core chat may spend several seconds on semantic interpretation and
+		// local cognition. Keep the browser gateway alive long enough to return
+		// the completed response instead of converting a successful core 201
+		// into a misleading 502.
+		// A cold local model may need more than one short HTTP round-trip to
+		// load on CPU. Keep the browser gateway aligned with the cognition
+		// deadline instead of turning that wait into a false unavailable reply.
+		&http.Client{Timeout: 90 * time.Second},
 		envOr("COGNITIVE_RUNTIME_URL", "http://cognitive-worker:8083"),
 		envOr("AGENT_WORKER_URL", "http://agent-worker:8090"),
 	)

cmd/creator-web/responsive_test.go

@@ -0,0 +1,53 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestCreatorConsoleResponsiveGuardrails(t *testing.T) {
+	html, err := staticFiles.ReadFile("static/index.html")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(html), `<meta name="viewport" content="width=device-width, initial-scale=1">`) {
+		t.Fatal("creator console is missing responsive viewport metadata")
+	}
+	css, err := staticFiles.ReadFile("static/assets/console.css")
+	if err != nil {
+		t.Fatal(err)
+	}
+	stylesheet := string(css)
+	for _, guard := range []string{
+		"@media (max-width: 680px)",
+		".console { display: block; }",
+		".diagnostic-list { grid-template-columns: 1fr; }",
+		".agent-details { grid-template-columns: 1fr; gap: 14px; }",
+		".fleet-list { grid-template-columns: repeat(2, minmax(0, 1fr)); }",
+		".section-nav { display: flex;",
+		"overflow-x: auto",
+	} {
+		if !strings.Contains(stylesheet, guard) {
+			t.Fatalf("responsive guardrail missing: %s", guard)
+		}
+	}
+}
+
+func TestChatResponsiveGuardrailsConstrainMobileGridItem(t *testing.T) {
+	css, err := staticFiles.ReadFile("static/assets/chat.css")
+	if err != nil {
+		t.Fatal(err)
+	}
+	stylesheet := string(css)
+	for _, guard := range []string{
+		".chat-view { width: 100%; min-width: 0;",
+		"@media (max-width: 640px)",
+		".chat-layout { height: auto; display: block; }",
+		".chat-header > .operator-link, .build-meta { display: none; }",
+		".chat-header .cognitive-console-link { flex: 0 1 110px;",
+	} {
+		if !strings.Contains(stylesheet, guard) {
+			t.Fatalf("chat responsive guardrail missing: %s", guard)
+		}
+	}
+}

cmd/creator-web/server.go

@@ -209,6 +209,7 @@ type browserChatResponse struct {
 	CapabilityKind                 string                      `json:"capability_kind"`
 	CapabilityHints                []capability.CapabilityKind `json:"capability_hints,omitempty"`
 	RequestedOutcome               string                      `json:"requested_outcome,omitempty"`
+	ResearchBacked                 bool                        `json:"research_backed"`
 	InterpretationConfidenceMillis int64                       `json:"interpretation_confidence_millis,omitempty"`
 	DelegationID                   string                      `json:"delegation_id"`
 	DelegationState                string                      `json:"delegation_state"`
@@ -501,6 +502,7 @@ func (g *gateway) handleChatMessage(w http.ResponseWriter, r *http.Request) {
 		CapabilityKind:                 string(saved.CapabilityKind),
 		CapabilityHints:                saved.CapabilityHints,
 		RequestedOutcome:               saved.RequestedOutcome,
+		ResearchBacked:                 saved.ResearchBacked,
 		InterpretationConfidenceMillis: saved.InterpretationConfidenceMillis,
 		DelegationID:                   saved.DelegationID,
 		DelegationState:                saved.DelegationState,
@@ -509,13 +511,18 @@ func (g *gateway) handleChatMessage(w http.ResponseWriter, r *http.Request) {
 }
 
 func localChatContext(saved interaction.ChatMessageResponse) []cognitive.ContextExcerpt {
-	if strings.TrimSpace(saved.ActiveProjectName) == "" {
-		return []cognitive.ContextExcerpt{}
-	}
-	bundle, err := cognitive.CompileContext(cognitive.ContextCompileInput{
-		DataPolicy: capability.DataPolicyLocalOnly,
-		MaxBytes:   2048,
-		Candidates: []cognitive.ContextCandidate{{
+	candidates := []cognitive.ContextCandidate{{
+		Excerpt: cognitive.ContextExcerpt{
+			ID:          "assistant-identity",
+			SourceKind:  "assistant-identity-policy",
+			SourceID:    "domovoy",
+			Sensitivity: cognitive.SensitivityPublic,
+			Text:        "Ты — Домовой, локальный помощник пользователя. Отвечай от имени Домового. Не называй себя Qwen, Alibaba Cloud, поставщиком модели или внутренним runtime. Если спрашивают имя, скажи: «Меня зовут Домовой». Твоя задача — понять смысл запроса, найти путь к цели и довести помощь до полезного конечного результата; не ограничивайся пересказом отказа модели.",
+		},
+		Relevance: 100,
+	}}
+	if strings.TrimSpace(saved.ActiveProjectName) != "" {
+		candidates = append(candidates, cognitive.ContextCandidate{
 			Excerpt: cognitive.ContextExcerpt{
 				ID:          cognitive.ContextExcerptID("active-project-focus"),
 				SourceKind:  "situation-active-project",
@@ -523,8 +530,13 @@ func localChatContext(saved interaction.ChatMessageResponse) []cognitive.Context
 				Sensitivity: cognitive.SensitivityPrivateAllowed,
 				Text:        "Текущий проект: " + strings.TrimSpace(saved.ActiveProjectName),
 			},
-			Relevance: 100,
-		}},
+			Relevance: 90,
+		})
+	}
+	bundle, err := cognitive.CompileContext(cognitive.ContextCompileInput{
+		DataPolicy: capability.DataPolicyLocalOnly,
+		MaxBytes:   2048,
+		Candidates: candidates,
 	})
 	if err != nil {
 		return []cognitive.ContextExcerpt{}

cmd/creator-web/server_test.go

@@ -13,13 +13,13 @@ import (
 	"git.cin.su/m/Assistant/contracts/interaction"
 )
 
-func TestLocalChatContextUsesOnlyActiveProject(t *testing.T) {
+func TestLocalChatContextIncludesDomovoyIdentityAndOptionalActiveProject(t *testing.T) {
 	context := localChatContext(interaction.ChatMessageResponse{ActiveProjectName: "Домовой"})
-	if len(context) != 1 || context[0].SourceKind != "situation-active-project" || context[0].Text != "Текущий проект: Домовой" {
+	if len(context) != 2 || context[0].SourceID != "domovoy" || !strings.Contains(context[0].Text, "Ты — Домовой") || context[1].Text != "Текущий проект: Домовой" {
 		t.Fatalf("unexpected local context: %#v", context)
 	}
-	if empty := localChatContext(interaction.ChatMessageResponse{}); len(empty) != 0 {
-		t.Fatalf("expected empty context without active project: %#v", empty)
+	if empty := localChatContext(interaction.ChatMessageResponse{}); len(empty) != 1 || empty[0].SourceID != "domovoy" {
+		t.Fatalf("identity context must remain available without active project: %#v", empty)
 	}
 }
 

cmd/creator-web/static/assets/chat.css

@@ -29,7 +29,7 @@ textarea { resize: vertical; min-height: 84px; max-height: 240px; padding: 14px;
 .login-form button, .composer button { border: 0; color: #11150f; background: var(--signal); font-weight: 700; }
 .login-form button { width: 100%; height: 50px; margin-top: 18px; }
 #login-error { min-height: 20px; color: var(--bad); font-size: 13px; }
-.chat-view { height: 100vh; min-height: 0; display: grid; grid-template-rows: 64px minmax(0, 1fr); overflow: hidden; }
+.chat-view { width: 100%; min-width: 0; height: 100vh; min-height: 0; display: grid; grid-template-rows: 64px minmax(0, 1fr); overflow: hidden; }
 .chat-header { min-width: 0; display: flex; align-items: center; gap: 14px; padding: 0 22px; border-bottom: 1px solid var(--line); background: rgba(16, 23, 20, .98); }
 .chat-header a { color: var(--ink); text-decoration: none; font: 400 24px/1 var(--serif); }
 #active-focus { color: var(--good); }
@@ -107,9 +107,10 @@ textarea { resize: vertical; min-height: 84px; max-height: 240px; padding: 14px;
   .conversation-starters { align-items: stretch; }
   .conversation-starters span { width: 100%; }
   .chat-header { gap: 10px; padding: 0 12px; }
-  .chat-header .cognitive-status { display: inline-flex; max-width: 150px; overflow: hidden; text-overflow: ellipsis; }
-  .build-meta { font-size: 8px; letter-spacing: .04em; }
-  .build-meta time { font-size: 7px; }
+  .chat-header .cognitive-status { display: inline-flex; flex: 1 1 110px; min-width: 0; max-width: 110px; overflow: hidden; text-overflow: ellipsis; }
+  .chat-header .cognitive-console-link { flex: 0 1 110px; min-width: 0; overflow: hidden; text-overflow: ellipsis; }
+  .chat-header > .operator-link, .build-meta { display: none; }
+  .chat-header > #logout { flex: 0 0 38px; }
   .chat-layout { height: auto; display: block; }
   .chat-side, .chat-main { min-height: auto; max-height: none; overflow: visible; }
   .chat-left, .chat-right { border: 0; border-bottom: 1px solid var(--line); }

cmd/research-runtime/main.go

@@ -34,6 +34,7 @@ func main() {
 	mux := http.NewServeMux()
 	mux.Handle("/healthz", health.Handler{Runtime: "research-runtime", SemanticGeneration: 1, ArchitectureGeneration: 1})
 	mux.Handle("/readyz", health.ReadinessHandler{Runtime: "research-runtime", Probes: []health.Probe{{Name: "epistemics-postgres", Check: func(ctx context.Context) error { return repository.Ping(ctx) }}}})
+	mux.Handle("/v1/research/status", truthRuntimeStatusHandler(repository))
 	mux.HandleFunc("POST /v1/research/evaluate", func(w http.ResponseWriter, r *http.Request) {
 		var request epistemics.ResearchEvaluationRequest
 		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 2<<20)).Decode(&request); err != nil {
@@ -88,6 +89,35 @@ func main() {
 		w.Header().Set("Content-Type", "application/json")
 		_ = json.NewEncoder(w).Encode(result)
 	})
+	searchConnector := researchadapter.SearchConnector{
+		EndpointTemplate: os.Getenv("RESEARCH_SEARCH_URL_TEMPLATE"),
+		AllowedHosts:     allowedHosts(os.Getenv("RESEARCH_SEARCH_ALLOWED_HOSTS")),
+		FallbackEndpoints: []researchadapter.SearchEndpoint{{
+			Template:     "https://html.duckduckgo.com/html/?q=%s",
+			AllowedHosts: map[string]struct{}{"html.duckduckgo.com": {}},
+		}},
+		Client:     &http.Client{Timeout: 8 * time.Second},
+		MaxResults: 3,
+	}
+	mux.HandleFunc("POST /v1/research/web/search", func(w http.ResponseWriter, r *http.Request) {
+		var request epistemics.WebSearchRequest
+		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10)).Decode(&request); err != nil {
+			http.Error(w, "invalid web search request", http.StatusBadRequest)
+			return
+		}
+		candidates, err := searchConnector.Collect(r.Context(), request, time.Now().UnixMilli())
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusUnprocessableEntity)
+			return
+		}
+		result, err := application.EvaluateAndPersist(r.Context(), epistemics.ResearchEvaluationRequest{Plan: request.Plan, Candidates: candidates}, repository, time.Now().UnixMilli())
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusUnprocessableEntity)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(result)
+	})
 	addr := os.Getenv("LISTEN_ADDR")
 	if addr == "" {
 		addr = ":8087"

cmd/research-runtime/status.go

@@ -0,0 +1,47 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+
+	"git.cin.su/m/Assistant/adapters/postgres"
+)
+
+type truthRuntimeStatusReader interface {
+	TruthRuntimeStatus(context.Context) (postgres.TruthRuntimeStatus, error)
+}
+
+type truthRuntimeStatusResponse struct {
+	Runtime              string           `json:"runtime"`
+	Status               string           `json:"status"`
+	BundleCount          int64            `json:"bundle_count"`
+	ClaimsByVerification map[string]int64 `json:"claims_by_verification"`
+	BeliefsByState       map[string]int64 `json:"beliefs_by_state"`
+	SourcesByFreshness   map[string]int64 `json:"sources_by_freshness"`
+	ObservedAtUnixMillis int64            `json:"observed_at_unix_millis"`
+}
+
+func truthRuntimeStatusHandler(reader truthRuntimeStatusReader) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet || r.URL.Path != "/v1/research/status" {
+			http.NotFound(w, r)
+			return
+		}
+		status, err := reader.TruthRuntimeStatus(r.Context())
+		if err != nil {
+			http.Error(w, "research status unavailable", http.StatusServiceUnavailable)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(truthRuntimeStatusResponse{
+			Runtime:              "research-runtime",
+			Status:               "ready",
+			BundleCount:          status.BundleCount,
+			ClaimsByVerification: status.ClaimsByVerification,
+			BeliefsByState:       status.BeliefsByState,
+			SourcesByFreshness:   status.SourcesByFreshness,
+			ObservedAtUnixMillis: status.ObservedAtUnixMillis,
+		})
+	})
+}

cmd/research-runtime/status_test.go

@@ -0,0 +1,48 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"git.cin.su/m/Assistant/adapters/postgres"
+)
+
+type fakeTruthRuntimeStatusReader struct {
+	status postgres.TruthRuntimeStatus
+	err    error
+}
+
+func (f fakeTruthRuntimeStatusReader) TruthRuntimeStatus(context.Context) (postgres.TruthRuntimeStatus, error) {
+	return f.status, f.err
+}
+
+func TestTruthRuntimeStatusReportsEvidenceCounts(t *testing.T) {
+	response := httptest.NewRecorder()
+	truthRuntimeStatusHandler(fakeTruthRuntimeStatusReader{status: postgres.TruthRuntimeStatus{
+		BundleCount:          4,
+		ClaimsByVerification: map[string]int64{"UNVERIFIED": 3, "VERIFIED": 1},
+		BeliefsByState:       map[string]int64{"PROVISIONAL": 4},
+		SourcesByFreshness:   map[string]int64{"FRESH": 4},
+		ObservedAtUnixMillis: 1700000000000,
+	}}).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/v1/research/status", nil))
+	if response.Code != http.StatusOK {
+		t.Fatalf("status code = %d", response.Code)
+	}
+	for _, expected := range []string{"\"status\":\"ready\"", "\"bundle_count\":4", "\"VERIFIED\":1", "\"PROVISIONAL\":4", "1700000000000"} {
+		if !strings.Contains(response.Body.String(), expected) {
+			t.Fatalf("response missing %q: %s", expected, response.Body.String())
+		}
+	}
+}
+
+func TestTruthRuntimeStatusFailsClosedOnDatabaseError(t *testing.T) {
+	response := httptest.NewRecorder()
+	truthRuntimeStatusHandler(fakeTruthRuntimeStatusReader{err: errors.New("database unavailable")}).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/v1/research/status", nil))
+	if response.Code != http.StatusServiceUnavailable {
+		t.Fatalf("status code = %d", response.Code)
+	}
+}

cmd/task-verifier/main.go

@@ -10,9 +10,11 @@ import (
 	"strings"
 
