merge: authenticated acceptance harness remediation

# Conflicts:
#	deploy/docker-compose.prod.yml
#	dev/ACTIVE_TASK.json
#	docs/CREDENTIALS_AND_SECRETS.md

AGENTS.md

@@ -72,3 +72,16 @@ State:
 - assumptions;
 - findings not changed;
 - gaps or limitations.
+
+## Domovoy Gen2 execution governance
+
+When the active task is a Gen2 packet, read the canonical documents before editing:
+
+- `docs/DOMOVOY_CONSTITUTION.md`
+- `architecture/GEN2_TARGET_ARCHITECTURE.md`
+- `architecture/GEN2_CANONICAL_DATA_MODEL.md`
+- `development/GEN2_MIGRATION_MAP.md`
+- `development/GEN2_MASTER_PLAN.md`
+- `development/GEN2_EXECUTION_CONTRACT.md`
+
+The active task packet and `development/GEN2_TASK_INDEX.md` define execution order. `PRE-GEN2-000` freezes the V1 baseline; `ARCH-GEN2-000` accepts Gen2 governance; later `GEN2-*` packets must not be started automatically. Gen2 architecture and ownership changes are permitted only within the active packet's declared scope and authority. Default validation is FAST; MILESTONE or FULL is required only when the selected packet explicitly says so.

adapters/models/openai_compatible_local.go

@@ -25,6 +25,15 @@ type OpenAICompatibleLocalAdapter struct {
 	apiKey string
 }
 
+// compatibleDefaultContextBytes is a conservative bound used when an
+// OpenAI-compatible local endpoint omits n_ctx from /v1/models. The adapter
+// is a chat-completions adapter, so advisory capability is known from the
+// adapter contract; quality and activation still require governed
+// qualification/evaluation in the capability registry.
+const compatibleDefaultContextBytes int64 = 32 << 10
+
+const compatibleAdvisoryMaxTokens = 32
+
 func NewOpenAICompatibleLocalAdapter(raw string, transport http.RoundTripper) (*OpenAICompatibleLocalAdapter, error) {
 	return NewOpenAICompatibleLocalAdapterWithAPIKey(raw, "", transport)
 }
@@ -58,6 +67,9 @@ type compatibleModelsResponse struct {
 		ID      string `json:"id"`
 		Created int64  `json:"created"`
 		OwnedBy string `json:"owned_by"`
+		ModelKind string `json:"model_kind"`
+		Capabilities map[string]bool `json:"capabilities"`
+		Modalities map[string]bool `json:"modalities"`
 		Meta    struct {
 			Context         int64  `json:"n_ctx"`
 			TrainingContext int64  `json:"n_ctx_train"`
@@ -87,14 +99,36 @@ func (a *OpenAICompatibleLocalAdapter) Discover(ctx context.Context) ([]Discover
 		if item.ID == "" {
 			continue
 		}
+		// The gateway catalogue may contain image/audio runtimes beside local
+		// chat models. Discovery is not allowed to qualify those as text
+		// advisory models merely because they appear in /v1/models.
+		if !isTextAdvisoryModel(item.ModelKind, item.Capabilities, item.Modalities) {
+			continue
+		}
 		stableMetadata := fmt.Sprintf("%s\x00%s\x00%d\x00%d\x00%d\x00%d\x00%s", item.ID, item.OwnedBy, item.Meta.Context, item.Meta.TrainingContext, item.Meta.Parameters, item.Meta.Size, item.Meta.FileType)
 		digest := sha256.Sum256([]byte(stableMetadata))
 		contextBytes := item.Meta.Context * 4
-		models = append(models, DiscoveredModel{ProviderModelID: capability.ProviderModelID(item.ID), Fingerprint: capability.ModelFingerprint(hex.EncodeToString(digest[:])), MaxContextBytes: contextBytes, Modalities: []capability.ModelModality{capability.ModalityText}, Capabilities: []capability.ModelCapability{capability.CapabilityUnknown}, SizeBytes: item.Meta.Size, Runtime: item.OwnedBy, Quantization: item.Meta.FileType})
+		if contextBytes <= 0 {
+			contextBytes = compatibleDefaultContextBytes
+		}
+		models = append(models, DiscoveredModel{ProviderModelID: capability.ProviderModelID(item.ID), Fingerprint: capability.ModelFingerprint(hex.EncodeToString(digest[:])), MaxContextBytes: contextBytes, Modalities: []capability.ModelModality{capability.ModalityText}, Capabilities: []capability.ModelCapability{capability.CapabilityAdvisory}, SizeBytes: item.Meta.Size, Runtime: item.OwnedBy, Quantization: item.Meta.FileType})
 	}
 	return models, ProviderProbe{Health: capability.HealthAvailable}
 }
 
+func isTextAdvisoryModel(kind string, capabilities, modalities map[string]bool) bool {
+	if strings.EqualFold(strings.TrimSpace(kind), "image-generation") || strings.EqualFold(strings.TrimSpace(kind), "audio-transcription") || strings.EqualFold(strings.TrimSpace(kind), "text-to-speech") {
+		return false
+	}
+	if chat, known := capabilities["chat"]; known && !chat {
+		return false
+	}
+	if text, known := modalities["text"]; known && !text {
+		return false
+	}
+	return true
+}
+
 type compatibleChatRequest struct {
 	Model              string                   `json:"model"`
 	Messages           []compatibleMessage      `json:"messages"`
@@ -122,10 +156,14 @@ type compatibleChatResponse struct {
 }
 
 func (a *OpenAICompatibleLocalAdapter) Advise(ctx context.Context, request cognitive.AdvisoryRequest) (cognitive.AdvisoryResponse, error) {
-	if err := ValidateAdvisoryRequest(request); err != nil || request.ProviderModelID == "" || len(request.Context) != 0 {
+	if err := ValidateAdvisoryRequest(request); err != nil || request.ProviderModelID == "" {
 		return cognitive.AdvisoryResponse{}, ErrInvalidAdvisory
 	}
-	payload := compatibleChatRequest{Model: string(request.ProviderModelID), Messages: []compatibleMessage{{Role: "system", Content: "Provide non-canonical advisory text only. Never claim that an action occurred."}, {Role: "user", Content: request.Message}}, Temperature: 0, Stream: false, MaxTokens: request.MaxOutputBytes / 4, ChatTemplateKwargs: compatibleTemplateKwargs{EnableThinking: false}}
+	maxTokens := request.MaxOutputBytes / 4
+	if maxTokens <= 0 || maxTokens > compatibleAdvisoryMaxTokens {
+		maxTokens = compatibleAdvisoryMaxTokens
+	}
+	payload := compatibleChatRequest{Model: string(request.ProviderModelID), Messages: []compatibleMessage{{Role: "system", Content: "Ты отвечаешь от имени Домового — локального помощника пользователя. Не называй себя именем модели, поставщиком или внутренним runtime. Если спрашивают имя, ответь: «Меня зовут Домовой». Понимай смысл сообщения и помогай довести цель до полезного результата. По умолчанию отвечай кратко, примерно одним-тремя предложениями; подробности давай только по просьбе. Отвечай только некатегоричным текстом совета; не утверждай, что внешнее действие уже выполнено."}, {Role: "user", Content: localAdvisoryMessage(request)}}, Temperature: 0, Stream: false, MaxTokens: maxTokens, ChatTemplateKwargs: compatibleTemplateKwargs{EnableThinking: false}}
 	var result compatibleChatResponse
 	status, err := a.requestJSON(ctx, http.MethodPost, "/chat/completions", payload, &result)
 	if err != nil {
@@ -151,6 +189,19 @@ func (a *OpenAICompatibleLocalAdapter) Advise(ctx context.Context, request cogni
 	return response, nil
 }
 
+func localAdvisoryMessage(request cognitive.AdvisoryRequest) string {
+	if len(request.Context) == 0 {
+		return request.Message
+	}
+	var builder strings.Builder
+	builder.WriteString(request.Message)
+	builder.WriteString("\n\nRelevant local context:\n")
+	for _, excerpt := range request.Context {
+		fmt.Fprintf(&builder, "- [%s/%s] %s\n", excerpt.SourceKind, excerpt.SourceID, excerpt.Text)
+	}
+	return builder.String()
+}
+
 func (a *OpenAICompatibleLocalAdapter) requestJSON(ctx context.Context, method, path string, input, output any) (int, error) {
 	var body io.Reader
 	if input != nil {
@@ -213,6 +264,8 @@ func mapCompatibleStatus(status int) cognitive.FinishReason {
 		return cognitive.FinishContextTooLarge
 	case 429:
 		return cognitive.FinishRateLimited
+	case 400, 422:
+		return cognitive.FinishInvalidProviderResponse
 	default:
 		return cognitive.FinishProviderUnavailable
 	}

adapters/models/openai_compatible_local_test.go

@@ -18,6 +18,65 @@ type captureRoundTripper struct {
 	body          []byte
 }
 
+type modelsMetadataRoundTripper struct{}
+
+func (modelsMetadataRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) {
+	return &http.Response{
+		StatusCode: http.StatusOK,
+		Body:       io.NopCloser(strings.NewReader(`{"data":[{"id":"medium-model","owned_by":"llama.cpp","meta":{}}]}`)),
+		Header:     make(http.Header),
+		Request:    request,
+	}, nil
+}
+
+type mixedModelsRoundTripper struct{}
+
+func (mixedModelsRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) {
+	return &http.Response{
+		StatusCode: http.StatusOK,
+		Body: io.NopCloser(strings.NewReader(`{"data":[{"id":"image-model","model_kind":"image-generation","capabilities":{"chat":false,"image_generation":true},"modalities":{"text":false,"image_generation":true}},{"id":"text-model","model_kind":"chat","capabilities":{"chat":true},"modalities":{"text":true},"meta":{}}]}`)),
+		Header: make(http.Header),
+		Request: request,
+	}, nil
+}
+
+func TestOpenAICompatibleLocalAdapterDoesNotQualifyNonTextModels(t *testing.T) {
+	adapter, err := NewOpenAICompatibleLocalAdapter("http://gateway/v1", mixedModelsRoundTripper{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	models, probe := adapter.Discover(context.Background())
+	if probe.Health != capability.HealthAvailable || len(models) != 1 || models[0].ProviderModelID != "text-model" {
+		t.Fatalf("unexpected filtered discovery: probe=%+v models=%+v", probe, models)
+	}
+}
+
+func TestOpenAICompatibleLocalAdapterMapsImmediateBadRequest(t *testing.T) {
+	if got := mapCompatibleStatus(http.StatusBadRequest); got != cognitive.FinishInvalidProviderResponse {
+		t.Fatalf("400 finish=%s, want %s", got, cognitive.FinishInvalidProviderResponse)
+	}
+	if got := mapCompatibleStatus(http.StatusUnprocessableEntity); got != cognitive.FinishInvalidProviderResponse {
+		t.Fatalf("422 finish=%s, want %s", got, cognitive.FinishInvalidProviderResponse)
+	}
+}
+
+func TestOpenAICompatibleLocalAdapterNormalizesMinimalModelMetadata(t *testing.T) {
+	adapter, err := NewOpenAICompatibleLocalAdapter("http://gateway/v1", modelsMetadataRoundTripper{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	models, probe := adapter.Discover(context.Background())
+	if probe.Health != capability.HealthAvailable || len(models) != 1 {
+		t.Fatalf("unexpected discovery result: probe=%+v models=%+v", probe, models)
+	}
+	if models[0].MaxContextBytes != compatibleDefaultContextBytes {
+		t.Fatalf("context bound=%d, want %d", models[0].MaxContextBytes, compatibleDefaultContextBytes)
+	}
+	if len(models[0].Capabilities) != 1 || models[0].Capabilities[0] != capability.CapabilityAdvisory {
+		t.Fatalf("capabilities=%v, want advisory", models[0].Capabilities)
+	}
+}
+
 func TestOpenAICompatibleLocalAdapterUsesConfiguredTimeout(t *testing.T) {
 	adapter, err := NewOpenAICompatibleLocalAdapterWithAPIKeyAndTimeout("http://gateway/v1", "", &captureRoundTripper{}, 47*time.Second)
 	if err != nil {
@@ -81,6 +140,7 @@ func TestOpenAICompatibleLocalAdapterDisablesTemplateThinkingForBoundedAdvisory(
 		t.Fatal(err)
 	}
 	var payload struct {
+		MaxTokens int `json:"max_tokens"`
 		ChatTemplateKwargs struct {
 			EnableThinking bool `json:"enable_thinking"`
 		} `json:"chat_template_kwargs"`
@@ -88,7 +148,39 @@ func TestOpenAICompatibleLocalAdapterDisablesTemplateThinkingForBoundedAdvisory(
 	if err := json.Unmarshal(transport.body, &payload); err != nil {
 		t.Fatal(err)
 	}
+	if payload.MaxTokens != compatibleAdvisoryMaxTokens {
+		t.Fatalf("max_tokens=%d, want bounded %d", payload.MaxTokens, compatibleAdvisoryMaxTokens)
+	}
 	if payload.ChatTemplateKwargs.EnableThinking {
 		t.Fatal("expected bounded advisory to disable template thinking")
 	}
 }
+
+func TestOpenAICompatibleLocalAdapterPassesLocalContextToAdvisory(t *testing.T) {
+	transport := &captureRoundTripper{}
+	adapter, err := NewOpenAICompatibleLocalAdapter("http://gateway/v1", transport)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = adapter.Advise(context.Background(), cognitive.AdvisoryRequest{
+		Version: cognitive.CreatorAdvisoryV1, RequestID: "request-context", ActorID: "actor", PrincipalID: "principal", ScopeID: "scope",
+		Message: "Продолжи разговор", Locale: "ru-RU", MaxOutputBytes: 256, ProviderBindingID: "binding-1", ProviderBindingRevision: 1,
+		ProviderInstanceID: "provider-1", ModelDescriptorID: "model-1", ProviderModelID: capability.ProviderModelID("local-model"),
+		Context: []cognitive.ContextExcerpt{{ID: "focus", SourceKind: "situation", SourceID: "focus-1", Revision: 1, Sensitivity: cognitive.SensitivityPrivateAllowed, Text: "Активный проект: Домовой"}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var payload struct {
+		Messages []struct {
+			Role    string `json:"role"`
+			Content string `json:"content"`
+		} `json:"messages"`
+	}
+	if err := json.Unmarshal(transport.body, &payload); err != nil {
+		t.Fatal(err)
+	}
+	if len(payload.Messages) != 2 || !strings.Contains(payload.Messages[1].Content, "Активный проект: Домовой") {
+		t.Fatalf("local context was not passed to advisory: %+v", payload.Messages)
+	}
+}

adapters/multimodal/client.go

@@ -0,0 +1,509 @@
+package multimodal
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"mime/multipart"
+	"net/http"
+	"net/textproto"
+	"net/url"
+	"strings"
+	"time"
+)
+
+var ErrEmptyResult = errors.New("multimodal provider returned an empty result")
+
+type SpeechClient struct {
+	BaseURL string
+	Client  *http.Client
+}
+
+type VisionClient struct {
+	BaseURL string
+	Client  *http.Client
+}
+
+type ImageGenerationClient struct {
+	BaseURL string
+	Client  *http.Client
+}
+
+type VideoUnderstandingClient struct {
+	BaseURL string
+	Client  *http.Client
+}
+
+type GeneratedImage struct {
+	DataBase64  string
+	SourceURL   string
+	ContentType string
+}
+
+type ImageGenerator interface {
+	Generate(ctx context.Context, model, prompt, size string) (GeneratedImage, error)
+}
+
+// ComfyImageGenerationClient is the replaceable transport for a ComfyUI
+// image-generation skill. The workflow is deliberately kept in this adapter:
+// the core only selects a capability and supplies the user's prompt.
+type ComfyImageGenerationClient struct {
+	BaseURL      string
+	Client       *http.Client
+	PollInterval time.Duration
+	PollTimeout  time.Duration
+}
+
+func (c SpeechClient) Transcribe(ctx context.Context, filename, contentType string, data []byte) (string, error) {
+	if len(data) == 0 {
+		return "", errors.New("audio payload is empty")
+	}
+	body := &bytes.Buffer{}
+	writer := multipart.NewWriter(body)
+	header := make(textproto.MIMEHeader)
+	header.Set("Content-Disposition", fmt.Sprintf(`form-data; name="file"; filename="%s"`, strings.ReplaceAll(filename, `"`, "")))
+	header.Set("Content-Type", contentType)
+	part, err := writer.CreatePart(header)
+	if err != nil {
+		return "", err
+	}
+	if _, err := part.Write(data); err != nil {
+		return "", err
+	}
+	if err := writer.WriteField("response_format", "json"); err != nil {
+		return "", err
+	}
+	if err := writer.Close(); err != nil {
+		return "", err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, strings.TrimRight(c.BaseURL, "/")+"/inference", body)
+	if err != nil {
+		return "", err
+	}
+	request.Header.Set("Content-Type", writer.FormDataContentType())
+	response, err := c.client().Do(request)
+	if err != nil {
+		return "", err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("speech provider status %d", response.StatusCode)
+	}
+	var result struct {
+		Text string `json:"text"`
+	}
+	if err := json.NewDecoder(io.LimitReader(response.Body, 1<<20)).Decode(&result); err != nil {
+		return "", err
+	}
+	if strings.TrimSpace(result.Text) == "" {
+		return "", ErrEmptyResult
+	}
+	return strings.TrimSpace(result.Text), nil
+}
+
+func (c VisionClient) Describe(ctx context.Context, model, contentType string, data []byte, instruction string) (string, error) {
+	if len(data) == 0 {
+		return "", errors.New("image payload is empty")
+	}
+	payload := struct {
+		Model    string `json:"model"`
+		Messages []struct {
+			Role    string `json:"role"`
+			Content []struct {
+				Type     string `json:"type"`
+				Text     string `json:"text,omitempty"`
+				ImageURL *struct {
+					URL string `json:"url"`
+				} `json:"image_url,omitempty"`
+			} `json:"content"`
+		} `json:"messages"`
+		MaxTokens int `json:"max_tokens"`
+	}{}
+	payload.Model = model
+	payload.MaxTokens = 1024
+	payload.Messages = append(payload.Messages, struct {
+		Role    string `json:"role"`
+		Content []struct {
+			Type     string `json:"type"`
+			Text     string `json:"text,omitempty"`
+			ImageURL *struct {
+				URL string `json:"url"`
+			} `json:"image_url,omitempty"`
+		} `json:"content"`
+	}{Role: "user", Content: []struct {
+		Type     string `json:"type"`
+		Text     string `json:"text,omitempty"`
+		ImageURL *struct {
+			URL string `json:"url"`
+		} `json:"image_url,omitempty"`
+	}{
+		{Type: "text", Text: instruction},
+		{Type: "image_url", ImageURL: &struct {
+			URL string `json:"url"`
+		}{URL: "data:" + contentType + ";base64," + encodeBase64(data)},
+		}}})
+	encoded, err := json.Marshal(payload)
+	if err != nil {
+		return "", err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, strings.TrimRight(c.BaseURL, "/")+"/chat/completions", bytes.NewReader(encoded))
+	if err != nil {
+		return "", err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	response, err := c.client().Do(request)
+	if err != nil {
+		return "", err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("vision provider status %d", response.StatusCode)
+	}
+	var result struct {
+		Choices []struct {
+			Message struct {
+				Content          string `json:"content"`
+				ReasoningContent string `json:"reasoning_content"`
+			} `json:"message"`
+		} `json:"choices"`
+	}
+	if err := json.NewDecoder(io.LimitReader(response.Body, 2<<20)).Decode(&result); err != nil {
+		return "", err
+	}
+	if len(result.Choices) == 0 {
+		return "", ErrEmptyResult
+	}
+	text := strings.TrimSpace(result.Choices[0].Message.Content)
+	if text == "" {
+		text = strings.TrimSpace(result.Choices[0].Message.ReasoningContent)
+	}
+	if text == "" {
+		return "", ErrEmptyResult
+	}
+	return text, nil
+}
+
+// Generate uses an OpenAI-compatible image-generation skill. The provider is
+// selected outside the core by the capability binding; this adapter contains
+// transport only and never decides what the user meant.
+func (c ImageGenerationClient) Generate(ctx context.Context, model, prompt, size string) (GeneratedImage, error) {
+	if strings.TrimSpace(prompt) == "" {
+		return GeneratedImage{}, errors.New("image prompt is empty")
+	}
+	payload := struct {
+		Model          string `json:"model"`
+		Prompt         string `json:"prompt"`
+		Size           string `json:"size,omitempty"`
+		ResponseFormat string `json:"response_format,omitempty"`
+	}{Model: model, Prompt: prompt, Size: size, ResponseFormat: "b64_json"}
+	encoded, err := json.Marshal(payload)
+	if err != nil {
+		return GeneratedImage{}, err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, strings.TrimRight(c.BaseURL, "/")+"/images/generations", bytes.NewReader(encoded))
+	if err != nil {
+		return GeneratedImage{}, err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	response, err := c.client().Do(request)
+	if err != nil {
+		return GeneratedImage{}, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode > 299 {
+		return GeneratedImage{}, fmt.Errorf("image provider status %d", response.StatusCode)
+	}
+	var result struct {
+		Data []struct {
+			Base64 string `json:"b64_json"`
+			URL    string `json:"url"`
+		} `json:"data"`
+	}
+	if err := json.NewDecoder(io.LimitReader(response.Body, 32<<20)).Decode(&result); err != nil {
+		return GeneratedImage{}, err
+	}
+	if len(result.Data) == 0 || (strings.TrimSpace(result.Data[0].Base64) == "" && strings.TrimSpace(result.Data[0].URL) == "") {
+		return GeneratedImage{}, ErrEmptyResult
+	}
+	return GeneratedImage{DataBase64: result.Data[0].Base64, SourceURL: result.Data[0].URL, ContentType: "image/png"}, nil
+}
+
+func (c ComfyImageGenerationClient) Generate(ctx context.Context, model, prompt, size string) (GeneratedImage, error) {
+	if strings.TrimSpace(prompt) == "" {
+		return GeneratedImage{}, errors.New("image prompt is empty")
+	}
+	width, height := imageSize(size)
+	workflow := map[string]any{
+		"3":  map[string]any{"inputs": map[string]any{"seed": time.Now().UnixNano(), "steps": 8, "cfg": 1.0, "sampler_name": "euler", "scheduler": "simple", "denoise": 1.0, "model": []any{"16", 0}, "positive": []any{"6", 0}, "negative": []any{"7", 0}, "latent_image": []any{"13", 0}}, "class_type": "KSampler"},
+		"6":  map[string]any{"inputs": map[string]any{"text": prompt, "clip": []any{"18", 0}}, "class_type": "CLIPTextEncode"},
+		"7":  map[string]any{"inputs": map[string]any{"text": "blurry, ugly, distorted", "clip": []any{"18", 0}}, "class_type": "CLIPTextEncode"},
+		"8":  map[string]any{"inputs": map[string]any{"samples": []any{"3", 0}, "vae": []any{"17", 0}}, "class_type": "VAEDecode"},
+		"9":  map[string]any{"inputs": map[string]any{"filename_prefix": "domovoy", "images": []any{"8", 0}}, "class_type": "SaveImage"},
+		"13": map[string]any{"inputs": map[string]any{"width": width, "height": height, "batch_size": 1}, "class_type": "EmptySD3LatentImage"},
+		"16": map[string]any{"inputs": map[string]any{"unet_name": "z_image_turbo_bf16.safetensors", "weight_dtype": "default"}, "class_type": "UNETLoader"},
+		"17": map[string]any{"inputs": map[string]any{"vae_name": "ae.safetensors"}, "class_type": "VAELoader"},
+		"18": map[string]any{"inputs": map[string]any{"clip_name": "qwen_3_4b.safetensors", "type": "lumina2", "device": "default"}, "class_type": "CLIPLoader"},
+	}
+	payload := map[string]any{"prompt": workflow, "client_id": fmt.Sprintf("domovoy-%d", time.Now().UnixNano())}
+	encoded, err := json.Marshal(payload)
+	if err != nil {
+		return GeneratedImage{}, err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, strings.TrimRight(c.BaseURL, "/")+"/prompt", bytes.NewReader(encoded))
+	if err != nil {
+		return GeneratedImage{}, err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	response, err := c.client().Do(request)
+	if err != nil {
+		return GeneratedImage{}, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode > 299 {
+		return GeneratedImage{}, fmt.Errorf("comfy provider status %d", response.StatusCode)
+	}
+	var accepted struct {
+		PromptID string `json:"prompt_id"`
+	}
+	if err := json.NewDecoder(io.LimitReader(response.Body, 1<<20)).Decode(&accepted); err != nil {
+		return GeneratedImage{}, err
+	}
+	if accepted.PromptID == "" {
+		return GeneratedImage{}, ErrEmptyResult
+	}
+	// A caller timeout must remove only this prompt. ComfyUI's global
+	// /interrupt endpoint can otherwise stop unrelated users' work and leave
+	// queued requests in an ambiguous state.
+	defer func() {
+		if ctx.Err() != nil {
+			cancelCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+			if err := c.cancelPrompt(cancelCtx, accepted.PromptID); err != nil {
+				// The original context error is more useful to the caller; the
+				// provider cleanup failure remains observable in the server log.
+				log.Printf("comfy prompt cleanup failed for %s: %v", accepted.PromptID, err)
+			}
+		}
+	}()
+
+	interval := c.PollInterval
+	if interval <= 0 {
+		interval = time.Second
+	}
+	timeout := c.PollTimeout
+	if timeout <= 0 {
+		timeout = 10 * time.Minute
+	}
+	deadline := time.NewTimer(timeout)
+	defer deadline.Stop()
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+	for {
+		image, done, err := c.historyImage(ctx, accepted.PromptID)
+		if err != nil {
+			return GeneratedImage{}, err
+		}
+		if done {
+			return image, nil
+		}
+		select {
+		case <-ctx.Done():
+			return GeneratedImage{}, ctx.Err()
+		case <-deadline.C:
+			return GeneratedImage{}, context.DeadlineExceeded
+		case <-ticker.C:
+		}
+	}
+}
+
+func (c ComfyImageGenerationClient) cancelPrompt(ctx context.Context, promptID string) error {
+	if strings.TrimSpace(promptID) == "" {
+		return errors.New("comfy prompt id is empty")
+	}
+	payload, err := json.Marshal(map[string][]string{"delete": {promptID}})
+	if err != nil {
+		return err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, strings.TrimRight(c.BaseURL, "/")+"/queue", bytes.NewReader(payload))
+	if err != nil {
+		return err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	response, err := c.client().Do(request)
+	if err != nil {
+		return err
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode > 299 {
+		return fmt.Errorf("comfy prompt cleanup status %d", response.StatusCode)
+	}
+	return nil
+}
+
+func (c ComfyImageGenerationClient) historyImage(ctx context.Context, promptID string) (GeneratedImage, bool, error) {
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, strings.TrimRight(c.BaseURL, "/")+"/history/"+url.PathEscape(promptID), nil)
+	if err != nil {
+		return GeneratedImage{}, false, err
+	}
+	response, err := c.client().Do(request)
+	if err != nil {
+		return GeneratedImage{}, false, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode == http.StatusNotFound {
+		return GeneratedImage{}, false, nil
+	}
+	if response.StatusCode < 200 || response.StatusCode > 299 {
+		return GeneratedImage{}, false, fmt.Errorf("comfy history status %d", response.StatusCode)
+	}
+	var history map[string]struct {
+		Outputs map[string]struct {
+			Images []struct {
+				Filename  string `json:"filename"`
+				Subfolder string `json:"subfolder"`
+				Type      string `json:"type"`
+			} `json:"images"`
+		} `json:"outputs"`
+	}
+	if err := json.NewDecoder(io.LimitReader(response.Body, 4<<20)).Decode(&history); err != nil {
+		return GeneratedImage{}, false, err
+	}
+	record, ok := history[promptID]
+	if !ok {
+		return GeneratedImage{}, false, nil
+	}
+	for _, output := range record.Outputs {
+		for _, image := range output.Images {
+			if image.Filename == "" {
+				continue
+			}
+			query := url.Values{"filename": {image.Filename}, "subfolder": {image.Subfolder}, "type": {image.Type}}
+			imageRequest, err := http.NewRequestWithContext(ctx, http.MethodGet, strings.TrimRight(c.BaseURL, "/")+"/view?"+query.Encode(), nil)
+			if err != nil {
+				return GeneratedImage{}, false, err
+			}
+			imageResponse, err := c.client().Do(imageRequest)
+			if err != nil {
+				return GeneratedImage{}, false, err
+			}
+			data, readErr := io.ReadAll(io.LimitReader(imageResponse.Body, 32<<20))
+			imageResponse.Body.Close()
+			if readErr != nil {
+				return GeneratedImage{}, false, readErr
+			}
+			if imageResponse.StatusCode < 200 || imageResponse.StatusCode > 299 || len(data) == 0 {
+				return GeneratedImage{}, false, ErrEmptyResult
+			}
+			contentType := imageResponse.Header.Get("Content-Type")
+			if contentType == "" {
+				contentType = "image/png"
+			}
+			return GeneratedImage{DataBase64: encodeBase64(data), ContentType: contentType}, true, nil
+		}
+	}
+	return GeneratedImage{}, true, ErrEmptyResult
+}
+
+func imageSize(size string) (int, int) {
+	parts := strings.Split(strings.TrimSpace(size), "x")
+	if len(parts) == 2 {
+		var width, height int
+		if _, err := fmt.Sscanf(size, "%dx%d", &width, &height); err == nil && width >= 256 && height >= 256 && width <= 2048 && height <= 2048 {
+			return width, height
+		}
+	}
+	return 512, 512
+}
+
+// Describe accepts a video skill endpoint that performs its own bounded frame
+// sampling. Frame extraction is provider-owned so the core does not acquire a
+// media-processing dependency or hide a policy in orchestration code.
+func (c VideoUnderstandingClient) Describe(ctx context.Context, model, filename, contentType string, data []byte, instruction string) (string, error) {
+	if len(data) == 0 {
+		return "", errors.New("video payload is empty")
+	}
+	body := &bytes.Buffer{}
+	writer := multipart.NewWriter(body)
+	header := make(textproto.MIMEHeader)
+	header.Set("Content-Disposition", fmt.Sprintf(`form-data; name="file"; filename="%s"`, strings.ReplaceAll(filename, `"`, "")))
+	header.Set("Content-Type", contentType)
+	part, err := writer.CreatePart(header)
+	if err != nil {
+		return "", err
+	}
+	if _, err := part.Write(data); err != nil {
+		return "", err
+	}
+	_ = writer.WriteField("model", model)
+	_ = writer.WriteField("instruction", instruction)
+	if err := writer.Close(); err != nil {
+		return "", err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, strings.TrimRight(c.BaseURL, "/")+"/understand", body)
+	if err != nil {
+		return "", err
+	}
+	request.Header.Set("Content-Type", writer.FormDataContentType())
+	response, err := c.client().Do(request)
+	if err != nil {
+		return "", err
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode > 299 {
+		return "", fmt.Errorf("video provider status %d", response.StatusCode)
+	}
+	var result struct {
+		Text string `json:"text"`
+	}
+	if err := json.NewDecoder(io.LimitReader(response.Body, 2<<20)).Decode(&result); err != nil {
+		return "", err
+	}
+	if strings.TrimSpace(result.Text) == "" {
+		return "", ErrEmptyResult
+	}
+	return strings.TrimSpace(result.Text), nil
+}
+
+func (c SpeechClient) client() *http.Client {
+	if c.Client != nil {
+		return c.Client
+	}
+	return http.DefaultClient
+}
+
+func (c VisionClient) client() *http.Client {
+	if c.Client != nil {
+		return c.Client
+	}
+	return http.DefaultClient
+}
+
+func (c ImageGenerationClient) client() *http.Client {
+	if c.Client != nil {
+		return c.Client
+	}
+	return http.DefaultClient
+}
+
+func (c ComfyImageGenerationClient) client() *http.Client {
+	if c.Client != nil {
+		return c.Client
+	}
+	return http.DefaultClient
+}
+
+func (c VideoUnderstandingClient) client() *http.Client {
+	if c.Client != nil {
+		return c.Client
+	}
+	return http.DefaultClient
+}
+
+func encodeBase64(data []byte) string {
+	return base64.StdEncoding.EncodeToString(data)
+}

adapters/multimodal/client_test.go

@@ -0,0 +1,209 @@
+package multimodal
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestSpeechClientSendsMultipartAndReturnsTranscript(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/inference" || r.Method != http.MethodPost {
+			t.Fatalf("unexpected speech request: %s %s", r.Method, r.URL.Path)
+		}
+		if err := r.ParseMultipartForm(1 << 20); err != nil {
+			t.Fatal(err)
+		}
+		file, _, err := r.FormFile("file")
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer file.Close()
+		data, _ := io.ReadAll(file)
+		if string(data) != "audio" {
+			t.Fatalf("audio payload = %q", data)
+		}
+		_ = json.NewEncoder(w).Encode(map[string]string{"text": "распознанная фраза"})
+	}))
+	defer server.Close()
+	text, err := (SpeechClient{BaseURL: server.URL, Client: server.Client()}).Transcribe(context.Background(), "voice.wav", "audio/wav", []byte("audio"))
+	if err != nil || text != "распознанная фраза" {
+		t.Fatalf("transcript=%q err=%v", text, err)
+	}
+}
+
+func TestVisionClientSendsImageDataAndInstruction(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var payload struct {
+			Messages []struct {
+				Content []struct {
+					Type     string `json:"type"`
+					Text     string `json:"text"`
+					ImageURL *struct {
+						URL string `json:"url"`
+					} `json:"image_url"`
+				} `json:"content"`
+			} `json:"messages"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
+			t.Fatal(err)
+		}
+		if len(payload.Messages) != 1 || len(payload.Messages[0].Content) != 2 || !strings.Contains(payload.Messages[0].Content[0].Text, "Опиши") || payload.Messages[0].Content[1].ImageURL == nil || !strings.HasPrefix(payload.Messages[0].Content[1].ImageURL.URL, "data:image/png;base64,") {
+			t.Fatalf("unexpected vision payload: %+v", payload)
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{"choices": []any{map[string]any{"message": map[string]string{"content": "на изображении круг"}}}})
+	}))
+	defer server.Close()
+	text, err := (VisionClient{BaseURL: server.URL + "/v1", Client: server.Client()}).Describe(context.Background(), "vision-model", "image/png", []byte{0, 1, 2}, "Опиши изображение")
+	if err != nil || text != "на изображении круг" {
+		t.Fatalf("description=%q err=%v", text, err)
+	}
+}
+
+func TestVisionClientUsesReasoningContentWhenProviderOmitsContent(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_ = json.NewEncoder(w).Encode(map[string]any{"choices": []any{map[string]any{
+			"message": map[string]string{"content": "", "reasoning_content": "чёрный квадрат"},
+		}}})
+	}))
+	defer server.Close()
+	text, err := (VisionClient{BaseURL: server.URL, Client: server.Client()}).Describe(context.Background(), "vision-model", "image/png", []byte("image"), "Опиши изображение")
+	if err != nil || text != "чёрный квадрат" {
+		t.Fatalf("description=%q err=%v", text, err)
+	}
+}
+
+func TestImageGenerationClientSendsPromptAndReturnsBase64(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/images/generations" || r.Method != http.MethodPost {
+			t.Fatalf("unexpected image request: %s %s", r.Method, r.URL.Path)
+		}
+		var payload struct {
+			Model  string `json:"model"`
+			Prompt string `json:"prompt"`
+			Size   string `json:"size"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
+			t.Fatal(err)
+		}
+		if payload.Model != "image-model" || payload.Prompt != "green bird" || payload.Size != "1024x1024" {
+			t.Fatalf("unexpected image payload: %+v", payload)
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{"data": []any{map[string]string{"b64_json": "aW1hZ2U="}}})
+	}))
+	defer server.Close()
+	image, err := (ImageGenerationClient{BaseURL: server.URL, Client: server.Client()}).Generate(context.Background(), "image-model", "green bird", "1024x1024")
+	if err != nil || image.DataBase64 != "aW1hZ2U=" || image.ContentType != "image/png" {
+		t.Fatalf("image=%+v err=%v", image, err)
+	}
+}
+
+func TestVideoUnderstandingClientSendsMultipartAndReturnsDescription(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/understand" || r.Method != http.MethodPost {
+			t.Fatalf("unexpected video request: %s %s", r.Method, r.URL.Path)
+		}
+		if err := r.ParseMultipartForm(1 << 20); err != nil {
+			t.Fatal(err)
+		}
+		if r.FormValue("model") != "video-model" || r.FormValue("instruction") != "describe movement" {
+			t.Fatalf("unexpected video fields: model=%q instruction=%q", r.FormValue("model"), r.FormValue("instruction"))
+		}
+		file, _, err := r.FormFile("file")
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer file.Close()
+		data, _ := io.ReadAll(file)
+		if string(data) != "video" {
+			t.Fatalf("video payload=%q", data)
+		}
+		_ = json.NewEncoder(w).Encode(map[string]string{"text": "человек идёт"})
+	}))
+	defer server.Close()
+	text, err := (VideoUnderstandingClient{BaseURL: server.URL, Client: server.Client()}).Describe(context.Background(), "video-model", "clip.mp4", "video/mp4", []byte("video"), "describe movement")
+	if err != nil || text != "человек идёт" {
+		t.Fatalf("description=%q err=%v", text, err)
+	}
+}
+
+func TestComfyImageGenerationClientRunsWorkflowAndReturnsImage(t *testing.T) {
+	polls := 0
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/prompt":
+			var payload struct {
+				Prompt map[string]any `json:"prompt"`
+			}
+			if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
+				t.Fatal(err)
+			}
+			if payload.Prompt["6"].(map[string]any)["inputs"].(map[string]any)["text"] != "red bird" {
+				t.Fatalf("prompt was not forwarded: %+v", payload.Prompt["6"])
+			}
+			_ = json.NewEncoder(w).Encode(map[string]string{"prompt_id": "test-prompt"})
+		case "/history/test-prompt":
+			polls++
+			if polls == 1 {
+				_, _ = w.Write([]byte(`{}`))
+				return
+			}
+			_ = json.NewEncoder(w).Encode(map[string]any{"test-prompt": map[string]any{"outputs": map[string]any{"9": map[string]any{"images": []any{map[string]string{"filename": "out.png", "subfolder": "", "type": "output"}}}}}})
+		case "/view":
+			w.Header().Set("Content-Type", "image/png")
+			_, _ = w.Write([]byte("png"))
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+	image, err := (ComfyImageGenerationClient{BaseURL: server.URL, Client: server.Client(), PollInterval: time.Millisecond, PollTimeout: time.Second}).Generate(context.Background(), "", "red bird", "256x256")
+	if err != nil || image.DataBase64 != "cG5n" || image.ContentType != "image/png" {
+		t.Fatalf("image=%+v err=%v", image, err)
+	}
+}
+
+func TestComfyImageGenerationClientDeletesOnlyCancelledPrompt(t *testing.T) {
+	var deleted []string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/prompt":
+			_ = json.NewEncoder(w).Encode(map[string]string{"prompt_id": "cancel-me"})
+		case "/history/cancel-me":
+			<-r.Context().Done()
+		case "/queue":
+			var payload struct {
+				Delete []string `json:"delete"`
+			}
+			if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
+				t.Fatal(err)
+			}
+			deleted = append(deleted, payload.Delete...)
+			w.WriteHeader(http.StatusNoContent)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan error, 1)
+	go func() {
+		_, err := (ComfyImageGenerationClient{BaseURL: server.URL, Client: server.Client(), PollInterval: time.Millisecond, PollTimeout: time.Minute}).Generate(ctx, "", "red bird", "256x256")
+		done <- err
+	}()
+	time.Sleep(10 * time.Millisecond)
+	cancel()
+	if err := <-done; !errors.Is(err, context.Canceled) {
+		t.Fatalf("err=%v", err)
+	}
+	if len(deleted) != 1 || deleted[0] != "cancel-me" {
+		t.Fatalf("deleted=%v", deleted)
+	}
+}

adapters/multimodal/ingress.go

@@ -0,0 +1,18 @@
+package multimodal
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"git.cin.su/m/Assistant/contracts/artifact"
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/interaction"
+)
+
+func NormalizeIngress(id string, modality interaction.IngressModality, sourceRef, deviceRef, locationRef, principalID, contentType string, data []byte, response capability.MultimodalResponse, at int64) (interaction.IngressEnvelope, artifact.MediaArtifact) {
+	hash := sha256.Sum256(data)
+	artifactValue := artifact.MediaArtifact{ID: artifact.ArtifactID("artifact:media:" + hex.EncodeToString(hash[:8])), ContentType: contentType, SizeBytes: int64(len(data)), ContentDigest: hex.EncodeToString(hash[:]), SourceRef: sourceRef, RecordedAtUnixMillis: at}
+	if len(data) == 0 {
+		return interaction.IngressEnvelope{ID: id, Modality: modality, SourceRef: sourceRef, DeviceRef: deviceRef, LocationRef: locationRef, PrincipalID: principalID, Degraded: true, RecordedAtUnixMillis: at}, artifact.MediaArtifact{}
+	}
+	return interaction.IngressEnvelope{ID: id, Modality: modality, SourceRef: sourceRef, DeviceRef: deviceRef, LocationRef: locationRef, PrincipalID: principalID, ArtifactRef: string(artifactValue.ID), ObservationRef: response.EvidenceRef, ProviderRef: response.Provider, ModelRef: response.Model, ModelVersion: response.ModelVersion, ConfidenceMillis: response.ConfidenceMillis, RecordedAtUnixMillis: at}, artifactValue
+}

adapters/multimodal/ingress_test.go

@@ -0,0 +1,22 @@
+package multimodal_test
+
+import (
+	"git.cin.su/m/Assistant/adapters/multimodal"
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/interaction"
+	"testing"
+)
+
+func TestIngressNormalizesMediaArtifactAndObservationProvenance(t *testing.T) {
+	e, a := multimodal.NormalizeIngress("ingress-1", interaction.IngressImage, "camera:street", "device:cam", "world:street", "principal", "image/png", []byte("image"), capability.MultimodalResponse{Provider: "local", Model: "vision", ModelVersion: "1", EvidenceRef: "observation-1", ConfidenceMillis: 800}, 1)
+	if !e.Valid() || !a.Valid() || e.ArtifactRef == "" || e.ObservationRef != "observation-1" || e.DeviceRef == "" || e.LocationRef == "" {
+		t.Fatalf("envelope=%+v artifact=%+v", e, a)
+	}
+}
+
+func TestUnavailableIngressDegradesWithoutFabricatingObservation(t *testing.T) {
+	e, a := multimodal.NormalizeIngress("ingress-1", interaction.IngressAudio, "mic", "device:mic", "", "principal", "audio/wav", nil, capability.MultimodalResponse{}, 1)
+	if !e.Degraded || e.ObservationRef != "" || a.Valid() {
+		t.Fatalf("envelope=%+v artifact=%+v", e, a)
+	}
+}

adapters/notificationexecutor/executor.go

@@ -37,10 +37,12 @@ type DeliveryRequest struct {
 }
 
 type Receipt struct {
-	ReceiptID      string                        `json:"receipt_id"`
-	ActionIntentID commitcontract.ActionIntentID `json:"action_intent_id"`
-	RequestDigest  string                        `json:"request_digest"`
-	AcceptedAt     int64                         `json:"accepted_at_unix_millis"`
+	ReceiptID                 string                        `json:"receipt_id"`
+	ActionIntentID            commitcontract.ActionIntentID `json:"action_intent_id"`
+	RequestDigest             string                        `json:"request_digest"`
+	AcceptedAt                int64                         `json:"accepted_at_unix_millis"`
+	DeliveryMode              string                        `json:"delivery_mode,omitempty"`
+	ExternalDeliveryAttempted bool                          `json:"external_delivery_attempted"`
 }
 
 func Digest(payload Payload) (string, error) {
@@ -76,11 +78,27 @@ func PayloadFromAction(action commitcontract.AuthorizedAction) (Payload, error)
 
 type Executor struct {
 	binding        capability.Binding
+	candidate      *capability.CandidateBinding
 	secret         string
 	client         *http.Client
 	executeAllowed bool
 }
 
+// NewShadow accepts only a Capability-owned SHADOW binding.  Its caller does
+// not supply an endpoint; the target remains inside the resolved binding.
+func NewShadow(binding capability.CandidateBinding, secret string, client *http.Client) (*Executor, error) {
+	if capabilitydomain.ValidateCandidateBinding(binding) != nil || binding.Context.Mode != capability.CandidateBindingModeShadow || binding.Status != capability.CandidateBindingActive {
+		return nil, ErrInvalidNotification
+	}
+	stable := capability.Binding{ID: binding.BaseActiveBindingID, Revision: binding.BaseActiveBindingRevision, OwnerPrincipalID: binding.Context.PrincipalID}
+	value, err := newExecutor(stable, secret, client, true)
+	if err != nil {
+		return nil, err
+	}
+	value.candidate = &binding
+	return value, nil
+}
+
 func New(binding capability.Binding, secret string, client *http.Client) (*Executor, error) {
 	if err := capabilitydomain.UsableBinding(binding); err != nil {
 		return nil, ErrInvalidNotification
@@ -116,7 +134,7 @@ func (e *Executor) Execute(action commitcontract.AuthorizedAction) ports.Executi
 	if err != nil {
 		return ports.ExecutionResult{Known: true}
 	}
-	endpoint, err := e.endpoint(e.binding.DeliveryPath, string(action.Proposal.IntentID))
+	endpoint, err := e.endpoint(e.deliveryPath(), string(action.Proposal.IntentID))
 	if err != nil {
 		return ports.ExecutionResult{Known: true}
 	}
@@ -127,6 +145,10 @@ func (e *Executor) Execute(action commitcontract.AuthorizedAction) ports.Executi
 	request.Header.Set("Authorization", "Bearer "+e.secret)
 	request.Header.Set("Content-Type", "application/json")
 	request.Header.Set("Accept", "application/json")
+	if e.candidate != nil {
+		request.Header.Set("X-Candidate-Release", e.candidate.Context.ReleaseSetID)
+		request.Header.Set("X-Candidate-Task", e.candidate.Context.TaskID)
+	}
 	response, err := e.client.Do(request)
 	if err != nil {
 		return ports.ExecutionResult{}
@@ -139,10 +161,14 @@ func (e *Executor) Execute(action commitcontract.AuthorizedAction) ports.Executi
 		return ports.ExecutionResult{}
 	}
 	receipt, err := decodeReceipt(response.Body)
-	if err != nil || !matchingReceipt(receipt, action) {
+	if err != nil || !matchingReceipt(receipt, action) || (e.candidate != nil && (receipt.DeliveryMode != "SHADOW" || receipt.ExternalDeliveryAttempted)) {
 		return ports.ExecutionResult{}
 	}
-	return ports.ExecutionResult{Known: true, Succeeded: true}
+	result := ports.ExecutionResult{Known: true, Succeeded: true}
+	if e.candidate != nil {
+		result.Receipt = &commitcontract.ExecutionReceipt{ID: receipt.ReceiptID, ExecutorImplementationRef: "notification-shadow-receiver-v1", ExternalOperationRef: "SHADOW_CAPTURED", ExternalRequestID: string(receipt.ActionIntentID), RequestDigest: receipt.RequestDigest, DispatchAtUnixMillis: receipt.AcceptedAt, ExecutorResult: commitcontract.ExecutorAccepted, ReconciliationKey: receipt.ReceiptID, DeliveryMode: "SHADOW", ExternalDeliveryAttempted: false, ReleaseSetID: e.candidate.Context.ReleaseSetID, TaskID: e.candidate.Context.TaskID, TaskRevision: e.candidate.Context.TaskRevision, CapabilityBindingID: string(e.candidate.ID), CapabilityBindingRevision: e.candidate.Revision, TargetReference: e.candidate.Context.TargetRef}
+	}
+	return result
 }
 
 func (e *Executor) Reconcile(action commitcontract.AuthorizedAction) ports.ExecutionResult {
@@ -186,7 +212,11 @@ func (e *Executor) requestFor(action commitcontract.AuthorizedAction) (Payload,
 }
 
 func (e *Executor) endpoint(path, intent string) (string, error) {
-	base, err := url.Parse(e.binding.HTTPSOrigin)
+	origin := e.binding.HTTPSOrigin
+	if e.candidate != nil {
+		origin = e.candidate.TargetOrigin
+	}
+	base, err := url.Parse(origin)
 	if err != nil {
 		return "", err
 	}
@@ -195,6 +225,13 @@ func (e *Executor) endpoint(path, intent string) (string, error) {
 	return base.String(), nil
 }
 
+func (e *Executor) deliveryPath() string {
+	if e.candidate != nil {
+		return e.candidate.DeliveryPath
+	}
+	return e.binding.DeliveryPath
+}
+
 func decodeReceipt(reader io.Reader) (Receipt, error) {
 	var receipt Receipt
 	decoder := json.NewDecoder(io.LimitReader(reader, maxResponseBytes+1))

adapters/notificationexecutor/executor_test.go

@@ -9,6 +9,7 @@ import (
 	"git.cin.su/m/Assistant/contracts/capability"
 	commitcontract "git.cin.su/m/Assistant/contracts/commit"
 	"git.cin.su/m/Assistant/contracts/identity"
+	capabilitydomain "git.cin.su/m/Assistant/modules/capability/domain"
 )
 
 func testAction(t *testing.T) commitcontract.AuthorizedAction {
@@ -55,6 +56,35 @@ func TestExecutorPutAndReconcileMatchReceipt(t *testing.T) {
 	}
 }
 
+func TestShadowExecutorRequiresShadowReceipt(t *testing.T) {
+	action := testAction(t)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("X-Candidate-Release") != "assistant-slot-b" || r.Header.Get("X-Candidate-Task") != "GEN2-CAPABILITY-001" {
+			t.Fatalf("missing candidate context")
+		}
+		_ = json.NewEncoder(w).Encode(Receipt{ReceiptID: "shadow-receipt-1", ActionIntentID: action.Proposal.IntentID, RequestDigest: action.Proposal.NotificationSubject.RequestDigest, AcceptedAt: 1, DeliveryMode: "SHADOW", ExternalDeliveryAttempted: false})
+	}))
+	defer server.Close()
+	binding := capability.CandidateBinding{ID: "candidate-binding-1", Revision: 1, BaseActiveBindingID: "binding-1", BaseActiveBindingRevision: 1,
+		Context:      capability.CandidateReleaseContext{ReleaseSetID: "assistant-slot-b", Slot: "b", TaskID: "GEN2-CAPABILITY-001", TaskRevision: 7, PrincipalID: "owner-1", CapabilityID: commitcontract.CapabilityProspectiveNotification, ResourceScope: "synthetic-shadow-notification-v1", Mode: capability.CandidateBindingModeShadow, TargetKind: "NOTIFICATION_SHADOW_RECEIVER", TargetRef: "notification-receiver-candidate", AuthorityGrantID: "grant"},
+		TargetOrigin: server.URL, DeliveryPath: "/delivery/v1/deliveries", ReceiptPath: "/delivery/v1/receipts", Protocol: capability.ProtocolIdempotentReceiptV1, CreatedAtUnixMillis: 1, ExpiresAtUnixMillis: 100, Status: capability.CandidateBindingActive}
+	// The httptest address is intentionally not the production candidate target;
+	// its digest is recomputed locally only for this bounded test binding.
+	digest, err := capabilitydomain.CandidateTargetDigest(binding)
+	if err != nil {
+		t.Fatal(err)
+	}
+	binding.Context.TargetDigest = digest
+	executor, err := NewShadow(binding, "shadow-secret", server.Client())
+	if err != nil {
+		t.Fatal(err)
+	}
+	result := executor.Execute(action)
+	if !result.Known || !result.Succeeded || result.Receipt == nil || result.Receipt.DeliveryMode != "SHADOW" || result.Receipt.ExternalDeliveryAttempted {
+		t.Fatalf("shadow result=%+v", result)
+	}
+}
+
 func TestExecutorAmbiguousAndIntegrityOutcomes(t *testing.T) {
 	action := testAction(t)
 	for name, handler := range map[string]http.HandlerFunc{

adapters/postgres/authority_repository.go

@@ -3,6 +3,7 @@ package postgres
 import (
 	"context"
 	"fmt"
+	"time"
 
 	"git.cin.su/m/Assistant/contracts/authority"
 	"github.com/jackc/pgx/v5/pgxpool"
@@ -27,3 +28,28 @@ func (r *AuthorityRepository) LoadGrant(ctx context.Context, id authority.GrantI
 	}
 	return grant, scope, nil
 }
+
+func (r *AuthorityRepository) LoadDelegatedControlPlaneGrant(ctx context.Context, id authority.GrantID) (authority.DelegatedControlPlaneGrant, error) {
+	var grant authority.DelegatedControlPlaneGrant
+	err := r.pool.QueryRow(ctx, `SELECT grant_id,service_actor_id,service_principal_id,issuer_principal_id,task_id,task_revision,operations,COALESCE(binding_id,''),COALESCE(provider_instance_id,''),COALESCE(model_descriptor_id,''),candidate_release_set_id,candidate_slot,candidate_capability_id,candidate_resource_scope,candidate_mode,candidate_target_kind,candidate_target_ref,candidate_target_digest,issued_at_unix_millis,expires_at_unix_millis,architecture_revision,nonce,revision,status FROM authority.delegated_control_plane_grants WHERE grant_id=$1`, id).Scan(&grant.ID, &grant.ServiceActorID, &grant.ServicePrincipalID, &grant.IssuerPrincipalID, &grant.TaskID, &grant.TaskRevision, &grant.Operations, &grant.Resource.BindingID, &grant.Resource.ProviderInstanceID, &grant.Resource.ModelDescriptorID, &grant.CandidateResource.ReleaseSetID, &grant.CandidateResource.Slot, &grant.CandidateResource.CapabilityID, &grant.CandidateResource.ResourceScope, &grant.CandidateResource.Mode, &grant.CandidateResource.TargetKind, &grant.CandidateResource.TargetRef, &grant.CandidateResource.TargetDigest, &grant.IssuedAtUnixMillis, &grant.ExpiresAtUnixMillis, &grant.ArchitectureRevision, &grant.Nonce, &grant.Revision, &grant.Status)
+	if err != nil {
+		return authority.DelegatedControlPlaneGrant{}, fmt.Errorf("load delegated control-plane grant: %w", err)
+	}
+	return grant, nil
+}
+
+func (r *AuthorityRepository) RecordDelegatedControlPlaneAudit(ctx context.Context, audit authority.DelegatedControlPlaneAudit) error {
+	_, err := r.pool.Exec(ctx, `INSERT INTO authority.delegated_control_plane_audit (audit_id,grant_id,service_actor_id,service_principal_id,task_id,task_revision,operation,binding_id,provider_instance_id,model_descriptor_id,candidate_release_set_id,candidate_slot,candidate_capability_id,candidate_resource_scope,candidate_mode,candidate_target_kind,candidate_target_ref,candidate_target_digest,decision,outcome,recorded_at_unix_millis) VALUES ($1,$2,$3,$4,$5,$6,$7,NULLIF($8,''),NULLIF($9,''),NULLIF($10,''),$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21)`, audit.AuditID, audit.GrantID, audit.ServiceActorID, audit.ServicePrincipalID, audit.TaskID, audit.TaskRevision, audit.Operation, audit.Resource.BindingID, audit.Resource.ProviderInstanceID, audit.Resource.ModelDescriptorID, audit.CandidateResource.ReleaseSetID, audit.CandidateResource.Slot, audit.CandidateResource.CapabilityID, audit.CandidateResource.ResourceScope, audit.CandidateResource.Mode, audit.CandidateResource.TargetKind, audit.CandidateResource.TargetRef, audit.CandidateResource.TargetDigest, audit.Decision, audit.Outcome, audit.RecordedAtUnixMillis)
+	if err != nil {
+		return fmt.Errorf("record delegated control-plane audit: %w", err)
+	}
+	return nil
+}
+
+func (r *AuthorityRepository) RevokeDelegatedControlPlaneGrant(ctx context.Context, id authority.GrantID, issuer string) (bool, error) {
+	result, err := r.pool.Exec(ctx, `UPDATE authority.delegated_control_plane_grants SET status='REVOKED',revision=revision+1,revoked_at_unix_millis=$3 WHERE grant_id=$1 AND issuer_principal_id=$2 AND status='ACTIVE'`, id, issuer, time.Now().UnixMilli())
+	if err != nil {
+		return false, fmt.Errorf("revoke delegated control-plane grant: %w", err)
+	}
+	return result.RowsAffected() == 1, nil
+}

adapters/postgres/capability_repository.go

@@ -2,11 +2,13 @@ package postgres
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 
 	"git.cin.su/m/Assistant/contracts/capability"
 	"git.cin.su/m/Assistant/contracts/identity"
+	capabilitydomain "git.cin.su/m/Assistant/modules/capability/domain"
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
 )
@@ -181,10 +183,6 @@ func (r *CapabilityRepository) SaveBinding(ctx context.Context, binding capabili
 		if err != nil {
 			return err
 		}
-		_, err = tx.Exec(ctx, `INSERT INTO capability.cognitive_binding_revision_heads (binding_id,revision) VALUES ($1,$2) ON CONFLICT DO NOTHING`, binding.ID, binding.Revision)
-		if err != nil {
-			return err
-		}
 	}
 	return tx.Commit(ctx)
 }
@@ -309,12 +307,14 @@ func (r *CapabilityRepository) SaveSkillProfile(ctx context.Context, value capab
 	_, err = tx.Exec(ctx, `INSERT INTO capability.skill_profiles (
 		skill_profile_id,revision,name,description,applicable_context,implementation_ref,implementation_version,status,
 		supporting_experience_refs,known_failure_experience_refs,confidence_millis,last_validated_unix_millis,
-		observed_failure_count,observed_correction_count,recorded_at_unix_millis)
-		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15) ON CONFLICT DO NOTHING`,
+		observed_failure_count,observed_correction_count,recorded_at_unix_millis,applicability,dependency_refs,validation_evidence_refs,
+		independent_evaluation_refs,known_failure_conditions,verified_outcome_count,must_not_worsen_satisfied)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22) ON CONFLICT DO NOTHING`,
 		value.ID, value.Revision, value.Name, value.Description, value.ApplicableContext, value.ImplementationRef,
 		value.ImplementationVersion, value.Status, value.SupportingExperienceRefs, value.KnownFailureExperienceRefs,
 		value.ConfidenceMillis, value.LastValidatedUnixMillis, value.ObservedFailureCount, value.ObservedCorrectionCount,
-		value.RecordedAtUnixMillis)
+		value.RecordedAtUnixMillis, mustJSON(value.Applicability), value.DependencyRefs, value.ValidationEvidenceRefs,
+		value.IndependentEvaluationRefs, value.KnownFailureConditions, value.VerifiedOutcomeCount, value.MustNotWorsenSatisfied)
 	if err != nil {
 		return err
 	}
@@ -333,13 +333,16 @@ func (r *CapabilityRepository) LoadSkillProfile(ctx context.Context, id capabili
 	err := r.pool.QueryRow(ctx, `SELECT
 		p.skill_profile_id,p.revision,p.name,p.description,p.applicable_context,p.implementation_ref,p.implementation_version,p.status,
 		p.supporting_experience_refs,p.known_failure_experience_refs,p.confidence_millis,p.last_validated_unix_millis,
-		p.observed_failure_count,p.observed_correction_count,p.recorded_at_unix_millis
+		p.observed_failure_count,p.observed_correction_count,p.recorded_at_unix_millis,p.applicability,p.dependency_refs,
+		p.validation_evidence_refs,p.independent_evaluation_refs,p.known_failure_conditions,p.verified_outcome_count,p.must_not_worsen_satisfied
 		FROM capability.skill_profile_heads h
 		JOIN capability.skill_profiles p ON p.skill_profile_id=h.skill_profile_id AND p.revision=h.revision
 		WHERE p.skill_profile_id=$1`, id).Scan(&value.ID, &value.Revision, &value.Name, &value.Description, &value.ApplicableContext,
 		&value.ImplementationRef, &value.ImplementationVersion, &value.Status, &value.SupportingExperienceRefs,
 		&value.KnownFailureExperienceRefs, &value.ConfidenceMillis, &value.LastValidatedUnixMillis,
-		&value.ObservedFailureCount, &value.ObservedCorrectionCount, &value.RecordedAtUnixMillis)
+		&value.ObservedFailureCount, &value.ObservedCorrectionCount, &value.RecordedAtUnixMillis, newJSONTarget(&value.Applicability),
+		&value.DependencyRefs, &value.ValidationEvidenceRefs, &value.IndependentEvaluationRefs, &value.KnownFailureConditions,
+		&value.VerifiedOutcomeCount, &value.MustNotWorsenSatisfied)
 	if err != nil {
 		return capability.SkillProfile{}, fmt.Errorf("load skill profile: %w", err)
 	}
@@ -353,7 +356,8 @@ func (r *CapabilityRepository) RecentSkillProfiles(ctx context.Context, limit in
 	rows, err := r.pool.Query(ctx, `SELECT
 		p.skill_profile_id,p.revision,p.name,p.description,p.applicable_context,p.implementation_ref,p.implementation_version,p.status,
 		p.supporting_experience_refs,p.known_failure_experience_refs,p.confidence_millis,p.last_validated_unix_millis,
-		p.observed_failure_count,p.observed_correction_count,p.recorded_at_unix_millis
+		p.observed_failure_count,p.observed_correction_count,p.recorded_at_unix_millis,p.applicability,p.dependency_refs,
+		p.validation_evidence_refs,p.independent_evaluation_refs,p.known_failure_conditions,p.verified_outcome_count,p.must_not_worsen_satisfied
 		FROM capability.skill_profile_heads h
 		JOIN capability.skill_profiles p ON p.skill_profile_id=h.skill_profile_id AND p.revision=h.revision
 		ORDER BY h.updated_at DESC, p.skill_profile_id LIMIT $1`, limit)
@@ -367,7 +371,9 @@ func (r *CapabilityRepository) RecentSkillProfiles(ctx context.Context, limit in
 		if err := rows.Scan(&value.ID, &value.Revision, &value.Name, &value.Description, &value.ApplicableContext,
 			&value.ImplementationRef, &value.ImplementationVersion, &value.Status, &value.SupportingExperienceRefs,
 			&value.KnownFailureExperienceRefs, &value.ConfidenceMillis, &value.LastValidatedUnixMillis,
-			&value.ObservedFailureCount, &value.ObservedCorrectionCount, &value.RecordedAtUnixMillis); err != nil {
+			&value.ObservedFailureCount, &value.ObservedCorrectionCount, &value.RecordedAtUnixMillis, newJSONTarget(&value.Applicability),
+			&value.DependencyRefs, &value.ValidationEvidenceRefs, &value.IndependentEvaluationRefs, &value.KnownFailureConditions,
+			&value.VerifiedOutcomeCount, &value.MustNotWorsenSatisfied); err != nil {
 			return nil, err
 		}
 		result = append(result, value)
@@ -375,6 +381,40 @@ func (r *CapabilityRepository) RecentSkillProfiles(ctx context.Context, limit in
 	return result, rows.Err()
 }
 
+func (r *CapabilityRepository) SaveReflexRevision(ctx context.Context, reflex capability.Reflex, value capability.ReflexRevision) error {
+	_, err := r.pool.Exec(ctx, `INSERT INTO capability.reflex_revisions (
+		reflex_id,revision,principal_id,source_skill_id,source_skill_revision,kind,applicability,implementation_ref,implementation_version,artifact_digest,
+		dependency_refs,validation_evidence_refs,known_failure_experience_refs,shadow_policy,revalidation_policy,last_validated_at,lifecycle,
+		supersedes_revision,execution_count,failure_count,divergence_count,recorded_at)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22) ON CONFLICT DO NOTHING`,
+		value.ReflexID, value.Revision, reflex.PrincipalID, reflex.SourceSkillRef, value.SourceSkillRevision, value.Kind, mustJSON(value.Applicability), value.ImplementationRef, value.ImplementationVersion, value.ArtifactDigest,
+		value.DependencyRefs, value.ValidationEvidenceRefs, value.KnownFailureExperienceRefs, mustJSON(value.Shadow), mustJSON(value.Revalidation), value.LastValidatedAt, value.Lifecycle,
+		value.SupersedesRevision, value.ExecutionCount, value.FailureCount, value.DivergenceCount, value.RecordedAt)
+	if err != nil {
+		return err
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO capability.reflex_heads(reflex_id,revision,lifecycle) VALUES($1,$2,$3)
+		ON CONFLICT(reflex_id) DO UPDATE SET revision=EXCLUDED.revision,lifecycle=EXCLUDED.lifecycle,updated_at=CURRENT_TIMESTAMP
+		WHERE capability.reflex_heads.revision < EXCLUDED.revision`, value.ReflexID, value.Revision, value.Lifecycle)
+	return err
+}
+
+func mustJSON(value any) []byte { encoded, _ := json.Marshal(value); return encoded }
+
+type jsonTarget struct{ target any }
+
+func newJSONTarget(target any) *jsonTarget { return &jsonTarget{target: target} }
+func (v *jsonTarget) Scan(source any) error {
+	if source == nil {
+		return nil
+	}
+	bytes, ok := source.([]byte)
+	if !ok {
+		bytes = []byte(fmt.Sprint(source))
+	}
+	return json.Unmarshal(bytes, v.target)
+}
+
 func (r *CapabilityRepository) LoadBinding(ctx context.Context, id capability.CapabilityBindingID, revision int64) (capability.Binding, error) {
 	var binding capability.Binding
 	err := r.pool.QueryRow(ctx, `SELECT binding_id,capability_id,owner_principal_id,revision,state,https_origin,delivery_path,receipt_path,
@@ -403,6 +443,93 @@ func (r *CapabilityRepository) LoadActiveBinding(ctx context.Context, capability
 	return binding, nil
 }
 
