feat(cognitive): execute bounded task evaluation cases

adapters/postgres/capability_repository.go

@@ -437,6 +437,24 @@ func (r *CapabilityRepository) LoadCognitiveCandidatesForProfile(ctx context.Con
 	return r.loadCognitiveCandidates(ctx, capabilityID, owner, profileID)
 }
 
+func (r *CapabilityRepository) LoadCognitiveCandidate(ctx context.Context, bindingID capability.CapabilityBindingID, revision int64) (capability.ResolvedCognitiveBinding, error) {
+	var capabilityID capability.CapabilityID
+	var owner identity.PrincipalID
+	if err := r.pool.QueryRow(ctx, `SELECT capability_id,owner_principal_id FROM capability.cognitive_bindings WHERE binding_id=$1 AND revision=$2`, bindingID, revision).Scan(&capabilityID, &owner); err != nil {
+		return capability.ResolvedCognitiveBinding{}, err
+	}
+	candidates, err := r.loadCognitiveCandidates(ctx, capabilityID, owner, "")
+	if err != nil {
+		return capability.ResolvedCognitiveBinding{}, err
+	}
+	for _, candidate := range candidates {
+		if candidate.Binding.ID == bindingID && candidate.Binding.Revision == revision {
+			return candidate, nil
+		}
+	}
+	return capability.ResolvedCognitiveBinding{}, pgx.ErrNoRows
+}
+
 func (r *CapabilityRepository) loadCognitiveCandidates(ctx context.Context, capabilityID capability.CapabilityID, owner identity.PrincipalID, profileID capability.TaskEvaluationProfileID) ([]capability.ResolvedCognitiveBinding, error) {
 	rows, err := r.pool.Query(ctx, `SELECT
 		b.binding_id,b.revision,b.capability_id,b.owner_principal_id,b.provider_instance_id,b.provider_revision,b.model_descriptor_id,b.model_revision,b.data_policy,b.qualification,b.activation,b.health,b.limit_policy_ref,

adapters/postgres/work_repository.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"slices"
 	"time"
 
 	"git.cin.su/m/Assistant/contracts/work"
@@ -106,24 +107,28 @@ func (r *WorkRepository) SaveDispatchIntent(ctx context.Context, intent work.Age
 		return err
 	}
 	defer tx.Rollback(ctx)
-	_, err = tx.Exec(ctx, `INSERT INTO work.agent_dispatch_intents(dispatch_id,idempotency_key,delegation_id,run_id,implementation_id,implementation_revision,source_revision,worktree_id,verification_plan_ref,created_at_unix_millis) VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10) ON CONFLICT(idempotency_key) DO NOTHING`, intent.DispatchID, intent.IdempotencyKey, intent.DelegationID, intent.RunID, intent.ImplementationID, intent.ImplementationRevision, intent.SourceRevision, intent.WorktreeID, intent.VerificationPlanRef, intent.CreatedAtUnixMillis)
+	_, err = tx.Exec(ctx, `INSERT INTO work.agent_dispatch_intents(dispatch_id,idempotency_key,delegation_id,run_id,implementation_id,implementation_revision,source_revision,worktree_id,verification_plan_ref,created_at_unix_millis,specialist_purpose,task_evaluation_profile_id,task_evaluation_binding_id,task_evaluation_case_ids) VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14) ON CONFLICT(idempotency_key) DO NOTHING`, intent.DispatchID, intent.IdempotencyKey, intent.DelegationID, intent.RunID, intent.ImplementationID, intent.ImplementationRevision, intent.SourceRevision, intent.WorktreeID, intent.VerificationPlanRef, intent.CreatedAtUnixMillis, intent.SpecialistPurpose, intent.TaskEvaluationProfileID, intent.TaskEvaluationBindingID, intent.TaskEvaluationCaseIDs)
 	if err != nil {
 		return fmt.Errorf("save dispatch intent: %w", err)
 	}
 	var existing work.AgentDispatchIntent
-	err = tx.QueryRow(ctx, `SELECT dispatch_id,idempotency_key,delegation_id,run_id,implementation_id,implementation_revision,source_revision,worktree_id,verification_plan_ref,created_at_unix_millis FROM work.agent_dispatch_intents WHERE idempotency_key=$1`, intent.IdempotencyKey).Scan(&existing.DispatchID, &existing.IdempotencyKey, &existing.DelegationID, &existing.RunID, &existing.ImplementationID, &existing.ImplementationRevision, &existing.SourceRevision, &existing.WorktreeID, &existing.VerificationPlanRef, &existing.CreatedAtUnixMillis)
+	err = tx.QueryRow(ctx, `SELECT dispatch_id,idempotency_key,delegation_id,run_id,implementation_id,implementation_revision,source_revision,worktree_id,verification_plan_ref,created_at_unix_millis,specialist_purpose,task_evaluation_profile_id,task_evaluation_binding_id,task_evaluation_case_ids FROM work.agent_dispatch_intents WHERE idempotency_key=$1`, intent.IdempotencyKey).Scan(&existing.DispatchID, &existing.IdempotencyKey, &existing.DelegationID, &existing.RunID, &existing.ImplementationID, &existing.ImplementationRevision, &existing.SourceRevision, &existing.WorktreeID, &existing.VerificationPlanRef, &existing.CreatedAtUnixMillis, &existing.SpecialistPurpose, &existing.TaskEvaluationProfileID, &existing.TaskEvaluationBindingID, &existing.TaskEvaluationCaseIDs)
 	if err != nil {
 		return fmt.Errorf("read dispatch intent: %w", err)
 	}
-	if existing != intent {
+	if !sameDispatchIntent(existing, intent) {
 		return ErrDispatchIntentConflict
 	}
 	return tx.Commit(ctx)
 }
 