 	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/work"
 )
 
 const verifierIdentity = "deterministic-task-verifier-v1"
+const genericVerifierIdentity = "deterministic-generic-envelope-verifier-v1"
 
 func main() {
 	mux := http.NewServeMux()
@@ -21,6 +23,7 @@ func main() {
 		_, _ = w.Write([]byte(`{"runtime":"task-verifier","status":"ok"}`))
 	})
 	mux.HandleFunc("POST /v1/task-evaluations/verify", verifyHandler)
+	mux.HandleFunc("POST /v1/work-graphs/candidates/verify", genericCandidateVerifyHandler)
 	addr := ":8091"
 	if value := strings.TrimSpace(os.Getenv("LISTEN_ADDR")); value != "" {
 		addr = value
@@ -30,6 +33,27 @@ func main() {
 	}
 }
 
+func genericCandidateVerifyHandler(w http.ResponseWriter, r *http.Request) {
+	var request work.GenericCandidateVerificationRequest
+	decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&request); err != nil || request.GraphID == "" || request.GraphRevision < 1 || request.NodeID == "" || request.AuthorRunID == "" || request.CandidateID == "" || strings.TrimSpace(request.Summary) == "" || len(request.EvidenceRefs) == 0 {
+		http.Error(w, "invalid generic candidate envelope", http.StatusBadRequest)
+		return
+	}
+	payload := fmt.Sprintf("%s|%s|%d|%s|%s|%s|%s", genericVerifierIdentity, request.GraphID, request.GraphRevision, request.NodeID, request.AuthorRunID, request.CandidateID, strings.Join(evidenceRefStrings(request.EvidenceRefs), "|"))
+	digest := sha256.Sum256([]byte(payload))
+	writeJSON(w, work.GenericCandidateVerificationResponse{Verified: true, VerificationEvidenceRef: "verification:" + hex.EncodeToString(digest[:]), VerifierIdentity: genericVerifierIdentity, Summary: "candidate attribution and evidence envelope verified; semantic content remains unverified"})
+}
+
+func evidenceRefStrings(values []work.EvidenceRef) []string {
+	result := make([]string, len(values))
+	for i, value := range values {
+		result[i] = string(value)
+	}
+	return result
+}
+
 func verifyHandler(w http.ResponseWriter, r *http.Request) {
 	var request capability.TaskCaseVerificationRequest
 	decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10))

cmd/task-verifier/main_test.go

@@ -5,9 +5,11 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/work"
 )
 
 func TestVerifyExactTextProducesIndependentEvidence(t *testing.T) {
@@ -39,3 +41,13 @@ func TestVerifyJSONFieldEquals(t *testing.T) {
 		t.Fatalf("unexpected JSON verification response: code=%d body=%s value=%+v", recorder.Code, recorder.Body.String(), response)
 	}
 }
+
+func TestVerifyGenericCandidateEnvelopeDoesNotClaimTruth(t *testing.T) {
+	payload, _ := json.Marshal(work.GenericCandidateVerificationRequest{GraphID: "graph-1", GraphRevision: 2, NodeID: "node-1", AuthorRunID: "run-1", CandidateID: "candidate-1", Summary: "model proposal", EvidenceRefs: []work.EvidenceRef{"agent-output:1"}})
+	recorder := httptest.NewRecorder()
+	genericCandidateVerifyHandler(recorder, httptest.NewRequest(http.MethodPost, "/v1/work-graphs/candidates/verify", bytes.NewReader(payload)))
+	var response work.GenericCandidateVerificationResponse
+	if recorder.Code != http.StatusOK || json.NewDecoder(recorder.Body).Decode(&response) != nil || !response.Verified || response.VerifierIdentity == "" || response.VerificationEvidenceRef == "" || !strings.Contains(response.Summary, "semantic content remains unverified") {
+		t.Fatalf("unexpected generic verification response: code=%d body=%s value=%+v", recorder.Code, recorder.Body.String(), response)
+	}
+}

cmd/work-graph-runtime/main.go

@@ -44,6 +44,7 @@ func main() {
 		}
 		graph, ready, err := application.AdmitAndSchedule(r.Context(), repository, request)
 		if err != nil {
+			log.Printf("work graph schedule rejected: %v", err)
 			http.Error(w, err.Error(), http.StatusUnprocessableEntity)
 			return
 		}
@@ -57,6 +58,21 @@ func main() {
 		}
 		graph, ready, err := application.AdmitAndScheduleTaskEvaluation(r.Context(), repository, request)
 		if err != nil {
+			log.Printf("task evaluation graph schedule rejected: %v", err)
+			http.Error(w, err.Error(), http.StatusUnprocessableEntity)
+			return
+		}
+		writeJSON(w, map[string]any{"graph": graph, "scheduled_nodes": ready})
+	})
+	mux.HandleFunc("POST /v1/work-graphs/task-evaluations/additional/schedule", func(w http.ResponseWriter, r *http.Request) {
+		var request application.TaskEvaluationExpansionScheduleRequest
+		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 4<<20)).Decode(&request); err != nil {
+			http.Error(w, "invalid additional task evaluation request", http.StatusBadRequest)
+			return
+		}
+		graph, ready, err := application.ScheduleAdditionalTaskEvaluation(r.Context(), repository, request)
+		if err != nil {
+			log.Printf("additional task evaluation schedule rejected: %v", err)
 			http.Error(w, err.Error(), http.StatusUnprocessableEntity)
 			return
 		}

contracts/epistemics/research.go

@@ -96,6 +96,8 @@ type ResearchFinding struct {
 	Statement      string
 	Claim          Claim
 	Citations      []Citation
+	Source         Source
+	Excerpt        SourceExcerpt
 	State          ResearchFindingState
 	Reason         string
 }
@@ -131,6 +133,15 @@ type WebResearchRequest struct {
 	Statement      string
 }
 
+// WebSearchRequest asks the research runtime to discover bounded source
+// evidence for a human question. The provider is configured by the runtime;
+// the caller supplies meaning, not a provider URL or model choice.
+type WebSearchRequest struct {
+	Plan           ResearchPlan
+	PropositionKey string
+	Query          string
+}
+
 // ResolveCitation creates evidence only when all identifiers form one exact
 // source chain. It deliberately does not fetch, infer or rewrite source text.
 func ResolveCitation(source Source, snapshot SourceSnapshot, excerpt SourceExcerpt, evidence EvidenceKind, coverage CoverageState, conflict ConflictState, resolvedAtUnixMillis int64) (Citation, error) {

contracts/interaction/types.go

@@ -70,6 +70,8 @@ const (
 	InformationRequestCognitiveModelInventory InformationRequestKind          = "COGNITIVE_MODEL_INVENTORY"
 	InformationRequestCognitiveChannelStatus  InformationRequestKind          = "COGNITIVE_CHANNEL_STATUS"
 	InformationRequestCognitiveRecovery       InformationRequestKind          = "COGNITIVE_RECOVERY"
+	InformationRequestMemoryInventory         InformationRequestKind          = "MEMORY_INVENTORY"
+	InformationRequestTimeDifference          InformationRequestKind          = "TIME_DIFFERENCE"
 )
 
 type Conversation struct {
@@ -173,6 +175,7 @@ type ChatMessageResponse struct {
 	Clarification                  ClarificationState
 	WorkPlanned                    bool
 	PlanningReply                  string
+	ResearchBacked                 bool
 	CapabilityStatus               capability.CapabilityResolutionStatus
 	CapabilityKind                 capability.CapabilityKind
 	CapabilityHints                []capability.CapabilityKind

contracts/work/graph.go

@@ -113,6 +113,26 @@ type ResultCandidate struct {
 	Summary         string        `json:"summary"`
 }
 
+// GenericCandidateVerificationRequest asks the independent deterministic
+// verifier to validate attribution and evidence-envelope integrity. It does
+// not assert that the candidate's semantic content is true.
+type GenericCandidateVerificationRequest struct {
+	GraphID       string        `json:"graph_id"`
+	GraphRevision int64         `json:"graph_revision"`
+	NodeID        GraphNodeID   `json:"node_id"`
+	AuthorRunID   AgentRunID    `json:"author_run_id"`
+	CandidateID   string        `json:"candidate_id"`
+	Summary       string        `json:"summary"`
+	EvidenceRefs  []EvidenceRef `json:"evidence_refs"`
+}
+
+type GenericCandidateVerificationResponse struct {
+	Verified                bool   `json:"verified"`
+	VerificationEvidenceRef string `json:"verification_evidence_ref"`
+	VerifierIdentity        string `json:"verifier_identity"`
+	Summary                 string `json:"summary"`
+}
+
 // GraphResultCallback carries one agent's attributable candidate to Work.
 // Recording a candidate never makes the node successful; the node enters
 // VERIFYING until an independent synthesis/verifier accepts it.

contracts/work/lease.go

@@ -83,4 +83,12 @@ type TaskEvaluationDispatchContext struct {
 	ActorID         identity.ActorID     `json:"actor_id"`
 	PrincipalID     identity.PrincipalID `json:"principal_id"`
 	ScopeID         authority.ScopeID    `json:"scope_id"`
+	// GenericMessage turns the existing durable dispatch context into a
+	// discriminated local cognitive-work payload without adding a second
+	// persistence column. It is ignored by task-evaluation executors.
+	GenericMessage        string `json:"generic_message,omitempty"`
+	GenericPurpose        string `json:"generic_purpose,omitempty"`
+	GenericLocale         string `json:"generic_locale,omitempty"`
+	GenericDataPolicy     string `json:"generic_data_policy,omitempty"`
+	GenericMaxOutputBytes int    `json:"generic_max_output_bytes,omitempty"`
 }

deploy/docker-compose.dev.yml

@@ -102,8 +102,11 @@ services:
       LISTEN_ADDR: ":8083"
       CORE_RUNTIME_URL: http://core-runtime:8080
       LOCAL_CPU_PROVIDER_URL: http://docker.cin.su:18082/v1
+      LOCAL_MEDIUM_PROVIDER_URL: ${LOCAL_MEDIUM_PROVIDER_URL:-http://docker.cin.su:18082/v1}
+      LOCAL_MEDIUM_PROVIDER_TIMEOUT: ${LOCAL_MEDIUM_PROVIDER_TIMEOUT:-120s}
       LOCAL_LIFEBOAT_PROVIDER_URL: ${LOCAL_LIFEBOAT_PROVIDER_URL:-}
       LOCAL_GPU_PROVIDER_URL: http://192.168.220.91:11434
+      COGNITIVE_ALLOW_CANARY: "true"
       COGNITIVE_OWNER_PRINCIPAL_ID: domovoy-creator-principal
     ports: ["19083:8083"]
 

deploy/docker-compose.prod.yml

@@ -119,12 +119,32 @@ services:
       WORK_POSTGRES_PASSWORD_FILE: /run/secrets/work_db_password
       SECRET_BACKEND_ROOT: /run/secrets
       TASK_VERIFIER_URL: http://task-verifier:8091
+      AGENT_EXECUTION_BRIDGE_URL: http://agent-execution-bridge:8092
     depends_on:
       postgres: { condition: service_healthy }
       task-verifier: { condition: service_healthy }
+      agent-execution-bridge: { condition: service_healthy }
     volumes:
       - assistant_core_secrets:/run/secrets:ro
 
+  agent-execution-bridge:
+    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: agent-execution-bridge, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
+    restart: unless-stopped
+    environment:
+      LISTEN_ADDR: :8092
+      COGNITIVE_WORKER_URL: http://cognitive-worker:8083
+      WORK_GRAPH_RUNTIME_URL: http://work-graph-runtime:8088
+      TASK_VERIFIER_URL: http://task-verifier:8091
+    depends_on:
+      cognitive-worker: { condition: service_started }
+      task-verifier: { condition: service_healthy }
+      work-graph-runtime: { condition: service_started }
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8092/healthz >/dev/null"]
+      interval: 10s
+      timeout: 3s
+      retries: 10
+
   task-verifier:
     build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: task-verifier, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
     restart: unless-stopped
@@ -175,6 +195,8 @@ services:
       LISTEN_ADDR: :8087
       RESEARCH_SOURCE_ROOT: /var/lib/research-sources
       RESEARCH_HTTP_ALLOWED_HOSTS: assistant.cin.su,git.cin.su
+      RESEARCH_SEARCH_URL_TEMPLATE: ${RESEARCH_SEARCH_URL_TEMPLATE:-https://www.bing.com/search?q=%s}
+      RESEARCH_SEARCH_ALLOWED_HOSTS: ${RESEARCH_SEARCH_ALLOWED_HOSTS:-www.bing.com}
       POSTGRES_HOST: postgres
       POSTGRES_PORT: "5432"
       POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
@@ -234,6 +256,7 @@ services:
       LOCAL_MEDIUM_PROVIDER_URL: ${LOCAL_MEDIUM_PROVIDER_URL:-http://llm-local-api:8080/v1}
       LOCAL_MEDIUM_PROVIDER_API_KEY_FILE: ${LOCAL_MEDIUM_PROVIDER_API_KEY_FILE:-}
       LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF: ${LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF:-credential://domovoy/local-medium/provider-api-key/v1}
+      LOCAL_GPU_PROVIDER_TIMEOUT: ${LOCAL_GPU_PROVIDER_TIMEOUT:-60s}
       LOCAL_LIFEBOAT_PROVIDER_URL: http://cognitive-lifeboat:8086/v1
       COGNITIVE_OWNER_PRINCIPAL_ID: domovoy-creator-principal
       COGNITIVE_ALLOW_CANARY: "true"

dev/ACTIVE_TASK.json

@@ -1,5 +1,5 @@
 {
-  "task_file": "dev/tasks/DEV-000246-work-graph-runtime-status.json",
-  "task_id": "DEV-000246",
+  "task_file": "dev/tasks/DEV-000292-development-mode-runtime-access.json",
+  "task_id": "DEV-000292",
   "task_revision": 1
 }