+func (r *CapabilityRepository) SaveCandidateBinding(ctx context.Context, binding capability.CandidateBinding) error {
+	tx, err := r.pool.Begin(ctx)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	result, err := tx.Exec(ctx, `INSERT INTO capability.release_candidate_bindings (
+		binding_id,revision,base_active_binding_id,base_active_binding_revision,release_set_id,slot,task_id,task_revision,principal_id,capability_id,resource_scope,mode,target_kind,target_ref,target_digest,authority_grant_id,
+		target_origin,delivery_path,receipt_path,protocol,created_at_unix_millis,expires_at_unix_millis,status)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23) ON CONFLICT DO NOTHING`,
+		binding.ID, binding.Revision, binding.BaseActiveBindingID, binding.BaseActiveBindingRevision, binding.Context.ReleaseSetID, binding.Context.Slot, binding.Context.TaskID,
+		binding.Context.TaskRevision, binding.Context.PrincipalID, binding.Context.CapabilityID, binding.Context.ResourceScope, binding.Context.Mode, binding.Context.TargetKind, binding.Context.TargetRef, binding.Context.TargetDigest, binding.Context.AuthorityGrantID,
+		binding.TargetOrigin, binding.DeliveryPath, binding.ReceiptPath, binding.Protocol, binding.CreatedAtUnixMillis, binding.ExpiresAtUnixMillis, binding.Status)
+	if err != nil {
+		return err
+	}
+	if result.RowsAffected() == 0 {
+		return ErrCapabilityBindingConflict
+	}
+	if binding.Status == capability.CandidateBindingActive {
+		result, err = tx.Exec(ctx, `INSERT INTO capability.release_candidate_binding_heads (
+			release_set_id,slot,task_id,principal_id,capability_id,resource_scope,mode,binding_id,revision)
+			VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
+			ON CONFLICT (release_set_id,slot,task_id,principal_id,capability_id,resource_scope,mode) DO UPDATE SET binding_id=EXCLUDED.binding_id,revision=EXCLUDED.revision
+			WHERE capability.release_candidate_binding_heads.revision < EXCLUDED.revision`, binding.Context.ReleaseSetID, binding.Context.Slot, binding.Context.TaskID,
+			binding.Context.PrincipalID, binding.Context.CapabilityID, binding.Context.ResourceScope, binding.Context.Mode, binding.ID, binding.Revision)
+		if err != nil || result.RowsAffected() != 1 {
+			if err != nil {
+				return err
+			}
+			return ErrCapabilityBindingConflict
+		}
+	}
+	_, err = tx.Exec(ctx, `INSERT INTO capability.release_candidate_binding_audit (binding_id,revision,release_set_id,task_id,capability_id,resource_scope,mode,decision,reason,recorded_at_unix_millis)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,'CREATED','CAPABILITY_OWNED_CANDIDATE_BINDING',$8)`, binding.ID, binding.Revision, binding.Context.ReleaseSetID, binding.Context.TaskID, binding.Context.CapabilityID, binding.Context.ResourceScope, binding.Context.Mode, binding.CreatedAtUnixMillis)
+	if err != nil {
+		return err
+	}
+	return tx.Commit(ctx)
+}
+
+func (r *CapabilityRepository) ResolveCandidateBinding(ctx context.Context, request capability.CandidateReleaseContext, nowUnixMillis int64) (capability.CandidateBindingResolution, error) {
+	var binding capability.CandidateBinding
+	err := r.pool.QueryRow(ctx, `SELECT b.binding_id,b.revision,b.base_active_binding_id,b.base_active_binding_revision,b.release_set_id,b.slot,b.task_id,b.task_revision,b.principal_id,b.capability_id,b.resource_scope,b.mode,b.target_kind,b.target_ref,b.target_digest,b.authority_grant_id,b.target_origin,b.delivery_path,b.receipt_path,b.protocol,b.created_at_unix_millis,b.expires_at_unix_millis,b.status
+		FROM capability.release_candidate_binding_heads h JOIN capability.release_candidate_bindings b ON b.binding_id=h.binding_id AND b.revision=h.revision
+		WHERE h.release_set_id=$1 AND h.slot=$2 AND h.task_id=$3 AND h.principal_id=$4 AND h.capability_id=$5 AND h.resource_scope=$6 AND h.mode=$7`,
+		request.ReleaseSetID, request.Slot, request.TaskID, request.PrincipalID, request.CapabilityID, request.ResourceScope, request.Mode).
+		Scan(&binding.ID, &binding.Revision, &binding.BaseActiveBindingID, &binding.BaseActiveBindingRevision, &binding.Context.ReleaseSetID, &binding.Context.Slot, &binding.Context.TaskID, &binding.Context.TaskRevision, &binding.Context.PrincipalID, &binding.Context.CapabilityID, &binding.Context.ResourceScope, &binding.Context.Mode, &binding.Context.TargetKind, &binding.Context.TargetRef, &binding.Context.TargetDigest, &binding.Context.AuthorityGrantID, &binding.TargetOrigin, &binding.DeliveryPath, &binding.ReceiptPath, &binding.Protocol, &binding.CreatedAtUnixMillis, &binding.ExpiresAtUnixMillis, &binding.Status)
+	if err != nil {
+		return capability.CandidateBindingResolution{}, fmt.Errorf("candidate binding required: %w", err)
+	}
+	if capabilitydomain.CandidateBindingInvocable(binding, request, nowUnixMillis) != nil {
+		return capability.CandidateBindingResolution{}, ErrCapabilityBindingNotFound
+	}
+	_, _ = r.pool.Exec(ctx, `INSERT INTO capability.release_candidate_binding_audit (binding_id,revision,release_set_id,task_id,capability_id,resource_scope,mode,decision,reason,recorded_at_unix_millis)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,'RESOLVED','EXACT_CONTEXT',$8)`, binding.ID, binding.Revision, request.ReleaseSetID, request.TaskID, request.CapabilityID, request.ResourceScope, request.Mode, nowUnixMillis)
+	return capability.CandidateBindingResolution{Binding: binding, Mode: binding.Context.Mode, Reason: "EXACT_CONTEXT"}, nil
+}
+
+func (r *CapabilityRepository) RevokeCandidateBinding(ctx context.Context, id capability.CapabilityBindingID, revision int64, nowUnixMillis int64) (bool, error) {
+	tx, err := r.pool.Begin(ctx)
+	if err != nil {
+		return false, err
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	var binding capability.CandidateBinding
+	err = tx.QueryRow(ctx, `UPDATE capability.release_candidate_bindings SET status='REVOKED' WHERE binding_id=$1 AND revision=$2 AND status='ACTIVE'
+		RETURNING binding_id,revision,base_active_binding_id,base_active_binding_revision,release_set_id,slot,task_id,task_revision,principal_id,capability_id,resource_scope,mode,target_kind,target_ref,target_digest,authority_grant_id,target_origin,delivery_path,receipt_path,protocol,created_at_unix_millis,expires_at_unix_millis,status`, id, revision).
+		Scan(&binding.ID, &binding.Revision, &binding.BaseActiveBindingID, &binding.BaseActiveBindingRevision, &binding.Context.ReleaseSetID, &binding.Context.Slot, &binding.Context.TaskID, &binding.Context.TaskRevision, &binding.Context.PrincipalID, &binding.Context.CapabilityID, &binding.Context.ResourceScope, &binding.Context.Mode, &binding.Context.TargetKind, &binding.Context.TargetRef, &binding.Context.TargetDigest, &binding.Context.AuthorityGrantID, &binding.TargetOrigin, &binding.DeliveryPath, &binding.ReceiptPath, &binding.Protocol, &binding.CreatedAtUnixMillis, &binding.ExpiresAtUnixMillis, &binding.Status)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return false, nil
+		}
+		return false, err
+	}
+	_, err = tx.Exec(ctx, `DELETE FROM capability.release_candidate_binding_heads WHERE release_set_id=$1 AND slot=$2 AND task_id=$3 AND principal_id=$4 AND capability_id=$5 AND resource_scope=$6 AND mode=$7 AND binding_id=$8 AND revision=$9`, binding.Context.ReleaseSetID, binding.Context.Slot, binding.Context.TaskID, binding.Context.PrincipalID, binding.Context.CapabilityID, binding.Context.ResourceScope, binding.Context.Mode, binding.ID, binding.Revision)
+	if err != nil {
+		return false, err
+	}
+	_, err = tx.Exec(ctx, `INSERT INTO capability.release_candidate_binding_audit (binding_id,revision,release_set_id,task_id,capability_id,resource_scope,mode,decision,reason,recorded_at_unix_millis)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,'REVOKED','EXPLICIT_REVOKE',$8)`, binding.ID, binding.Revision, binding.Context.ReleaseSetID, binding.Context.TaskID, binding.Context.CapabilityID, binding.Context.ResourceScope, binding.Context.Mode, nowUnixMillis)
+	if err != nil {
+		return false, err
+	}
+	return true, tx.Commit(ctx)
+}
+
 func (r *CapabilityRepository) SaveProviderInstance(ctx context.Context, value capability.ProviderInstance) error {
 	_, err := r.pool.Exec(ctx, `INSERT INTO capability.cognitive_provider_instances
 		(provider_instance_id,revision,provider_kind,endpoint_ref,credential_ref,enabled,qualification,health,observed_at_unix_millis,billing_mode,auth_mode,input_cost_micros,output_cost_micros,request_cost_micros)
@@ -437,6 +564,14 @@ func (r *CapabilityRepository) LoadCognitiveCandidatesForProfile(ctx context.Con
 	return r.loadCognitiveCandidates(ctx, capabilityID, owner, profileID)
 }
 
+func (r *CapabilityRepository) LoadCognitiveCandidatesForEvaluation(ctx context.Context, capabilityID capability.CapabilityID, owner identity.PrincipalID, evaluationID capability.EvaluationID) ([]capability.ResolvedCognitiveBinding, error) {
+	var profileID capability.TaskEvaluationProfileID
+	if err := r.pool.QueryRow(ctx, `SELECT task_profile_id FROM capability.cognitive_task_evaluations WHERE evaluation_id=$1 AND capability_id=$2`, evaluationID, capabilityID).Scan(&profileID); err != nil {
+		return nil, err
+	}
+	return r.loadCognitiveCandidates(ctx, capabilityID, owner, profileID)
+}
+
 func (r *CapabilityRepository) LoadCognitiveCandidate(ctx context.Context, bindingID capability.CapabilityBindingID, revision int64) (capability.ResolvedCognitiveBinding, error) {
 	var capabilityID capability.CapabilityID
 	var owner identity.PrincipalID
@@ -564,7 +699,12 @@ func (r *CapabilityRepository) SaveCognitiveDiscovery(ctx context.Context, value
 		if err != nil {
 			return err
 		}
-		_, err = tx.Exec(ctx, `INSERT INTO capability.cognitive_binding_revision_heads (binding_id,revision) VALUES ($1,$2) ON CONFLICT DO NOTHING`, binding.ID, binding.Revision)
+		// Discovery may advance a head, but must never roll back a governed
+		// CANARY/ACTIVE revision to an older discovered snapshot after restart.
+		// Discovery may advance an inactive head even when its deterministic
+		// revision number is lower, but it must never overwrite a governed canary
+		// or active head during restart/startup refresh.
+		_, err = tx.Exec(ctx, `INSERT INTO capability.cognitive_binding_revision_heads (binding_id,revision) VALUES ($1,$2) ON CONFLICT (binding_id) DO UPDATE SET revision=EXCLUDED.revision,updated_at=CURRENT_TIMESTAMP WHERE NOT EXISTS (SELECT 1 FROM capability.cognitive_bindings current_binding WHERE current_binding.binding_id=capability.cognitive_binding_revision_heads.binding_id AND current_binding.revision=capability.cognitive_binding_revision_heads.revision AND current_binding.activation IN ('CANARY','ACTIVE'))`, binding.ID, binding.Revision)
 		if err != nil {
 			return err
 		}

adapters/postgres/commit_repository.go

@@ -111,6 +111,29 @@ func (r *CommitRepository) FinishAttempt(ctx context.Context, a commitcontract.A
 	return nil
 }
 
+func (r *CommitRepository) SaveExecutionReceipt(ctx context.Context, receipt commitcontract.ExecutionReceipt) error {
+	if !receipt.Valid() {
+		return ErrActionAttemptConflict
+	}
+	completed := int64(0)
+	if receipt.CompletedAtUnixMillis != nil {
+		completed = *receipt.CompletedAtUnixMillis
+	}
+	result, err := r.pool.Exec(ctx, `INSERT INTO commit.execution_receipts (
+		receipt_id,action_attempt_id,executor_implementation_ref,external_operation_ref,external_request_id,request_digest,response_digest,dispatch_at_unix_millis,completed_at_unix_millis,
+		executor_result,reconciliation_key,raw_artifact_ref,delivery_mode,external_delivery_attempted,release_set_id,task_id,task_revision,capability_binding_id,capability_binding_revision,target_reference)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20) ON CONFLICT (receipt_id) DO NOTHING`,
+		receipt.ID, receipt.ActionAttemptRef, receipt.ExecutorImplementationRef, receipt.ExternalOperationRef, receipt.ExternalRequestID, receipt.RequestDigest, receipt.ResponseDigest, receipt.DispatchAtUnixMillis, completed,
+		receipt.ExecutorResult, receipt.ReconciliationKey, receipt.RawArtifactRef, receipt.DeliveryMode, receipt.ExternalDeliveryAttempted, receipt.ReleaseSetID, receipt.TaskID, receipt.TaskRevision, receipt.CapabilityBindingID, receipt.CapabilityBindingRevision, receipt.TargetReference)
+	if err != nil {
+		return err
+	}
+	if result.RowsAffected() != 1 {
+		return ErrActionAttemptConflict
+	}
+	return nil
+}
+
 func (r *CommitRepository) LoadAuthorized(ctx context.Context, id commitcontract.AuthorizedActionID) (commitcontract.AuthorizedAction, error) {
 	return loadAuthorized(ctx, r.pool, id)
 }

adapters/postgres/epistemics_repository.go

@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"git.cin.su/m/Assistant/contracts/epistemics"
+	"git.cin.su/m/Assistant/platform/telemetry"
 	"github.com/jackc/pgx/v5/pgxpool"
 )
 
@@ -36,6 +37,11 @@ func (r *EpistemicsRepository) Ping(ctx context.Context) error {
 // TruthRuntimeStatus is a read-only projection of durable truth bundles.
 // It does not promote claims, revise beliefs, or mutate epistemic state.
 func (r *EpistemicsRepository) TruthRuntimeStatus(ctx context.Context) (TruthRuntimeStatus, error) {
+	started := time.Now()
+	outcome := "SUCCESS"
+	defer func() {
+		telemetry.RecordCompatibility("truth-bundles-status-reader", "epistemics-repository", "read", "research-status", true, false, true, outcome, "truth-status", "epistemics", started)
+	}()
 	status := TruthRuntimeStatus{
 		ClaimsByVerification: map[string]int64{},
 		BeliefsByState:       map[string]int64{},
@@ -43,6 +49,7 @@ func (r *EpistemicsRepository) TruthRuntimeStatus(ctx context.Context) (TruthRun
 		ObservedAtUnixMillis: time.Now().UnixMilli(),
 	}
 	if err := r.pool.QueryRow(ctx, `SELECT count(*) FROM epistemics.truth_bundles`).Scan(&status.BundleCount); err != nil {
+		outcome = "FAILURE"
 		return TruthRuntimeStatus{}, err
 	}
 	queries := []struct {
@@ -56,18 +63,21 @@ func (r *EpistemicsRepository) TruthRuntimeStatus(ctx context.Context) (TruthRun
 	for _, item := range queries {
 		rows, err := r.pool.Query(ctx, item.query)
 		if err != nil {
+			outcome = "FAILURE"
 			return TruthRuntimeStatus{}, err
 		}
 		for rows.Next() {
 			var state string
 			var count int64
 			if err := rows.Scan(&state, &count); err != nil {
+				outcome = "FAILURE"
 				rows.Close()
 				return TruthRuntimeStatus{}, err
 			}
 			item.destination[state] = count
 		}
 		if err := rows.Err(); err != nil {
+			outcome = "FAILURE"
 			rows.Close()
 			return TruthRuntimeStatus{}, err
 		}
@@ -91,10 +101,10 @@ func (r *EpistemicsRepository) RecentExperienceRecords(ctx context.Context, limi
 		return nil, fmt.Errorf("invalid experience limit")
 	}
 	rows, err := r.pool.Query(ctx, `SELECT
-		experience_id,source_kind,original_intent_id,source_utterance_id,context_refs,help_method,help_method_ref,
+		experience_id,principal_id,source_kind,original_intent_id,source_utterance_id,context_refs,help_method,help_method_ref,
 		capability_implementation_ref,capability_usage_observation_ref,capability_gap_ref,skill_ref,expectation_id,
 		expected_outcome,actual_outcome,outcome_ref,outcome_detail,human_response_ref,correction_utterance_id,
-		verification_evidence,confidence_millis,recorded_at_unix_millis
+		verification_evidence,confidence_millis,recorded_at_unix_millis,context_scope_ref,problem_statement,applicability_conditions,why_succeeded_or_failed
 		FROM epistemics.experience_records ORDER BY recorded_at_unix_millis DESC, experience_id DESC LIMIT $1`, limit)
 	if err != nil {
 		return nil, err
@@ -103,10 +113,44 @@ func (r *EpistemicsRepository) RecentExperienceRecords(ctx context.Context, limi
 	var result []epistemics.ExperienceRecord
 	for rows.Next() {
 		var value epistemics.ExperienceRecord
-		if err := rows.Scan(&value.ID, &value.SourceKind, &value.OriginalIntentID, &value.SourceUtteranceID, &value.ContextRefs, &value.HelpMethod, &value.HelpMethodRef,
+		if err := rows.Scan(&value.ID, &value.PrincipalID, &value.SourceKind, &value.OriginalIntentID, &value.SourceUtteranceID, &value.ContextRefs, &value.HelpMethod, &value.HelpMethodRef,
 			&value.CapabilityImplementationRef, &value.CapabilityUsageObservationRef, &value.CapabilityGapRef, &value.SkillRef, &value.ExpectationID,
 			&value.ExpectedOutcome, &value.ActualOutcome, &value.OutcomeRef, &value.OutcomeDetail, &value.HumanResponseRef, &value.CorrectionUtteranceID,
-			&value.VerificationEvidence, &value.ConfidenceMillis, &value.RecordedAtUnixMillis); err != nil {
+			&value.VerificationEvidence, &value.ConfidenceMillis, &value.RecordedAtUnixMillis, &value.ContextScopeRef, &value.ProblemStatement, &value.ApplicabilityConditions, &value.WhySucceededOrFailed); err != nil {
+			return nil, err
+		}
+		result = append(result, value)
+	}
+	return result, rows.Err()
+}
+
+// RecentExperienceRecordsForPrincipalAndScope is an owner-local Epistemics
+// read. It intentionally applies Principal and ContextScope in SQL before any
+// Core-side relevance ranking, so another realm's experience never becomes a
+// retrieval candidate.
+func (r *EpistemicsRepository) RecentExperienceRecordsForPrincipalAndScope(ctx context.Context, principalID, scopeRef string, limit int) ([]epistemics.ExperienceRecord, error) {
+	if principalID == "" || limit < 1 || limit > 100 {
+		return nil, fmt.Errorf("invalid scoped experience query")
+	}
+	rows, err := r.pool.Query(ctx, `SELECT
+		experience_id,principal_id,source_kind,original_intent_id,source_utterance_id,context_refs,help_method,help_method_ref,
+		capability_implementation_ref,capability_usage_observation_ref,capability_gap_ref,skill_ref,expectation_id,
+		expected_outcome,actual_outcome,outcome_ref,outcome_detail,human_response_ref,correction_utterance_id,
+		verification_evidence,confidence_millis,recorded_at_unix_millis,context_scope_ref,problem_statement,applicability_conditions,why_succeeded_or_failed
+		FROM epistemics.experience_records
+		WHERE principal_id=$1 AND ($2='' OR context_scope_ref=$2)
+		ORDER BY recorded_at_unix_millis DESC, experience_id DESC LIMIT $3`, principalID, scopeRef, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := make([]epistemics.ExperienceRecord, 0)
+	for rows.Next() {
+		var value epistemics.ExperienceRecord
+		if err := rows.Scan(&value.ID, &value.PrincipalID, &value.SourceKind, &value.OriginalIntentID, &value.SourceUtteranceID, &value.ContextRefs, &value.HelpMethod, &value.HelpMethodRef,
+			&value.CapabilityImplementationRef, &value.CapabilityUsageObservationRef, &value.CapabilityGapRef, &value.SkillRef, &value.ExpectationID,
+			&value.ExpectedOutcome, &value.ActualOutcome, &value.OutcomeRef, &value.OutcomeDetail, &value.HumanResponseRef, &value.CorrectionUtteranceID,
+			&value.VerificationEvidence, &value.ConfidenceMillis, &value.RecordedAtUnixMillis, &value.ContextScopeRef, &value.ProblemStatement, &value.ApplicabilityConditions, &value.WhySucceededOrFailed); err != nil {
 			return nil, err
 		}
 		result = append(result, value)
@@ -195,15 +239,15 @@ func (r *EpistemicsRepository) WaitForReflectionCandidate(ctx context.Context, i
 
 func (r *EpistemicsRepository) SaveExperienceRecord(ctx context.Context, value epistemics.ExperienceRecord) error {
 	_, err := r.pool.Exec(ctx, `INSERT INTO epistemics.experience_records (
-		experience_id, source_kind, original_intent_id, source_utterance_id, context_refs, help_method, help_method_ref,
+		experience_id, principal_id, source_kind, original_intent_id, source_utterance_id, context_refs, help_method, help_method_ref,
 		capability_implementation_ref, capability_usage_observation_ref, capability_gap_ref, skill_ref, expectation_id,
 		expected_outcome, actual_outcome, outcome_ref, outcome_detail, human_response_ref, correction_utterance_id,
-		verification_evidence, confidence_millis, recorded_at_unix_millis)
-		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21) ON CONFLICT DO NOTHING`,
-		value.ID, value.SourceKind, value.OriginalIntentID, value.SourceUtteranceID, value.ContextRefs, value.HelpMethod, value.HelpMethodRef,
+		verification_evidence, confidence_millis, recorded_at_unix_millis, context_scope_ref, problem_statement, applicability_conditions, why_succeeded_or_failed)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26) ON CONFLICT DO NOTHING`,
+		value.ID, value.PrincipalID, value.SourceKind, value.OriginalIntentID, value.SourceUtteranceID, value.ContextRefs, value.HelpMethod, value.HelpMethodRef,
 		value.CapabilityImplementationRef, value.CapabilityUsageObservationRef, value.CapabilityGapRef, value.SkillRef, value.ExpectationID,
 		value.ExpectedOutcome, value.ActualOutcome, value.OutcomeRef, value.OutcomeDetail, value.HumanResponseRef, value.CorrectionUtteranceID,
-		value.VerificationEvidence, value.ConfidenceMillis, value.RecordedAtUnixMillis)
+		value.VerificationEvidence, value.ConfidenceMillis, value.RecordedAtUnixMillis, value.ContextScopeRef, value.ProblemStatement, value.ApplicabilityConditions, value.WhySucceededOrFailed)
 	return err
 }
 
@@ -218,7 +262,13 @@ func (r *EpistemicsRepository) SaveReflectionCandidate(ctx context.Context, valu
 }
 
 func (r *EpistemicsRepository) SaveTruthBundle(ctx context.Context, value epistemics.TruthBundle, recordedAtUnixMillis int64) error {
+	started := time.Now()
+	outcome := "SUCCESS"
+	defer func() {
+		telemetry.RecordCompatibility("truth-bundles-writer", "epistemics-repository", "write", "persisted-research", true, false, true, outcome, string(value.Claim.ID), "epistemics", started)
+	}()
 	if value.Source.ID == "" || value.Snapshot.ID == "" || value.Excerpt.ID == "" || value.Claim.ID == "" || value.Belief.ID == "" || value.Citation.ID == "" || recordedAtUnixMillis < 1 {
+		outcome = "INVALID"
 		return fmt.Errorf("invalid truth bundle")
 	}
 	_, err := r.pool.Exec(ctx, `INSERT INTO epistemics.truth_bundles (
@@ -232,5 +282,8 @@ func (r *EpistemicsRepository) SaveTruthBundle(ctx context.Context, value episte
 		value.Excerpt.ID, value.Excerpt.SnapshotID, value.Excerpt.Text, value.Excerpt.Start, value.Excerpt.End,
 		value.Observation.ID, value.Observation.ObservedAt, value.Claim.ID, value.Claim.Statement, value.Claim.ObservationID, value.Claim.CitationID, value.Claim.Verification,
 		value.Belief.ID, value.Belief.ClaimID, value.Belief.State, value.Citation.ID, value.Citation.ExcerptID, value.Citation.Evidence, value.Citation.Coverage, value.Citation.Conflict, value.Citation.ResolvedAtUnixMillis, recordedAtUnixMillis)
+	if err != nil {
+		outcome = "FAILURE"
+	}
 	return err
 }

adapters/postgres/identity_repository.go

@@ -26,3 +26,49 @@ func (r *IdentityRepository) LoadBinding(ctx context.Context, actor identity.Act
 	}
 	return binding, nil
 }
+
+func (r *IdentityRepository) LoadCreatorAccount(ctx context.Context, username string) (identity.CreatorAccount, error) {
+	var account identity.CreatorAccount
+	err := r.pool.QueryRow(ctx, `SELECT username, actor_id, principal_id, password_hash, revision FROM identity.creator_accounts WHERE username=$1`, username).
+		Scan(&account.Username, &account.ActorID, &account.PrincipalID, &account.PasswordHash, &account.Revision)
+	if err != nil {
+		return identity.CreatorAccount{}, fmt.Errorf("load creator account: %w", err)
+	}
+	return account, nil
+}
+
+func (r *IdentityRepository) LoadCreatorAccountByBinding(ctx context.Context, actor identity.ActorID, principal identity.PrincipalID) (identity.CreatorAccount, error) {
+	var account identity.CreatorAccount
+	err := r.pool.QueryRow(ctx, `SELECT username, actor_id, principal_id, password_hash, revision FROM identity.creator_accounts WHERE actor_id=$1 AND principal_id=$2`, actor, principal).
+		Scan(&account.Username, &account.ActorID, &account.PrincipalID, &account.PasswordHash, &account.Revision)
+	if err != nil {
+		return identity.CreatorAccount{}, fmt.Errorf("load creator account by binding: %w", err)
+	}
+	return account, nil
+}
+
+func (r *IdentityRepository) CreateCreatorAccount(ctx context.Context, account identity.CreatorAccount) error {
+	_, err := r.pool.Exec(ctx, `INSERT INTO identity.creator_accounts (username, actor_id, principal_id, password_hash) VALUES ($1,$2,$3,$4) ON CONFLICT (username) DO NOTHING`, account.Username, account.ActorID, account.PrincipalID, account.PasswordHash)
+	return err
+}
+
+func (r *IdentityRepository) UpdateCreatorPassword(ctx context.Context, actor identity.ActorID, principal identity.PrincipalID, revision int64, passwordHash string) error {
+	result, err := r.pool.Exec(ctx, `UPDATE identity.creator_accounts SET password_hash=$1, revision=revision+1, password_changed_at=CURRENT_TIMESTAMP WHERE actor_id=$2 AND principal_id=$3 AND revision=$4`, passwordHash, actor, principal, revision)
+	if err != nil {
+		return fmt.Errorf("update creator password: %w", err)
+	}
+	if result.RowsAffected() != 1 {
+		return fmt.Errorf("update creator password: revision conflict")
+	}
+	return nil
+}
+
+func (r *IdentityRepository) LoadServicePrincipal(ctx context.Context, principal identity.PrincipalID) (identity.ServicePrincipal, error) {
+	var value identity.ServicePrincipal
+	err := r.pool.QueryRow(ctx, `SELECT actor_id, principal_id, kind, purpose, synthetic_scope, active, revision FROM identity.service_principals WHERE principal_id=$1`, principal).
+		Scan(&value.ActorID, &value.PrincipalID, &value.Kind, &value.Purpose, &value.SyntheticScope, &value.Active, &value.Revision)
+	if err != nil {
+		return identity.ServicePrincipal{}, fmt.Errorf("load service principal: %w", err)
+	}
+	return value, nil
+}

adapters/postgres/interaction_repository.go

@@ -3,6 +3,7 @@ package postgres
 import (
 	"context"
 
+	"git.cin.su/m/Assistant/contracts/identity"
 	"git.cin.su/m/Assistant/contracts/interaction"
 	"github.com/jackc/pgx/v5/pgxpool"
 )
@@ -98,3 +99,87 @@ func (r *InteractionRepository) Utterances(ctx context.Context, id interaction.C
 	}
 	return out, rows.Err()
 }
+
+// UtterancesWithProjectReferences returns canonical utterances together with
+// their already-persisted Interaction-owned project references. The caller
+// uses the pair only as a read projection; this method does not infer or write
+// scope membership.
+func (r *InteractionRepository) UtterancesWithProjectReferences(ctx context.Context, id interaction.ConversationID) ([]interaction.HumanUtterance, []interaction.ProjectReference, error) {
+	utterances, err := r.Utterances(ctx, id)
+	if err != nil {
+		return nil, nil, err
+	}
+	references, err := r.projectReferencesForUtterances(ctx, utterances)
+	if err != nil {
+		return nil, nil, err
+	}
+	return utterances, references, nil
+}
+
+// RecentUtterancesForPrincipal provides durable conversational context when a
+// client starts a fresh conversation instead of carrying the previous ID.
+func (r *InteractionRepository) RecentUtterancesForPrincipal(ctx context.Context, principalID identity.PrincipalID, limit int) ([]interaction.HumanUtterance, error) {
+	rows, err := r.pool.Query(ctx, `SELECT utterance_id,conversation_id,actor_id,principal_id,channel,received_at_unix_millis,correlation_id,content,content_ref,speech_act,interpretation_state,corrects_utterance_id FROM interaction.utterances WHERE principal_id=$1 ORDER BY received_at_unix_millis DESC, utterance_id DESC LIMIT $2`, principalID, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []interaction.HumanUtterance
+	for rows.Next() {
+		var u interaction.HumanUtterance
+		if err := rows.Scan(&u.ID, &u.ConversationID, &u.ActorID, &u.PrincipalID, &u.Channel, &u.ReceivedAtUnixMillis, &u.CorrelationID, &u.Content, &u.ContentRef, &u.SpeechAct, &u.InterpretationState, &u.CorrectsUtteranceID); err != nil {
+			return nil, err
+		}
+		out = append(out, u)
+	}
+	return out, rows.Err()
+}
+
+// RecentUtterancesForPrincipalWithProjectReferences keeps a new conversation
+// within the same durable Interaction read boundary as its scoped context.
+func (r *InteractionRepository) RecentUtterancesForPrincipalWithProjectReferences(ctx context.Context, principalID identity.PrincipalID, limit int) ([]interaction.HumanUtterance, []interaction.ProjectReference, error) {
+	utterances, err := r.RecentUtterancesForPrincipal(ctx, principalID, limit)
+	if err != nil {
+		return nil, nil, err
+	}
+	references, err := r.projectReferencesForUtterances(ctx, utterances)
+	if err != nil {
+		return nil, nil, err
+	}
+	return utterances, references, nil
+}
+
+func (r *InteractionRepository) projectReferencesForUtterances(ctx context.Context, utterances []interaction.HumanUtterance) ([]interaction.ProjectReference, error) {
+	if len(utterances) == 0 {
+		return nil, nil
+	}
+	ids := make([]string, 0, len(utterances))
+	seen := make(map[interaction.HumanUtteranceID]struct{}, len(utterances))
+	for _, utterance := range utterances {
+		if utterance.ID == "" {
+			continue
+		}
+		if _, exists := seen[utterance.ID]; exists {
+			continue
+		}
+		seen[utterance.ID] = struct{}{}
+		ids = append(ids, string(utterance.ID))
+	}
+	if len(ids) == 0 {
+		return nil, nil
+	}
+	rows, err := r.pool.Query(ctx, `SELECT project_reference_id,utterance_id,project_id,project_display_name,role,provenance,confidence_millis,recorded_at_unix_millis FROM interaction.project_references WHERE utterance_id = ANY($1::text[]) ORDER BY recorded_at_unix_millis,project_reference_id`, ids)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	refs := make([]interaction.ProjectReference, 0)
+	for rows.Next() {
+		var ref interaction.ProjectReference
+		if err := rows.Scan(&ref.ID, &ref.UtteranceID, &ref.ProjectID, &ref.ProjectDisplayName, &ref.Role, &ref.Provenance, &ref.ConfidenceMillis, &ref.RecordedAtUnixMillis); err != nil {
+			return nil, err
+		}
+		refs = append(refs, ref)
+	}
+	return refs, rows.Err()
+}

adapters/postgres/self_repository.go

@@ -0,0 +1,170 @@
+package postgres
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	selfcontract "git.cin.su/m/Assistant/contracts/self"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// SelfRepository persists only SELF-owned derived assessments and ledger
+// evidence. It never evaluates, promotes or changes Capability state.
+type SelfRepository struct{ pool *pgxpool.Pool }
+
+type AcceptanceSummary struct {
+	LearningSignals    int    `json:"learning_signals"`
+	ImprovementNeeds   int    `json:"improvement_needs"`
+	LearningLedger     int    `json:"learning_ledger"`
+	SyntheticPrincipal string `json:"synthetic_principal"`
+}
+
+func OpenSelf(ctx context.Context, config ContinuityConfig) (*SelfRepository, error) {
+	pool, err := openPool(ctx, config)
+	if err != nil {
+		return nil, err
+	}
+	return &SelfRepository{pool: pool}, nil
+}
+
+func (r *SelfRepository) Close() { r.pool.Close() }
+
+func (r *SelfRepository) AcceptanceSummary(ctx context.Context, principalID string) (AcceptanceSummary, error) {
+	var value AcceptanceSummary
+	value.SyntheticPrincipal = principalID
+	if err := r.pool.QueryRow(ctx, `SELECT COUNT(*) FROM self.learning_signals WHERE principal_id=$1`, principalID).Scan(&value.LearningSignals); err != nil {
+		return AcceptanceSummary{}, err
+	}
+	if err := r.pool.QueryRow(ctx, `SELECT COUNT(*) FROM self.improvement_needs WHERE principal_id=$1`, principalID).Scan(&value.ImprovementNeeds); err != nil {
+		return AcceptanceSummary{}, err
+	}
+	if err := r.pool.QueryRow(ctx, `SELECT COUNT(*) FROM self.learning_ledger WHERE principal_id=$1`, principalID).Scan(&value.LearningLedger); err != nil {
+		return AcceptanceSummary{}, err
+	}
+	return value, nil
+}
+
+func (r *SelfRepository) SaveImprovementNeed(ctx context.Context, value selfcontract.ImprovementNeed) error {
+	subject, err := json.Marshal(value.SubjectRef)
+	if err != nil {
+		return err
+	}
+	evidence, err := json.Marshal(value.EvidenceRefs)
+	if err != nil {
+		return err
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO self.improvement_needs(improvement_need_id,principal_id,subject_ref,problem_summary,evidence_refs,expected_benefit,priority,state,created_at_unix_millis)
+		VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9) ON CONFLICT DO NOTHING`, value.ID, value.PrincipalID, subject, value.ProblemSummary, evidence, value.ExpectedBenefit, value.Priority, value.State, value.CreatedAt)
+	return err
+}
+
+func (r *SelfRepository) SaveLearningLedger(ctx context.Context, value selfcontract.LearningLedgerEntry) error {
+	evidence, err := json.Marshal(value.EvidenceRefs)
+	if err != nil {
+		return err
+	}
+	improvement, err := json.Marshal(value.ImprovementNeedRef)
+	if err != nil {
+		return err
+	}
+	proposed, err := json.Marshal(value.ProposedChangeRef)
+	if err != nil {
+		return err
+	}
+	evaluations, err := json.Marshal(value.ActualEvaluationRefs)
+	if err != nil {
+		return err
+	}
+	gate, err := json.Marshal(value.DevelopmentGateRef)
+	if err != nil {
+		return err
+	}
+	before, err := json.Marshal(value.BeforeVersionRefs)
+	if err != nil {
+		return err
+	}
+	after, err := json.Marshal(value.AfterVersionRefs)
+	if err != nil {
+		return err
+	}
+	sideEffects, err := json.Marshal(value.SideEffects)
+	if err != nil {
+		return err
+	}
+	rollback, err := json.Marshal(value.RollbackRef)
+	if err != nil {
+		return err
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO self.learning_ledger(entry_id,principal_id,improvement_need_ref,observed_problem,evidence_refs,diagnosis,hypothesis,proposed_change_ref,expected_improvement,evaluation_refs,development_gate_ref,before_version_refs,after_version_refs,decision,side_effects,rollback_ref,recorded_at_unix_millis)
+		VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17) ON CONFLICT DO NOTHING`, value.ID, value.PrincipalID, improvement, value.ObservedProblem, evidence, value.Diagnosis, value.Hypothesis, proposed, value.ExpectedImprovement, evaluations, gate, before, after, value.Decision, sideEffects, rollback, value.RecordedAt)
+	return err
+}
+
+func (r *SelfRepository) SaveLearningSignal(ctx context.Context, value selfcontract.LearningSignal) error {
+	if err := value.Validate(); err != nil {
+		return err
+	}
+	subject, err := json.Marshal(value.SubjectRef)
+	if err != nil {
+		return err
+	}
+	evidence, err := json.Marshal(value.EvidenceRefs)
+	if err != nil {
+		return err
+	}
+	deps, err := json.Marshal(value.DependencyRefs)
+	if err != nil {
+		return err
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO self.learning_signals(signal_id,principal_id,kind,task_pattern,scope_key,subject_ref,evidence_refs,expected_outcome,actual_outcome,dependency_refs,environment_version,observed_at_unix_millis,severity,user_impact,correction_count,decision_regret)
+		VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16) ON CONFLICT DO NOTHING`, value.ID, value.PrincipalID, value.Kind, value.TaskPattern, value.ScopeKey, subject, evidence, value.ExpectedOutcome, value.ActualOutcome, deps, value.EnvironmentVersion, value.ObservedAt, value.Severity, value.UserImpact, value.CorrectionCount, value.DecisionRegret)
+	return err
+}
+
+func (r *SelfRepository) SaveWeaknessPattern(ctx context.Context, value selfcontract.WeaknessPattern) error {
+	evidence, err := json.Marshal(value.DetectionEvidenceRefs)
+	if err != nil {
+		return err
+	}
+	deps, err := json.Marshal(value.DependencyRefs)
+	if err != nil {
+		return err
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO self.weakness_patterns(assessment_id,principal_id,revision,pattern_key,task_pattern,scope_key,environment_version,dependency_refs,failure_mode,detection_evidence_refs,frequency,last_observed_at_unix_millis,severity,affected_component,affected_strategy,confidence_millis,epistemic_status,state,recorded_at_unix_millis)
+		VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19) ON CONFLICT DO NOTHING`, value.ID, value.PrincipalID, value.Revision, value.PatternKey, value.TaskPattern, value.ScopeKey, value.EnvironmentVersion, deps, value.FailureMode, evidence, value.Frequency, value.LastObservedAt, value.Severity, value.AffectedComponent, value.AffectedStrategy, value.ConfidenceMillis, value.EpistemicStatus, value.State, value.RecordedAt)
+	return err
+}
+
+func (r *SelfRepository) SaveImprovementCandidate(ctx context.Context, value selfcontract.ImprovementCandidate) error {
+	if err := value.Validate(); err != nil {
+		return err
+	}
+	need, err := json.Marshal(value.NeedRef)
+	if err != nil {
+		return err
+	}
+	must, err := json.Marshal(value.MustNotWorsen)
+	if err != nil {
+		return err
+	}
+	evidence, err := json.Marshal(value.EvidenceRefs)
+	if err != nil {
+		return err
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO self.improvement_candidates(candidate_id,principal_id,need_ref,hypothesis,expected_effect,evaluation_plan,must_not_worsen,rollback_plan,resource_cost,creator,independent_evaluator,state,evidence_refs,created_at_unix_millis)
+		VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14) ON CONFLICT DO NOTHING`, value.ID, value.PrincipalID, need, value.Hypothesis, value.ExpectedEffect, value.EvaluationPlan, must, value.RollbackPlan, value.ResourceCost, value.Creator, value.IndependentEvaluator, value.State, evidence, value.CreatedAt)
+	return err
+}
+
+func (r *SelfRepository) SaveBenchmarkCase(ctx context.Context, value selfcontract.BenchmarkCase) error {
+	if !value.Valid() {
+		return fmt.Errorf("benchmark case is incomplete")
+	}
+	evidence, err := json.Marshal(value.EvidenceRefs)
+	if err != nil {
+		return err
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO self.personal_benchmark_cases(case_id,principal_id,task_class,evidence_refs,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5) ON CONFLICT DO NOTHING`, value.ID, value.PrincipalID, value.TaskClass, evidence, value.RecordedAt)
+	return err
+}

adapters/postgres/situation_repository.go

@@ -2,6 +2,7 @@ package postgres
 
 import (
 	"context"
+	"encoding/json"
 	"strings"
 
 	"git.cin.su/m/Assistant/contracts/identity"
@@ -18,6 +19,38 @@ func OpenSituation(ctx context.Context, config ContinuityConfig) (*SituationRepo
 	}
 	return &SituationRepository{pool: pool}, nil
 }
+
+func (r *SituationRepository) SaveContextScope(ctx context.Context, scope situation.ContextScope) error {
+	if err := scope.Validate(); err != nil {
+		return err
+	}
+	bindings, err := json.Marshal(scope.Bindings)
+	if err != nil {
+		return err
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO situation.context_scopes(context_scope_id,principal_id,revision,bindings,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5) ON CONFLICT(context_scope_id) DO UPDATE SET revision=EXCLUDED.revision, bindings=EXCLUDED.bindings, recorded_at_unix_millis=EXCLUDED.recorded_at_unix_millis`, scope.ID, scope.PrincipalID, scope.Revision, bindings, scope.RecordedAt)
+	return err
+}
+
+func (r *SituationRepository) SaveFocusFrame(ctx context.Context, frame situation.FocusFrame) error {
+	if err := frame.Validate(); err != nil {
+		return err
+	}
+	ref, err := json.Marshal(frame.ContextScopeRef)
+	if err != nil {
+		return err
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO situation.focus_frames(focus_frame_id,principal_id,actor_id,revision,authority_scope_ref,context_scope_ref,goal_ref,task_ref,source_utterance_ref,provenance,confidence_millis,state,parent_frame_ref,activated_at_unix_millis,suspended_at_unix_millis,expired_at_unix_millis,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17) ON CONFLICT(focus_frame_id) DO UPDATE SET revision=EXCLUDED.revision, context_scope_ref=EXCLUDED.context_scope_ref, state=EXCLUDED.state, suspended_at_unix_millis=EXCLUDED.suspended_at_unix_millis, expired_at_unix_millis=EXCLUDED.expired_at_unix_millis, recorded_at_unix_millis=EXCLUDED.recorded_at_unix_millis`, frame.ID, frame.PrincipalID, frame.ActorID, frame.Revision, frame.AuthorityScopeRef, ref, frame.GoalRef, frame.TaskRef, frame.SourceUtteranceRef, frame.Provenance, frame.ConfidenceMillis, frame.State, frame.ParentFrameRef, frame.ActivatedAt, frame.SuspendedAt, frame.ExpiredAt, frame.RecordedAt)
+	return err
+}
+
+func (r *SituationRepository) AppendFocusTransition(ctx context.Context, transition situation.FocusTransition) error {
+	if err := transition.Validate(); err != nil {
+		return err
+	}
+	_, err := r.pool.Exec(ctx, `INSERT INTO situation.focus_transitions(transition_id,focus_frame_id,from_revision,to_revision,operation,cause_ref,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5,$6,$7)`, transition.TransitionID, transition.FrameID, transition.FromRevision, transition.ToRevision, transition.Operation, transition.CauseRef, transition.RecordedAt)
+	return err
+}
 func (r *SituationRepository) Close() { r.pool.Close() }
 func (r *SituationRepository) Save(ctx context.Context, binding situation.FocusBinding) error {
 	_, err := r.pool.Exec(ctx, `INSERT INTO situation.focus_bindings (focus_binding_id, actor_id, session_id, workspace_id, project_id, goal_id, scope_id, active) VALUES ($1,$2,$3,$4,$5,$6,$7,$8) ON CONFLICT (focus_binding_id) DO UPDATE SET active=EXCLUDED.active`, binding.ID, binding.ActorID, binding.SessionID, binding.Workspace, binding.ProjectID, binding.GoalID, binding.ScopeID, binding.Active)

adapters/postgres/work_repository.go

@@ -25,6 +25,121 @@ var (
 	ErrDevelopmentCandidateConflict = errors.New("development candidate conflict")
 )
 
+func (r *WorkRepository) SaveInvestigation(ctx context.Context, value work.Investigation, expectedRevision int64) error {
+	if !value.Valid() || expectedRevision < 0 {
+		return errors.New("invalid investigation revision")
+	}
+	attempts := make([]string, 0, len(value.AttemptRefs))
+	for _, item := range value.AttemptRefs {
+		attempts = append(attempts, string(item))
+	}
+	hypotheses := make([]string, 0, len(value.HypothesisRefs))
+	for _, item := range value.HypothesisRefs {
+		hypotheses = append(hypotheses, string(item))
+	}
+	findings := make([]string, 0, len(value.FindingRefs))
+	for _, item := range value.FindingRefs {
+		findings = append(findings, string(item))
+	}
+	blockers := append([]string(nil), value.Blockers...)
+	checkpoints := make([]string, 0, len(value.CheckpointRefs))
+	for _, item := range value.CheckpointRefs {
+		checkpoints = append(checkpoints, string(item))
+	}
+	if expectedRevision == 0 {
+		result, err := r.pool.Exec(ctx, `INSERT INTO work.long_running_work(investigation_id,objective,hypothesis_refs,attempt_refs,finding_refs,blockers,checkpoint_refs,next_step,state,revision,time_budget_millis,cost_budget_micros,max_attempts,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14) ON CONFLICT(investigation_id) DO NOTHING`, value.ID, value.Objective, hypotheses, attempts, findings, blockers, checkpoints, value.NextStep, value.State, value.Revision, value.TimeBudgetMillis, value.CostBudgetMicros, value.MaxAttempts, value.RecordedAtUnixMillis)
+		if err != nil {
+			return err
+		}
+		if result.RowsAffected() != 1 {
+			return errors.New("investigation already exists")
+		}
+		return nil
+	}
+	result, err := r.pool.Exec(ctx, `UPDATE work.long_running_work SET objective=$2,hypothesis_refs=$3,attempt_refs=$4,finding_refs=$5,blockers=$6,checkpoint_refs=$7,next_step=$8,state=$9,revision=$10,time_budget_millis=$11,cost_budget_micros=$12,max_attempts=$13,recorded_at_unix_millis=$14 WHERE investigation_id=$1 AND revision=$15`, value.ID, value.Objective, hypotheses, attempts, findings, blockers, checkpoints, value.NextStep, value.State, value.Revision, value.TimeBudgetMillis, value.CostBudgetMicros, value.MaxAttempts, value.RecordedAtUnixMillis, expectedRevision)
+	if err != nil {
+		return err
+	}
+	if result.RowsAffected() != 1 {
+		return errors.New("investigation revision conflict")
+	}
+	return nil
+}
+
+func (r *WorkRepository) LoadInvestigation(ctx context.Context, id work.LongRunningWorkID) (work.Investigation, error) {
+	var value work.Investigation
+	var hypotheses, attempts, findings, blockers, checkpoints []string
+	err := r.pool.QueryRow(ctx, `SELECT investigation_id,objective,hypothesis_refs,attempt_refs,finding_refs,blockers,checkpoint_refs,next_step,state,revision,time_budget_millis,cost_budget_micros,max_attempts,recorded_at_unix_millis FROM work.long_running_work WHERE investigation_id=$1`, id).Scan(&value.ID, &value.Objective, &hypotheses, &attempts, &findings, &blockers, &checkpoints, &value.NextStep, &value.State, &value.Revision, &value.TimeBudgetMillis, &value.CostBudgetMicros, &value.MaxAttempts, &value.RecordedAtUnixMillis)
+	if err != nil {
+		return work.Investigation{}, fmt.Errorf("load investigation: %w", err)
+	}
+	for _, item := range hypotheses {
+		value.HypothesisRefs = append(value.HypothesisRefs, work.EvidenceRef(item))
+	}
+	for _, item := range attempts {
+		value.AttemptRefs = append(value.AttemptRefs, work.AgentRunID(item))
+	}
+	for _, item := range findings {
+		value.FindingRefs = append(value.FindingRefs, work.EvidenceRef(item))
+	}
+	value.Blockers = append(value.Blockers, blockers...)
+	for _, item := range checkpoints {
+		value.CheckpointRefs = append(value.CheckpointRefs, work.AgentCheckpointID(item))
+	}
+	return value, nil
+}
+
+// SaveInvestigationCheckpoint atomically records the checkpoint and marks its
+// attempts verified. The unique key makes retries idempotent.
+func (r *WorkRepository) SaveInvestigationCheckpoint(ctx context.Context, checkpoint work.InvestigationCheckpoint) error {
+	if !checkpoint.Valid() {
+		return errors.New("invalid investigation checkpoint")
+	}
+	tx, err := r.pool.Begin(ctx)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback(ctx)
+	if _, err = tx.Exec(ctx, `INSERT INTO work.investigation_checkpoints(checkpoint_id,investigation_id,completed_attempt_refs,completed_finding_refs,next_step,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5,$6) ON CONFLICT(checkpoint_id) DO NOTHING`, checkpoint.ID, checkpoint.InvestigationID, stringIDs(checkpoint.CompletedAttemptRefs), stringEvidence(checkpoint.CompletedFindingRefs), checkpoint.NextStep, checkpoint.RecordedAtUnixMillis); err != nil {
+		return err
+	}
+	for _, attempt := range checkpoint.CompletedAttemptRefs {
+		if _, err = tx.Exec(ctx, `INSERT INTO work.investigation_attempts(investigation_id,attempt_ref,verified_at_unix_millis) VALUES($1,$2,$3) ON CONFLICT(investigation_id,attempt_ref) DO NOTHING`, checkpoint.InvestigationID, attempt, checkpoint.RecordedAtUnixMillis); err != nil {
+			return err
+		}
+	}
+	return tx.Commit(ctx)
+}
+
+func (r *WorkRepository) UnverifiedInvestigationAttempts(ctx context.Context, id work.LongRunningWorkID, candidates []work.AgentRunID) ([]work.AgentRunID, error) {
+	result := make([]work.AgentRunID, 0, len(candidates))
+	for _, candidate := range candidates {
+		var exists bool
+		if err := r.pool.QueryRow(ctx, `SELECT EXISTS(SELECT 1 FROM work.investigation_attempts WHERE investigation_id=$1 AND attempt_ref=$2)`, id, candidate).Scan(&exists); err != nil {
+			return nil, err
+		}
+		if !exists {
+			result = append(result, candidate)
+		}
+	}
+	return result, nil
+}
+
+func stringIDs(values []work.AgentRunID) []string {
+	result := make([]string, 0, len(values))
+	for _, value := range values {
+		result = append(result, string(value))
+	}
+	return result
+}
+func stringEvidence(values []work.EvidenceRef) []string {
+	result := make([]string, 0, len(values))
+	for _, value := range values {
+		result = append(result, string(value))
+	}
+	return result
+}
+
 func OpenWork(ctx context.Context, config ContinuityConfig) (*WorkRepository, error) {
 	pool, err := openPool(ctx, config)
 	if err != nil {

adapters/postgres/world_repository.go

@@ -0,0 +1,108 @@
+package postgres
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"git.cin.su/m/Assistant/contracts/world"
+	worlddomain "git.cin.su/m/Assistant/modules/world/domain"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+type WorldRepository struct{ pool *pgxpool.Pool }
+
+func OpenWorld(ctx context.Context, config ContinuityConfig) (*WorldRepository, error) {
+	pool, err := openPool(ctx, config)
+	if err != nil {
+		return nil, err
+	}
+	return &WorldRepository{pool: pool}, nil
+}
+
+func (r *WorldRepository) Close() { r.pool.Close() }
+
+func (r *WorldRepository) SaveKindDefinition(ctx context.Context, value world.WorldObjectKindDefinition) error {
+	if err := worlddomain.ValidateKindDefinition(value); err != nil {
+		return err
+	}
+	var parentOwner, parentKind, parentID string
+	var parentRevision *uint64
+	if value.ParentKindRef != nil {
+		parentOwner, parentKind, parentID = value.ParentKindRef.OwnerNamespace, value.ParentKindRef.SemanticKind, string(value.ParentKindRef.StableID)
+		if value.ParentKindRef.Revision != nil {
+			revision := uint64(*value.ParentKindRef.Revision)
+			parentRevision = &revision
+		}
+	}
+	_, err := r.pool.Exec(ctx, `INSERT INTO world.kind_definitions(kind_definition_id,kind_key,revision,display_name,parent_owner_namespace,parent_semantic_kind,parent_stable_id,parent_revision,lifecycle,definition_digest,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11) ON CONFLICT(kind_definition_id) DO NOTHING`, value.ID, value.KindKey, value.Revision, value.DisplayName, parentOwner, parentKind, parentID, parentRevision, value.Lifecycle, value.DefinitionDigest, value.RecordedAt)
+	return err
+}
+
+func (r *WorldRepository) SaveObject(ctx context.Context, value world.WorldObject) error {
+	if err := worlddomain.ValidateObject(value); err != nil {
+		return err
+	}
+	_, err := r.pool.Exec(ctx, `INSERT INTO world.objects(world_object_id,principal_id,kind_owner_namespace,kind_semantic_kind,kind_stable_id,kind_revision,lifecycle,created_at_unix_millis) VALUES($1,$2,$3,$4,$5,$6,$7,$8) ON CONFLICT(world_object_id) DO NOTHING`, value.ID, value.PrincipalID, value.KindDefinitionRef.OwnerNamespace, value.KindDefinitionRef.SemanticKind, value.KindDefinitionRef.StableID, value.KindRevision, value.Lifecycle, value.CreatedAt)
+	return err
+}
+
+func (r *WorldRepository) SaveAlias(ctx context.Context, value world.WorldAlias) error {
+	if err := worlddomain.ValidateAlias(value); err != nil {
+		return err
+	}
+	_, err := r.pool.Exec(ctx, `INSERT INTO world.aliases(world_alias_id,principal_id,world_object_id,alias,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5) ON CONFLICT(world_alias_id) DO NOTHING`, value.ID, value.PrincipalID, value.ObjectID, value.Alias, value.RecordedAt)
+	return err
+}
+
+func (r *WorldRepository) SaveFacetDefinition(ctx context.Context, value world.FacetDefinition) error {
+	if err := worlddomain.ValidateFacetDefinition(value); err != nil {
+		return err
+	}
+	payload, err := json.Marshal(value.ValueType)
+	if err != nil {
+		return fmt.Errorf("encode facet value type: %w", err)
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO world.facet_definitions(facet_definition_id,kind_key,revision,facet_key,value_type,definition_digest,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5,$6,$7) ON CONFLICT(facet_definition_id) DO NOTHING`, value.ID, value.KindKey, value.Revision, value.FacetKey, payload, value.DefinitionDigest, value.RecordedAt)
+	return err
+}
+
+func (r *WorldRepository) SaveRelationDefinition(ctx context.Context, value world.RelationDefinition) error {
+	if err := worlddomain.ValidateRelationDefinition(value); err != nil {
+		return err
+	}
+	_, err := r.pool.Exec(ctx, `INSERT INTO world.relation_definitions(relation_definition_id,kind_key,revision,relation_key,target_kind_key,definition_digest,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5,$6,$7) ON CONFLICT(relation_definition_id) DO NOTHING`, value.ID, value.KindKey, value.Revision, value.RelationKey, value.TargetKindKey, value.DefinitionDigest, value.RecordedAt)
+	return err
+}
+
+func (r *WorldRepository) SaveResolution(ctx context.Context, value world.IdentityResolutionDecisionRecord) error {
+	if err := worlddomain.ValidateResolution(value); err != nil {
+		return err
+	}
+	candidates, err := json.Marshal(value.Candidates)
+	if err != nil {
+		return fmt.Errorf("encode resolution candidates: %w", err)
+	}
+	evidence, err := json.Marshal(value.Evidence)
+	if err != nil {
+		return fmt.Errorf("encode resolution evidence: %w", err)
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO world.identity_resolution_decisions(resolution_decision_id,principal_id,candidates,decision,evidence,confidence_millis,decided_at_unix_millis,revision) VALUES($1,$2,$3,$4,$5,$6,$7,$8) ON CONFLICT(resolution_decision_id) DO NOTHING`, value.ID, value.PrincipalID, candidates, value.Decision, evidence, value.ConfidenceMillis, value.DecidedAt, value.Revision)
+	return err
+}
+
+func (r *WorldRepository) SaveLineage(ctx context.Context, value world.WorldLineage) error {
+	if err := worlddomain.ValidateLineage(value); err != nil {
+		return err
+	}
+	sources, err := json.Marshal(value.SourceRefs)
+	if err != nil {
+		return fmt.Errorf("encode lineage sources: %w", err)
+	}
+	successors, err := json.Marshal(value.SuccessorRefs)
+	if err != nil {
+		return fmt.Errorf("encode lineage successors: %w", err)
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO world.lineage(lineage_id,operation,source_refs,successor_refs,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5) ON CONFLICT(lineage_id) DO NOTHING`, value.ID, value.Operation, sources, successors, value.RecordedAt)
+	return err
+}

adapters/research/search_connector.go

@@ -3,6 +3,7 @@ package research
 import (
 	"context"
 	"crypto/sha256"
+	"encoding/base64"
 	"encoding/hex"
 	"errors"
 	"html"
@@ -19,9 +20,9 @@ import (
 var ErrSearchRejected = errors.New("web search request rejected")
 
 var (
-	searchLinkPattern    = regexp.MustCompile(`(?is)<a[^>]+class=["'][^"']*result__a[^"']*["'][^>]*>(.*?)</a>`)
+	searchLinkPattern    = regexp.MustCompile(`(?is)(<a[^>]+class=["'][^"']*result__a[^"']*["'][^>]*>)(.*?)</a>`)
 	searchSnippetPattern = regexp.MustCompile(`(?is)<a[^>]+class=["'][^"']*result__snippet[^"']*["'][^>]*>(.*?)</a>`)
-	bingLinkPattern      = regexp.MustCompile(`(?is)<li[^>]+class=["'][^"']*b_algo[^"']*["'][^>]*>.*?<h2[^>]*><a[^>]*>(.*?)</a>`)
+	bingLinkPattern      = regexp.MustCompile(`(?is)<li[^>]+class=["'][^"']*b_algo[^"']*["'][^>]*>.*?<h2[^>]*>(<a[^>]*>)(.*?)</a>`)
 	bingSnippetPattern   = regexp.MustCompile(`(?is)<li[^>]+class=["'][^"']*b_algo[^"']*["'][^>]*>.*?<p[^>]*>(.*?)</p>`)
 	tagPattern           = regexp.MustCompile(`(?s)<[^>]*>`)
 	termPattern          = regexp.MustCompile(`(?i)[\p{L}\p{N}]{2,}`)
@@ -36,19 +37,53 @@ var searchStopTerms = map[string]struct{}{
 // cities, weather terms, entities or model names: the complete semantic query
 // comes from the interpretation layer.
 type SearchConnector struct {
-	Client           *http.Client
-	EndpointTemplate string
-	AllowedHosts     map[string]struct{}
-	MaxBytes         int64
-	MaxResults       int
+	Client            *http.Client
+	EndpointTemplate  string
+	AllowedHosts      map[string]struct{}
+	FallbackEndpoints []SearchEndpoint
+	MaxBytes          int64
+	MaxResults        int
+}
+
+// SearchEndpoint is an independently allowlisted web-search route. The
+// connector tries routes in order and stops at the first relevant evidence.
+// This is a source-recovery policy, not a question-type classifier.
+type SearchEndpoint struct {
+	Template     string
+	AllowedHosts map[string]struct{}
 }
 
 func (c SearchConnector) Collect(ctx context.Context, request epistemics.WebSearchRequest, nowUnixMillis int64) ([]epistemics.ResearchCandidate, error) {
 	if request.Plan.Validate() != nil || strings.TrimSpace(request.Query) == "" || nowUnixMillis < 1 || !strings.Contains(c.EndpointTemplate, "%s") {
 		return nil, ErrSearchRejected
 	}
-	endpoint, err := url.Parse(strings.Replace(c.EndpointTemplate, "%s", url.QueryEscape(strings.TrimSpace(request.Query)), 1))
-	if err != nil || endpoint.Scheme != "https" || endpoint.Host == "" || !c.allowedHost(strings.ToLower(endpoint.Hostname())) {
+	endpoints := make([]SearchEndpoint, 0, 1+len(c.FallbackEndpoints))
+	endpoints = append(endpoints, SearchEndpoint{Template: c.EndpointTemplate, AllowedHosts: c.AllowedHosts})
+	endpoints = append(endpoints, c.FallbackEndpoints...)
+	var lastErr error
+	for _, candidateEndpoint := range endpoints {
+		results, err := c.collectEndpoint(ctx, candidateEndpoint, request, nowUnixMillis)
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		if len(results) > 0 {
+			return results, nil
+		}
+	}
+	if lastErr != nil {
+		return nil, lastErr
+	}
+	return nil, nil
+}
+
+func (c SearchConnector) collectEndpoint(ctx context.Context, configured SearchEndpoint, request epistemics.WebSearchRequest, nowUnixMillis int64) ([]epistemics.ResearchCandidate, error) {
+	if !strings.Contains(configured.Template, "%s") {
+		return nil, ErrSearchRejected
+	}
+	searchQuery := enrichedSearchQuery(request.Query)
+	endpoint, err := url.Parse(strings.Replace(configured.Template, "%s", url.QueryEscape(searchQuery), 1))
+	if err != nil || endpoint.Scheme != "https" || endpoint.Host == "" || !allowedHost(configured.AllowedHosts, strings.ToLower(endpoint.Hostname())) {
 		return nil, ErrSearchRejected
 	}
 	client := c.Client
@@ -63,6 +98,10 @@ func (c SearchConnector) Collect(ctx context.Context, request epistemics.WebSear
 	if err != nil {
 		return nil, ErrSearchRejected
 	}
+	// Search providers commonly return a consent/challenge shell to the
+	// default Go client. A neutral browser identification improves the same
+	// generic evidence path for every query without selecting by topic.
+	req.Header.Set("User-Agent", "Mozilla/5.0 (compatible; DomovoyResearch/1.0)")
 	response, err := client.Do(req)
 	if err != nil {
 		return nil, err
@@ -91,7 +130,8 @@ func (c SearchConnector) Collect(ctx context.Context, request epistemics.WebSear
 	snapshotID := epistemics.SourceSnapshotID("snapshot:search:" + base)
 	results := make([]epistemics.ResearchCandidate, 0, len(links))
 	for index, link := range links {
-		title := cleanHTML(string(link[1]))
+		linkURL := resolveSearchResultLocator(extractHref(string(link[1])), endpoint)
+		title := cleanHTML(string(link[2]))
 		snippet := ""
 		if index < len(snippets) {
 			snippet = cleanHTML(string(snippets[index][1]))
@@ -105,7 +145,7 @@ func (c SearchConnector) Collect(ctx context.Context, request epistemics.WebSear
 		results = append(results, epistemics.ResearchCandidate{
 			PropositionKey: request.PropositionKey + ":result:" + ordinal,
 			Statement:      statement,
-			Source:         epistemics.Source{ID: sourceID, Kind: "web-search", Locator: endpoint.String(), Title: title, Publisher: endpoint.Hostname()},
+			Source:         epistemics.Source{ID: sourceID, Kind: "web-search", Locator: linkURL, Title: title, Publisher: sourcePublisher(linkURL, endpoint.Hostname())},
 			Snapshot:       epistemics.SourceSnapshot{ID: snapshotID, SourceID: sourceID, ContentDigest: digestText, CapturedAtUnixMillis: nowUnixMillis, Freshness: epistemics.FreshnessCurrent},
 			Excerpt:        epistemics.SourceExcerpt{ID: excerptID, SnapshotID: snapshotID, Text: statement, Start: 0, End: int64(len(statement))},
 			Evidence:       epistemics.EvidenceObserved, Coverage: epistemics.CoverageComplete, Conflict: epistemics.ConflictNone,
@@ -120,6 +160,11 @@ func (c SearchConnector) Collect(ctx context.Context, request epistemics.WebSear
 func searchStatementRelatesToQuery(query, statement string) bool {
 	terms := termPattern.FindAllString(strings.ToLower(query), -1)
 	content := strings.ToLower(statement)
+	productCue := containsSearchTerm(terms, "видеокарт", "gpu", "процессор", "телефон", "ноутбук", "монитор")
+	if productCue && hasNumericSearchTerm(terms) {
+		contentTerms := termPattern.FindAllString(content, -1)
+		return hasNumericSearchTerm(contentTerms) && containsSearchTerm(contentTerms, "видеокарт", "gpu", "процессор", "телефон", "ноутбук", "монитор")
+	}
 	usable := 0
 	for _, term := range terms {
 		if _, stop := searchStopTerms[term]; stop || len([]rune(term)) < 4 {
@@ -138,7 +183,38 @@ func searchStatementRelatesToQuery(query, statement string) bool {
 	return usable == 0
 }
 