+func sameDispatchIntent(left, right work.AgentDispatchIntent) bool {
+	return left.DispatchID == right.DispatchID && left.IdempotencyKey == right.IdempotencyKey && left.DelegationID == right.DelegationID && left.RunID == right.RunID && left.ImplementationID == right.ImplementationID && left.ImplementationRevision == right.ImplementationRevision && left.SourceRevision == right.SourceRevision && left.WorktreeID == right.WorktreeID && left.VerificationPlanRef == right.VerificationPlanRef && left.CreatedAtUnixMillis == right.CreatedAtUnixMillis && left.SpecialistPurpose == right.SpecialistPurpose && left.TaskEvaluationProfileID == right.TaskEvaluationProfileID && left.TaskEvaluationBindingID == right.TaskEvaluationBindingID && slices.Equal(left.TaskEvaluationCaseIDs, right.TaskEvaluationCaseIDs)
+}
+
 func (r *WorkRepository) LoadDispatchIntent(ctx context.Context, dispatchID string) (work.AgentDispatchIntent, error) {
 	var intent work.AgentDispatchIntent
-	err := r.pool.QueryRow(ctx, `SELECT dispatch_id,idempotency_key,delegation_id,run_id,implementation_id,implementation_revision,source_revision,worktree_id,verification_plan_ref,created_at_unix_millis FROM work.agent_dispatch_intents WHERE dispatch_id=$1`, dispatchID).Scan(&intent.DispatchID, &intent.IdempotencyKey, &intent.DelegationID, &intent.RunID, &intent.ImplementationID, &intent.ImplementationRevision, &intent.SourceRevision, &intent.WorktreeID, &intent.VerificationPlanRef, &intent.CreatedAtUnixMillis)
+	err := r.pool.QueryRow(ctx, `SELECT dispatch_id,idempotency_key,delegation_id,run_id,implementation_id,implementation_revision,source_revision,worktree_id,verification_plan_ref,created_at_unix_millis,specialist_purpose,task_evaluation_profile_id,task_evaluation_binding_id,task_evaluation_case_ids FROM work.agent_dispatch_intents WHERE dispatch_id=$1`, dispatchID).Scan(&intent.DispatchID, &intent.IdempotencyKey, &intent.DelegationID, &intent.RunID, &intent.ImplementationID, &intent.ImplementationRevision, &intent.SourceRevision, &intent.WorktreeID, &intent.VerificationPlanRef, &intent.CreatedAtUnixMillis, &intent.SpecialistPurpose, &intent.TaskEvaluationProfileID, &intent.TaskEvaluationBindingID, &intent.TaskEvaluationCaseIDs)
 	if err != nil {
 		return work.AgentDispatchIntent{}, fmt.Errorf("load dispatch intent: %w", err)
 	}
@@ -191,11 +196,11 @@ func (r *WorkRepository) SaveWorkGraph(ctx context.Context, graph work.WorkGraph
 		return err
 	}
 	defer tx.Rollback(ctx)
-	if _, err := tx.Exec(ctx, `INSERT INTO work.graphs(graph_id,revision,state,max_parallel,max_attempts) VALUES($1,$2,$3,$4,$5) ON CONFLICT(graph_id,revision) DO NOTHING`, graph.ID, graph.Revision, graph.State, graph.Budget.MaxParallel, graph.Budget.MaxAttempts); err != nil {
+	if _, err := tx.Exec(ctx, `INSERT INTO work.graphs(graph_id,revision,state,max_parallel,max_attempts,parent_graph_id,parent_graph_revision,trigger_evidence_ref) VALUES($1,$2,$3,$4,$5,$6,$7,$8) ON CONFLICT(graph_id,revision) DO NOTHING`, graph.ID, graph.Revision, graph.State, graph.Budget.MaxParallel, graph.Budget.MaxAttempts, graph.ParentGraphID, graph.ParentGraphRevision, graph.TriggerEvidenceRef); err != nil {
 		return err
 	}
 	for _, node := range graph.Nodes {
-		if _, err := tx.Exec(ctx, `INSERT INTO work.graph_nodes(graph_id,revision,node_id,dispatch_id,idempotency_key,state,attempts) VALUES($1,$2,$3,$4,$5,$6,$7) ON CONFLICT(graph_id,revision,node_id) DO NOTHING`, graph.ID, graph.Revision, node.ID, node.DispatchID, node.IdempotencyKey, node.State, node.Attempts); err != nil {
+		if _, err := tx.Exec(ctx, `INSERT INTO work.graph_nodes(graph_id,revision,node_id,dispatch_id,idempotency_key,state,attempts,purpose,task_profile_id,binding_id,case_ids) VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11) ON CONFLICT(graph_id,revision,node_id) DO NOTHING`, graph.ID, graph.Revision, node.ID, node.DispatchID, node.IdempotencyKey, node.State, node.Attempts, node.Purpose, node.TaskProfileID, node.BindingID, node.CaseIDs); err != nil {
 			return err
 		}
 	}
@@ -209,17 +214,17 @@ func (r *WorkRepository) SaveWorkGraph(ctx context.Context, graph work.WorkGraph
 