dev/tasks/DEV-000247-research-runtime-status.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000247",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "e70be0103a03c31f7ecea851fd1aeabcb7abcc55",
+  "risk_tier": "E",
+  "intent": "Expose read-only Truth/Research evidence counts from durable truth bundles without changing epistemic evaluation or belief semantics.",
+  "requirement_ids": ["Truth/Research runtime", "Observation-Claim-Belief evidence visibility", "fast operational verification"],
+  "allowed_change_scope": {"modules": ["epistemics"], "paths": ["adapters/postgres/epistemics_repository.go", "cmd/research-runtime/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000247-research-runtime-status.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "modules/work/secrets/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["epistemics.truth_bundles", "existing research health conventions"], "may_change": ["internal read-only status response"]},
+  "semantic_owner": "Epistemics Truth/Research runtime observability",
+  "canonical_state": ["none; counts are derived projections"],
+  "state_transitions": ["none"],
+  "side_effects_and_privileges": ["read-only aggregate queries only"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["status fails closed with 503 when epistemics database is unavailable"],
+  "assumptions": ["truth bundle migration is present in production"],
+  "acceptance_scenarios": ["readyz remains database-backed", "status reports bundle, claim verification, belief and freshness counts", "status does not mutate epistemic state"],
+  "required_tests": ["go test ./cmd/research-runtime ./adapters/postgres", "go vet ./cmd/research-runtime ./adapters/postgres", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "independent", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000248-live-task-evaluation-scheduling.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000248",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "cdc72e17be46c843737eabcd654cb69ae32d6268",
+  "risk_tier": "E",
+  "intent": "Diagnose and repair the live Work Graph task-evaluation scheduling path exposed by the production canary, preserving durable fan-out and callback semantics.",
+  "requirement_ids": ["live task evaluation", "model quality qualification", "Work Graph integration"],
+  "allowed_change_scope": {"modules": ["work", "capability"], "paths": ["cmd/work-graph-runtime/**", "adapters/postgres/work_repository.go", "modules/work/application/**", "modules/work/domain/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000248-live-task-evaluation-scheduling.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "modules/work/secrets/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing TaskEvaluationGraphRequest", "existing AgentDispatchIntent", "existing Work Graph repository"], "may_change": ["diagnostic logging and local integration behavior"]},
+  "semantic_owner": "Work Graph task-evaluation scheduling",
+  "canonical_state": ["existing graph, dispatch and evaluation records only"],
+  "state_transitions": ["schedule -> queue -> evaluator -> verifier -> evidence callback"],
+  "side_effects_and_privileges": ["existing work/capability owner writes; no new privileges"],
+  "persistence_and_migrations": ["none unless current schema mismatch is proven"],
+  "failure_retry_restart": ["failed scheduling leaves no partial graph or dispatch mutation; durable retries remain existing worker behavior"],
+  "assumptions": ["production canary payload is provider-neutral and contains no secret"],
+  "acceptance_scenarios": ["live general evaluation graph schedules", "worker executes and verifier accepts one case", "TaskEvaluation persists", "graph callback reaches terminal state"],
+  "required_tests": ["go test ./cmd/work-graph-runtime ./modules/work/application ./modules/work/domain ./adapters/postgres", "go vet ./cmd/work-graph-runtime ./modules/work/application ./modules/work/domain ./adapters/postgres", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "independent", "CI", "production health smoke", "live task-evaluation canary"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000249-task-evaluation-model-failover.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000249",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "f90ed7af35f9f19c72039812272640ae1d63635b",
+  "risk_tier": "E",
+  "intent": "Make task-evaluation execution use the existing cognitive model resolution and local fallback path without recording unsupported output as qualification evidence.",
+  "requirement_ids": ["model fleet/failover", "live task evaluation", "local recovery"],
+  "allowed_change_scope": {"modules": ["capability", "work"], "paths": ["cmd/cognitive-worker/**", "cmd/agent-worker/**", "modules/capability/domain/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000249-task-evaluation-model-failover.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "modules/work/**", "modules/work/secrets/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing CognitiveRequirement", "existing ResolvedCognitiveBinding", "existing TaskEvaluationExecutionRequest/Response"], "may_change": []},
+  "semantic_owner": "capability cognitive execution adapter",
+  "canonical_state": ["existing cognitive usage observations and task evaluation records only"],
+  "state_transitions": ["candidate invocation -> bounded fallback candidate -> verified evaluation or UNKNOWN"],
+  "side_effects_and_privileges": ["existing cognitive provider calls and capability observations; no new privileges"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["provider failure excludes the failed binding for the current bounded execution; all candidates unavailable returns UNKNOWN without qualification"],
+  "assumptions": ["fallback resolution remains governed by the existing capability resolver and data-policy checks"],
+  "acceptance_scenarios": ["task evaluation invokes active candidate", "provider-unavailable candidate is excluded and local candidate is attempted", "empty/non-completed provider response never becomes supported evidence", "all candidates unavailable produces durable UNKNOWN evaluation and terminal graph callback"],
+  "required_tests": ["go test ./cmd/cognitive-worker ./modules/capability/domain", "go vet ./cmd/cognitive-worker ./modules/capability/domain", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "independent", "CI", "production health smoke", "live task-evaluation canary"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000250-task-evaluation-terminal-callback.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000250",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "2b8cea5aa8f43f597b2af7d92c2eaa305d68256e",
+  "risk_tier": "E",
+  "intent": "Preserve the scheduled Work Graph revision in task-evaluation dispatch context so verifier callbacks complete the current immutable graph revision and reach terminal state.",
+  "requirement_ids": ["live task evaluation", "Work Graph integration", "durable callback lineage"],
+  "allowed_change_scope": {"modules": ["work"], "paths": ["modules/work/application/**", "modules/work/domain/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000250-task-evaluation-terminal-callback.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "cmd/cognitive-worker/**", "cmd/agent-worker/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing WorkGraph scheduler", "existing TaskEvaluationDispatchContext", "existing callback contract"], "may_change": []},
+  "semantic_owner": "Work Graph task-evaluation scheduling",
+  "canonical_state": ["existing immutable graph revisions and node states only"],
+  "state_transitions": ["scheduled revision -> evaluator callback -> completed revision -> terminal graph"],
+  "side_effects_and_privileges": ["existing work and capability owner writes; no new privileges"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["callback uses the revision that contains the leased node; duplicate callback remains protected by existing immutable revision/idempotency behavior"],
+  "assumptions": ["scheduler increments the draft graph revision exactly once before enqueueing dispatches"],
+  "acceptance_scenarios": ["live task-evaluation callback updates scheduled revision", "unknown evaluation reaches graph terminal state", "successful verified evaluation reaches graph terminal state", "callback lineage remains serializable"],
+  "required_tests": ["go test ./modules/work/application ./modules/work/domain", "go vet ./modules/work/application ./modules/work/domain", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "independent", "CI", "production health smoke", "live task-evaluation canary"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000251-reflection-cognition-routing.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000251",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "c1cde67bcfff8e0e80553ce0562f9841f6c00b30",
+  "risk_tier": "E",
+  "intent": "Prevent the reflection worker from resolving cognition-required candidates before a governed reflection path evaluates them.",
+  "requirement_ids": ["learning reflection loop", "durable candidate routing", "no false resolution"],
+  "allowed_change_scope": {"modules": ["epistemics"], "paths": ["adapters/postgres/epistemics_repository.go", "cmd/reflection-worker/**", "modules/epistemics/domain/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000251-reflection-cognition-routing.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "modules/work/**", "cmd/cognitive-worker/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing ReflectionCandidate state and requires_cognition field", "existing Epistemics repository"], "may_change": []},
+  "semantic_owner": "Epistemics reflection candidate lifecycle",
+  "canonical_state": ["existing epistemics.reflection_candidates rows only"],
+  "state_transitions": ["OPEN deterministic -> EVALUATING -> RESOLVED", "OPEN cognition-required remains OPEN until governed evaluator"],
+  "side_effects_and_privileges": ["existing epistemics owner updates only; no cognition call or proposal promotion"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["cognition-required candidates remain durable and claimable only by a future cognition evaluator; stale deterministic claims recover"],
+  "assumptions": ["reflection worker is the deterministic close loop and must not impersonate a cognitive evaluator"],
+  "acceptance_scenarios": ["worker resolves deterministic candidate", "worker does not claim cognition-required candidate", "OPEN cognition candidate survives restart", "status remains healthy when only cognition candidates are pending"],
+  "required_tests": ["go test ./cmd/reflection-worker ./adapters/postgres ./modules/epistemics/domain", "go vet ./cmd/reflection-worker ./adapters/postgres ./modules/epistemics/domain", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "independent", "CI", "production health smoke", "live reflection-worker status"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000252-local-governed-verification-executor.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000252",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "c925089fd2304213758d2721a0592ca73d765047",
+  "risk_tier": "E",
+  "intent": "Add a local governed verification executor that runs only typed, bounded checks inside an isolated worktree and returns evidence without source, secret, production or promotion authority.",
+  "requirement_ids": ["governed self-development", "isolated verification", "independent test evidence"],
+  "allowed_change_scope": {"modules": ["governed-development"], "paths": ["adapters/developmentexecutor/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000252-local-governed-verification-executor.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "modules/work/**", "cmd/core-runtime/**", "cmd/agent-worker/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing DevelopmentScaffold semantics", "typed local check plan"], "may_change": []},
+  "semantic_owner": "governed development verification adapter",
+  "canonical_state": ["none; executor returns evidence to a future gate owner"],
+  "state_transitions": ["typed plan -> validated sandbox checks -> immutable result summary"],
+  "side_effects_and_privileges": ["read-only source/test execution in supplied isolated worktree; no secrets, production, protected main or promotion access"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["each check has an explicit result; failed or cancelled checks never become verification success; rerun creates a new result"],
+  "assumptions": ["worktree isolation and gate persistence are supplied by the surrounding governed control plane"],
+  "acceptance_scenarios": ["allowed go test/vet and git diff check plans validate", "shell injection and unsupported commands reject", "protected or production worktree rejects", "failed check returns non-success evidence", "result contains no command output or secret material"],
+  "required_tests": ["go test ./adapters/developmentexecutor", "go vet ./adapters/developmentexecutor", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "independent", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000253-development-gate-verifier-integration.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000253",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "f2e520e31e27563a17f66c73ff68b35bc93963a0",
+  "risk_tier": "E",
+  "intent": "Connect the local bounded verification executor to the authenticated durable DevelopmentGate ISOLATED-to-VERIFIED transition with optimistic revision and independent verifier checks.",
+  "requirement_ids": ["governed self-development", "independent verification", "durable gate progression"],
+  "allowed_change_scope": {"modules": ["governed-development"], "paths": ["cmd/core-runtime/development_gate.go", "cmd/core-runtime/main.go", "cmd/core-runtime/development_gate_test.go", "adapters/developmentexecutor/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000253-development-gate-verifier-integration.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "modules/work/**", "cmd/agent-worker/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing authenticated Creator session", "existing DevelopmentGate CAS store", "local developmentexecutor"], "may_change": ["internal authenticated verifier route" ]},
+  "semantic_owner": "Work-owned DevelopmentGate controller",
+  "canonical_state": ["existing work.development_gates row only"],
+  "state_transitions": ["ISOLATED -> VERIFIED only after bounded checks pass and verifier run differs from producer runs"],
+  "side_effects_and_privileges": ["read-only checks in isolated worktree; one existing Work-owner CAS update; no source mutation, secrets, production or promotion authority"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["stale gate revision conflicts; failed checks leave gate ISOLATED; rerun uses a new verifier run/evidence reference"],
+  "assumptions": ["worktree has already been created by the governed isolation step"],
+  "acceptance_scenarios": ["unauthenticated verifier request denied", "non-ISOLATED gate denied", "same producer/verifier run denied", "failed check leaves gate unchanged", "passing checks persist VERIFIED with evidence and CAS"],
+  "required_tests": ["go test ./cmd/core-runtime ./adapters/developmentexecutor", "go vet ./cmd/core-runtime ./adapters/developmentexecutor", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "independent", "CI", "production health smoke", "authenticated gate verifier live smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000254-development-gate-canary-promotion-rollback.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000254",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "3bfe76278b7e44965cbb0e3b4ac2911ad4a4bbae",
+  "risk_tier": "E",
+  "intent": "Expose typed authenticated transitions for durable governed self-development canary, promotion and rollback evidence with optimistic revision checks.",
+  "requirement_ids": ["governed self-development", "durable canary evidence", "promotion and rollback lineage"],
+  "allowed_change_scope": {"modules": ["governed-development"], "paths": ["cmd/core-runtime/development_gate.go", "cmd/core-runtime/main.go", "cmd/core-runtime/development_gate_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000254-development-gate-canary-promotion-rollback.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "modules/work/**", "cmd/agent-worker/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing authenticated Creator session", "existing DevelopmentGate CAS store", "existing governed stage machine"], "may_change": ["internal authenticated canary/promotion/rollback routes"]},
+  "semantic_owner": "Work-owned DevelopmentGate controller",
+  "canonical_state": ["existing work.development_gates row only"],
+  "state_transitions": ["VERIFIED -> CANARY", "CANARY -> PROMOTED", "CANARY -> ROLLED_BACK"],
+  "side_effects_and_privileges": ["one existing Work-owner CAS update per transition; no source mutation, secrets, external mutation or deployment authority"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["stale revisions conflict; missing evidence is rejected; terminal stages cannot be reopened; retry uses a new reference and current revision"],
+  "assumptions": ["canary execution and deployment evidence are produced by their owning executor; this task records only typed evidence and advances the durable gate"],
+  "acceptance_scenarios": ["unauthenticated transition denied", "missing evidence denied", "stale revision denied", "canary evidence advances VERIFIED to CANARY", "promotion evidence advances CANARY to PROMOTED", "rollback evidence advances CANARY to ROLLED_BACK", "terminal gates cannot be reopened"],
+  "required_tests": ["go test ./cmd/core-runtime", "go vet ./cmd/core-runtime", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "independent verifier", "CI", "production health smoke", "authenticated transition smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000255-refresh-live-audit-status-projection.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000255",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "12ab124411771fbed16e1f1935b97b1d0700a7b0",
+  "risk_tier": "E",
+  "intent": "Refresh the audit status projection and evidence matrix from current production and authenticated UI observations without changing runtime behavior.",
+  "requirement_ids": ["task lineage and status synchronization", "auditable production evidence"],
+  "allowed_change_scope": {"modules": ["governance-documentation"], "paths": ["docs/PROJECT_STATUS.md", "docs/evidence/audit-completion-matrix-2026-08-23-v4.json", "docs/evidence/authenticated-ui-acceptance-2026-08-23-v3.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000255-refresh-live-audit-status-projection.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "cmd/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["current production health and revision evidence", "current authenticated Creator UI observation"], "may_change": ["documentation evidence projection only"]},
+  "semantic_owner": "Governance evidence projection",
+  "canonical_state": ["none; evidence files are derived audit artifacts"],
+  "state_transitions": ["supersede stale status projection with timestamped current evidence"],
+  "side_effects_and_privileges": ["documentation-only; no runtime, database, secret or external mutation"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["retain prior evidence as historical; newer evidence supersedes it without rewriting history"],
+  "assumptions": ["mobile viewport cannot be emulated by the current in-app browser control surface, so mobile remains explicitly unverified"],
+  "acceptance_scenarios": ["status names current deployed revision", "model counts match current authenticated UI", "external bridge and mobile limitations remain explicit", "no secret values are recorded"],
+  "required_tests": ["go test ./cmd/core-runtime", "go vet ./cmd/core-runtime", "independent evidence review", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000256-model-rating-reachability-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000256",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "3d97b348f74741b9aca2aa8d77f2e66b9f5760c2",
+  "risk_tier": "E",
+  "intent": "Expose observed qualification latency and evidence strength in provider-neutral model ratings without inferring quality, activation or authority.",
+  "requirement_ids": ["model fleet/failover", "provider-neutral rating", "quality must remain unrated without task evaluation"],
+  "allowed_change_scope": {"modules": ["capability"], "paths": ["modules/capability/domain/cognitive_registry.go", "modules/capability/domain/model_rating_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000256-model-rating-reachability-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "cmd/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing ModelQualificationObservation", "existing provider-neutral ModelRating"], "may_change": ["derived rating values for reachability-only evidence"]},
+  "semantic_owner": "Capability rating derivation",
+  "canonical_state": ["none; ModelRating is derived from existing evidence"],
+  "state_transitions": ["none"],
+  "side_effects_and_privileges": ["pure deterministic derivation only"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["missing or unavailable qualification remains UNRATED with no quality claim"],
+  "assumptions": ["reachability and latency are operational evidence, not task quality"],
+  "acceptance_scenarios": ["reachable qualification exposes latency/evidence scores", "quality category remains UNRATED without supported task evaluation", "provider kind and hardware do not affect rating", "unavailable qualification does not create positive rating"],
+  "required_tests": ["go test ./modules/capability/domain", "go vet ./modules/capability/domain", "independent evidence review", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000257-operations-acceptance-fast-smoke.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000257",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "8868258afd4e58edfa9c71e3fbf79793cd32397b",
+  "risk_tier": "E",
+  "intent": "Record a bounded operations acceptance smoke for authenticated fleet and agent-worker status surfaces and unauthenticated protection.",
+  "requirement_ids": ["UI/operations acceptance", "truthful degraded state", "authenticated read-only status"],
+  "allowed_change_scope": {"modules": ["governance-documentation"], "paths": ["docs/evidence/operations-acceptance-2026-08-23-v1.json", "docs/PROJECT_STATUS.md", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000257-operations-acceptance-fast-smoke.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "cmd/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["authenticated Creator UI", "fleet readiness read API", "agent-worker status read API"], "may_change": ["evidence projection only"]},
+  "semantic_owner": "Governance evidence projection",
+  "canonical_state": ["none"],
+  "state_transitions": ["none"],
+  "side_effects_and_privileges": ["read-only API/UI checks; no mutation"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["failed checks remain explicit and do not alter runtime state"],
+  "assumptions": ["deep UI, long-running delegation and mobile viewport acceptance remain separate tests"],
+  "acceptance_scenarios": ["unauthenticated fleet status returns 401", "unauthenticated agent status returns 401", "authenticated fleet refresh displays selected tier and degraded reason", "authenticated agent refresh displays local fallback and bridge-unavailable reason"],
+  "required_tests": ["go test ./cmd/creator-web", "go vet ./cmd/creator-web", "independent evidence review", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "CI", "production health smoke", "authenticated operations smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000258-responsive-console-regression-guard.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000258",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "5e8286695f0da3f3819cdc17ced6525237512e6e",
+  "risk_tier": "E",
+  "intent": "Add a fast static responsive regression guard for the authenticated Creator console while retaining the requirement for real mobile visual acceptance.",
+  "requirement_ids": ["UI responsive safety", "authenticated console acceptance"],
+  "allowed_change_scope": {"modules": ["creator-web"], "paths": ["cmd/creator-web/responsive_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000258-responsive-console-regression-guard.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "cmd/core-runtime/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["embedded Creator console HTML/CSS"], "may_change": ["tests only"]},
+  "semantic_owner": "Creator Web presentation tests",
+  "canonical_state": ["none"],
+  "state_transitions": ["none"],
+  "side_effects_and_privileges": ["test-only static inspection"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["test fails when responsive guardrails disappear"],
+  "assumptions": ["static guard is not a substitute for browser visual acceptance; real mobile viewport evidence remains required when browser capability exists"],
+  "acceptance_scenarios": ["viewport metadata exists", "mobile media block exists", "key panels collapse to safe single-column layouts", "only section navigation owns horizontal scrolling"],
+  "required_tests": ["go test ./cmd/creator-web", "go vet ./cmd/creator-web", "independent evidence review", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000259-refresh-post-responsive-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000259",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "d4b541612647acd826477c8cbea2bc9976049f03",
+  "risk_tier": "E",
+  "intent": "Refresh the audit status projection after the responsive regression guard and current production deployment.",
+  "requirement_ids": ["task lineage and status synchronization", "auditable UI acceptance state"],
+  "allowed_change_scope": {"modules": ["governance-documentation"], "paths": ["docs/PROJECT_STATUS.md", "docs/evidence/audit-completion-matrix-2026-08-23-v5.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000259-refresh-post-responsive-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "cmd/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["current production health/revision", "responsive regression test evidence", "authenticated operations smoke"], "may_change": ["status projection only"]},
+  "semantic_owner": "Governance evidence projection",
+  "canonical_state": ["none"],
+  "state_transitions": ["supersede stale projection without rewriting historical evidence"],
+  "side_effects_and_privileges": ["documentation-only"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["historical evidence remains immutable; current projection can be refreshed"],
+  "assumptions": ["real mobile viewport visual evidence remains unavailable"],
+  "acceptance_scenarios": ["status names DEV-000258 as latest completed", "matrix names d4b54161 production revision", "responsive static guard is recorded", "mobile visual limitation remains explicit"],
+  "required_tests": ["go test ./cmd/creator-web", "go vet ./cmd/creator-web", "independent evidence review", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000260-deep-authenticated-acceptance.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000260",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "a9dbc3b",
+  "risk_tier": "E",
+  "intent": "Record deep authenticated UI and operations acceptance without changing runtime behavior.",
+  "requirement_ids": ["authenticated deep acceptance evidence", "truthful operational status"],
+  "allowed_change_scope": {"modules": ["governance-documentation"], "paths": ["docs/evidence/deep-authenticated-acceptance-2026-08-23-v1.json", "docs/PROJECT_STATUS.md", "docs/evidence/audit-completion-matrix-2026-08-23-v5.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000260-deep-authenticated-acceptance.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "cmd/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["authenticated browser UI", "current production fleet/agent/learning status"], "may_change": ["evidence projection only"]},
+  "semantic_owner": "Governance evidence projection",
+  "canonical_state": ["none"],
+  "state_transitions": ["none"],
+  "side_effects_and_privileges": ["documentation-only; browser acceptance used no mutation"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["evidence remains immutable; status projection can be refreshed"],
+  "assumptions": ["mobile viewport capability remains unavailable", "no delegation ID was present in the authenticated session"],
+  "acceptance_scenarios": ["authenticated chat reply received", "diagnostics 7/7 after refresh", "fleet and agent refresh completed", "learning refresh completed", "action history visible", "no secrets exposed"],
+  "required_tests": ["go test ./cmd/creator-web ./cmd/devctl", "go vet ./cmd/creator-web", "go run ./cmd/devctl preflight -task dev/tasks/DEV-000260-deep-authenticated-acceptance.json", "go run ./cmd/devctl check-diff -task dev/tasks/DEV-000260-deep-authenticated-acceptance.json", "independent evidence review", "git diff --check", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000261-durable-additional-task-evaluation-scheduling.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000261",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "d2dd38b",
+  "risk_tier": "E",
+  "intent": "Connect unresolved model-evaluation evidence to a bounded additional Work Graph and durable dispatch schedule.",
+  "requirement_ids": ["model fleet/failover", "general-first qualification", "adaptive additional tests", "durable parallel dispatch"],
+  "allowed_change_scope": {"modules": ["work", "capability-evaluation"], "paths": ["modules/work/application/graph_runtime.go", "modules/work/application/task_evaluation_dispatch_test.go", "cmd/work-graph-runtime/main.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000261-durable-additional-task-evaluation-scheduling.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "cmd/core-runtime/**", "cmd/creator-web/**", "cmd/agent-worker/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["TaskEvaluationExpansionRequest", "UnresolvedTaskEvidence", "Work Graph admission and dispatch ports"], "may_change": ["application orchestration function only"]},
+  "semantic_owner": "Work application schedules; Capability domain decides qualification expansion",
+  "canonical_state": ["work graph and dispatch queue remain durable owners"],
+  "state_transitions": ["completed unresolved general evaluation -> bounded additional graph -> leased/queued specialist dispatch"],
+  "side_effects_and_privileges": ["durable graph/dispatch persistence through existing ports; no provider or external mutation"],
+  "persistence_and_migrations": ["none; existing graph and dispatch persistence is reused"],
+  "failure_retry_restart": ["existing graph admission and worker lease/recovery semantics remain authoritative; qualified candidate suppresses expansion"],
+  "assumptions": ["caller supplies fresh dispatch identities and bounded additional benchmark version", "independent verifier remains required before qualification promotion"],
+  "acceptance_scenarios": ["unresolved general result creates exactly two bounded additional cases", "additional graph preserves parent evidence lineage", "fresh dispatch intent is queued through existing scheduler", "qualified candidate creates no additional graph"],
+  "required_tests": ["go test ./modules/work/application ./modules/work/domain ./modules/capability/domain", "go vet ./modules/work/application ./modules/work/domain ./modules/capability/domain", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "independent evidence review", "git diff --check", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000262-additional-evaluation-live-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000262",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "b789878",
+  "risk_tier": "E",
+  "intent": "Record production evidence for the deployed adaptive additional task-evaluation scheduling hand-off.",
+  "requirement_ids": ["auditable model qualification lifecycle", "production runtime evidence"],
+  "allowed_change_scope": {"modules": ["governance-documentation"], "paths": ["docs/evidence/additional-evaluation-runtime-live-2026-08-23-v1.json", "docs/PROJECT_STATUS.md", "docs/evidence/audit-completion-matrix-2026-08-23-v5.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000262-additional-evaluation-live-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "cmd/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["production work-graph health/readiness and route response"], "may_change": ["status projection only"]},
+  "semantic_owner": "Governance evidence projection",
+  "canonical_state": ["none"],
+  "state_transitions": ["none"],
+  "side_effects_and_privileges": ["documentation-only; live probe used rejected empty request"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["historical evidence remains immutable; status projection can be refreshed"],
+  "assumptions": ["route validation is not proof of a successful graph mutation"],
+  "acceptance_scenarios": ["production work-graph health is OK", "readiness reports PostgreSQL available", "additional scheduling route rejects incomplete payload with 422", "no secret value appears"],
+  "required_tests": ["go test ./cmd/creator-web", "go vet ./cmd/creator-web", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "independent evidence review", "git diff --check", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000263-gpu-qualification-runtime-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000263",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "1f20685",
+  "risk_tier": "E",
+  "intent": "Record the current Domovoy-owned GPU qualification result without promoting unreachable models.",
+  "requirement_ids": ["model fleet/failover", "quality separated from reachability", "hardware-neutral routing"],
+  "allowed_change_scope": {"modules": ["governance-documentation"], "paths": ["docs/evidence/gpu-qualification-runtime-2026-08-23-v2.json", "docs/PROJECT_STATUS.md", "docs/evidence/audit-completion-matrix-2026-08-23-v5.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000263-gpu-qualification-runtime-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "cmd/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["Domovoy cognitive-worker qualification response", "provider-neutral model rating"], "may_change": ["status projection only"]},
+  "semantic_owner": "Governance evidence projection",
+  "canonical_state": ["none"],
+  "state_transitions": ["none"],
+  "side_effects_and_privileges": ["read-only bounded model qualification; no activation or promotion"],
+  "persistence_and_migrations": ["qualification observations are persisted by existing Capability owner route; this task adds only evidence projection"],
+  "failure_retry_restart": ["timeout remains UNRATED and fallback remains active"],
+  "assumptions": ["GPU endpoint and protected credential were resolved inside cognitive-worker"],
+  "acceptance_scenarios": ["four exact discovered model IDs recorded", "all timeouts remain UNRATED", "GPU does not become preferred", "no secret value appears"],
+  "required_tests": ["go test ./cmd/creator-web", "go vet ./cmd/creator-web", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "independent evidence review", "git diff --check", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000264-capability-aware-agent-worker-readiness.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000264",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "c8dc9ed",
+  "risk_tier": "E",
+  "intent": "Report agent-worker readiness for the bounded local capability while keeping unsupported work durably waiting and external bridge state explicit.",
+  "requirement_ids": ["Agent Execution runtime and recovery", "local-first fallback", "truthful operational readiness"],
+  "allowed_change_scope": {"modules": ["agent-worker"], "paths": ["cmd/agent-worker/status.go", "cmd/agent-worker/status_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000264-capability-aware-agent-worker-readiness.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["agent-worker status response", "local task-evaluation capability"], "may_change": ["readiness semantics only"]},
+  "semantic_owner": "Agent worker operational status",
+  "canonical_state": ["none"],
+  "state_transitions": ["local capability unavailable -> recovery-only; local task-evaluation capability available -> capability-ready; external bridge configured -> execution-ready"],
+  "side_effects_and_privileges": ["status/readiness response only"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["unsupported work remains WAITING; stale claims remain recoverable"],
+  "assumptions": ["ready means at least one advertised capability can accept work, not that every arbitrary agent operation is supported"],
+  "acceptance_scenarios": ["recovery-only remains not ready", "local task-evaluation reports ready without claiming external bridge", "configured bridge remains ready", "local capability and unsupported-work distinction is explicit"],
+  "required_tests": ["go test ./cmd/agent-worker/...", "go vet ./cmd/agent-worker/...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "independent evidence review", "git diff --check", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000265-agent-worker-capability-readiness-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000265",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "102a57a",
+  "risk_tier": "E",
+  "intent": "Record live capability-aware agent-worker readiness after the local executor rollout.",
+  "requirement_ids": ["Agent Execution runtime and recovery", "truthful operational status"],
+  "allowed_change_scope": {"modules": ["governance-documentation"], "paths": ["docs/evidence/agent-worker-capability-readiness-2026-08-24-v1.json", "docs/PROJECT_STATUS.md", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000265-agent-worker-capability-readiness-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "cmd/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["live agent-worker status and readyz", "public Assistant health"], "may_change": ["status projection only"]},
+  "semantic_owner": "Governance evidence projection",
+  "canonical_state": ["none"],
+  "state_transitions": ["none"],
+  "side_effects_and_privileges": ["documentation-only; read-only runtime probes"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["unsupported work remains durable waiting; recovery counters remain observable"],
+  "assumptions": ["capability-ready semantics are narrower than generic agent execution readiness"],
+  "acceptance_scenarios": ["local task-evaluation capability reports READY", "external bridge remains false", "readyz is READY", "public health is OK", "no secret value appears"],
+  "required_tests": ["go test ./cmd/creator-web", "go vet ./cmd/creator-web", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "independent evidence review", "git diff --check", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000266-local-agent-execution-bridge.json