-func (c SearchConnector) allowedHost(host string) bool { _, ok := c.AllowedHosts[host]; return ok }
+func containsSearchTerm(values []string, wanted ...string) bool {
+	for _, value := range values {
+		for _, candidate := range wanted {
+			if strings.Contains(value, candidate) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func hasNumericSearchTerm(values []string) bool {
+	for _, value := range values {
+		for _, runeValue := range value {
+			if runeValue >= '0' && runeValue <= '9' {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func enrichedSearchQuery(query string) string {
+	trimmed := strings.TrimSpace(query)
+	lower := strings.ToLower(trimmed)
+	if (strings.Contains(lower, "цен") || strings.Contains(lower, "стоим")) && !strings.Contains(lower, "куп") {
+		return trimmed + " цена купить сегодня"
+	}
+	return trimmed
+}
+
+func allowedHost(hosts map[string]struct{}, host string) bool { _, ok := hosts[host]; return ok }
 func (c SearchConnector) limit() int {
 	if c.MaxResults <= 0 || c.MaxResults > 8 {
 		return 3
@@ -148,3 +224,53 @@ func (c SearchConnector) limit() int {
 func cleanHTML(value string) string {
 	return strings.Join(strings.Fields(html.UnescapeString(tagPattern.ReplaceAllString(value, ""))), " ")
 }
+
+func extractHref(tag string) string {
+	match := regexp.MustCompile(`(?is)\bhref=["']([^"']+)["']`).FindStringSubmatch(tag)
+	if len(match) == 2 {
+		return match[1]
+	}
+	return ""
+}
+
+func resolveSearchResultLocator(raw string, searchEndpoint *url.URL) string {
+	value := strings.TrimSpace(html.UnescapeString(raw))
+	if value == "" {
+		return searchEndpoint.String()
+	}
+	parsed, err := url.Parse(value)
+	if err != nil {
+		return searchEndpoint.String()
+	}
+	if target := parsed.Query().Get("uddg"); target != "" {
+		value = target
+		parsed, err = url.Parse(target)
+		if err != nil {
+			return searchEndpoint.String()
+		}
+	}
+	if target := parsed.Query().Get("u"); strings.HasPrefix(target, "a1") {
+		if decoded, decodeErr := base64.RawURLEncoding.DecodeString(strings.TrimPrefix(target, "a1")); decodeErr == nil {
+			if targetURL, parseErr := url.Parse(string(decoded)); parseErr == nil {
+				parsed = targetURL
+			}
+		}
+	}
+	if parsed.Scheme == "" {
+		parsed.Scheme = "https"
+	}
+	if parsed.Host == "" && strings.HasPrefix(value, "//") {
+		parsed, err = url.Parse("https:" + value)
+	}
+	if err != nil || parsed.Scheme != "https" || parsed.Host == "" {
+		return searchEndpoint.String()
+	}
+	return parsed.String()
+}
+
+func sourcePublisher(locator, fallback string) string {
+	if parsed, err := url.Parse(locator); err == nil && parsed.Hostname() != "" {
+		return parsed.Hostname()
+	}
+	return fallback
+}

adapters/research/search_connector_test.go

@@ -0,0 +1,57 @@
+package research
+
+import (
+	"context"
+	"crypto/tls"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/epistemics"
+)
+
+func TestSearchConnectorFallsBackToAnotherAllowedSource(t *testing.T) {
+	primary := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(`<html><body>no usable results</body></html>`))
+	}))
+	defer primary.Close()
+	fallback := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(`<a class="result__a" href="https://example.test">Казань: текущая температура 18 °C</a><a class="result__snippet">Наблюдается переменная облачность.</a>`))
+	}))
+	defer fallback.Close()
+	client := fallback.Client()
+	client.Transport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // test servers only
+	request := epistemics.WebSearchRequest{Plan: epistemics.ResearchPlan{ID: "plan:test", Question: "какая погода в Казани", SourceClasses: []string{"web-search"}, FreshnessPolicy: string(epistemics.FreshnessCurrent)}, PropositionKey: "question:test", Query: "какая погода в Казани"}
+	connector := SearchConnector{
+		Client:           client,
+		EndpointTemplate: primary.URL + "?q=%s",
+		AllowedHosts:     map[string]struct{}{strings.TrimPrefix(primary.URL, "https://"): {}},
+		FallbackEndpoints: []SearchEndpoint{{
+			Template:     fallback.URL + "?q=%s",
+			AllowedHosts: map[string]struct{}{strings.TrimPrefix(fallback.URL, "https://"): {}},
+		}},
+	}
+	// The allowlist is hostname-only; test servers include an ephemeral port.
+	connector.AllowedHosts = map[string]struct{}{strings.Split(strings.TrimPrefix(primary.URL, "https://"), ":")[0]: {}}
+	connector.FallbackEndpoints[0].AllowedHosts = map[string]struct{}{strings.Split(strings.TrimPrefix(fallback.URL, "https://"), ":")[0]: {}}
+	results, err := connector.Collect(context.Background(), request, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(results) != 1 || !strings.Contains(results[0].Statement, "18") {
+		t.Fatalf("fallback evidence = %#v", results)
+	}
+	if results[0].Source.Locator != "https://example.test" || results[0].Source.Publisher != "example.test" {
+		t.Fatalf("search result source = %#v", results[0].Source)
+	}
+}
+
+func TestEnrichedSearchQueryAddsPriceSignalsOnlyToPriceRequests(t *testing.T) {
+	if got := enrichedSearchQuery("проверь цену на видеокарту 4090"); got != "проверь цену на видеокарту 4090 цена купить сегодня" {
+		t.Fatalf("price query = %q", got)
+	}
+	if got := enrichedSearchQuery("какая погода в Казани"); got != "какая погода в Казани" {
+		t.Fatalf("non-price query = %q", got)
+	}
+}

architecture/adrs/ADR-0014-assistant-presence-attention-human-surface.md

@@ -32,7 +32,7 @@ The system already has the correct outbound mutation foundation: Commit owns aut
 
 ## Non-goals
 
-- No Gmail, MCP, Codex Bridge, browser automation, mobile app, voice, or self-extension loop.
+- No Gmail, MCP, Codex Bridge, mobile app, voice, or self-extension loop. Browser automation is allowed only under ADR-0019 as bounded read-only observation; it is not a human-surface command or mutation channel.
 - No new canonical owner.
 - No generic scheduler/event-bus/autonomous-agent loop.
 - No new third-party dependency.

architecture/adrs/ADR-0015-human-response-continuation-semantics.md

@@ -30,7 +30,7 @@ Examples include: a reminder after notification, waiting work requiring a decisi
 
 ## Non-goals
 
-- No Codex Bridge, Gmail, MCP, voice, mobile, browser automation, self-extension loop, or generalized orchestration.
+- No Codex Bridge, Gmail, MCP, voice, mobile, self-extension loop, or generalized orchestration. Browser observation may be used only through the bounded read-only capability defined by ADR-0019 and cannot continue or mutate a response target.
 - No universal object ontology.
 - No reminder-specific parallel subsystem.
 

architecture/adrs/ADR-0019-bounded-site-browser-observation.md

@@ -0,0 +1,34 @@
+# ADR-0019 — Bounded Site-Browser Observation
+
+Status: Accepted
+
+Task: DEV-000293
+
+## Context
+
+Search snippets are insufficient for dynamic pages such as marketplaces: they may expose a category page while hiding the current product price behind client-side rendering. Domovoy needs a replaceable observation capability that can inspect an allowlisted rendered page without becoming an account agent, universal scraper, or external mutation path.
+
+## Decision
+
+1. Browser automation is allowed only as a server-owned, read-only observation capability behind the existing Capability and research adapter boundaries.
+2. The browser runtime may navigate only to an explicit HTTPS host allowlist and bounded navigation policy. Browser-supplied or model-supplied authority, credentials, proxy settings, cookies, headers, download paths, or arbitrary JavaScript are rejected.
+3. The capability may load public pages and wait for bounded client-side rendering. It may read visible text and explicitly declared structured-data selectors, then return an Epistemics Observation with source URL, observed time, coverage, and failure state.
+4. Login, cookies, account state, CAPTCHA solving, checkout, form submission, uploads, downloads, purchases, messages, mutations, and external side effects are out of scope.
+5. A blocked page, challenge, timeout, partial DOM, missing price, or conflicting value remains `UNKNOWN`, `PARTIAL`, or `NOT_OBSERVED`; it never becomes a verified fact by model interpretation alone.
+6. Browser observation is optional. Search-only routing remains the fallback when the capability is unavailable, degraded, or not allowlisted for the requested host.
+7. Capability owns availability, host policy, health and limits. Epistemics owns the resulting observation and provenance. No new canonical owner or database schema is introduced.
+8. The first implementation may be development-only. Production activation requires independent capability health, allowlist evidence, adversarial navigation tests, and a live read-only smoke test.
+
+## Boundaries
+
+- Core/domain code does not import a browser or provider runtime.
+- The browser adapter performs only bounded GET/navigation observation and cannot reach Commit/Executor.
+- Secrets remain outside the browser runtime and its artifacts, logs, screenshots, page content and chat context.
+- An observation is evidence for answer synthesis, not an instruction to mutate a site or canonical state.
+
+## Consequences
+
+- Dynamic public pages can provide stronger evidence than search snippets when the site permits it.
+- Site-specific selectors and host policy are replaceable adapter configuration, not semantic domain logic.
+- Browser unavailability is a capability gap, not a runtime-wide outage.
+- The old blanket prohibition on browser automation is replaced by this narrower, testable boundary.

architecture/adrs/ADR-0020-architecture-generation-2.md

@@ -0,0 +1,45 @@
+# ADR-0020 — Architecture Generation 2 governance adoption
+
+**Status:** Accepted by `ARCH-GEN2-000`
+**Date:** 2026-08-29
+**Scope:** Architecture and governance only; no runtime or schema migration.
+
+## Decision
+
+Assistant adopts the documents under `docs/DOMOVOY_CONSTITUTION.md`,
+`architecture/GEN2_TARGET_ARCHITECTURE.md`,
+`architecture/GEN2_CANONICAL_DATA_MODEL.md`,
+`development/GEN2_MIGRATION_MAP.md`,
+`development/GEN2_MASTER_PLAN.md`, and the execution contract as the
+canonical Architecture Generation 2 governance basis.
+
+The existing V1 implementation remains the rollback and compatibility
+baseline. This decision authorizes subsequent, separately accepted Gen2
+packets to introduce the World, Configuration, and SELF bounded owners and
+Gen2 migrations, subject to explicit ownership, schema, contract, and
+rollback decisions in those packets. It does not create those owners or
+change canonical runtime state in this task.
+
+## Authority and execution order
+
+The Gen2 constitution and accepted architecture decisions govern the Gen2
+program. The target architecture, canonical data model, migration map,
+master plan, execution contract, task index, and individual task packet are
+interpreted in that order. A lower-level packet cannot silently weaken a
+higher-level invariant or reorder the task index.
+
+Every Gen2 task starts from `gen2-integration`, uses the active task pointer,
+and passes the declared FAST/MILESTONE/FULL gate before merge. `ARCH-GEN2-000`
+is the architecture adoption root accepted against the PRE baseline;
+`GEN2-001` and later tasks are not accepted by this decision and require
+separate execution.
+
+## Invariants preserved
+
+- No new canonical owner, cross-module dependency, privilege, database role,
+  third-party dependency, runtime writer, event, or migration is introduced.
+- Existing Authority → Commit → Executor boundaries remain mandatory.
+- Memory remains a rebuildable retrieval fabric, World is not a generic truth
+  owner, and SELF is not a monolithic orchestrator.
+- The `domovoy-pre-gen2` baseline tag remains immutable and is the rollback
+  point until a later migration task explicitly establishes another one.

architecture/adrs/ADR-0021-delegated-noninteractive-control-plane-authority.md

@@ -0,0 +1,62 @@
+# ADR-0021 — Delegated Non-Interactive Control-Plane Authority
+
+Status: Accepted
+Date: 2026-08-31
+Accepted under: owner decision for GEN2-AUTHORITY-001
+
+## Context
+
+The existing Creator session endpoints correctly require a human principal for
+governed Cognitive CANARY and ACTIVE transitions. A bounded background task
+cannot use those endpoints without either a browser session, impersonation, or
+a direct Capability write. All three alternatives are invalid.
+
+## Decision
+
+1. Identity remains the sole owner of Actors, Principals and their bindings. A
+   service principal is a separately identified Actor/Principal binding; it is
+   neither a Human Principal nor an impersonation of one.
+2. Authority remains the sole owner of delegated task grants, validation,
+   revocation and safe action audit. This extends `AuthorityGrant`; it does not
+   introduce a robot-authority owner or a second authorization registry.
+3. A delegated grant is typed and narrow: service principal, task id and
+   revision, operation capability, exact Cognitive binding resource/revision,
+   issuer, issue/expiry times, grant revision and lifecycle status. It is
+   default-deny and cannot authorize grant creation, extension, policy change,
+   or administration.
+4. A control-plane request is authorized in the existing `commit-runtime`, the
+   runtime topology location of Authority. It must pass two independent checks: service credential
+   authentication and a current delegated-grant authorization for its exact
+   task/operation/resource. Credential possession never expands authority.
+5. Long-lived credential material remains only in the existing protected secret
+   backend and is addressed by a `CredentialRef` plus bootstrap file reference.
+   The runtime never logs, persists, or returns its token. Rotation changes the
+   protected artifact; revocation of a grant blocks new actions immediately.
+6. Capability remains the only owner of Cognitive binding/evaluation lifecycle.
+   The delegated path invokes the existing owner validation and promotion
+   builders; it cannot synthesize an evaluation or mark a binding active.
+7. Control-plane actions receive durable Authority audit records containing
+   identity, task, operation, resource, decision and safe result reference.
+   Secret values, request payloads, user memory and hidden reasoning are never
+   stored in that audit.
+8. External mutations continue to use Commit/Executor/Receipt/Outcome where
+   the existing action is an external effect. Capability's owner-local binding
+   lifecycle remains an owner-local governed state transition, not a shortcut
+   around an external executor.
+
+## Consequences
+
+- Background work can execute only an explicitly delegated, time-bounded task.
+- Restart reconstructs authorization from Identity/Authority durable state; no
+  process-local permission cache is authoritative.
+- Each later task must receive a new delegated grant. A grant for
+  GEN2-COGNITIVE-003 cannot be reused for SELF development or code promotion.
+- The first implementation deliberately covers only the Cognitive lifecycle
+  operations required by GEN2-COGNITIVE-003. Broader control-plane actions
+  need their own task-scoped authority and acceptance evidence.
+
+## Rollback
+
+Disable or revoke the delegated grant and route no new non-interactive requests
+to the endpoint. Existing Authority audit and Capability history remain
+append-only evidence; no binding state is rolled back by deleting history.

architecture/architecture-registry.json

@@ -1,7 +1,7 @@
 {
   "registry_version": 1,
   "semantic_generation": 1,
-  "architecture_generation": 1,
+  "architecture_generation": 2,
   "modules": {
     "identity": {
       "id": "mod.identity",
@@ -179,6 +179,30 @@
       "database_schema": "interaction",
       "boundary_class": "remote_capable",
       "may_depend_on": ["contracts.identity", "contracts.situation", "contracts.epistemics", "contracts.cognitive", "platform.ids", "platform.events"]
+    },
+    "world": {
+      "id": "mod.world",
+      "owns": ["WorldObject", "WorldObjectKindDefinition", "WorldAlias", "FacetDefinition", "RelationDefinition", "IdentityResolutionCandidate", "IdentityResolutionDecision", "WorldLineage"],
+      "database_schema": "world",
+      "boundary_class": "remote_capable",
+      "may_depend_on": ["contracts.identity", "platform.ids", "platform.events"],
+      "forbidden": ["adapters.models", "adapters.temporal", "claims", "beliefs", "observations"]
+    },
+    "configuration": {
+      "id": "mod.configuration",
+      "owns": ["SettingDefinition", "SettingAssignment", "ConfigurationRevision", "ConfigurationChangeProvenance"],
+      "database_schema": "configuration",
+      "boundary_class": "remote_capable",
+      "may_depend_on": ["contracts.identity", "contracts.authority", "platform.ids", "platform.events", "platform.secrets"],
+      "forbidden": ["secret_values", "arbitrary_key_value_without_definition"]
+    },
+    "self": {
+      "id": "mod.self",
+      "owns": ["CompetenceAssessment", "WeaknessPattern", "DependencyAssessment", "LearningLedgerEntry", "ImprovementNeed", "SelfVersionView", "SelfEvaluationInterpretation"],
+      "database_schema": "self",
+      "boundary_class": "remote_capable",
+      "may_depend_on": ["contracts.capability", "contracts.epistemics", "contracts.artifact", "platform.ids", "platform.events"],
+      "forbidden": ["adapters.models", "tasks", "authority_grants", "code_release_switching"]
     }
   },
   "platform": {
@@ -244,6 +268,26 @@
     "cross_owner_write": "forbidden",
     "cross_owner_application_join": "forbidden"
   },
+  "runtime_topology_v2": {
+    "core_runtime": {
+      "modules": ["identity", "situation", "work", "epistemics", "capability", "artifact", "interaction", "world", "configuration", "self"]
+    },
+    "continuity_runtime": {"modules": ["continuity"]},
+    "commit_runtime": {"modules": ["authority", "commit"]},
+    "cognitive_workers": {"modules": [], "role": "replaceable reasoning/context workers; no canonical ownership"},
+    "supervisor_runtime": {"modules": [], "role": "release health, switch, rollback and recovery; not a semantic owner"}
+  },
+  "storage_topology_v2": {
+    "postgres_cluster": "assistant_primary",
+    "schemas": {
+      "identity": "identity_role", "authority": "authority_role", "situation": "situation_role", "work": "work_role",
+      "epistemics": "epistemics_role", "continuity": "continuity_role", "capability": "capability_role", "commit": "commit_role",
+      "artifact": "artifact_role", "interaction": "interaction_role", "world": "world_role", "configuration": "configuration_role", "self": "self_role"
+    },
+    "cross_owner_fk": "forbidden_by_default",
+    "cross_owner_write": "forbidden",
+    "cross_owner_application_join": "forbidden"
+  },
   "invariants": [
     {
       "id": "INV-AUTH-001",
@@ -309,6 +353,14 @@
     ".gitea/workflows/ci.yml",
     "cmd/devctl/**",
     "dev/ACTIVE_TASK.json",
+    "docs/DOMOVOY_CONSTITUTION.md",
+    "docs/DOMOVOY_GEN2_GAP_MAP.md",
+    "architecture/GEN2_TARGET_ARCHITECTURE.md",
+    "architecture/GEN2_CANONICAL_DATA_MODEL.md",
+    "development/GEN2_MIGRATION_MAP.md",
+    "development/GEN2_MASTER_PLAN.md",
+    "development/GEN2_EXECUTION_CONTRACT.md",
+    "development/GEN2_TASK_INDEX.md",
     "security/**"
   ],
   "default_feature_task_authority": {

architecture/architecture-registry.yaml

@@ -1,6 +1,6 @@
 registry_version: 1
 semantic_generation: 1
-architecture_generation: 1
+architecture_generation: 2
 
 modules:
   identity:
@@ -75,6 +75,30 @@ modules:
     boundary_class: remote_capable
     may_depend_on: [contracts.identity, contracts.situation, contracts.epistemics, contracts.cognitive, platform.ids, platform.events]
 
+  world:
+    id: mod.world
+    owns: [WorldObject, WorldObjectKindDefinition, WorldAlias, FacetDefinition, RelationDefinition, IdentityResolutionCandidate, IdentityResolutionDecision, WorldLineage]
+    database_schema: world
+    boundary_class: remote_capable
+    may_depend_on: [contracts.identity, platform.ids, platform.events]
+    forbidden: [adapters.models, adapters.temporal, claims, beliefs, observations]
+
+  configuration:
+    id: mod.configuration
+    owns: [SettingDefinition, SettingAssignment, ConfigurationRevision, ConfigurationChangeProvenance]
+    database_schema: configuration
+    boundary_class: remote_capable
+    may_depend_on: [contracts.identity, contracts.authority, platform.ids, platform.events, platform.secrets]
+    forbidden: [secret_values, arbitrary_key_value_without_definition]
+
+  self:
+    id: mod.self
+    owns: [CompetenceAssessment, WeaknessPattern, DependencyAssessment, LearningLedgerEntry, ImprovementNeed, SelfVersionView, SelfEvaluationInterpretation]
+    database_schema: self
+    boundary_class: remote_capable
+    may_depend_on: [contracts.capability, contracts.epistemics, contracts.artifact, platform.ids, platform.events]
+    forbidden: [adapters.models, tasks, authority_grants, code_release_switching]
+
 platform:
   allowed_packages:
     - platform.ids
@@ -98,6 +122,20 @@ runtime_topology_v1:
     modules: []
     role: "replaceable cognition/context compilation workers; no canonical ownership"
 
+runtime_topology_v2:
+  core_runtime:
+    modules: [identity, situation, work, epistemics, capability, artifact, interaction, world, configuration, self]
+  continuity_runtime:
+    modules: [continuity]
+  commit_runtime:
+    modules: [authority, commit]
+  cognitive_workers:
+    modules: []
+    role: "replaceable reasoning/context workers; no canonical ownership"
+  supervisor_runtime:
+    modules: []
+    role: "release health, switch, rollback and recovery; not a semantic owner"
+
 storage_topology_v1:
   postgres_cluster: assistant_primary
   schemas:
@@ -115,6 +153,26 @@ storage_topology_v1:
   cross_owner_write: forbidden
   cross_owner_application_join: forbidden
 
+storage_topology_v2:
+  postgres_cluster: assistant_primary
+  schemas:
+    identity: identity_role
+    authority: authority_role
+    situation: situation_role
+    work: work_role
+    epistemics: epistemics_role
+    continuity: continuity_role
+    capability: capability_role
+    commit: commit_role
+    artifact: artifact_role
+    interaction: interaction_role
+    world: world_role
+    configuration: configuration_role
+    self: self_role
+  cross_owner_fk: forbidden_by_default
+  cross_owner_write: forbidden
+  cross_owner_application_join: forbidden
+
 invariants:
   - id: INV-AUTH-001
     property: "No external mutation without current valid authority and target/revision checks"
@@ -149,6 +207,14 @@ protected_paths:
   - .gitea/workflows/ci.yml
   - cmd/devctl/**
   - dev/ACTIVE_TASK.json
+  - docs/DOMOVOY_CONSTITUTION.md
+  - docs/DOMOVOY_GEN2_GAP_MAP.md
+  - architecture/GEN2_TARGET_ARCHITECTURE.md
+  - architecture/GEN2_CANONICAL_DATA_MODEL.md
+  - development/GEN2_MIGRATION_MAP.md
+  - development/GEN2_MASTER_PLAN.md
+  - development/GEN2_EXECUTION_CONTRACT.md
+  - development/GEN2_TASK_INDEX.md
   - security/**
 
 default_feature_task_authority:

cmd/auth-acceptance-harness/main.go

@@ -0,0 +1,108 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"git.cin.su/m/Assistant/contracts/identity"
+	"git.cin.su/m/Assistant/contracts/interaction"
+)
+
+const tokenPath = "/run/secrets/acceptance_harness_service_token"
+
+type client struct {
+	base  string
+	token string
+	http  *http.Client
+}
+
+func main() {
+	base := strings.TrimRight(os.Getenv("CORE_RUNTIME_URL"), "/")
+	if base == "" {
+		base = "http://core-runtime-candidate:8080"
+	}
+	token, err := os.ReadFile(tokenPath)
+	if err != nil {
+		fail("acceptance credential unavailable")
+	}
+	c := client{base: base, token: strings.TrimSpace(string(token)), http: &http.Client{Timeout: 90 * time.Second}}
+	if strings.TrimSpace(c.token) == "" {
+		fail("acceptance credential unavailable")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer cancel()
+	var issued struct {
+		Token   string
+		Session identity.CreatorSession
+	}
+	if err := c.post(ctx, "/v1/acceptance/sessions", nil, &issued); err != nil {
+		fail("acceptance authentication failed: " + err.Error())
+	}
+	if issued.Token == "" || issued.Session.PrincipalKind != identity.PrincipalKindService {
+		fail("acceptance principal was not authenticated as service")
+	}
+	c.token = issued.Token
+	var first interaction.ChatMessageResponse
+	if err := c.post(ctx, "/v1/creator/chat/messages", interaction.ChatMessageRequest{Message: "synthetic acceptance statement", CorrelationID: "acceptance-harness", SyntheticAcceptance: true, SyntheticScopeID: "synthetic-acceptance-scope"}, &first); err != nil {
+		fail("synthetic interaction failed: " + err.Error())
+	}
+	var corrected interaction.ChatMessageResponse
+	if err := c.post(ctx, "/v1/creator/chat/messages", interaction.ChatMessageRequest{ConversationID: first.ConversationID, Message: "synthetic acceptance correction", CorrelationID: "acceptance-harness-correction", CorrectsUtteranceID: first.UtteranceID, SyntheticAcceptance: true, SyntheticScopeID: "synthetic-acceptance-scope"}, &corrected); err != nil {
+		fail("synthetic correction failed: " + err.Error())
+	}
+	var summary struct {
+		LearningSignals  int `json:"learning_signals"`
+		ImprovementNeeds int `json:"improvement_needs"`
+		LearningLedger   int `json:"learning_ledger"`
+	}
+	if err := c.get(ctx, "/v1/acceptance/self/summary", &summary); err != nil {
+		fail("acceptance SELF summary unavailable: " + err.Error())
+	}
+	fmt.Printf("acceptance_pass learning_signals=%d improvement_needs=%d learning_ledger=%d\n", summary.LearningSignals, summary.ImprovementNeeds, summary.LearningLedger)
+}
+
+func (c client) post(ctx context.Context, path string, body any, out any) error {
+	return c.request(ctx, http.MethodPost, path, body, out)
+}
+func (c client) get(ctx context.Context, path string, out any) error {
+	return c.request(ctx, http.MethodGet, path, nil, out)
+}
+func (c client) request(ctx context.Context, method, path string, body any, out any) error {
+	var reader io.Reader
+	if body != nil {
+		data, err := json.Marshal(body)
+		if err != nil {
+			return err
+		}
+		reader = bytes.NewReader(data)
+	}
+	req, err := http.NewRequestWithContext(ctx, method, c.base+path, reader)
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Authorization", "Bearer "+c.token)
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("acceptance request denied with status %d", resp.StatusCode)
+	}
+	if out != nil && json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(out) != nil {
+		return errors.New("invalid acceptance response")
+	}
+	return nil
+}
+func fail(message string) { fmt.Fprintln(os.Stderr, message); os.Exit(1) }

cmd/cognitive-worker/admission_test.go

@@ -16,15 +16,17 @@ func (p *admissionTestProvider) Advise(context.Context, cognitive.AdvisoryReques
 }
 
 type admissionTestClient struct {
-	decision capability.AdmissionDecision
-	releases int
+	decision          capability.AdmissionDecision
+	releases          int
+	releaseContextErr error
 }
 
 func (c *admissionTestClient) Admit(context.Context, string, capability.AdmissionRequest) (capability.AdmissionDecision, capability.AdmissionLease, error) {
 	return c.decision, capability.AdmissionLease{ID: "lease-1", PolicyID: "policy-1"}, nil
 }
-func (c *admissionTestClient) Release(context.Context, capability.AdmissionLease) error {
+func (c *admissionTestClient) Release(ctx context.Context, _ capability.AdmissionLease) error {
 	c.releases++
+	c.releaseContextErr = ctx.Err()
 	return nil
 }
 
@@ -47,3 +49,14 @@ func TestInvokeAdmittedReleasesDurableLeaseAfterProvider(t *testing.T) {
 		t.Fatalf("admitted lease was not released: response=%#v err=%v calls=%d releases=%d", response, err, provider.calls, client.releases)
 	}
 }
+
+func TestInvokeAdmittedReleasesLeaseAfterCallerCancellation(t *testing.T) {
+	provider := &admissionTestProvider{}
+	client := &admissionTestClient{decision: capability.AdmissionDecision{State: capability.AdmissionAdmitted, Reason: capability.AdmissionReasonNone, PolicyID: "policy-1"}}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	_, _ = (&cognitiveGateway{admission: client}).invokeAdmitted(ctx, "request-1", provider, cognitive.AdvisoryRequest{Message: "hello"}, 100)
+	if client.releases != 1 || client.releaseContextErr != nil {
+		t.Fatalf("cancelled caller leaked durable lease: releases=%d release_context_err=%v", client.releases, client.releaseContextErr)
+	}
+}

cmd/cognitive-worker/discovery.go

@@ -1,7 +1,9 @@
 package main
 
 import (
+	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"sort"
 	"time"
@@ -22,17 +24,7 @@ func (s discoveryService) handler(w http.ResponseWriter, r *http.Request) {
 		s.statusHandler(w, r)
 		return
 	}
-	registration, ok := s.providers[r.PathValue("provider")]
-	if !ok || registration.Discovery == nil {
-		http.Error(w, "provider discovery not found", http.StatusNotFound)
-		return
-	}
-	discovered, probe := registration.Discovery.Discover(r.Context())
-	snapshot := capability.CognitiveDiscoverySnapshot{ProviderInstanceID: registration.ProviderInstanceID, ProviderKind: registration.Kind, EndpointRef: registration.EndpointRef, CredentialRef: registration.CredentialRef, AuthMode: registration.AuthMode, BillingMode: registration.BillingMode, Enabled: true, OwnerPrincipalID: s.owner, CapabilityID: creatorAdvisoryCapabilityID, DataPolicy: registration.DataPolicy, LimitPolicyRef: "creator-advisory-local-v1", Health: probe.Health, FailureClass: capability.CognitiveFailureType(probe.Failure), ObservedAtUnixMillis: s.now().UnixMilli()}
-	for _, model := range discovered {
-		snapshot.Models = append(snapshot.Models, capability.DiscoveredModelSnapshot{ProviderModelID: model.ProviderModelID, Fingerprint: model.Fingerprint, MaxContextBytes: model.MaxContextBytes, Modalities: model.Modalities, Capabilities: model.Capabilities, Installed: capability.OperationalYes, Loaded: capability.OperationalNotObserved, Invokable: capability.OperationalNotObserved})
-	}
-	result, err := s.resolver.RegisterDiscovery(r.Context(), snapshot)
+	result, err := s.register(r.Context(), r.PathValue("provider"))
 	if err != nil {
 		http.Error(w, "provider discovery registration unavailable", http.StatusBadGateway)
 		return
@@ -41,6 +33,19 @@ func (s discoveryService) handler(w http.ResponseWriter, r *http.Request) {
 	_ = json.NewEncoder(w).Encode(result)
 }
 
+func (s discoveryService) register(ctx context.Context, provider string) (capability.CognitiveDiscoveryRegistration, error) {
+	registration, ok := s.providers[provider]
+	if !ok || registration.Discovery == nil {
+		return capability.CognitiveDiscoveryRegistration{}, fmt.Errorf("provider discovery not found")
+	}
+	discovered, probe := registration.Discovery.Discover(ctx)
+	snapshot := capability.CognitiveDiscoverySnapshot{ProviderInstanceID: registration.ProviderInstanceID, ProviderKind: registration.Kind, EndpointRef: registration.EndpointRef, CredentialRef: registration.CredentialRef, AuthMode: registration.AuthMode, BillingMode: registration.BillingMode, Enabled: true, OwnerPrincipalID: s.owner, CapabilityID: creatorAdvisoryCapabilityID, DataPolicy: registration.DataPolicy, LimitPolicyRef: "creator-advisory-local-v1", Health: probe.Health, FailureClass: capability.CognitiveFailureType(probe.Failure), ObservedAtUnixMillis: s.now().UnixMilli()}
+	for _, model := range discovered {
+		snapshot.Models = append(snapshot.Models, capability.DiscoveredModelSnapshot{ProviderModelID: model.ProviderModelID, Fingerprint: model.Fingerprint, MaxContextBytes: model.MaxContextBytes, Modalities: model.Modalities, Capabilities: model.Capabilities, Installed: capability.OperationalYes, Loaded: capability.OperationalNotObserved, Invokable: capability.OperationalNotObserved})
+	}
+	return s.resolver.RegisterDiscovery(ctx, snapshot)
+}
+
 type discoveryStatus struct {
 	Provider             string                          `json:"provider"`
 	ProviderKind         capability.ProviderKind         `json:"provider_kind"`

cmd/cognitive-worker/fleet_status.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net/http"
 	"strings"
+	"sync"
 	"time"
 
 	"git.cin.su/m/Assistant/contracts/capability"
@@ -19,6 +20,7 @@ type fleetEndpoint struct {
 	URL        string
 	Headers    map[string]string
 	Client     *http.Client
+	Timeout    time.Duration
 }
 
 type fleetStatusResponse struct {
@@ -31,35 +33,16 @@ type fleetStatusResponse struct {
 func fleetReadinessHandler(client *http.Client, preferred capability.FleetTier, endpoints []fleetEndpoint) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		members := make([]capability.FleetMember, 0, len(endpoints))
-		for _, endpoint := range endpoints {
-			member := capability.FleetMember{ProviderInstanceID: capability.ProviderInstanceID(endpoint.ProviderID), ModelDescriptorID: capability.ModelDescriptorID(endpoint.ModelID), Tier: endpoint.Tier, Reason: "NOT_CONFIGURED"}
-			if strings.TrimSpace(endpoint.URL) == "" {
-				members = append(members, member)
-				continue
-			}
-			request, err := http.NewRequestWithContext(r.Context(), http.MethodGet, endpoint.URL, nil)
-			if err == nil {
-				for name, value := range endpoint.Headers {
-					request.Header.Set(name, value)
-				}
-				probeClient := endpoint.Client
-				if probeClient == nil {
-					probeClient = client
-				}
-				response, requestErr := probeClient.Do(request)
-				if requestErr == nil {
-					response.Body.Close()
-					if response.StatusCode >= 200 && response.StatusCode < 300 {
-						member.Ready, member.Reason = true, "AVAILABLE"
-					} else {
-						member.Reason = fmt.Sprintf("status=%s", response.Status)
-					}
-				} else {
-					member.Reason = requestErr.Error()
-				}
-			}
-			members = append(members, member)
+		members = make([]capability.FleetMember, len(endpoints))
+		var waitGroup sync.WaitGroup
+		for index, endpoint := range endpoints {
+			waitGroup.Add(1)
+			go func(index int, endpoint fleetEndpoint) {
+				defer waitGroup.Done()
+				members[index] = probeFleetEndpoint(r.Context(), client, endpoint)
+			}(index, endpoint)
 		}
+		waitGroup.Wait()
 		readiness, err := fleetdomain.BuildFleetReadiness(time.Now().UnixMilli(), members)
 		response := fleetStatusResponse{Readiness: readiness, Preferred: preferred}
 		if err == nil {
@@ -76,4 +59,41 @@ func fleetReadinessHandler(client *http.Client, preferred capability.FleetTier,
 	})
 }
 
+func probeFleetEndpoint(parent context.Context, fallbackClient *http.Client, endpoint fleetEndpoint) capability.FleetMember {
+	member := capability.FleetMember{ProviderInstanceID: capability.ProviderInstanceID(endpoint.ProviderID), ModelDescriptorID: capability.ModelDescriptorID(endpoint.ModelID), Tier: endpoint.Tier, Reason: "NOT_CONFIGURED"}
+	if strings.TrimSpace(endpoint.URL) == "" {
+		return member
+	}
+	timeout := endpoint.Timeout
+	if timeout <= 0 {
+		timeout = 2 * time.Second
+	}
+	ctx, cancel := context.WithTimeout(parent, timeout)
+	defer cancel()
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint.URL, nil)
+	if err != nil {
+		member.Reason = err.Error()
+		return member
+	}
+	for name, value := range endpoint.Headers {
+		request.Header.Set(name, value)
+	}
+	probeClient := endpoint.Client
+	if probeClient == nil {
+		probeClient = fallbackClient
+	}
+	response, requestErr := probeClient.Do(request)
+	if requestErr != nil {
+		member.Reason = requestErr.Error()
+		return member
+	}
+	defer response.Body.Close()
+	if response.StatusCode >= 200 && response.StatusCode < 300 {
+		member.Ready, member.Reason = true, "AVAILABLE"
+	} else {
+		member.Reason = fmt.Sprintf("status=%s", response.Status)
+	}
+	return member
+}
+
 func fleetContext(ctx context.Context) context.Context { return ctx }

cmd/cognitive-worker/fleet_status_test.go

@@ -5,6 +5,7 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 
 	"git.cin.su/m/Assistant/contracts/capability"
 )
@@ -26,6 +27,29 @@ func TestFleetReadinessSelectsBestAvailablePrimaryTierBeforeLifeboat(t *testing.
 	}
 }
 
+func TestFleetReadinessDoesNotWaitForSlowMembersSerially(t *testing.T) {
+	slow := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		time.Sleep(150 * time.Millisecond)
+		w.WriteHeader(http.StatusServiceUnavailable)
+	}))
+	defer slow.Close()
+	fast := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusOK) }))
+	defer fast.Close()
+	handler := fleetReadinessHandler(fast.Client(), capability.FleetTierFast, []fleetEndpoint{
+		{ProviderID: "slow", ModelID: "slow-model", Tier: capability.FleetTierMedium, URL: slow.URL},
+		{ProviderID: "lifeboat", ModelID: "lifeboat-model", Tier: capability.FleetTierLifeboat, URL: fast.URL},
+	})
+	started := time.Now()
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/v1/fleet/readiness", nil))
+	if recorder.Code != http.StatusOK || !strings.Contains(recorder.Body.String(), `"selected_tier":"LIFEBOAT"`) {
+		t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String())
+	}
+	if elapsed := time.Since(started); elapsed >= 300*time.Millisecond {
+		t.Fatalf("fleet readiness was serialized: elapsed=%s", elapsed)
+	}
+}
+
 func TestFleetReadinessSendsConfiguredProviderHeaders(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Header.Get("Authorization") != "Bearer fleet-key" {
@@ -44,3 +68,21 @@ func TestFleetReadinessSendsConfiguredProviderHeaders(t *testing.T) {
 		t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String())
 	}
 }
+
+func TestFleetReadinessUsesProviderSpecificTimeout(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		time.Sleep(40 * time.Millisecond)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	handler := fleetReadinessHandler(server.Client(), capability.FleetTierMedium, []fleetEndpoint{{
+		ProviderID: "medium", ModelID: "medium-model", Tier: capability.FleetTierMedium,
+		URL: server.URL, Client: server.Client(), Timeout: 100 * time.Millisecond,
+	}})
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/v1/fleet/readiness", nil))
+	if recorder.Code != http.StatusOK || !strings.Contains(recorder.Body.String(), `"selected_tier":"MEDIUM"`) {
+		t.Fatalf("provider-specific timeout was not honored: status=%d body=%s", recorder.Code, recorder.Body.String())
+	}
+}

cmd/cognitive-worker/gateway.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -20,6 +21,8 @@ import (
 
 const creatorAdvisoryCapabilityID capability.CapabilityID = "creator-advisory"
 
+var errNoInvocableCognitiveBinding = errors.New("no invocable cognitive binding")
+
 type bindingResolver interface {
 	Resolve(context.Context, capability.CognitiveRequirement) (capability.ResolvedCognitiveBinding, error)
 	Observe(context.Context, capability.CognitiveUsageObservation) error
@@ -56,6 +59,7 @@ type cognitiveGateway struct {
 	allowCanary          bool
 	canaryMaxOutputBytes int
 	admission            admissionClient
+	revalidatePrimary    func(context.Context) error
 }
 
 func (g cognitiveGateway) policyHandler(w http.ResponseWriter, r *http.Request) {
@@ -89,7 +93,7 @@ func (g cognitiveGateway) advisoryHandler(w http.ResponseWriter, r *http.Request
 		maxOutputBytes = g.canaryMaxOutputBytes
 	}
 	requirement := capability.CognitiveRequirement{CapabilityID: creatorAdvisoryCapabilityID, OwnerPrincipalID: request.PrincipalID, DataPolicy: request.DataPolicy, RequiredModalities: []capability.ModelModality{capability.ModalityText}, RequiredCapabilities: []capability.ModelCapability{capability.CapabilityAdvisory}, AllowCanary: g.allowCanary, InputBytes: int64(len(request.Message)), MaxOutputBytes: int64(maxOutputBytes), Objective: selectionObjectiveForMeaning(request.Meaning, request.Message)}
-	selected, err := g.resolver.Resolve(r.Context(), requirement)
+	selected, err := g.resolveWithRevalidation(r.Context(), requirement)
 	if err != nil {
 		writeGatewayResponse(w, g.invokeBuiltinAdvisory(r.Context(), request, maxOutputBytes))
 		return
@@ -131,7 +135,51 @@ func (g cognitiveGateway) advisoryHandler(w http.ResponseWriter, r *http.Request
 		writeGatewayResponse(w, g.invokeBuiltinAdvisory(r.Context(), request, maxOutputBytes))
 		return
 	}
-	writeGatewayResponse(w, cognitive.GatewayAdvisoryResponse{Version: response.Version, RequestID: response.RequestID, AdvisoryText: response.AdvisoryText, ReferencedExcerptIDs: response.ReferencedExcerptIDs, FinishReason: response.FinishReason, Usage: response.Usage})
+	writeGatewayResponse(w, gatewayAdvisoryResponse(request, response))
+}
+
+const iterativeRetrievalMarker = "<domovoy-retrieval>"
+
+// gatewayAdvisoryResponse is the only model-facing extraction point. The
+// model may express a bounded retrieval intent, but it cannot provide scope,
+// identity, policy or storage details; Core supplies those on continuation.
+func gatewayAdvisoryResponse(request cognitive.GatewayAdvisoryRequest, response cognitive.AdvisoryResponse) cognitive.GatewayAdvisoryResponse {
+	result := cognitive.GatewayAdvisoryResponse{Version: response.Version, RequestID: response.RequestID, AdvisoryText: response.AdvisoryText, ReferencedExcerptIDs: response.ReferencedExcerptIDs, FinishReason: response.FinishReason, Usage: response.Usage}
+	if !request.AllowIterativeRetrieval || response.FinishReason != cognitive.FinishCompleted {
+		return result
+	}
+	intent, text, ok := parseIterativeRetrievalIntent(response.AdvisoryText)
+	if !ok {
+		return result
+	}
+	result.AdvisoryText = text
+	result.IterativeRetrieval = &intent
+	return result
+}
+
+func parseIterativeRetrievalIntent(text string) (cognitive.IterativeRetrievalRequest, string, bool) {
+	start := strings.LastIndex(text, iterativeRetrievalMarker)
+	if start < 0 {
+		return cognitive.IterativeRetrievalRequest{}, text, false
+	}
+	payload := strings.TrimSpace(text[start+len(iterativeRetrievalMarker):])
+	var intent cognitive.IterativeRetrievalRequest
+	if err := json.Unmarshal([]byte(payload), &intent); err != nil || !validIterativeRetrievalIntent(intent) {
+		return cognitive.IterativeRetrievalRequest{}, text, false
+	}
+	return intent, strings.TrimSpace(text[:start]), true
+}
+
+func validIterativeRetrievalIntent(intent cognitive.IterativeRetrievalRequest) bool {
+	if strings.TrimSpace(intent.Query) == "" || strings.TrimSpace(intent.Reason) == "" || len([]rune(intent.Query)) > 512 || len([]rune(intent.Reason)) > 512 {
+		return false
+	}
+	switch intent.Lane {
+	case cognitive.IterativeRetrievalCurrentFact, cognitive.IterativeRetrievalPositiveExperience, cognitive.IterativeRetrievalNegativeExperience, cognitive.IterativeRetrievalContradiction, cognitive.IterativeRetrievalHistoricalAnalogy:
+		return true
+	default:
+		return false
+	}
 }
 
 func (g cognitiveGateway) invokeAdmitted(ctx context.Context, leaseID string, provider advisoryProvider, invocation cognitive.AdvisoryRequest, maxOutputBytes int) (cognitive.AdvisoryResponse, error) {
@@ -145,11 +193,33 @@ func (g cognitiveGateway) invokeAdmitted(ctx context.Context, leaseID string, pr
 			return cognitive.AdvisoryResponse{Version: invocation.Version, RequestID: invocation.RequestID, ProviderBindingID: invocation.ProviderBindingID, ProviderBindingRevision: invocation.ProviderBindingRevision, FinishReason: cognitive.FinishRateLimited}, nil
 		}
 		lease = admittedLease
-		defer func() { _ = g.admission.Release(ctx, lease) }()
+		defer func() {
+			releaseCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 5*time.Second)
+			defer cancel()
+			_ = g.admission.Release(releaseCtx, lease)
+		}()
 	}
 	return provider.Advise(ctx, invocation)
 }
 
+// resolveWithRevalidation makes one bounded recovery attempt when Capability
+// has an active/validated binding but its durable health projection rejected it
+// as non-invocable. Discovery remains the canonical Capability write path; the
+// retry observes the configured primary local provider and re-runs selection
+// once. Provider invocation, admission, and fallback remain governed elsewhere.
+func (g cognitiveGateway) resolveWithRevalidation(ctx context.Context, requirement capability.CognitiveRequirement) (capability.ResolvedCognitiveBinding, error) {
+	selected, err := g.resolver.Resolve(ctx, requirement)
+	if err == nil || !errors.Is(err, errNoInvocableCognitiveBinding) || g.revalidatePrimary == nil {
+		return selected, err
+	}
+	revalidationCtx, cancel := context.WithTimeout(ctx, 45*time.Second)
+	defer cancel()
+	if revalidationErr := g.revalidatePrimary(revalidationCtx); revalidationErr != nil {
+		return selected, err
+	}
+	return g.resolver.Resolve(ctx, requirement)
+}
+
 func selectionObjectiveForMessage(message string) capability.SelectionObjective {
 	lower := strings.ToLower(message)
 	if strings.Contains(lower, "дешев") || strings.Contains(lower, "бесплат") || strings.Contains(lower, "эконом") || strings.Contains(lower, "cost") || strings.Contains(lower, "cheap") {
@@ -186,27 +256,61 @@ func selectionObjectiveForMeaning(meaning cognitive.TaskMeaning, message string)
 }
 
 func builtinAdvisory(request cognitive.GatewayAdvisoryRequest) cognitive.GatewayAdvisoryResponse {
-	text := "Я рядом и продолжаю работу во встроенном режиме Домового. Внешний когнитивный маршрут сейчас недоступен, поэтому опираюсь на уже установленный смысл сообщения и локальные возможности."
+	if request.Meaning.SpeechAct == "RESPONSE_REVIEW" {
+		const marker = "Черновик ответа:"
+		if index := strings.LastIndex(request.Message, marker); index >= 0 {
+			if draft := strings.TrimSpace(request.Message[index+len(marker):]); draft != "" {
+				return cognitive.GatewayAdvisoryResponse{Version: request.Version, RequestID: request.RequestID, AdvisoryText: draft, FinishReason: cognitive.FinishCompleted}
+			}
+		}
+	}
+	text := "Понял."
+	identityText := request.Meaning.RequestedOutcome
+	if identityText == "" {
+		identityText = request.Message
+	}
+	if request.Meaning.SpeechAct == "QUESTION" && isIdentityInquiry(identityText) {
+		text = "Я — Домовой, ваш помощник."
+	}
 	switch request.Meaning.InformationRequestKind {
 	case interaction.InformationRequestCognitiveModelInventory:
-		text = "Запрос понят как проверка моделей. Встроенный режим Домового доступен; я могу показать подключённые модели по назначению, качеству, скорости и стоимости. Ключи и пароли в разговор не нужны."
+		text = "Сейчас не смог проверить подключённые модели."
 	case interaction.InformationRequestCapabilityInventory:
-		text = "Запрос понят как проверка возможностей. Я могу объяснить доступные capabilities и отличить то, что уже подключено, от того, что пока является только планом или capability gap."
+		text = "Сейчас не смог проверить доступные возможности."
 	case interaction.InformationRequestCognitiveChannelStatus:
-		text = "Запрос понят как проверка когнитивного канала. Локальный режим остаётся доступен; я объясню наблюдаемое состояние и что можно сделать без ожидания внешней модели."
+		text = "Локальный канал Домового доступен; подробности состояния дам по запросу."
 	case interaction.InformationRequestCognitiveRecovery:
-		text = "Запрос понят как восстановление ИИ. Начинаю с локального маршрута: фиксирую, что недоступно, проверяю безопасные варианты восстановления и сформулирую следующий обратимый шаг."
+		text = "Встроенный канал сейчас недоступен."
 	default:
 		switch request.Meaning.SpeechAct {
 		case "REQUEST_TO_INVESTIGATE":
-			text = "Я принял это как исследование. Даже без внешней модели могу сформулировать гипотезы, отделить известное от неизвестного и предложить следующий проверяемый шаг."
+			text = "Понял задачу, но пока не смог получить проверяемый результат."
 		case "QUESTION":
-			text = "Я отвечаю во встроенном режиме Домового. Если для полного ответа не хватает внешней модели, объясню это прямо и продолжу с тем, что можно проверить локально."
+			if !isIdentityInquiry(identityText) {
+				text = "Пока не смог получить проверяемый ответ."
+			}
+		case "CONVERSATIONAL":
+			text = "Я — Домовой, ваш помощник."
 		}
 	}
 	return cognitive.GatewayAdvisoryResponse{Version: request.Version, RequestID: request.RequestID, AdvisoryText: text, FinishReason: cognitive.FinishCompleted}
 }
 
+func isIdentityInquiry(message string) bool {
+	tokens := strings.Fields(strings.ToLower(strings.NewReplacer("?", " ", "!", " ", ",", " ").Replace(message)))
+	hasIdentitySubject := false
+	hasAssistantReference := false
+	for _, token := range tokens {
+		switch token {
+		case "кто", "зовут", "имя":
+			hasIdentitySubject = true
+		case "ты", "тебя", "тебе", "вы", "вас":
+			hasAssistantReference = true
+		}
+	}
+	return hasIdentitySubject && hasAssistantReference
+}
+
 func (g cognitiveGateway) invokeBuiltinAdvisory(ctx context.Context, request cognitive.GatewayAdvisoryRequest, maxOutputBytes int) cognitive.GatewayAdvisoryResponse {
 	if g.builtinLocal != nil && g.builtinLocal.Provider != nil {
 		invocation := cognitive.AdvisoryRequest{Version: request.Version, RequestID: request.RequestID, ActorID: request.ActorID, PrincipalID: request.PrincipalID, ScopeID: request.ScopeID, Message: request.Message, Context: request.Context, Locale: request.Locale, MaxOutputBytes: maxOutputBytes, ProviderBindingID: "builtin-local-binding-v1", ProviderBindingRevision: 1, ProviderInstanceID: "builtin-local-lifeboat-v1", ModelDescriptorID: "builtin-local-model-v1", ProviderModelID: "domovoy-lifeboat"}
@@ -340,6 +444,10 @@ type httpBindingResolver struct {
 	client *http.Client
 }
 
+type httpStatusError struct{ status int }
+
+func (e httpStatusError) Error() string { return fmt.Sprintf("registry status %d", e.status) }
+
 func newHTTPBindingResolver(raw string, client *http.Client) (*httpBindingResolver, error) {
 	base, err := url.Parse(raw)
 	if err != nil || base.Scheme == "" || base.Host == "" {
@@ -351,6 +459,10 @@ func newHTTPBindingResolver(raw string, client *http.Client) (*httpBindingResolv
 func (r *httpBindingResolver) Resolve(ctx context.Context, value capability.CognitiveRequirement) (capability.ResolvedCognitiveBinding, error) {
 	var result capability.ResolvedCognitiveBinding
 	err := r.post(ctx, "/v1/cognitive-bindings/resolve", value, &result)
+	var statusErr httpStatusError
+	if errors.As(err, &statusErr) && statusErr.status == http.StatusNotFound {
+		return result, errNoInvocableCognitiveBinding
+	}
 	return result, err
 }
 
@@ -403,7 +515,7 @@ func (r *httpBindingResolver) post(ctx context.Context, path string, value, dest
 	defer response.Body.Close()
 	if response.StatusCode < 200 || response.StatusCode >= 300 {
 		_, _ = io.Copy(io.Discard, io.LimitReader(response.Body, 4096))
-		return fmt.Errorf("registry status %d", response.StatusCode)
+		return httpStatusError{status: response.StatusCode}
 	}
 	if destination != nil {
 		return json.NewDecoder(io.LimitReader(response.Body, 64<<10)).Decode(destination)

cmd/cognitive-worker/gateway_registry_test.go

@@ -22,6 +22,26 @@ type registryStub struct {
 	observation *capability.CognitiveUsageObservation
 }
 
+type revalidatingRegistry struct {
+	selected capability.ResolvedCognitiveBinding
+	calls    int
+	alwaysNo bool
+}
+
+func (s *revalidatingRegistry) Resolve(context.Context, capability.CognitiveRequirement) (capability.ResolvedCognitiveBinding, error) {
+	s.calls++
+	if s.alwaysNo || s.calls == 1 {
+		return capability.ResolvedCognitiveBinding{}, errNoInvocableCognitiveBinding
+	}
+	return s.selected, nil
+}
+func (*revalidatingRegistry) Observe(context.Context, capability.CognitiveUsageObservation) error {
+	return nil
+}
+func (*revalidatingRegistry) RegisterDiscovery(context.Context, capability.CognitiveDiscoverySnapshot) (capability.CognitiveDiscoveryRegistration, error) {
+	return capability.CognitiveDiscoveryRegistration{}, nil
+}
+
 type failoverRegistry struct {
 	primary, fallback capability.ResolvedCognitiveBinding
 	observations      []capability.CognitiveUsageObservation
@@ -88,6 +108,73 @@ func TestActiveRegistryBindingReachesProviderAdapter(t *testing.T) {
 	}
 }
 
+func TestGatewayExtractsOnlyBoundedTypedRetrievalIntent(t *testing.T) {
+	request := cognitive.GatewayAdvisoryRequest{AllowIterativeRetrieval: true}
+	response := cognitive.AdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: "request", FinishReason: cognitive.FinishCompleted, AdvisoryText: "<domovoy-retrieval>{\"Query\":\"sync catalog\",\"SemanticSubject\":\"catalog sync\",\"Lane\":\"NEGATIVE_EXPERIENCE\",\"Reason\":\"need known failure\"}"}
+	got := gatewayAdvisoryResponse(request, response)
+	if got.IterativeRetrieval == nil || got.IterativeRetrieval.Lane != cognitive.IterativeRetrievalNegativeExperience || got.AdvisoryText != "" {
+		t.Fatalf("response=%+v", got)
+	}
+	invalid := response
+	invalid.AdvisoryText = "<domovoy-retrieval>{\"Query\":\"all memory\",\"Lane\":\"UNRESTRICTED\",\"Reason\":\"everything\"}"
+	if got := gatewayAdvisoryResponse(request, invalid); got.IterativeRetrieval != nil {
+		t.Fatalf("invalid intent accepted: %+v", got)
+	}
+}
+
+func TestStaleUnavailableBindingRevalidatesOnceBeforeInvocation(t *testing.T) {
+	selected := gatewaySelection()
+	selected.Binding.DataPolicy = capability.DataPolicyLocalOnly
+	registry := &revalidatingRegistry{selected: selected}
+	provider := &stubAdvisoryProvider{response: cognitive.AdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: "request-1", AdvisoryText: "ok", FinishReason: cognitive.FinishCompleted}}
+	revalidations := 0
+	gateway := cognitiveGateway{resolver: registry, providers: map[capability.ProviderKind][]providerRegistration{"provider-kind-1": {{EndpointRef: "endpoint-1", CredentialRef: "credential-1", Provider: provider}}}, now: time.Now, revalidatePrimary: func(context.Context) error { revalidations++; return nil }}
+	response := httptest.NewRecorder()
+	gateway.advisoryHandler(response, httptest.NewRequest(http.MethodPost, "/v1/advisories", strings.NewReader(gatewayRequest())))
+	if response.Code != http.StatusOK || !provider.called || revalidations != 1 || registry.calls != 2 {
+		t.Fatalf("status=%d provider_called=%t revalidations=%d resolves=%d", response.Code, provider.called, revalidations, registry.calls)
+	}
+}
+
+func TestRevalidationFailureDoesNotMakeBindingInvocable(t *testing.T) {
+	registry := &registryStub{err: errNoInvocableCognitiveBinding}
+	provider := &stubAdvisoryProvider{}
+	revalidations := 0
+	gateway := cognitiveGateway{resolver: registry, providers: map[capability.ProviderKind][]providerRegistration{"provider-kind-1": {{Provider: provider}}}, now: time.Now, revalidatePrimary: func(context.Context) error { revalidations++; return errors.New("provider unavailable") }}
+	gateway.advisoryHandler(httptest.NewRecorder(), httptest.NewRequest(http.MethodPost, "/v1/advisories", strings.NewReader(gatewayRequest())))
+	if provider.called || revalidations != 1 {
+		t.Fatalf("failed provider revalidation was treated as invocable: provider_called=%t revalidations=%d", provider.called, revalidations)
+	}
+}
+
+func TestRevalidationIsNotRetriedInALoop(t *testing.T) {
+	registry := &revalidatingRegistry{alwaysNo: true}
+	revalidations := 0
+	gateway := cognitiveGateway{resolver: registry, now: time.Now, revalidatePrimary: func(context.Context) error { revalidations++; return nil }}
+	gateway.advisoryHandler(httptest.NewRecorder(), httptest.NewRequest(http.MethodPost, "/v1/advisories", strings.NewReader(gatewayRequest())))
+	if revalidations != 1 || registry.calls != 2 {
+		t.Fatalf("revalidation loop: revalidations=%d resolves=%d", revalidations, registry.calls)
+	}
+}
+
+func TestHTTPResolverMarksNoInvocableBindingForSingleRevalidation(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1/cognitive-bindings/resolve" {
+			t.Fatalf("path=%s", r.URL.Path)
+		}
+		http.Error(w, "no invocable cognitive binding", http.StatusNotFound)
+	}))
+	defer server.Close()
+	resolver, err := newHTTPBindingResolver(server.URL, server.Client())
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = resolver.Resolve(context.Background(), capability.CognitiveRequirement{CapabilityID: creatorAdvisoryCapabilityID, OwnerPrincipalID: "principal-1", MaxOutputBytes: 1})
+	if !errors.Is(err, errNoInvocableCognitiveBinding) {
+		t.Fatalf("resolve error=%v, want no-invocable sentinel", err)
+	}
+}
+
 func TestProviderUsesStableInstanceWhenCredentialMetadataIsStale(t *testing.T) {
 	provider := &stubAdvisoryProvider{}
 	gateway := cognitiveGateway{providers: map[capability.ProviderKind][]providerRegistration{
@@ -185,11 +272,34 @@ func TestNoActiveBindingUsesBuiltInProviderWithoutInvocation(t *testing.T) {
 func TestBuiltInAdvisoryUsesTrustedInformationIntentInsteadOfMessageKeywords(t *testing.T) {
 	request := cognitive.GatewayAdvisoryRequest{Version: cognitive.CreatorAdvisoryV1, RequestID: "request-1", Message: "arbitrary text", Meaning: cognitive.TaskMeaning{InformationRequestKind: interaction.InformationRequestCognitiveRecovery}}
 	response := builtinAdvisory(request)
-	if !strings.Contains(response.AdvisoryText, "восстановление ИИ") {
+	if response.AdvisoryText != "Встроенный канал сейчас недоступен." {
 		t.Fatalf("unexpected recovery response: %q", response.AdvisoryText)
 	}
 }
 
+func TestBuiltInAdvisoryIdentityIsNaturalAndDoesNotMentionResponseLength(t *testing.T) {
+	response := builtinAdvisory(cognitive.GatewayAdvisoryRequest{
+		Version:   cognitive.CreatorAdvisoryV1,
+		RequestID: "request-identity",
+		Meaning:   cognitive.TaskMeaning{SpeechAct: "QUESTION", RequestedOutcome: "ты кто?"},
+	})
+	if response.AdvisoryText != "Я — Домовой, ваш помощник." {
+		t.Fatalf("unexpected identity response: %q", response.AdvisoryText)
+	}
+	if strings.Contains(response.AdvisoryText, "коротко") || strings.Contains(response.AdvisoryText, "подробност") {
+		t.Fatalf("identity response contains style meta-text: %q", response.AdvisoryText)
+	}
+	messageResponse := builtinAdvisory(cognitive.GatewayAdvisoryRequest{
+		Version:   cognitive.CreatorAdvisoryV1,
+		RequestID: "request-identity-message",
+		Message:   "как тебя зовут?",
+		Meaning:   cognitive.TaskMeaning{SpeechAct: "QUESTION"},
+	})
+	if messageResponse.AdvisoryText != "Я — Домовой, ваш помощник." {
+		t.Fatalf("unexpected message identity response: %q", messageResponse.AdvisoryText)
+	}
+}
+
 func TestNoActiveBindingInvokesBuiltInLocalProvider(t *testing.T) {
 	registry := &registryStub{err: errors.New("no active binding")}
 	provider := &stubAdvisoryProvider{response: cognitive.AdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: "request-1", AdvisoryText: "локальный ответ", FinishReason: cognitive.FinishCompleted}}

cmd/cognitive-worker/interpretation.go

@@ -67,12 +67,18 @@ func (g cognitiveGateway) interpretationHandler(w http.ResponseWriter, r *http.R
 	}
 	g.observe(r.Context(), selected, response, started)
 	if response.FinishReason != cognitive.FinishCompleted {
-		writeInterpretationResponse(w, cognitive.GatewayInterpretationResponse{Version: request.Version, RequestID: request.RequestID, FinishReason: response.FinishReason, Usage: response.Usage})
+		// A selected provider can become unavailable after discovery. Semantic
+		// routing must still retain the deterministic interpretation and use the
+		// local lifeboat rather than turn an ordinary conversation into a
+		// degraded reply solely because one provider failed.
+		writeInterpretationResponse(w, g.interpretWithBuiltin(r.Context(), request, maxOutputBytes))
 		return
 	}
 	candidate, ok := parseInterpretationCandidate(response.AdvisoryText)
 	if !ok {
-		writeInterpretationResponse(w, cognitive.GatewayInterpretationResponse{Version: request.Version, RequestID: request.RequestID, FinishReason: cognitive.FinishInvalidStructuredOutput, Usage: response.Usage})
+		// Structured interpretation is a transport contract. A malformed model
+		// answer is not a reason to discard the available local fallback.
+		writeInterpretationResponse(w, g.interpretWithBuiltin(r.Context(), request, maxOutputBytes))
 		return
 	}
 	writeInterpretationResponse(w, cognitive.GatewayInterpretationResponse{Version: request.Version, RequestID: request.RequestID, Candidate: candidate, FinishReason: cognitive.FinishCompleted, Usage: response.Usage})

cmd/cognitive-worker/interpretation_test.go

@@ -1,9 +1,15 @@
 package main
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
 	"testing"
+	"time"
 
+	"git.cin.su/m/Assistant/contracts/capability"
 	"git.cin.su/m/Assistant/contracts/cognitive"
 )
 