 func (r *WorkRepository) LoadWorkGraph(ctx context.Context, graphID string, revision int64) (work.WorkGraph, error) {
 	var graph work.WorkGraph
-	err := r.pool.QueryRow(ctx, `SELECT graph_id,revision,state,max_parallel,max_attempts FROM work.graphs WHERE graph_id=$1 AND revision=$2`, graphID, revision).Scan(&graph.ID, &graph.Revision, &graph.State, &graph.Budget.MaxParallel, &graph.Budget.MaxAttempts)
+	err := r.pool.QueryRow(ctx, `SELECT graph_id,revision,state,max_parallel,max_attempts,parent_graph_id,parent_graph_revision,trigger_evidence_ref FROM work.graphs WHERE graph_id=$1 AND revision=$2`, graphID, revision).Scan(&graph.ID, &graph.Revision, &graph.State, &graph.Budget.MaxParallel, &graph.Budget.MaxAttempts, &graph.ParentGraphID, &graph.ParentGraphRevision, &graph.TriggerEvidenceRef)
 	if err != nil {
 		return work.WorkGraph{}, fmt.Errorf("load graph: %w", err)
 	}
-	rows, err := r.pool.Query(ctx, `SELECT node_id,dispatch_id,idempotency_key,state,attempts FROM work.graph_nodes WHERE graph_id=$1 AND revision=$2 ORDER BY node_id`, graphID, revision)
+	rows, err := r.pool.Query(ctx, `SELECT node_id,dispatch_id,idempotency_key,state,attempts,purpose,task_profile_id,binding_id,case_ids FROM work.graph_nodes WHERE graph_id=$1 AND revision=$2 ORDER BY node_id`, graphID, revision)
 	if err != nil {
 		return work.WorkGraph{}, err
 	}
 	for rows.Next() {
 		var node work.GraphNode
-		if err := rows.Scan(&node.ID, &node.DispatchID, &node.IdempotencyKey, &node.State, &node.Attempts); err != nil {
+		if err := rows.Scan(&node.ID, &node.DispatchID, &node.IdempotencyKey, &node.State, &node.Attempts, &node.Purpose, &node.TaskProfileID, &node.BindingID, &node.CaseIDs); err != nil {
 			rows.Close()
 			return work.WorkGraph{}, err
 		}

cmd/cognitive-worker/gateway.go

@@ -26,6 +26,10 @@ type bindingResolver interface {
 	RegisterDiscovery(context.Context, capability.CognitiveDiscoverySnapshot) (capability.CognitiveDiscoveryRegistration, error)
 }
 
+type candidateBindingResolver interface {
+	ResolveCandidate(context.Context, capability.CapabilityBindingID, int64) (capability.ResolvedCognitiveBinding, error)
+}
+
 type admissionClient interface {
 	Admit(context.Context, string, capability.AdmissionRequest) (capability.AdmissionDecision, capability.AdmissionLease, error)
 	Release(context.Context, capability.AdmissionLease) error
@@ -341,6 +345,26 @@ func (r *httpBindingResolver) Resolve(ctx context.Context, value capability.Cogn
 	return result, err
 }
 
+func (r *httpBindingResolver) ResolveCandidate(ctx context.Context, bindingID capability.CapabilityBindingID, revision int64) (capability.ResolvedCognitiveBinding, error) {
+	var result capability.ResolvedCognitiveBinding
+	target := *r.base
+	target.Path = "/v1/cognitive-bindings/" + url.PathEscape(string(bindingID)) + "/revisions/" + fmt.Sprint(revision) + "/snapshot"
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, target.String(), nil)
+	if err != nil {
+		return result, err
+	}
+	response, err := r.client.Do(request)
+	if err != nil {
+		return result, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		return result, fmt.Errorf("candidate status %d", response.StatusCode)
+	}
+	err = json.NewDecoder(io.LimitReader(response.Body, 64<<10)).Decode(&result)
+	return result, err
+}
+
 func (r *httpBindingResolver) Observe(ctx context.Context, value capability.CognitiveUsageObservation) error {
 	return r.post(ctx, "/v1/cognitive-usage-observations", value, nil)
 }

cmd/cognitive-worker/main.go

@@ -166,6 +166,7 @@ func main() {
 	mux.HandleFunc("POST /v1/advisory-policy", gateway.policyHandler)
 	mux.HandleFunc("POST /v1/advisories", gateway.advisoryHandler)
 	mux.HandleFunc("POST /v1/interpretations", gateway.interpretationHandler)
+	mux.HandleFunc("POST /v1/task-evaluations/execute", gateway.taskEvaluationHandler)
 	discovery := discoveryService{resolver: resolver, providers: discoveries, owner: identity.PrincipalID(envOr("COGNITIVE_OWNER_PRINCIPAL_ID", "domovoy-creator-principal")), now: time.Now}
 	mux.HandleFunc("POST /v1/provider-discovery/{provider}", discovery.handler)
 	refreshProviderDiscoveries(resolver, discovery)