@@ -0,0 +1,26 @@
+{
+  "task_id": "DEV-000266",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "c4f3f02",
+  "risk_tier": "E",
+  "intent": "Provide an independently running local Agent Execution bridge for the bounded task-evaluation capability, while keeping unsupported generic work durably waiting.",
+  "requirement_ids": ["WP-301", "Agent Execution runtime and recovery"],
+  "allowed_change_scope": {
+    "modules": ["agent-worker", "agentbridge"],
+    "paths": ["adapters/agentbridge/**", "cmd/agent-worker/**", "cmd/agent-execution-bridge/**", "deploy/docker-compose.prod.yml", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000266-local-agent-execution-bridge.json", "docs/evidence/**", "docs/PROJECT_STATUS.md"]
+  },
+  "forbidden_change_scope": {"paths": ["architecture/**", "database/**", "security/**", "contracts/authority/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["AgentExecutionRequest", "AgentExecutionResult", "TaskEvaluationExecutionResponse", "TaskCaseVerificationResponse", "TaskEvaluationEvidenceCallback"], "may_change": []},
+  "semantic_owner": "work dispatches; capability owns evaluation evidence",
+  "canonical_state": ["existing work lease/callback state", "existing capability evaluation evidence"],
+  "state_transitions": ["durable dispatch -> bridge request -> bounded evaluation/verifier/callback -> completed or explicit waiting"],
+  "side_effects_and_privileges": ["outbound HTTP only to cognitive-worker, task-verifier and work-graph-runtime; no database access; no credentials forwarded"],
+  "persistence_and_migrations": ["reuse existing owners; no migration"],
+  "failure_retry_restart": ["bridge or dependency failure returns an executor error; worker retains durable retry/recovery evidence", "unsupported intent returns WAITING and is never completed"],
+  "assumptions": ["local bridge is a bounded fallback, not a universal Codex executor", "generic work remains pending until a separately qualified capability is installed"],
+  "acceptance_scenarios": ["bridge receives typed request", "task-evaluation reaches cognitive worker, verifier and graph callback", "unsupported generic intent returns WAITING", "worker can use bridge-backed execution without changing lease/recovery semantics"],
+  "required_tests": ["unit", "runtime HTTP", "architecture", "go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "docker compose config", "git diff --check"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000267-refresh-gpu-and-ui-gap-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000267",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "c459cd5",
+  "risk_tier": "E",
+  "intent": "Record fresh Domovoy-owned GPU qualification and authenticated UI viewport evidence without promoting models or changing runtime behavior.",
+  "requirement_ids": ["model fleet/failover", "UI/operations acceptance"],
+  "allowed_change_scope": {"modules": ["governance-documentation"], "paths": ["docs/evidence/gpu-qualification-runtime-2026-08-24-v1.json", "docs/evidence/audit-completion-matrix-2026-08-24-v7.json", "docs/PROJECT_STATUS.md", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000267-refresh-gpu-and-ui-gap-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "cmd/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["Domovoy cognitive-worker GPU qualification response", "authenticated browser viewport observation"], "may_change": ["status projection only"]},
+  "semantic_owner": "Governance evidence projection",
+  "canonical_state": ["none"],
+  "state_transitions": ["none"],
+  "side_effects_and_privileges": ["read-only bounded qualification and browser observation; no activation, promotion or mutation"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["timeout remains UNRATED and CPU/LIFEBOAT fallback remains active", "missing mobile viewport remains an explicit acceptance gap"],
+  "assumptions": ["GPU credential remains resolved inside cognitive-worker", "browser session is already authenticated and no secrets are inspected"],
+  "acceptance_scenarios": ["four exact GPU model IDs recorded", "all timeout results remain UNRATED", "GPU does not become preferred", "desktop viewport and mobile limitation recorded", "no secret value appears"],
+  "required_tests": ["go test ./cmd/creator-web", "go vet ./cmd/creator-web", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "independent evidence review", "git diff --check", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000268-configurable-gpu-qualification-timeout.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000268",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "3ca7ffa",
+  "risk_tier": "E",
+  "intent": "Make the GPU cognitive provider invocation deadline configurable and bounded so large local models are not rejected by an accidental ten-second cold-start limit.",
+  "requirement_ids": ["model fleet/failover", "quality separated from reachability", "hardware-neutral routing"],
+  "allowed_change_scope": {"modules": ["cognitive-worker", "deployment-governance"], "paths": ["cmd/cognitive-worker/**", "deploy/docker-compose.prod.yml", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000268-configurable-gpu-qualification-timeout.json", "docs/evidence/**", "docs/PROJECT_STATUS.md"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "contracts/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing OpenAI-compatible local provider adapter", "existing qualification route"], "may_change": ["deployment timeout configuration only"]},
+  "semantic_owner": "cognitive-worker invokes provider; capability remains qualification and promotion owner",
+  "canonical_state": ["existing qualification observations"],
+  "state_transitions": ["provider timeout window changes; no qualification or activation transition is inferred"],
+  "side_effects_and_privileges": ["bounded outbound GPU provider request through existing credential boundary"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["timeout remains an unrated/unavailable observation; CPU/LIFEBOAT fallback remains authoritative"],
+  "assumptions": ["60 seconds is a bounded cold-start window and qualification models still run in parallel", "no model is promoted automatically"],
+  "acceptance_scenarios": ["GPU adapter uses configured bounded timeout", "default is 60 seconds", "qualification remains unrated on timeout", "routing does not infer intelligence from GPU"],
+  "required_tests": ["go test ./...", "go vet ./...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl/independent", "docker compose config", "git diff --check", "production health smoke", "one Domovoy-owned GPU qualification probe"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000270-local-first-model-scope.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000270",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "29dad40",
+  "risk_tier": "E",
+  "intent": "Record the approved local-first operating scope: one local conversational model, Qwen3-8B or Gemma-4 when available locally, is sufficient for the current phase, with the local Lifeboat as recovery fallback; external model qualification is deferred until explicitly requested, while external capability remains optional and non-blocking.",
+  "requirement_ids": ["local-first model operation", "hardware-neutral routing", "explicit scope decisions"],
+  "allowed_change_scope": {"modules": ["cognitive-worker", "deployment-governance"], "paths": ["docs/MODEL_FLEET_POLICY.md", "docs/PROJECT_STATUS.md", "docs/evidence/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000270-local-first-model-scope.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "contracts/**", "LLM-local/**", "cmd/**", "deploy/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing local CPU provider route", "existing local Lifeboat route"], "may_change": ["documentation and evidence projection only"]},
+  "semantic_owner": "cognitive-worker model routing policy remains hardware-neutral; this task records the current operating scope",
+  "canonical_state": ["existing local provider and Lifeboat runtime state", "this explicit scope decision"],
+  "state_transitions": ["external model qualification is deferred, not promoted or removed"],
+  "side_effects_and_privileges": [],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["local CPU route remains primary; local Lifeboat remains recovery fallback", "durable reflexes, skills, and local executors continue work when external models are unavailable"],
+  "assumptions": ["external providers may be added later by a separate explicit task", "GPU presence does not imply quality or priority"],
+  "acceptance_scenarios": ["policy names one local Qwen3-8B or Gemma-4 conversational model as current primary candidate", "policy names local Lifeboat as fallback", "external qualification is clearly deferred", "external unavailability does not block local/reflex/skill execution", "no external model probe is required for this task"],
+  "required_tests": ["go test ./...", "go vet ./...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl/independent", "git diff --check", "local runtime health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000273-live-audit-status-reconciliation.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000273",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "d7151f1",
+  "risk_tier": "E",
+  "intent": "Reconcile the audit status with the current merged production artifact and fresh authenticated desktop/mobile viewport evidence without changing runtime behavior.",
+  "requirement_ids": ["current-state evidence", "truthful UI acceptance", "production artifact provenance"],
+  "allowed_change_scope": {"modules": ["deployment-governance", "creator-web-acceptance"], "paths": ["docs/evidence/**", "docs/PROJECT_STATUS.md", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000273-live-audit-status-reconciliation.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "contracts/**", "cmd/**", "deploy/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing production health and image provenance", "authenticated browser DOM and viewport observations"], "may_change": ["evidence and status projections only"]},
+  "semantic_owner": "audit evidence projection",
+  "canonical_state": ["merged main revision", "live production observations"],
+  "state_transitions": ["evidence projection advances to the latest verified production revision"],
+  "side_effects_and_privileges": [],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["failed or unavailable observations remain explicit and do not become passes"],
+  "assumptions": ["documentation-only changes do not require a Docker rebuild", "mobile viewport acceptance requires an actual 390x844 browser viewport"],
+  "acceptance_scenarios": ["main and production artifact revision are recorded", "authenticated desktop evidence is recorded", "mobile acceptance remains unclaimed when actual viewport is not 390x844", "external model probing is not performed"],
+  "required_tests": ["go test ./...", "go vet ./...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl/independent", "git diff --check", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000274-truth-first-question-gate.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000274",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "5205845",
+  "risk_tier": "E",
+  "intent": "Make the default chat path refuse unverified factual answers instead of exposing model speculation; preserve explicitly classified internal status paths and leave a general research capability for the next routing stage.",
+  "requirement_ids": ["truth-first default", "no fabricated factual answers", "semantic routing without entity word lists"],
+  "allowed_change_scope": {"modules": ["creator-web", "cognitive-worker", "interaction"], "paths": ["cmd/creator-web/server.go", "cmd/creator-web/chat_test.go", "cmd/cognitive-worker/interpretation.go", "cmd/cognitive-worker/interpretation_test.go", "modules/interaction/domain/chat.go", "modules/interaction/domain/chat_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000274-truth-first-question-gate.json", "docs/PROJECT_STATUS.md", "docs/evidence/**"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "contracts/**", "deploy/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing semantic speech act and information request", "existing local cognitive gateway"], "may_change": ["truthful chat presentation gate", "interpretation prompt guidance"]},
+  "semantic_owner": "interaction semantics and creator-web presentation boundary",
+  "canonical_state": ["existing semantic interpretation", "existing verified internal status paths"],
+  "state_transitions": ["unverified question -> truthful verification-required response", "explicitly classified internal status -> existing status response"],
+  "side_effects_and_privileges": ["none; no provider call is made for an unverified factual question"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["missing research capability never becomes a fabricated answer"],
+  "assumptions": ["a later task will connect WEB_RESEARCH to a read-only source connector", "explicit user requests to discuss hypotheses/options remain a separate cognitive path"],
+  "acceptance_scenarios": ["weather-like factual question does not expose a model-generated answer without evidence", "response explains that verification is unavailable and names safe source category", "internal classified status path remains functional", "an incidental word such as model does not open an inventory or verification route", "routing uses semantic intent rather than city/entity keyword lists"],
+  "required_tests": ["go test ./cmd/creator-web/... ./cmd/cognitive-worker/...", "go vet ./cmd/creator-web/... ./cmd/cognitive-worker/...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl/independent", "git diff --check", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000275-semantic-web-research-routing.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000275",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "1eb3e39",
+  "risk_tier": "E",
+  "intent": "Route semantically classified WEB_RESEARCH questions through the bounded research runtime and present only immutable source excerpts; absence or conflict of evidence remains a truthful non-answer.",
+  "requirement_ids": ["semantic request classification", "truth-first default", "source-backed response", "optional external channel"],
+  "allowed_change_scope": {"modules": ["core-runtime", "creator-web", "cognitive-worker", "research-runtime", "epistemics", "interaction", "deployment"], "paths": ["contracts/epistemics/research.go", "contracts/interaction/types.go", "adapters/research/search_connector.go", "modules/epistemics/domain/research.go", "cmd/research-runtime/main.go", "cmd/core-runtime/main.go", "cmd/core-runtime/research_client.go", "cmd/core-runtime/cognitive_interpretation.go", "cmd/core-runtime/cognitive_interpretation_test.go", "cmd/creator-web/server.go", "deploy/docker-compose.prod.yml", "tests/research_runtime/search_connector_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000275-semantic-web-research-routing.json", "docs/PROJECT_STATUS.md", "docs/evidence/**"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "LLM-local/**", "modules/interaction/domain/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing semantic interpretation", "existing epistemics evidence chain", "existing research runtime persistence"], "may_change": ["typed web-search request and source-backed finding presentation"]},
+  "semantic_owner": "interaction/cognitive interpretation selects meaning; epistemics owns evidence; Core presents the result",
+  "canonical_state": ["epistemics truth bundle and citation state remain canonical", "no generated advisory is canonical evidence"],
+  "state_transitions": ["semantic WEB_RESEARCH -> bounded search request -> persisted source snapshot -> source-backed chat response", "search unavailable/conflicted -> verification-required response"],
+  "side_effects_and_privileges": ["read-only HTTPS search fetches to configured allowlist", "no provider/model selection from user input", "no secret forwarded to search"],
+  "persistence_and_migrations": ["existing epistemics persistence only; no migration"],
+  "failure_retry_restart": ["empty/unavailable search never becomes an answer", "runtime restart preserves persisted evidence"],
+  "assumptions": ["search endpoint template and host allowlist are operator configuration", "local model remains optional; deterministic truth gate is the fallback"],
+  "acceptance_scenarios": ["simple factual question reaches semantic interpretation", "generic question is routed by WEB_RESEARCH without city/entity keyword lists", "bounded source excerpt and locator are returned", "conflicted/empty evidence is not presented as fact", "search channel can be absent without breaking chat core"],
+  "required_tests": ["go test ./adapters/research ./modules/epistemics/... ./cmd/research-runtime/... ./cmd/core-runtime/... ./cmd/creator-web/... ./tests/research_runtime/...", "go vet ./...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl/independent", "git diff --check", "CI", "production health and research-runtime readiness smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000276-research-search-provider-fallback.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000276",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "c09be4c",
+  "risk_tier": "E",
+  "intent": "Replace the blocked default search provider with an available configured HTML search endpoint while preserving bounded parsing and truth-first failure behavior.",
+  "requirement_ids": ["research provider fallback", "no fabricated evidence", "optional external channel"],
+  "allowed_change_scope": {"modules": ["research-runtime", "deployment"], "paths": ["adapters/research/search_connector.go", "deploy/docker-compose.prod.yml", "tests/research_runtime/search_connector_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000276-research-search-provider-fallback.json", "docs/PROJECT_STATUS.md", "docs/evidence/**"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "contracts/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing WebSearchRequest and evidence chain"], "may_change": ["bounded provider response parsing"]},
+  "semantic_owner": "research runtime owns source collection and evidence preservation",
+  "canonical_state": ["existing epistemics source snapshot and citation chain"],
+  "state_transitions": ["configured provider response -> bounded excerpts", "provider challenge/no result -> unknown evidence"],
+  "side_effects_and_privileges": ["read-only HTTPS fetch to operator allowlist"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["provider failure never becomes a supported finding"],
+  "assumptions": ["operator may override search URL and host allowlist", "search results are source excerpts, not generated answers"],
+  "acceptance_scenarios": ["Bing-style bounded result is collected", "unallowlisted endpoint is rejected", "provider challenge yields no evidence", "no entity-specific query logic exists"],
+  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production research-runtime smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000277-research-parser-live-fix.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000277",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "5058d5a",
+  "risk_tier": "E",
+  "intent": "Align the bounded configured search parser with the observed provider HTML while retaining explicit no-evidence behavior.",
+  "requirement_ids": ["research live smoke", "source-backed response"],
+  "allowed_change_scope": {"modules": ["research-runtime"], "paths": ["adapters/research/search_connector.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000277-research-parser-live-fix.json", "docs/evidence/**"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing search connector and evidence chain"], "may_change": ["provider HTML parser" ]},
+  "semantic_owner": "research runtime",
+  "canonical_state": ["existing persisted source evidence"],
+  "state_transitions": ["observed provider HTML -> exact bounded excerpt"],
+  "side_effects_and_privileges": ["none beyond existing allowlisted read-only fetch"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["parser mismatch remains no-evidence, never fabricated evidence"],
+  "assumptions": ["provider response remains bounded and allowlisted"],
+  "acceptance_scenarios": ["current configured provider heading markup parses", "empty or challenge response remains UNKNOWN"],
+  "required_tests": ["go test ./tests/research_runtime ./cmd/research-runtime/...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production research smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000278-live-research-evidence-reconciliation.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000278",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "f1c3abb",
+  "risk_tier": "E",
+  "intent": "Record current production evidence for source-backed research routing without changing runtime behavior.",
+  "requirement_ids": ["truth/research live evidence", "production provenance"],
+  "allowed_change_scope": {"modules": [], "paths": ["dev/ACTIVE_TASK.json", "dev/tasks/DEV-000278-live-research-evidence-reconciliation.json", "docs/PROJECT_STATUS.md", "docs/evidence/semantic-web-research-routing-2026-08-24-v2.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "contracts/**", "modules/**", "adapters/**", "cmd/**", "deploy/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing production health and research smoke evidence"], "may_change": ["documentation evidence only"]},
+  "semantic_owner": "evidence reconciliation",
+  "canonical_state": ["no runtime state changed"],
+  "state_transitions": ["observed production smoke -> evidence record"],
+  "side_effects_and_privileges": ["none"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["none"],
+  "assumptions": ["production smoke was read-only and used no secrets"],
+  "acceptance_scenarios": ["evidence names exact production revision", "source claims remain explicitly UNVERIFIED", "authenticated UI limitation remains explicit"],
+  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000279-live-audit-matrix-reconciliation.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000279",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "ffd7ddc",
+  "risk_tier": "E",
+  "intent": "Reconcile the audit matrix with current production fleet, bridge and research observations; documentation only.",
+  "requirement_ids": ["audit current-state evidence", "no stale production claims"],
+  "allowed_change_scope": {"modules": [], "paths": ["dev/ACTIVE_TASK.json", "dev/tasks/DEV-000279-live-audit-matrix-reconciliation.json", "docs/PROJECT_STATUS.md", "docs/evidence/audit-completion-matrix-2026-08-24-v11.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "contracts/**", "modules/**", "adapters/**", "cmd/**", "deploy/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["current production health, fleet, bridge and research observations"], "may_change": ["audit evidence only"]},
+  "semantic_owner": "evidence reconciliation",
+  "canonical_state": ["no runtime state changed"],
+  "state_transitions": ["live observations -> current audit evidence"],
+  "side_effects_and_privileges": ["none"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["none"],
+  "assumptions": ["all observations were read-only"],
+  "acceptance_scenarios": ["matrix names exact production revision", "fleet selected tier matches live response", "remaining gaps remain explicit"],
+  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000280-local-generic-agent-execution.json