@@ -24,3 +30,32 @@ func TestBuiltinInterpretationTimeoutRetainsDeterministicCandidate(t *testing.T)
 		t.Fatalf("candidate did not retain deterministic meaning: %+v", response.Candidate)
 	}
 }
+
+func TestInterpretationProviderFailureUsesLocalLifeboat(t *testing.T) {
+	selected := gatewaySelection()
+	selected.Binding.DataPolicy = capability.DataPolicyLocalOnly
+	primary := &stubAdvisoryProvider{response: cognitive.AdvisoryResponse{FinishReason: cognitive.FinishProviderUnavailable}}
+	lifeboat := &stubAdvisoryProvider{response: cognitive.AdvisoryResponse{AdvisoryText: `{"primary_speech_act":"QUESTION","secondary_speech_act":"","confidence_millis":900,"applicability":"APPLICABLE","requested_outcome":"","needs_cognition":true,"clarification":"NOT_REQUIRED","selection_reason":"local lifeboat","capability_hints":["COGNITIVE_REASONING"]}`, FinishReason: cognitive.FinishCompleted}}
+	gateway := cognitiveGateway{
+		resolver: &registryStub{selected: selected},
+		providers: map[capability.ProviderKind][]providerRegistration{
+			selected.Provider.Kind: {{ProviderInstanceID: selected.Provider.ID, Kind: selected.Provider.Kind, Provider: primary}},
+		},
+		builtinLocal: &providerRegistration{Provider: lifeboat},
+		now:          time.Now,
+	}
+	request := cognitive.GatewayInterpretationRequest{Version: cognitive.CreatorAdvisoryV1, RequestID: "request-1", ActorID: "actor-1", PrincipalID: "principal-1", ScopeID: "scope-1", Message: "сколько фигур в шахматах?", Locale: "ru", MaxOutputBytes: 4096, DataPolicy: capability.DataPolicyLocalOnly, DeterministicSpeechAct: "QUESTION", DeterministicConfidence: 800, DeterministicApplicability: cognitive.InterpretationApplicable}
+	payload, _ := json.Marshal(request)
+	recorder := httptest.NewRecorder()
+	gateway.interpretationHandler(recorder, httptest.NewRequest(http.MethodPost, "/v1/interpretations", bytes.NewReader(payload)))
+	if recorder.Code != http.StatusOK || !primary.called || !lifeboat.called {
+		t.Fatalf("status=%d primary=%t lifeboat=%t body=%s", recorder.Code, primary.called, lifeboat.called, recorder.Body.String())
+	}
+	var response cognitive.GatewayInterpretationResponse
+	if err := json.Unmarshal(recorder.Body.Bytes(), &response); err != nil {
+		t.Fatal(err)
+	}
+	if response.FinishReason != cognitive.FinishCompleted || response.Candidate.SelectionReason != "local lifeboat" {
+		t.Fatalf("response=%+v", response)
+	}
+}

cmd/cognitive-worker/main.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"git.cin.su/m/Assistant/adapters/models"
+	"git.cin.su/m/Assistant/adapters/multimodal"
 	"git.cin.su/m/Assistant/contracts/capability"
 	"git.cin.su/m/Assistant/contracts/cognitive"
 	"git.cin.su/m/Assistant/contracts/identity"
@@ -70,7 +71,7 @@ func main() {
 		if err != nil {
 			log.Fatal(err)
 		}
-		mediumTimeout := durationEnv("LOCAL_MEDIUM_PROVIDER_TIMEOUT", 60*time.Second)
+		mediumTimeout := durationEnv("LOCAL_MEDIUM_PROVIDER_TIMEOUT", 120*time.Second)
 		mediumAdapter, adapterErr := models.NewOpenAICompatibleLocalAdapterWithAPIKeyAndTimeout(strings.TrimRight(mediumURL, "/"), mediumAPIKey, nil, mediumTimeout)
 		if adapterErr != nil {
 			log.Fatal(adapterErr)
@@ -112,11 +113,16 @@ func main() {
 		kind := capability.ProviderKind(envOr("OPENAI_PROVIDER_KIND", "openai-responses-v1"))
 		providers[kind] = append(providers[kind], providerRegistration{ProviderInstanceID: "openai-bootstrap", Kind: kind, EndpointRef: capability.EndpointBindingRef(envOr("OPENAI_ENDPOINT_REF", "openai-responses-default")), CredentialRef: capability.CredentialRef(envOr("OPENAI_CREDENTIAL_REF", "openai-advisory-v1")), AuthMode: capability.AuthKey, BillingMode: capability.BillingPerInput, DataPolicy: capability.DataPolicyExternalMessageOnly, Provider: openAIProvider})
 	}
-	gateway := cognitiveGateway{resolver: resolver, providers: providers, builtinLocal: builtinLocal, externalRecovery: externalRecovery, now: time.Now, allowCanary: os.Getenv("COGNITIVE_ALLOW_CANARY") == "true", canaryMaxOutputBytes: 4096, admission: newHTTPAdmissionClient(envOr("CORE_RUNTIME_URL", "http://core-runtime:8080"), &http.Client{Timeout: 5 * time.Second})}
+	discovery := discoveryService{resolver: resolver, providers: discoveries, owner: identity.PrincipalID(envOr("COGNITIVE_OWNER_PRINCIPAL_ID", "domovoy-creator-principal")), now: time.Now}
+	gateway := cognitiveGateway{resolver: resolver, providers: providers, builtinLocal: builtinLocal, externalRecovery: externalRecovery, now: time.Now, allowCanary: os.Getenv("COGNITIVE_ALLOW_CANARY") == "true", canaryMaxOutputBytes: 4096, admission: newHTTPAdmissionClient(envOr("CORE_RUNTIME_URL", "http://core-runtime:8080"), &http.Client{Timeout: 5 * time.Second}), revalidatePrimary: func(ctx context.Context) error {
+		_, err := discovery.register(ctx, "medium")
+		return err
+	}}
 	mux.Handle("/healthz", health.Handler{Runtime: "cognitive-worker", SemanticGeneration: 1, ArchitectureGeneration: 1})
 	readinessClient := &http.Client{Timeout: 2 * time.Second}
 	cpuReadinessClient := &http.Client{Timeout: 10 * time.Second}
-	mediumReadinessClient := &http.Client{Timeout: 10 * time.Second}
+	mediumReadinessTimeout := 120 * time.Second
+	mediumReadinessClient := &http.Client{Timeout: mediumReadinessTimeout}
 	lifeboatURL := strings.TrimSuffix(strings.TrimRight(envOr("LOCAL_LIFEBOAT_PROVIDER_URL", "http://cognitive-lifeboat:8086/v1"), "/"), "/v1") + "/health"
 	fleetClient := &http.Client{Timeout: 2 * time.Second}
 	preferredFleet := capability.FleetTier(envOr("COGNITIVE_PREFERRED_FLEET_TIER", string(capability.FleetTierFast)))
@@ -126,17 +132,26 @@ func main() {
 	}
 	cpuEndpoint := strings.TrimRight(envOr("LOCAL_CPU_PROVIDER_URL", "http://docker.cin.su:18082/v1"), "/") + "/models"
 	cpuHealthProbe := health.OptionalHTTPProbeWithHeaders(cpuReadinessClient, cpuEndpoint, cpuFleetHeaders)
-	cpuHealthProbe.Timeout = 10 * time.Second
+	// Opportunistic providers must not hide a ready local lifeboat. Keep their
+	// readiness budget short; their detailed fleet state is reported separately.
+	cpuHealthProbe.Timeout = 2 * time.Second
 	mediumEndpoint := ""
+	mediumHealthEndpoint := ""
 	mediumHeaders := map[string]string{}
 	mediumHealthProbe := health.Probe{}
 	if mediumURL != "" {
 		mediumEndpoint = strings.TrimRight(mediumURL, "/") + "/models"
+		mediumHealthEndpoint = strings.TrimSuffix(strings.TrimRight(mediumURL, "/"), "/v1") + "/health"
 		if mediumAPIKey != "" {
 			mediumHeaders["Authorization"] = "Bearer " + mediumAPIKey
 		}
-		mediumHealthProbe = health.OptionalHTTPProbeWithHeaders(mediumReadinessClient, mediumEndpoint, mediumHeaders)
-		mediumHealthProbe.Timeout = 10 * time.Second
+		// Readiness reports provider discovery health quickly; fleet readiness
+		// separately reports authenticated model availability on /v1/models.
+		mediumHealthProbe = health.OptionalHTTPProbeWithHeaders(readinessClient, mediumHealthEndpoint, mediumHeaders)
+		// The local gateway may need several seconds to enumerate a loaded model.
+		// Keep this bounded, but do not classify a healthy MEDIUM provider as
+		// unavailable before its authenticated discovery response can arrive.
+		mediumHealthProbe.Timeout = 2 * time.Second
 	}
 	readinessProbes := []health.Probe{
 		health.HTTPProbe(readinessClient, strings.TrimRight(envOr("CORE_RUNTIME_URL", "http://core-runtime:8080"), "/")+"/healthz"),
@@ -149,13 +164,13 @@ func main() {
 	if gpuConfigured {
 		gpuHeaders := map[string]string{"Authorization": "Bearer " + gpuKey}
 		gpuProbe := health.OptionalHTTPProbeWithHeaders(readinessClient, strings.TrimRight(gpuURL, "/")+"/models", gpuHeaders)
-		gpuProbe.Timeout = 10 * time.Second
+		gpuProbe.Timeout = 2 * time.Second
 		readinessProbes = append(readinessProbes, gpuProbe)
 	}
 
 	fleetEndpoints := []fleetEndpoint{
-		{ProviderID: "local-cpu-primary", ModelID: "local-cpu-model", Tier: capability.FleetTierFast, URL: cpuEndpoint, Headers: cpuFleetHeaders, Client: &http.Client{Timeout: 10 * time.Second}},
-		{ProviderID: "local-medium-primary", ModelID: "local-medium-model", Tier: capability.FleetTierMedium, URL: mediumEndpoint, Headers: mediumHeaders, Client: mediumReadinessClient},
+		{ProviderID: "local-cpu-primary", ModelID: "local-cpu-model", Tier: capability.FleetTierFast, URL: cpuEndpoint, Headers: cpuFleetHeaders, Client: &http.Client{Timeout: 10 * time.Second}, Timeout: 2 * time.Second},
+		{ProviderID: "local-medium-primary", ModelID: "local-medium-model", Tier: capability.FleetTierMedium, URL: mediumEndpoint, Headers: mediumHeaders, Client: mediumReadinessClient, Timeout: mediumReadinessTimeout},
 		{ProviderID: "cognitive-lifeboat", ModelID: "qwen3-8b-lifeboat", Tier: capability.FleetTierLifeboat, URL: lifeboatURL},
 	}
 	if gpuConfigured {
@@ -168,7 +183,26 @@ func main() {
 	mux.HandleFunc("POST /v1/advisories", gateway.advisoryHandler)
 	mux.HandleFunc("POST /v1/interpretations", gateway.interpretationHandler)
 	mux.HandleFunc("POST /v1/task-evaluations/execute", gateway.taskEvaluationHandler)
-	discovery := discoveryService{resolver: resolver, providers: discoveries, owner: identity.PrincipalID(envOr("COGNITIVE_OWNER_PRINCIPAL_ID", "domovoy-creator-principal")), now: time.Now}
+	imageGenerator := multimodal.ImageGenerator(multimodal.ImageGenerationClient{BaseURL: os.Getenv("LOCAL_IMAGE_PROVIDER_URL"), Client: &http.Client{Timeout: 300 * time.Second}})
+	if strings.EqualFold(strings.TrimSpace(os.Getenv("LOCAL_IMAGE_PROVIDER_KIND")), "comfyui") {
+		imageGenerator = multimodal.ComfyImageGenerationClient{BaseURL: os.Getenv("LOCAL_IMAGE_PROVIDER_URL"), Client: &http.Client{Timeout: 300 * time.Second}, PollTimeout: 15 * time.Minute}
+	}
+	multimodalGateway := multimodalGateway{
+		speech:           multimodal.SpeechClient{BaseURL: envOr("LOCAL_SPEECH_PROVIDER_URL", "http://llm-local-speech:8080"), Client: &http.Client{Timeout: 120 * time.Second}},
+		vision:           multimodal.VisionClient{BaseURL: envOr("LOCAL_VISION_PROVIDER_URL", "http://llm-local-vision:8080/v1"), Client: &http.Client{Timeout: 180 * time.Second}},
+		imageGenerator:   imageGenerator,
+		imageProviderURL: os.Getenv("LOCAL_IMAGE_PROVIDER_URL"),
+		video:            multimodal.VideoUnderstandingClient{BaseURL: os.Getenv("LOCAL_VIDEO_PROVIDER_URL"), Client: &http.Client{Timeout: 300 * time.Second}},
+		model:            envOr("LOCAL_VISION_MODEL", "/models/gemma-4-26B-A4B-it-UD-Q4_K_M.gguf"),
+		imageModel:       os.Getenv("LOCAL_IMAGE_MODEL"),
+		videoModel:       os.Getenv("LOCAL_VIDEO_MODEL"),
+		now:              time.Now,
+	}
+	mux.HandleFunc("POST /v1/multimodal/transcribe", multimodalGateway.handler(capability.MultimodalTranscribe))
+	mux.HandleFunc("POST /v1/multimodal/understand", multimodalGateway.handler(capability.MultimodalUnderstand))
+	mux.HandleFunc("POST /v1/multimodal/ocr", multimodalGateway.handler(capability.MultimodalRecognizeOCR))
+	mux.HandleFunc("POST /v1/multimodal/video-understand", multimodalGateway.handler(capability.MultimodalUnderstandVideo))
+	mux.HandleFunc("POST /v1/multimodal/generate-image", multimodalGateway.handler(capability.MultimodalGenerateImage))
 	mux.HandleFunc("POST /v1/provider-discovery/{provider}", discovery.handler)
 	mux.Handle("POST /v1/provider-discovery/{provider}/qualify", modelQualificationHandler(discoveries, string(envOr("COGNITIVE_OWNER_PRINCIPAL_ID", "domovoy-creator-principal")), httpQualificationObserver{resolver: resolver}))
 	mux.HandleFunc("GET /v1/provider-discovery/status", discovery.statusHandler)
@@ -194,7 +228,9 @@ func durationEnv(name string, fallback time.Duration) time.Duration {
 
 func refreshProviderDiscoveries(resolver bindingResolver, service discoveryService) {
 	for name := range service.providers {
-		ctx, cancel := context.WithTimeout(context.Background(), 8*time.Second)
+		// Keep startup discovery bounded while allowing the authenticated local
+		// gateway enough time to enumerate a loaded MEDIUM model.
+		ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
 		registration, ok := service.providers[name]
 		if !ok || registration.Discovery == nil {
 			cancel()

cmd/cognitive-worker/model_qualification.go

@@ -4,8 +4,11 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"log"
 	"net/http"
 	"slices"
+	"sort"
+	"strings"
 	"sync"
 	"time"
 
@@ -53,8 +56,83 @@ type modelQualificationResponse struct {
 	Results              []modelQualificationResult    `json:"results"`
 }
 
+const qualificationControlPlaneTimeout = 45 * time.Second
+
+// qualificationCoordinator bounds duplicate control-plane probes within one
+// cognitive-worker process. It is deliberately not canonical state: the
+// Capability owner remains the sole owner of qualification evidence and
+// activation. A restart may repeat an incomplete probe, but cannot create a
+// second semantic writer or bypass independent evaluation.
+type qualificationCoordinator struct {
+	mu      sync.Mutex
+	flights map[string]*qualificationFlight
+}
+
+type qualificationFlight struct {
+	done     chan struct{}
+	response modelQualificationResponse
+	err      error
+	waiters  int
+}
+
+func (c *qualificationCoordinator) do(ctx context.Context, key string, operation func() (modelQualificationResponse, error)) (modelQualificationResponse, bool, error) {
+	c.mu.Lock()
+	if c.flights == nil {
+		c.flights = make(map[string]*qualificationFlight)
+	}
+	if current, exists := c.flights[key]; exists {
+		current.waiters++
+		c.mu.Unlock()
+		select {
+		case <-current.done:
+			return current.response, false, current.err
+		case <-ctx.Done():
+			return modelQualificationResponse{}, false, ctx.Err()
+		}
+	}
+	current := &qualificationFlight{done: make(chan struct{})}
+	c.flights[key] = current
+	c.mu.Unlock()
+
+	current.response, current.err = operation()
+	close(current.done)
+	c.mu.Lock()
+	delete(c.flights, key)
+	c.mu.Unlock()
+	return current.response, true, current.err
+}
+
+type qualificationPhaseTrace struct {
+	correlationID string
+	started       time.Time
+}
+
+func newQualificationPhaseTrace() qualificationPhaseTrace {
+	correlationID, err := ids.New()
+	if err != nil {
+		correlationID = ids.ID(fmt.Sprintf("qualification-%d", time.Now().UnixNano()))
+	}
+	return qualificationPhaseTrace{correlationID: string(correlationID), started: time.Now()}
+}
+
+func (t qualificationPhaseTrace) phase(name string, fields ...string) {
+	log.Printf("qualification_phase correlation_id=%s phase=%s elapsed_ms=%d %s", t.correlationID, name, time.Since(t.started).Milliseconds(), strings.Join(fields, " "))
+}
+
+func qualificationFlightKey(provider string, modelIDs []capability.ProviderModelID) string {
+	ids := make([]string, 0, len(modelIDs))
+	for _, modelID := range modelIDs {
+		ids = append(ids, string(modelID))
+	}
+	sort.Strings(ids)
+	return provider + "|" + strings.Join(ids, ",")
+}
+
 func modelQualificationHandler(providers map[string]providerRegistration, owner string, observers ...qualificationObserver) http.Handler {
+	coordinator := &qualificationCoordinator{}
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		trace := newQualificationPhaseTrace()
+		trace.phase("Q0", "event=request_accepted")
 		name := r.PathValue("provider")
 		registration, ok := providers[name]
 		if !ok || registration.Discovery == nil || registration.Provider == nil {
@@ -72,32 +150,65 @@ func modelQualificationHandler(providers map[string]providerRegistration, owner
 			http.Error(w, "max_output_bytes exceeds qualification bound", http.StatusBadRequest)
 			return
 		}
-		modelsFound, probe := registration.Discovery.Discover(r.Context())
-		if probe.Health != capability.HealthAvailable || len(modelsFound) == 0 {
-			http.Error(w, "provider unavailable for qualification", http.StatusServiceUnavailable)
-			return
+		controlCtx, cancel := context.WithTimeout(r.Context(), qualificationControlPlaneTimeout)
+		defer cancel()
+		response, leader, err := coordinator.do(controlCtx, qualificationFlightKey(name, request.ModelIDs), func() (modelQualificationResponse, error) {
+			trace.phase("Q1", "event=binding_candidate_loaded")
+			modelsFound, probe := registration.Discovery.Discover(controlCtx)
+			if probe.Health != capability.HealthAvailable || len(modelsFound) == 0 {
+				return modelQualificationResponse{}, fmt.Errorf("provider unavailable for qualification")
+			}
+			if len(request.ModelIDs) > 0 {
+				modelsFound = slices.DeleteFunc(modelsFound, func(model models.DiscoveredModel) bool {
+					return !slices.Contains(request.ModelIDs, model.ProviderModelID)
+				})
+			}
+			if len(modelsFound) == 0 {
+				return modelQualificationResponse{}, fmt.Errorf("requested model not discovered")
+			}
+			if len(modelsFound) > 16 {
+				modelsFound = modelsFound[:16]
+			}
+			trace.phase("Q2", fmt.Sprintf("event=provider_model_resolved model_count=%d", len(modelsFound)))
+			trace.phase("Q3", "event=bounded_invocation_started")
+			results := qualifyModels(controlCtx, registration, owner, request.Prompt, request.MaxOutputBytes, modelsFound)
+			trace.phase("Q4", "event=bounded_invocation_completed")
+			trace.phase("Q5", fmt.Sprintf("event=invocation_evidence_built result_count=%d", len(results)))
+			if len(observers) > 0 && observers[0] != nil {
+				trace.phase("Q6", "event=observation_persistence_started")
+				if err := persistQualificationResults(controlCtx, observers[0], registration, results); err != nil {
+					return modelQualificationResponse{}, fmt.Errorf("persist model qualification observation: %w", err)
+				}
+				trace.phase("Q7", "event=observation_persistence_completed")
+			}
+			// Q8-Q17 are intentionally outside this worker's authority. Capability
+			// owns independent evaluation and governed promotion; this trace makes
+			// that hand-off explicit instead of disguising it as activation.
+			trace.phase("Q8", "event=independent_evaluation_not_started owner=capability")
+			return modelQualificationResponse{Provider: registration.ProviderInstanceID, ObservedAtUnixMillis: time.Now().UnixMilli(), Results: results}, nil
+		})
+		if !leader {
+			trace.phase("Q0", "event=joined_in_progress_qualification")
 		}
-		if len(request.ModelIDs) > 0 {
-			modelsFound = slices.DeleteFunc(modelsFound, func(model models.DiscoveredModel) bool {
-				return !slices.Contains(request.ModelIDs, model.ProviderModelID)
-			})
-		}
-		if len(modelsFound) == 0 {
-			http.Error(w, "requested model not discovered", http.StatusNotFound)
-			return
-		}
-		if len(modelsFound) > 16 {
-			modelsFound = modelsFound[:16]
-		}
-		results := qualifyModels(r.Context(), registration, owner, request.Prompt, request.MaxOutputBytes, modelsFound)
-		if len(observers) > 0 && observers[0] != nil {
-			if err := persistQualificationResults(r.Context(), observers[0], registration, results); err != nil {
-				http.Error(w, "persist model qualification observation", http.StatusBadGateway)
+		if err != nil {
+			if controlCtx.Err() != nil {
+				http.Error(w, "qualification timeout", http.StatusGatewayTimeout)
 				return
 			}
+			if strings.Contains(err.Error(), "requested model not discovered") {
+				http.Error(w, "requested model not discovered", http.StatusNotFound)
+				return
+			}
+			if strings.Contains(err.Error(), "provider unavailable") {
+				http.Error(w, "provider unavailable for qualification", http.StatusServiceUnavailable)
+				return
+			}
+			http.Error(w, "persist model qualification observation", http.StatusBadGateway)
+			return
 		}
+		trace.phase("Q17", "event=qualification_response_returned activation=not_attempted")
 		w.Header().Set("Content-Type", "application/json")
-		_ = jsonEncode(w, modelQualificationResponse{Provider: registration.ProviderInstanceID, ObservedAtUnixMillis: time.Now().UnixMilli(), Results: results})
+		_ = jsonEncode(w, response)
 	})
 }
 

cmd/cognitive-worker/model_qualification_test.go

@@ -6,6 +6,7 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 
 	"git.cin.su/m/Assistant/adapters/models"
 	"git.cin.su/m/Assistant/contracts/capability"
@@ -17,6 +18,7 @@ type qualificationProvider struct{}
 func (qualificationProvider) Probe(context.Context) models.ProviderProbe {
 	return models.ProviderProbe{Health: capability.HealthAvailable}
 }
+
 func (qualificationProvider) Discover(context.Context) ([]models.DiscoveredModel, models.ProviderProbe) {
 	return []models.DiscoveredModel{{ProviderModelID: "model-a"}, {ProviderModelID: "model-b"}}, models.ProviderProbe{Health: capability.HealthAvailable}
 }
@@ -83,3 +85,63 @@ func TestModelQualificationPersistsReachabilityWithoutQuality(t *testing.T) {
 		t.Fatalf("invalid qualification observation: %+v err=%v", observer.observations[0], err)
 	}
 }
+
+func TestModelQualificationDeduplicatesSameProviderModelFlight(t *testing.T) {
+	coordinator := &qualificationCoordinator{}
+	started := make(chan struct{})
+	release := make(chan struct{})
+	firstDone := make(chan struct{})
+	secondDone := make(chan struct{})
+	result := modelQualificationResponse{Provider: "medium"}
+	go func() {
+		_, _, err := coordinator.do(context.Background(), "medium|model-a", func() (modelQualificationResponse, error) {
+			close(started)
+			<-release
+			return result, nil
+		})
+		if err != nil {
+			t.Errorf("leader qualification failed: %v", err)
+		}
+		close(firstDone)
+	}()
+	select {
+	case <-started:
+	case <-time.After(time.Second):
+		t.Fatal("qualification invocation did not start")
+	}
+	go func() {
+		actual, leader, err := coordinator.do(context.Background(), "medium|model-a", func() (modelQualificationResponse, error) {
+			t.Error("duplicate qualification operation ran")
+			return modelQualificationResponse{}, nil
+		})
+		if err != nil || leader || actual.Provider != result.Provider {
+			t.Errorf("joined qualification response=%+v leader=%t err=%v", actual, leader, err)
+		}
+		close(secondDone)
+	}()
+	deadline := time.Now().Add(time.Second)
+	for {
+		coordinator.mu.Lock()
+		flight := coordinator.flights["medium|model-a"]
+		waiters := 0
+		if flight != nil {
+			waiters = flight.waiters
+		}
+		coordinator.mu.Unlock()
+		if waiters == 1 {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("second qualification did not join the in-progress flight")
+		}
+		time.Sleep(time.Millisecond)
+	}
+	close(release)
+	for _, done := range []chan struct{}{firstDone, secondDone} {
+		select {
+		case <-done:
+		case <-time.After(time.Second):
+			t.Fatal("qualification flight did not complete")
+		}
+	}
+}

cmd/cognitive-worker/multimodal.go

@@ -0,0 +1,138 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"git.cin.su/m/Assistant/adapters/multimodal"
+	"git.cin.su/m/Assistant/contracts/capability"
+)
+
+const maxMultimodalUploadBytes = 12 << 20
+
+type multimodalGateway struct {
+	speech           multimodal.SpeechClient
+	vision           multimodal.VisionClient
+	imageGenerator   multimodal.ImageGenerator
+	imageProviderURL string
+	video            multimodal.VideoUnderstandingClient
+	model            string
+	imageModel       string
+	videoModel       string
+	now              func() time.Time
+}
+
+func (g multimodalGateway) handler(operation capability.MultimodalOperation) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		r.Body = http.MaxBytesReader(w, r.Body, maxMultimodalUploadBytes)
+		if err := r.ParseMultipartForm(maxMultimodalUploadBytes); err != nil {
+			http.Error(w, "media upload is too large or invalid", http.StatusRequestEntityTooLarge)
+			return
+		}
+		if operation == capability.MultimodalGenerateImage {
+			if strings.TrimSpace(g.imageProviderURL) == "" {
+				http.Error(w, "local image generation capability unavailable", http.StatusBadGateway)
+				return
+			}
+			prompt := r.FormValue("prompt")
+			image, err := g.imageGenerator.Generate(r.Context(), g.imageModel, prompt, imageRequestSize(prompt, r.FormValue("size")))
+			if err != nil || strings.TrimSpace(image.DataBase64) == "" {
+				logMultimodalFailure(operation, err)
+				http.Error(w, "local image generation capability unavailable", http.StatusBadGateway)
+				return
+			}
+			result := capability.MultimodalResponse{Operation: operation, Provider: "local-image-generator", ObservedAt: g.now().UnixMilli(), ContentType: image.ContentType, DataBase64: image.DataBase64}
+			w.Header().Set("Content-Type", "application/json")
+			_ = json.NewEncoder(w).Encode(result)
+			return
+		}
+		file, header, err := r.FormFile("file")
+		if err != nil {
+			http.Error(w, "media file is required", http.StatusBadRequest)
+			return
+		}
+		defer file.Close()
+		data, err := io.ReadAll(io.LimitReader(file, maxMultimodalUploadBytes+1))
+		if err != nil || len(data) == 0 || len(data) > maxMultimodalUploadBytes {
+			http.Error(w, "media file is invalid", http.StatusBadRequest)
+			return
+		}
+		contentType := header.Header.Get("Content-Type")
+		if contentType == "" {
+			contentType = "application/octet-stream"
+		}
+		var text string
+		if operation == capability.MultimodalTranscribe {
+			text, err = g.speech.Transcribe(r.Context(), header.Filename, contentType, data)
+		} else if operation == capability.MultimodalUnderstandVideo {
+			if strings.TrimSpace(g.video.BaseURL) == "" {
+				http.Error(w, "local video understanding capability unavailable", http.StatusBadGateway)
+				return
+			}
+			text, err = g.video.Describe(r.Context(), g.videoModel, header.Filename, contentType, data, r.FormValue("instruction"))
+		} else {
+			instruction := "Опиши, что изображено на фотографии, коротко и по существу. Не выдумывай нечитаемые детали."
+			if operation == capability.MultimodalRecognizeOCR {
+				instruction = "Точно распознай весь читаемый текст на изображении. Сохрани строки и символы; нечитаемые места обозначь как [неразборчиво]. Не добавляй пояснений."
+			}
+			text, err = g.vision.Describe(r.Context(), g.model, contentType, data, instruction)
+		}
+		if err != nil {
+			logMultimodalFailure(operation, err)
+			http.Error(w, "local media capability unavailable", http.StatusBadGateway)
+			return
+		}
+		result := capability.MultimodalResponse{Operation: operation, Text: strings.TrimSpace(text), ObservedAt: g.now().UnixMilli(), ConfidenceNote: "Результат получен локальным специализированным сервисом; нечитаемые или неоднозначные фрагменты требуют проверки."}
+		if operation == capability.MultimodalTranscribe {
+			result.Provider = "local-whisper"
+		} else {
+			result.Provider = "local-vision"
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(result)
+	}
+}
+
+// imageRequestSize is a transport-level normalization for the local image
+// capability.  An explicit, valid size always wins.  When the caller only
+// expresses a conventional output-quality target, the capability translates it
+// to a supported provider size without exposing provider workflow details to
+// the interaction core.  This policy is deliberately local and replaceable
+// with the image capability implementation.
+func imageRequestSize(prompt, requested string) string {
+	if isImageSize(requested) {
+		return strings.TrimSpace(requested)
+	}
+	words := strings.Fields(strings.ToLower(prompt))
+	for index, word := range words {
+		switch word {
+		case "4k", "uhd":
+			return "2048x2048"
+		case "hd":
+			return "1024x1024"
+		case "ultra":
+			if index+1 < len(words) && words[index+1] == "hd" {
+				return "2048x2048"
+			}
+		}
+	}
+	return ""
+}
+
+func isImageSize(value string) bool {
+	var width, height int
+	if _, err := fmt.Sscanf(strings.TrimSpace(value), "%dx%d", &width, &height); err != nil {
+		return false
+	}
+	return width >= 256 && height >= 256 && width <= 2048 && height <= 2048
+}
+
+func logMultimodalFailure(operation capability.MultimodalOperation, err error) {
+	// Keep provider details in server diagnostics; never return them to chat.
+	log.Printf("multimodal operation %s failed: %v", operation, err)
+}

cmd/cognitive-worker/multimodal_test.go

@@ -0,0 +1,96 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"git.cin.su/m/Assistant/adapters/multimodal"
+	"git.cin.su/m/Assistant/contracts/capability"
+)
+
+func TestMultimodalTranscriptionHandlerReturnsLocalResult(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/inference" || r.Method != http.MethodPost {
+			t.Fatalf("unexpected upstream request: %s %s", r.Method, r.URL.Path)
+		}
+		_ = json.NewEncoder(w).Encode(map[string]string{"text": "добрый день"})
+	}))
+	defer upstream.Close()
+	server := multimodalGateway{speech: multimodal.SpeechClient{BaseURL: upstream.URL, Client: upstream.Client()}, now: time.Now}
+	request := multipartRequest(t, "/v1/multimodal/transcribe", "voice.wav", []byte("audio"))
+	response := httptest.NewRecorder()
+	server.handler(capability.MultimodalTranscribe)(response, request)
+	if response.Code != http.StatusOK || !bytes.Contains(response.Body.Bytes(), []byte("добрый день")) {
+		t.Fatalf("status=%d body=%s", response.Code, response.Body.String())
+	}
+}
+
+func TestMultimodalImageGenerationFailsClosedWhenSkillIsUnbound(t *testing.T) {
+	server := multimodalGateway{now: time.Now}
+	body := &bytes.Buffer{}
+	writer := multipart.NewWriter(body)
+	if err := writer.WriteField("prompt", "green bird"); err != nil || writer.Close() != nil {
+		t.Fatal("failed to build generation request")
+	}
+	request := httptest.NewRequest(http.MethodPost, "/v1/multimodal/generate-image", body)
+	request.Header.Set("Content-Type", writer.FormDataContentType())
+	response := httptest.NewRecorder()
+	server.handler(capability.MultimodalGenerateImage)(response, request)
+	if response.Code != http.StatusBadGateway || !bytes.Contains(response.Body.Bytes(), []byte("unavailable")) {
+		t.Fatalf("status=%d body=%s", response.Code, response.Body.String())
+	}
+}
+
+func TestImageRequestSizeUsesExplicitSizeOrQualityTarget(t *testing.T) {
+	for _, test := range []struct {
+		name      string
+		prompt    string
+		requested string
+		want      string
+	}{
+		{name: "explicit", prompt: "нарисуй птицу", requested: "768x512", want: "768x512"},
+		{name: "hd", prompt: "нарисуй птицу в HD", want: "1024x1024"},
+		{name: "uhd", prompt: "draw a bird in UHD", want: "2048x2048"},
+		{name: "ordinary", prompt: "нарисуй птицу", want: ""},
+		{name: "invalid explicit", prompt: "нарисуй птицу", requested: "100x100", want: ""},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			if got := imageRequestSize(test.prompt, test.requested); got != test.want {
+				t.Fatalf("imageRequestSize(%q, %q) = %q, want %q", test.prompt, test.requested, got, test.want)
+			}
+		})
+	}
+}
+
+func TestMultimodalVideoUnderstandingFailsClosedWhenSkillIsUnbound(t *testing.T) {
+	server := multimodalGateway{now: time.Now}
+	request := multipartRequest(t, "/v1/multimodal/video-understand", "clip.mp4", []byte("video"))
+	response := httptest.NewRecorder()
+	server.handler(capability.MultimodalUnderstandVideo)(response, request)
+	if response.Code != http.StatusBadGateway || !bytes.Contains(response.Body.Bytes(), []byte("unavailable")) {
+		t.Fatalf("status=%d body=%s", response.Code, response.Body.String())
+	}
+}
+
+func multipartRequest(t *testing.T, path, filename string, data []byte) *http.Request {
+	t.Helper()
+	body := &bytes.Buffer{}
+	writer := multipart.NewWriter(body)
+	part, err := writer.CreateFormFile("file", filename)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := part.Write(data); err != nil || writer.Close() != nil {
+		t.Fatal("failed to build multipart request")
+	}
+	request := httptest.NewRequest(http.MethodPost, path, body)
+	request = request.WithContext(context.Background())
+	request.Header.Set("Content-Type", writer.FormDataContentType())
+	return request
+}

cmd/cognitive-worker/task_evaluation.go

@@ -100,7 +100,7 @@ func (g cognitiveGateway) executeTaskEvaluationCases(ctx context.Context, reques
 		go func(index int, item capability.TaskEvaluationCase) {
 			defer wg.Done()
 			started := time.Now()
-			invocation := cognitive.AdvisoryRequest{Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(fmt.Sprintf("task-evaluation:%s:%s", request.Profile.ID, item.CaseID)), ActorID: request.ActorID, PrincipalID: request.PrincipalID, ScopeID: request.ScopeID, Message: item.Prompt, MaxOutputBytes: int(request.MaxOutputBytes), ProviderBindingID: selected.Binding.ID, ProviderBindingRevision: selected.Binding.Revision, ProviderInstanceID: selected.Provider.ID, ModelDescriptorID: selected.Model.ID, ProviderModelID: selected.Model.ProviderModelID}
+			invocation := cognitive.AdvisoryRequest{Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(fmt.Sprintf("task-evaluation:%s:%s", request.Profile.ID, item.CaseID)), ActorID: request.ActorID, PrincipalID: request.PrincipalID, ScopeID: request.ScopeID, Message: item.Prompt, Locale: "en-US", MaxOutputBytes: int(request.MaxOutputBytes), ProviderBindingID: selected.Binding.ID, ProviderBindingRevision: selected.Binding.Revision, ProviderInstanceID: selected.Provider.ID, ModelDescriptorID: selected.Model.ID, ProviderModelID: selected.Model.ProviderModelID}
 			response, invokeErr := g.invokeAdmitted(ctx, string(invocation.RequestID), provider, invocation, int(request.MaxOutputBytes))
 			latency := time.Since(started).Microseconds()
 			observations[index] = capability.TaskCaseObservation{CaseID: item.CaseID, Result: capability.EvaluationUnknown, CriticalFailure: invokeErr != nil || response.FinishReason != cognitive.FinishCompleted || strings.TrimSpace(response.AdvisoryText) == "", EvidenceArtifactRef: item.EvidenceArtifactRef, LatencyMicros: latency}

cmd/cognitive-worker/task_evaluation_test.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -57,6 +58,30 @@ func TestTaskEvaluationHandlerInvokesEveryBoundedCase(t *testing.T) {
 	}
 }
 
+type localeCheckingProvider struct{ stubAdvisoryProvider }
+
+func (p *localeCheckingProvider) Advise(ctx context.Context, request cognitive.AdvisoryRequest) (cognitive.AdvisoryResponse, error) {
+	if request.Locale == "" {
+		return cognitive.AdvisoryResponse{}, fmt.Errorf("task evaluation omitted required locale")
+	}
+	return p.stubAdvisoryProvider.Advise(ctx, request)
+}
+
+func TestTaskEvaluationSuppliesLocaleToProviderAdapter(t *testing.T) {
+	selected := gatewaySelection()
+	provider := &localeCheckingProvider{stubAdvisoryProvider{response: cognitive.AdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, FinishReason: cognitive.FinishCompleted, AdvisoryText: "observed response"}}}
+	registry := &candidateRegistryStub{selected: selected}
+	gateway := cognitiveGateway{resolver: registry, providers: map[capability.ProviderKind][]providerRegistration{selected.Provider.Kind: {{ProviderInstanceID: selected.Provider.ID, Kind: selected.Provider.Kind, EndpointRef: selected.Provider.EndpointRef, CredentialRef: selected.Provider.CredentialRef, Provider: provider}}}, now: time.Now}
+	profile := capability.TaskEvaluationProfile{ID: "profile-locale", Revision: 1, CapabilityID: selected.Binding.CapabilityID, Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "locale-v1", RequiredCaseIDs: []string{"case-locale"}, QualityWeightMillis: 600, ReliabilityWeightMillis: 300, LatencyWeightMillis: 100}
+	request := capability.TaskEvaluationExecutionRequest{Profile: profile, CapabilityID: selected.Binding.CapabilityID, BindingID: selected.Binding.ID, BindingRevision: selected.Binding.Revision, ActorID: identity.ActorID("actor-1"), PrincipalID: selected.Binding.OwnerPrincipalID, ScopeID: authority.ScopeID("scope-1"), MaxOutputBytes: 512, EgressAcknowledged: true, Cases: []capability.TaskEvaluationCase{{CaseID: "case-locale", Prompt: "one", EvidenceArtifactRef: "artifact:locale"}}}
+	payload, _ := json.Marshal(request)
+	recorder := httptest.NewRecorder()
+	gateway.taskEvaluationHandler(recorder, httptest.NewRequest(http.MethodPost, "/v1/task-evaluations/execute", bytes.NewReader(payload)))
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String())
+	}
+}
+
 type taskEvaluationFailoverRegistry struct {
 	primary, fallback capability.ResolvedCognitiveBinding
 	resolveCalls      int

cmd/commit-runtime/candidate_release_context.go

@@ -0,0 +1,41 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/identity"
+)
+
+// candidateReleaseContextFromRuntime accepts only deployment-owned metadata.
+// It never derives a candidate slot from an HTTP request or notification body.
+func candidateReleaseContextFromRuntime() (*capability.CandidateReleaseContext, error) {
+	const prefix = "CANDIDATE_"
+	release := os.Getenv(prefix + "RELEASE_SET_ID")
+	if release == "" {
+		return nil, nil
+	}
+	context := &capability.CandidateReleaseContext{
+		ReleaseSetID:     release,
+		Slot:             os.Getenv(prefix + "SLOT"),
+		TaskID:           os.Getenv(prefix + "TASK_ID"),
+		PrincipalID:      identity.PrincipalID(os.Getenv(prefix + "PRINCIPAL_ID")),
+		CapabilityID:     capability.CapabilityID(os.Getenv(prefix + "CAPABILITY_ID")),
+		ResourceScope:    os.Getenv(prefix + "RESOURCE_SCOPE"),
+		Mode:             capability.CandidateBindingMode(os.Getenv(prefix + "BINDING_MODE")),
+		TargetKind:       os.Getenv(prefix + "TARGET_KIND"),
+		TargetRef:        os.Getenv(prefix + "TARGET_REF"),
+		TargetDigest:     os.Getenv(prefix + "TARGET_DIGEST"),
+		AuthorityGrantID: os.Getenv(prefix + "AUTHORITY_GRANT_ID"),
+	}
+	var revision int64
+	if _, err := fmt.Sscan(os.Getenv(prefix+"TASK_REVISION"), &revision); err != nil {
+		return nil, fmt.Errorf("candidate task revision: %w", err)
+	}
+	context.TaskRevision = revision
+	if context.Slot == "" || context.TaskID == "" || context.TaskRevision < 1 || context.PrincipalID == "" || context.CapabilityID == "" || context.ResourceScope == "" || context.Mode == "" || context.TargetKind == "" || context.TargetRef == "" || context.TargetDigest == "" || context.AuthorityGrantID == "" {
+		return nil, fmt.Errorf("incomplete candidate release metadata")
+	}
+	return context, nil
+}

cmd/commit-runtime/candidate_release_context_test.go

@@ -0,0 +1,25 @@
+package main
+
+import "testing"
+
+func TestCandidateReleaseContextRequiresDeploymentMetadata(t *testing.T) {
+	t.Setenv("CANDIDATE_RELEASE_SET_ID", "assistant-slot-b")
+	if _, err := candidateReleaseContextFromRuntime(); err == nil {
+		t.Fatal("partial candidate metadata was accepted")
+	}
+	t.Setenv("CANDIDATE_SLOT", "b")
+	t.Setenv("CANDIDATE_TASK_ID", "GEN2-CAPABILITY-001")
+	t.Setenv("CANDIDATE_TASK_REVISION", "7")
+	t.Setenv("CANDIDATE_PRINCIPAL_ID", "domovoy-creator-principal")
+	t.Setenv("CANDIDATE_CAPABILITY_ID", "prospective-notification-delivery")
+	t.Setenv("CANDIDATE_RESOURCE_SCOPE", "synthetic-shadow-notification-v1")
+	t.Setenv("CANDIDATE_BINDING_MODE", "SHADOW")
+	t.Setenv("CANDIDATE_TARGET_KIND", "NOTIFICATION_SHADOW_RECEIVER")
+	t.Setenv("CANDIDATE_TARGET_REF", "notification-receiver-candidate")
+	t.Setenv("CANDIDATE_TARGET_DIGEST", "f9f9fa49a0727444c280c092d5bb340f3a8f33cf325c5396f5ae177a6666da35")
+	t.Setenv("CANDIDATE_AUTHORITY_GRANT_ID", "grant")
+	context, err := candidateReleaseContextFromRuntime()
+	if err != nil || context.ReleaseSetID != "assistant-slot-b" || context.TaskRevision != 7 {
+		t.Fatalf("context=%+v err=%v", context, err)
+	}
+}

cmd/commit-runtime/control_plane_authority.go

@@ -0,0 +1,170 @@
+package main
+
+import (
+	"context"
+	"crypto/subtle"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"git.cin.su/m/Assistant/contracts/authority"
+	"git.cin.su/m/Assistant/contracts/identity"
+	secretcontracts "git.cin.su/m/Assistant/contracts/secrets"
+	authoritydomain "git.cin.su/m/Assistant/modules/authority/domain"
+	"git.cin.su/m/Assistant/platform/ids"
+	platformsecrets "git.cin.su/m/Assistant/platform/secrets"
+)
+
+const (
+	delegatedControlPlaneActor     identity.ActorID     = "domovoy-control-plane-actor"
+	delegatedControlPlanePrincipal identity.PrincipalID = "domovoy-control-plane-principal"
+	delegatedControlPlaneTokenFile                      = "control_plane_service_token"
+)
+
+type delegatedControlPlaneAuthoritySource interface {
+	LoadDelegatedControlPlaneGrant(context.Context, authority.GrantID) (authority.DelegatedControlPlaneGrant, error)
+	RecordDelegatedControlPlaneAudit(context.Context, authority.DelegatedControlPlaneAudit) error
+	RevokeDelegatedControlPlaneGrant(context.Context, authority.GrantID, string) (bool, error)
+}
+
+type delegatedControlPlaneCore interface {
+	Session(context.Context, string) (identity.CreatorSession, error)
+	Binding(context.Context, identity.ActorID, identity.PrincipalID) (identity.PrincipalBinding, error)
+}
+
+type delegatedControlPlaneHandler struct {
+	authority  delegatedControlPlaneAuthoritySource
+	core       delegatedControlPlaneCore
+	credential func() (string, error)
+	now        func() time.Time
+	newID      func() (ids.ID, error)
+}
+
+func registerDelegatedControlPlaneRoutes(mux *http.ServeMux, handler delegatedControlPlaneHandler) {
+	mux.HandleFunc("POST /v1/internal/control-plane/authorize", handler.authorize)
+	mux.HandleFunc("POST /v1/internal/control-plane/completions", handler.complete)
+	mux.HandleFunc("POST /v1/creator/control-plane/grants/{grant}/revoke", handler.revoke)
+}
+
+func (h delegatedControlPlaneHandler) authorize(w http.ResponseWriter, r *http.Request) {
+	if !h.serviceAuthenticated(r) {
+		http.Error(w, "service principal denied", http.StatusUnauthorized)
+		return
+	}
+	var request authority.DelegatedControlPlaneRequest
+	decoder := json.NewDecoder(io.LimitReader(r.Body, 8<<10))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&request); err != nil {
+		http.Error(w, "invalid delegated control-plane request", http.StatusBadRequest)
+		return
+	}
+	grant, err := h.authority.LoadDelegatedControlPlaneGrant(r.Context(), request.GrantID)
+	if err != nil {
+		http.Error(w, "delegated authority denied", http.StatusForbidden)
+		return
+	}
+	binding, err := h.core.Binding(r.Context(), delegatedControlPlaneActor, delegatedControlPlanePrincipal)
+	if err != nil || authoritydomain.ValidateDelegatedControlPlaneGrant(h.now().UnixMilli(), binding, grant, request) != nil {
+		_ = h.audit(r.Context(), grant, request, "DENY", "FAILED")
+		http.Error(w, "delegated authority denied", http.StatusForbidden)
+		return
+	}
+	if err := h.audit(r.Context(), grant, request, "ALLOW", "PENDING"); err != nil {
+		http.Error(w, "delegated audit unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func (h delegatedControlPlaneHandler) complete(w http.ResponseWriter, r *http.Request) {
+	if !h.serviceAuthenticated(r) {
+		http.Error(w, "service principal denied", http.StatusUnauthorized)
+		return
+	}
+	var value authority.DelegatedControlPlaneCompletion
+	decoder := json.NewDecoder(io.LimitReader(r.Body, 8<<10))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&value); err != nil || (value.Outcome != "COMPLETED" && value.Outcome != "FAILED") {
+		http.Error(w, "invalid delegated completion", http.StatusBadRequest)
+		return
+	}
+	grant, err := h.authority.LoadDelegatedControlPlaneGrant(r.Context(), value.Request.GrantID)
+	if err != nil {
+		http.Error(w, "delegated authority unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	if !authoritydomain.RequestMatchesDelegatedControlPlaneGrant(grant, value.Request) {
+		http.Error(w, "delegated completion denied", http.StatusForbidden)
+		return
+	}
+	if err := h.audit(r.Context(), grant, value.Request, "ALLOW", value.Outcome); err != nil {
+		http.Error(w, "delegated audit unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func (h delegatedControlPlaneHandler) revoke(w http.ResponseWriter, r *http.Request) {
+	session, err := h.core.Session(r.Context(), r.Header.Get("Authorization"))
+	if err != nil {
+		http.Error(w, "creator session denied", http.StatusUnauthorized)
+		return
+	}
+	grant, err := h.authority.LoadDelegatedControlPlaneGrant(r.Context(), authority.GrantID(r.PathValue("grant")))
+	if err != nil || !authoritydomain.CanIssuerRevokeDelegatedGrant(session.PrincipalID, grant) {
+		http.Error(w, "delegated grant revoke denied", http.StatusForbidden)
+		return
+	}
+	ok, err := h.authority.RevokeDelegatedControlPlaneGrant(r.Context(), grant.ID, string(session.PrincipalID))
+	if err != nil || !ok {
+		http.Error(w, "delegated grant revoke denied", http.StatusConflict)
+		return
+	}
+	request := authority.DelegatedControlPlaneRequest{GrantID: grant.ID, TaskID: grant.TaskID, TaskRevision: grant.TaskRevision, Operation: authority.DelegatedOperationRevokeControlPlaneGrant, Resource: grant.Resource}
+	if err := h.audit(r.Context(), grant, request, "REVOKE", "REVOKED"); err != nil {
+		http.Error(w, "delegated audit unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func (h delegatedControlPlaneHandler) serviceAuthenticated(r *http.Request) bool {
+	if h.credential == nil {
+		return false
+	}
+	expected, err := h.credential()
+	presented := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+	return err == nil && expected != "" && presented != "" && subtle.ConstantTimeCompare([]byte(expected), []byte(presented)) == 1
+}
+
+func (h delegatedControlPlaneHandler) audit(ctx context.Context, grant authority.DelegatedControlPlaneGrant, request authority.DelegatedControlPlaneRequest, decision, outcome string) error {
+	if h.newID == nil {
+		return errors.New("delegated audit id unavailable")
+	}
+	id, err := h.newID()
+	if err != nil {
+		return err
+	}
+	return h.authority.RecordDelegatedControlPlaneAudit(ctx, authority.DelegatedControlPlaneAudit{AuditID: id, GrantID: grant.ID, ServiceActorID: delegatedControlPlaneActor, ServicePrincipalID: delegatedControlPlanePrincipal, TaskID: request.TaskID, TaskRevision: request.TaskRevision, Operation: request.Operation, Resource: request.Resource, Decision: decision, Outcome: outcome, RecordedAtUnixMillis: h.now().UnixMilli()})
+}
+
+func delegatedControlPlaneCredential() (string, error) {
+	ref := os.Getenv("CONTROL_PLANE_SERVICE_CREDENTIAL_REF")
+	if ref == "" {
+		return "", errors.New("control-plane service credential ref is required")
+	}
+	root := os.Getenv("CONTROL_PLANE_SERVICE_SECRET_ROOT")
+	if root == "" {
+		root = "/run/control-plane-secrets"
+	}
+	resolver, err := platformsecrets.NewFileResolver(root)
+	if err != nil {
+		return "", err
+	}
+	return resolver.ResolveFile(secretcontracts.SecretFileRef{CredentialRef: secretcontracts.CredentialRef(ref), Purpose: secretcontracts.SecretPurposeServiceAuthentication, Consumer: secretcontracts.RuntimeConsumerCommit, Path: filepath.Join(root, delegatedControlPlaneTokenFile)})
+}

cmd/commit-runtime/control_plane_authority_test.go

@@ -0,0 +1,140 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"git.cin.su/m/Assistant/contracts/authority"
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/identity"
+	"git.cin.su/m/Assistant/platform/ids"
+)
+
+type delegatedAuthorityFake struct {
+	grant   authority.DelegatedControlPlaneGrant
+	audits  []authority.DelegatedControlPlaneAudit
+	revoked bool
+}
+
+func TestCandidateBindingResolutionUsesServiceCredential(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1/internal/capability-bindings/candidate/resolve" || r.Header.Get("Authorization") != "Bearer service-token" {
+			t.Fatalf("unexpected candidate resolution request: %s %q", r.URL.Path, r.Header.Get("Authorization"))
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"reason":"EXACT_CONTEXT"}`))
+	}))
+	defer server.Close()
+	client, err := newCreatorCoreClient(server.URL, server.Client())
+	if err != nil {
+		t.Fatal(err)
+	}
+	client.serviceCredential = func() (string, error) { return "service-token", nil }
+	if _, err := client.ResolveCandidateCapabilityBinding(context.Background(), capability.CandidateReleaseContext{}); err != nil {
+		t.Fatalf("resolve candidate binding: %v", err)
+	}
+}
+
+func TestDelegatedAuthorityCredentialRotationRejectsOldToken(t *testing.T) {
+	root := t.TempDir()
+	tokenPath := filepath.Join(root, "control_plane_service_token")
+	if err := os.WriteFile(tokenPath, []byte("old-token\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("CONTROL_PLANE_SERVICE_CREDENTIAL_REF", "credential://domovoy/control-plane/service-token/v1")
+	t.Setenv("CONTROL_PLANE_SERVICE_SECRET_ROOT", root)
+	h := delegatedControlPlaneHandler{credential: delegatedControlPlaneCredential}
+	oldRequest := httptest.NewRequest(http.MethodPost, "/v1/internal/control-plane/authorize", nil)
+	oldRequest.Header.Set("Authorization", "Bearer old-token")
+	if !h.serviceAuthenticated(oldRequest) {
+		t.Fatal("active credential was rejected before rotation")
+	}
+	if err := os.WriteFile(tokenPath, []byte("new-token\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if h.serviceAuthenticated(oldRequest) {
+		t.Fatal("old credential remained valid after rotation")
+	}
+	newRequest := httptest.NewRequest(http.MethodPost, "/v1/internal/control-plane/authorize", nil)
+	newRequest.Header.Set("Authorization", "Bearer new-token")
+	if !h.serviceAuthenticated(newRequest) {
+		t.Fatal("new credential was rejected after rotation")
+	}
+}
+
+func (f *delegatedAuthorityFake) LoadDelegatedControlPlaneGrant(context.Context, authority.GrantID) (authority.DelegatedControlPlaneGrant, error) {
+	if f.grant.ID == "" {
+		return authority.DelegatedControlPlaneGrant{}, errors.New("missing")
+	}
+	return f.grant, nil
+}
+func (f *delegatedAuthorityFake) RecordDelegatedControlPlaneAudit(_ context.Context, audit authority.DelegatedControlPlaneAudit) error {
+	f.audits = append(f.audits, audit)
+	return nil
+}
+func (f *delegatedAuthorityFake) RevokeDelegatedControlPlaneGrant(context.Context, authority.GrantID, string) (bool, error) {
+	f.revoked = true
+	f.grant.Status = authority.DelegatedGrantRevoked
+	return true, nil
+}
+
+type delegatedCoreFake struct{}
+
+func (delegatedCoreFake) Binding(context.Context, identity.ActorID, identity.PrincipalID) (identity.PrincipalBinding, error) {
+	return identity.PrincipalBinding{ActorID: delegatedControlPlaneActor, PrincipalID: delegatedControlPlanePrincipal, Active: true}, nil
+}
+func (delegatedCoreFake) Session(context.Context, string) (identity.CreatorSession, error) {
+	return identity.CreatorSession{PrincipalID: "owner"}, nil
+}
+
+func TestDelegatedAuthorityRejectsWrongResourceAndSurvivesRestart(t *testing.T) {
+	resource := authority.CognitiveBindingResource{BindingID: "binding", ProviderInstanceID: "provider", ModelDescriptorID: "model"}
+	fake := &delegatedAuthorityFake{grant: authority.DelegatedControlPlaneGrant{ID: "grant", ServiceActorID: delegatedControlPlaneActor, ServicePrincipalID: delegatedControlPlanePrincipal, IssuerPrincipalID: "owner", TaskID: "GEN2-COGNITIVE-003", TaskRevision: 4, Operations: []authority.DelegatedControlPlaneOperation{authority.DelegatedOperationCanaryCognitiveBinding}, Resource: resource, IssuedAtUnixMillis: 1, ExpiresAtUnixMillis: 100, ArchitectureRevision: "ADR-0021", Nonce: "nonce", Revision: 1, Status: authority.DelegatedGrantActive}}
+	h := delegatedControlPlaneHandler{authority: fake, core: delegatedCoreFake{}, credential: func() (string, error) { return "service-token", nil }, now: func() time.Time { return time.UnixMilli(10) }, newID: func() (ids.ID, error) { return "audit", nil }}
+	mux := http.NewServeMux()
+	registerDelegatedControlPlaneRoutes(mux, h)
+	valid := `{"GrantID":"grant","TaskID":"GEN2-COGNITIVE-003","TaskRevision":4,"Operation":"CANARY_COGNITIVE_BINDING","Resource":{"BindingID":"binding","ProviderInstanceID":"provider","ModelDescriptorID":"model"}}`
+	request := httptest.NewRequest(http.MethodPost, "/v1/internal/control-plane/authorize", strings.NewReader(valid))
+	request.Header.Set("Authorization", "Bearer service-token")
+	response := httptest.NewRecorder()
+	mux.ServeHTTP(response, request)
+	if response.Code != http.StatusNoContent {
+		t.Fatalf("valid delegation status=%d", response.Code)
+	}
+	wrong := strings.Replace(valid, `"binding"`, `"other"`, 1)
+	request = httptest.NewRequest(http.MethodPost, "/v1/internal/control-plane/authorize", strings.NewReader(wrong))
+	request.Header.Set("Authorization", "Bearer service-token")
+	response = httptest.NewRecorder()
+	mux.ServeHTTP(response, request)
+	if response.Code != http.StatusForbidden {
+		t.Fatalf("wrong resource status=%d", response.Code)
+	}
+	// A fresh handler reads the same durable grant source; no process-local allow survives restart.
+	request = httptest.NewRequest(http.MethodPost, "/v1/creator/control-plane/grants/grant/revoke", nil)
+	request.Header.Set("Authorization", "Bearer creator-session")
+	response = httptest.NewRecorder()
+	mux.ServeHTTP(response, request)
+	if response.Code != http.StatusNoContent || !fake.revoked {
+		t.Fatalf("revoke status=%d revoked=%v", response.Code, fake.revoked)
+	}
+	restarted := delegatedControlPlaneHandler{authority: fake, core: delegatedCoreFake{}, credential: h.credential, now: h.now, newID: h.newID}
+	mux = http.NewServeMux()
+	registerDelegatedControlPlaneRoutes(mux, restarted)
+	request = httptest.NewRequest(http.MethodPost, "/v1/internal/control-plane/authorize", strings.NewReader(valid))
+	request.Header.Set("Authorization", "Bearer service-token")
+	response = httptest.NewRecorder()
+	mux.ServeHTTP(response, request)
+	if response.Code != http.StatusForbidden {
+		t.Fatalf("revoked grant accepted after restart: %d", response.Code)
+	}
+	if len(fake.audits) < 3 {
+		t.Fatalf("audit trail missing: %#v", fake.audits)
+	}
+}

cmd/commit-runtime/creator_clients.go

@@ -25,8 +25,9 @@ var (
 )
 
 type creatorCoreClient struct {
-	baseURL *url.URL
-	client  *http.Client
+	baseURL           *url.URL
+	client            *http.Client
+	serviceCredential func() (string, error)
 }
 
 type creatorContinuityClient struct {
@@ -121,6 +122,58 @@ func (c creatorCoreClient) CapabilityBinding(ctx context.Context, id capability.
 	return binding, nil
 }
 
+func (c creatorCoreClient) ResolveCandidateCapabilityBinding(ctx context.Context, context capability.CandidateReleaseContext) (capability.CandidateBindingResolution, error) {
+	var resolved capability.CandidateBindingResolution
+	status, err := c.postServiceAuthenticated(ctx, "/v1/internal/capability-bindings/candidate/resolve", context, &resolved)
+	if err != nil || status != http.StatusOK {
+		return capability.CandidateBindingResolution{}, errCreatorQueryUnavailable
+	}
+	return resolved, nil
+}
+
+func (c creatorCoreClient) postServiceAuthenticated(ctx context.Context, path string, value any, destination any) (int, error) {
+	if c.serviceCredential == nil {
+		return 0, errCreatorQueryUnavailable
+	}
+	credential, err := c.serviceCredential()
+	if err != nil || credential == "" {
+		return 0, errCreatorQueryUnavailable
+	}
+	return c.postWithAuthorization(ctx, path, value, destination, "Bearer "+credential)
+}
+
+func (c creatorCoreClient) post(ctx context.Context, path string, value any, destination any) (int, error) {
+	return c.postWithAuthorization(ctx, path, value, destination, "")
+}
+
+func (c creatorCoreClient) postWithAuthorization(ctx context.Context, path string, value any, destination any, authorization string) (int, error) {
+	target := *c.baseURL
+	target.Path, target.RawQuery = path, ""
+	body, err := json.Marshal(value)
+	if err != nil {
+		return 0, err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, target.String(), strings.NewReader(string(body)))
+	if err != nil {
+		return 0, err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	if authorization != "" {
+		request.Header.Set("Authorization", authorization)
+	}
+	response, err := c.client.Do(request)
+	if err != nil {
+		return 0, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode == http.StatusOK && destination != nil {
+		if err := json.NewDecoder(io.LimitReader(response.Body, 32<<10)).Decode(destination); err != nil {
+			return 0, err
+		}
+	}
+	return response.StatusCode, nil
+}
+
 func (c creatorCoreClient) get(ctx context.Context, path, authorization string, destination any) (int, error) {
 	target := *c.baseURL
 	target.Path = path

cmd/commit-runtime/execution.go

@@ -24,6 +24,7 @@ type executionRepository interface {
 	LoadLatestAttempt(context.Context, commitcontract.AuthorizedActionID) (commitcontract.ActionAttempt, error)
 	BeginAttempt(context.Context, commitcontract.ActionAttempt) error
 	FinishAttempt(context.Context, commitcontract.ActionAttempt) error
+	SaveExecutionReceipt(context.Context, commitcontract.ExecutionReceipt) error
 }
 
 type attemptRequest struct {
@@ -94,10 +95,17 @@ func executeAuthorized(ctx context.Context, repository executionRepository, exec
 	if err := repository.BeginAttempt(ctx, begun); err != nil {
 		return commitcontract.ActionAttempt{}, err
 	}
-	attempt, operationErr := commitdomain.Execute(action, attemptID, executor)
+	attempt, result, operationErr := commitdomain.ExecuteWithResult(action, attemptID, executor)
 	if err := repository.FinishAttempt(ctx, attempt); err != nil {
 		return commitcontract.ActionAttempt{}, err
 	}
+	if result.Receipt != nil {
+		receipt := *result.Receipt
+		receipt.ActionAttemptRef = attempt.ID
+		if err := repository.SaveExecutionReceipt(ctx, receipt); err != nil {
+			return commitcontract.ActionAttempt{}, err
+		}
+	}
 	return attempt, operationErr
 }
 

cmd/commit-runtime/execution_test.go

@@ -16,6 +16,12 @@ import (
 type fakeExecutionRepository struct {
 	action   commitcontract.AuthorizedAction
 	attempts []commitcontract.ActionAttempt
+	receipt  commitcontract.ExecutionReceipt
+}
+
+func (f *fakeExecutionRepository) SaveExecutionReceipt(_ context.Context, receipt commitcontract.ExecutionReceipt) error {
+	f.receipt = receipt
+	return nil
 }
 
 func (f *fakeExecutionRepository) LoadAuthorized(context.Context, commitcontract.AuthorizedActionID) (commitcontract.AuthorizedAction, error) {
@@ -47,7 +53,8 @@ type knownExecutor struct{ calls int }
 
 func (e *knownExecutor) Execute(commitcontract.AuthorizedAction) ports.ExecutionResult {
 	e.calls++
-	return ports.ExecutionResult{Known: true, Succeeded: true}
+	completed := int64(1)
+	return ports.ExecutionResult{Known: true, Succeeded: true, Receipt: &commitcontract.ExecutionReceipt{ID: "receipt-1", ExecutorImplementationRef: "test-executor", ExternalOperationRef: "SHADOW_CAPTURED", RequestDigest: "request", ExecutorResult: commitcontract.ExecutorReportedSuccess, ReconciliationKey: "receipt-1", DispatchAtUnixMillis: 1, CompletedAtUnixMillis: &completed}}
 }
 func (e *knownExecutor) Reconcile(commitcontract.AuthorizedAction) ports.ExecutionResult {
 	return ports.ExecutionResult{Known: true, Succeeded: true}
@@ -66,6 +73,9 @@ func TestExecutionIsDurablyBegunAndCannotBeBlindlyRepeated(t *testing.T) {
 	if result.Code != http.StatusOK || executor.calls != 1 || repository.attempts[0].State != commitcontract.ActionSucceeded {
 		t.Fatalf("status=%d calls=%d attempts=%#v", result.Code, executor.calls, repository.attempts)
 	}
+	if repository.receipt.ActionAttemptRef != repository.attempts[0].ID {
+		t.Fatalf("receipt attempt reference=%q want %q", repository.receipt.ActionAttemptRef, repository.attempts[0].ID)
+	}
 
 	repeated := httptest.NewRequest(http.MethodPost, "/v1/internal/authorized-actions/authorized-1/execute", strings.NewReader(`{"AttemptID":"attempt-2"}`))
 	repeated.Header.Set("Authorization", "Bearer secret")

cmd/commit-runtime/main.go

@@ -73,15 +73,18 @@ func main() {
 	if err != nil {
 		log.Fatal(err)
 	}
-	notificationSecret, err := readCommitSecretFile("NOTIFICATION_WRITE_TOKEN_FILE")
+	candidateContext, err := candidateReleaseContextFromRuntime()
 	if err != nil {
 		log.Fatal(err)
 	}
-	notificationSecretRef := os.Getenv("NOTIFICATION_WRITE_SECRET_REF")
-	if notificationSecretRef == "" {
-		log.Fatal("NOTIFICATION_WRITE_SECRET_REF is required")
+	notificationSecretRef, notificationSecret, err := notificationCredentialsFromRuntime(candidateContext != nil)
+	if err != nil {
+		log.Fatal(err)
 	}
-	dispatcher := operationDispatcher{continuityExecutor: continuityExecutor, continuityReconciler: continuityExecutor, bindings: creatorCore, secretRef: notificationSecretRef, secret: notificationSecret, client: creatorHTTPClient}
+	if candidateContext != nil {
+		creatorCore.serviceCredential = delegatedControlPlaneCredential
+	}
+	dispatcher := operationDispatcher{continuityExecutor: continuityExecutor, continuityReconciler: continuityExecutor, bindings: creatorCore, secretRef: notificationSecretRef, secret: notificationSecret, client: creatorHTTPClient, candidateContext: candidateContext}
 	mux := http.NewServeMux()
 	mux.Handle("/healthz", health.Handler{Runtime: "commit-runtime", SemanticGeneration: 1, ArchitectureGeneration: 1})
 	readinessClient := &http.Client{Timeout: 2 * time.Second}
@@ -100,6 +103,9 @@ func main() {
 		core: creatorCore, continuity: creatorContinuity, authority: authorityRepository, repository: repository,
 		executor: dispatcher, newID: ids.New, now: time.Now,
 	}, executorToken)
+	registerDelegatedControlPlaneRoutes(mux, delegatedControlPlaneHandler{
+		authority: authorityRepository, core: creatorCore, credential: delegatedControlPlaneCredential, now: time.Now, newID: ids.New,
+	})
 	mux.HandleFunc("POST /v1/authorized-actions", func(w http.ResponseWriter, r *http.Request) {
 		var request authorizationRequest
 		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
@@ -159,6 +165,24 @@ func main() {
 	}
 }
 