cmd/cognitive-worker/task_evaluation.go

@@ -0,0 +1,93 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"sync"
+	"time"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/cognitive"
+)
+
+func (g cognitiveGateway) taskEvaluationHandler(w http.ResponseWriter, r *http.Request) {
+	var request capability.TaskEvaluationExecutionRequest
+	if !decodeJSON(w, r, 256<<10, &request) {
+		return
+	}
+	if err := request.Profile.Validate(); err != nil || request.CapabilityID == "" || request.CapabilityID != request.Profile.CapabilityID || request.BindingID == "" || request.BindingRevision < 1 || request.ActorID == "" || request.PrincipalID == "" || request.ScopeID == "" || request.MaxOutputBytes < 1 || len(request.Cases) != len(request.Profile.RequiredCaseIDs) {
+		http.Error(w, "invalid task evaluation execution request", http.StatusBadRequest)
+		return
+	}
+	resolver, ok := g.resolver.(candidateBindingResolver)
+	if !ok {
+		http.Error(w, "exact candidate resolver unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	selected, err := resolver.ResolveCandidate(r.Context(), request.BindingID, request.BindingRevision)
+	if err != nil || selected.Binding.ID != request.BindingID || selected.Binding.Revision != request.BindingRevision || selected.Binding.CapabilityID != request.CapabilityID || selected.Binding.OwnerPrincipalID != request.PrincipalID {
+		http.Error(w, "cognitive binding snapshot unavailable", http.StatusConflict)
+		return
+	}
+	if selected.Binding.DataPolicy != capability.DataPolicyLocalOnly && !request.EgressAcknowledged {
+		http.Error(w, "external egress acknowledgement required", http.StatusBadRequest)
+		return
+	}
+	provider := g.provider(selected)
+	if provider == nil {
+		http.Error(w, "cognitive provider unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	caseSet := make(map[string]struct{}, len(request.Profile.RequiredCaseIDs))
+	for _, id := range request.Profile.RequiredCaseIDs {
+		caseSet[id] = struct{}{}
+	}
+	observations := make([]capability.TaskCaseObservation, len(request.Cases))
+	var wg sync.WaitGroup
+	seenCases := make(map[string]struct{}, len(request.Cases))
+	for i, item := range request.Cases {
+		if item.CaseID == "" || item.Prompt == "" || item.EvidenceArtifactRef == "" {
+			http.Error(w, "invalid task evaluation case", http.StatusBadRequest)
+			return
+		}
+		if _, exists := caseSet[item.CaseID]; !exists {
+			http.Error(w, "task evaluation case is not in profile", http.StatusBadRequest)
+			return
+		}
+		if _, exists := seenCases[item.CaseID]; exists {
+			http.Error(w, "duplicate task evaluation case", http.StatusBadRequest)
+			return
+		}
+		seenCases[item.CaseID] = struct{}{}
+		wg.Add(1)
+		go func(index int, item capability.TaskEvaluationCase) {
+			defer wg.Done()
+			started := time.Now()
+			invocation := cognitive.AdvisoryRequest{Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(fmt.Sprintf("task-evaluation:%s:%s", request.Profile.ID, item.CaseID)), ActorID: request.ActorID, PrincipalID: request.PrincipalID, ScopeID: request.ScopeID, Message: item.Prompt, MaxOutputBytes: int(request.MaxOutputBytes), ProviderBindingID: selected.Binding.ID, ProviderBindingRevision: selected.Binding.Revision, ProviderInstanceID: selected.Provider.ID, ModelDescriptorID: selected.Model.ID, ProviderModelID: selected.Model.ProviderModelID}
+			response, invokeErr := g.invokeAdmitted(r.Context(), string(invocation.RequestID), provider, invocation, int(request.MaxOutputBytes))
+			observation := capability.TaskCaseObservation{CaseID: item.CaseID, LatencyMicros: time.Since(started).Microseconds(), EvidenceArtifactRef: item.EvidenceArtifactRef}
+			if invokeErr == nil && response.FinishReason == cognitive.FinishCompleted && response.AdvisoryText != "" {
+				observation.Result = capability.EvaluationSupported
+				// Invocation success proves reachability/support for this case,
+				// not semantic answer quality. A verifier may score quality later.
+				observation.QualityScoreMillis = 0
+			} else {
+				observation.Result = capability.EvaluationUnknown
+				observation.CriticalFailure = invokeErr != nil
+			}
+			observations[index] = observation
+		}(i, item)
+	}
+	if len(seenCases) != len(caseSet) {
+		http.Error(w, "task evaluation case set is incomplete", http.StatusBadRequest)
+		return
+	}
+	wg.Wait()
+	writeTaskEvaluationJSON(w, capability.TaskEvaluationExecutionResponse{ProfileID: request.Profile.ID, BindingID: selected.Binding.ID, BindingRevision: selected.Binding.Revision, Observations: observations, ObservedAtUnixMillis: time.Now().UnixMilli()})
+}
+
+func writeTaskEvaluationJSON(w http.ResponseWriter, value any) {
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(value)
+}

cmd/cognitive-worker/task_evaluation_test.go

@@ -0,0 +1,53 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"git.cin.su/m/Assistant/contracts/authority"
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/cognitive"
+	"git.cin.su/m/Assistant/contracts/identity"
+)
+
+type candidateRegistryStub struct {
+	registryStub
+	selected capability.ResolvedCognitiveBinding
+}
+
+func (s *candidateRegistryStub) ResolveCandidate(context.Context, capability.CapabilityBindingID, int64) (capability.ResolvedCognitiveBinding, error) {
+	return s.selected, nil
+}
+
+func TestTaskEvaluationHandlerInvokesEveryBoundedCase(t *testing.T) {
+	selected := gatewaySelection()
+	registry := &candidateRegistryStub{selected: selected}
+	provider := &stubAdvisoryProvider{response: cognitive.AdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, FinishReason: cognitive.FinishCompleted, AdvisoryText: "observed response"}}
+	gateway := cognitiveGateway{
+		resolver: registry,
+		providers: map[capability.ProviderKind][]providerRegistration{
+			selected.Provider.Kind: {{ProviderInstanceID: selected.Provider.ID, Kind: selected.Provider.Kind, EndpointRef: selected.Provider.EndpointRef, CredentialRef: selected.Provider.CredentialRef, Provider: provider}},
+		},
+		now: func() time.Time { return time.UnixMilli(1000) },
+	}
+	profile := capability.TaskEvaluationProfile{ID: "profile-general", Revision: 1, CapabilityID: selected.Binding.CapabilityID, Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "general-v1", RequiredCaseIDs: []string{"case-a", "case-b"}, QualityWeightMillis: 600, ReliabilityWeightMillis: 300, LatencyWeightMillis: 100}
+	request := capability.TaskEvaluationExecutionRequest{Profile: profile, CapabilityID: selected.Binding.CapabilityID, BindingID: selected.Binding.ID, BindingRevision: selected.Binding.Revision, ActorID: identity.ActorID("actor-1"), PrincipalID: selected.Binding.OwnerPrincipalID, ScopeID: authority.ScopeID("scope-1"), MaxOutputBytes: 512, EgressAcknowledged: true, Cases: []capability.TaskEvaluationCase{{CaseID: "case-a", Prompt: "one", EvidenceArtifactRef: "artifact:a"}, {CaseID: "case-b", Prompt: "two", EvidenceArtifactRef: "artifact:b"}}}
+	payload, _ := json.Marshal(request)
+	recorder := httptest.NewRecorder()
+	gateway.taskEvaluationHandler(recorder, httptest.NewRequest(http.MethodPost, "/v1/task-evaluations/execute", bytes.NewReader(payload)))
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String())
+	}
+	var response capability.TaskEvaluationExecutionResponse
+	if err := json.Unmarshal(recorder.Body.Bytes(), &response); err != nil {
+		t.Fatal(err)
+	}
+	if len(response.Observations) != 2 || response.Observations[0].Result != capability.EvaluationSupported || response.Observations[1].Result != capability.EvaluationSupported {
+		t.Fatalf("unexpected observations: %+v", response.Observations)
+	}
+}