@@ -0,0 +1,26 @@
+{
+  "task_id": "DEV-000280",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "51db637",
+  "risk_tier": "E",
+  "intent": "Add a typed local generic cognitive specialist execution path for Work Graph nodes, preserving independent verification and durable recovery semantics.",
+  "requirement_ids": ["generic local agent execution", "candidate output is not verified fact", "work graph callback remains independently verifiable"],
+  "allowed_change_scope": {
+    "modules": ["work"],
+    "paths": ["contracts/work/bridge.go", "contracts/work/lease.go", "adapters/postgres/work_repository.go", "cmd/agent-execution-bridge/**", "cmd/agent-worker/**", "tests/agent_execution/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000280-local-generic-agent-execution.json"]
+  },
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "modules/identity/**", "modules/authority/**", "LLM-local/**", "deploy/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["contracts/work@v1", "cognitive gateway advisory endpoint", "work graph result callback"], "may_change": ["contracts/work@v1 bridge extension"]},
+  "semantic_owner": "work",
+  "canonical_state": ["work dispatch intent and graph candidate only; no canonical fact or external mutation"],
+  "state_transitions": ["queued -> leased -> executing -> candidate recorded -> verifying", "unsupported or unavailable -> WAITING with durable retry"],
+  "side_effects_and_privileges": ["local cognitive gateway call", "work graph candidate callback", "no external mutation"],
+  "persistence_and_migrations": ["reuse existing work.agent_dispatch_intents and graph candidate persistence; no migration"],
+  "failure_retry_restart": ["bridge timeout or gateway failure returns error for durable retry", "unsupported context returns WAITING", "lease heartbeat and stale claim recovery remain unchanged"],
+  "assumptions": ["Cognitive Gateway is the only model boundary", "generic output is an unverified candidate until independent synthesis", "local CPU/Lifeboat fallback remains the default capability"],
+  "acceptance_scenarios": ["typed generic request reaches gateway and callback", "callback candidate leaves graph eligible for verification rather than success", "missing generic context returns WAITING", "gateway failure is retryable and never reported completed"],
+  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_ARCHITECTURE_GAP"]
+}