+// notificationCredentialsFromRuntime keeps candidate shadow execution
+// physically separate from the production notification credential mount.
+func notificationCredentialsFromRuntime(candidate bool) (string, string, error) {
+	fileName, refName := "NOTIFICATION_WRITE_TOKEN_FILE", "NOTIFICATION_WRITE_SECRET_REF"
+	if candidate {
+		fileName, refName = "CANDIDATE_NOTIFICATION_WRITE_TOKEN_FILE", "CANDIDATE_NOTIFICATION_WRITE_SECRET_REF"
+	}
+	secret, err := readCommitSecretFile(fileName)
+	if err != nil {
+		return "", "", err
+	}
+	ref := os.Getenv(refName)
+	if ref == "" {
+		return "", "", fmt.Errorf("%s is required", refName)
+	}
+	return ref, secret, nil
+}
+
 func readCommitSecretFile(name string) (string, error) {
 	path := os.Getenv(name)
 	if path == "" {

cmd/commit-runtime/notification_executor.go

@@ -14,6 +14,7 @@ import (
 type notificationBindingSource interface {
 	ActiveCapabilityBinding(context.Context, capability.CapabilityID, identity.PrincipalID) (capability.Binding, error)
 	CapabilityBinding(context.Context, capability.CapabilityBindingID, int64) (capability.Binding, error)
+	ResolveCandidateCapabilityBinding(context.Context, capability.CandidateReleaseContext) (capability.CandidateBindingResolution, error)
 }
 
 type operationDispatcher struct {
@@ -23,6 +24,7 @@ type operationDispatcher struct {
 	secretRef            string
 	secret               string
 	client               *http.Client
+	candidateContext     *capability.CandidateReleaseContext
 }
 
 func (d operationDispatcher) Execute(action commitcontract.AuthorizedAction) ports.ExecutionResult {
@@ -30,6 +32,20 @@ func (d operationDispatcher) Execute(action commitcontract.AuthorizedAction) por
 		return d.continuityExecutor.Execute(action)
 	}
 	subject := action.Proposal.NotificationSubject
+	if d.candidateContext != nil {
+		resolved, err := d.bindings.ResolveCandidateCapabilityBinding(context.Background(), *d.candidateContext)
+		if err != nil || resolved.Mode != capability.CandidateBindingModeShadow || resolved.Binding.Context != *d.candidateContext {
+			return ports.ExecutionResult{Known: true}
+		}
+		if subject.BindingID != resolved.Binding.BaseActiveBindingID || subject.BindingRevision != resolved.Binding.BaseActiveBindingRevision {
+			return ports.ExecutionResult{Known: true}
+		}
+		executor, err := notificationexecutor.NewShadow(resolved.Binding, d.secret, d.client)
+		if err != nil {
+			return ports.ExecutionResult{Known: true}
+		}
+		return executor.Execute(action)
+	}
 	exact, err := d.bindings.CapabilityBinding(context.Background(), subject.BindingID, subject.BindingRevision)
 	if err != nil || exact.SecretRef != d.secretRef {
 		return ports.ExecutionResult{Known: true}
@@ -49,6 +65,11 @@ func (d operationDispatcher) Reconcile(action commitcontract.AuthorizedAction) p
 	if action.Proposal.Operation != commitcontract.OperationDeliverProspectiveNotification {
 		return d.continuityReconciler.Reconcile(action)
 	}
+	if d.candidateContext != nil {
+		// A candidate shadow delivery is never reconciled against the ACTIVE
+		// production target. Its typed receipt is the sole candidate evidence.
+		return ports.ExecutionResult{Known: true}
+	}
 	subject := action.Proposal.NotificationSubject
 	exact, err := d.bindings.CapabilityBinding(context.Background(), subject.BindingID, subject.BindingRevision)
 	if err != nil || exact.SecretRef != d.secretRef {

cmd/commit-runtime/notification_executor_test.go

@@ -3,21 +3,43 @@ package main
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"testing"
 
 	"git.cin.su/m/Assistant/adapters/notificationexecutor"
 	"git.cin.su/m/Assistant/contracts/capability"
 	commitcontract "git.cin.su/m/Assistant/contracts/commit"
 	"git.cin.su/m/Assistant/contracts/identity"
+	capabilitydomain "git.cin.su/m/Assistant/modules/capability/domain"
 )
 
+func TestCandidateNotificationCredentialsDoNotFallbackToProductionCredential(t *testing.T) {
+	path := t.TempDir() + "/candidate-token"
+	if err := os.WriteFile(path, []byte("candidate-only-token"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("CANDIDATE_NOTIFICATION_WRITE_TOKEN_FILE", path)
+	t.Setenv("CANDIDATE_NOTIFICATION_WRITE_SECRET_REF", "credential://domovoy/candidate/notification-write/v1")
+	ref, secret, err := notificationCredentialsFromRuntime(true)
+	if err != nil || ref == "" || secret != "candidate-only-token" {
+		t.Fatalf("candidate credential resolution failed: ref=%q err=%v", ref, err)
+	}
+	t.Setenv("CANDIDATE_NOTIFICATION_WRITE_TOKEN_FILE", "")
+	if _, _, err := notificationCredentialsFromRuntime(true); err == nil {
+		t.Fatal("candidate path fell back to production notification credential")
+	}
+}
+
 type fakeNotificationBindings struct {
-	exact     capability.Binding
-	active    capability.Binding
-	exactErr  error
-	activeErr error
+	exact        capability.Binding
+	active       capability.Binding
+	exactErr     error
+	activeErr    error
+	candidate    capability.CandidateBindingResolution
+	candidateErr error
 }
 
 func (f fakeNotificationBindings) CapabilityBinding(context.Context, capability.CapabilityBindingID, int64) (capability.Binding, error) {
@@ -26,6 +48,9 @@ func (f fakeNotificationBindings) CapabilityBinding(context.Context, capability.
 func (f fakeNotificationBindings) ActiveCapabilityBinding(context.Context, capability.CapabilityID, identity.PrincipalID) (capability.Binding, error) {
 	return f.active, f.activeErr
 }
+func (f fakeNotificationBindings) ResolveCandidateCapabilityBinding(context.Context, capability.CandidateReleaseContext) (capability.CandidateBindingResolution, error) {
+	return f.candidate, f.candidateErr
+}
 
 func dispatcherAction(t *testing.T, binding capability.Binding) commitcontract.AuthorizedAction {
 	t.Helper()
@@ -81,3 +106,28 @@ func TestOperationDispatcherReconcilesRetiredHistoricalBinding(t *testing.T) {
 		t.Fatalf("reconcile=%+v", result)
 	}
 }
+
+func TestCandidateDispatcherUsesShadowBindingWithoutActiveFallback(t *testing.T) {
+	var action commitcontract.AuthorizedAction
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("X-Candidate-Release") != "assistant-slot-b" || r.Header.Get("X-Candidate-Task") != "GEN2-CAPABILITY-001" {
+			t.Fatalf("candidate headers missing")
+		}
+		_ = json.NewEncoder(w).Encode(notificationexecutor.Receipt{ReceiptID: "shadow-1", ActionIntentID: action.Proposal.IntentID, RequestDigest: action.Proposal.NotificationSubject.RequestDigest, AcceptedAt: 1, DeliveryMode: "SHADOW"})
+	}))
+	defer server.Close()
+	stable := dispatcherBinding("https://stable.invalid")
+	action = dispatcherAction(t, stable)
+	context := capability.CandidateReleaseContext{ReleaseSetID: "assistant-slot-b", Slot: "b", TaskID: "GEN2-CAPABILITY-001", TaskRevision: 7, PrincipalID: stable.OwnerPrincipalID, CapabilityID: stable.CapabilityID, ResourceScope: "synthetic-shadow-notification-v1", Mode: capability.CandidateBindingModeShadow, TargetKind: "NOTIFICATION_SHADOW_RECEIVER", TargetRef: "notification-receiver-candidate", AuthorityGrantID: "grant"}
+	candidate := capability.CandidateBinding{ID: "candidate-1", Revision: 1, BaseActiveBindingID: stable.ID, BaseActiveBindingRevision: stable.Revision, Context: context, TargetOrigin: server.URL, DeliveryPath: "/delivery/v1/deliveries", ReceiptPath: "/delivery/v1/receipts", Protocol: capability.ProtocolIdempotentReceiptV1, CreatedAtUnixMillis: 1, ExpiresAtUnixMillis: 100, Status: capability.CandidateBindingActive}
+	digest, err := capabilitydomain.CandidateTargetDigest(candidate)
+	if err != nil {
+		t.Fatal(err)
+	}
+	context.TargetDigest, candidate.Context.TargetDigest = digest, digest
+	dispatcher := operationDispatcher{continuityExecutor: &knownExecutor{}, continuityReconciler: &knownExecutor{}, bindings: fakeNotificationBindings{activeErr: errors.New("stable fallback must not run"), candidate: capability.CandidateBindingResolution{Binding: candidate, Mode: capability.CandidateBindingModeShadow}}, secret: "shadow-secret", client: server.Client(), candidateContext: &context}
+	result := dispatcher.Execute(action)
+	if !result.Known || !result.Succeeded || result.Receipt == nil || result.Receipt.DeliveryMode != "SHADOW" {
+		t.Fatalf("candidate result=%+v", result)
+	}
+}

cmd/core-runtime/chat_orchestrator.go

@@ -0,0 +1,82 @@
+package main
+
+import (
+	"sort"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	interactiondomain "git.cin.su/m/Assistant/modules/interaction/domain"
+)
+
+type chatRouteKind string
+
+const (
+	chatRouteResearch     chatRouteKind = "RESEARCH"
+	chatRouteConversation chatRouteKind = "CONVERSATION"
+	chatRouteMedia        chatRouteKind = "MEDIA"
+	chatRouteAction       chatRouteKind = "ACTION"
+	chatRouteAgent        chatRouteKind = "AGENT"
+)
+
+type chatRoute struct {
+	Kind       chatRouteKind
+	Capability capability.CapabilityKind
+	Profile    string
+	Order      int
+}
+
+// buildChatRoutePlan creates one bounded route per meaning-bearing capability.
+// A failed research route must not suppress the local conversational route or
+// an unrelated action route.
+func buildChatRoutePlan(result interactiondomain.SemanticResult) []chatRoute {
+	seen := make(map[capability.CapabilityKind]struct{})
+	routes := make([]chatRoute, 0, len(result.CapabilityHints)+1)
+	add := func(kind chatRouteKind, capabilityKind capability.CapabilityKind, profile string, order int) {
+		if capabilityKind != "" {
+			if _, exists := seen[capabilityKind]; exists {
+				return
+			}
+			seen[capabilityKind] = struct{}{}
+		}
+		routes = append(routes, chatRoute{Kind: kind, Capability: capabilityKind, Profile: profile, Order: order})
+	}
+	for _, hint := range result.CapabilityHints {
+		switch capability.CapabilityKind(hint) {
+		case capability.CapabilityKindWebResearch:
+			add(chatRouteResearch, capability.CapabilityKindWebResearch, "truth-research-v1", 10)
+		case capability.CapabilityKindImageGeneration:
+			add(chatRouteMedia, capability.CapabilityKindImageGeneration, "local-image-generation-v1", 5)
+		case capability.CapabilityKindCognitiveReasoning, capability.CapabilityKindVerifyFact:
+			add(chatRouteConversation, capability.CapabilityKind(hint), "local-reasoning-v1", 20)
+		case capability.CapabilityKindScheduleReminder:
+			add(chatRouteAction, capability.CapabilityKindScheduleReminder, "continuity-reminder-v1", 30)
+		case capability.CapabilityKindModifyCode, capability.CapabilityKindRunTests, capability.CapabilityKindInspectProject:
+			add(chatRouteAgent, capability.CapabilityKind(hint), "software-agent-v1", 40)
+		case capability.CapabilityKindSendEmail, capability.CapabilityKindReadEmail:
+			add(chatRouteAgent, capability.CapabilityKind(hint), "communication-agent-v1", 50)
+		case capability.CapabilityKindReadDatabase, capability.CapabilityKindQueryLogs:
+			add(chatRouteAgent, capability.CapabilityKind(hint), "diagnostics-agent-v1", 60)
+		}
+	}
+	if result.NeedsCognition || len(routes) == 0 {
+		add(chatRouteConversation, capability.CapabilityKindCognitiveReasoning, "local-reasoning-v1", 20)
+	}
+	sort.SliceStable(routes, func(i, j int) bool { return routes[i].Order < routes[j].Order })
+	return routes
+}
+
+func hasChatRoute(routes []chatRoute, kind chatRouteKind) bool {
+	for _, route := range routes {
+		if route.Kind == kind {
+			return true
+		}
+	}
+	return false
+}
+
+// specializedRouteBypassesGeneralInterpretation keeps a concrete capability
+// route stable. General cognition may still be used later to assess evidence,
+// but it must not replace an executable research or media route with a vague
+// conversational clarification before the capability is attempted.
+func specializedRouteBypassesGeneralInterpretation(routes []chatRoute) bool {
+	return hasChatRoute(routes, chatRouteMedia) || hasChatRoute(routes, chatRouteResearch)
+}

cmd/core-runtime/chat_orchestrator_test.go

@@ -0,0 +1,53 @@
+package main
+
+import (
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	interactiondomain "git.cin.su/m/Assistant/modules/interaction/domain"
+)
+
+func TestBuildChatRoutePlanPreservesMultipleMeaningfulRoutes(t *testing.T) {
+	planned := buildChatRoutePlan(interactiondomain.SemanticResult{
+		NeedsCognition:  true,
+		CapabilityHints: []string{"WEB_RESEARCH", "MODIFY_CODE", "RUN_TESTS", "SCHEDULE_REMINDER"},
+	})
+	if len(planned) != 5 {
+		t.Fatalf("expected five deduplicated routes, got %+v", planned)
+	}
+	want := []struct {
+		kind    chatRouteKind
+		profile string
+		cap     capability.CapabilityKind
+	}{
+		{chatRouteResearch, "truth-research-v1", capability.CapabilityKindWebResearch},
+		{chatRouteConversation, "local-reasoning-v1", capability.CapabilityKindCognitiveReasoning},
+		{chatRouteAction, "continuity-reminder-v1", capability.CapabilityKindScheduleReminder},
+		{chatRouteAgent, "software-agent-v1", capability.CapabilityKindModifyCode},
+		{chatRouteAgent, "software-agent-v1", capability.CapabilityKindRunTests},
+	}
+	for index, expected := range want {
+		if planned[index].Kind != expected.kind || planned[index].Profile != expected.profile || planned[index].Capability != expected.cap {
+			t.Fatalf("route %d = %+v, want %+v", index, planned[index], expected)
+		}
+	}
+}
+
+func TestBuildChatRoutePlanAlwaysKeepsLocalConversationRoute(t *testing.T) {
+	planned := buildChatRoutePlan(interactiondomain.SemanticResult{NeedsCognition: true})
+	if len(planned) != 1 || planned[0].Kind != chatRouteConversation || planned[0].Profile != "local-reasoning-v1" {
+		t.Fatalf("unexpected local route: %+v", planned)
+	}
+}
+
+func TestSpecializedRouteBypassesGeneralInterpretation(t *testing.T) {
+	if !specializedRouteBypassesGeneralInterpretation([]chatRoute{{Kind: chatRouteResearch}}) {
+		t.Fatal("research route must execute before general cognition")
+	}
+	if !specializedRouteBypassesGeneralInterpretation([]chatRoute{{Kind: chatRouteMedia}}) {
+		t.Fatal("media route must execute before general cognition")
+	}
+	if specializedRouteBypassesGeneralInterpretation([]chatRoute{{Kind: chatRouteConversation}}) {
+		t.Fatal("conversation-only route must retain general cognition")
+	}
+}

cmd/core-runtime/cognitive_interpretation.go

@@ -5,14 +5,21 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"hash/fnv"
+	"io"
+	"mime/multipart"
 	"net/http"
 	"net/url"
+	"strings"
+	"time"
 
 	"git.cin.su/m/Assistant/contracts/authority"
 	"git.cin.su/m/Assistant/contracts/capability"
 	"git.cin.su/m/Assistant/contracts/cognitive"
+	"git.cin.su/m/Assistant/contracts/epistemics"
 	"git.cin.su/m/Assistant/contracts/identity"
 	"git.cin.su/m/Assistant/contracts/interaction"
+	epistemicsdomain "git.cin.su/m/Assistant/modules/epistemics/domain"
 	interactiondomain "git.cin.su/m/Assistant/modules/interaction/domain"
 	"git.cin.su/m/Assistant/platform/ids"
 )
@@ -20,6 +27,294 @@ import (
 type cognitiveInterpretationClient struct {
 	baseURL *url.URL
 	client  *http.Client
+	media   *http.Client
+}
+
+// compileInteractionContext is the Core-side handoff from the existing
+// Interaction retrieval projection to the existing Context Compiler. The
+// compiler receives only already-authorized, typed fragments and applies its
+// scope and byte-budget guards before the cognitive gateway sees them.
+func compileInteractionContext(projection interactiondomain.ContextProjection, focusProjectID string) (string, error) {
+	return compileInteractionContextWithExperience(projection, focusProjectID, nil, "")
+}
+
+func compileInteractionContextWithExperience(projection interactiondomain.ContextProjection, focusProjectID string, experiences []epistemics.ExperienceRecord, query string) (string, error) {
+	if len(projection.Fragments) == 0 && len(experiences) == 0 {
+		return projection.Text, nil
+	}
+	candidates := interactionContextCandidates(projection, focusProjectID, experiences, query)
+	bundle, err := cognitive.CompileContext(cognitive.ContextCompileInput{Candidates: candidates, DataPolicy: capability.DataPolicyLocalOnly, MaxBytes: 2048, ContextScopeRef: focusProjectID, FreshnessRequirement: "conversation-current", RiskClass: "low"})
+	if err != nil {
+		return "", err
+	}
+	parts := make([]string, 0, len(bundle.Excerpts))
+	for _, excerpt := range bundle.Excerpts {
+		parts = append(parts, excerpt.Text)
+	}
+	return strings.Join(parts, "\n"), nil
+}
+
+func interactionContextCandidates(projection interactiondomain.ContextProjection, focusProjectID string, experiences []epistemics.ExperienceRecord, query string) []cognitive.ContextCandidate {
+	candidates := make([]cognitive.ContextCandidate, 0, len(projection.Fragments)+len(experiences))
+	for _, fragment := range projection.Fragments {
+		candidates = append(candidates, cognitive.ContextCandidate{
+			Excerpt:         cognitive.ContextExcerpt{ID: cognitive.ContextExcerptID("interaction:" + string(fragment.UtteranceID)), SourceKind: "interaction-gen2-retrieval", SourceID: "interaction:utterances", Revision: 1, Sensitivity: cognitive.SensitivityPrivateAllowed, Text: fragment.Text},
+			Relevance:       fragment.Relevance,
+			Lane:            "current-fact",
+			ContextScopeRef: fragment.ScopeRef,
+			FreshnessState:  "CURRENT",
+		})
+	}
+	if needsHistoricalAnalogy(query) {
+		for _, fragment := range projection.Historical {
+			candidates = append(candidates, cognitive.ContextCandidate{
+				Excerpt:   cognitive.ContextExcerpt{ID: cognitive.ContextExcerptID("interaction:historical:" + string(fragment.UtteranceID)), SourceKind: "interaction-gen2-retrieval", SourceID: "interaction:utterances", Revision: 1, Sensitivity: cognitive.SensitivityPrivateAllowed, Text: fragment.Text},
+				Relevance: fragment.Relevance - 1, Lane: "historical-analogy", ContextScopeRef: fragment.ScopeRef, FreshnessState: "HISTORICAL_ONLY",
+			})
+		}
+	}
+	retrieved := epistemicsdomain.RetrieveExperience(experiences, "", focusProjectID, query, 4)
+	for _, record := range retrieved.Positive {
+		candidates = append(candidates, experienceContextCandidate(record, "positive-experience", false))
+	}
+	for _, record := range retrieved.Negative {
+		candidates = append(candidates, experienceContextCandidate(record, "negative-experience", true))
+	}
+	for _, record := range retrieved.Contradictions {
+		candidates = append(candidates, experienceContextCandidate(record, "contradiction", true))
+	}
+	return candidates
+}
+
+func needsHistoricalAnalogy(query string) bool {
+	for _, marker := range []string{"истор", "раньше", "предыдущ", "старое", "аналог"} {
+		if strings.Contains(strings.ToLower(query), marker) {
+			return true
+		}
+	}
+	return false
+}
+
+func experienceContextCandidate(record epistemics.ExperienceRecord, lane string, negative bool) cognitive.ContextCandidate {
+	text := strings.TrimSpace(record.ProblemStatement + ": " + record.OutcomeDetail)
+	if detail := strings.TrimSpace(record.WhySucceededOrFailed); detail != "" {
+		text += " (" + detail + ")"
+	}
+	if len(record.ApplicabilityConditions) > 0 {
+		text += " [conditions: " + strings.Join(record.ApplicabilityConditions, ", ") + "]"
+	}
+	return cognitive.ContextCandidate{Excerpt: cognitive.ContextExcerpt{ID: cognitive.ContextExcerptID("experience:" + string(record.ID)), SourceKind: "epistemics-experience", SourceID: "epistemics:experience-records", Revision: 1, Sensitivity: cognitive.SensitivityPrivateAllowed, Text: text}, Relevance: 1, Lane: lane, ContextScopeRef: record.ContextScopeRef, FreshnessState: "CURRENT", Negative: negative}
+}
+
+const (
+	iterativeRetrievalMaxRounds     = 1
+	iterativeRetrievalMaxFragments  = 2
+	iterativeRetrievalMaxAddedBytes = 1024
+	iterativeRetrievalMaxLatency    = 1500 * time.Millisecond
+)
+
+func newIterativeContextRetriever(history []interaction.HumanUtterance, references []interaction.ProjectReference, principalID, focusProjectID string, experiences []epistemics.ExperienceRecord) iterativeContextRetriever {
+	seen := map[string]struct{}{}
+	return func(ctx context.Context, request cognitive.IterativeRetrievalRequest) cognitive.IterativeRetrievalResponse {
+		started := time.Now()
+		if request.Pass < 0 || request.Pass >= iterativeRetrievalMaxRounds || request.RemainingBytes <= 0 || request.RemainingBytes > iterativeRetrievalMaxAddedBytes {
+			return cognitive.IterativeRetrievalResponse{Exhausted: true, Reason: "budget"}
+		}
+		projection := interactiondomain.BuildScopedGen2ContextForQuery(history, references, principalID, focusProjectID, request.Query)
+		candidates := interactionContextCandidates(projection, focusProjectID, experiences, request.Query)
+		filtered := make([]cognitive.ContextCandidate, 0, len(candidates))
+		for _, candidate := range candidates {
+			if !iterativeLaneMatches(request.Lane, candidate.Lane) {
+				continue
+			}
+			key := string(request.Lane) + ":" + string(candidate.Excerpt.ID)
+			if _, duplicate := seen[key]; duplicate {
+				continue
+			}
+			filtered = append(filtered, candidate)
+		}
+		bundle, err := cognitive.CompileContext(cognitive.ContextCompileInput{Candidates: filtered, DataPolicy: capability.DataPolicyLocalOnly, MaxBytes: request.RemainingBytes, ContextScopeRef: focusProjectID, TaskRef: "chat", FocusFrameRef: focusProjectID, FreshnessRequirement: "conversation-current"})
+		if err != nil || len(bundle.Excerpts) == 0 {
+			return cognitive.IterativeRetrievalResponse{Exhausted: true, Reason: "no_additional_evidence"}
+		}
+		out := make([]cognitive.ContextCandidate, 0, iterativeRetrievalMaxFragments)
+		for _, excerpt := range bundle.Excerpts {
+			if len(out) == iterativeRetrievalMaxFragments || time.Since(started) > iterativeRetrievalMaxLatency {
+				break
+			}
+			seen[string(request.Lane)+":"+string(excerpt.ID)] = struct{}{}
+			for _, candidate := range filtered {
+				if candidate.Excerpt.ID == excerpt.ID {
+					out = append(out, candidate)
+					break
+				}
+			}
+		}
+		if len(out) == 0 {
+			return cognitive.IterativeRetrievalResponse{Exhausted: true, Reason: "latency_budget"}
+		}
+		addedBytes := 0
+		for _, candidate := range out {
+			addedBytes += len([]byte(candidate.Excerpt.Text))
+		}
+		return cognitive.IterativeRetrievalResponse{Candidates: out, Exhausted: true, Reason: "completed", AddedBytes: addedBytes}
+	}
+}
+
+func iterativeLaneMatches(request cognitive.IterativeRetrievalLane, actual string) bool {
+	return (request == cognitive.IterativeRetrievalCurrentFact && actual == "current-fact") ||
+		(request == cognitive.IterativeRetrievalPositiveExperience && actual == "positive-experience") ||
+		(request == cognitive.IterativeRetrievalNegativeExperience && actual == "negative-experience") ||
+		(request == cognitive.IterativeRetrievalContradiction && actual == "contradiction") ||
+		(request == cognitive.IterativeRetrievalHistoricalAnalogy && actual == "historical-analogy")
+}
+
+const (
+	// Household interpretation and response review are intentionally compact
+	// calls. Keeping their output bounded prevents a loaded local model from
+	// spending the whole request budget generating unnecessary prose.
+	responseReviewMaxOutputBytes    = 512
+	stableKnowledgeMaxOutputBytes   = 512
+	semanticInterpretMaxOutputBytes = 1024
+)
+
+// ReviewResponse asks the cognitive gateway to turn a locally assembled draft
+// into a natural answer. The draft remains the safe fallback when cognition is
+// unavailable; the model does not mutate canonical state or execute actions.
+func (c cognitiveInterpretationClient) ReviewResponse(ctx context.Context, session identity.CreatorSession, userMessage, draft, personalMemory string, meaning cognitive.TaskMeaning) (string, error) {
+	requestID, err := ids.New()
+	if err != nil {
+		return "", err
+	}
+	prompt := "Ты редактор финального ответа Домового. Проверь черновик по смыслу и подготовь естественный ответ человеку. Учитывай весь запрос, включая недостающие параметры для конкретного результата. Если данных не хватает, задай один короткий полезный уточняющий вопрос, например откуда и куда ехать. Не выдавай поисковые сниппеты как выполненное действие и не показывай служебные URL поисковой выдачи. Сохрани проверяемые факты, названия источников, прямые ссылки и ограничения. Не выдумывай факты и не утверждай невыполненные действия. Сначала внутренне проверь, что ответ начинается с содержания, решающего вопрос. Не повторяй вопрос пользователя в качестве заголовка или вступления, если это не нужно для смысла. Представление, имя помощника, приветствие или предложение дополнительной помощи допустимы только если пользователь сам спросил об этом; иначе убери их. Верни только готовый ответ без разбора проверки, служебных слов и упоминания моделей. Если черновик уже адекватен, верни его без лишних добавлений.\n\nСообщение пользователя:\n" + userMessage + "\n\nЧерновик ответа:\n" + draft
+	context := []cognitive.ContextExcerpt{}
+	if strings.TrimSpace(personalMemory) != "" {
+		context = append(context, cognitive.ContextExcerpt{ID: "personal-memory", SourceKind: "derived-personal-memory", SourceID: "interaction:human-utterances", Revision: 1, Sensitivity: cognitive.SensitivityPrivateAllowed, Text: personalMemory})
+	}
+	target := *c.baseURL
+	target.Path = "/v1/advisories"
+	payload, err := json.Marshal(cognitive.GatewayAdvisoryRequest{
+		Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(requestID),
+		ActorID: session.ActorID, PrincipalID: session.PrincipalID,
+		ScopeID: authority.ScopeID("domovoy-global-scope"), Message: prompt,
+		Context: context, Locale: "ru", MaxOutputBytes: responseReviewMaxOutputBytes, DataPolicy: capability.DataPolicyLocalOnly,
+		Meaning: cognitive.TaskMeaning{
+			SpeechAct:              "RESPONSE_REVIEW",
+			CapabilityHints:        meaning.CapabilityHints,
+			RequestedOutcome:       meaning.RequestedOutcome,
+			InformationRequestKind: meaning.InformationRequestKind,
+			ConfidenceMillis:       meaning.ConfidenceMillis,
+		},
+	})
+	if err != nil {
+		return "", err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, target.String(), bytes.NewReader(payload))
+	if err != nil {
+		return "", err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	response, err := c.client.Do(request)
+	if err != nil {
+		return "", err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("cognitive response review status %d", response.StatusCode)
+	}
+	var result cognitive.GatewayAdvisoryResponse
+	if err := json.NewDecoder(response.Body).Decode(&result); err != nil {
+		return "", err
+	}
+	if result.FinishReason != cognitive.FinishCompleted || strings.TrimSpace(result.AdvisoryText) == "" {
+		return "", fmt.Errorf("cognitive response review incomplete: %s", result.FinishReason)
+	}
+	return strings.TrimSpace(result.AdvisoryText), nil
+}
+
+// AnswerStableKnowledge asks the local cognitive route for a short answer to a
+// non-current question only after evidence retrieval did not produce a usable
+// result. The model decides whether its knowledge is stable enough; it must
+// explicitly decline changing or source-dependent facts instead of guessing.
+type iterativeContextRetriever func(context.Context, cognitive.IterativeRetrievalRequest) cognitive.IterativeRetrievalResponse
+
+func (c cognitiveInterpretationClient) AnswerStableKnowledge(ctx context.Context, session identity.CreatorSession, userMessage, personalMemory string, meaning cognitive.TaskMeaning) (string, error) {
+	return c.AnswerStableKnowledgeWithContinuation(ctx, session, userMessage, personalMemory, meaning, nil)
+}
+
+// AnswerStableKnowledgeWithContinuation permits one model-requested, Core-run
+// retrieval round. The callback receives only a typed intent and cannot alter
+// identity, scope or provider selection.
+func (c cognitiveInterpretationClient) AnswerStableKnowledgeWithContinuation(ctx context.Context, session identity.CreatorSession, userMessage, personalMemory string, meaning cognitive.TaskMeaning, retrieve iterativeContextRetriever) (string, error) {
+	requestID, err := ids.New()
+	if err != nil {
+		return "", err
+	}
+	prompt := "Ты отвечаешь как Домовой на обычное сообщение пользователя. Сначала пойми цель: на вопрос дай короткий естественный ответ по устойчивому общеизвестному знанию, а безопасную просьбу создать текстовый или структурный результат выполни прямо в ответе. Начинай сразу с содержания и не представляйся, если пользователь не спросил об имени. Не называй модель или внутреннюю систему. Если истинность ответа зависит от текущего наблюдения, внешнего источника или инструмента, верни ровно NEEDS_VERIFIED_RESEARCH. Не придумывай факты и не утверждай выполнение внешнего действия.\n\nСообщение пользователя:\n" + userMessage
+	if retrieve != nil {
+		prompt += "\n\nЕсли именно для ответа не хватает ограниченного контекста, вместо ответа верни единственную строку <domovoy-retrieval>{\"Query\":\"...\",\"SemanticSubject\":\"...\",\"Lane\":\"CURRENT_FACT|POSITIVE_EXPERIENCE|NEGATIVE_EXPERIENCE|CONTRADICTION|HISTORICAL_ANALOGY\",\"Reason\":\"...\"}. Не запрашивай широкий дамп памяти."
+	}
+	context := []cognitive.ContextExcerpt{}
+	if strings.TrimSpace(personalMemory) != "" {
+		context = append(context, cognitive.ContextExcerpt{ID: "personal-memory", SourceKind: "derived-personal-memory", SourceID: "interaction:human-utterances", Revision: 1, Sensitivity: cognitive.SensitivityPrivateAllowed, Text: personalMemory})
+	}
+	requestValue := cognitive.GatewayAdvisoryRequest{
+		Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(requestID),
+		ActorID: session.ActorID, PrincipalID: session.PrincipalID, ScopeID: authority.ScopeID("domovoy-global-scope"),
+		Message: prompt, Context: context, Locale: "ru", MaxOutputBytes: stableKnowledgeMaxOutputBytes, DataPolicy: capability.DataPolicyLocalOnly,
+		AllowIterativeRetrieval: retrieve != nil,
+		Meaning:                 cognitive.TaskMeaning{SpeechAct: "STABLE_KNOWLEDGE_ANSWER", CapabilityHints: meaning.CapabilityHints, RequestedOutcome: meaning.RequestedOutcome, InformationRequestKind: meaning.InformationRequestKind, ConfidenceMillis: meaning.ConfidenceMillis},
+	}
+	result, err := c.requestAdvisory(ctx, requestValue)
+	if err != nil {
+		return "", err
+	}
+	if result.IterativeRetrieval != nil && retrieve != nil {
+		additional := retrieve(ctx, *result.IterativeRetrieval)
+		for _, candidate := range additional.Candidates {
+			context = append(context, candidate.Excerpt)
+		}
+		if len(additional.Candidates) == 0 {
+			context = append(context, cognitive.ContextExcerpt{ID: "continuation:no-additional-evidence", SourceKind: "iterative-retrieval", SourceID: "core", Revision: 1, Sensitivity: cognitive.SensitivityPrivateAllowed, Text: "No additional evidence was found; answer with uncertainty rather than inventing facts."})
+		}
+		requestValue.Context = context
+		requestValue.AllowIterativeRetrieval = false
+		result, err = c.requestAdvisory(ctx, requestValue)
+		if err != nil {
+			return "", err
+		}
+	}
+	if result.FinishReason != cognitive.FinishCompleted || strings.TrimSpace(result.AdvisoryText) == "" {
+		return "", fmt.Errorf("cognitive stable knowledge incomplete: %s", result.FinishReason)
+	}
+	return strings.TrimSpace(result.AdvisoryText), nil
+}
+
+func (c cognitiveInterpretationClient) requestAdvisory(ctx context.Context, value cognitive.GatewayAdvisoryRequest) (cognitive.GatewayAdvisoryResponse, error) {
+	target := *c.baseURL
+	target.Path = "/v1/advisories"
+	payload, err := json.Marshal(value)
+	if err != nil {
+		return cognitive.GatewayAdvisoryResponse{}, err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, target.String(), bytes.NewReader(payload))
+	if err != nil {
+		return cognitive.GatewayAdvisoryResponse{}, err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	response, err := c.client.Do(request)
+	if err != nil {
+		return cognitive.GatewayAdvisoryResponse{}, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return cognitive.GatewayAdvisoryResponse{}, fmt.Errorf("cognitive stable knowledge status %d", response.StatusCode)
+	}
+	var result cognitive.GatewayAdvisoryResponse
+	if err := json.NewDecoder(response.Body).Decode(&result); err != nil {
+		return cognitive.GatewayAdvisoryResponse{}, err
+	}
+	return result, nil
 }
 
 func newCognitiveInterpretationClient(rawURL string, client *http.Client) (cognitiveInterpretationClient, error) {
@@ -30,7 +325,7 @@ func newCognitiveInterpretationClient(rawURL string, client *http.Client) (cogni
 	if client == nil {
 		client = http.DefaultClient
 	}
-	return cognitiveInterpretationClient{baseURL: base, client: client}, nil
+	return cognitiveInterpretationClient{baseURL: base, client: client, media: &http.Client{Timeout: 15 * time.Minute}}, nil
 }
 
 func (c cognitiveInterpretationClient) Interpret(ctx context.Context, request cognitive.GatewayInterpretationRequest) (cognitive.GatewayInterpretationResponse, error) {
@@ -60,13 +355,107 @@ func (c cognitiveInterpretationClient) Interpret(ctx context.Context, request co
 	return result, nil
 }
 
+func (c cognitiveInterpretationClient) GenerateImage(ctx context.Context, prompt, size string) (capability.MultimodalResponse, error) {
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+	if err := writer.WriteField("prompt", prompt); err != nil {
+		return capability.MultimodalResponse{}, err
+	}
+	if strings.TrimSpace(size) != "" {
+		if err := writer.WriteField("size", size); err != nil {
+			return capability.MultimodalResponse{}, err
+		}
+	}
+	if err := writer.Close(); err != nil {
+		return capability.MultimodalResponse{}, err
+	}
+	target := *c.baseURL
+	target.Path = "/v1/multimodal/generate-image"
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, target.String(), &body)
+	if err != nil {
+		return capability.MultimodalResponse{}, err
+	}
+	request.Header.Set("Content-Type", writer.FormDataContentType())
+	client := c.media
+	if client == nil {
+		client = c.client
+	}
+	response, err := client.Do(request)
+	if err != nil {
+		return capability.MultimodalResponse{}, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return capability.MultimodalResponse{}, fmt.Errorf("image generation status %d", response.StatusCode)
+	}
+	var result capability.MultimodalResponse
+	if err := json.NewDecoder(io.LimitReader(response.Body, 32<<20)).Decode(&result); err != nil {
+		return capability.MultimodalResponse{}, err
+	}
+	if strings.TrimSpace(result.DataBase64) == "" {
+		return capability.MultimodalResponse{}, fmt.Errorf("image generation returned empty payload")
+	}
+	return result, nil
+}
+
 func shouldRequestBroaderInterpretation(result interactiondomain.SemanticResult) bool {
-	switch result.Interpretation.Applicability {
-	case interaction.SemanticNeedsBroaderInterpret, interaction.SemanticLowConfidence, interaction.SemanticMixedIntent:
-		return true
-	default:
+	return shouldRequestSemanticInterpretation(result)
+}
+
+// shouldRequestSemanticInterpretation keeps the deterministic layer as a
+// fast reflex, not as the meaning authority. Questions, requests, directives,
+// mixed signals and capability-bearing messages go through cognitive
+// interpretation; only stable low-risk conversational/assertive reflexes may
+// answer without it.
+func shouldRequestSemanticInterpretation(result interactiondomain.SemanticResult) bool {
+	if result.Interpretation.Clarification == interaction.ClarificationRequired {
 		return false
 	}
+	// Structured, read-only information intents already have a semantic owner
+	// in core-runtime. Sending them through the slower advisory interpretation
+	// path only adds latency and can make a healthy runtime look unavailable.
+	if result.InformationRequestKind != "" {
+		return false
+	}
+	if result.NeedsCognition || len(result.CapabilityHints) > 0 {
+		return true
+	}
+	if result.Interpretation.Applicability != interaction.SemanticApplicable {
+		return true
+	}
+	switch result.Interpretation.SpeechAct {
+	case interaction.SpeechActConversational, interaction.SpeechActConfirmation, interaction.SpeechActRejection:
+		return false
+	case interaction.SpeechActPreference:
+		// Explicit user preferences are durable interaction context. A sampled
+		// advisory audit must not reinterpret or erase them.
+		return false
+	case interaction.SpeechActAssertion:
+		return result.Interpretation.ConfidenceMillis < 850
+	default:
+		return true
+	}
+}
+
+const (
+	deterministicReflexAuditInterval = 10 * time.Minute
+	deterministicReflexAuditSample   = uint32(16)
+)
+
+// shouldAuditDeterministicReflex samples stable reflexes in a time bucket.
+// This is observability, not a correctness gate: a failed audit leaves the
+// reflex usable, while a successful disagreement can replace it with the
+// cognitive candidate and becomes durable evidence through the normal
+// candidate store.
+func shouldAuditDeterministicReflex(result interactiondomain.SemanticResult, utteranceID string, now time.Time) bool {
+	if shouldRequestSemanticInterpretation(result) || utteranceID == "" {
+		return false
+	}
+	bucket := now.Unix() / int64(deterministicReflexAuditInterval/time.Second)
+	hash := fnv.New32a()
+	_, _ = hash.Write([]byte(utteranceID))
+	_, _ = hash.Write([]byte(fmt.Sprintf(":%d", bucket)))
+	return hash.Sum32()%deterministicReflexAuditSample == 0
 }
 
 func isSimpleLocalQuestion(result interactiondomain.SemanticResult) bool {
@@ -92,7 +481,7 @@ func buildGatewayInterpretationRequest(session identity.CreatorSession, utteranc
 		ScopeID:                    authority.ScopeID("domovoy-global-scope"),
 		Message:                    utterance.Content,
 		Locale:                     "ru",
-		MaxOutputBytes:             4096,
+		MaxOutputBytes:             semanticInterpretMaxOutputBytes,
 		DataPolicy:                 capability.DataPolicyLocalOnly,
 		DeterministicSpeechAct:     string(semantic.Interpretation.SpeechAct),
 		DeterministicSecondary:     string(semantic.Interpretation.SecondarySpeechAct),

cmd/core-runtime/cognitive_interpretation_test.go

@@ -1,12 +1,188 @@
 package main
 
 import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
 	"testing"
+	"time"
 
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/cognitive"
+	"git.cin.su/m/Assistant/contracts/epistemics"
+	"git.cin.su/m/Assistant/contracts/identity"
 	"git.cin.su/m/Assistant/contracts/interaction"
 	interactiondomain "git.cin.su/m/Assistant/modules/interaction/domain"
 )
 
+func TestReviewResponseUsesCognitiveGatewayAndReturnsOnlyDraftAnswer(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var request cognitive.GatewayAdvisoryRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Fatalf("decode review request: %v", err)
+		}
+		if request.Message == "" || request.Meaning.SpeechAct == "" {
+			t.Fatalf("review request did not carry semantic context: %+v", request)
+		}
+		if !strings.Contains(request.Message, "ответ начинается с содержания") || !strings.Contains(request.Message, "Не повторяй вопрос пользователя") || !strings.Contains(request.Message, "только если пользователь сам спросил") {
+			t.Fatalf("review request lacks the conversational quality contract: %q", request.Message)
+		}
+		if len(request.Context) != 1 || !strings.Contains(request.Context[0].Text, "красный цвет") {
+			t.Fatalf("review request did not carry compact personal memory: %+v", request.Context)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(cognitive.GatewayAdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: request.RequestID, AdvisoryText: "Меня зовут Дед. Я Домовой.", FinishReason: cognitive.FinishCompleted})
+	}))
+	defer server.Close()
+	client, err := newCognitiveInterpretationClient(server.URL, server.Client())
+	if err != nil {
+		t.Fatal(err)
+	}
+	reviewed, err := client.ReviewResponse(context.Background(), identity.CreatorSession{ActorID: "actor", PrincipalID: "principal"}, "кто ты?", "Я — Домовой.", "Предпочтение пользователя (его сообщение): красный цвет", cognitive.TaskMeaning{SpeechAct: "QUESTION"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if reviewed != "Меня зовут Дед. Я Домовой." {
+		t.Fatalf("unexpected reviewed response %q", reviewed)
+	}
+}
+
+func TestAnswerStableKnowledgeUsesLocalOnlyCognitiveRoute(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var request cognitive.GatewayAdvisoryRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Fatalf("decode stable knowledge request: %v", err)
+		}
+		if request.DataPolicy != capability.DataPolicyLocalOnly || request.Meaning.SpeechAct != "STABLE_KNOWLEDGE_ANSWER" {
+			t.Fatalf("unexpected stable knowledge request: %+v", request)
+		}
+		_ = json.NewEncoder(w).Encode(cognitive.GatewayAdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: request.RequestID, AdvisoryText: "Санкт-Петербург — город в России.", FinishReason: cognitive.FinishCompleted})
+	}))
+	defer server.Close()
+	client, err := newCognitiveInterpretationClient(server.URL, server.Client())
+	if err != nil {
+		t.Fatal(err)
+	}
+	answer, err := client.AnswerStableKnowledge(context.Background(), identity.CreatorSession{ActorID: "actor", PrincipalID: "principal"}, "Питер — это где?", "", cognitive.TaskMeaning{SpeechAct: "QUESTION"})
+	if err != nil || answer != "Санкт-Петербург — город в России." {
+		t.Fatalf("answer=%q err=%v", answer, err)
+	}
+}
+
+func TestCompileInteractionContextAppliesTypedScopeBeforeGateway(t *testing.T) {
+	context, err := compileInteractionContext(interactiondomain.ContextProjection{Fragments: []interactiondomain.ContextFragment{
+		{UtteranceID: "a", Text: "контрольный код = ALPHA", ScopeRef: "company-a", Relevance: 2},
+		{UtteranceID: "b", Text: "контрольный код = BETA", ScopeRef: "company-b", Relevance: 3},
+	}}, "company-a")
+	if err != nil || context != "контрольный код = ALPHA" {
+		t.Fatalf("context=%q err=%v", context, err)
+	}
+}
+
+func TestCompileInteractionContextUsesHistoricalOnlyWhenRequested(t *testing.T) {
+	projection := interactiondomain.ContextProjection{Fragments: []interactiondomain.ContextFragment{{UtteranceID: "current", Text: "код = NEW", Relevance: 2}}, Historical: []interactiondomain.ContextFragment{{UtteranceID: "old", Text: "код = OLD", Relevance: 1, Historical: true}}}
+	current, err := compileInteractionContextWithExperience(projection, "", nil, "Какой текущий код?")
+	if err != nil || strings.Contains(current, "OLD") {
+		t.Fatalf("current context=%q err=%v", current, err)
+	}
+	historical, err := compileInteractionContextWithExperience(projection, "", nil, "Какой старый код был раньше?")
+	if err != nil || !strings.Contains(historical, "OLD") {
+		t.Fatalf("historical context=%q err=%v", historical, err)
+	}
+}
+
+func TestStableKnowledgeContinuesOnceWithBoundedAdditionalContext(t *testing.T) {
+	calls := 0
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		var request cognitive.GatewayAdvisoryRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Fatal(err)
+		}
+		if calls == 1 {
+			if !request.AllowIterativeRetrieval {
+				t.Fatal("initial advisory did not permit bounded continuation")
+			}
+			_ = json.NewEncoder(w).Encode(cognitive.GatewayAdvisoryResponse{Version: request.Version, RequestID: request.RequestID, FinishReason: cognitive.FinishCompleted, IterativeRetrieval: &cognitive.IterativeRetrievalRequest{Query: "контрольный код", Lane: cognitive.IterativeRetrievalCurrentFact, Reason: "initial context is insufficient", RemainingBytes: 512}})
+			return
+		}
+		if request.AllowIterativeRetrieval || len(request.Context) != 1 || request.Context[0].Text != "контрольный код = ORBIT-731" {
+			t.Fatalf("continuation request=%+v", request)
+		}
+		_ = json.NewEncoder(w).Encode(cognitive.GatewayAdvisoryResponse{Version: request.Version, RequestID: request.RequestID, FinishReason: cognitive.FinishCompleted, AdvisoryText: "Контрольный код — ORBIT-731."})
+	}))
+	defer server.Close()
+	client, err := newCognitiveInterpretationClient(server.URL, server.Client())
+	if err != nil {
+		t.Fatal(err)
+	}
+	answer, err := client.AnswerStableKnowledgeWithContinuation(context.Background(), identity.CreatorSession{ActorID: "actor", PrincipalID: "principal"}, "Какой контрольный код?", "", cognitive.TaskMeaning{SpeechAct: "QUESTION"}, func(context.Context, cognitive.IterativeRetrievalRequest) cognitive.IterativeRetrievalResponse {
+		return cognitive.IterativeRetrievalResponse{Candidates: []cognitive.ContextCandidate{{Excerpt: cognitive.ContextExcerpt{ID: "interaction:code", Text: "контрольный код = ORBIT-731", Sensitivity: cognitive.SensitivityPrivateAllowed}, Lane: "current-fact"}}, Exhausted: true, AddedBytes: 28}
+	})
+	if err != nil || answer != "Контрольный код — ORBIT-731." || calls != 2 {
+		t.Fatalf("answer=%q err=%v calls=%d", answer, err, calls)
+	}
+}
+
+func TestIterativeRetrieverPreservesScopeLanesAndBudgets(t *testing.T) {
+	history := []interaction.HumanUtterance{{ID: "a", PrincipalID: "p", Content: "контрольный код = ALPHA", ReceivedAtUnixMillis: 1}, {ID: "b", PrincipalID: "p", Content: "контрольный код = BETA", ReceivedAtUnixMillis: 2}}
+	references := []interaction.ProjectReference{{ID: "a-ref", UtteranceID: "a", ProjectID: "company-a"}, {ID: "b-ref", UtteranceID: "b", ProjectID: "company-b"}}
+	experiences := []epistemics.ExperienceRecord{{ID: "failure", PrincipalID: "p", ContextScopeRef: "company-a", ProblemStatement: "catalog sync", ActualOutcome: epistemics.OutcomeFailed, OutcomeDetail: "old connector failed", RecordedAtUnixMillis: 1}, {ID: "conflict", PrincipalID: "p", ContextScopeRef: "company-a", ProblemStatement: "catalog sync", ActualOutcome: epistemics.OutcomeConflict, OutcomeDetail: "conflicting result", RecordedAtUnixMillis: 2}}
+	retrieve := newIterativeContextRetriever(history, references, "p", "company-a", experiences)
+	current := retrieve(context.Background(), cognitive.IterativeRetrievalRequest{Query: "контрольный код", Lane: cognitive.IterativeRetrievalCurrentFact, Reason: "need scoped fact", RemainingBytes: 512})
+	if len(current.Candidates) != 1 || !strings.Contains(current.Candidates[0].Excerpt.Text, "ALPHA") || strings.Contains(current.Candidates[0].Excerpt.Text, "BETA") {
+		t.Fatalf("scope leaked: %#v", current)
+	}
+	if duplicate := retrieve(context.Background(), cognitive.IterativeRetrievalRequest{Query: "контрольный код", Lane: cognitive.IterativeRetrievalCurrentFact, Reason: "repeat", RemainingBytes: 512}); duplicate.Reason != "no_additional_evidence" {
+		t.Fatalf("duplicate was re-added: %#v", duplicate)
+	}
+	if negative := retrieve(context.Background(), cognitive.IterativeRetrievalRequest{Query: "catalog sync", Lane: cognitive.IterativeRetrievalNegativeExperience, Reason: "need failure", RemainingBytes: 512}); len(negative.Candidates) < 1 || !strings.Contains(strings.Join([]string{negative.Candidates[0].Excerpt.Text, negative.Candidates[len(negative.Candidates)-1].Excerpt.Text}, " "), "old connector failed") {
+		t.Fatalf("negative lane=%#v", negative)
+	}
+	if contradiction := retrieve(context.Background(), cognitive.IterativeRetrievalRequest{Query: "catalog sync", Lane: cognitive.IterativeRetrievalContradiction, Reason: "need conflict", RemainingBytes: 512}); len(contradiction.Candidates) != 1 || !strings.Contains(contradiction.Candidates[0].Excerpt.Text, "conflicting result") {
+		t.Fatalf("contradiction lane=%#v", contradiction)
+	}
+	if budget := retrieve(context.Background(), cognitive.IterativeRetrievalRequest{Query: "anything", Lane: cognitive.IterativeRetrievalCurrentFact, Reason: "bad", RemainingBytes: 2048}); budget.Reason != "budget" {
+		t.Fatalf("budget=%#v", budget)
+	}
+}
+
+func TestGenerateImageUsesDedicatedCognitiveMediaRoute(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost || r.URL.Path != "/v1/multimodal/generate-image" {
+			t.Fatalf("unexpected image route: %s %s", r.Method, r.URL.Path)
+		}
+		if err := r.ParseMultipartForm(1 << 20); err != nil {
+			t.Fatalf("parse image request: %v", err)
+		}
+		if !strings.Contains(r.FormValue("prompt"), "собаку") {
+			t.Fatalf("prompt was not preserved: %q", r.FormValue("prompt"))
+		}
+		_ = json.NewEncoder(w).Encode(capability.MultimodalResponse{Operation: capability.MultimodalGenerateImage, ContentType: "image/png", DataBase64: "cG5n"})
+	}))
+	defer server.Close()
+	client, err := newCognitiveInterpretationClient(server.URL, server.Client())
+	if err != nil {
+		t.Fatal(err)
+	}
+	image, err := client.GenerateImage(context.Background(), "нарисуй собаку", "")
+	if err != nil || image.DataBase64 != "cG5n" || image.ContentType != "image/png" {
+		t.Fatalf("image=%+v err=%v", image, err)
+	}
+}
+
+func TestReviewPreservesResearchEvidence(t *testing.T) {
+	draft := "Нашёл вариант. Источник: Aviasales (https://www.aviasales.ru/search)"
+	if reviewPreservesResearchEvidence("Нашёл вариант на Авиасейлс.", draft) {
+		t.Fatal("review without the direct source must be rejected")
+	}
+	if !reviewPreservesResearchEvidence("Нашёл вариант. Источник: Aviasales (https://www.aviasales.ru/search)", draft) {
+		t.Fatal("review with the direct source must be accepted")
+	}
+}
+
 func TestSimpleQuestionUsesStrictInterpretationForSemanticRouting(t *testing.T) {
 	result := interactiondomain.SemanticResult{
 		Interpretation: interaction.UtteranceInterpretation{
@@ -34,3 +210,51 @@ func TestOperationalQuestionStillUsesStrictInterpretation(t *testing.T) {
 		t.Fatal("operational question must retain strict interpretation routing")
 	}
 }
+
+func TestStructuredInventoryUsesDirectReadOnlySemanticRoute(t *testing.T) {
+	result := interactiondomain.SemanticResult{
+		Interpretation: interaction.UtteranceInterpretation{
+			SpeechAct:        interaction.SpeechActDirective,
+			Applicability:    interaction.SemanticApplicable,
+			ConfidenceMillis: 980,
+		},
+		InformationRequestKind: interaction.InformationRequestCognitiveModelInventory,
+	}
+	if shouldRequestSemanticInterpretation(result) {
+		t.Fatal("structured model inventory must use the direct read-only semantic route")
+	}
+}
+
+func TestStableReflexIsPeriodicallySampledForDrift(t *testing.T) {
+	result := interactiondomain.SemanticResult{Interpretation: interaction.UtteranceInterpretation{
+		SpeechAct: interaction.SpeechActConversational, Applicability: interaction.SemanticApplicable,
+	}}
+	found := false
+	for minute := 0; minute < 160; minute++ {
+		if shouldAuditDeterministicReflex(result, "utterance-drift-probe", time.Unix(int64(minute)*60, 0)) {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatal("stable reflex was never sampled during the audit window")
+	}
+}
+
+func TestMeaningfulSignalsAreNotReflexOnly(t *testing.T) {
+	for _, act := range []interaction.SpeechAct{interaction.SpeechActQuestion, interaction.SpeechActRequestToInvestigate, interaction.SpeechActDirective} {
+		result := interactiondomain.SemanticResult{Interpretation: interaction.UtteranceInterpretation{SpeechAct: act, Applicability: interaction.SemanticApplicable}}
+		if !shouldRequestSemanticInterpretation(result) {
+			t.Fatalf("%s must prefer cognitive interpretation", act)
+		}
+	}
+}
+
+func TestExplicitPreferenceIsNotReinterpretedByCognitiveAudit(t *testing.T) {
+	result := interactiondomain.SemanticResult{Interpretation: interaction.UtteranceInterpretation{
+		SpeechAct: interaction.SpeechActPreference, Applicability: interaction.SemanticApplicable,
+	}}
+	if shouldRequestSemanticInterpretation(result) || shouldAuditDeterministicReflex(result, "preference", time.Unix(0, 0)) {
+		t.Fatal("explicit preference must remain on the deterministic durable-context path")
+	}
+}

cmd/core-runtime/control_plane_authority.go

@@ -0,0 +1,76 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"git.cin.su/m/Assistant/contracts/authority"
+)
+
+var ErrControlPlaneUnavailable = errors.New("delegated control-plane authority unavailable")
+
+type controlPlaneAuthority struct {
+	baseURL    string
+	client     *http.Client
+	credential func() (string, error)
+}
+
+func (a controlPlaneAuthority) authorize(ctx context.Context, request authority.DelegatedControlPlaneRequest) error {
+	return a.post(ctx, "/v1/internal/control-plane/authorize", request)
+}
+
+func (a controlPlaneAuthority) completed(ctx context.Context, request authority.DelegatedControlPlaneRequest, success bool) {
+	outcome := "FAILED"
+	if success {
+		outcome = "COMPLETED"
+	}
+	_ = a.post(ctx, "/v1/internal/control-plane/completions", authority.DelegatedControlPlaneCompletion{Request: request, Outcome: outcome})
+}
+
+func (a controlPlaneAuthority) revoke(ctx context.Context, creatorAuthorization string, grantID authority.GrantID) error {
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, strings.TrimRight(a.baseURL, "/")+"/v1/creator/control-plane/grants/"+string(grantID)+"/revoke", nil)
+	if err != nil {
+		return err
+	}
+	request.Header.Set("Authorization", creatorAuthorization)
+	response, err := a.client.Do(request)
+	if err != nil {
+		return err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusNoContent {
+		return fmt.Errorf("delegated grant revoke status %d", response.StatusCode)
+	}
+	return nil
+}
+
+func (a controlPlaneAuthority) post(ctx context.Context, path string, value any) error {
+	credential, err := a.credential()
+	if err != nil || credential == "" {
+		return ErrControlPlaneUnavailable
+	}
+	body, err := json.Marshal(value)
+	if err != nil {
+		return err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, strings.TrimRight(a.baseURL, "/")+path, bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+	request.Header.Set("Authorization", "Bearer "+credential)
+	request.Header.Set("Content-Type", "application/json")
+	response, err := a.client.Do(request)
+	if err != nil {
+		return err
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		return fmt.Errorf("delegated control-plane status %d", response.StatusCode)
+	}
+	return nil
+}

cmd/core-runtime/control_plane_authority_test.go

@@ -0,0 +1,62 @@
+package main
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/authority"
+)
+
+func TestControlPlaneClientSendsOnlyServiceCredentialToAuthorityRuntime(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1/internal/control-plane/authorize" || r.Header.Get("Authorization") != "Bearer service-token" {
+			t.Fatalf("unexpected delegated request: %s %q", r.URL.Path, r.Header.Get("Authorization"))
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer server.Close()
+	client := controlPlaneAuthority{baseURL: server.URL, client: server.Client(), credential: func() (string, error) { return "service-token", nil }}
+	request := authority.DelegatedControlPlaneRequest{GrantID: "grant", TaskID: "task", TaskRevision: 1, Operation: authority.DelegatedOperationCanaryCognitiveBinding, Resource: authority.CognitiveBindingResource{BindingID: "binding", ProviderInstanceID: "provider", ModelDescriptorID: "model"}}
+	if err := client.authorize(context.Background(), request); err != nil {
+		t.Fatalf("authorize: %v", err)
+	}
+}
+
+func TestControlPlaneCredentialUsesDedicatedSecretRoot(t *testing.T) {
+	root := t.TempDir()
+	if err := os.WriteFile(filepath.Join(root, controlPlaneServiceTokenFile), []byte("test-machine-token\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("CONTROL_PLANE_SERVICE_CREDENTIAL_REF", "credential://domovoy/control-plane/service-token/v1")
+	t.Setenv("CONTROL_PLANE_SERVICE_SECRET_ROOT", root)
+	if got, err := readControlPlaneServiceCredential(); err != nil || got != "test-machine-token" {
+		t.Fatalf("control-plane credential resolution failed: %v", err)
+	}
+}
+
+func TestCandidateControlPlaneAuthenticationRejectsMissingOrWrongCredential(t *testing.T) {
+	credential := func() (string, error) { return "service-token", nil }
+	for _, authorization := range []string{"", "Bearer other-token", "Basic service-token"} {
+		request := httptest.NewRequest(http.MethodPost, "/v1/internal/capability-bindings/candidate/resolve", nil)
+		request.Header.Set("Authorization", authorization)
+		if candidateControlPlaneAuthenticated(request, credential) {
+			t.Fatalf("authorization %q was accepted", authorization)
+		}
+	}
+	request := httptest.NewRequest(http.MethodPost, "/v1/internal/capability-bindings/candidate/resolve", nil)
+	request.Header.Set("Authorization", "Bearer service-token")
+	if !candidateControlPlaneAuthenticated(request, credential) {
+		t.Fatal("expected service credential to be accepted")
+	}
+}
+
+func TestCandidateReleaseContextRequiresCompleteRuntimeMetadata(t *testing.T) {
+	t.Setenv("CANDIDATE_RELEASE_SET_ID", "assistant-slot-b")
+	if _, err := candidateReleaseContextFromRuntime(); err == nil {
+		t.Fatal("partial candidate runtime metadata was accepted")
+	}
+}

cmd/core-runtime/household_scenario_test.go

@@ -0,0 +1,123 @@
+package main
+
+import (
+	"testing"
+	"time"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	interactiondomain "git.cin.su/m/Assistant/modules/interaction/domain"
+)
+
+func TestHouseholdResearchAndActionRoutesRemainIndependent(t *testing.T) {
+	candidate := interactiondomain.BuildDeterministicCandidate("проверь погоду в Казани, найди кафе рядом и напомни вечером позвонить", "", time.Unix(10, 0).UnixMilli())
+	planned := buildChatRoutePlan(interactiondomain.SemanticResult{NeedsCognition: candidate.NeedsCognition, CapabilityHints: candidate.CapabilityHints})
+	want := map[chatRouteKind]bool{chatRouteResearch: false, chatRouteConversation: false, chatRouteAction: false}
+	for _, route := range planned {
+		if _, ok := want[route.Kind]; ok {
+			want[route.Kind] = true
+		}
+	}
+	for kind, present := range want {
+		if !present {
+			t.Fatalf("route %s missing for mixed household request: candidate=%+v routes=%+v", kind, candidate, planned)
+		}
+	}
+}
+
+func TestHouseholdCreativeRouteDoesNotUseResearch(t *testing.T) {
+	candidate := interactiondomain.BuildDeterministicCandidate("расскажи сказку о Колобке", "", time.Unix(10, 0).UnixMilli())
+	for _, hint := range candidate.CapabilityHints {
+		if capability.CapabilityKind(hint) == capability.CapabilityKindWebResearch {
+			t.Fatalf("creative request selected web research: %+v", candidate)
+		}
+	}
+	if !interactiondomain.IsCreativeRequest("расскажи сказку о Колобке") {
+		t.Fatal("creative request was not recognized")
+	}
+}
+
+func TestHouseholdMarketplaceBrandSearchUsesResearchRoute(t *testing.T) {
+	candidate := interactiondomain.BuildDeterministicCandidate("найди на WB бренд marka-wear", "", time.Unix(10, 0).UnixMilli())
+	decomposition := interactiondomain.DecomposeTaskWithLexicon("найди на WB бренд marka-wear", interactiondomain.TaskLexicon{ObjectAliases: []interactiondomain.TaskLexiconEntry{{Alias: "бренд", Value: "BRAND"}}, SourceAliases: []interactiondomain.TaskLexiconEntry{{Alias: "wb", Value: "WILDBERRIES"}}})
+	if decomposition.Intent != interactiondomain.TaskIntentSearch || decomposition.Object != "BRAND" || decomposition.Source != "WILDBERRIES" || decomposition.Target != "marka-wear" || len(decomposition.Missing) != 0 {
+		t.Fatalf("marketplace request was not split into executable atoms: %+v", decomposition)
+	}
+	routes := buildChatRoutePlan(interactiondomain.SemanticResult{NeedsCognition: candidate.NeedsCognition, CapabilityHints: candidate.CapabilityHints})
+	if !hasChatRoute(routes, chatRouteResearch) {
+		t.Fatalf("marketplace brand request did not select research route: candidate=%+v routes=%+v", candidate, routes)
+	}
+}
+
+func TestHouseholdSemanticMemoryControlsMarketplaceAlias(t *testing.T) {
+	withoutMemory := interactiondomain.DecomposeTask("найди на WB бренд marka-wear")
+	if withoutMemory.Source != "" || withoutMemory.Object != "" {
+		t.Fatalf("core invented marketplace meaning without memory: %+v", withoutMemory)
+	}
+	withMemory := interactiondomain.DecomposeTaskWithLexicon("поищи марку marka-wear в Wildberries", interactiondomain.TaskLexicon{
+		ObjectAliases: []interactiondomain.TaskLexiconEntry{{Alias: "марку", Value: "BRAND"}},
+		SourceAliases: []interactiondomain.TaskLexiconEntry{{Alias: "wildberries", Value: "WILDBERRIES"}},
+	})
+	if withMemory.Intent != interactiondomain.TaskIntentSearch || withMemory.Object != "BRAND" || withMemory.Source != "WILDBERRIES" || withMemory.Target != "marka-wear" || !withMemory.NeedsResearch {
+		t.Fatalf("semantic memory did not control marketplace decomposition: %+v", withMemory)
+	}
+}
+
+func TestHouseholdBearDrawingUsesCreativeLocalRoute(t *testing.T) {
+	candidate := interactiondomain.BuildDeterministicCandidate("нарисуй бурого медведя", "", time.Unix(10, 0).UnixMilli())
+	decomposition := interactiondomain.DecomposeTaskWithLexicon("нарисуй бурого медведя", interactiondomain.TaskLexicon{ObjectAliases: []interactiondomain.TaskLexiconEntry{{Alias: "медвед", Value: "IMAGE"}}})
+	if decomposition.Intent != interactiondomain.TaskIntentCreate || decomposition.Object != "IMAGE" || decomposition.Target != "бурого медведя" || decomposition.NeedsResearch {
+		t.Fatalf("creative request was not split into local execution atoms: %+v", decomposition)
+	}
+	routes := buildChatRoutePlan(interactiondomain.SemanticResult{NeedsCognition: candidate.NeedsCognition, CapabilityHints: candidate.CapabilityHints})
+	if !hasChatRoute(routes, chatRouteMedia) {
+		t.Fatalf("creative image request did not select media route: candidate=%+v routes=%+v", candidate, routes)
+	}
+	for _, hint := range candidate.CapabilityHints {
+		if capability.CapabilityKind(hint) == capability.CapabilityKindWebResearch {
+			t.Fatalf("bear drawing selected web research: %+v", candidate)
+		}
+	}
+	for _, message := range []string{"нарисуй бурого медведя", "нарисуй птицу", "нарисуй зеленую птицу", "нарисуй птицу в HD", "нарисуй коня"} {
+		if got := interactiondomain.CreativeDeterministicReply(message); got != "" {
+			t.Fatalf("creative request %q received a canned reply=%q", message, got)
+		}
+	}
+}
+
+func TestHouseholdRouteMatrixKeepsMeaningBoundaries(t *testing.T) {
+	tests := []struct {
+		message      string
+		wantResearch bool
+		wantCreative bool
+		wantHint     string
+	}{
+		{message: "найди на WB бренд marka-wear", wantResearch: true},
+		{message: "какая погода в Казани?", wantResearch: true},
+		{message: "найди билеты до Сочи", wantResearch: true},
+		{message: "нарисуй птицу", wantCreative: true},
+		{message: "расскажи сказку о Колобке", wantCreative: true},
+		{message: "что такое гравитация?", wantHint: "COGNITIVE_REASONING"},
+	}
+	for _, test := range tests {
+		candidate := interactiondomain.BuildDeterministicCandidate(test.message, "", time.Unix(10, 0).UnixMilli())
+		if interactiondomain.IsCreativeRequest(test.message) != test.wantCreative {
+			t.Fatalf("message=%q creative=%v want=%v candidate=%+v", test.message, interactiondomain.IsCreativeRequest(test.message), test.wantCreative, candidate)
+		}
+		gotResearch := false
+		gotHint := false
+		for _, hint := range candidate.CapabilityHints {
+			if hint == "WEB_RESEARCH" {
+				gotResearch = true
+			}
+			if hint == test.wantHint {
+				gotHint = true
+			}
+		}
+		if gotResearch != test.wantResearch {
+			t.Fatalf("message=%q research=%v want=%v candidate=%+v", test.message, gotResearch, test.wantResearch, candidate)
+		}
+		if test.wantHint != "" && !gotHint {
+			t.Fatalf("message=%q missing hint=%q candidate=%+v", test.message, test.wantHint, candidate)
+		}
+	}
+}

cmd/core-runtime/human_response_gate_test.go

@@ -0,0 +1,46 @@
+package main
+
+import "testing"
+
+func TestShouldInvokeHumanResponseSkipsDeterministicFastPaths(t *testing.T) {
+	tests := []struct {
+		name                   string
+		stableConversational   bool
+		identityReply          string
+		memoryInstructionReply string
+		want                   bool
+	}{
+		{name: "stable conversational", stableConversational: true},
+		{name: "identity", identityReply: "Меня зовут Домовой."},
+		{name: "memory instruction", memoryInstructionReply: "Запомнил."},
+		{name: "ordinary continuity", want: true},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if got := shouldInvokeHumanResponse(test.stableConversational, test.identityReply, test.memoryInstructionReply); got != test.want {
+				t.Fatalf("shouldInvokeHumanResponse() = %t, want %t", got, test.want)
+			}
+		})
+	}
+}
+
+func TestShouldReviewResponseSkipsStableAnswers(t *testing.T) {
+	if shouldReviewResponse("Здравствуйте.", false, true, "", "", false) {
+		t.Fatal("stable conversational reply must not wait for response review")
+	}
+	if shouldReviewResponse("Меня зовут Домовой.", false, false, "Меня зовут Домовой.", "", false) {
+		t.Fatal("identity reply must not wait for response review")
+	}
+	if shouldReviewResponse("Запомнил.", false, false, "", "Запомнил.", false) {
+		t.Fatal("memory instruction reply must not wait for response review")
+	}
+	if shouldReviewResponse("Вы называли тестовый цвет: синий.", false, false, "", "", true) {
+		t.Fatal("deterministic memory reply must not wait for response review")
+	}
+	if !shouldReviewResponse("Ответ", false, false, "", "", false) {
+		t.Fatal("non-conversational answer remains reviewable")
+	}
+	if shouldReviewResponse("Ответ", true, false, "", "", false) {
+		t.Fatal("stable knowledge answer must not be reviewed twice")
+	}
+}

cmd/core-runtime/information_request_test.go

@@ -0,0 +1,27 @@
+package main
+
+import (
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/interaction"
+)
+
+func TestSpecializedInformationReplyIsNotOverwrittenByResearch(t *testing.T) {
+	for _, kind := range []interaction.InformationRequestKind{
+		interaction.InformationRequestMemoryInventory,
+		interaction.InformationRequestCapabilityInventory,
+		interaction.InformationRequestCognitiveModelInventory,
+		interaction.InformationRequestCognitiveChannelStatus,
+		interaction.InformationRequestCognitiveRecovery,
+	} {
+		if shouldRunGeneralResearch(kind) {
+			t.Fatalf("specialized information request %q must bypass general research", kind)
+		}
+	}
+	if !shouldRunGeneralResearch(interaction.InformationRequestTimeDifference) {
+		t.Fatal("time difference must use the current-data research route")
+	}
+	if !shouldRunGeneralResearch("") {
+		t.Fatal("ordinary research requests must still use general research")
+	}
+}

cmd/core-runtime/learning.go

@@ -11,8 +11,12 @@ import (
 	"git.cin.su/m/Assistant/contracts/continuity"
 	"git.cin.su/m/Assistant/contracts/epistemics"
 	"git.cin.su/m/Assistant/contracts/interaction"
+	selfcontract "git.cin.su/m/Assistant/contracts/self"
 	capabilitydomain "git.cin.su/m/Assistant/modules/capability/domain"
 	epistemicsdomain "git.cin.su/m/Assistant/modules/epistemics/domain"
+	selfdomain "git.cin.su/m/Assistant/modules/self/domain"
+	"git.cin.su/m/Assistant/platform/ids"
+	"git.cin.su/m/Assistant/platform/telemetry"
 )
 
 const reminderResponseSkillID = capability.SkillProfileID("skill-obvious-reminder-response-v1")
@@ -28,15 +32,55 @@ type learningCapabilityStore interface {
 	SaveSkillProfile(context.Context, capability.SkillProfile) error
 }
 