cmd/core-runtime/main.go

@@ -834,6 +834,20 @@ func main() {
 		w.Header().Set("Content-Type", "application/json")
 		_ = json.NewEncoder(w).Encode(binding)
 	})
+	mux.HandleFunc("GET /v1/cognitive-bindings/{id}/revisions/{revision}/snapshot", func(w http.ResponseWriter, r *http.Request) {
+		revision, err := strconv.ParseInt(r.PathValue("revision"), 10, 64)
+		if err != nil || revision < 1 {
+			http.Error(w, "invalid cognitive binding revision", http.StatusBadRequest)
+			return
+		}
+		snapshot, err := capabilityRepository.LoadCognitiveCandidate(r.Context(), capability.CapabilityBindingID(r.PathValue("id")), revision)
+		if err != nil {
+			http.Error(w, "cognitive binding snapshot not found", http.StatusNotFound)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(snapshot)
+	})
 	mux.HandleFunc("POST /v1/cognitive-bindings/resolve", func(w http.ResponseWriter, r *http.Request) {
 		var requirement capability.CognitiveRequirement
 		decoder := json.NewDecoder(io.LimitReader(r.Body, 16*1024+1))

cmd/work-graph-runtime/main.go

@@ -7,9 +7,11 @@ import (
 	"log"
 	"net/http"
 	"os"
+	"time"
 
 	"git.cin.su/m/Assistant/adapters/postgres"
 	secretcontracts "git.cin.su/m/Assistant/contracts/secrets"
+	"git.cin.su/m/Assistant/contracts/work"
 	"git.cin.su/m/Assistant/modules/work/application"
 	"git.cin.su/m/Assistant/platform/secrets"
 	"git.cin.su/m/Assistant/runtime/health"
@@ -26,6 +28,10 @@ func main() {
 		log.Fatal(err)
 	}
 	defer repository.Close()
+	evidenceSink, err := newCoreTaskEvaluationSink(envOr("CORE_RUNTIME_URL", "http://core-runtime:8080"), &http.Client{Timeout: 12 * time.Second})
+	if err != nil {
+		log.Fatal(err)
+	}
 	mux := http.NewServeMux()
 	mux.Handle("/healthz", health.Handler{Runtime: "work-graph-runtime", SemanticGeneration: 1, ArchitectureGeneration: 1})
 	mux.Handle("/readyz", health.ReadinessHandler{Runtime: "work-graph-runtime", Probes: []health.Probe{{Name: "work-postgres", Check: func(ctx context.Context) error { return repository.Ping(ctx) }}}})
@@ -68,6 +74,19 @@ func main() {
 		}
 		writeJSON(w, graph)
 	})
+	mux.HandleFunc("POST /v1/work-graphs/task-evaluations/callback", func(w http.ResponseWriter, r *http.Request) {
+		var request work.TaskEvaluationEvidenceCallback
+		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&request); err != nil {
+			http.Error(w, "invalid task evaluation callback", http.StatusBadRequest)
+			return
+		}
+		graph, err := application.CompleteTaskEvaluationNode(r.Context(), repository, evidenceSink, request)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusUnprocessableEntity)
+			return
+		}
+		writeJSON(w, graph)
+	})
 	mux.HandleFunc("POST /v1/work-graphs/synthesis", func(w http.ResponseWriter, r *http.Request) {
 		var request application.GraphSynthesisRequest
 		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 4<<20)).Decode(&request); err != nil {
@@ -89,6 +108,13 @@ func main() {
 	log.Fatal(http.ListenAndServe(addr, mux))
 }
 
+func envOr(name, fallback string) string {
+	if value := os.Getenv(name); value != "" {
+		return value
+	}
+	return fallback
+}
+
 func writeJSON(w http.ResponseWriter, value any) {
 	w.Header().Set("Content-Type", "application/json")
 	_ = json.NewEncoder(w).Encode(value)

cmd/work-graph-runtime/task_evaluation_sink.go

@@ -0,0 +1,49 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+)
+
+type coreTaskEvaluationSink struct {
+	baseURL string
+	client  *http.Client
+}
+
+func newCoreTaskEvaluationSink(baseURL string, client *http.Client) (*coreTaskEvaluationSink, error) {
+	baseURL = strings.TrimRight(strings.TrimSpace(baseURL), "/")
+	if baseURL == "" {
+		return nil, fmt.Errorf("core runtime URL is required")
+	}
+	if client == nil {
+		client = http.DefaultClient
+	}
+	return &coreTaskEvaluationSink{baseURL: baseURL, client: client}, nil
+}
+
+func (s *coreTaskEvaluationSink) SaveTaskEvaluation(ctx context.Context, value capability.TaskEvaluation) error {
+	payload, err := json.Marshal(value)
+	if err != nil {
+		return err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, s.baseURL+"/v1/cognitive-registry/task-evaluations", bytes.NewReader(payload))
+	if err != nil {
+		return err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	response, err := s.client.Do(request)
+	if err != nil {
+		return err
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		return fmt.Errorf("save task evaluation: status %s", response.Status)
+	}
+	return nil
+}