dev/tasks/DEV-000281-live-generic-agent-execution-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000281",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "080bd44",
+  "risk_tier": "E",
+  "intent": "Reconcile production evidence after the generic local Agent Execution rollout.",
+  "requirement_ids": ["no stale production claims", "generic bridge evidence is explicit", "remaining acceptance gaps remain visible"],
+  "allowed_change_scope": {"modules": [], "paths": ["dev/ACTIVE_TASK.json", "dev/tasks/DEV-000281-live-generic-agent-execution-evidence.json", "docs/PROJECT_STATUS.md", "docs/evidence/audit-completion-matrix-2026-08-24-v12.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "contracts/**", "modules/**", "adapters/**", "cmd/**", "deploy/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["production image labels", "agent bridge health", "agent worker readiness", "assistant health"], "may_change": ["audit evidence only"]},
+  "semantic_owner": "evidence reconciliation",
+  "canonical_state": ["no runtime state changed"],
+  "state_transitions": ["live observations -> versioned evidence"],
+  "side_effects_and_privileges": ["read-only production inspection"],
+  "persistence_and_migrations": ["documentation only"],
+  "failure_retry_restart": ["none"],
+  "assumptions": ["the deployment label is the authoritative runtime revision evidence", "generic candidate output still requires independent graph verification"],
+  "acceptance_scenarios": ["matrix records 080bd44 production revision", "bridge and worker advertise generic-cognitive-work", "mobile and authenticated chat gaps remain explicit"],
+  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000282-final-auto-deploy-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000282",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "e132ec6",
+  "risk_tier": "E",
+  "intent": "Record the final delayed Portainer auto-deployment and live production revision after DEV-000281.",
+  "requirement_ids": ["production revision is current", "auto-deploy is documented", "live health remains green"],
+  "allowed_change_scope": {"modules": [], "paths": ["dev/ACTIVE_TASK.json", "dev/tasks/DEV-000282-final-auto-deploy-evidence.json", "docs/PROJECT_STATUS.md", "docs/evidence/audit-completion-matrix-2026-08-24-v13.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "contracts/**", "modules/**", "adapters/**", "cmd/**", "deploy/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["Portainer delayed auto-deploy observation", "production image labels", "assistant health", "bridge and worker readiness"], "may_change": ["audit evidence only"]},
+  "semantic_owner": "evidence reconciliation",
+  "canonical_state": ["no runtime state changed"],
+  "state_transitions": ["merged main -> Portainer rollout -> live evidence"],
+  "side_effects_and_privileges": ["read-only production inspection"],
+  "persistence_and_migrations": ["documentation only"],
+  "failure_retry_restart": ["rollout may be delayed; verify revision after the delay"],
+  "assumptions": ["Portainer Git deployment is the production control plane", "no secret values are needed for normal auto-deploy"],
+  "acceptance_scenarios": ["production labels and public HTML expose e132ec6", "health remains ok", "generic bridge capability remains advertised"],
+  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000283-generic-candidate-verifier.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000283",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "94baf98",
+  "risk_tier": "E",
+  "intent": "Add an independent deterministic envelope verifier before a generic local Work Graph candidate is recorded.",
+  "requirement_ids": ["independent candidate envelope verification", "model output is not truth", "graph success still requires synthesis"],
+  "allowed_change_scope": {"modules": ["work"], "paths": ["dev/ACTIVE_TASK.json", "dev/tasks/DEV-000283-generic-candidate-verifier.json", "contracts/work/graph.go", "cmd/task-verifier/**", "cmd/agent-execution-bridge/**"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "modules/identity/**", "modules/authority/**", "LLM-local/**", "deploy/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["contracts/work@v1", "task-verifier internal endpoint", "work graph result callback"], "may_change": ["contracts/work graph candidate verification payload"]},
+  "semantic_owner": "work",
+  "canonical_state": ["verification evidence is an integrity envelope only; candidate remains unverified semantically"],
+  "state_transitions": ["generic model output -> deterministic envelope verification -> candidate recording -> VERIFYING"],
+  "side_effects_and_privileges": ["local verifier call and work graph callback; no external mutation"],
+  "persistence_and_migrations": ["reuse existing candidate evidence refs; no migration"],
+  "failure_retry_restart": ["verifier unavailable returns retryable failure", "invalid envelope returns WAITING", "graph success remains gated by independent synthesis"],
+  "assumptions": ["deterministic verification proves attribution/integrity only, not factual truth", "task-verifier is an independently running local service"],
+  "acceptance_scenarios": ["valid generic candidate obtains verifier evidence", "invalid candidate is not recorded as completed", "model output remains unverified", "existing task evaluation path remains unchanged"],
+  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000284-live-generic-synthesis-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000284",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "bcbd41f",
+  "risk_tier": "E",
+  "intent": "Record a bounded production canary proving that generic Work Graph candidates remain unverified until an independent verifier and synthesis path completes the graph.",
+  "requirement_ids": ["generic candidate independent verification", "candidate dissent lineage", "graph completion only after verified synthesis"],
+  "allowed_change_scope": {"modules": [], "paths": ["dev/ACTIVE_TASK.json", "dev/tasks/DEV-000284-live-generic-synthesis-evidence.json", "docs/PROJECT_STATUS.md", "docs/evidence/audit-completion-matrix-2026-08-24-v14.json", "docs/evidence/generic-synthesis-live-2026-08-24-v1.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "contracts/**", "modules/**", "adapters/**", "cmd/**", "deploy/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["task-verifier generic envelope response", "Work Graph synthesis response", "production runtime labels"], "may_change": ["audit evidence only"]},
+  "semantic_owner": "evidence reconciliation",
+  "canonical_state": ["synthetic canary graph and candidates are disposable evidence records; no user data or external mutation"],
+  "state_transitions": ["candidate recorded -> independently envelope-verified -> synthesis verified -> graph completed"],
+  "side_effects_and_privileges": ["bounded synthetic production Work Graph records only"],
+  "persistence_and_migrations": ["documentation only; no migration"],
+  "failure_retry_restart": ["canary is idempotent by unique synthetic graph id; failure remains evidence gap"],
+  "assumptions": ["semantic envelope verification is not semantic truth verification", "external model qualification remains deferred"],
+  "acceptance_scenarios": ["two candidates retain dissent lineage", "synthesis response is independently attributed", "graph reaches COMPLETED only through synthesis endpoint", "semantic content remains explicitly unverified"],
+  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production health smoke", "live generic synthesis canary"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000285-semantic-research-routing-fix.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000285",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "5c98bc3",
+  "risk_tier": "E",
+  "intent": "Route semantically source-dependent current-fact questions to the existing provider-neutral WEB_RESEARCH capability instead of returning an unverified fallback.",
+  "requirement_ids": ["truth-first source routing", "no entity-specific keyword branches", "local deterministic fallback remains honest"],
+  "allowed_change_scope": {"modules": ["interaction"], "paths": ["dev/ACTIVE_TASK.json", "dev/tasks/DEV-000285-semantic-research-routing-fix.json", "modules/interaction/domain/chat.go", "modules/interaction/domain/chat_test.go"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "cmd/**", "deploy/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["interaction semantic candidate contract", "capability WEB_RESEARCH hint"], "may_change": []},
+  "semantic_owner": "interaction",
+  "canonical_state": ["no new canonical state; only semantic interpretation hints change"],
+  "state_transitions": ["source-dependent question -> WEB_RESEARCH hint -> existing research runtime"],
+  "side_effects_and_privileges": ["existing read-only research connector may be selected by downstream runtime"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["if research is unavailable, existing truthful unverified response remains"],
+  "assumptions": ["lexical cues represent semantic classes such as currentness and observed external state, not named entities"],
+  "acceptance_scenarios": ["weather-like current fact routes to WEB_RESEARCH without city-specific code", "ordinary model mention does not route to research", "non-research factual question remains honest when no source-dependent cue exists"],
+  "required_tests": ["go test ./modules/interaction/domain", "go vet ./modules/interaction/domain", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000286-research-result-relevance-filter.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000286",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "b0a8b3e",
+  "risk_tier": "E",
+  "intent": "Reject web-search excerpts with no substantive lexical relation to the requested query so truth-first chat never presents irrelevant search results as useful evidence.",
+  "requirement_ids": ["research relevance boundary", "truth-first no irrelevant evidence", "no entity-specific filtering"],
+  "allowed_change_scope": {"modules": ["research adapter"], "paths": ["dev/ACTIVE_TASK.json", "dev/tasks/DEV-000286-research-result-relevance-filter.json", "adapters/research/search_connector.go", "tests/research_runtime/search_connector_test.go"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "cmd/**", "deploy/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["epistemics ResearchCandidate", "provider-neutral WebSearchRequest"], "may_change": []},
+  "semantic_owner": "epistemics research adapter boundary",
+  "canonical_state": ["no new canonical state; irrelevant candidates are not emitted"],
+  "state_transitions": ["raw search result -> relevance gate -> candidate or omission"],
+  "side_effects_and_privileges": ["read-only search connector only"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["zero relevant candidates becomes the existing truthful no-evidence response"],
+  "assumptions": ["short query terms without substantive tokens retain prior parser behavior for compatibility", "term overlap is a bounded relevance guard, not semantic truth verification"],
+  "acceptance_scenarios": ["irrelevant dictionary results are omitted for a weather-like query", "relevant result is retained", "no entity-specific branch exists"],
+  "required_tests": ["go test ./tests/research_runtime", "go vet ./adapters/research ./tests/research_runtime", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production health smoke", "one live chat smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000287-live-evidence-reconciliation.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000287",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "3c46a5f07f4c7a31f4614c5306efe843c10bd264",
+  "risk_tier": "E",
+  "intent": "Reconcile durable project evidence with the merged research relevance filter, current production revision, and one authenticated truth-first chat smoke.",
+  "requirement_ids": ["current production evidence", "truth-first authenticated chat smoke", "no stale completion claims"],
+  "allowed_change_scope": {"modules": ["project evidence"], "paths": ["dev/ACTIVE_TASK.json", "dev/tasks/DEV-000287-live-evidence-reconciliation.json", "docs/PROJECT_STATUS.md", "docs/evidence/audit-completion-matrix-2026-08-24-v15.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "cmd/**", "deploy/**", "LLM-local/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["production health/readiness endpoints", "authenticated chat UI evidence"], "may_change": []},
+  "semantic_owner": "project evidence",
+  "canonical_state": ["none; evidence and status projections only"],
+  "state_transitions": ["stale evidence -> reconciled evidence"],
+  "side_effects_and_privileges": ["read-only production checks and one chat smoke"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["no runtime behavior is changed; missing evidence remains an explicit gap"],
+  "assumptions": ["deep authenticated/mobile UI and external model qualification remain deferred by scope"],
+  "acceptance_scenarios": ["all current production revisions match merged main", "public and internal readiness are healthy", "authenticated factual chat refuses unverified weather data", "matrix records remaining gaps explicitly"],
+  "required_tests": ["go test ./tests/research_runtime", "go vet ./tests/research_runtime", "preflight", "check-diff", "check-architecture", "independent", "JSON parse", "git diff --check", "CI", "production health smoke", "one authenticated chat smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000288-production-evidence-revision.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000288",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "3e91ae503c28547852acf130a5414ae9a27a4579",
+  "risk_tier": "E",
+  "intent": "Record the current production revision after the DEV-000287 documentation merge without changing runtime behavior.",
+  "requirement_ids": ["current production evidence", "no stale revision claim"],
+  "allowed_change_scope": {"modules": ["project evidence"], "paths": ["dev/ACTIVE_TASK.json", "dev/tasks/DEV-000288-production-evidence-revision.json", "docs/PROJECT_STATUS.md", "docs/evidence/audit-completion-matrix-2026-08-24-v16.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "cmd/**", "deploy/**", "LLM-local/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["production Docker revision labels", "public health endpoint", "v15 audit evidence"], "may_change": []},
+  "semantic_owner": "project evidence",
+  "canonical_state": ["none; evidence projection only"],
+  "state_transitions": ["v15 production observation -> v16 current observation"],
+  "side_effects_and_privileges": ["read-only production checks"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["if production revision is unavailable, retain an explicit missing-evidence gap"],
+  "assumptions": ["mobile authenticated visual acceptance, deep UI acceptance and external model qualification remain deferred by explicit scope"],
+  "acceptance_scenarios": ["all runtime containers show the merged revision", "public health is ok", "remaining gaps remain explicit"],
+  "required_tests": ["go test ./tests/research_runtime", "go vet ./tests/research_runtime", "preflight", "check-diff", "check-architecture", "independent", "JSON parse", "git diff --check", "CI", "production health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000289-chat-mobile-overflow-fix.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000289",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "a2ff01050e5a2e22b29b85c700ff788d739e1c77",
+  "risk_tier": "E",
+  "intent": "Remove authenticated chat horizontal overflow at mobile viewport widths caused by intrinsic grid-item width.",
+  "requirement_ids": ["authenticated mobile UI acceptance", "no horizontal overflow at 390px"],
+  "allowed_change_scope": {"modules": ["creator-web"], "paths": ["dev/ACTIVE_TASK.json", "dev/tasks/DEV-000289-chat-mobile-overflow-fix.json", "cmd/creator-web/static/assets/chat.css", "cmd/creator-web/responsive_test.go"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "LLM-local/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing creator-web HTML/CSS surface"], "may_change": []},
+  "semantic_owner": "creator-web presentation",
+  "canonical_state": ["none"],
+  "state_transitions": ["mobile layout intrinsic width -> constrained viewport width"],
+  "side_effects_and_privileges": ["none"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["CSS-only; no runtime state or recovery semantics changed"],
+  "assumptions": ["desktop layout must remain unchanged", "deep UI and load tests remain deferred"],
+  "acceptance_scenarios": ["authenticated chat has no horizontal overflow at 390px", "existing mobile media rules remain present", "desktop static layout remains unchanged"],
+  "required_tests": ["go test ./cmd/creator-web", "go vet ./cmd/creator-web", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production health smoke", "one authenticated mobile smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000290-chat-mobile-header-overflow.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000290",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "e9d5b1ca8a2aa14fb11241c2766e79547a469078",
+  "risk_tier": "E",
+  "intent": "Constrain authenticated chat header controls at mobile viewport widths after live acceptance found a second horizontal overflow source.",
+  "requirement_ids": ["authenticated mobile UI acceptance", "no horizontal overflow at 390px"],
+  "allowed_change_scope": {"modules": ["creator-web"], "paths": ["dev/ACTIVE_TASK.json", "dev/tasks/DEV-000290-chat-mobile-header-overflow.json", "cmd/creator-web/static/assets/chat.css", "cmd/creator-web/responsive_test.go"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "LLM-local/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing creator-web header controls"], "may_change": []},
+  "semantic_owner": "creator-web presentation",
+  "canonical_state": ["none"],
+  "state_transitions": ["header intrinsic controls -> bounded mobile controls"],
+  "side_effects_and_privileges": ["none"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["CSS-only; no runtime state or recovery semantics changed"],
+  "assumptions": ["desktop header remains unchanged", "the settings link remains available through the cognitive console link"],
+  "acceptance_scenarios": ["authenticated chat has no horizontal overflow at 390px", "settings navigation remains available", "logout remains visible", "desktop static layout remains unchanged"],
+  "required_tests": ["go test ./cmd/creator-web", "go vet ./cmd/creator-web", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production health smoke", "one authenticated mobile smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000291-mobile-acceptance-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000291",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "8c6f23dc491150a747bcc46c26ff04d217d37eba",
+  "risk_tier": "E",
+  "intent": "Record successful authenticated mobile chat acceptance after the responsive overflow fixes.",
+  "requirement_ids": ["authenticated mobile visual acceptance", "current production evidence"],
+  "allowed_change_scope": {"modules": ["project evidence"], "paths": ["dev/ACTIVE_TASK.json", "dev/tasks/DEV-000291-mobile-acceptance-evidence.json", "docs/PROJECT_STATUS.md", "docs/evidence/audit-completion-matrix-2026-08-24-v17.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "cmd/**", "deploy/**", "LLM-local/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["production Docker revision labels", "authenticated browser viewport evidence"], "may_change": []},
+  "semantic_owner": "project evidence",
+  "canonical_state": ["none; evidence projection only"],
+  "state_transitions": ["mobile overflow observed -> responsive fix -> authenticated mobile acceptance passed"],
+  "side_effects_and_privileges": ["read-only production checks and browser smoke"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["missing evidence remains an explicit gap"],
+  "assumptions": ["deep authenticated mutation/delegation/long-running acceptance and external model qualification remain deferred by explicit scope"],
+  "acceptance_scenarios": ["390x844 authenticated chat has no horizontal overflow", "session remains active", "production revision matches merged main", "remaining gaps remain explicit"],
+  "required_tests": ["go test ./tests/research_runtime", "go vet ./tests/research_runtime", "preflight", "check-diff", "check-architecture", "independent", "JSON parse", "git diff --check", "CI", "production health smoke", "authenticated mobile smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000292-development-mode-runtime-access.json