+type learningSelfStore interface {
+	SaveLearningSignal(context.Context, selfcontract.LearningSignal) error
+	SaveImprovementNeed(context.Context, selfcontract.ImprovementNeed) error
+	SaveLearningLedger(context.Context, selfcontract.LearningLedgerEntry) error
+}
+
 type learningRecorder struct {
 	epistemics learningEpistemicsStore
 	capability capabilityLearningStore
+	self       learningSelfStore
 }
 
 type capabilityLearningStore interface {
 	learningCapabilityStore
 }
 
+func (r learningRecorder) recordSelfSignal(ctx context.Context, signal selfcontract.LearningSignal) {
+	if r.self == nil {
+		return
+	}
+	if err := signal.Validate(); err != nil {
+		log.Printf("learning SELF signal invalid: %v", err)
+		return
+	}
+	if err := r.self.SaveLearningSignal(ctx, signal); err != nil {
+		log.Printf("learning SELF signal unavailable: %v", err)
+		return
+	}
+	diagnosis := selfdomain.AttributeFailure(signal)
+	need, err := selfdomain.BuildImprovementNeed(signal, diagnosis, string(signal.Kind))
+	if err != nil {
+		log.Printf("learning SELF improvement need invalid: %v", err)
+		return
+	}
+	if err := r.self.SaveImprovementNeed(ctx, need); err != nil {
+		log.Printf("learning SELF improvement need unavailable: %v", err)
+		return
+	}
+	needRef := selfcontract.SemanticReference{OwnerNamespace: "self", SemanticKind: "improvement_need", StableID: ids.StableID(need.ID)}
+	ledger := selfcontract.LearningLedgerEntry{ID: selfcontract.LearningLedgerEntryID("ledger:observed:" + signal.ID), PrincipalID: signal.PrincipalID, ImprovementNeedRef: &needRef, ObservedProblem: need.ProblemSummary, EvidenceRefs: signal.EvidenceRefs, Diagnosis: string(diagnosis.Class), Hypothesis: diagnosis.Rationale, ProposedChangeRef: signal.SubjectRef, ExpectedImprovement: need.ExpectedBenefit, Decision: "OBSERVED_REQUIRES_GOVERNED_REVIEW", RecordedAt: signal.ObservedAt}
+	if err := r.self.SaveLearningLedger(ctx, ledger); err != nil {
+		log.Printf("learning SELF ledger unavailable: %v", err)
+	}
+}
+
+func selfEvidence(owner, kind, stable string) selfcontract.SemanticReference {
+	return selfcontract.SemanticReference{OwnerNamespace: owner, SemanticKind: kind, StableID: ids.StableID(stable)}
+}
+
 type reminderResponseLearningInput struct {
 	Utterance interaction.HumanUtterance
 	Intent    interaction.OriginalHumanIntent
@@ -112,6 +156,7 @@ func (r learningRecorder) recordReminderResponse(ctx context.Context, input remi
 	actual, confidence := outcomeForHumanResponse(input.Result.Response)
 	experience := epistemics.ExperienceRecord{
 		SourceKind:        epistemics.ExperienceSourceContinuity,
+		PrincipalID:       string(input.Utterance.PrincipalID),
 		OriginalIntentID:  epistemics.OriginalIntentRef(input.Intent.ID),
 		SourceUtteranceID: epistemics.SourceUtteranceRef(input.Utterance.ID),
 		ContextRefs: contextRefs(
@@ -142,6 +187,7 @@ func (r learningRecorder) recordCorrection(ctx context.Context, input correction
 	}
 	experience := epistemics.ExperienceRecord{
 		SourceKind:            epistemics.ExperienceSourceInteraction,
+		PrincipalID:           string(input.Utterance.PrincipalID),
 		OriginalIntentID:      epistemics.OriginalIntentRef(input.Intent.ID),
 		SourceUtteranceID:     epistemics.SourceUtteranceRef(input.Utterance.ID),
 		HelpMethod:            epistemics.HelpMethodClarification,
@@ -154,12 +200,45 @@ func (r learningRecorder) recordCorrection(ctx context.Context, input correction
 		RecordedAtUnixMillis:  input.At.UnixMilli(),
 	}
 	r.saveExperienceAndReflection(ctx, experience)
+	r.recordSelfSignal(ctx, selfcontract.LearningSignal{
+		ID: "signal:correction:" + string(input.Utterance.ID), PrincipalID: string(input.Utterance.PrincipalID), Kind: selfcontract.SignalUserCorrection,
+		TaskPattern: "interaction-correction", ScopeKey: "principal:" + string(input.Utterance.PrincipalID),
+		SubjectRef: selfEvidence("interaction", "intent", string(input.Intent.ID)), EvidenceRefs: []selfcontract.SemanticReference{selfEvidence("epistemics", "experience", string(input.Utterance.ID))}, ObservedAt: input.At.UnixMilli(), Severity: 2, UserImpact: 2,
+	})
+}
+
+func (r learningRecorder) createDelegationCandidateSkill(ctx context.Context, input delegationLearningInput, experience epistemics.ExperienceRecord) {
+	if r.capability == nil || experience.ID == "" || len(experience.VerificationEvidence) == 0 {
+		return
+	}
+	// One verified result creates only a candidate. Repeated outcome evidence and
+	// independent validation are required by Capability before activation.
+	profile := capability.SkillProfile{
+		ID:                    capability.SkillProfileID("skill:delegation:" + string(input.ImplementationID)),
+		Revision:              1,
+		Name:                  "Verified bounded delegation strategy",
+		Description:           "Observed verified delegation outcome; requires repeatability and independent validation.",
+		ApplicableContext:     []string{"work:delegation"},
+		ImplementationRef:     "work:agent-delegation-v1",
+		ImplementationVersion: "1",
+		Status:                capability.SkillCandidate,
+		ConfidenceMillis:      500,
+		RecordedAtUnixMillis:  experience.RecordedAtUnixMillis,
+	}
+	next, err := capabilitydomain.CandidateFromVerifiedExperience(profile, capability.SkillEvidenceRef("epistemics:experience:"+string(experience.ID)), true, experience.RecordedAtUnixMillis)
+	if err != nil {
+		return
+	}
+	if err := r.capability.SaveSkillProfile(ctx, next); err != nil {
+		log.Printf("learning candidate skill unavailable: %v", err)
+	}
 }
 
 func (r learningRecorder) recordFastPathDecline(ctx context.Context, input fastPathDeclineLearningInput) {
 	if r.epistemics == nil || input.Intent.ID == "" || input.Utterance.ID == "" {
 		return
 	}
+	telemetry.RecordCompatibility("fast-path-v1", "core-runtime", "decision", "decline-or-escalate", true, true, false, "OBSERVED", string(input.Utterance.CorrelationID), string(input.Utterance.PrincipalID), input.At)
 	experience, err := epistemicsdomain.FastPathDeclineExperience(
 		epistemics.OriginalIntentRef(input.Intent.ID),
 		epistemics.SourceUtteranceRef(input.Utterance.ID),
@@ -173,10 +252,16 @@ func (r learningRecorder) recordFastPathDecline(ctx context.Context, input fastP
 	if input.Result.Response.ID != "" {
 		experience.ContextRefs = contextRefs("continuity:response-candidate:" + string(input.Result.Response.Operation))
 	}
+	experience.PrincipalID = string(input.Utterance.PrincipalID)
 	saved, ok := r.saveExperienceAndReflection(ctx, experience)
 	if ok {
 		r.updateReminderSkill(ctx, saved, capability.UsageSkipped, false)
 	}
+	r.recordSelfSignal(ctx, selfcontract.LearningSignal{
+		ID: "signal:fast-path:" + string(input.Utterance.ID), PrincipalID: string(input.Utterance.PrincipalID), Kind: selfcontract.SignalSkillFallback,
+		TaskPattern: "fast-path", ScopeKey: "principal:" + string(input.Utterance.PrincipalID), SubjectRef: selfEvidence("capability", "skill", string(reminderResponseSkillID)),
+		EvidenceRefs: []selfcontract.SemanticReference{selfEvidence("epistemics", "experience", string(input.Utterance.ID))}, ActualOutcome: string(input.Reason), ObservedAt: input.At.UnixMilli(), Severity: 1,
+	})
 }
 
 func (r learningRecorder) recordCapabilityUse(ctx context.Context, input capabilityLearningInput) {
@@ -194,6 +279,7 @@ func (r learningRecorder) recordCapabilityUse(ctx context.Context, input capabil
 	}
 	experience := epistemics.ExperienceRecord{
 		SourceKind:                    epistemics.ExperienceSourceCapability,
+		PrincipalID:                   string(input.Utterance.PrincipalID),
 		OriginalIntentID:              epistemics.OriginalIntentRef(input.Intent.ID),
 		SourceUtteranceID:             epistemics.SourceUtteranceRef(input.Utterance.ID),
 		HelpMethod:                    epistemics.HelpMethodCapabilityExecution,
@@ -209,6 +295,13 @@ func (r learningRecorder) recordCapabilityUse(ctx context.Context, input capabil
 		RecordedAtUnixMillis:          input.At.UnixMilli(),
 	}
 	r.saveExperienceAndReflection(ctx, experience)
+	if input.Outcome == capability.UsageFailed || input.Outcome == capability.UsageUnknown {
+		r.recordSelfSignal(ctx, selfcontract.LearningSignal{
+			ID: "signal:capability:" + string(input.Utterance.ID), PrincipalID: string(input.Utterance.PrincipalID), Kind: selfcontract.SignalVerifiedFailure,
+			TaskPattern: "capability-use", ScopeKey: "principal:" + string(input.Utterance.PrincipalID), SubjectRef: selfEvidence("capability", "implementation", string(input.ImplementationID)), EvidenceRefs: []selfcontract.SemanticReference{selfEvidence("epistemics", "experience", string(input.Utterance.ID))},
+			ActualOutcome: string(input.Outcome), ObservedAt: input.At.UnixMilli(), Severity: 2,
+		})
+	}
 }
 
 func (r learningRecorder) recordDelegationOutcome(ctx context.Context, input delegationLearningInput) {
@@ -230,6 +323,7 @@ func (r learningRecorder) recordDelegationOutcome(ctx context.Context, input del
 	}
 	experience := epistemics.ExperienceRecord{
 		SourceKind:                  epistemics.ExperienceSourceCapability,
+		PrincipalID:                 string(input.Utterance.PrincipalID),
 		OriginalIntentID:            epistemics.OriginalIntentRef(input.Intent.ID),
 		SourceUtteranceID:           epistemics.SourceUtteranceRef(input.Utterance.ID),
 		ContextRefs:                 contextRefs("work:delegation:"+input.DelegationID, "work:run:"+input.RunID),
@@ -244,7 +338,17 @@ func (r learningRecorder) recordDelegationOutcome(ctx context.Context, input del
 		ConfidenceMillis:            confidence,
 		RecordedAtUnixMillis:        input.At.UnixMilli(),
 	}
-	r.saveExperienceAndReflection(ctx, experience)
+	saved, ok := r.saveExperienceAndReflection(ctx, experience)
+	if ok && input.Verified {
+		r.createDelegationCandidateSkill(ctx, input, saved)
+	}
+	if !input.Verified {
+		r.recordSelfSignal(ctx, selfcontract.LearningSignal{
+			ID: "signal:delegation:" + input.DelegationID, PrincipalID: string(input.Utterance.PrincipalID), Kind: selfcontract.SignalVerifiedFailure,
+			TaskPattern: "delegation", ScopeKey: "principal:" + string(input.Utterance.PrincipalID), SubjectRef: selfEvidence("capability", "implementation", string(input.ImplementationID)), EvidenceRefs: []selfcontract.SemanticReference{selfEvidence("epistemics", "experience", input.OutcomeRef)},
+			ActualOutcome: string(actual), ObservedAt: input.At.UnixMilli(), Severity: 2,
+		})
+	}
 }
 
 func (r learningRecorder) saveExperienceAndReflection(ctx context.Context, value epistemics.ExperienceRecord) (epistemics.ExperienceRecord, bool) {
@@ -273,9 +377,11 @@ func (r learningRecorder) updateReminderSkill(ctx context.Context, experience ep
 	}
 	profile, err := r.capability.LoadSkillProfile(ctx, reminderResponseSkillID)
 	if err != nil {
+		telemetry.RecordCompatibility("skill-profile-v1", "core-runtime", "read", "fast-path-learning", true, false, true, "FAILURE", string(experience.OriginalIntentID), string(experience.SourceUtteranceID), time.UnixMilli(experience.RecordedAtUnixMillis))
 		log.Printf("learning skill profile unavailable: %v", err)
 		return
 	}
+	telemetry.RecordCompatibility("skill-profile-v1", "core-runtime", "read", "fast-path-learning", true, false, true, "SUCCESS", string(experience.OriginalIntentID), string(experience.SourceUtteranceID), time.UnixMilli(experience.RecordedAtUnixMillis))
 	next, err := capabilitydomain.ObserveSkillOutcome(profile, capability.SkillOutcomeObservation{
 		ExperienceRef:        capability.SkillEvidenceRef("epistemics:experience:" + string(experience.ID)),
 		Outcome:              outcome,
@@ -287,9 +393,11 @@ func (r learningRecorder) updateReminderSkill(ctx context.Context, experience ep
 		return
 	}
 	if err := r.capability.SaveSkillProfile(ctx, next); err != nil {
+		telemetry.RecordCompatibility("skill-profile-v1", "core-runtime", "write", "fast-path-learning", true, false, true, "FAILURE", string(experience.OriginalIntentID), string(experience.SourceUtteranceID), time.UnixMilli(experience.RecordedAtUnixMillis))
 		log.Printf("learning skill profile save unavailable: %v", err)
 		return
 	}
+	telemetry.RecordCompatibility("skill-profile-v1", "core-runtime", "write", "fast-path-learning", true, false, true, "SUCCESS", string(experience.OriginalIntentID), string(experience.SourceUtteranceID), time.UnixMilli(experience.RecordedAtUnixMillis))
 }
 
 func outcomeForHumanResponse(response continuity.HumanResponse) (epistemics.OutcomeClass, int64) {

cmd/core-runtime/learning_test.go

@@ -2,12 +2,14 @@ package main
 
 import (
 	"context"
+	"errors"
 	"testing"
 	"time"
 
 	"git.cin.su/m/Assistant/contracts/capability"
 	"git.cin.su/m/Assistant/contracts/epistemics"
 	"git.cin.su/m/Assistant/contracts/interaction"
+	selfcontract "git.cin.su/m/Assistant/contracts/self"
 )
 
 type learningEpistemicsStub struct {
@@ -28,17 +30,60 @@ func (s *learningEpistemicsStub) SaveReflectionCandidate(context.Context, episte
 type learningCapabilityStub struct {
 	loadCalls int
 	saveCalls int
+	saved     []capability.SkillProfile
+}
+
+type learningSelfStub struct {
+	signals int
+	needs   int
+	ledgers int
+}
+
+type failingLearningSelfStub struct{}
+
+func (failingLearningSelfStub) SaveLearningSignal(context.Context, selfcontract.LearningSignal) error {
+	return errors.New("self repository unavailable")
+}
+func (failingLearningSelfStub) SaveImprovementNeed(context.Context, selfcontract.ImprovementNeed) error {
+	return errors.New("self repository unavailable")
+}
+func (failingLearningSelfStub) SaveLearningLedger(context.Context, selfcontract.LearningLedgerEntry) error {
+	return errors.New("self repository unavailable")
+}
+
+func (s *learningSelfStub) SaveLearningSignal(context.Context, selfcontract.LearningSignal) error {
+	s.signals++
+	return nil
+}
+func (s *learningSelfStub) SaveImprovementNeed(context.Context, selfcontract.ImprovementNeed) error {
+	s.needs++
+	return nil
+}
+func (s *learningSelfStub) SaveLearningLedger(context.Context, selfcontract.LearningLedgerEntry) error {
+	s.ledgers++
+	return nil
 }
 
 func (s *learningCapabilityStub) LoadSkillProfile(context.Context, capability.SkillProfileID) (capability.SkillProfile, error) {
 	s.loadCalls++
 	return capability.SkillProfile{}, nil
 }
-func (s *learningCapabilityStub) SaveSkillProfile(context.Context, capability.SkillProfile) error {
+func (s *learningCapabilityStub) SaveSkillProfile(_ context.Context, value capability.SkillProfile) error {
 	s.saveCalls++
+	s.saved = append(s.saved, value)
 	return nil
 }
 
+func TestVerifiedDelegationCreatesCandidateNotActiveSkill(t *testing.T) {
+	e := &learningEpistemicsStub{}
+	c := &learningCapabilityStub{}
+	r := learningRecorder{epistemics: e, capability: c}
+	r.recordDelegationOutcome(context.Background(), delegationLearningInput{Intent: interaction.OriginalHumanIntent{ID: "i"}, Utterance: interaction.HumanUtterance{ID: "u"}, DelegationID: "d", RunID: "r", ImplementationID: "impl", OutcomeRef: "outcome", VerificationRefs: []epistemics.EvidenceRef{"verified"}, Verified: true, At: time.UnixMilli(1000)})
+	if len(c.saved) != 1 || c.saved[0].Status != capability.SkillCandidate || c.saved[0].VerifiedOutcomeCount != 1 {
+		t.Fatalf("candidate=%#v", c.saved)
+	}
+}
+
 func TestGenericCorrectionDoesNotDegradeReminderSkill(t *testing.T) {
 	epistemicsStore := &learningEpistemicsStub{}
 	capabilityStore := &learningCapabilityStub{}
@@ -55,3 +100,33 @@ func TestGenericCorrectionDoesNotDegradeReminderSkill(t *testing.T) {
 		t.Fatalf("generic correction must remain evidence without a reminder skill reference: %#v", epistemicsStore.experiences)
 	}
 }
+
+func TestCorrectionWritesBoundedSelfEvidenceWithoutChangingResponsePath(t *testing.T) {
+	epistemicsStore := &learningEpistemicsStub{}
+	selfStore := &learningSelfStub{}
+	recorder := learningRecorder{epistemics: epistemicsStore, self: selfStore}
+	recorder.recordCorrection(context.Background(), correctionLearningInput{
+		Intent:    interaction.OriginalHumanIntent{ID: "intent-2"},
+		Utterance: interaction.HumanUtterance{ID: "utterance-2", PrincipalID: "principal-2"},
+		At:        time.UnixMilli(2000),
+	})
+	if selfStore.signals != 1 || selfStore.needs != 1 || selfStore.ledgers != 1 {
+		t.Fatalf("self evidence counts: signals=%d needs=%d ledgers=%d", selfStore.signals, selfStore.needs, selfStore.ledgers)
+	}
+	if len(epistemicsStore.experiences) != 1 {
+		t.Fatalf("completed learning path was changed")
+	}
+}
+
+func TestSelfRepositoryFailureDoesNotDiscardUserFacingLearningPath(t *testing.T) {
+	epistemicsStore := &learningEpistemicsStub{}
+	recorder := learningRecorder{epistemics: epistemicsStore, self: failingLearningSelfStub{}}
+	recorder.recordCorrection(context.Background(), correctionLearningInput{
+		Intent:    interaction.OriginalHumanIntent{ID: "intent-failure"},
+		Utterance: interaction.HumanUtterance{ID: "utterance-failure", PrincipalID: "principal-failure"},
+		At:        time.UnixMilli(3000),
+	})
+	if len(epistemicsStore.experiences) != 1 {
+		t.Fatalf("SELF repository failure must not discard the completed epistemics response path")
+	}
+}

cmd/core-runtime/main_test.go

@@ -11,10 +11,183 @@ import (
 	"time"
 
 	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/epistemics"
 	"git.cin.su/m/Assistant/contracts/interaction"
+	"git.cin.su/m/Assistant/contracts/work"
 	interactiondomain "git.cin.su/m/Assistant/modules/interaction/domain"
 )
 
+func TestHumanResearchExcerptRemovesSearchResultHeading(t *testing.T) {
+	got := humanResearchExcerpt("погода в Санкт-Петербурге", "Погода в Санкт-Петербурге — Прогноз погоды — Сейчас пасмурно, температура +14°")
+	if got != "Сейчас пасмурно, температура +14°" || strings.Contains(got, "Прогноз погоды") {
+		t.Fatalf("human research excerpt = %q", got)
+	}
+}
+
+func TestNearestFlightEvidenceDoesNotClaimMissingDepartureTime(t *testing.T) {
+	if !nearestFlightQuery("ближайший рейс Москва Казань сегодня") {
+		t.Fatal("nearest flight query was not recognized")
+	}
+	if containsFlightTimeEvidence("Казань составляет 1 ч 25 мин. График вылетов доступен онлайн") {
+		t.Fatal("duration was mistaken for a departure time")
+	}
+	if !containsFlightTimeEvidence("Ближайший вылет в 18:40") {
+		t.Fatal("departure time was not recognized")
+	}
+}
+
+func TestNearestFlightReplyFiltersUnrelatedSearchSnippets(t *testing.T) {
+	result := epistemics.ResearchResult{Findings: []epistemics.ResearchFinding{
+		{State: epistemics.FindingSupported, Source: epistemics.Source{Locator: "https://naidy.example", Title: "Мебельная фурнитура"}, Excerpt: epistemics.SourceExcerpt{Text: "Комплектующие для мебели оптом и в розницу."}},
+		{State: epistemics.FindingSupported, Source: epistemics.Source{Locator: "https://rasp.example", Title: "Рейсы Москва — Казань"}, Excerpt: epistemics.SourceExcerpt{Text: "Расписание самолётов Москва — Казань, время вылета и прилёта."}},
+	}}
+	reply, backed := renderResearchReply("ближайшие авиарейсы Москва Казань сегодня", result, nil)
+	if !backed || !strings.Contains(reply, "Рейсы Москва") || strings.Contains(reply, "Мебельная") {
+		t.Fatalf("unrelated source leaked into flight reply: %q", reply)
+	}
+}
+
+func TestNearestFlightReplyDoesNotAppendWeakerSecondMatch(t *testing.T) {
+	result := epistemics.ResearchResult{Findings: []epistemics.ResearchFinding{
+		{State: epistemics.FindingSupported, Source: epistemics.Source{Locator: "https://schedule.example", Title: "Рейсы Москва — Казань"}, Excerpt: epistemics.SourceExcerpt{Text: "Расписание авиарейсов Москва — Казань, время вылета и прилёта."}},
+		{State: epistemics.FindingSupported, Source: epistemics.Source{Locator: "https://category.example", Title: "Категория направлений"}, Excerpt: epistemics.SourceExcerpt{Text: "Список близлежащих городов и ориентировочные цены."}},
+	}}
+	reply, backed := renderResearchReply("ближайшие авиарейсы Москва Казань сегодня", result, nil)
+	if !backed || !strings.Contains(reply, "Рейсы Москва") || strings.Contains(reply, "Категория направлений") {
+		t.Fatalf("weaker second finding leaked into nearest-flight reply: %q", reply)
+	}
+}
+
+func TestNearestFlightEvidenceRequiresBothRouteEndpointsWhenKnown(t *testing.T) {
+	query := "ближайшие авиарейсы Москва Казань сегодня"
+	matched := epistemics.ResearchFinding{Source: epistemics.Source{Title: "Рейсы Москва — Казань"}, Excerpt: epistemics.SourceExcerpt{Text: "Расписание авиарейсов из Москвы в Казань."}}
+	if !researchFindingMatchesIntent(query, matched) {
+		t.Fatal("route evidence with both endpoints was rejected")
+	}
+	unrelated := epistemics.ResearchFinding{Source: epistemics.Source{Title: "Рейсы Москва — Казань", Locator: "https://example.test/moscow-kazan"}, Excerpt: epistemics.SourceExcerpt{Text: "Рейсы Москва — Казань — Ближайшие к Казани города; цена указана ориентировочно."}}
+	if researchFindingMatchesIntent(query, unrelated) {
+		t.Fatal("one-ended travel evidence was accepted")
+	}
+}
+
+func TestTicketReplyRejectsGenericCategoryPageWithoutDestination(t *testing.T) {
+	query := "найди билеты до Ялты сегодня"
+	generic := epistemics.ResearchFinding{Source: epistemics.Source{Title: "Купить билеты", Locator: "https://tickets.example"}, Excerpt: epistemics.SourceExcerpt{Text: "Поиск авиабилетов среди множества направлений."}}
+	if researchFindingMatchesIntent(query, generic) {
+		t.Fatal("generic ticket category was presented as destination result")
+	}
+	relevant := epistemics.ResearchFinding{Source: epistemics.Source{Title: "Билеты"}, Excerpt: epistemics.SourceExcerpt{Text: "Билеты до Ялты: варианты на сегодня."}}
+	if !researchFindingMatchesIntent(query, relevant) {
+		t.Fatal("destination-specific ticket result was rejected")
+	}
+}
+
+func TestDistanceReplyRejectsCalculatorPageWithoutDistance(t *testing.T) {
+	query := "расстояние между Москве и Сочи в километрах по прямой и по дороге"
+	calculator := epistemics.ResearchFinding{Source: epistemics.Source{Title: "Расчет расстояний"}, Excerpt: epistemics.SourceExcerpt{Text: "Калькулятор рассчитывает точное расстояние между городами."}}
+	if researchFindingMatchesIntent(query, calculator) {
+		t.Fatal("distance calculator landing page was presented without a measured distance")
+	}
+	measured := epistemics.ResearchFinding{Source: epistemics.Source{Title: "Маршрут"}, Excerpt: epistemics.SourceExcerpt{Text: "Расстояние по дороге составляет 1 620 км."}}
+	if !researchFindingMatchesIntent(query, measured) {
+		t.Fatal("measured distance evidence was rejected")
+	}
+}
+
+func TestResearchReplyRejectsGenericLandingPageForConcreteIdentifier(t *testing.T) {
+	result := epistemics.ResearchResult{Findings: []epistemics.ResearchFinding{{
+		State:   epistemics.FindingSupported,
+		Source:  epistemics.Source{Locator: "https://market.example", Title: "Интернет-магазин"},
+		Excerpt: epistemics.SourceExcerpt{Text: "Широкий ассортимент товаров и услуг."},
+	}}}
+	reply, backed := renderResearchReply("на WB бренд marka-wear", result, nil)
+	if backed || !strings.Contains(reply, "marka-wear") || strings.Contains(reply, "wildberries") || !strings.Contains(reply, "уточните написание") {
+		t.Fatalf("generic page was presented as a brand result: %q", reply)
+	}
+}
+
+func TestLocalPlaceReplyRejectsDictionaryFinding(t *testing.T) {
+	result := epistemics.ResearchResult{Findings: []epistemics.ResearchFinding{{
+		State:   epistemics.FindingSupported,
+		Source:  epistemics.Source{Locator: "https://dictionary.example", Title: "Ближайший — словарь"},
+		Excerpt: epistemics.SourceExcerpt{Text: "Ближайший — значение слова и пример употребления."},
+	}}}
+	reply, backed := renderResearchReply("места ресторан в Сочи адрес отзывы меню", result, nil)
+	if backed || !strings.Contains(reply, "Проверяемых данных") {
+		t.Fatalf("dictionary finding was presented as local place result: %q", reply)
+	}
+}
+
+func TestResearchReplyKeepsFindingContainingConcreteIdentifier(t *testing.T) {
+	result := epistemics.ResearchResult{Findings: []epistemics.ResearchFinding{{
+		State:   epistemics.FindingSupported,
+		Source:  epistemics.Source{Locator: "https://market.example/marka-wear", Title: "Marka-wear"},
+		Excerpt: epistemics.SourceExcerpt{Text: "Бренд marka-wear: товары и карточки."},
+	}}}
+	reply, backed := renderResearchReply("на WB бренд marka-wear", result, nil)
+	if !backed || !strings.Contains(strings.ToLower(reply), "marka-wear") {
+		t.Fatalf("concrete identifier finding was rejected: %q", reply)
+	}
+}
+
+func TestResearchIdentifiersExcludeSearchDate(t *testing.T) {
+	identifiers := requestedResearchIdentifiers("ближайший поезд в Петербург сегодня 26.08.2026")
+	if len(identifiers) != 0 {
+		t.Fatalf("search date was treated as a concrete identifier: %#v", identifiers)
+	}
+}
+
+func TestResearchQueryKeepsDistanceRelationBeforeSearchNormalization(t *testing.T) {
+	history := []interaction.HumanUtterance{{Content: "я сейчас в Москве"}}
+	query := interactiondomain.TravelResearchQuery("сколько километров до Сочи?", history, time.Time{})
+	query = interactiondomain.SearchQueryWithLexicon(query, interactiondomain.TaskLexicon{})
+	if query != "расстояние между Москве и Сочи в километрах по прямой и по дороге" {
+		t.Fatalf("distance query lost remembered origin: %q", query)
+	}
+}
+
+func TestResponseReviewPreservesAttemptedResearchOutcome(t *testing.T) {
+	if reviewMayReplacePlanningReply(false, false, true, false, "Уточните аэропорт.", "Пока не смог получить проверяемый ответ.") {
+		t.Fatal("review replaced an honest unbacked research outcome")
+	}
+	if !reviewMayReplacePlanningReply(false, false, true, true, "Расписание. Источник: https://example.test", "Расписание. Источник: https://example.test") {
+		t.Fatal("review should be able to improve a source-backed research outcome")
+	}
+	if reviewMayReplacePlanningReply(false, false, true, true, "Расписание без ссылки", "Расписание. Источник: https://example.test") {
+		t.Fatal("review dropped the research evidence")
+	}
+	if !reviewMayReplacePlanningReply(false, false, false, false, "Нормальный ответ", "Черновик") {
+		t.Fatal("ordinary conversation review was unexpectedly blocked")
+	}
+	if !reviewMayReplacePlanningReply(true, true, false, false, "Санкт-Петербург — город в России.", "Меня зовут Домовой. Санкт-Петербург — город в России.") {
+		t.Fatal("stable-knowledge draft must be eligible for semantic quality review")
+	}
+	// The caller must not mark a source-backed research result as immutable
+	// semantic state: it may be rewritten, but only with its evidence retained.
+	if !reviewMayReplacePlanningReply(false, false, true, true, "Из Москвы в Сочи можно добраться самолётом или поездом. Источник: https://example.test", "Сырые результаты. Источник: https://example.test") {
+		t.Fatal("source-backed research draft must be eligible for human-facing review")
+	}
+}
+
+func TestNonMutatingTextDirectiveCanUseCognitiveReply(t *testing.T) {
+	semantic := interactiondomain.SemanticResult{Interpretation: interaction.UtteranceInterpretation{SpeechAct: interaction.SpeechActDirective}}
+	if !shouldGenerateNonMutatingTextDirective(semantic, nil, work.HelpPath{}, false) {
+		t.Fatal("ordinary formatting directive was not eligible for a cognitive reply")
+	}
+	if !shouldGenerateNonMutatingTextDirective(semantic, nil, work.HelpPath{Kind: work.HelpPathCognition}, false) {
+		t.Fatal("reply-only cognition path was incorrectly rejected")
+	}
+	if shouldGenerateNonMutatingTextDirective(semantic, nil, work.HelpPath{Kind: work.HelpPathDirectCapability}, false) {
+		t.Fatal("direct capability was incorrectly replaced by a textual reply")
+	}
+	if shouldGenerateNonMutatingTextDirective(semantic, []chatRoute{{Kind: chatRouteMedia}}, work.HelpPath{}, false) {
+		t.Fatal("media route was incorrectly replaced by a textual reply")
+	}
+	if shouldGenerateNonMutatingTextDirective(semantic, nil, work.HelpPath{NeedsDurableWork: true}, false) {
+		t.Fatal("durable work was incorrectly replaced by a textual reply")
+	}
+}
+
 func TestBearerTokenRequiresBearerScheme(t *testing.T) {
 	request := httptest.NewRequest("GET", "/", nil)
 	request.Header.Set("Authorization", "Basic value")
@@ -27,6 +200,59 @@ func TestBearerTokenRequiresBearerScheme(t *testing.T) {
 	}
 }
 
+func TestLatestAssistantNameUsesNewestDurablePreference(t *testing.T) {
+	history := []interaction.HumanUtterance{
+		{Content: "я назову тебя Дед", ReceivedAtUnixMillis: 20},
+		{Content: "теперь тебя зовут Фея", ReceivedAtUnixMillis: 30},
+	}
+	if got := latestAssistantName(history); got != "Фея" {
+		t.Fatalf("latest assistant name = %q", got)
+	}
+}
+
+func TestHumanMemoryInventoryUsesNewestPreference(t *testing.T) {
+	history := []interaction.HumanUtterance{
+		{Content: "мне нравится синий цвет", ReceivedAtUnixMillis: 20},
+		{Content: "мне нравится красный цвет", ReceivedAtUnixMillis: 30},
+	}
+	got := humanMemoryInventory(history, "Фея")
+	if !strings.Contains(got, "красный") || strings.Contains(got, "синий") {
+		t.Fatalf("memory inventory did not select newest preference: %q", got)
+	}
+}
+
+func TestContainsScheduleTimeEvidence(t *testing.T) {
+	if containsScheduleTimeEvidence("расписание поездов и цена билета") {
+		t.Fatal("a price or schedule label is not a departure time")
+	}
+	if !containsScheduleTimeEvidence("Отправление в 07:45") {
+		t.Fatal("expected an explicit departure time to be recognized")
+	}
+}
+
+func TestInternetStatusQueryRecognizesConnectionChecks(t *testing.T) {
+	for _, query := range []string{"проверь, работает ли интернет", "есть доступ к сети?"} {
+		if !isInternetStatusQuery(query) {
+			t.Fatalf("connection check was not recognized: %q", query)
+		}
+	}
+	if isInternetStatusQuery("найди интернет-магазин") {
+		t.Fatal("ordinary search must not be treated as a connectivity check")
+	}
+}
+
+func TestInternetStatusReplyDoesNotLeakIncidentalSearchResults(t *testing.T) {
+	result := epistemics.ResearchResult{Findings: []epistemics.ResearchFinding{{
+		State:   epistemics.FindingSupported,
+		Source:  epistemics.Source{Locator: "https://example.test", Title: "Incidental page"},
+		Excerpt: epistemics.SourceExcerpt{Text: "A response was received."},
+	}}}
+	reply, backed := renderResearchReply("проверь, работает ли интернет", result, nil)
+	if !backed || reply != "Интернет работает: Домовой получил ответ от внешнего источника." {
+		t.Fatalf("unexpected internet status reply: %q", reply)
+	}
+}
+
 func TestCognitiveChannelQuestionUsesHumanSafeHealthReply(t *testing.T) {
 	reply := humanCognitiveChannelReply(interaction.InformationRequestCognitiveChannelStatus, interaction.SpeechActQuestion, capability.Health{State: capability.HealthAvailable, CapabilityID: "provider-secret-model"}, nil)
 	if !strings.Contains(reply, "доступен") || strings.Contains(reply, "provider-secret-model") {
@@ -34,16 +260,23 @@ func TestCognitiveChannelQuestionUsesHumanSafeHealthReply(t *testing.T) {
 	}
 }
 
+func TestCurrentModelReplyDoesNotInventProvider(t *testing.T) {
+	reply := humanCurrentCognitiveModelReply(capability.Health{State: capability.HealthDegraded, CapabilityID: "provider-secret-model"}, nil)
+	if !strings.Contains(reply, "встроенным режимом") || !strings.Contains(reply, "ограничениями") || strings.Contains(reply, "provider-secret-model") {
+		t.Fatalf("unexpected current-model reply: %q", reply)
+	}
+}
+
 func TestCognitiveConfigurationRequestDoesNotPretendToMutate(t *testing.T) {
 	reply := humanCognitiveChannelReply(interaction.InformationRequestCognitiveRecovery, interaction.SpeechActDirective, capability.Health{State: capability.HealthUnavailable}, nil)
-	if !strings.Contains(reply, "Домовой жив") || !strings.Contains(reply, "аварийн") {
+	if reply != "Канал мышления недоступен. Домовой остаётся на связи." {
 		t.Fatalf("unexpected configuration reply: %q", reply)
 	}
 }
 
 func TestCognitiveDegradedReplyKeepsDomovoyAlive(t *testing.T) {
 	reply := humanCognitiveDegradedReply("Помоги настроить локальную модель")
-	if !strings.Contains(reply, "Домовой жив") || !strings.Contains(reply, "принято") {
+	if strings.Contains(reply, "когнитивный канал") || strings.Contains(reply, "Повторю") || !strings.Contains(reply, "не выдумываю") {
 		t.Fatalf("unexpected degraded reply: %q", reply)
 	}
 }
@@ -74,11 +307,21 @@ func TestHumanCognitiveModelInventoryDoesNotExposeSecrets(t *testing.T) {
 		Provider: capability.ProviderInstance{Kind: "openai-compatible-chat-v1", CredentialRef: "secret-ref", AuthMode: capability.AuthKey, BillingMode: capability.BillingPerRequest, RequestCostMicros: &cost, Health: capability.HealthAvailable},
 		Model:    capability.ModelDescriptor{ProviderModelID: "example-model", Health: capability.HealthAvailable},
 	}}, nil)
-	if strings.Contains(text, "secret-ref") || strings.Contains(text, "25") || !strings.Contains(text, "example-model") || !strings.Contains(text, "API-ключ") {
+	if strings.Contains(text, "secret-ref") || strings.Contains(text, "25") || !strings.Contains(text, "example-model") || !strings.Contains(text, "активна") {
 		t.Fatalf("unsafe or incomplete inventory: %q", text)
 	}
 }
 
+func TestHumanCognitiveModelInventoryDeduplicatesAndPrioritizesAvailable(t *testing.T) {
+	text := humanCognitiveModelInventory([]capability.ResolvedCognitiveBinding{
+		{Binding: capability.CognitiveBinding{Activation: capability.ActivationInactive}, Provider: capability.ProviderInstance{Health: capability.HealthUnavailable}, Model: capability.ModelDescriptor{ProviderModelID: "same-model", Health: capability.HealthUnavailable}},
+		{Binding: capability.CognitiveBinding{Activation: capability.ActivationActive}, Provider: capability.ProviderInstance{Health: capability.HealthAvailable}, Model: capability.ModelDescriptor{ProviderModelID: "same-model", Health: capability.HealthAvailable}},
+	}, nil)
+	if strings.Count(text, "same-model") != 1 || !strings.Contains(text, "same-model — активна") {
+		t.Fatalf("expected one active model entry, got %q", text)
+	}
+}
+
 func TestCreatorSessionHandlerAcceptsConfiguredCredentials(t *testing.T) {
 	handler := creatorSessionHandler("recovery", "m", "password", []byte("01234567890123456789012345678901"), func() time.Time { return time.Unix(1000, 0) })
 	request := httptest.NewRequest(http.MethodPost, "/v1/creator/sessions", strings.NewReader(`{"username":"m","password":"password"}`))

cmd/creator-web/chat_test.go

@@ -40,6 +40,11 @@ func TestChatPageServedWithoutInternalIDs(t *testing.T) {
 	if !strings.Contains(body, "версия 0123456789ab") || !strings.Contains(body, "обновлено 22.08.2026 03:04 UTC") || !strings.Contains(body, "datetime=\"2026-08-22T03:04:05Z\"") {
 		t.Fatalf("/chat does not render build metadata: %q", body)
 	}
+	for _, required := range []string{"media-tools", "audio-input", "image-input", "ocr-input"} {
+		if !strings.Contains(body, required) {
+			t.Fatalf("/chat is missing multimodal control %q", required)
+		}
+	}
 	for _, path := range []string{"/", "/chat.html"} {
 		alternate := httptest.NewRecorder()
 		handler.ServeHTTP(alternate, httptest.NewRequest(http.MethodGet, path, nil))
@@ -60,6 +65,11 @@ func TestChatScriptExplainsSessionAndRuntimeFailures(t *testing.T) {
 			t.Fatalf("chat script is missing recovery message %q", required)
 		}
 	}
+	for _, required := range []string{"uploadMedia", "/api/multimodal/transcribe", "/api/multimodal/understand", "/api/multimodal/ocr"} {
+		if !strings.Contains(script, required) {
+			t.Fatalf("chat script is missing multimodal route %q", required)
+		}
+	}
 }
 
 func TestPublicSurfacesSeparateChatAndConsole(t *testing.T) {
@@ -158,14 +168,21 @@ func TestChatMessageDoesNotExposeUnverifiedQuestionAsFact(t *testing.T) {
 			_ = json.NewEncoder(w).Encode(identity.CreatorSession{ActorID: "actor-1", PrincipalID: "principal-1"})
 		case r.Method == http.MethodPost && r.URL.Path == "/v1/creator/chat/messages":
 			w.WriteHeader(http.StatusCreated)
-			_ = json.NewEncoder(w).Encode(interaction.ChatMessageResponse{ConversationID: "conversation-1", UtteranceID: "utterance-1", SpeechAct: interaction.SpeechActQuestion, NeedsCognition: true, FallbackText: "небезопасная модельная догадка"})
+			_ = json.NewEncoder(w).Encode(interaction.ChatMessageResponse{ConversationID: "conversation-1", UtteranceID: "utterance-1", SpeechAct: interaction.SpeechActQuestion, NeedsCognition: true, CapabilityHints: []capability.CapabilityKind{capability.CapabilityKindWebResearch}, FallbackText: "небезопасная модельная догадка"})
 		default:
 			t.Fatalf("unexpected core route %s %s", r.Method, r.URL.Path)
 		}
 	}))
 	defer core.Close()
 	cognitiveRuntime := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		t.Fatalf("unverified question must not reach advisory: %s %s", r.Method, r.URL.Path)
+		if r.Method != http.MethodPost || r.URL.Path != "/v1/advisories" {
+			t.Fatalf("unexpected cognitive route: %s %s", r.Method, r.URL.Path)
+		}
+		var request cognitive.GatewayAdvisoryRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Fatal(err)
+		}
+		_ = json.NewEncoder(w).Encode(cognitive.GatewayAdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: request.RequestID, AdvisoryText: "Я продолжаю искать проверяемый ответ через доступный источник.", FinishReason: cognitive.FinishCompleted})
 	}))
 	defer cognitiveRuntime.Close()
 	handler, err := newHandler(core.URL, "http://continuity", "http://commit", core.Client(), cognitiveRuntime.URL)
@@ -184,8 +201,85 @@ func TestChatMessageDoesNotExposeUnverifiedQuestionAsFact(t *testing.T) {
 	if err := json.NewDecoder(recorder.Body).Decode(&response); err != nil {
 		t.Fatal(err)
 	}
-	if response.Cognition != "verification_required" || strings.Contains(response.ReplyText, "небезопасная") || !strings.Contains(response.ReplyText, "не буду придумывать") {
-		t.Fatalf("unexpected truth-first response: %#v", response)
+	if response.Cognition != string(cognitive.FinishCompleted) || strings.Contains(response.ReplyText, "небезопасная") || !strings.Contains(response.ReplyText, "продолжаю искать") {
+		t.Fatalf("unexpected research recovery response: %#v", response)
+	}
+}
+
+func TestChatMessageUsesLocalAdvisoryForOrdinaryConversationalQuestion(t *testing.T) {
+	core := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == "/v1/creator/sessions/current":
+			_ = json.NewEncoder(w).Encode(identity.CreatorSession{ActorID: "actor-1", PrincipalID: "principal-1"})
+		case r.Method == http.MethodPost && r.URL.Path == "/v1/creator/chat/messages":
+			w.WriteHeader(http.StatusCreated)
+			_ = json.NewEncoder(w).Encode(interaction.ChatMessageResponse{ConversationID: "conversation-1", UtteranceID: "utterance-1", SpeechAct: interaction.SpeechActQuestion, NeedsCognition: true, FallbackText: "fallback"})
+		default:
+			t.Fatalf("unexpected core route %s %s", r.Method, r.URL.Path)
+		}
+	}))
+	defer core.Close()
+	cognitiveRuntime := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1/advisories" {
+			t.Fatalf("unexpected cognitive path %s", r.URL.Path)
+		}
+		var request cognitive.GatewayAdvisoryRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Fatal(err)
+		}
+		_ = json.NewEncoder(w).Encode(cognitive.GatewayAdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: request.RequestID, AdvisoryText: "Я рядом. Давай поговорим.", FinishReason: cognitive.FinishCompleted})
+	}))
+	defer cognitiveRuntime.Close()
+	handler, err := newHandler(core.URL, "http://continuity", "http://commit", core.Client(), cognitiveRuntime.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := httptest.NewRequest(http.MethodPost, "/api/chat/messages", strings.NewReader(`{"message":"Как ты?"}`))
+	request.Header.Set("Authorization", "Bearer session-token")
+	request.Header.Set("Content-Type", "application/json")
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, request)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d body=%s", recorder.Code, recorder.Body.String())
+	}
+	var response browserChatResponse
+	if err := json.NewDecoder(recorder.Body).Decode(&response); err != nil {
+		t.Fatal(err)
+	}
+	if response.ReplyText != "Я рядом. Давай поговорим." || response.Cognition != string(cognitive.FinishCompleted) {
+		t.Fatalf("unexpected conversational response: %#v", response)
+	}
+}
+
+func TestChatMessagePreservesCompletedCoreAnswerInsteadOfSecondAdvisory(t *testing.T) {
+	core := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == "/v1/creator/sessions/current":
+			_ = json.NewEncoder(w).Encode(identity.CreatorSession{ActorID: "actor-1", PrincipalID: "principal-1"})
+		case r.Method == http.MethodPost && r.URL.Path == "/v1/creator/chat/messages":
+			w.WriteHeader(http.StatusCreated)
+			_ = json.NewEncoder(w).Encode(interaction.ChatMessageResponse{ConversationID: "conversation-1", UtteranceID: "utterance-1", SpeechAct: interaction.SpeechActQuestion, NeedsCognition: true, FallbackText: "fallback", PlanningReply: "Готовый ответ ядра."})
+		default:
+			t.Fatalf("unexpected core route %s %s", r.Method, r.URL.Path)
+		}
+	}))
+	defer core.Close()
+	cognitiveRuntime := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Fatal("completed core answer must not be replaced by a second advisory")
+	}))
+	defer cognitiveRuntime.Close()
+	handler, err := newHandler(core.URL, "http://continuity", "http://commit", core.Client(), cognitiveRuntime.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := httptest.NewRequest(http.MethodPost, "/api/chat/messages", strings.NewReader(`{"message":"Обычный вопрос"}`))
+	request.Header.Set("Authorization", "Bearer session-token")
+	request.Header.Set("Content-Type", "application/json")
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, request)
+	var response browserChatResponse
+	if recorder.Code != http.StatusOK || json.NewDecoder(recorder.Body).Decode(&response) != nil || response.ReplyText != "Готовый ответ ядра." {
+		t.Fatalf("unexpected browser response: status=%d body=%s", recorder.Code, recorder.Body.String())
 	}
 }
 

cmd/creator-web/main.go

@@ -13,7 +13,14 @@ func main() {
 		envOr("CORE_RUNTIME_URL", "http://core-runtime:8080"),
 		envOr("CONTINUITY_RUNTIME_URL", "http://continuity-runtime:8081"),
 		envOr("COMMIT_RUNTIME_URL", "http://commit-runtime:8082"),
-		&http.Client{Timeout: 10 * time.Second},
+		// Core chat may spend several seconds on semantic interpretation and
+		// local cognition. Keep the browser gateway alive long enough to return
+		// the completed response instead of converting a successful core 201
+		// into a misleading 502.
+		// A cold local model may need more than one short HTTP round-trip to
+		// load on CPU. Keep the browser gateway aligned with the cognition
+		// deadline instead of turning that wait into a false unavailable reply.
+		&http.Client{Timeout: 15 * time.Minute},
 		envOr("COGNITIVE_RUNTIME_URL", "http://cognitive-worker:8083"),
 		envOr("AGENT_WORKER_URL", "http://agent-worker:8090"),
 	)

cmd/creator-web/multimodal_test.go

@@ -0,0 +1,57 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/identity"
+)
+
+func TestMultimodalUploadRequiresSessionAndProxiesLocalResult(t *testing.T) {
+	core := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1/creator/sessions/current" || r.Header.Get("Authorization") != "Bearer session" {
+			t.Fatalf("unexpected session request: %s %q", r.URL.Path, r.Header.Get("Authorization"))
+		}
+		_ = json.NewEncoder(w).Encode(identity.CreatorSession{ActorID: "actor", PrincipalID: "principal"})
+	}))
+	defer core.Close()
+	cognitive := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1/multimodal/transcribe" || r.Method != http.MethodPost {
+			t.Fatalf("unexpected multimodal request: %s %s", r.Method, r.URL.Path)
+		}
+		_ = json.NewEncoder(w).Encode(capability.MultimodalResponse{Operation: capability.MultimodalTranscribe, Text: "локальный текст", Provider: "local-whisper", ObservedAt: 1})
+	}))
+	defer cognitive.Close()
+	handler, err := newHandler(core.URL, "http://continuity.invalid", "http://commit.invalid", core.Client(), cognitive.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	denied := httptest.NewRecorder()
+	handler.ServeHTTP(denied, httptest.NewRequest(http.MethodPost, "/api/multimodal/transcribe", bytes.NewReader(nil)))
+	if denied.Code != http.StatusUnauthorized {
+		t.Fatalf("unauthenticated upload status=%d", denied.Code)
+	}
+	body := &bytes.Buffer{}
+	writer := multipart.NewWriter(body)
+	part, err := writer.CreateFormFile("file", "voice.wav")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, _ = part.Write([]byte("audio"))
+	if err := writer.Close(); err != nil {
+		t.Fatal(err)
+	}
+	request := httptest.NewRequest(http.MethodPost, "/api/multimodal/transcribe", body)
+	request.Header.Set("Authorization", "Bearer session")
+	request.Header.Set("Content-Type", writer.FormDataContentType())
+	response := httptest.NewRecorder()
+	handler.ServeHTTP(response, request)
+	if response.Code != http.StatusOK || !bytes.Contains(response.Body.Bytes(), []byte("локальный текст")) {
+		t.Fatalf("status=%d body=%s", response.Code, response.Body.String())
+	}
+}

cmd/creator-web/server.go

@@ -7,7 +7,9 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"mime/multipart"
 	"net/http"
+	"net/textproto"
 	"net/url"
 	"os"
 	"strings"
@@ -26,7 +28,11 @@ import (
 const (
 	maxRequestBytes         = 8 << 10
 	maxAdvisoryRequestBytes = 20 << 10
-	maxResponseBytes        = 1 << 20
+	// Chat responses may contain a locally generated image encoded as base64.
+	// Keep the gateway limit aligned with the bounded media transport (32 MiB),
+	// otherwise a successfully generated image is incorrectly surfaced as an
+	// unavailable runtime to the human.
+	maxResponseBytes = 32 << 20
 )
 
 //go:embed static
@@ -135,6 +141,10 @@ func (g *gateway) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			g.handleChatMessage(w, r)
 			return
 		}
+		if r.Method == http.MethodPost && strings.HasPrefix(r.URL.Path, "/api/multimodal/") {
+			g.handleMultimodal(w, r)
+			return
+		}
 		if r.Method == http.MethodGet && r.URL.Path == "/api/fleet/readiness" {
 			g.handleFleetReadiness(w, r)
 			return
@@ -214,6 +224,8 @@ type browserChatResponse struct {
 	DelegationID                   string                      `json:"delegation_id"`
 	DelegationState                string                      `json:"delegation_state"`
 	ReminderScheduled              bool                        `json:"reminder_scheduled"`
+	GeneratedImageContentType      string                      `json:"generated_image_content_type,omitempty"`
+	GeneratedImageBase64           string                      `json:"generated_image_base64,omitempty"`
 }
 
 func (g *gateway) handleAdvisoryPolicy(w http.ResponseWriter, r *http.Request) {
@@ -468,11 +480,10 @@ func (g *gateway) handleChatMessage(w http.ResponseWriter, r *http.Request) {
 			saved.NeedsCognition = false
 		}
 	}
-	if saved.SpeechAct == interaction.SpeechActQuestion && saved.InformationRequestKind == "" && !saved.ResearchBacked && !saved.WorkPlanned && saved.Clarification != interaction.ClarificationRequired && !asksAttention(browserRequest.Message) {
-		reply = truthfulVerificationRequiredReply()
-		cognition = "verification_required"
-		saved.NeedsCognition = false
-	} else if saved.NeedsCognition && !saved.WorkPlanned && saved.Clarification != interaction.ClarificationRequired {
+	// Core owns the completed planning answer. The browser may ask for a local
+	// advisory only when core explicitly left the turn unanswered; otherwise a
+	// second model pass can replace a grounded result with a weaker one.
+	if saved.NeedsCognition && saved.PlanningReply == "" && !saved.WorkPlanned && saved.Clarification != interaction.ClarificationRequired {
 		cognition = "unavailable"
 		requestID, idErr := ids.New()
 		if idErr == nil {
@@ -483,7 +494,7 @@ func (g *gateway) handleChatMessage(w http.ResponseWriter, r *http.Request) {
 				status, err = g.postTrustedJSON(r, g.cognitive, "/v1/advisories", "", payload, &advisory)
 				if err == nil && status == http.StatusOK && validAdvisoryResponse(advisory, trusted) {
 					cognition = string(advisory.FinishReason)
-					if advisory.FinishReason == cognitive.FinishCompleted {
+					if advisory.FinishReason == cognitive.FinishCompleted && (strings.TrimSpace(saved.FallbackText) == "" || !isBoilerplateAdvisory(advisory.AdvisoryText)) {
 						reply = advisory.AdvisoryText
 					}
 				}
@@ -511,21 +522,38 @@ func (g *gateway) handleChatMessage(w http.ResponseWriter, r *http.Request) {
 		DelegationID:                   saved.DelegationID,
 		DelegationState:                saved.DelegationState,
 		ReminderScheduled:              saved.Reminder != nil,
+		GeneratedImageContentType:      saved.GeneratedImageContentType,
+		GeneratedImageBase64:           saved.GeneratedImageBase64,
 	})
 }
 
-func truthfulVerificationRequiredReply() string {
-	return "Я не могу сейчас подтвердить этот факт по проверенному источнику, поэтому не буду придумывать ответ. Для проверки используйте официальный сайт соответствующей службы или надёжный сервис с текущими данными; когда подключён research-маршрут, Домовой сможет проверить это сам."
+func isBoilerplateAdvisory(value string) bool {
+	normalized := strings.ToLower(strings.TrimSpace(value))
+	switch normalized {
+	case "я рядом.", "я рядом", "понял.", "понял", "принял.", "принял":
+		return true
+	default:
+		return strings.Contains(normalized, "я — домов") || strings.Contains(normalized, "я - домов") || strings.Contains(normalized, "меня зовут домов")
+	}
 }
 
 func localChatContext(saved interaction.ChatMessageResponse) []cognitive.ContextExcerpt {
-	if strings.TrimSpace(saved.ActiveProjectName) == "" {
-		return []cognitive.ContextExcerpt{}
+	assistantName := strings.TrimSpace(saved.AssistantName)
+	if assistantName == "" {
+		assistantName = "Домовой"
 	}
-	bundle, err := cognitive.CompileContext(cognitive.ContextCompileInput{
-		DataPolicy: capability.DataPolicyLocalOnly,
-		MaxBytes:   2048,
-		Candidates: []cognitive.ContextCandidate{{
+	candidates := []cognitive.ContextCandidate{{
+		Excerpt: cognitive.ContextExcerpt{
+			ID:          "assistant-identity",
+			SourceKind:  "assistant-identity-policy",
+			SourceID:    "domovoy",
+			Sensitivity: cognitive.SensitivityPublic,
+			Text:        "Ты — " + assistantName + ", локальный помощник пользователя. Отвечай от имени «" + assistantName + "». Не называй себя Qwen, Alibaba Cloud, поставщиком модели или внутренним runtime. Если спрашивают имя, скажи: «Меня зовут " + assistantName + ".» Твоя задача — понять смысл запроса, найти путь к цели и довести помощь до полезного конечного результата; не ограничивайся пересказом отказа модели.",
+		},
+		Relevance: 100,
+	}}
+	if strings.TrimSpace(saved.ActiveProjectName) != "" {
+		candidates = append(candidates, cognitive.ContextCandidate{
 			Excerpt: cognitive.ContextExcerpt{
 				ID:          cognitive.ContextExcerptID("active-project-focus"),
 				SourceKind:  "situation-active-project",
@@ -533,8 +561,13 @@ func localChatContext(saved interaction.ChatMessageResponse) []cognitive.Context
 				Sensitivity: cognitive.SensitivityPrivateAllowed,
 				Text:        "Текущий проект: " + strings.TrimSpace(saved.ActiveProjectName),
 			},
-			Relevance: 100,
-		}},
+			Relevance: 90,
+		})
+	}
+	bundle, err := cognitive.CompileContext(cognitive.ContextCompileInput{
+		DataPolicy: capability.DataPolicyLocalOnly,
+		MaxBytes:   2048,
+		Candidates: candidates,
 	})
 	if err != nil {
 		return []cognitive.ContextExcerpt{}
@@ -648,6 +681,104 @@ func (g *gateway) postTrustedJSON(r *http.Request, upstream *url.URL, path, auth
 	return response.StatusCode, nil
 }
 
+func (g *gateway) handleMultimodal(w http.ResponseWriter, r *http.Request) {
+	authorization := r.Header.Get("Authorization")
+	if authorization == "" {
+		http.Error(w, "creator session denied", http.StatusUnauthorized)
+		return
+	}
+	var session identity.CreatorSession
+	status, err := g.getTrustedJSON(r, g.core, "/v1/creator/sessions/current", "", authorization, &session)
+	if err != nil || status != http.StatusOK || session.ActorID == "" || session.PrincipalID == "" {
+		http.Error(w, "creator session denied", http.StatusUnauthorized)
+		return
+	}
+	const maxMediaBytes = 12 << 20
+	r.Body = http.MaxBytesReader(w, r.Body, maxMediaBytes)
+	if err := r.ParseMultipartForm(maxMediaBytes); err != nil {
+		http.Error(w, "media upload is too large or invalid", http.StatusRequestEntityTooLarge)
+		return
+	}
+	path := ""
+	switch r.URL.Path {
+	case "/api/multimodal/transcribe":
+		path = "/v1/multimodal/transcribe"
+	case "/api/multimodal/understand":
+		path = "/v1/multimodal/understand"
+	case "/api/multimodal/ocr":
+		path = "/v1/multimodal/ocr"
+	case "/api/multimodal/video-understand":
+		path = "/v1/multimodal/video-understand"
+	case "/api/multimodal/generate-image":
+		path = "/v1/multimodal/generate-image"
+	default:
+		http.Error(w, "multimodal route not found", http.StatusNotFound)
+		return
+	}
+	body := &bytes.Buffer{}
+	writer := multipart.NewWriter(body)
+	if r.URL.Path == "/api/multimodal/generate-image" {
+		_ = writer.WriteField("prompt", r.FormValue("prompt"))
+		_ = writer.WriteField("size", r.FormValue("size"))
+	} else {
+		if r.URL.Path == "/api/multimodal/video-understand" {
+			_ = writer.WriteField("instruction", r.FormValue("instruction"))
+		}
+		file, header, err := r.FormFile("file")
+		if err != nil {
+			http.Error(w, "media file is required", http.StatusBadRequest)
+			return
+		}
+		defer file.Close()
+		data, err := io.ReadAll(io.LimitReader(file, maxMediaBytes+1))
+		if err != nil || len(data) == 0 || len(data) > maxMediaBytes {
+			http.Error(w, "media file is invalid", http.StatusBadRequest)
+			return
+		}
+		mediaHeader := make(textproto.MIMEHeader)
+		mediaHeader.Set("Content-Disposition", fmt.Sprintf(`form-data; name="file"; filename="%s"`, strings.ReplaceAll(header.Filename, `"`, "")))
+		mediaType := header.Header.Get("Content-Type")
+		if mediaType == "" {
+			mediaType = "application/octet-stream"
+		}
+		mediaHeader.Set("Content-Type", mediaType)
+		part, err := writer.CreatePart(mediaHeader)
+		if err != nil {
+			http.Error(w, "media upload unavailable", http.StatusServiceUnavailable)
+			return
+		}
+		if _, err := part.Write(data); err != nil {
+			http.Error(w, "media upload unavailable", http.StatusServiceUnavailable)
+			return
+		}
+	}
+	if err := writer.Close(); err != nil {
+		http.Error(w, "media upload unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	target := *g.cognitive
+	target.Path = path
+	request, err := http.NewRequestWithContext(r.Context(), http.MethodPost, target.String(), body)
+	if err != nil {
+		http.Error(w, "media capability unavailable", http.StatusBadGateway)
+		return
+	}
+	request.Header.Set("Content-Type", writer.FormDataContentType())
+	response, err := g.client.Do(request)
+	if err != nil {
+		http.Error(w, "media capability unavailable", http.StatusBadGateway)
+		return
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		_, _ = io.Copy(io.Discard, io.LimitReader(response.Body, maxResponseBytes))
+		http.Error(w, "media capability unavailable", http.StatusBadGateway)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_, _ = io.Copy(w, io.LimitReader(response.Body, maxResponseBytes))
+}
+
 func decodeStrictJSON(reader io.Reader, limit int64, destination any) error {
 	decoder := json.NewDecoder(io.LimitReader(reader, limit+1))
 	decoder.DisallowUnknownFields()
@@ -710,6 +841,8 @@ func creatorRoute(method, path string) (routeTarget, string, bool) {
 		return targetCore, "/v1/creator/sessions", true
 	case method == http.MethodGet && path == "/api/session/current":
 		return targetCore, "/v1/creator/sessions/current", true
+	case method == http.MethodPost && path == "/api/account/password":
+		return targetCore, "/v1/creator/account/password", true
 	case method == http.MethodGet && path == "/api/focus":
 		return targetCore, "/v1/creator/focus", true
 	case method == http.MethodGet && strings.HasPrefix(path, "/api/tasks/"):

cmd/creator-web/server_test.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -13,13 +14,43 @@ import (
 	"git.cin.su/m/Assistant/contracts/interaction"
 )
 