contracts/capability/task_evaluation_execution.go

@@ -0,0 +1,35 @@
+package capability
+
+import (
+	"git.cin.su/m/Assistant/contracts/authority"
+	"git.cin.su/m/Assistant/contracts/identity"
+)
+
+// TaskEvaluationCase carries one bounded prompt selected by the evaluator.
+// The prompt is an input artifact, not a model-produced fact.
+type TaskEvaluationCase struct {
+	CaseID              string
+	Prompt              string
+	EvidenceArtifactRef string
+}
+
+type TaskEvaluationExecutionRequest struct {
+	Profile            TaskEvaluationProfile
+	CapabilityID       CapabilityID
+	BindingID          CapabilityBindingID
+	BindingRevision    int64
+	ActorID            identity.ActorID
+	PrincipalID        identity.PrincipalID
+	ScopeID            authority.ScopeID
+	Cases              []TaskEvaluationCase
+	MaxOutputBytes     int64
+	EgressAcknowledged bool
+}
+
+type TaskEvaluationExecutionResponse struct {
+	ProfileID            TaskEvaluationProfileID
+	BindingID            CapabilityBindingID
+	BindingRevision      int64
+	Observations         []TaskCaseObservation
+	ObservedAtUnixMillis int64
+}

contracts/work/graph.go

@@ -81,6 +81,17 @@ type TaskEvaluationGraphRequest struct {
 	TriggerEvidenceRef  string                           `json:"trigger_evidence_ref,omitempty"`
 }
 
+// TaskEvaluationEvidenceCallback is emitted by a specialist after it has
+// completed the bounded case set. Capability remains the evidence owner;
+// Work only advances its matching graph node after the evidence is accepted.
+type TaskEvaluationEvidenceCallback struct {
+	GraphID    string                    `json:"graph_id"`
+	Revision   int64                     `json:"revision"`
+	NodeID     GraphNodeID               `json:"node_id"`
+	Evaluation capability.TaskEvaluation `json:"evaluation"`
+	Succeeded  bool                      `json:"succeeded"`
+}
+
 type ResultCandidate struct {
 	ID              string        `json:"id"`
 	GraphID         string        `json:"graph_id"`

contracts/work/lease.go

@@ -1,6 +1,10 @@
 package work
 
-import "time"
+import (
+	"time"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+)
 
 type AgentLeaseID string
 type AgentFencingToken uint64
@@ -50,14 +54,18 @@ type IndependentVerification struct {
 }
 
 type AgentDispatchIntent struct {
-	DispatchID             string       `json:"dispatch_id"`
-	IdempotencyKey         string       `json:"idempotency_key"`
-	DelegationID           DelegationID `json:"delegation_id"`
-	RunID                  AgentRunID   `json:"run_id"`
-	ImplementationID       string       `json:"implementation_id"`
-	ImplementationRevision int64        `json:"implementation_revision"`
-	SourceRevision         string       `json:"source_revision"`
-	WorktreeID             string       `json:"worktree_id"`
-	VerificationPlanRef    string       `json:"verification_plan_ref"`
-	CreatedAtUnixMillis    int64        `json:"created_at_unix_millis"`
+	DispatchID              string                             `json:"dispatch_id"`
+	IdempotencyKey          string                             `json:"idempotency_key"`
+	DelegationID            DelegationID                       `json:"delegation_id"`
+	RunID                   AgentRunID                         `json:"run_id"`
+	ImplementationID        string                             `json:"implementation_id"`
+	ImplementationRevision  int64                              `json:"implementation_revision"`
+	SourceRevision          string                             `json:"source_revision"`
+	WorktreeID              string                             `json:"worktree_id"`
+	VerificationPlanRef     string                             `json:"verification_plan_ref"`
+	CreatedAtUnixMillis     int64                              `json:"created_at_unix_millis"`
+	SpecialistPurpose       string                             `json:"specialist_purpose,omitempty"`
+	TaskEvaluationProfileID capability.TaskEvaluationProfileID `json:"task_evaluation_profile_id,omitempty"`
+	TaskEvaluationBindingID capability.CapabilityBindingID     `json:"task_evaluation_binding_id,omitempty"`
+	TaskEvaluationCaseIDs   []string                           `json:"task_evaluation_case_ids,omitempty"`
 }

database/migrations/040_task_evaluation_dispatch.sql

@@ -0,0 +1,23 @@
+BEGIN;
+
+SET ROLE work_role;
+
+ALTER TABLE work.agent_dispatch_intents
+  ADD COLUMN IF NOT EXISTS specialist_purpose TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS task_evaluation_profile_id TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS task_evaluation_binding_id TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS task_evaluation_case_ids TEXT[] NOT NULL DEFAULT '{}';
+
+ALTER TABLE work.graphs
+  ADD COLUMN IF NOT EXISTS parent_graph_id TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS parent_graph_revision BIGINT NOT NULL DEFAULT 0,
+  ADD COLUMN IF NOT EXISTS trigger_evidence_ref TEXT NOT NULL DEFAULT '';
+
+ALTER TABLE work.graph_nodes
+  ADD COLUMN IF NOT EXISTS purpose TEXT NOT NULL DEFAULT 'GENERIC',
+  ADD COLUMN IF NOT EXISTS task_profile_id TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS binding_id TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS case_ids TEXT[] NOT NULL DEFAULT '{}';
+
+RESET ROLE;
+COMMIT;

dev/ACTIVE_TASK.json

@@ -1,5 +1,5 @@
 {
-  "task_file": "dev/tasks/DEV-000209-task-evaluator-work-graph.json",
-  "task_id": "DEV-000209",
+  "task_file": "dev/tasks/DEV-000212-task-evaluator-invocation.json",
+  "task_id": "DEV-000212",
   "task_revision": 1
 }