@@ -0,0 +1,51 @@
+{
+  "task_id": "DEV-000292",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "HEAD",
+  "risk_tier": "E",
+  "intent": "Provide an explicitly isolated development/test runtime profile for Domovoy so local model, speech, image, OCR, Docker and diagnostic paths are usable without changing production behavior.",
+  "requirement_ids": ["isolated development runtime", "local multimodal model access", "development diagnostics"],
+  "allowed_change_scope": {
+    "modules": ["interaction", "core-runtime", "cognitive-worker", "creator-web", "deployment", "development-governance"],
+    "paths": [
+      "cmd/cognitive-worker/**",
+      "cmd/core-runtime/**",
+      "cmd/creator-web/**",
+      "cmd/research-runtime/**",
+      "adapters/models/**",
+      "adapters/research/**",
+      "contracts/cognitive/**",
+      "modules/interaction/domain/**",
+      "deploy/docker-compose.dev.yml",
+      "dev/ACTIVE_TASK.json",
+      "dev/tasks/DEV-000292-development-mode-runtime-access.json",
+      "docs/evidence/**",
+      "docs/PROJECT_STATUS.md"
+    ]
+  },
+  "forbidden_change_scope": {
+    "paths": ["architecture/**", "security/**", "database/**", "deploy/docker-compose.prod.yml", "LLM-local/**"]
+  },
+  "allowed_architecture_delta": {
+    "new_cross_module_dependencies": 0,
+    "new_canonical_owners": 0,
+    "new_privileges": 1,
+    "new_third_party_dependencies": 0,
+    "new_database_owner_roles": 0
+  },
+  "contracts": {
+    "consume": ["existing cognitive gateway", "existing local model HTTP APIs", "existing dev compose network"],
+    "may_change": ["dev-only modality and diagnostic wiring; no production contract change"]
+  },
+  "semantic_owner": "development-governance owns the isolated dev profile; cognitive-worker owns model capability routing",
+  "canonical_state": ["existing dev databases and Docker volumes only"],
+  "state_transitions": ["production-only restriction -> explicit dev-only capability switch"],
+  "side_effects_and_privileges": ["dev network and Docker diagnostics only", "no production credentials", "no secret logging", "no production external mutation"],
+  "persistence_and_migrations": ["dev volumes only; no production migration"],
+  "failure_retry_restart": ["dev services remain independently restartable", "unsupported modality stays explicitly unavailable"],
+  "assumptions": ["the developer starts the profile separately from production", "test credentials are disposable and never reused in production"],
+  "acceptance_scenarios": ["dev profile starts independently", "text, speech, image and OCR routes are discoverable or report a precise unavailable state", "diagnostic endpoints are reachable inside the dev network", "meaningful chat requests prefer cognitive interpretation over token reflexes", "stable reflexes are sampled periodically for cognitive drift and a disagreement is observable as a cognitive candidate", "production compose remains unchanged", "no secret value appears in source or logs"],
+  "required_tests": ["go test ./...", "go vet ./...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl independent", "docker compose -f deploy/docker-compose.dev.yml config", "git diff --check", "dev runtime health smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_CONFLICT", "BLOCKED_BY_MISSING_CAPABILITY"]
+}

docs/MODEL_FLEET_POLICY.md

@@ -5,6 +5,31 @@ Hardware and endpoint identity are operational observations only. A model is
 eligible for routing only after the existing qualification and activation
 gates pass.
 
+## Current operating scope: LOCAL_FIRST_V1
+
+For the current development phase, one local CPU model is sufficient and is the
+authoritative working route. The local Lifeboat is the recovery fallback. GPU
+and other external providers are optional extensions, not prerequisites for the
+core Domovoy experience.
+
+External-model capability must remain supported, but external availability must
+never block the Domovoy runtime. When an external model is absent, slow, or
+temporarily unavailable, work continues through the local model, local
+Lifeboat, durable reflexes, registered skills, and local executors. The result
+may be slower or narrower, but the task is not abandoned merely because a more
+capable provider is unavailable.
+
+The first-stage conversational candidate is one locally available Qwen3-8B
+(the user's shorthand “Qwen3.8” is normalized here to Qwen3-8B) or Gemma-4.
+The runtime chooses whichever approved candidate is actually present locally;
+this policy does not claim that either candidate is installed unless live runtime
+evidence confirms it.
+
+External model discovery, qualification, ranking, and promotion are explicitly
+deferred until a separate task requests them. Their absence or unrated state is
+not a failure of the current local-first scope, and no external probe is
+required while this scope is active.
+
 `FAST`, `MEDIUM`, and `HEAVY` are capability service classes, not hardware
 claims. A CPU model may be the best available quality model, and a GPU model
 may be unavailable, degraded, or unrated.
@@ -18,7 +43,7 @@ The Capability owner derives a provider-neutral `ModelRating` from evidence:
 
 The score combines quality, reliability, latency and evidence coverage. Missing
 measurements remain explicit. A model can change category after a new immutable
-qualification/performance revision. The current CPU route is an operational
-choice, not a permanent hardware assumption. CPU is preferred in the current
-deployment; if it is unavailable, the policy tries another ready class before
-using the Lifeboat recovery path.
+qualification/performance revision. The current CPU route is the operational
+choice for this phase. If it is unavailable, the policy uses the local Lifeboat
+recovery path. Additional providers may be added later without changing the
+local-first contract.

docs/PROJECT_STATUS.md

@@ -1,31 +1,37 @@
 # Assistant project status
 
-## Current audit delta — 2026-08-23
+## Current audit delta — 2026-08-24
 
-- `LAST_COMPLETED = DEV-000222`; independent task verification now supports exact text and structured top-level JSON-field checks, and unresolved outcomes can produce two bounded additional case candidates after the general evaluation stage. The task packet is merged to `main` and deployed; quality remains unclaimed unless verifier evidence is present.
+- `CURRENT_MODEL_SCOPE = LOCAL_FIRST_V1`; one locally available Qwen3-8B or Gemma-4 conversational model is sufficient for the first stage, with the local Lifeboat as recovery fallback. External models remain supported as optional capability, but their absence must not block work: reflexes, skills and local executors provide degraded continuation. External/GPU qualification and promotion are intentionally deferred by DEV-000270.
+- `TRUTH_FIRST_DEFAULT = LIVE`; an unverified factual question is no longer passed to the advisory model as an answer. The response is explicitly marked `verification_required`; internal canonical status paths remain available. Semantic interpretation may select the provider-neutral `WEB_RESEARCH` capability without entity-specific keyword lists. Evidence: `docs/evidence/truth-first-question-gate-2026-08-24-v1.json`.
 