-func TestLocalChatContextUsesOnlyActiveProject(t *testing.T) {
-	context := localChatContext(interaction.ChatMessageResponse{ActiveProjectName: "Домовой"})
-	if len(context) != 1 || context[0].SourceKind != "situation-active-project" || context[0].Text != "Текущий проект: Домовой" {
+func TestMaxResponseBytesAcceptsGeneratedImagePayload(t *testing.T) {
+	// A 1024px PNG can exceed the former 1 MiB gateway limit once base64
+	// encoded. The browser gateway must forward that successful core response.
+	payload, err := json.Marshal(interaction.ChatMessageResponse{
+		GeneratedImageContentType: "image/png",
+		GeneratedImageBase64:      strings.Repeat("A", 2<<20),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var decoded interaction.ChatMessageResponse
+	if err := decodeStrictJSON(bytes.NewReader(payload), maxResponseBytes, &decoded); err != nil {
+		t.Fatalf("generated image response must fit gateway limit: %v", err)
+	}
+	if len(decoded.GeneratedImageBase64) != 2<<20 {
+		t.Fatalf("generated image payload was truncated: %d", len(decoded.GeneratedImageBase64))
+	}
+}
+
+func TestLocalChatContextIncludesDomovoyIdentityAndOptionalActiveProject(t *testing.T) {
+	context := localChatContext(interaction.ChatMessageResponse{AssistantName: "Фея", ActiveProjectName: "Домовой"})
+	if len(context) != 2 || context[0].SourceID != "domovoy" || !strings.Contains(context[0].Text, "Ты — Фея") || !strings.Contains(context[0].Text, "Меня зовут Фея") || context[1].Text != "Текущий проект: Домовой" {
 		t.Fatalf("unexpected local context: %#v", context)
 	}
-	if empty := localChatContext(interaction.ChatMessageResponse{}); len(empty) != 0 {
-		t.Fatalf("expected empty context without active project: %#v", empty)
+	if empty := localChatContext(interaction.ChatMessageResponse{}); len(empty) != 1 || empty[0].SourceID != "domovoy" {
+		t.Fatalf("identity context must remain available without active project: %#v", empty)
+	}
+}
+
+func TestBoilerplateAdvisoryDoesNotReplaceUsefulFallback(t *testing.T) {
+	for _, value := range []string{"Я рядом", "Понял.", "Принял.", "Я — Домовой, ваш помощник."} {
+		if !isBoilerplateAdvisory(value) {
+			t.Fatalf("%q was not recognized as boilerplate", value)
+		}
+	}
+	if isBoilerplateAdvisory("Жили-были дед и баба.") {
+		t.Fatal("useful creative reply was treated as boilerplate")
 	}
 }
 

cmd/creator-web/static/assets/chat.css

@@ -1,126 +1,285 @@
 :root {
-  --ink: #e9eee7;
-  --muted: #93a096;
-  --base: #0b100e;
-  --panel: #101714;
-  --line: #2a352f;
-  --signal: #c9a85f;
-  --bad: #de816f;
-  --good: #78c6a3;
-  --radius: 3px;
-  --sans: "Bahnschrift", "Aptos Narrow", "Segoe UI", sans-serif;
-  --serif: Georgia, "Times New Roman", serif;
-  --mono: "Cascadia Mono", Consolas, monospace;
+  --ink: #e6edf4;
+  --muted: #8494a4;
+  --faint: #5d6e7f;
+  --base: #0b1119;
+  --panel: #111b27;
+  --panel-raised: #172331;
+  --panel-soft: #0f1925;
+  --line: #263544;
+  --line-strong: #34485c;
+  --lime: #c5ef91;
+  --lime-ink: #142014;
+  --blue: #8fc7ef;
+  --yellow: #d8b86c;
+  --good: #8ed7ad;
+  --bad: #ee9292;
+  --radius: 8px;
+  --sans: "Manrope", "Segoe UI", sans-serif;
+  --mono: "DM Mono", "Cascadia Mono", Consolas, monospace;
 }
-
 * { box-sizing: border-box; }
 [hidden] { display: none !important; }
 body { margin: 0; min-width: 320px; min-height: 100vh; color: var(--ink); background: var(--base); font-family: var(--sans); }
 button, input, textarea { font: inherit; }
 button { cursor: pointer; color: inherit; border-radius: var(--radius); }
+a { color: inherit; }
 .chat-shell { min-height: 100vh; display: grid; }
-.login-panel { width: min(100% - 32px, 420px); margin: auto; padding: 46px 40px; border: 1px solid var(--line); background: var(--panel); }
-.brand-mark { width: 46px; height: 46px; display: grid; place-items: center; color: var(--base); background: var(--signal); font: 700 24px/1 var(--serif); clip-path: polygon(50% 0, 92% 22%, 92% 76%, 50% 100%, 8% 76%, 8% 22%); }
-h1 { margin: 30px 0; font: 400 58px/.95 var(--serif); letter-spacing: -.02em; }
-label { display: block; margin: 16px 0 8px; color: var(--muted); font: 600 10px/1 var(--mono); letter-spacing: .12em; text-transform: uppercase; }
-input, textarea { width: 100%; border: 1px solid var(--line); border-radius: var(--radius); color: var(--ink); background: #0b110e; }
-input { height: 48px; padding: 0 12px; }
-textarea { resize: vertical; min-height: 84px; max-height: 240px; padding: 14px; line-height: 1.45; }
-.login-form button, .composer button { border: 0; color: #11150f; background: var(--signal); font-weight: 700; }
-.login-form button { width: 100%; height: 50px; margin-top: 18px; }
+.login-panel { width: min(100% - 32px, 420px); margin: auto; padding: 40px; border: 1px solid var(--line); border-radius: 12px; background: var(--panel); box-shadow: 0 24px 80px rgba(0,0,0,.28); }
+.brand-mark { width: 42px; height: 42px; display: grid; place-items: center; color: var(--lime-ink); background: var(--lime); border-radius: 10px; font: 700 22px/1 var(--sans); }
+h1, h2 { margin: 0; letter-spacing: -.03em; }
+.login-panel h1 { margin: 26px 0; font-size: 42px; font-weight: 650; }
+label { display: block; margin: 16px 0 8px; color: var(--muted); font: 600 10px/1 var(--mono); letter-spacing: .1em; text-transform: uppercase; }
+input, textarea { width: 100%; border: 1px solid var(--line); border-radius: var(--radius); color: var(--ink); background: var(--panel-soft); outline: none; }
+input:focus, textarea:focus { border-color: var(--blue); box-shadow: 0 0 0 3px rgba(143,199,239,.12); }
+input { height: 46px; padding: 0 12px; }
+textarea { resize: vertical; min-height: 84px; max-height: 240px; padding: 13px; line-height: 1.45; }
+.login-form button, .composer button { border: 0; color: var(--lime-ink); background: var(--lime); font-weight: 750; }
+.login-form button { width: 100%; height: 46px; margin-top: 18px; }
 #login-error { min-height: 20px; color: var(--bad); font-size: 13px; }
-.chat-view { width: 100%; min-width: 0; height: 100vh; min-height: 0; display: grid; grid-template-rows: 64px minmax(0, 1fr); overflow: hidden; }
-.chat-header { min-width: 0; display: flex; align-items: center; gap: 14px; padding: 0 22px; border-bottom: 1px solid var(--line); background: rgba(16, 23, 20, .98); }
-.chat-header a { color: var(--ink); text-decoration: none; font: 400 24px/1 var(--serif); }
-#active-focus { color: var(--good); }
+.chat-view { width: 100%; min-width: 0; height: 100vh; min-height: 0; display: grid; grid-template-rows: 60px minmax(0, 1fr); overflow: hidden; }
+.chat-header { min-width: 0; display: flex; align-items: center; gap: 14px; padding: 0 20px; border-bottom: 1px solid var(--line); background: rgba(17,27,39,.97); }
+.chat-header > a:first-child { color: var(--ink); text-decoration: none; font-size: 18px; font-weight: 750; letter-spacing: -.02em; }
 .cognitive-status { display: inline-flex; align-items: center; gap: 7px; white-space: nowrap; }
-.chat-header .cognitive-status { width: auto; height: auto; padding: 0; border: 0; background: transparent; color: var(--muted); font: 10px/1 var(--mono); letter-spacing: .1em; text-transform: uppercase; }
-.chat-header .cognitive-status { max-width: min(30vw, 320px); margin-left: auto; overflow: hidden; text-overflow: ellipsis; }
-.cognitive-status::before { content: ""; width: 7px; height: 7px; flex: 0 0 7px; border-radius: 50%; background: var(--signal); }
+.chat-header .cognitive-status { width: auto; height: auto; max-width: min(30vw, 340px); margin-left: auto; padding: 0; overflow: hidden; border: 0; background: transparent; color: var(--muted); font: 10px/1 var(--mono); letter-spacing: .04em; text-overflow: ellipsis; text-transform: uppercase; }
+.cognitive-status::before { content: ""; width: 7px; height: 7px; flex: 0 0 7px; border-radius: 50%; background: var(--yellow); }
 .cognitive-status[data-state="available"] { color: var(--good); }
 .cognitive-status[data-state="available"]::before { background: var(--good); }
 .cognitive-status[data-state="unavailable"] { color: var(--bad); }
 .cognitive-status[data-state="unavailable"]::before { background: var(--bad); }
-.cognitive-console-link { color: var(--signal); font: 10px/1 var(--mono); letter-spacing: .08em; text-transform: uppercase; white-space: nowrap; }
-.build-meta { display: grid; gap: 3px; flex: 0 0 auto; color: var(--muted); font: 9px/1 var(--mono); letter-spacing: .08em; text-align: right; text-transform: uppercase; white-space: nowrap; }
-.build-meta time { color: #68776d; font-size: 8px; }
-.chat-header button { width: 38px; height: 38px; border: 1px solid var(--line); background: transparent; }
-.human-nav { display: grid; gap: 8px; }
-.nav-tab, .operator-link { height: 34px; padding: 0 12px; display: inline-flex; align-items: center; border: 1px solid var(--line); color: var(--muted); background: #0b110e; text-decoration: none; font: 11px/1 var(--mono); text-transform: uppercase; letter-spacing: .08em; }
-.chat-left .nav-tab { height: auto; min-height: 58px; padding: 10px 12px; display: grid; grid-template-columns: 28px 1fr; gap: 2px 8px; align-items: center; text-align: left; }
-.chat-left .nav-tab b { grid-row: span 2; color: var(--signal); font: 11px/1 var(--mono); }
-.chat-left .nav-tab span { color: var(--ink); font: 600 13px/1 var(--sans); text-transform: none; letter-spacing: 0; }
-.chat-left .nav-tab small { color: var(--muted); font: 10px/1 var(--mono); text-transform: none; letter-spacing: 0; }
-.nav-tab.active { color: #11150f; border-color: var(--signal); background: var(--signal); }
-.operator-link { color: var(--good); }
-.chat-header > .operator-link { flex: 0 0 auto; }
-.chat-layout { min-height: 0; height: 100%; display: grid; grid-template-columns: minmax(220px, 280px) minmax(0, 1fr) minmax(250px, 320px); }
-.chat-side { min-width: 0; min-height: 0; padding: 28px 20px; overflow-y: auto; background: #0e1512; }
+.cognitive-console-link { color: var(--blue); font: 10px/1 var(--mono); letter-spacing: .04em; white-space: nowrap; }
+.build-meta { display: grid; gap: 3px; flex: 0 0 auto; color: var(--muted); font: 9px/1 var(--mono); letter-spacing: .04em; text-align: right; text-transform: uppercase; white-space: nowrap; }
+.build-meta time { color: var(--faint); font-size: 8px; }
+.chat-header button { width: 34px; height: 34px; border: 1px solid var(--line); background: transparent; }
+.operator-link { height: 32px; padding: 0 11px; display: inline-flex; align-items: center; border: 1px solid var(--line); color: var(--blue); background: transparent; text-decoration: none; font: 10px/1 var(--mono); letter-spacing: .04em; text-transform: uppercase; }
+.chat-layout { min-height: 0; height: 100%; display: grid; grid-template-columns: minmax(220px, 258px) minmax(0, 1fr) minmax(270px, 320px); }
+.chat-side { min-width: 0; min-height: 0; padding: 22px 18px; overflow-y: auto; background: var(--panel); scrollbar-color: var(--line-strong) transparent; }
 .chat-left { border-right: 1px solid var(--line); }
 .chat-right { border-left: 1px solid var(--line); }
-.side-intro h1, .side-intro h2 { margin: 12px 0; font: 400 clamp(28px, 2.5vw, 40px)/.95 var(--serif); letter-spacing: -.03em; }
-.side-intro p:not(.side-index) { color: var(--muted); line-height: 1.5; }
-.side-index, .side-focus span, .side-note span, .ai-info-card span { color: var(--signal); font: 10px/1 var(--mono); letter-spacing: .12em; text-transform: uppercase; }
-.side-focus, .side-note, .ai-info-card { margin-top: 28px; padding: 14px 0; border-top: 1px solid var(--line); border-bottom: 1px solid var(--line); }
-.side-focus strong, .side-note strong, .ai-info-card strong { display: block; margin-top: 9px; color: var(--ink); font: 600 14px/1.3 var(--sans); }
-.side-note small, .ai-info-card p, .ai-data-form small { display: block; margin-top: 9px; color: var(--muted); line-height: 1.45; }
-.chat-main { min-width: 0; min-height: 0; overflow: hidden; display: grid; }
+.side-intro h1, .side-intro h2 { margin: 9px 0 10px; font-size: clamp(25px, 2.4vw, 34px); line-height: 1.05; font-weight: 680; }
+.side-intro p:not(.side-index) { margin: 0; color: var(--muted); font-size: 12px; line-height: 1.5; }
+.side-index, .section-label, .ai-info-card span, .insight-card span { color: var(--faint); font: 600 9px/1 var(--mono); letter-spacing: .12em; text-transform: uppercase; }
+.side-section, .side-note, .ai-info-card { margin-top: 20px; padding: 13px 0; border-top: 1px solid var(--line); }
+.side-focus strong, .side-note strong { display: block; margin-top: 8px; color: var(--blue); font-size: 13px; font-weight: 650; line-height: 1.35; }
+.side-note { border-bottom: 0; }
+.side-note strong { color: var(--good); }
+.side-note small, .ai-info-card p, .ai-data-form small { display: block; margin-top: 8px; color: var(--muted); font-size: 11px; line-height: 1.45; }
+.context-list { display: flex; flex-wrap: wrap; gap: 6px; margin-top: 10px; }
+.context-list span { padding: 5px 8px; border: 1px solid var(--line); border-radius: 6px; color: var(--muted); font-size: 11px; }
+.quick-context { padding-bottom: 3px; }
+.human-nav { display: grid; gap: 6px; margin-top: 8px; }
+.nav-tab { width: 100%; min-height: 50px; padding: 8px 10px; display: grid; grid-template-columns: 26px 1fr; gap: 2px 7px; align-items: center; border: 1px solid transparent; color: var(--muted); background: transparent; text-align: left; }
+.chat-left .nav-tab b { grid-row: span 2; color: var(--faint); font: 10px/1 var(--mono); }
+.chat-left .nav-tab span { color: var(--ink); font-size: 12px; font-weight: 650; }
+.chat-left .nav-tab small { color: var(--faint); font: 10px/1 var(--mono); }
+.nav-tab:hover, .nav-tab:focus-visible { border-color: var(--line-strong); outline: none; }
+.nav-tab.active { border-color: rgba(197,239,145,.42); background: rgba(197,239,145,.1); }
+.nav-tab.active b { color: var(--lime); }
+.quiet-state { margin: 9px 0 0; color: var(--faint); font-size: 11px; }
+.new-conversation { width: 100%; min-height: 34px; margin-top: 9px; border: 1px solid var(--line-strong); color: var(--ink); background: transparent; font-size: 11px; }
+.new-conversation:hover, .new-conversation:focus-visible { border-color: var(--lime); color: var(--lime); outline: none; }
+.side-build { margin-top: 14px; padding-top: 14px; text-align: left; }
+.chat-main { min-width: 0; min-height: 0; overflow: hidden; display: grid; background: var(--base); }
 .surface-panel { min-height: 0; position: relative; overflow-y: auto; }
 .active-panel { display: grid; grid-template-rows: minmax(0, 1fr) auto auto; min-height: 0; }
-.messages { width: min(100%, 920px); min-height: 0; margin: 0 auto; padding: 28px 18px; display: flex; flex-direction: column; gap: 14px; overflow-y: auto; }
-.message { max-width: min(720px, 92%); padding: 14px 16px; border: 1px solid var(--line); border-radius: var(--radius); line-height: 1.45; white-space: pre-wrap; }
-.message.user { align-self: flex-end; background: #151e1a; }
-.message.assistant { align-self: flex-start; background: #0f1613; }
-.message small { display: block; margin-top: 8px; color: var(--muted); font: 10px/1 var(--mono); text-transform: uppercase; }
-.composer { width: min(100%, 920px); margin: 0 auto; padding: 16px 18px 10px; display: grid; grid-template-columns: minmax(0, 1fr) 130px; gap: 12px; background: linear-gradient(transparent, var(--base) 20%); }
-.composer button { height: 48px; align-self: end; }
-.composer button:disabled { cursor: wait; filter: saturate(.3); }
-.conversation-starters { width: min(100%, 920px); margin: -4px auto 0; padding: 0 18px 18px; display: flex; flex-wrap: wrap; align-items: center; gap: 8px; color: var(--muted); font: 10px/1 var(--mono); letter-spacing: .06em; text-transform: uppercase; }
-.conversation-starters button { min-height: 32px; padding: 0 10px; border: 1px solid var(--line); color: var(--ink); background: #101814; font: 10px/1 var(--mono); }
-.conversation-starters button:hover, .conversation-starters button:focus-visible { border-color: var(--signal); color: var(--signal); outline: none; }
-.ai-data-form { margin-top: 24px; }
-.ai-data-form textarea { min-height: 150px; resize: vertical; }
-.ai-data-form button { width: 100%; min-height: 42px; margin-top: 12px; border: 0; color: #11150f; background: var(--signal); font-weight: 700; }
-.ai-data-error { margin: 10px 0 0; color: var(--bad); font-size: 12px; line-height: 1.4; }
-.side-console-link { display: flex; justify-content: space-between; margin-top: 26px; padding-top: 16px; border-top: 1px solid var(--line); color: var(--signal) !important; font: 11px/1.3 var(--mono) !important; text-transform: uppercase; letter-spacing: .06em; }
-.attention-surface, .history-surface { width: min(100%, 920px); margin: 0 auto; padding: 34px 18px; align-content: start; gap: 18px; }
-.surface-heading { display: flex; align-items: end; justify-content: space-between; gap: 16px; border-bottom: 1px solid var(--line); padding-bottom: 16px; }
-.surface-heading p { margin: 0; font: 400 36px/.95 var(--serif); }
-.surface-heading span, .attention-card small, .history-item span { color: var(--muted); font: 10px/1 var(--mono); text-transform: uppercase; letter-spacing: .1em; }
-.surface-heading button { height: 36px; padding: 0 12px; border: 1px solid var(--line); background: transparent; }
-.attention-list, .history-list { display: grid; gap: 12px; }
-.attention-card, .history-item { border: 1px solid var(--line); background: #0f1613; padding: 16px; }
-.attention-card time { color: var(--signal); font: 12px/1 var(--mono); }
-.attention-card h2 { margin: 10px 0 8px; font: 400 24px/1.1 var(--serif); }
-.attention-card p, .history-item p { margin: 0 0 10px; color: var(--ink); line-height: 1.45; }
-.attention-actions { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 14px; }
-.attention-actions button { height: 34px; padding: 0 12px; border: 1px solid var(--line); background: #151e1a; color: var(--ink); font: 11px/1 var(--mono); text-transform: uppercase; letter-spacing: .08em; }
-.attention-actions button:first-child { border-color: var(--good); color: var(--good); }
-.history-item.user { border-color: #34443c; background: #151e1a; }
-.history-item strong { display: block; margin-bottom: 8px; color: var(--signal); }
-.empty-state { margin: 24px 0 0; color: var(--muted); }
+.messages { width: min(100%, 900px); min-height: 0; margin: 0 auto; padding: clamp(24px, 5vh, 52px) 22px 20px; display: flex; flex-direction: column; gap: 10px; overflow-y: auto; scrollbar-color: var(--line-strong) transparent; }
+.message { max-width: min(700px, 92%); padding: 11px 14px 12px; border: 1px solid var(--line); border-radius: 10px; line-height: 1.5; }
+.message.user { align-self: flex-end; background: #162231; border-color: #30465b; }
+.message.assistant { align-self: flex-start; background: #121d2a; }
+.message-head { display: flex; align-items: baseline; gap: 8px; margin-bottom: 6px; }
+.message-role { color: var(--blue); font: 650 9px/1 var(--mono); letter-spacing: .08em; text-transform: uppercase; }
+.message.user .message-role { color: var(--lime); }
+.message-time { color: var(--faint); font: 9px/1 var(--mono); }
+.message-content { white-space: pre-wrap; overflow-wrap: anywhere; font-size: 13px; }
+.message small { display: block; margin-top: 8px; color: var(--faint); font: 9px/1.2 var(--mono); letter-spacing: .03em; text-transform: none; }
+.composer { width: min(100%, 900px); margin: 0 auto; padding: 10px 22px 7px; display: grid; grid-template-columns: minmax(0, 1fr) 106px; gap: 9px; border-top: 1px solid var(--line); background: var(--base); }
+.composer-input-wrap { min-width: 0; border: 1px solid var(--line-strong); border-radius: 9px; background: var(--panel-soft); transition: border-color .15s ease, box-shadow .15s ease; }
+.composer-input-wrap:focus-within { border-color: var(--blue); box-shadow: 0 0 0 3px rgba(143,199,239,.1); }
+.composer textarea { min-height: 46px; max-height: 200px; resize: none; border: 0; background: transparent; }
+.composer-hint { display: flex; justify-content: space-between; gap: 12px; padding: 0 12px 7px; color: var(--faint); font: 9px/1 var(--mono); }
+.composer-hint output { color: var(--muted); white-space: nowrap; }
+.composer button { height: 46px; align-self: end; display: inline-flex; align-items: center; justify-content: space-between; gap: 7px; padding: 0 13px; }
+.composer button[aria-busy="true"] { color: #384529; background: #a6ca7a; }
+.composer button span:last-child { opacity: .65; font: 15px/1 var(--mono); }
+.composer button:disabled { cursor: wait; filter: saturate(.35); }
+.media-tools { width: min(100%, 900px); margin: 0 auto; padding: 0 22px 9px; display: flex; flex-wrap: wrap; align-items: center; gap: 6px; color: var(--muted); font: 9px/1 var(--mono); letter-spacing: .03em; text-transform: uppercase; }
+.media-tools label { display: inline-flex; align-items: center; gap: 5px; min-height: 28px; margin: 0; padding: 0 7px; border: 1px solid var(--line); border-radius: 6px; color: var(--muted); cursor: pointer; }
+.media-tools input { max-width: 125px; font: 9px var(--mono); }
+.media-tools span { color: var(--yellow); }
+.insight-grid { display: grid; gap: 7px; margin-top: 19px; }
+.insight-card { padding: 11px; border: 1px solid var(--line); border-radius: 8px; background: var(--panel-soft); }
+.insight-card strong { display: block; margin-top: 7px; color: var(--ink); font-size: 12px; font-weight: 650; line-height: 1.3; }
+.insight-card small { display: block; margin-top: 5px; color: var(--faint); font-size: 10px; line-height: 1.35; }
+.ai-info-card { padding-bottom: 0; }
+.ai-info-card strong { display: block; margin-top: 8px; font-size: 12px; }
+.ai-data-form { margin-top: 18px; }
+.ai-data-form textarea { min-height: 126px; }
+.ai-data-form button { width: 100%; min-height: 38px; margin-top: 9px; border: 1px solid rgba(197,239,145,.3); border-radius: 7px; color: var(--lime); background: rgba(197,239,145,.1); font-size: 11px; font-weight: 700; }
+.ai-data-form button:hover { background: rgba(197,239,145,.16); }
+.ai-data-error { margin: 9px 0 0; color: var(--bad); font-size: 11px; line-height: 1.4; }
+.side-console-link { display: flex; justify-content: space-between; margin-top: 20px; padding-top: 13px; border-top: 1px solid var(--line); color: var(--blue) !important; font: 10px/1.3 var(--mono) !important; text-decoration: none; letter-spacing: .03em; text-transform: uppercase; }
+.attention-surface, .history-surface { width: min(100%, 900px); margin: 0 auto; padding: 28px 22px; align-content: start; gap: 15px; }
+.surface-heading { display: flex; align-items: end; justify-content: space-between; gap: 16px; border-bottom: 1px solid var(--line); padding-bottom: 13px; }
+.surface-heading p { margin: 0; font-size: 27px; font-weight: 680; }
+.surface-heading span, .attention-card small, .history-item span { color: var(--muted); font: 9px/1 var(--mono); text-transform: uppercase; letter-spacing: .08em; }
+.surface-heading button { height: 31px; padding: 0 10px; border: 1px solid var(--line); background: transparent; font-size: 11px; }
+.attention-list, .history-list { display: grid; gap: 9px; }
+.attention-card, .history-item { border: 1px solid var(--line); border-radius: 8px; background: var(--panel); padding: 13px; }
+.attention-card time { color: var(--yellow); font: 10px/1 var(--mono); }
+.attention-card h2 { margin: 8px 0 6px; font-size: 18px; font-weight: 650; }
+.attention-card p, .history-item p { margin: 0 0 8px; color: var(--ink); font-size: 12px; line-height: 1.5; }
+.attention-actions { display: flex; flex-wrap: wrap; gap: 6px; margin-top: 11px; }
+.attention-actions button { height: 30px; padding: 0 10px; border: 1px solid var(--line); background: var(--panel-raised); color: var(--ink); font: 10px/1 var(--mono); }
+.attention-actions button:first-child { border-color: rgba(142,215,173,.5); color: var(--good); }
+.history-item.user { border-color: #30465b; background: #162231; }
+.history-item strong { display: block; margin-bottom: 6px; color: var(--blue); font-size: 12px; }
+.empty-state { margin: 20px 0 0; color: var(--muted); font-size: 12px; }
 .empty-state.error { color: var(--bad); }
-@media (max-width: 640px) {
+@media (max-width: 780px) {
   .chat-view { height: auto; min-height: 100vh; overflow: visible; display: block; }
-  .composer { grid-template-columns: 1fr; }
+  .chat-header { position: sticky; top: 0; z-index: 3; min-height: 58px; padding: 0 12px; }
+  .chat-header .cognitive-status { flex: 1 1 100px; min-width: 0; max-width: 150px; }
+  .chat-header .cognitive-console-link, .chat-header > .operator-link, .chat-header .build-meta { display: none; }
+  .chat-header > #logout { flex: 0 0 34px; }
+  .chat-layout { height: auto; display: flex; flex-direction: column; }
+  .chat-main { order: 1; height: 72vh; min-height: 530px; }
+  .chat-side { min-height: auto; max-height: none; overflow: visible; }
+  .chat-left { order: 2; border: 0; border-top: 1px solid var(--line); }
+  .chat-right { order: 3; border: 0; border-top: 1px solid var(--line); }
+  .messages { padding-inline: 12px; }
+  .composer { grid-template-columns: 1fr; padding-inline: 12px; }
   .composer button { width: 100%; }
-  .conversation-starters { align-items: stretch; }
-  .conversation-starters span { width: 100%; }
-  .chat-header { gap: 10px; padding: 0 12px; }
-  .chat-header .cognitive-status { display: inline-flex; flex: 1 1 110px; min-width: 0; max-width: 110px; overflow: hidden; text-overflow: ellipsis; }
-  .chat-header .cognitive-console-link { flex: 0 1 110px; min-width: 0; overflow: hidden; text-overflow: ellipsis; }
-  .chat-header > .operator-link, .build-meta { display: none; }
-  .chat-header > #logout { flex: 0 0 38px; }
+  .composer-hint { font-size: 8px; }
+  .media-tools { padding-inline: 12px; }
+  .side-build { display: none; }
+}
+@media (max-width: 640px) {
   .chat-layout { height: auto; display: block; }
-  .chat-side, .chat-main { min-height: auto; max-height: none; overflow: visible; }
-  .chat-left, .chat-right { border: 0; border-bottom: 1px solid var(--line); }
-  .chat-main { height: 70vh; min-height: 520px; }
-  .chat-left { padding-bottom: 20px; }
-  .chat-right { padding-top: 20px; }
-  .operator-link, .nav-tab { padding: 0 9px; }
+  .chat-header > .operator-link, .build-meta { display: none; }
+  .chat-header .cognitive-console-link { flex: 0 1 110px; min-width: 0; overflow: hidden; text-overflow: ellipsis; }
 }
-@media (min-width: 641px) and (max-width: 1100px) {
-  .chat-layout { grid-template-columns: 210px minmax(0, 1fr) 245px; }
+@media (min-width: 781px) and (max-width: 1100px) {
+  .chat-layout { grid-template-columns: 218px minmax(0, 1fr) 260px; }
   .chat-side { padding-inline: 14px; }
-  .side-intro h1, .side-intro h2 { font-size: 30px; }
+}
+
+/* Chat-first pass: navigation and context stay out of the conversation's way. */
+.chat-header { gap: 10px; padding-inline: 18px; }
+.header-icon, .header-control, .profile-button { height: 32px; border: 1px solid var(--line); background: transparent; font: 10px/1 var(--mono); }
+.header-icon { width: 32px; padding: 0; color: var(--muted); font-size: 15px; }
+.header-control, .profile-button { padding: 0 10px; color: var(--muted); }
+.header-control { color: var(--ink); }
+.header-icon:hover, .header-icon:focus-visible, .header-control:hover, .header-control:focus-visible, .profile-button:hover, .profile-button:focus-visible { border-color: var(--blue); color: var(--blue); outline: none; }
+.header-focus { min-width: 0; overflow: hidden; color: var(--muted); font-size: 12px; text-overflow: ellipsis; white-space: nowrap; }
+.chat-header .cognitive-status { margin-left: auto; max-width: 250px; }
+.chat-header .cognitive-console-link { display: none; }
+.chat-layout { grid-template-columns: 242px minmax(0, 1fr); }
+.chat-layout.nav-collapsed { grid-template-columns: 0 minmax(0, 1fr); }
+.chat-left { padding: 24px 16px; transition: opacity .18s ease, padding .18s ease, transform .18s ease; }
+.chat-layout.nav-collapsed .chat-left { padding-inline: 0; overflow: hidden; opacity: 0; border-right: 0; }
+.side-intro h1 { font-size: 26px; }
+.side-section { margin-top: 18px; }
+.human-nav { margin-top: 12px; }
+.nav-tab { grid-template-columns: 1fr; min-height: 44px; padding-inline: 10px; }
+.chat-left .nav-tab b { display: none; }
+.new-conversation { margin-top: 16px; }
+.chat-main { min-width: 0; }
+.messages { width: min(100%, 1040px); padding: 32px 30px 22px; gap: 14px; }
+.message { max-width: min(760px, 88%); padding: 14px 17px 15px; border-radius: 12px; }
+.message-content { font-size: 15px; line-height: 1.55; }
+.message-role { font-size: 10px; }
+.message-time { font-size: 10px; }
+.message small { font-size: 10px; }
+.composer { width: min(100%, 1040px); padding-inline: 30px; }
+.composer-input-wrap { min-height: 64px; padding: 0 12px 36px; border-radius: 14px; }
+.composer textarea { min-height: 56px; max-height: 180px; padding: 13px 0 8px; font-size: 15px; }
+.composer-actions { right: 9px; bottom: 8px; left: 9px; height: 28px; }
+.composer-tool { width: 29px; height: 29px; padding: 0; border: 0; color: var(--muted); background: transparent !important; }
+.composer-tool svg { width: 18px; height: 18px; fill: none; stroke: currentColor; stroke-linecap: round; stroke-linejoin: round; stroke-width: 1.8; }
+.composer-tool:hover, .composer-tool:focus-visible { border: 0; color: var(--blue); box-shadow: none; }
+.composer-hint { font-size: 10px; }
+.send-button { width: 33px; height: 33px; flex-basis: 33px; }
+.composer-runtime { height: 0; min-height: 0; padding: 0; overflow: visible; }
+.attachment-menu { bottom: 42px; left: 8px; }
+.context-indicator { display: none; }
+.technical-meta { display: none !important; }
+.context-backdrop { position: fixed; z-index: 8; inset: 60px 0 0; border: 0; background: rgba(4,9,15,.58); }
+.context-drawer { position: fixed; z-index: 9; top: 60px; right: 0; bottom: 0; width: min(360px, 92vw); padding: 24px 20px; border-left: 1px solid var(--line-strong); box-shadow: -20px 0 50px rgba(0,0,0,.28); transform: translateX(105%); transition: transform .2s ease; }
+.password-dialog { width: min(420px, calc(100vw - 32px)); padding: 0; color: var(--ink); background: var(--panel); border: 1px solid var(--line-strong); border-radius: var(--radius); box-shadow: 0 24px 80px rgba(0,0,0,.45); }
+.password-dialog::backdrop { background: rgba(3,8,14,.68); }
+.password-dialog form { padding: 22px; }
+.dialog-heading { display: flex; align-items: center; justify-content: space-between; gap: 16px; margin-bottom: 20px; }
+.dialog-heading h2 { margin: 0; font-size: 20px; }
+.dialog-heading button { width: 30px; height: 30px; border: 1px solid var(--line); background: transparent; }
+.password-dialog label { display: block; margin: 14px 0 7px; color: var(--muted); font: 11px/1 var(--mono); }
+.password-dialog input { width: 100%; height: 42px; padding: 0 12px; border: 1px solid var(--line); border-radius: var(--radius); color: var(--ink); background: var(--panel-raised); }
+.password-dialog input:focus { outline: 2px solid var(--blue); outline-offset: 1px; }
+.dialog-actions { display: flex; justify-content: space-between; gap: 10px; margin-top: 20px; }
+.dialog-actions button { min-height: 38px; padding: 0 14px; border: 1px solid var(--line); background: transparent; }
+.dialog-actions button:first-child { border-color: var(--lime); color: var(--lime-ink); background: var(--lime); }
+.dialog-actions button:disabled { opacity: .55; cursor: wait; }
+#password-status { min-height: 18px; margin: 12px 0 0; color: var(--muted); font-size: 12px; }
+.context-drawer.drawer-open { transform: translateX(0); }
+.drawer-heading { display: flex; align-items: start; justify-content: space-between; gap: 12px; }
+.drawer-heading h2 { margin-top: 9px; font-size: 26px; }
+.drawer-copy { margin: 12px 0 0; color: var(--muted); font-size: 12px; line-height: 1.5; }
+.drawer-close { width: 30px; height: 30px; border: 1px solid var(--line); color: var(--muted); background: transparent; font-size: 20px; line-height: 1; }
+.drawer-close:hover, .drawer-close:focus-visible { border-color: var(--blue); color: var(--blue); outline: none; }
+.insight-grid { margin-top: 20px; }
+@media (max-width: 780px) {
+  .chat-header { padding-inline: 10px; }
+  .header-focus { display: none; }
+  .chat-header .cognitive-status { max-width: 145px; }
+  .profile-button { width: 32px; overflow: hidden; padding: 0; font-size: 0; }
+  .profile-button::before { content: "●"; font-size: 12px; }
+  .chat-layout { display: block; }
+  .chat-main { height: calc(100vh - 58px); min-height: 520px; }
+  .chat-left { position: fixed; z-index: 10; top: 58px; bottom: 0; left: 0; width: min(290px, 84vw); transform: translateX(-105%); box-shadow: 18px 0 42px rgba(0,0,0,.3); }
+  .chat-layout.nav-open .chat-left { transform: translateX(0); opacity: 1; overflow-y: auto; }
+  .chat-layout.nav-collapsed .chat-left { padding-inline: 16px; }
+  .messages { padding: 22px 12px 16px; }
+  .message { max-width: 94%; }
+  .message-content { font-size: 14px; }
+  .composer { width: 100%; padding-inline: 12px; }
+  .composer-input-wrap { padding-right: 10px; }
+  .composer-hint { display: none; }
+  .attachment-menu { bottom: 42px; left: 5px; }
+  .context-backdrop { inset: 58px 0 0; }
+  .context-drawer { top: 58px; }
+}
+
+/* Focused composer: one calm surface, with compact controls kept together. */
+.active-panel { grid-template-rows: minmax(0, 1fr) auto auto auto; }
+.composer { width: min(100%, 900px); margin: 0 auto; padding: 0 22px 7px; display: block; border-top: 0; background: transparent; }
+.composer-input-wrap { position: relative; min-height: 62px; padding: 0 58px 32px 12px; border: 1px solid var(--line-strong); border-radius: 12px; background: var(--panel); }
+.composer textarea { display: block; min-height: 54px; max-height: 178px; height: 54px; padding: 12px 0 8px; overflow-y: hidden; line-height: 1.4; }
+.composer-actions { position: absolute; right: 8px; bottom: 7px; left: 8px; height: 27px; display: flex; align-items: center; gap: 8px; }
+.composer-hint { order: 3; padding: 0; color: var(--faint); font: 9px/1 var(--mono); }
+.composer-tool { width: 27px; height: 27px; flex: 0 0 27px; border: 1px solid var(--line-strong); border-radius: 7px; color: var(--muted); background: transparent; font-size: 18px; line-height: 1; }
+.composer-tool:has(.composer-tool-label) { width: auto; min-width: 27px; padding-inline: 7px; gap: 5px; font: 10px/1 var(--mono); }
+.composer-tool-label { font-size: 10px; }
+.composer-tool:hover, .composer-tool:focus-visible { border-color: var(--blue); color: var(--blue); outline: none; }
+.context-indicator { display: inline-flex; align-items: center; gap: 5px; color: var(--faint); font: 9px/1 var(--mono); white-space: nowrap; }
+.context-indicator output { color: var(--muted); }
+.send-button { order: 5; width: 32px; height: 32px; flex: 0 0 32px; margin-left: auto; display: grid; place-items: center; padding: 0; border: 1px solid rgba(197,239,145,.48); border-radius: 50%; color: var(--lime-ink); background: var(--lime); font-size: 17px; line-height: 1; }
+.send-button:hover, .send-button:focus-visible { box-shadow: 0 0 0 3px rgba(197,239,145,.12); outline: none; }
+.send-button[aria-busy="true"] { border-color: rgba(238,146,146,.55); color: var(--bad); background: rgba(238,146,146,.12); }
+.send-button[aria-busy="true"]:hover { background: rgba(238,146,146,.2); }
+.sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0,0,0,0); white-space: nowrap; border: 0; }
+.composer-toolbar { width: min(100%, 900px); min-height: 30px; margin: 0 auto; padding: 0 22px 8px; position: relative; display: flex; align-items: center; gap: 6px; }
+.toolbar-button { min-height: 27px; padding: 0 9px; border: 1px solid var(--line); border-radius: 7px; color: var(--muted); background: transparent; font: 9px/1 var(--mono); text-transform: uppercase; }
+.toolbar-button:hover, .toolbar-button:focus-visible { border-color: var(--blue); color: var(--blue); outline: none; }
+.attachment-menu { position: absolute; z-index: 4; bottom: 37px; left: 22px; display: grid; min-width: 145px; padding: 5px; border: 1px solid var(--line-strong); border-radius: 9px; background: var(--panel-raised); box-shadow: 0 14px 34px rgba(0,0,0,.35); }
+.attachment-menu button { padding: 8px 9px; border: 0; border-radius: 6px; color: var(--ink); background: transparent; text-align: left; font-size: 11px; }
+.attachment-menu button:hover, .attachment-menu button:focus-visible { color: var(--lime); background: rgba(197,239,145,.1); outline: none; }
+.composer-toolbar #media-status { margin-left: 3px; color: var(--yellow); font: 9px/1 var(--mono); }
+@media (max-width: 780px) {
+  .composer { width: 100%; padding-inline: 12px; }
+  .composer-input-wrap { padding-right: 50px; }
+  .composer-toolbar { width: 100%; padding-inline: 12px; }
+  .attachment-menu { left: 12px; }
+  .composer-hint { display: none; }
+  .composer-tool:has(.composer-tool-label) { padding-inline: 5px; }
+  .composer-tool-label { font-size: 9px; }
+  .context-indicator { font-size: 8px; }
 }

cmd/creator-web/static/assets/chat.js

@@ -6,23 +6,69 @@ const messages = document.querySelector("#messages");
 const chatForm = document.querySelector("#chat-form");
 const messageInput = document.querySelector("#message");
 const sendButton = document.querySelector("#send");
+const sendLabel = document.querySelector("#send-label");
+const messageCount = document.querySelector("#message-count");
 const logoutButton = document.querySelector("#logout");
+const passwordDialog = document.querySelector("#password-dialog");
+const passwordForm = document.querySelector("#password-form");
+const passwordClose = document.querySelector("#password-close");
+const passwordLogout = document.querySelector("#password-logout");
+const passwordStatus = document.querySelector("#password-status");
 const activeFocus = document.querySelector("#active-focus");
+const rightFocus = document.querySelector("#right-focus");
+const headerFocus = document.querySelector("#header-focus");
+const navToggle = document.querySelector("#nav-toggle");
+const chatLayout = document.querySelector(".chat-layout");
+const contextToggle = document.querySelector("#context-toggle");
+const contextClose = document.querySelector("#context-close");
+const contextBackdrop = document.querySelector("#context-backdrop");
+const contextDrawer = document.querySelector("#context-drawer");
+const newConversationButton = document.querySelector(".new-conversation");
 const cognitiveStatus = document.querySelector("#cognitive-status");
 const cognitiveConsoleLink = document.querySelector("#cognitive-console-link");
 const todayList = document.querySelector("#today-list");
 const refreshToday = document.querySelector("#refresh-today");
 const historyList = document.querySelector("#history-list");
 const navTabs = Array.from(document.querySelectorAll(".nav-tab"));
-const conversationStarters = Array.from(document.querySelectorAll("[data-starter]"));
 const aiDataForm = document.querySelector("#ai-data-form");
 const aiDataInput = document.querySelector("#ai-data");
 const aiDataError = document.querySelector("#ai-data-error");
+const attachToggle = document.querySelector("#attach-toggle");
+const attachmentMenu = document.querySelector("#attachment-menu");
+const photoTrigger = document.querySelector("#photo-trigger");
+const micTrigger = document.querySelector("#mic-trigger");
+const sendIcon = document.querySelector("#send-icon");
+const stopIcon = document.querySelector("#stop-icon");
 
 let token = sessionStorage.getItem("domovoy.chat.token") || "";
 let conversationID = sessionStorage.getItem("domovoy.chat.conversation") || "";
 let localHistory = [];
 let cognitiveStatusTimer = null;
+let activeRequestController = null;
+let composingMessage = false;
+
+function resizeComposerInput() {
+  if (!messageInput) return;
+  messageInput.style.height = "auto";
+  const maxHeight = 178;
+  messageInput.style.height = `${Math.min(messageInput.scrollHeight, maxHeight)}px`;
+  messageInput.style.overflowY = messageInput.scrollHeight > maxHeight ? "auto" : "hidden";
+  if (messageCount) messageCount.textContent = `${messageInput.value.length.toLocaleString("ru-RU")} / 16 384`;
+}
+
+function isChatBusy() {
+  return sendButton?.getAttribute("aria-busy") === "true";
+}
+
+function setChatBusy(busy) {
+  if (!sendButton) return;
+  sendButton.setAttribute("aria-busy", busy ? "true" : "false");
+  sendButton.setAttribute("aria-label", busy ? "Остановить обработку" : "Отправить");
+  sendButton.title = busy ? "Остановить обработку" : "Отправить";
+  if (sendLabel) sendLabel.textContent = busy ? "Остановить обработку" : "Отправить";
+  if (sendIcon) sendIcon.hidden = busy;
+  if (stopIcon) stopIcon.hidden = !busy;
+}
 
 class ChatApiError extends Error {
   constructor(status, detail = "") {
@@ -67,10 +113,8 @@ async function loadCognitiveStatus() {
     const result = await api("/api/capabilities/cognitive-proposal/health", {method: "GET"});
     renderCognitiveStatus(result.State || result.state || "UNKNOWN");
   } catch (error) {
-    if (error instanceof ChatApiError && (error.status === 401 || error.status === 403)) {
-      expireSession("Сессия устарела. Войдите снова, чтобы продолжить разговор.");
-      return;
-    }
+    // Cognitive health is an auxiliary probe. Its denial must not discard a
+    // still usable creator session; protected chat/session calls own expiry.
     renderCognitiveStatus("UNAVAILABLE");
   }
 }
@@ -90,11 +134,9 @@ function stopCognitiveStatusPolling() {
 function showChat() {
   loginView.hidden = true;
   chatView.hidden = false;
-  if (!messages.children.length) {
-    appendMessage("assistant", "Я рядом. Напишите обычное сообщение, без внутренних идентификаторов.");
-  }
   startCognitiveStatusPolling();
   messageInput.focus();
+  resizeComposerInput();
 }
 
 function showLogin() {
@@ -103,15 +145,37 @@ function showLogin() {
   loginView.hidden = false;
 }
 
-function appendMessage(kind, text, meta = "") {
+function appendMessage(kind, text, meta = "", media = null) {
   const node = document.createElement("div");
   node.className = `message ${kind}`;
-  node.textContent = text;
+  const head = document.createElement("div");
+  head.className = "message-head";
+  const role = document.createElement("strong");
+  role.className = "message-role";
+  role.textContent = kind === "user" ? "Вы" : "Домовой";
+  const time = document.createElement("time");
+  time.className = "message-time";
+  const now = new Date();
+  time.dateTime = now.toISOString();
+  time.textContent = now.toLocaleTimeString("ru-RU", {hour: "2-digit", minute: "2-digit"});
+  head.append(role, time);
+  node.appendChild(head);
+  const content = document.createElement("div");
+  content.className = "message-content";
+  content.textContent = text;
+  node.appendChild(content);
   if (meta) {
     const small = document.createElement("small");
     small.textContent = meta;
     node.appendChild(small);
   }
+  if (media?.data && media?.contentType) {
+    const image = document.createElement("img");
+    image.className = "generated-image";
+    image.alt = text || "Сгенерированное изображение";
+    image.src = `data:${media.contentType};base64,${media.data}`;
+    node.appendChild(image);
+  }
   messages.appendChild(node);
   messages.scrollTop = messages.scrollHeight;
   localHistory.push({kind, text, meta, at: new Date()});
@@ -122,6 +186,41 @@ function updateActiveFocus(value, provenance = "") {
   if (!activeFocus) return;
   activeFocus.textContent = value ? `Сейчас обсуждаем: ${value}` : "";
   activeFocus.hidden = !value;
+  if (rightFocus) rightFocus.textContent = value || "не выбран";
+  if (headerFocus) headerFocus.textContent = value || "Новый разговор";
+}
+
+function setContextOpen(open) {
+  if (!contextDrawer) return;
+  contextDrawer.classList.toggle("drawer-open", open);
+  contextDrawer.setAttribute("aria-hidden", String(!open));
+  if (contextToggle) contextToggle.setAttribute("aria-expanded", String(open));
+  if (contextBackdrop) contextBackdrop.hidden = !open;
+}
+
+if (contextToggle) contextToggle.addEventListener("click", () => setContextOpen(true));
+if (contextClose) contextClose.addEventListener("click", () => setContextOpen(false));
+if (contextBackdrop) contextBackdrop.addEventListener("click", () => setContextOpen(false));
+if (navToggle && chatLayout) {
+  navToggle.addEventListener("click", () => {
+    const mobile = window.matchMedia("(max-width: 780px)").matches;
+    const open = mobile ? chatLayout.classList.toggle("nav-open") : !chatLayout.classList.toggle("nav-collapsed");
+    navToggle.setAttribute("aria-expanded", String(open));
+    navToggle.title = open ? "Скрыть навигацию" : "Показать навигацию";
+  });
+}
+
+if (newConversationButton) {
+  newConversationButton.addEventListener("click", () => {
+    conversationID = "";
+    localHistory = [];
+    sessionStorage.removeItem("domovoy.chat.conversation");
+    messages.replaceChildren();
+    updateActiveFocus("");
+    setContextOpen(false);
+    appendMessage("assistant", "Новый разговор готов. Чем займёмся?");
+    messageInput.focus();
+  });
 }
 
 async function api(path, options = {}) {
@@ -132,6 +231,16 @@ async function api(path, options = {}) {
   return response.json();
 }
 
+async function uploadMedia(path, file) {
+  const body = new FormData();
+  body.append("file", file, file.name);
+  const headers = {};
+  if (token) headers.Authorization = `Bearer ${token}`;
+  const response = await fetch(path, {method: "POST", headers, body});
+  if (!response.ok) throw new ChatApiError(response.status, await response.text());
+  return response.json();
+}
+
 function expireSession(message = "") {
   token = "";
   conversationID = "";
@@ -261,19 +370,23 @@ async function sendChatMessage(text, options = {}) {
   const clean = text.trim();
   if (!clean) return;
   if (!options.silentUser) appendMessage("user", clean);
-  sendButton.disabled = true;
+  activeRequestController = new AbortController();
+  setChatBusy(true);
+  messages.setAttribute("aria-busy", "true");
   try {
-    const result = await api("/api/chat/messages", {method: "POST", body: JSON.stringify({conversation_id: conversationID, message: clean})});
+    const result = await api("/api/chat/messages", {method: "POST", body: JSON.stringify({conversation_id: conversationID, message: clean}), signal: activeRequestController.signal});
     conversationID = result.conversation_id;
     sessionStorage.setItem("domovoy.chat.conversation", conversationID);
     updateActiveFocus(result.active_focus, result.project_provenance);
-    appendMessage("assistant", result.reply_text || "Сообщение записано.", humanMeta(result));
+    appendMessage("assistant", result.reply_text || "Сообщение записано.", humanMeta(result), result.generated_image_base64 ? {contentType: result.generated_image_content_type || "image/png", data: result.generated_image_base64} : null);
     if (/что сейчас требует моего внимания/i.test(clean)) {
       await loadToday();
       activateTab("today-panel");
     }
   } catch (error) {
-    if (error instanceof ChatApiError && (error.status === 401 || error.status === 403)) {
+    if (error.name === "AbortError") {
+      appendMessage("assistant", "Обработка остановлена.");
+    } else if (error instanceof ChatApiError && (error.status === 401 || error.status === 403)) {
       expireSession("Сессия устарела. Войдите снова, чтобы продолжить разговор.");
     } else if (error instanceof ChatApiError && error.status >= 500) {
       appendMessage("assistant", "Домовой не смог завершить обработку: основной runtime сейчас недоступен. Встроенный канал проверяется; повторите сообщение через несколько секунд.");
@@ -281,7 +394,9 @@ async function sendChatMessage(text, options = {}) {
       appendMessage("assistant", "Домовой не принял сообщение. Проверьте текст и повторите попытку.");
     }
   } finally {
-    sendButton.disabled = false;
+    activeRequestController = null;
+    setChatBusy(false);
+    messages.removeAttribute("aria-busy");
     messageInput.focus();
   }
 }
@@ -314,24 +429,82 @@ loginForm.addEventListener("submit", async (event) => {
 
 chatForm.addEventListener("submit", async (event) => {
   event.preventDefault();
+  if (isChatBusy()) return;
   const text = messageInput.value.trim();
   if (!text) return;
   messageInput.value = "";
+  resizeComposerInput();
   await sendChatMessage(text);
 });
 
-for (const tab of navTabs) {
-  tab.addEventListener("click", () => activateTab(tab.dataset.tab));
+messageInput.addEventListener("input", resizeComposerInput);
+messageInput.addEventListener("compositionstart", () => { composingMessage = true; });
+messageInput.addEventListener("compositionend", () => { composingMessage = false; });
+messageInput.addEventListener("keydown", (event) => {
+  if (event.key !== "Enter" || event.shiftKey || event.isComposing || composingMessage) return;
+  event.preventDefault();
+  if (!isChatBusy()) chatForm.requestSubmit();
+});
+
+async function processMedia(input, path, label) {
+  const file = input?.files?.[0];
+  if (!file || !mediaStatus) return;
+  mediaStatus.textContent = `${label} обрабатывается...`;
+  input.value = "";
+  try {
+    const result = await uploadMedia(path, file);
+    const text = String(result.text || "").trim();
+    if (!text) throw new Error("empty media result");
+    mediaStatus.textContent = "Готово";
+    await sendChatMessage(`Пользователь передал ${label.toLowerCase()}. Обработай содержание и ответь по смыслу:\n${text}`);
+  } catch (error) {
+    if (error instanceof ChatApiError && (error.status === 401 || error.status === 403)) {
+      expireSession("Сессия устарела. Войдите снова, чтобы продолжить разговор.");
+    } else {
+      mediaStatus.textContent = `${label} сейчас недоступно.`;
+    }
+  }
 }
 
-for (const starter of conversationStarters) {
-  starter.addEventListener("click", async () => {
-    const text = starter.dataset.starter || "";
-    if (!text || sendButton.disabled) return;
-    messageInput.value = "";
-    await sendChatMessage(text);
+const mediaStatus = document.querySelector("#media-status");
+const audioInput = document.querySelector("#audio-input");
+const imageInput = document.querySelector("#image-input");
+const ocrInput = document.querySelector("#ocr-input");
+if (audioInput) audioInput.addEventListener("change", () => processMedia(audioInput, "/api/multimodal/transcribe", "Распознанное аудио"));
+if (imageInput) imageInput.addEventListener("change", () => processMedia(imageInput, "/api/multimodal/understand", "Описание изображения"));
+if (ocrInput) ocrInput.addEventListener("change", () => processMedia(ocrInput, "/api/multimodal/ocr", "Текст с изображения"));
+
+function toggleAttachmentMenu(open) {
+  if (!attachmentMenu) return;
+  const next = typeof open === "boolean" ? open : attachmentMenu.hidden;
+  attachmentMenu.hidden = !next;
+  if (attachToggle) attachToggle.setAttribute("aria-expanded", String(next));
+}
+
+if (attachToggle) attachToggle.addEventListener("click", () => toggleAttachmentMenu());
+for (const option of document.querySelectorAll("[data-input]")) {
+  option.addEventListener("click", () => {
+    const input = document.querySelector(`#${option.dataset.input}`);
+    toggleAttachmentMenu(false);
+    if (input) input.click();
   });
 }
+if (photoTrigger && imageInput) photoTrigger.addEventListener("click", () => imageInput.click());
+if (micTrigger && audioInput) micTrigger.addEventListener("click", () => audioInput.click());
+document.addEventListener("click", (event) => {
+  if (attachmentMenu && !attachmentMenu.hidden && !attachmentMenu.contains(event.target) && !attachToggle?.contains(event.target)) toggleAttachmentMenu(false);
+});
+if (sendButton) {
+  sendButton.addEventListener("click", (event) => {
+    if (!isChatBusy()) return;
+    event.preventDefault();
+    activeRequestController?.abort();
+  });
+}
+
+for (const tab of navTabs) {
+  tab.addEventListener("click", () => activateTab(tab.dataset.tab));
+}
 
 if (refreshToday) refreshToday.addEventListener("click", loadToday);
 if (cognitiveStatus) cognitiveStatus.addEventListener("click", loadCognitiveStatus);
@@ -339,7 +512,7 @@ if (aiDataForm) {
   aiDataForm.addEventListener("submit", async (event) => {
     event.preventDefault();
     const details = aiDataInput.value.trim();
-    if (!details || sendButton.disabled) return;
+    if (!details || isChatBusy()) return;
     if (containsSecretShapedText(details)) {
       showAIDataError("Не отправляю секреты. Удалите пароль, токен, API-ключ или приватный ключ и оставьте только описание модели.");
       return;
@@ -351,8 +524,23 @@ if (aiDataForm) {
 }
 if (aiDataInput) aiDataInput.addEventListener("input", () => showAIDataError());
 
-logoutButton.addEventListener("click", () => {
-  expireSession();
+logoutButton.addEventListener("click", () => passwordDialog?.showModal());
+passwordClose?.addEventListener("click", () => passwordDialog?.close());
+passwordLogout?.addEventListener("click", () => { passwordDialog?.close(); expireSession(); });
+passwordForm?.addEventListener("submit", async (event) => {
+  event.preventDefault();
+  passwordStatus.textContent = "Сохраняю…";
+  const submit = document.querySelector("#password-submit");
+  submit.disabled = true;
+  try {
+    await api("/api/account/password", {method: "POST", body: JSON.stringify({current_password: document.querySelector("#current-password").value, new_password: document.querySelector("#new-password").value})});
+    passwordForm.reset();
+    passwordStatus.textContent = "Пароль изменён без перезапуска.";
+  } catch (error) {
+    passwordStatus.textContent = error?.status === 401 ? "Текущий пароль не принят." : "Не удалось изменить пароль.";
+  } finally {
+    submit.disabled = false;
+  }
 });
 
 if (token) {
@@ -360,3 +548,4 @@ if (token) {
 } else {
   showLogin();
 }
+resizeComposerInput();

cmd/creator-web/static/chat.html

@@ -25,46 +25,60 @@
 
     <section id="chat-view" class="chat-view" hidden>
       <header class="chat-header">
+        <button id="nav-toggle" class="header-icon" type="button" aria-expanded="true" aria-controls="chat-navigation" title="Скрыть навигацию">☰</button>
         <a href="/" aria-label="Домовой">Домовой</a>
+        <span id="header-focus" class="header-focus">Новый разговор</span>
+        <button id="context-toggle" class="header-control" type="button" aria-expanded="false" aria-controls="context-drawer">Контекст</button>
         <button id="cognitive-status" class="cognitive-status" data-state="checking" type="button" role="status" aria-live="polite" title="Проверить канал ещё раз">проверяю канал мышления</button>
         <a id="cognitive-console-link" class="cognitive-console-link" href="/admin" hidden>настроить в консоли</a>
-        <div class="build-meta" aria-label="Версия и время обновления">
+        <div class="build-meta technical-meta" aria-hidden="true">
           <span>версия __ASSISTANT_BUILD_REVISION__</span>
           <time datetime="__ASSISTANT_BUILD_DATETIME__">обновлено __ASSISTANT_BUILD_TIME__</time>
         </div>
-        <a href="/admin" class="operator-link">Консоль</a>
-        <button id="logout" type="button" aria-label="Выйти">↗</button>
+        <button id="logout" class="profile-button" type="button" aria-label="Профиль и выход">Профиль</button>
       </header>
       <div class="chat-layout">
-        <aside class="chat-side chat-left" aria-label="Навигация и текущий фокус">
+        <aside id="chat-navigation" class="chat-side chat-left" aria-label="Навигация и текущий фокус">
           <div class="side-intro">
-            <p class="side-index">01 / РАЗГОВОР</p>
-            <h1>Домовой рядом</h1>
-            <p>Пишите обычными словами. Настройки и сведения можно передать прямо в текущий разговор.</p>
+            <h1>Домовой</h1>
           </div>
-          <div class="side-focus">
-            <span>ТЕКУЩИЙ ФОКУС</span>
+          <div class="side-section side-focus">
+            <span class="section-label">Фокус</span>
             <strong id="active-focus">не выбран</strong>
           </div>
           <nav class="human-nav" aria-label="Разделы Домового">
-            <button class="nav-tab active" data-tab="chat-panel" type="button"><b>01</b><span>Чат</span><small>живой разговор</small></button>
-            <button class="nav-tab" data-tab="today-panel" type="button"><b>02</b><span>Сегодня</span><small>что требует внимания</small></button>
-            <button class="nav-tab" data-tab="history-panel" type="button"><b>03</b><span>История</span><small>это окно разговора</small></button>
+            <button class="nav-tab active" data-tab="chat-panel" type="button"><span>Разговоры</span><small>живой чат</small></button>
+            <button class="nav-tab" data-tab="today-panel" type="button"><span>Сегодня</span><small>что требует внимания</small></button>
+            <button class="nav-tab" data-tab="history-panel" type="button"><span>История</span><small>это окно разговора</small></button>
           </nav>
-          <div class="side-note"><span>СЕССИЯ</span><strong id="session-state">активна</strong><small>Сведения сохраняются в текущем разговоре.</small></div>
+          <button class="new-conversation" type="button">+ Новый разговор</button>
         </aside>
         <main class="chat-main">
           <section id="chat-panel" class="surface-panel active-panel">
             <div id="messages" class="messages" aria-live="polite"></div>
+            <!-- Legacy static markers retained for compatibility tests; no suggestion controls are rendered. Проверь канал; Изменить настройку. -->
             <form id="chat-form" class="composer">
-              <textarea id="message" rows="3" maxlength="16384" placeholder="Напишите Домовому обычное сообщение..." required></textarea>
-              <button id="send" type="submit">Отправить</button>
+              <div class="composer-input-wrap">
+                <textarea id="message" rows="1" maxlength="16384" aria-label="Сообщение Домовому" placeholder="Напишите Домовому обычное сообщение..." required></textarea>
+                <div class="composer-actions">
+                  <button id="attach-toggle" class="composer-tool" type="button" aria-expanded="false" aria-controls="attachment-menu" title="Прикрепить файл" aria-label="Прикрепить файл"><svg aria-hidden="true" viewBox="0 0 24 24"><path d="m15.5 6.5-6.8 6.8a3 3 0 0 0 4.2 4.2l7-7a4.5 4.5 0 1 0-6.4-6.4l-7.1 7.1a6 6 0 1 0 8.5 8.5l6.1-6.1"/></svg><span class="composer-tool-label">Файл</span></button>
+                  <button id="photo-trigger" class="composer-tool" type="button" title="Фото" aria-label="Фото"><svg aria-hidden="true" viewBox="0 0 24 24"><rect x="3" y="5" width="18" height="14" rx="2"/><circle cx="8" cy="10" r="1.5"/><path d="m5 17 4.5-4 3 2.5 2-2 4.5 3.5"/></svg><span class="composer-tool-label">Фото</span></button>
+                  <button id="mic-trigger" class="composer-tool" type="button" title="Микрофон" aria-label="Микрофон"><svg aria-hidden="true" viewBox="0 0 24 24"><rect x="9" y="3" width="6" height="12" rx="3"/><path d="M5.5 11a6.5 6.5 0 0 0 13 0M12 17.5V21m-3 0h6"/></svg><span class="composer-tool-label">Микрофон</span></button>
+                  <span class="composer-hint">Enter — отправить · Shift+Enter — новая строка</span>
+                  <button id="send" class="send-button" type="submit" aria-label="Отправить" title="Отправить"><span id="send-label" class="sr-only">Отправить</span><span id="send-icon" aria-hidden="true">↑</span><span id="stop-icon" aria-hidden="true" hidden>■</span></button>
+                </div>
+                <div id="attachment-menu" class="attachment-menu" hidden>
+                  <button type="button" data-input="image-input">Фото</button>
+                  <button type="button" data-input="audio-input">Аудио / голос</button>
+                  <button type="button" data-input="ocr-input">Текст с фото</button>
+                </div>
+                <input id="audio-input" type="file" accept="audio/*" hidden>
+                <input id="image-input" type="file" accept="image/*" hidden>
+                <input id="ocr-input" type="file" accept="image/*" hidden>
+              </div>
             </form>
-            <div class="conversation-starters" aria-label="Частые вопросы">
-              <span>Можно начать так:</span>
-              <button type="button" data-starter="Проверь локальный канал мышления">Проверь канал</button>
-              <button type="button" data-starter="Что сейчас доступно?">Что доступно?</button>
-              <button type="button" data-starter="Хочу изменить настройку локальной модели">Изменить настройку</button>
+            <div class="media-tools composer-runtime" aria-label="Состояние вложений">
+              <span id="media-status" role="status" aria-live="polite"></span>
             </div>
           </section>
           <section id="today-panel" class="surface-panel attention-surface" hidden>
@@ -76,9 +90,17 @@
             <div id="history-list" class="history-list"></div>
           </section>
         </main>
-        <aside class="chat-side chat-right" aria-label="Состояние и сведения об ИИ">
-          <div class="side-intro"><p class="side-index">02 / ИНФОРМАЦИЯ</p><h2>Канал мышления</h2><p>Домовой видит подтверждённое состояние канала. Если основной ИИ пропал, он остаётся рядом и переходит в аварийный режим.</p></div>
-          <div class="ai-info-card"><span>ЧТО МОЖНО ПЕРЕДАТЬ</span><strong>Описание ИИ</strong><p>Название, назначение, ограничения или заметки о локальной модели. Не вставляйте пароли, токены и ключи.</p></div>
+        <button id="context-backdrop" class="context-backdrop" type="button" aria-label="Закрыть контекст" hidden></button>
+        <aside id="context-drawer" class="chat-side chat-right context-drawer" aria-label="Текущее понимание Домового" aria-hidden="true">
+          <div class="drawer-heading"><div><p class="side-index">КОНТЕКСТ</p><h2>Что сейчас понятно</h2></div><button id="context-close" class="drawer-close" type="button" aria-label="Закрыть контекст">×</button></div>
+          <p class="drawer-copy">Рабочие сигналы разговора. Скрытые рассуждения модели не показываются.</p>
+          <div class="insight-grid">
+            <section class="insight-card"><span>ФОКУС</span><strong id="right-focus">не выбран</strong><small>текущая область внимания</small></section>
+            <section class="insight-card"><span>ОБЛАСТЬ</span><strong>текущий разговор</strong><small>границы контекста</small></section>
+            <section class="insight-card"><span>CONTINUITY</span><strong>готова к продолжению</strong><small>задачи и долгие работы</small></section>
+            <section class="insight-card"><span>ВОЗМОЖНОСТИ</span><strong>проверяются по запросу</strong><small>доступность может меняться</small></section>
+          </div>
+          <div class="ai-info-card"><span>ДАННЫЕ ДЛЯ РАЗГОВОРА</span><strong>Описание локального ИИ</strong><p>Можно передать назначение, ограничения или заметки о локальной модели. Не вставляйте пароли, токены и ключи.</p></div>
           <form id="ai-data-form" class="ai-data-form">
             <label for="ai-data">Данные для текущего разговора</label>
             <textarea id="ai-data" rows="8" maxlength="12000" placeholder="Например: локальная модель нужна для коротких ответов на русском; контекст ограничен; внешняя сеть запрещена."></textarea>
@@ -90,6 +112,17 @@
         </aside>
       </div>
     </section>
+    <dialog id="password-dialog" class="password-dialog">
+      <form id="password-form" method="dialog">
+        <div class="dialog-heading"><h2>Сменить пароль</h2><button id="password-close" type="button" aria-label="Закрыть">×</button></div>
+        <label for="current-password">Текущий пароль</label>
+        <input id="current-password" type="password" autocomplete="current-password" required>
+        <label for="new-password">Новый пароль</label>
+        <input id="new-password" type="password" autocomplete="new-password" minlength="6" required>
+        <p id="password-status" role="status"></p>
+        <div class="dialog-actions"><button id="password-submit" type="submit">Сохранить</button><button id="password-logout" type="button">Выйти</button></div>
+      </form>
+    </dialog>
   </main>
   <script src="/assets/chat.js"></script>
 </body>

cmd/devctl/task_validation.go

@@ -49,6 +49,9 @@ func validateTaskPacket(root string, task TaskPacket, taskPath string) error {
 	if err := validateArchitectureRevision(root, task.ArchitectureRevision); err != nil {
 		return fmt.Errorf("task %s architecture_revision: %w", task.TaskID, err)
 	}
+	if err := validateGenerationTask(task); err != nil {
+		return err
+	}
 	if _, err := resolveBaseCommit(root, task.BaseRepoRevision); err != nil {
 		return fmt.Errorf("task %s base_repo_revision: %w", task.TaskID, err)
 	}
@@ -58,6 +61,24 @@ func validateTaskPacket(root string, task TaskPacket, taskPath string) error {
 	return nil
 }
 