dev/tasks/DEV-000210-task-evaluator-worker.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000210",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "9a6ab6a9caf68e65f302c95ab0859b259122dacf",
+  "risk_tier": "E",
+  "intent": "Carry task-evaluation specialist metadata through durable dispatch, persistence and recovery so workers can execute bounded model cases and return evidence without losing profile lineage.",
+  "requirement_ids": ["worker execution context", "durable task metadata", "recovery-safe dispatch", "bounded case set", "no synchronous chat blocking"],
+  "allowed_change_scope": {"modules": ["work"], "paths": ["contracts/work/**", "modules/work/**", "adapters/postgres/work_repository.go", "cmd/agent-worker/**", "database/migrations/040_task_evaluation_dispatch.sql", "tests/model_qualification/**", "tests/agent_execution/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000210-task-evaluator-worker.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "deploy/**", "cmd/devctl/**", "modules/identity/**", "modules/capability/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 1},
+  "contracts": {"consume": ["Work Graph task-evaluation node metadata", "AgentExecutionRequest/Result", "existing lease and recovery contract"], "may_change": ["typed dispatch task-evaluation metadata"]},
+  "semantic_owner": "work",
+  "canonical_state": ["work-owned dispatch metadata and graph lineage; capability remains owner of evaluation evidence"],
+  "state_transitions": ["graph specialist node -> enriched dispatch intent", "claimed dispatch -> executor receives profile/binding/cases", "stale claim -> recovery preserves task metadata for retry"],
+  "side_effects_and_privileges": ["work role migration only; no provider calls and no secret access added"],
+  "persistence_and_migrations": ["040 adds typed task metadata columns to existing work dispatch/graph tables"],
+  "failure_retry_restart": ["metadata is persisted before enqueue; idempotency conflict rejects divergent task context", "lease timeout/recovery does not erase profile or case references"],
+  "assumptions": ["an upcoming cognitive specialist executor uses the typed metadata to invoke the model gateway and post Capability evidence", "external bridge absence remains typed WAITING/local-fallback"],
+  "acceptance_scenarios": ["task graph dispatch carries profile, binding and all cases", "persist/load round trip preserves metadata", "divergent idempotency retry is rejected", "legacy non-task dispatch remains valid", "recovery path does not claim success"],
+  "required_tests": ["go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "migration/schema checks", "CI", "production public health check"],
+  "terminal_gap_states": ["BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000211-task-evaluator-callback.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000211",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "6dec47c79163f456cf6b18085a268ebb2619c7bb",
+  "risk_tier": "E",
+  "intent": "Accept specialist task-evaluation evidence through a Work Graph callback: persist evidence through the Capability owner and complete the matching graph node only after typed lineage and revision checks pass.",
+  "requirement_ids": ["evidence callback", "fan-in completion", "owner-local persistence", "revision safety", "no cross-owner DB access"],
+  "allowed_change_scope": {"modules": ["work"], "paths": ["contracts/work/**", "modules/work/**", "cmd/work-graph-runtime/**", "tests/model_qualification/**", "tests/agent_execution/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000211-task-evaluator-callback.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "deploy/**", "cmd/devctl/**", "modules/identity/**", "database/**", "modules/capability/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["capability.TaskEvaluation", "existing Work Graph revision/completion contract", "Core Runtime capability evaluation HTTP boundary"], "may_change": ["typed task-evaluation callback contract"]},
+  "semantic_owner": "work for graph lifecycle; capability for evaluation evidence",
+  "canonical_state": ["Capability owns evaluation evidence; Work owns graph/node lifecycle and callback lineage"],
+  "state_transitions": ["specialist result -> callback received", "callback -> Capability evidence persisted", "persisted evidence -> matching node completion and graph fan-in"],
+  "side_effects_and_privileges": ["remote Core Runtime call through existing internal boundary; no direct foreign DB access and no new secrets"],
+  "persistence_and_migrations": ["uses existing capability task-evaluation and work graph persistence; no migration"],
+  "failure_retry_restart": ["Capability write failure leaves node incomplete and callback retryable", "stale graph revision is rejected; unknown/unsupported evaluation is not promoted by callback"],
+  "assumptions": ["specialist executor has already produced evidence and artifact references", "the callback is asynchronous and never blocks the chat request"],
+  "acceptance_scenarios": ["callback rejects non-task graph node", "callback rejects profile/binding lineage mismatch", "Capability write occurs before node completion", "sink failure leaves graph node unfinished", "valid callback advances graph fan-in", "duplicate evidence remains idempotent at Capability owner"],
+  "required_tests": ["go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production public health check"],
+  "terminal_gap_states": ["BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_MISSING_CAPABILITY"]
+}

dev/tasks/DEV-000212-task-evaluator-invocation.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000212",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "dff6c91c8e08611d73231a04a1af67efeebed22b",
+  "risk_tier": "E",
+  "intent": "Execute bounded task-evaluation cases against an exact Capability binding through Cognitive Gateway and return typed observations for the Work Graph callback.",
+  "requirement_ids": ["actual model invocation", "exact binding evaluation", "bounded cases", "provider-neutral evidence", "unknown on provider failure"],
+  "allowed_change_scope": {"modules": ["capability", "core-runtime", "cognitive-worker"], "paths": ["contracts/capability/**", "adapters/postgres/capability_repository.go", "cmd/core-runtime/**", "cmd/cognitive-worker/**", "tests/model_qualification/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000212-task-evaluator-invocation.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "deploy/**", "cmd/devctl/**", "database/**", "modules/identity/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["TaskEvaluationProfile", "TaskCaseObservation", "Cognitive Gateway provider boundary", "Capability cognitive binding snapshot boundary"], "may_change": ["task evaluation execution request/response"]},
+  "semantic_owner": "capability owns evaluation meaning; cognitive-worker owns provider invocation adapter boundary",
+  "canonical_state": ["none; this task returns observations only and does not promote or persist activation"],
+  "state_transitions": ["execution request -> exact binding snapshot", "case -> provider invocation -> SUPPORTED or UNKNOWN observation", "all observations -> Work Graph callback input"],
+  "side_effects_and_privileges": ["provider calls only through existing cognitive adapter; no direct DB and no new secret access"],
+  "persistence_and_migrations": ["none; durable persistence remains callback/Core Capability owner"],
+  "failure_retry_restart": ["provider timeout/auth/unavailable maps to UNKNOWN observation with evidence reference; caller may retry as a new attempt", "partial case set is never returned as supported aggregate"],
+  "assumptions": ["specialist supplies case prompts and artifact references from the approved bounded profile", "quality scoring beyond bounded invocation is performed by a verifier or later evaluator and is not fabricated here"],
+  "acceptance_scenarios": ["exact binding snapshot is required", "all supplied cases are invoked", "successful non-empty response yields supported observation with latency", "provider failure yields unknown observation", "unknown is never silently converted to supported", "no provider or hardware field participates in scoring"],
+  "required_tests": ["go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production public health check"],
+  "terminal_gap_states": ["BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_MISSING_CAPABILITY"]
+}