-- `CURRENT_PRODUCTION_STATUS = LIVE_HEALTHY`; public `/healthz` is healthy. The exact deployed revision is authoritative in the deployment log and merge record, not duplicated in this mutable status projection. Evidence: `docs/evidence/audit-runtime-status-2026-08-23-v1.json`.
+- `LAST_COMPLETED = DEV-000290`; the governed self-development path, provider-neutral reachability rating, bounded authenticated operations smoke, truth-first research routing, relevance filtering and authenticated desktop/mobile chat acceptance are live. Deep mutation, delegation and long-running acceptance remain deferred.
+
+- `CURRENT_PRODUCTION_STATUS = LIVE_HEALTHY`; public `/healthz` is healthy and current runtime project labels match merged `8c6f23dc491150a747bcc46c26ff04d217d37eba`. Evidence: `docs/evidence/audit-completion-matrix-2026-08-24-v17.json`.
 - `FAST_PROVIDER_STATUS = LIVE_SMOKE_SUPPORTED`: local CPU gateway authentication is configured through a protected file reference; four bounded local-only advisory cases completed through cognitive-worker. Evidence: `docs/evidence/wp-601-fast-gateway-live-smoke-2026-08-22-v1.json`.
 - `MEDIUM_PROVIDER_STATUS = LIVE_BOUNDED_SMOKE_SUPPORTED_UNPROMOTED`; four bounded local-provider cases passed with template thinking disabled. This is availability/response-shape evidence only; lifecycle qualification, activation and promotion remain unclaimed. Evidence: `docs/evidence/medium-live-bounded-smoke-2026-08-23-v1.json`.
 - `HEAVY_PROVIDER_STATUS = LIVE_BOUNDED_INVOCATION_SUPPORTED_UNPROMOTED`; the exact Domovoy adapter payload produced one bounded Qwen completion in 0.583s. Quality is not assessed, lifecycle promotion is not performed, and GPU availability is not treated as intelligence or routing priority. Evidence: `docs/evidence/gpu-discovery-2026-08-23-v1.json`, `docs/evidence/gpu-invocation-qualification-2026-08-23-v1.json`.
-- `AGENT_EXECUTION_STATUS = DURABLE_DRY_RUN_CANARY_VERIFIED`; the explicit production canary persisted a dispatch intent, an ACTIVE lease and callback head sequence 2. No independently operated bridge endpoint is configured, so bridge-backed execution remains unavailable. Evidence: `docs/evidence/agent-execution-dry-run-canary-2026-08-23-v1.json`.
-- `FLEET_EXECUTION_EVIDENCE = docs/evidence/audit-runtime-status-2026-08-23-v1.json`; FAST, MEDIUM and LIFEBOAT are ready, HEAVY is explicitly degraded by provider timeout, FAST remains preferred/selected, and LIFEBOAT is the fallback tier.
+- `EXTERNAL_MODEL_STATUS = DEFERRED_BY_SCOPE`; previous bounded GPU timeout evidence remains historical diagnostic evidence, but no external model is part of the current operating route and no further external probes are planned in this phase.
+- `AGENT_EXECUTION_STATUS = LIVE_TYPED_GENERIC_LOCAL_BRIDGE`; production worker and bridge are ready for task-evaluation and generic cognitive work. Generic output is recorded as an unverified Work Graph candidate and still requires independent synthesis before graph success. Evidence: `docs/evidence/audit-completion-matrix-2026-08-24-v12.json`.
+- `ADDITIONAL_EVALUATION_STATUS = LIVE_TYPED_HANDOFF`; Capability-owned unresolved evaluation decisions can now be handed to Work through a typed production endpoint. Work preserves parent evidence lineage and schedules the bounded additional profile through the existing durable graph/dispatch path; model/provider selection remains outside Work. Evidence: `docs/evidence/additional-evaluation-runtime-live-2026-08-23-v1.json` and DEV-000261.
+- `FLEET_EXECUTION_EVIDENCE = docs/evidence/audit-completion-matrix-2026-08-24-v13.json`; current live readiness has MEDIUM and LIFEBOAT ready, FAST and HEAVY unavailable by timeout, MEDIUM selected and LIFEBOAT fallback.
 - `TRUTH_RESEARCH_STATUS = LIVE_CANARY_PERSISTED`; the web research canary preserved an OBSERVED/COMPLETE/NO-CONFLICT source chain while leaving the claim UNVERIFIED and belief PROVISIONAL. Evidence: `docs/evidence/truth-runtime-canary-2026-08-23-v1.json`.
+- `TRUTH_FIRST_CHAT_STATUS = LIVE_SOURCE_ROUTING_WITH_RELEVANCE_GATE`; factual questions require strict semantic routing to optional `WEB_RESEARCH`; irrelevant search excerpts are rejected and the authenticated weather smoke returned an explicit no-confirmation response rather than invented data. Evidence: `docs/evidence/audit-completion-matrix-2026-08-24-v15.json`.
 - `LEARNING_REFLECTION_STATUS = LIVE_RECONCILED`; reflection worker returned no pending candidate and the durable state contains 31 RESOLVED candidates with no OPEN backlog. Evidence: `docs/evidence/reflection-runtime-reconciliation-2026-08-23-v1.json`.
 - `BACKUP_RESTORE_STATUS = VERIFIED`; latest checksum and isolated restore evidence is retained in `docs/evidence/wp-002-postgres-restore-2026-08-22-v1.json`.
-- `GOVERNED_SELF_DEVELOPMENT_STATUS = DURABLE_GATE_PERSISTED`; Work-owned revisioned gate storage and optimistic-concurrency persistence are live. No bridge-backed source mutation, promotion or rollback is claimed. Evidence: `docs/evidence/governed-development-gate-persistence-2026-08-23-v1.json`.
+- `GOVERNED_SELF_DEVELOPMENT_STATUS = DURABLE_GATE_VERIFIER_AND_TRANSITIONS_LIVE`; Work-owned revisioned gate storage, independent local verification, and authenticated optimistic-concurrency transitions for canary/promotion/rollback are live. Source mutation and external bridge execution remain unclaimed. Evidence: `docs/evidence/governed-development-gate-persistence-2026-08-23-v1.json` and DEV-000254 CI/live-smoke records.
 - `UI_AUTHENTICATED_ACCEPTANCE = AUTHENTICATED_QUICK_SMOKE_PASS`; browser-driven smoke completed in the active production session: chat response received, admin login accepted, diagnostics 7/7 passed, operations fleet 4/4 READY, and action history loaded. Deep mutation, delegation-specific and long-running acceptance remain intentionally deferred.
-- `CURRENT_UI_SESSION_STATUS = NO_CURRENT_AUTHENTICATED_SESSION`; the historical quick-smoke evidence above is retained, but the current acceptance run has no signed-in browser session, so no new authenticated visual result is claimed. Public cabinet shell and unauthenticated protection were checked separately.
-- `AGENT_WORKER_STATUS_CORRECTION = LIVE_TRUTHFUL_LOCAL_EXECUTOR`; absence of the protected bridge is reported as `executor_configured=false`, `mode=local-executor`, `ready=false`, with `task-evaluation` as the only advertised local capability; unsupported work remains durably waiting and is not represented as external agent execution. Evidence: `docs/evidence/audit-runtime-status-2026-08-23-v2.json` (pre-DEV-000227 field shape remains historical).
-- `FLEET_READINESS_LIVE = MEDIUM_SELECTED_BY_AVAILABILITY`; the live cognitive worker observed FAST unavailable, MEDIUM available, HEAVY available and LIFEBOAT available; it selected MEDIUM while the configured preference remained FAST. This is routing evidence only, not a quality or promotion claim. Evidence: `docs/evidence/fleet-readiness-live-2026-08-23-v2.json`.
-- `UI_AUTHENTICATED_ACCEPTANCE = CURRENT_LIVE_PASS`; current signed-in browser evidence covers root chat session, admin diagnostics 7/7, operations fleet 4/4 READY with FAST selected, truthful local-executor agent status, action history and learning/reflection sections; the 390x844 console layout remained readable without horizontal overflow. Evidence: `docs/evidence/authenticated-ui-acceptance-2026-08-23-v2.json`.
+- `CURRENT_UI_SESSION_STATUS = AUTHENTICATED_DESKTOP_MOBILE_PASS`; the current signed-in session showed active state and no horizontal overflow at `390×844` after the chat layout/header fixes. Deep mutation/delegation/long-running acceptance remains deferred.
+- `AGENT_EXECUTION_BRIDGE_STATUS = LIVE_LOCAL_TYPED_BRIDGE`; the independent local bridge reports `healthz=200` with `task-evaluation` and `generic-cognitive-work`; `agent-worker` reports `mode=execution`, `executor_configured=true`, `ready=true`. Evidence: `docs/evidence/audit-completion-matrix-2026-08-24-v13.json`.
+- `FLEET_READINESS_LIVE = MEDIUM_SELECTED_BY_AVAILABILITY`; the latest live readiness endpoint observed FAST unavailable, MEDIUM available, HEAVY unavailable by timeout and LIFEBOAT available; it selected MEDIUM while the configured preference remained FAST. This is routing evidence only, not a quality or promotion claim. Evidence: `docs/evidence/audit-completion-matrix-2026-08-24-v13.json`.
+- `UI_AUTHENTICATED_ACCEPTANCE = DEEP_DESKTOP_PASS_WITH_MOBILE_GAP`; deep signed-in browser evidence covers chat reply, diagnostics 7/7 after refresh, fleet/agent/action-history refresh, 3/4 fleet readiness with FAST selected, truthful local executor state and learning/reflection refresh. Static responsive regression guard passed in CI; mobile viewport acceptance is not claimed. Evidence: `docs/evidence/deep-authenticated-acceptance-2026-08-23-v1.json`.
 
 ## Current governance checkpoint
 
-- `COMPLETION_MATRIX = docs/evidence/audit-completion-matrix-2026-08-23-v3.json`; all seven objective areas are mapped to current repository/production proof, with external bridge, GPU promotion/quality and deep-acceptance gaps explicit.
+- `COMPLETION_MATRIX = docs/evidence/audit-completion-matrix-2026-08-24-v17.json`; generic candidate envelope verification, independent Work Graph synthesis, research relevance gating and authenticated desktop/mobile truth-first chat acceptance are live; external qualification and deep mutation/delegation/long-running acceptance remain explicit.
 
-- `ACTIVE_TASK = dev/tasks/DEV-000235-model-qualification-probe.json revision 1`; cognitive-worker now exposes a bounded provider-neutral qualification probe that discovers actual model IDs, invokes them in parallel, reports reachability/latency and keeps quality `UNRATED` until independent task tests. Hardware presence does not grant promotion or priority.
+- `ACTIVE_TASK = dev/tasks/DEV-000291-mobile-acceptance-evidence.json revision 1`; this evidence reconciliation does not change runtime behavior or model routing.
 - `LINEAGE_DECISION = docs/GOVERNANCE_LINEAGE_DECISION_2026-08-22.md`; historical packets remain provenance and are not current authority.
 - `REGISTRY_STATUS = YAML and JSON semantic mirrors agree`
 - `PRODUCTION_DOMAIN = docker.cin.su`; shared docker-test is not used for this project.
-- `NEXT_WORK = use qualification evidence in the provider-neutral Capability rating/selection loop, then continue authenticated UI acceptance, reflection recovery and governed self-development gaps.`
+- `NEXT_WORK = obtain a viewport-capable browser for real mobile authenticated visual acceptance; add external providers later under an explicit task. Deep UI/load tests remain deferred until explicitly requested.`

docs/evidence/additional-evaluation-runtime-live-2026-08-23-v1.json

@@ -0,0 +1,13 @@
+{
+  "evidence_id": "additional-evaluation-runtime-live-2026-08-23-v1",
+  "captured_at": "2026-08-23T20:00:00Z",
+  "production_main_revision": "b789878",
+  "runtime": "work-graph-runtime",
+  "health": {"healthz": "OK", "readyz": "READY", "work_postgres": "AVAILABLE"},
+  "route": {"path": "/v1/work-graphs/task-evaluations/additional/schedule", "empty_payload_status": 422, "typed_validation": "PASS"},
+  "behavior": "Capability-owned additional profile/cases are handed to Work, which preserves parent evidence lineage and uses existing durable graph admission and dispatch queue paths.",
+  "provider_selection": "not performed by Work; Capability remains the decision owner",
+  "mutations_performed": false,
+  "secrets_exposed": false,
+  "limitations": ["No live additional graph mutation was created; production route was validated with a rejected empty payload", "independent external Agent Execution bridge, GPU quality promotion and mobile visual acceptance remain open gaps"]
+}

docs/evidence/agent-execution-bridge-live-2026-08-24-v1.json

@@ -0,0 +1,12 @@
+{
+  "evidence_id": "agent-execution-bridge-live-2026-08-24-v1",
+  "captured_at": "2026-08-23T21:34:06Z",
+  "production_revision": "7a004e5",
+  "runtime": "agent-execution-bridge",
+  "bridge": {"healthz": "200 OK", "capabilities": ["task-evaluation"], "service": "assistant-agent-execution-bridge-1"},
+  "agent_worker": {"readyz": "200 OK", "mode": "execution", "executor_configured": true, "local_fallback": false, "last_result": "idle"},
+  "public_health": "OK",
+  "semantics": "The independent local bridge executes only the bounded task-evaluation capability through cognitive-worker, task-verifier and work-graph callback. Unsupported generic work returns WAITING and is never reported as completed.",
+  "secrets_exposed": false,
+  "limitations": ["Universal generic/Codex execution remains unavailable until a separately qualified capability is installed", "GPU quality qualification and promotion remain incomplete", "real mobile authenticated visual acceptance remains unavailable in the current browser surface"]
+}

docs/evidence/agent-worker-capability-readiness-2026-08-24-v1.json

@@ -0,0 +1,13 @@
+{
+  "evidence_id": "agent-worker-capability-readiness-2026-08-24-v1",
+  "captured_at": "2026-08-23T21:12:39Z",
+  "production_revision": "102a57a",
+  "runtime": "agent-worker",
+  "status": {"mode": "local-executor", "ready": true, "executor_configured": false, "local_executor": true, "local_fallback": true, "capabilities": ["task-evaluation"], "last_result": "idle", "total_recovered_claims": 0},
+  "readyz": "READY",
+  "semantics": "Ready means an advertised local capability can accept work; it does not claim that unsupported generic agent operations are executable.",
+  "external_bridge": "not configured and not fabricated",
+  "public_health": "OK",
+  "secrets_exposed": false,
+  "limitations": ["Generic Agent Execution/Codex bridge remains unavailable; unsupported work remains durable waiting"]
+}