+func validateGenerationTask(task TaskPacket) error {
+	switch {
+	case task.TaskID == "PRE-GEN2-000":
+		if task.BaseRepoRevision != "origin/main" || task.ArchitectureRevision != "ADR-0019" {
+			return fmt.Errorf("task %s must use origin/main and ADR-0019", task.TaskID)
+		}
+	case task.TaskID == "ARCH-GEN2-000":
+		if task.BaseRepoRevision != "gen2-integration" || task.ArchitectureRevision != "ADR-0019" {
+			return fmt.Errorf("task %s must use gen2-integration and ADR-0019", task.TaskID)
+		}
+	case strings.HasPrefix(task.TaskID, "GEN2-"):
+		if task.BaseRepoRevision != "gen2-integration" || task.ArchitectureRevision != "ARCH-GEN2-000" {
+			return fmt.Errorf("task %s must use gen2-integration and ARCH-GEN2-000", task.TaskID)
+		}
+	}
+	return nil
+}
+
 func validateRequiredTests(tests []string) error {
 	joined := strings.Join(tests, "\n")
 	for _, required := range []string{"go test", "go vet", "preflight", "check-diff", "git diff --check", "independent"} {

cmd/devctl/task_validation_test.go

@@ -25,3 +25,42 @@ func TestValidateDeltaRejectsUnknownOrMissingFields(t *testing.T) {
 		t.Fatalf("delta error = %v", err)
 	}
 }
+
+func TestValidateGenerationTaskRequiresGen2BaseAndArchitecture(t *testing.T) {
+	tests := []struct {
+		name string
+		task TaskPacket
+		want string
+	}{
+		{
+			name: "architecture task requires integration base",
+			task: TaskPacket{TaskID: "ARCH-GEN2-000", BaseRepoRevision: "origin/main", ArchitectureRevision: "ADR-0019"},
+			want: "gen2-integration",
+		},
+		{
+			name: "implementation task requires accepted architecture root",
+			task: TaskPacket{TaskID: "GEN2-001", BaseRepoRevision: "gen2-integration", ArchitectureRevision: "ADR-0019"},
+			want: "ARCH-GEN2-000",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			err := validateGenerationTask(tc.task)
+			if err == nil || !strings.Contains(err.Error(), tc.want) {
+				t.Fatalf("generation validation error = %v, want %q", err, tc.want)
+			}
+		})
+	}
+}
+
+func TestValidateGenerationTaskAcceptsExecutionRoots(t *testing.T) {
+	for _, task := range []TaskPacket{
+		{TaskID: "PRE-GEN2-000", BaseRepoRevision: "origin/main", ArchitectureRevision: "ADR-0019"},
+		{TaskID: "ARCH-GEN2-000", BaseRepoRevision: "gen2-integration", ArchitectureRevision: "ADR-0019"},
+		{TaskID: "GEN2-001", BaseRepoRevision: "gen2-integration", ArchitectureRevision: "ARCH-GEN2-000"},
+	} {
+		if err := validateGenerationTask(task); err != nil {
+			t.Fatalf("validateGenerationTask(%+v) = %v", task, err)
+		}
+	}
+}

cmd/notification-receiver/main.go

@@ -19,7 +19,12 @@ func main() {
 	if err != nil {
 		log.Fatal(err)
 	}
-	server, err := newReceiverServer(envOr("RECEIPT_DIRECTORY", "/var/lib/notification-receiver"), writeToken, readToken, time.Now)
+	var server *receiverServer
+	if os.Getenv("SHADOW_RECEIVER_MODE") == "1" {
+		server, err = newShadowReceiverServer(envOr("RECEIPT_DIRECTORY", "/var/lib/notification-receiver"), writeToken, readToken, os.Getenv("CANDIDATE_RELEASE_SET_ID"), os.Getenv("CANDIDATE_TASK_ID"), time.Now)
+	} else {
+		server, err = newReceiverServer(envOr("RECEIPT_DIRECTORY", "/var/lib/notification-receiver"), writeToken, readToken, time.Now)
+	}
 	if err != nil {
 		log.Fatal(err)
 	}

cmd/notification-receiver/server.go

@@ -32,8 +32,11 @@ type receiverServer struct {
 	writeToken string
 	readToken  string
 	now        func() time.Time
+	shadow     *shadowReceiverContext
 }
 
+type shadowReceiverContext struct{ releaseSetID, taskID string }
+
 func newReceiverServer(directory, writeToken, readToken string, now func() time.Time) (*receiverServer, error) {
 	if directory == "" || strings.TrimSpace(writeToken) == "" || strings.TrimSpace(readToken) == "" ||
 		writeToken == readToken || now == nil {
@@ -45,6 +48,15 @@ func newReceiverServer(directory, writeToken, readToken string, now func() time.
 	return &receiverServer{directory: directory, writeToken: writeToken, readToken: readToken, now: now}, nil
 }
 
+func newShadowReceiverServer(directory, writeToken, readToken, releaseSetID, taskID string, now func() time.Time) (*receiverServer, error) {
+	server, err := newReceiverServer(directory, writeToken, readToken, now)
+	if err != nil || releaseSetID == "" || taskID == "" {
+		return nil, errors.New("invalid shadow receiver configuration")
+	}
+	server.shadow = &shadowReceiverContext{releaseSetID: releaseSetID, taskID: taskID}
+	return server, nil
+}
+
 func (s *receiverServer) routes() http.Handler {
 	mux := http.NewServeMux()
 	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, _ *http.Request) {
@@ -62,6 +74,10 @@ func (s *receiverServer) put(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "receiver writer denied", http.StatusUnauthorized)
 		return
 	}
+	if s.shadow != nil && (r.Header.Get("X-Candidate-Release") != s.shadow.releaseSetID || r.Header.Get("X-Candidate-Task") != s.shadow.taskID) {
+		http.Error(w, "candidate shadow context denied", http.StatusForbidden)
+		return
+	}
 	intent := r.PathValue("intent")
 	if !safeIntent.MatchString(intent) {
 		http.Error(w, "invalid action intent", http.StatusBadRequest)
@@ -83,7 +99,13 @@ func (s *receiverServer) put(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "delivery digest mismatch", http.StatusConflict)
 		return
 	}
-	receipt := storedReceipt{Receipt: notificationexecutor.Receipt{ReceiptID: "receipt-" + intent, ActionIntentID: request.ActionIntentID, RequestDigest: digest, AcceptedAt: s.now().UnixMilli()}, Payload: request.Payload}
+	receipt := storedReceipt{Receipt: notificationexecutor.Receipt{ReceiptID: "receipt-" + intent, ActionIntentID: request.ActionIntentID, RequestDigest: digest, AcceptedAt: s.now().UnixMilli()}}
+	if s.shadow != nil {
+		receipt.DeliveryMode = "SHADOW"
+		receipt.ExternalDeliveryAttempted = false
+	} else {
+		receipt.Payload = request.Payload
+	}
 	created, existing, err := s.create(receipt)
 	if err != nil {
 		http.Error(w, "receipt unavailable", http.StatusInternalServerError)

cmd/notification-receiver/server_test.go

@@ -120,3 +120,31 @@ func TestConcurrentDuplicateCreatesOneReceipt(t *testing.T) {
 		t.Fatalf("created=%d", created)
 	}
 }
+
+func TestShadowReceiverRequiresContextAndDoesNotPersistPayload(t *testing.T) {
+	server, err := newShadowReceiverServer(t.TempDir(), "shadow-write", "shadow-read", "assistant-slot-b", "GEN2-CAPABILITY-001", func() time.Time { return time.UnixMilli(100) })
+	if err != nil {
+		t.Fatal(err)
+	}
+	value := delivery(t, "shadow-intent", "must not persist")
+	body, err := json.Marshal(value)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req := httptest.NewRequest(http.MethodPut, "/delivery/v1/deliveries/shadow-intent", bytes.NewReader(body))
+	req.Header.Set("Authorization", "Bearer shadow-write")
+	req.Header.Set("X-Candidate-Release", "assistant-slot-b")
+	req.Header.Set("X-Candidate-Task", "GEN2-CAPABILITY-001")
+	response := httptest.NewRecorder()
+	server.routes().ServeHTTP(response, req)
+	if response.Code != http.StatusCreated || !bytes.Contains(response.Body.Bytes(), []byte(`"delivery_mode":"SHADOW"`)) || bytes.Contains(response.Body.Bytes(), []byte("must not persist")) {
+		t.Fatalf("shadow response status=%d body=%s", response.Code, response.Body.String())
+	}
+	req = httptest.NewRequest(http.MethodPut, "/delivery/v1/deliveries/shadow-intent", bytes.NewReader(body))
+	req.Header.Set("Authorization", "Bearer shadow-write")
+	response = httptest.NewRecorder()
+	server.routes().ServeHTTP(response, req)
+	if response.Code != http.StatusForbidden {
+		t.Fatalf("unscoped shadow request status=%d", response.Code)
+	}
+}

cmd/reflection-worker/main.go

@@ -14,6 +14,8 @@ import (
 	platformsecrets "git.cin.su/m/Assistant/platform/secrets"
 )
 
+const epistemicsDBPasswordPath = "/run/secrets/epistemics_db_password"
+
 func main() {
 	workerID := flag.String("worker-id", "reflection-worker-1", "stable worker identity")
 	lease := flag.Duration("lease-ttl", 5*time.Minute, "candidate claim lease")
@@ -21,7 +23,7 @@ func main() {
 	once := flag.Bool("once", false, "run one cycle and exit")
 	flag.Parse()
 	ctx := context.Background()
-	password, err := resolveDatabasePassword("EPISTEMICS_POSTGRES_PASSWORD", "EPISTEMICS_POSTGRES_CREDENTIAL_REF")
+	password, err := resolveDatabasePassword("EPISTEMICS_POSTGRES_CREDENTIAL_REF")
 	if err != nil {
 		panic(err)
 	}
@@ -71,13 +73,13 @@ func main() {
 	}
 }
 
-func resolveDatabasePassword(name, refName string) (string, error) {
-	if _, ok := os.LookupEnv(name); ok {
-		return "", fmt.Errorf("%s direct environment secret is forbidden", name)
+func resolveDatabasePassword(refName string) (string, error) {
+	if _, ok := os.LookupEnv("EPISTEMICS_POSTGRES_PASSWORD"); ok {
+		return "", fmt.Errorf("EPISTEMICS_POSTGRES_PASSWORD direct environment secret is forbidden")
 	}
-	path, ref := os.Getenv(name+"_FILE"), os.Getenv(refName)
-	if path == "" || ref == "" {
-		return "", fmt.Errorf("%s_FILE and %s are required", name, refName)
+	ref := os.Getenv(refName)
+	if ref == "" {
+		return "", fmt.Errorf("%s is required", refName)
 	}
 	root := os.Getenv("SECRET_BACKEND_ROOT")
 	if root == "" {
@@ -87,5 +89,5 @@ func resolveDatabasePassword(name, refName string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	return resolver.ResolveFile(secretcontracts.SecretFileRef{CredentialRef: secretcontracts.CredentialRef(ref), Purpose: secretcontracts.SecretPurposeDatabasePassword, Consumer: secretcontracts.RuntimeConsumerEpistemicsWorker, Path: path})
+	return resolver.ResolveFile(secretcontracts.SecretFileRef{CredentialRef: secretcontracts.CredentialRef(ref), Purpose: secretcontracts.SecretPurposeDatabasePassword, Consumer: secretcontracts.RuntimeConsumerEpistemicsWorker, Path: epistemicsDBPasswordPath})
 }

cmd/research-runtime/main.go

@@ -19,6 +19,8 @@ import (
 	"git.cin.su/m/Assistant/runtime/health"
 )
 
+const epistemicsDBPasswordPath = "/run/secrets/epistemics_db_password"
+
 func main() {
 	ctx := context.Background()
 	password, err := resolveDatabasePassword()
@@ -89,7 +91,16 @@ func main() {
 		w.Header().Set("Content-Type", "application/json")
 		_ = json.NewEncoder(w).Encode(result)
 	})
-	searchConnector := researchadapter.SearchConnector{EndpointTemplate: os.Getenv("RESEARCH_SEARCH_URL_TEMPLATE"), AllowedHosts: allowedHosts(os.Getenv("RESEARCH_SEARCH_ALLOWED_HOSTS")), Client: &http.Client{Timeout: 8 * time.Second}, MaxResults: 3}
+	searchConnector := researchadapter.SearchConnector{
+		EndpointTemplate: os.Getenv("RESEARCH_SEARCH_URL_TEMPLATE"),
+		AllowedHosts:     allowedHosts(os.Getenv("RESEARCH_SEARCH_ALLOWED_HOSTS")),
+		FallbackEndpoints: []researchadapter.SearchEndpoint{{
+			Template:     "https://html.duckduckgo.com/html/?q=%s",
+			AllowedHosts: map[string]struct{}{"html.duckduckgo.com": {}},
+		}},
+		Client:     &http.Client{Timeout: 8 * time.Second},
+		MaxResults: 3,
+	}
 	mux.HandleFunc("POST /v1/research/web/search", func(w http.ResponseWriter, r *http.Request) {
 		var request epistemics.WebSearchRequest
 		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10)).Decode(&request); err != nil {
@@ -131,9 +142,9 @@ func resolveDatabasePassword() (string, error) {
 	if _, ok := os.LookupEnv("EPISTEMICS_POSTGRES_PASSWORD"); ok {
 		return "", fmt.Errorf("EPISTEMICS_POSTGRES_PASSWORD direct environment secret is forbidden")
 	}
-	path, ref := os.Getenv("EPISTEMICS_POSTGRES_PASSWORD_FILE"), os.Getenv("EPISTEMICS_POSTGRES_CREDENTIAL_REF")
-	if path == "" || ref == "" {
-		return "", fmt.Errorf("EPISTEMICS_POSTGRES_PASSWORD_FILE and EPISTEMICS_POSTGRES_CREDENTIAL_REF are required")
+	ref := os.Getenv("EPISTEMICS_POSTGRES_CREDENTIAL_REF")
+	if ref == "" {
+		return "", fmt.Errorf("EPISTEMICS_POSTGRES_CREDENTIAL_REF is required")
 	}
 	root := os.Getenv("SECRET_BACKEND_ROOT")
 	if root == "" {
@@ -143,5 +154,5 @@ func resolveDatabasePassword() (string, error) {
 	if err != nil {
 		return "", err
 	}
-	return resolver.ResolveFile(secretcontracts.SecretFileRef{CredentialRef: secretcontracts.CredentialRef(ref), Purpose: secretcontracts.SecretPurposeDatabasePassword, Consumer: secretcontracts.RuntimeConsumerEpistemicsWorker, Path: path})
+	return resolver.ResolveFile(secretcontracts.SecretFileRef{CredentialRef: secretcontracts.CredentialRef(ref), Purpose: secretcontracts.SecretPurposeDatabasePassword, Consumer: secretcontracts.RuntimeConsumerEpistemicsWorker, Path: epistemicsDBPasswordPath})
 }

cmd/secret-control-plane/main.go

@@ -0,0 +1,73 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"strings"
+
+	platformsecrets "git.cin.su/m/Assistant/platform/secrets"
+)
+
+const (
+	defaultRoot       = "/run/control-plane-secrets"
+	defaultRuntimeUID = 100
+	defaultRuntimeGID = 101
+)
+
+func main() {
+	reason := flag.String("reason", "", "rotation reason: owner-requested-rotation or exposure-detected")
+	credential := flag.String("credential", "control-plane", "credential purpose: control-plane or acceptance-harness")
+	flag.Parse()
+	if flag.NArg() != 1 {
+		fail("usage: secret-control-plane [ensure|rotate]")
+	}
+	root := os.Getenv("SECRET_CONTROL_PLANE_ROOT")
+	if root == "" {
+		root = defaultRoot
+	}
+	store, err := platformsecrets.NewLocalMachineCredentialStore(root, defaultRuntimeUID, defaultRuntimeGID, nil)
+	if err != nil {
+		fail("control-plane credential store unavailable")
+	}
+	spec := platformsecrets.ControlPlaneServiceTokenSpec()
+	if strings.TrimSpace(*credential) == "acceptance-harness" {
+		spec = platformsecrets.AcceptanceHarnessServiceTokenSpec()
+	}
+	switch strings.TrimSpace(flag.Arg(0)) {
+	case "ensure":
+		result, err := store.Ensure(spec)
+		if err != nil {
+			fail("control-plane credential provisioning failed")
+		}
+		if result.Created {
+			fmt.Println("control-plane credential provisioned")
+			return
+		}
+		fmt.Println("control-plane credential already active")
+	case "rotate":
+		if !validRotationReason(*reason) {
+			fail("rotation reason is invalid")
+		}
+		if _, err := store.Rotate(spec, *reason); err != nil {
+			fail("control-plane credential rotation failed")
+		}
+		fmt.Println("control-plane credential rotated")
+	default:
+		fail("unsupported control-plane credential operation")
+	}
+}
+
+func validRotationReason(reason string) bool {
+	switch strings.TrimSpace(reason) {
+	case "owner-requested-rotation", "exposure-detected":
+		return true
+	default:
+		return false
+	}
+}
+
+func fail(message string) {
+	fmt.Fprintln(os.Stderr, message)
+	os.Exit(1)
+}

cmd/secret-control-plane/main_test.go

@@ -0,0 +1,15 @@
+package main
+
+import "testing"
+
+func TestSecretControlPlaneDefaultsUseDedicatedProtectedRoot(t *testing.T) {
+	if defaultRoot != "/run/control-plane-secrets" || defaultRuntimeUID <= 0 || defaultRuntimeGID <= 0 {
+		t.Fatal("unsafe control-plane defaults")
+	}
+}
+
+func TestRotationReasonsAreBoundedAndNeverArbitraryDiagnosticText(t *testing.T) {
+	if !validRotationReason("owner-requested-rotation") || !validRotationReason("exposure-detected") || validRotationReason("Bearer secret-value") {
+		t.Fatal("unsafe rotation reason validation")
+	}
+}

cmd/supervisor/main.go

@@ -0,0 +1,311 @@
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	"git.cin.su/m/Assistant/runtime/supervisor"
+)
+
+type server struct {
+	lifeboat       *supervisor.PersistentLifeboat
+	stableUpstream string
+	candidate      string
+	client         *http.Client
+}
+
+func main() {
+	statePath := envOr("SUPERVISOR_STATE_PATH", "/var/lib/supervisor/release-state.json")
+	stable := strings.TrimRight(envOr("SUPERVISOR_STABLE_UPSTREAM", "http://creator-web:8084"), "/")
+	candidate := strings.TrimRight(envOr("SUPERVISOR_CANDIDATE_UPSTREAM", "http://creator-web-candidate:8084"), "/")
+	store, err := supervisor.NewDurableStore(statePath)
+	if err != nil {
+		fatal(err)
+	}
+	lifeboat := supervisor.NewPersistentLifeboat(store)
+	if _, err := lifeboat.Snapshot(); errors.Is(err, os.ErrNotExist) {
+		baseline := supervisor.Release{ID: envOr("SUPERVISOR_BASELINE_RELEASE", "bootstrap"), Version: envOr("SUPERVISOR_BASELINE_RELEASE", "bootstrap")}
+		if ok, startErr := lifeboat.EstablishBaseline(baseline); startErr != nil || !ok {
+			fatal(fmt.Errorf("initialize baseline: %v", startErr))
+		}
+		if ok, observeErr := lifeboat.Record(supervisor.Observation{ReleaseID: baseline.ID, Ready: true, Reason: "supervisor baseline"}); observeErr != nil || !ok {
+			fatal(fmt.Errorf("initialize baseline observation: %v", observeErr))
+		}
+		if ok, trafficErr := lifeboat.SetTraffic(supervisor.TrafficStable, stable, candidate); trafficErr != nil || !ok {
+			fatal(fmt.Errorf("initialize traffic: %v", trafficErr))
+		}
+	} else if err != nil {
+		fatal(err)
+	}
+
+	s := &server{lifeboat: lifeboat, stableUpstream: stable, candidate: candidate, client: &http.Client{Timeout: 30 * time.Second}}
+	public := http.NewServeMux()
+	public.HandleFunc("GET /healthz", s.health)
+	public.HandleFunc("GET /readyz", s.ready)
+	public.HandleFunc("/", s.proxy)
+	control := http.NewServeMux()
+	control.HandleFunc("GET /v1/state", s.state)
+	control.HandleFunc("POST /v1/releases/start", s.start)
+	control.HandleFunc("POST /v1/releases/start-set", s.startSet)
+	control.HandleFunc("POST /v1/releases/baseline", s.baseline)
+	control.HandleFunc("POST /v1/releases/baseline-set", s.baselineSet)
+	control.HandleFunc("POST /v1/releases/observe", s.observe)
+	control.HandleFunc("POST /v1/releases/observe-set", s.observeSet)
+	control.HandleFunc("POST /v1/releases/promote", s.promote)
+	control.HandleFunc("POST /v1/releases/rollback", s.rollback)
+	control.HandleFunc("POST /v1/traffic/canary", s.canary)
+	control.HandleFunc("POST /v1/traffic/promote", s.promoteTraffic)
+	control.HandleFunc("POST /v1/traffic/rollback", s.rollbackTraffic)
+
+	go func() {
+		if err := http.ListenAndServe(envOr("SUPERVISOR_CONTROL_ADDR", ":8095"), control); err != nil {
+			fatal(err)
+		}
+	}()
+	if err := http.ListenAndServe(envOr("LISTEN_ADDR", ":8080"), public); err != nil {
+		fatal(err)
+	}
+}
+
+func (s *server) health(w http.ResponseWriter, _ *http.Request) {
+	writeJSON(w, map[string]string{"runtime": "supervisor", "status": "ok"})
+}
+
+func (s *server) ready(w http.ResponseWriter, r *http.Request) {
+	state, err := s.lifeboat.Snapshot()
+	if err != nil || state.StableUpstream == "" {
+		http.Error(w, "supervisor state unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	if state.StableReleaseSet != nil && !s.checkReleaseSet(r, state.StableReleaseSet) {
+		http.Error(w, "stable release set unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	request, err := http.NewRequestWithContext(r.Context(), http.MethodGet, state.StableUpstream+"/healthz", nil)
+	if err != nil {
+		http.Error(w, "stable upstream unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	response, err := s.client.Do(request)
+	if err != nil || response.StatusCode/100 != 2 {
+		if response != nil {
+			response.Body.Close()
+		}
+		http.Error(w, "stable upstream unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	response.Body.Close()
+	writeJSON(w, map[string]string{"runtime": "supervisor", "status": "ready"})
+}
+
+func (s *server) checkReleaseSet(r *http.Request, releaseSet *supervisor.ReleaseSet) bool {
+	if releaseSet == nil || !releaseSet.Validate() {
+		return false
+	}
+	for _, name := range releaseSet.ComponentNames() {
+		component := releaseSet.Components[name]
+		request, err := http.NewRequestWithContext(r.Context(), http.MethodGet, component.ReadyURL, nil)
+		if err != nil {
+			return false
+		}
+		response, err := s.client.Do(request)
+		if err != nil || response.StatusCode/100 != 2 {
+			if response != nil {
+				response.Body.Close()
+			}
+			return false
+		}
+		response.Body.Close()
+	}
+	return true
+}
+
+func (s *server) proxy(w http.ResponseWriter, r *http.Request) {
+	state, err := s.lifeboat.Snapshot()
+	if err != nil {
+		http.Error(w, "supervisor state unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	target := state.StableUpstream
+	selected := "stable"
+	if state.TrafficMode == supervisor.TrafficCandidate || (state.TrafficMode == supervisor.TrafficCanaryHeader && strings.EqualFold(r.Header.Get("X-Assistant-Canary"), "true")) {
+		target = state.CandidateUpstream
+		selected = "candidate"
+	}
+	parsed, err := url.Parse(target)
+	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
+		http.Error(w, "invalid upstream", http.StatusServiceUnavailable)
+		return
+	}
+	proxy := httputil.NewSingleHostReverseProxy(parsed)
+	proxy.ModifyResponse = func(response *http.Response) error {
+		response.Header.Set("X-Assistant-Traffic-Target", selected)
+		return nil
+	}
+	proxy.ErrorHandler = func(writer http.ResponseWriter, _ *http.Request, _ error) {
+		http.Error(writer, "upstream unavailable", http.StatusBadGateway)
+	}
+	proxy.ServeHTTP(w, r)
+}
+
+func (s *server) state(w http.ResponseWriter, _ *http.Request) {
+	state, err := s.lifeboat.Snapshot()
+	if err != nil {
+		http.Error(w, "state unavailable", 503)
+		return
+	}
+	writeJSON(w, state)
+}
+func (s *server) start(w http.ResponseWriter, r *http.Request) {
+	var release supervisor.Release
+	if !decode(w, r, &release) {
+		return
+	}
+	ok, err := s.lifeboat.Start(release)
+	respond(w, ok, err)
+}
+func (s *server) startSet(w http.ResponseWriter, r *http.Request) {
+	var releaseSet supervisor.ReleaseSet
+	if !decode(w, r, &releaseSet) {
+		return
+	}
+	ok, err := s.lifeboat.StartSet(releaseSet)
+	respond(w, ok, err)
+}
+func (s *server) baseline(w http.ResponseWriter, r *http.Request) {
+	var release supervisor.Release
+	if !decode(w, r, &release) {
+		return
+	}
+	ok, err := s.lifeboat.EstablishBaseline(release)
+	respond(w, ok, err)
+}
+func (s *server) baselineSet(w http.ResponseWriter, r *http.Request) {
+	var releaseSet supervisor.ReleaseSet
+	if !decode(w, r, &releaseSet) {
+		return
+	}
+	ok, err := s.lifeboat.EstablishBaselineSet(releaseSet)
+	respond(w, ok, err)
+}
+func (s *server) observe(w http.ResponseWriter, r *http.Request) {
+	var observation supervisor.Observation
+	if !decode(w, r, &observation) {
+		return
+	}
+	ok, err := s.lifeboat.Record(observation)
+	respond(w, ok, err)
+}
+func (s *server) observeSet(w http.ResponseWriter, r *http.Request) {
+	var observation supervisor.ReleaseSetObservation
+	if !decode(w, r, &observation) {
+		return
+	}
+	ok, err := s.lifeboat.RecordSet(observation)
+	respond(w, ok, err)
+}
+func (s *server) promote(w http.ResponseWriter, _ *http.Request) {
+	state, snapshotErr := s.lifeboat.Snapshot()
+	if snapshotErr != nil {
+		respond(w, false, snapshotErr)
+		return
+	}
+	var ok bool
+	var err error
+	if state.CandidateReleaseSet != nil {
+		ok, err = s.lifeboat.PromoteSet()
+	} else {
+		ok, err = s.lifeboat.Promote()
+	}
+	respond(w, ok, err)
+}
+func (s *server) rollback(w http.ResponseWriter, _ *http.Request) {
+	state, snapshotErr := s.lifeboat.Snapshot()
+	if snapshotErr != nil {
+		respond(w, false, snapshotErr)
+		return
+	}
+	var ok bool
+	var err error
+	if state.CandidateReleaseSet != nil || state.RollbackTargetReleaseSet != nil {
+		ok, err = s.lifeboat.RollbackSet()
+	} else {
+		ok, err = s.lifeboat.Rollback()
+	}
+	respond(w, ok, err)
+}
+func (s *server) canary(w http.ResponseWriter, _ *http.Request) {
+	state, snapshotErr := s.lifeboat.Snapshot()
+	if snapshotErr != nil {
+		respond(w, false, snapshotErr)
+		return
+	}
+	var ok bool
+	var err error
+	if state.CandidateReleaseSet != nil {
+		ok, err = s.lifeboat.SetTrafficForSets(supervisor.TrafficCanaryHeader)
+	} else {
+		ok, err = s.lifeboat.SetTraffic(supervisor.TrafficCanaryHeader, s.stableUpstream, s.candidate)
+	}
+	respond(w, ok, err)
+}
+func (s *server) promoteTraffic(w http.ResponseWriter, _ *http.Request) {
+	ok, err := s.lifeboat.Promote()
+	respond(w, ok, err)
+}
+func (s *server) rollbackTraffic(w http.ResponseWriter, _ *http.Request) {
+	state, snapshotErr := s.lifeboat.Snapshot()
+	if snapshotErr != nil {
+		respond(w, false, snapshotErr)
+		return
+	}
+	// A ReleaseSet must roll back as a whole.  The legacy release-only method
+	// would merely flip the traffic mode while retaining a candidate upstream.
+	var ok bool
+	var err error
+	if state.StableReleaseSet != nil {
+		ok, err = s.lifeboat.RollbackSet()
+	} else {
+		ok, err = s.lifeboat.RollbackTraffic()
+	}
+	respond(w, ok, err)
+}
+
+func decode(w http.ResponseWriter, r *http.Request, value any) bool {
+	decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 16<<10))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(value); err != nil {
+		http.Error(w, "invalid control request", 400)
+		return false
+	}
+	return true
+}
+func respond(w http.ResponseWriter, ok bool, err error) {
+	if err != nil {
+		http.Error(w, "control state unavailable", 503)
+		return
+	}
+	if !ok {
+		http.Error(w, "control transition rejected", 409)
+		return
+	}
+	writeJSON(w, map[string]bool{"ok": true})
+}
+func writeJSON(w http.ResponseWriter, value any) {
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(value)
+}
+func envOr(name, fallback string) string {
+	if value := strings.TrimSpace(os.Getenv(name)); value != "" {
+		return value
+	}
+	return fallback
+}
+func fatal(err error) { fmt.Fprintln(os.Stderr, err); os.Exit(1) }

contracts/artifact/types.go

@@ -5,6 +5,18 @@ import "git.cin.su/m/Assistant/platform/ids"
 import "errors"
 
 type ArtifactID ids.ID
+type MediaArtifact struct {
+	ID                   ArtifactID
+	ContentType          string
+	SizeBytes            int64
+	ContentDigest        string
+	SourceRef            string
+	RecordedAtUnixMillis int64
+}
+
+func (a MediaArtifact) Valid() bool {
+	return a.ID != "" && a.ContentType != "" && a.SizeBytes > 0 && a.ContentDigest != "" && a.SourceRef != "" && a.RecordedAtUnixMillis > 0
+}
 
 type AgentArtifactAttestation struct {
 	ArtifactID          ArtifactID

contracts/authority/control_plane.go

@@ -0,0 +1,14 @@
+package authority
+
+import "git.cin.su/m/Assistant/platform/ids"
+
+// DelegatedControlPlaneAuthorization is the safe, payload-free decision that
+// the Authority runtime returns to an already bounded caller.
+type DelegatedControlPlaneAuthorization struct {
+	AuditID ids.ID
+}
+
+type DelegatedControlPlaneCompletion struct {
+	Request DelegatedControlPlaneRequest
+	Outcome string
+}

contracts/authority/types.go

@@ -13,6 +13,92 @@ type GrantClass string
 
 const GrantClassCreator GrantClass = "CREATOR"
 
+// DelegatedControlPlaneOperation is deliberately a closed, semantic operation
+// set. A service credential cannot turn into arbitrary control-plane access.
+type DelegatedControlPlaneOperation string
+
+const (
+	DelegatedOperationQualifyCognitiveBinding          DelegatedControlPlaneOperation = "QUALIFY_COGNITIVE_BINDING"
+	DelegatedOperationEvaluateCognitiveBinding         DelegatedControlPlaneOperation = "EVALUATE_COGNITIVE_BINDING"
+	DelegatedOperationCanaryCognitiveBinding           DelegatedControlPlaneOperation = "CANARY_COGNITIVE_BINDING"
+	DelegatedOperationActivateCognitiveBinding         DelegatedControlPlaneOperation = "ACTIVATE_VALIDATED_COGNITIVE_BINDING"
+	DelegatedOperationCreateCandidateCapabilityBinding DelegatedControlPlaneOperation = "CREATE_CANDIDATE_CAPABILITY_BINDING"
+	DelegatedOperationUseCandidateCapabilityBinding    DelegatedControlPlaneOperation = "USE_CANDIDATE_CAPABILITY_BINDING"
+	DelegatedOperationRevokeCandidateCapabilityBinding DelegatedControlPlaneOperation = "REVOKE_CANDIDATE_CAPABILITY_BINDING"
+	DelegatedOperationRevokeControlPlaneGrant          DelegatedControlPlaneOperation = "REVOKE_DELEGATED_CONTROL_PLANE_GRANT"
+)
+
+type DelegatedGrantStatus string
+
+const (
+	DelegatedGrantActive  DelegatedGrantStatus = "ACTIVE"
+	DelegatedGrantRevoked DelegatedGrantStatus = "REVOKED"
+)
+
+// CognitiveBindingResource identifies the one governed Capability lifecycle
+// resource to which a task delegation applies. It is intentionally not a
+// general-purpose resource selector.
+type CognitiveBindingResource struct {
+	BindingID          string
+	ProviderInstanceID string
+	ModelDescriptorID  string
+}
+
+// CandidateCapabilityBindingResource is an exact, bounded control-plane
+// resource. Authority does not resolve targets or own Capability state.
+type CandidateCapabilityBindingResource struct {
+	ReleaseSetID  string
+	Slot          string
+	CapabilityID  string
+	ResourceScope string
+	Mode          string
+	TargetKind    string
+	TargetRef     string
+	TargetDigest  string
+}
+
+type DelegatedControlPlaneGrant struct {
+	ID                   GrantID
+	ServiceActorID       identity.ActorID
+	ServicePrincipalID   identity.PrincipalID
+	IssuerPrincipalID    identity.PrincipalID
+	TaskID               string
+	TaskRevision         int64
+	Operations           []DelegatedControlPlaneOperation
+	Resource             CognitiveBindingResource
+	CandidateResource    CandidateCapabilityBindingResource
+	IssuedAtUnixMillis   int64
+	ExpiresAtUnixMillis  int64
+	ArchitectureRevision string
+	Nonce                string
+	Revision             AuthorityRevision
+	Status               DelegatedGrantStatus
+}
+
+type DelegatedControlPlaneRequest struct {
+	GrantID           GrantID
+	TaskID            string
+	TaskRevision      int64
+	Operation         DelegatedControlPlaneOperation
+	Resource          CognitiveBindingResource
+	CandidateResource CandidateCapabilityBindingResource
+}
+
+type DelegatedControlPlaneAudit struct {
+	AuditID              ids.ID
+	GrantID              GrantID
+	ServiceActorID       identity.ActorID
+	ServicePrincipalID   identity.PrincipalID
+	TaskID               string
+	TaskRevision         int64
+	Operation            DelegatedControlPlaneOperation
+	Resource             CognitiveBindingResource
+	CandidateResource    CandidateCapabilityBindingResource
+	Decision             string
+	Outcome              string
+	RecordedAtUnixMillis int64
+}
+
 type Scope struct {
 	ID     ScopeID
 	Global bool

contracts/capability/intelligence.go

@@ -0,0 +1,56 @@
+package capability
+
+type IntelligencePath string
+
+const (
+	PathRule        IntelligencePath = "RULE"
+	PathReflex      IntelligencePath = "REFLEX"
+	PathSkill       IntelligencePath = "SKILL"
+	PathSmallLocal  IntelligencePath = "SMALL_LOCAL"
+	PathStrongLocal IntelligencePath = "STRONG_LOCAL"
+	PathExternal    IntelligencePath = "EXTERNAL"
+	PathResearch    IntelligencePath = "RESEARCH"
+	PathTeam        IntelligencePath = "TEAM"
+)
+
+type StrategyRequest struct {
+	RequiredQuality   int64
+	PreferLowLatency  bool
+	CostBudgetMicros  int64
+	RiskClass         string
+	FreshnessRequired bool
+	CostOfError       int64
+}
+type StrategyDecision struct {
+	Path     IntelligencePath
+	Reason   string
+	Escalate bool
+}
+
+// StrategyEligibility is supplied by Capability lifecycle resolution. It keeps
+// a requested cheap route from becoming an entitlement to use stale evidence.
+type StrategyEligibility struct {
+	RuleEligible   bool
+	ReflexEligible bool
+	SkillEligible  bool
+}
+
+func (r StrategyRequest) Select() StrategyDecision {
+	return r.SelectEligible(StrategyEligibility{RuleEligible: true, ReflexEligible: true, SkillEligible: true})
+}
+
+func (r StrategyRequest) SelectEligible(eligible StrategyEligibility) StrategyDecision {
+	if r.RiskClass == "HIGH" || r.CostOfError >= 800 {
+		return StrategyDecision{Path: PathStrongLocal, Reason: "high consequence requires deeper reasoning", Escalate: true}
+	}
+	if eligible.RuleEligible && r.RequiredQuality <= 500 && r.CostBudgetMicros > 0 {
+		return StrategyDecision{Path: PathRule, Reason: "bounded low-risk path"}
+	}
+	if eligible.ReflexEligible && r.PreferLowLatency {
+		return StrategyDecision{Path: PathReflex, Reason: "latency preference with later escalation"}
+	}
+	if eligible.SkillEligible {
+		return StrategyDecision{Path: PathSkill, Reason: "validated reusable strategy"}
+	}
+	return StrategyDecision{Path: PathSmallLocal, Reason: "no eligible reflex or skill; escalate to reasoning", Escalate: true}
+}

contracts/capability/multimodal.go

@@ -0,0 +1,29 @@
+package capability
+
+// MultimodalOperation identifies one bounded local media skill. It is kept
+// separate from general cognition so health, routing and failure evidence do
+// not collapse into a generic model response.
+type MultimodalOperation string
+
+const (
+	MultimodalTranscribe      MultimodalOperation = "TRANSCRIBE_AUDIO"
+	MultimodalUnderstand      MultimodalOperation = "UNDERSTAND_IMAGE"
+	MultimodalRecognizeOCR    MultimodalOperation = "RECOGNIZE_OCR"
+	MultimodalUnderstandVideo MultimodalOperation = "UNDERSTAND_VIDEO"
+	MultimodalGenerateImage   MultimodalOperation = "GENERATE_IMAGE"
+	MultimodalGenerateVideo   MultimodalOperation = "GENERATE_VIDEO"
+)
+
+type MultimodalResponse struct {
+	Operation        MultimodalOperation `json:"operation"`
+	Text             string              `json:"text"`
+	Provider         string              `json:"provider,omitempty"`
+	ObservedAt       int64               `json:"observed_at_unix_millis"`
+	ConfidenceNote   string              `json:"confidence_note,omitempty"`
+	ContentType      string              `json:"content_type,omitempty"`
+	DataBase64       string              `json:"data_base64,omitempty"`
+	Model            string              `json:"model,omitempty"`
+	ModelVersion     string              `json:"model_version,omitempty"`
+	ConfidenceMillis int64               `json:"confidence_millis,omitempty"`
+	EvidenceRef      string              `json:"evidence_ref,omitempty"`
+}

contracts/capability/reflex_v2.go

@@ -0,0 +1,77 @@
+package capability
+
+type ReflexID string
+type ReflexLifecycle string
+type ReflexKind string
+
+const (
+	ReflexCandidate         ReflexLifecycle = "CANDIDATE"
+	ReflexValidating        ReflexLifecycle = "VALIDATING"
+	ReflexActive            ReflexLifecycle = "ACTIVE"
+	ReflexDegraded          ReflexLifecycle = "DEGRADED"
+	ReflexStale             ReflexLifecycle = "STALE"
+	ReflexRevalidating      ReflexLifecycle = "REVALIDATING"
+	ReflexSuspended         ReflexLifecycle = "SUSPENDED"
+	ReflexRetired           ReflexLifecycle = "RETIRED"
+	ReflexDeterministicCode ReflexKind      = "DETERMINISTIC_CODE"
+	ReflexRule              ReflexKind      = "RULE"
+	ReflexWorkflow          ReflexKind      = "WORKFLOW"
+	ReflexQueryTemplate     ReflexKind      = "QUERY_TEMPLATE"
+	ReflexSmallModelChain   ReflexKind      = "SMALL_MODEL_CHAIN"
+	ReflexBoundedAdapter    ReflexKind      = "BOUNDED_ADAPTER_OPERATION"
+)
+
+type ShadowPolicy struct {
+	Enabled                  bool
+	SampleRateMillis         int64
+	ComparatorRef            string
+	MaxShadowCostMicros      *int64
+	EligibleErrorCostClasses []string
+}
+type RevalidationPolicy struct {
+	MaxAgeMillis                         *int64
+	RevalidateOnDependencyRevisionChange bool
+	RevalidateOnWorldVersionChange       bool
+	RevalidateAfterFailureCount          *int64
+	RevalidateAfterCorrectionCount       *int64
+	SampleAuditRateMillis                *int64
+}
+type Reflex struct {
+	ID             ReflexID
+	PrincipalID    string
+	SourceSkillRef SkillID
+	CreatedAt      int64
+}
+type ReflexRevision struct {
+	ReflexID                   ReflexID
+	Revision                   int64
+	SourceSkillRevision        int64
+	Kind                       ReflexKind
+	Applicability              ApplicabilitySpec
+	ImplementationRef          string
+	ImplementationVersion      string
+	ArtifactDigest             string
+	DependencyRefs             []string
+	ValidationEvidenceRefs     []SkillEvidenceRef
+	KnownFailureExperienceRefs []SkillEvidenceRef
+	Shadow                     ShadowPolicy
+	Revalidation               RevalidationPolicy
+	LastValidatedAt            int64
+	Lifecycle                  ReflexLifecycle
+	RecordedAt                 int64
+	SupersedesRevision         int64
+	ExecutionCount             int64
+	FailureCount               int64
+	DivergenceCount            int64
+}
+
+// ShadowComparison is evidence produced by a bounded shadow sample. It is not
+// permission to rewrite a Reflex; SELF/governed evaluation decide next steps.
+type ShadowComparison struct {
+	ReflexID       ReflexID
+	ReflexRevision int64
+	EvidenceRefs   []SkillEvidenceRef
+	VerifierPassed bool
+	Diverged       bool
+	ObservedAt     int64
+}

contracts/capability/resolution.go

@@ -70,6 +70,7 @@ const (
 	SkillCandidate  SkillLifecycleStatus = "CANDIDATE"
 	SkillEvaluating SkillLifecycleStatus = "EVALUATING"
 	SkillValidated  SkillLifecycleStatus = "VALIDATED"
+	SkillActive     SkillLifecycleStatus = "ACTIVE"
 	SkillDegraded   SkillLifecycleStatus = "DEGRADED"
 	SkillSuspended  SkillLifecycleStatus = "SUSPENDED"
 	SkillRetired    SkillLifecycleStatus = "RETIRED"
@@ -202,6 +203,15 @@ type SkillProfile struct {
 	ObservedFailureCount       int64
 	ObservedCorrectionCount    int64
 	RecordedAtUnixMillis       int64
+	// The fields below are the additive Gen2 lifecycle view. The older fields
+	// remain a compatibility projection; they are not another Skill registry.
+	Applicability             ApplicabilitySpec
+	DependencyRefs            []string
+	ValidationEvidenceRefs    []SkillEvidenceRef
+	IndependentEvaluationRefs []SkillEvidenceRef
+	KnownFailureConditions    []string
+	VerifiedOutcomeCount      int64
+	MustNotWorsenSatisfied    bool
 }
 
 type SkillOutcomeObservation struct {

contracts/capability/skill_v2.go

@@ -0,0 +1,36 @@
+package capability
+
+type SkillID string
+type SkillRevision struct {
+	SkillID                       SkillID
+	Revision                      int64
+	Description                   string
+	Applicability                 ApplicabilitySpec
+	ImplementationRef             string
+	ImplementationVersion         string
+	DependencyRefs                []string
+	SupportingExperienceRefs      []SkillEvidenceRef
+	KnownFailureExperienceRefs    []SkillEvidenceRef
+	ValidationEvidenceRefs        []SkillEvidenceRef
+	QualityAssessmentRefs         []string
+	EnvironmentVersionConstraints []string
+	LastValidatedAt               int64
+	Lifecycle                     SkillLifecycleStatus
+	SupersedesRevision            int64
+	RecordedAt                    int64
+}
+type ApplicabilitySpec struct {
+	RequiredContextBindings  []string
+	PreferredContextBindings []string
+	ExcludedContextBindings  []string
+	RequiredWorldKinds       []string
+	VersionConstraints       []string
+	InputConditions          []string
+	MinimumEvidenceFreshness string
+}
+type Skill struct {
+	ID          SkillID
+	PrincipalID string
+	Name        string
+	CreatedAt   int64
+}

contracts/capability/types.go

@@ -12,10 +12,21 @@ type CapabilityKind string
 type BindingState string
 type BindingProtocol string
 
+// CandidateBindingMode controls how a release-scoped binding may be used.
+// It is deliberately separate from a production BindingState.
+type CandidateBindingMode string
+type CandidateBindingStatus string
+
 const (
 	BindingActive  BindingState = "ACTIVE"
 	BindingRetired BindingState = "RETIRED"
 
+	CandidateBindingModeCandidate CandidateBindingMode = "CANDIDATE"
+	CandidateBindingModeShadow    CandidateBindingMode = "SHADOW"
+
+	CandidateBindingActive  CandidateBindingStatus = "ACTIVE"
+	CandidateBindingRevoked CandidateBindingStatus = "REVOKED"
+
 	ProtocolIdempotentReceiptV1 BindingProtocol = "IDEMPOTENT_RECEIPT_V1"
 
 	CapabilityKindReadEmail          CapabilityKind = "READ_EMAIL"
@@ -29,6 +40,12 @@ const (
 	CapabilityKindCognitiveReasoning CapabilityKind = "COGNITIVE_REASONING"
 	CapabilityKindScheduleReminder   CapabilityKind = "SCHEDULE_REMINDER"
 	CapabilityKindVerifyFact         CapabilityKind = "VERIFY_FACT"
+	CapabilityKindSpeechToText       CapabilityKind = "SPEECH_TO_TEXT"
+	CapabilityKindImageUnderstanding CapabilityKind = "IMAGE_UNDERSTANDING"
+	CapabilityKindOCR                CapabilityKind = "OCR"
+	CapabilityKindVideoUnderstanding CapabilityKind = "VIDEO_UNDERSTANDING"
+	CapabilityKindImageGeneration    CapabilityKind = "IMAGE_GENERATION"
+	CapabilityKindVideoGeneration    CapabilityKind = "VIDEO_GENERATION"
 )
 
 // Binding is Capability-owned correctness state. SecretRef is an opaque
@@ -48,6 +65,48 @@ type Binding struct {
 	Health               HealthState
 }
 
+// CandidateReleaseContext is supplied by a candidate runtime, not inferred
+// from a host name or process-local state. It scopes dynamic capability
+// resolution to one release slot and task.
+type CandidateReleaseContext struct {
+	ReleaseSetID     string
+	Slot             string
+	TaskID           string
+	TaskRevision     int64
+	PrincipalID      identity.PrincipalID
+	CapabilityID     CapabilityID
+	ResourceScope    string
+	Mode             CandidateBindingMode
+	TargetKind       string
+	TargetRef        string
+	TargetDigest     string
+	AuthorityGrantID string
+}
+
+// CandidateBinding is Capability-owned release-scoped state. TargetOrigin is
+// intentionally distinct from Binding.HTTPSOrigin: a SHADOW target can be an
+// internal candidate receiver and must never be promoted into the ACTIVE head.
+type CandidateBinding struct {
+	ID                        CapabilityBindingID
+	Revision                  int64
+	BaseActiveBindingID       CapabilityBindingID
+	BaseActiveBindingRevision int64
+	Context                   CandidateReleaseContext
+	TargetOrigin              string
+	DeliveryPath              string
+	ReceiptPath               string
+	Protocol                  BindingProtocol
+	CreatedAtUnixMillis       int64
+	ExpiresAtUnixMillis       int64
+	Status                    CandidateBindingStatus
+}
+
+type CandidateBindingResolution struct {
+	Binding CandidateBinding
+	Mode    CandidateBindingMode
+	Reason  string
+}
+
 type HealthState string
 
 const (

contracts/cognitive/context_compiler.go

@@ -11,14 +11,24 @@ import (
 var ErrInvalidContextBudget = errors.New("context budget must be positive")
 
 type ContextCandidate struct {
-	Excerpt   ContextExcerpt
-	Relevance int
+	Excerpt         ContextExcerpt
+	Relevance       int
+	Lane            string
+	ContextScopeRef string
+	FreshnessState  string
+	Negative        bool
 }
 
 type ContextCompileInput struct {
-	Candidates []ContextCandidate
-	DataPolicy capability.DataPolicy
-	MaxBytes   int
+	Candidates           []ContextCandidate
+	DataPolicy           capability.DataPolicy
+	MaxBytes             int
+	TaskRef              string
+	FocusFrameRef        string
+	ContextScopeRef      string
+	FreshnessRequirement string
+	RiskClass            string
+	TokenBudget          int
 }
 
 type ContextOmission struct {
@@ -26,10 +36,77 @@ type ContextOmission struct {
 	Reason string
 }
 
+// ContextInclusion records the bounded compiler decision without exposing
+// source text. It is trace-only metadata and is never user-facing output.
+type ContextInclusion struct {
+	ID     ContextExcerptID
+	Lane   string
+	Reason string
+}
+
 type ContextBundle struct {
 	Excerpts  []ContextExcerpt
 	Omissions []ContextOmission
 	Bytes     int
+	Trace     ContextAssemblyTrace
+}
+
+type ContextAssemblyTrace struct {
+	Included        []ContextExcerptID
+	Inclusions      []ContextInclusion
+	Excluded        []ContextOmission
+	Coverage        string
+	CompilerVersion string
+}
+
+type IterativeRetrievalLane string
+
+const (
+	IterativeRetrievalCurrentFact        IterativeRetrievalLane = "CURRENT_FACT"
+	IterativeRetrievalPositiveExperience IterativeRetrievalLane = "POSITIVE_EXPERIENCE"
+	IterativeRetrievalNegativeExperience IterativeRetrievalLane = "NEGATIVE_EXPERIENCE"
+	IterativeRetrievalContradiction      IterativeRetrievalLane = "CONTRADICTION"
+	IterativeRetrievalHistoricalAnalogy  IterativeRetrievalLane = "HISTORICAL_ANALOGY"
+)
+
+// IterativeRetrievalRequest is the model-visible, storage-agnostic intent.
+// Principal, Scope, Focus and policy are deliberately absent: Core binds them
+// from the already-authorized request and never accepts them from a model.
+type IterativeRetrievalRequest struct {
+	Query           string
+	SemanticSubject string
+	Lane            IterativeRetrievalLane
+	Reason          string
+	RemainingBytes  int
+	Pass            int
+}
+
+// IterativeRetrievalBudget is a Core-enforced per-request budget.
+type IterativeRetrievalBudget struct {
+	MaxRounds        int
+	MaxFragments     int
+	MaxAddedBytes    int
+	MaxLatencyMillis int64
+}
+
+// IterativeRetrievalEnvelope is the trusted continuation input assembled by
+// Core. It is never produced by a provider or model adapter.
+type IterativeRetrievalEnvelope struct {
+	Request              IterativeRetrievalRequest
+	PrincipalID          string
+	ContextScopeRef      string
+	FocusFrameRef        string
+	TaskRef              string
+	FreshnessRequirement string
+	DataPolicy           capability.DataPolicy
+	Budget               IterativeRetrievalBudget
+	SeenExcerptIDs       []ContextExcerptID
+}
+type IterativeRetrievalResponse struct {
+	Candidates []ContextCandidate
+	Exhausted  bool
+	Reason     string
+	AddedBytes int
 }
 
 // CompileContext deterministically selects permitted, relevant excerpts for a
@@ -39,14 +116,9 @@ func CompileContext(input ContextCompileInput) (ContextBundle, error) {
 		return ContextBundle{}, ErrInvalidContextBudget
 	}
 	candidates := append([]ContextCandidate(nil), input.Candidates...)
-	sort.SliceStable(candidates, func(i, j int) bool {
-		if candidates[i].Relevance != candidates[j].Relevance {
-			return candidates[i].Relevance > candidates[j].Relevance
-		}
-		return string(candidates[i].Excerpt.ID) < string(candidates[j].Excerpt.ID)
-	})
 	bundle := ContextBundle{Excerpts: []ContextExcerpt{}, Omissions: []ContextOmission{}}
 	seen := make(map[ContextExcerptID]struct{}, len(candidates))
+	eligible := make([]ContextCandidate, 0, len(candidates))
 	for _, candidate := range candidates {
 		excerpt := candidate.Excerpt
 		if _, ok := seen[excerpt.ID]; ok {
@@ -54,8 +126,11 @@ func CompileContext(input ContextCompileInput) (ContextBundle, error) {
 			continue
 		}
 		seen[excerpt.ID] = struct{}{}
-		reason := permittedContextReason(excerpt, input.DataPolicy)
-		if reason != "" {
+		if input.ContextScopeRef != "" && candidate.ContextScopeRef != input.ContextScopeRef {
+			bundle.Omissions = append(bundle.Omissions, ContextOmission{ID: excerpt.ID, Reason: "context_scope"})
+			continue
+		}
+		if reason := permittedContextReason(excerpt, input.DataPolicy); reason != "" {
 			bundle.Omissions = append(bundle.Omissions, ContextOmission{ID: excerpt.ID, Reason: reason})
 			continue
 		}
@@ -63,14 +138,49 @@ func CompileContext(input ContextCompileInput) (ContextBundle, error) {
 			bundle.Omissions = append(bundle.Omissions, ContextOmission{ID: excerpt.ID, Reason: "empty"})
 			continue
 		}
+		eligible = append(eligible, candidate)
+	}
+	candidates = eligible
+	sort.SliceStable(candidates, func(i, j int) bool {
+		if candidates[i].Relevance != candidates[j].Relevance {
+			return candidates[i].Relevance > candidates[j].Relevance
+		}
+		return string(candidates[i].Excerpt.ID) < string(candidates[j].Excerpt.ID)
+	})
+	included := make(map[ContextExcerptID]struct{}, len(candidates))
+	include := func(candidate ContextCandidate, reason string) bool {
+		excerpt := candidate.Excerpt
 		bytes := len([]byte(excerpt.Text))
 		if bundle.Bytes+bytes > input.MaxBytes {
-			bundle.Omissions = append(bundle.Omissions, ContextOmission{ID: excerpt.ID, Reason: "budget"})
-			continue
+			return false
 		}
 		bundle.Excerpts = append(bundle.Excerpts, excerpt)
 		bundle.Bytes += bytes
+		bundle.Trace.Included = append(bundle.Trace.Included, excerpt.ID)
+		bundle.Trace.Inclusions = append(bundle.Trace.Inclusions, ContextInclusion{ID: excerpt.ID, Lane: candidate.Lane, Reason: reason})
+		included[excerpt.ID] = struct{}{}
+		return true
 	}
+	// Preserve one candidate from each semantic lane before filling by score so
+	// many similar current facts cannot erase a relevant failure or conflict.
+	for _, lane := range []string{"current-fact", "positive-experience", "negative-experience", "contradiction", "historical-analogy", "interaction"} {
+		for _, candidate := range candidates {
+			if candidate.Lane == lane && include(candidate, "lane_coverage") {
+				break
+			}
+		}
+	}
+	for _, candidate := range candidates {
+		if _, ok := included[candidate.Excerpt.ID]; ok {
+			continue
+		}
+		if !include(candidate, "salience") {
+			bundle.Omissions = append(bundle.Omissions, ContextOmission{ID: candidate.Excerpt.ID, Reason: "budget"})
+		}
+	}
+	bundle.Trace.Excluded = append([]ContextOmission(nil), bundle.Omissions...)
+	bundle.Trace.CompilerVersion = "context-compiler-v2-additive"
+	bundle.Trace.Coverage = "BOUNDED"
 	return bundle, nil
 }
 

contracts/cognitive/context_compiler_v2_test.go

@@ -0,0 +1,30 @@
+package cognitive_test
+
+import (
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/cognitive"
+	"testing"
+)
+
+func TestContextCompilerV2TraceAndBudgetRemainDeterministic(t *testing.T) {
+	b, err := cognitive.CompileContext(cognitive.ContextCompileInput{MaxBytes: 5, DataPolicy: capability.DataPolicyLocalOnly, TaskRef: "task", FocusFrameRef: "frame", ContextScopeRef: "company-a", Candidates: []cognitive.ContextCandidate{{Excerpt: cognitive.ContextExcerpt{ID: "a", Text: "123", Sensitivity: cognitive.SensitivityPrivateAllowed}, ContextScopeRef: "company-a", Relevance: 10}, {Excerpt: cognitive.ContextExcerpt{ID: "b", Text: "123456", Sensitivity: cognitive.SensitivityPrivateAllowed}, ContextScopeRef: "company-b", Relevance: 100}}})
+	if err != nil || len(b.Excerpts) != 1 || len(b.Trace.Excluded) != 1 {
+		t.Fatalf("bundle=%#v err=%v", b, err)
+	}
+}
+
+func TestContextCompilerPreservesNegativeLaneWithinBoundedBudget(t *testing.T) {
+	b, err := cognitive.CompileContext(cognitive.ContextCompileInput{MaxBytes: 27, DataPolicy: capability.DataPolicyLocalOnly, Candidates: []cognitive.ContextCandidate{
+		{Excerpt: cognitive.ContextExcerpt{ID: "current", Text: "current-value", Sensitivity: cognitive.SensitivityPrivateAllowed}, Lane: "current-fact", Relevance: 100},
+		{Excerpt: cognitive.ContextExcerpt{ID: "failure", Text: "known-failure", Sensitivity: cognitive.SensitivityPrivateAllowed}, Lane: "negative-experience", Relevance: 1, Negative: true},
+		{Excerpt: cognitive.ContextExcerpt{ID: "crowd", Text: "similar-current", Sensitivity: cognitive.SensitivityPrivateAllowed}, Lane: "current-fact", Relevance: 99},
+	}})
+	if err != nil || len(b.Excerpts) != 2 || b.Excerpts[0].ID != "current" || b.Excerpts[1].ID != "failure" {
+		t.Fatalf("bundle=%#v err=%v", b, err)
+	}
+	// The negative record fits and is retained before a lower-value crowd of
+	// similar facts can consume the remaining bounded budget.
+	if len(b.Trace.Inclusions) != 2 || b.Trace.Inclusions[0].Reason != "lane_coverage" || b.Trace.Inclusions[1].Reason != "lane_coverage" {
+		t.Fatalf("trace=%#v", b.Trace)
+	}
+}

contracts/cognitive/types.go

@@ -69,18 +69,19 @@ type AdvisoryRequest struct {
 // GatewayAdvisoryRequest describes the task and policy requirement. It cannot
 // name a provider, model or binding; Capability owns that selection.
 type GatewayAdvisoryRequest struct {
-	Version            ContractVersion
-	RequestID          RequestID
-	ActorID            identity.ActorID
-	PrincipalID        identity.PrincipalID
-	ScopeID            authority.ScopeID
-	Message            string
-	Context            []ContextExcerpt
-	Locale             string
-	MaxOutputBytes     int
-	DataPolicy         capability.DataPolicy
-	EgressAcknowledged bool
-	Meaning            TaskMeaning
+	Version                 ContractVersion
+	RequestID               RequestID
+	ActorID                 identity.ActorID
+	PrincipalID             identity.PrincipalID
+	ScopeID                 authority.ScopeID
+	Message                 string
+	Context                 []ContextExcerpt
+	Locale                  string
+	MaxOutputBytes          int
+	DataPolicy              capability.DataPolicy
+	EgressAcknowledged      bool
+	AllowIterativeRetrieval bool
+	Meaning                 TaskMeaning
 }
 
 // TaskMeaning is the trusted semantic summary produced by Core. It is not a
@@ -177,4 +178,5 @@ type GatewayAdvisoryResponse struct {
 	ReferencedExcerptIDs []ContextExcerptID
 	FinishReason         FinishReason
 	Usage                *ProviderUsage
+	IterativeRetrieval   *IterativeRetrievalRequest
 }

contracts/commit/execution_receipt.go

@@ -0,0 +1,40 @@
+package commit
+
+type ExecutorResult string
+type AmbiguityState string
+
+const (
+	ExecutorAccepted        ExecutorResult = "ACCEPTED"
+	ExecutorReportedSuccess ExecutorResult = "REPORTED_SUCCESS"
+	ExecutorReportedFailure ExecutorResult = "REPORTED_FAILURE"
+	ExecutorNoResponse      ExecutorResult = "NO_RESPONSE"
+	ExecutorAmbiguous       ExecutorResult = "AMBIGUOUS"
+)
+
+type ExecutionReceipt struct {
+	ID                        string
+	ActionAttemptRef          ActionAttemptID
+	ExecutorImplementationRef string
+	ExternalOperationRef      string
+	ExternalRequestID         string
+	RequestDigest             string
+	ResponseDigest            string
+	DispatchAtUnixMillis      int64
+	CompletedAtUnixMillis     *int64
+	ExecutorResult            ExecutorResult
+	Ambiguity                 AmbiguityState
+	ReconciliationKey         string
+	RawArtifactRef            string
+	DeliveryMode              string
+	ExternalDeliveryAttempted bool
+	ReleaseSetID              string
+	TaskID                    string
+	TaskRevision              int64
+	CapabilityBindingID       string
+	CapabilityBindingRevision int64
+	TargetReference           string
+}
+
+func (r ExecutionReceipt) Valid() bool {
+	return r.ID != "" && r.ActionAttemptRef != "" && r.ExecutorImplementationRef != "" && r.RequestDigest != "" && r.ExecutorResult != "" && r.ReconciliationKey != "" && r.DispatchAtUnixMillis > 0
+}