modules/work/application/graph_runtime.go

@@ -11,6 +11,7 @@ import (
 )
 
 var ErrGraphDispatchBinding = errors.New("graph node dispatch binding is missing")
+var ErrTaskEvaluationCallbackMismatch = errors.New("task evaluation callback does not match graph node")
 
 type GraphScheduleRequest struct {
 	Graph   work.WorkGraph             `json:"graph"`
@@ -42,6 +43,31 @@ type GraphSynthesisRequest struct {
 	Verified          bool                   `json:"verified"`
 }
 
+func CompleteTaskEvaluationNode(ctx context.Context, graphStore ports.GraphStore, evidenceSink ports.TaskEvaluationSink, request work.TaskEvaluationEvidenceCallback) (work.WorkGraph, error) {
+	if evidenceSink == nil || request.GraphID == "" || request.Revision < 1 || request.NodeID == "" || !request.Succeeded {
+		return work.WorkGraph{}, ErrTaskEvaluationCallbackMismatch
+	}
+	graph, err := graphStore.LoadWorkGraph(ctx, request.GraphID, request.Revision)
+	if err != nil {
+		return work.WorkGraph{}, err
+	}
+	matched := false
+	for _, node := range graph.Nodes {
+		if node.ID != request.NodeID {
+			continue
+		}
+		matched = node.Purpose == work.GraphNodePurposeTaskEvaluation && node.TaskProfileID == request.Evaluation.ProfileID && node.BindingID == request.Evaluation.BindingID
+		break
+	}
+	if !matched || request.Evaluation.BindingRevision < 1 || request.Evaluation.CapabilityID == "" {
+		return work.WorkGraph{}, ErrTaskEvaluationCallbackMismatch
+	}
+	if err := evidenceSink.SaveTaskEvaluation(ctx, request.Evaluation); err != nil {
+		return work.WorkGraph{}, err
+	}
+	return CompleteGraphNode(ctx, graphStore, request.GraphID, request.Revision, request.NodeID, true)
+}
+
 func SynthesizeGraph(ctx context.Context, store ports.GraphResultStore, request GraphSynthesisRequest) (work.ConflictSet, work.GraphSynthesisCandidate, error) {
 	conflict, synthesis, err := domain.BuildVerifiedGraphSynthesis(request.Conflict, request.Candidates, request.SelectedCandidate, request.VerifierRunID, request.VerifierIdentity, request.EvidenceRefs, request.Summary, request.Verified)
 	if err != nil {
@@ -120,7 +146,21 @@ func AdmitAndScheduleTaskEvaluation(ctx context.Context, store ports.GraphStore,
 	if err != nil {
 		return work.WorkGraph{}, nil, err
 	}
-	return AdmitAndSchedule(ctx, store, GraphScheduleRequest{Graph: graph, Intents: request.Intents, Now: request.Now})
+	intents := make([]work.AgentDispatchIntent, len(request.Intents))
+	copy(intents, request.Intents)
+	for i := range intents {
+		for _, node := range graph.Nodes {
+			if node.DispatchID != intents[i].DispatchID {
+				continue
+			}
+			intents[i].SpecialistPurpose = string(node.Purpose)
+			intents[i].TaskEvaluationProfileID = node.TaskProfileID
+			intents[i].TaskEvaluationBindingID = node.BindingID
+			intents[i].TaskEvaluationCaseIDs = append([]string(nil), node.CaseIDs...)
+			break
+		}
+	}
+	return AdmitAndSchedule(ctx, store, GraphScheduleRequest{Graph: graph, Intents: intents, Now: request.Now})
 }
 
 func CompleteGraphNode(ctx context.Context, store ports.GraphStore, graphID string, revision int64, nodeID work.GraphNodeID, success bool) (work.WorkGraph, error) {

modules/work/application/task_evaluation_callback_test.go

@@ -0,0 +1,80 @@
+package application
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/work"
+)
+
+type callbackGraphStore struct {
+	graph work.WorkGraph
+	saves int
+}
+
+func (s *callbackGraphStore) SaveWorkGraph(_ context.Context, graph work.WorkGraph) error {
+	s.graph = graph
+	s.saves++
+	return nil
+}
+func (s *callbackGraphStore) LoadWorkGraph(context.Context, string, int64) (work.WorkGraph, error) {
+	return s.graph, nil
+}
+func (s *callbackGraphStore) SaveDispatchIntent(context.Context, work.AgentDispatchIntent) error {
+	return nil
+}
+func (s *callbackGraphStore) EnqueueDispatch(context.Context, work.AgentDispatchQueueItem) error {
+	return nil
+}
+
+type callbackSink struct {
+	evaluation capability.TaskEvaluation
+	err        error
+}
+
+func (s *callbackSink) SaveTaskEvaluation(_ context.Context, value capability.TaskEvaluation) error {
+	s.evaluation = value
+	return s.err
+}
+
+func callbackRequest() (work.WorkGraph, work.TaskEvaluationEvidenceCallback) {
+	graph := work.WorkGraph{ID: "graph-1", Revision: 1, State: work.GraphRunning, Budget: work.GraphBudget{MaxParallel: 1, MaxAttempts: 1}, Nodes: []work.GraphNode{{ID: "node-1", DispatchID: "dispatch-1", IdempotencyKey: "idem-1", State: work.GraphNodeRunning, Purpose: work.GraphNodePurposeTaskEvaluation, TaskProfileID: "profile-1", BindingID: "binding-1"}}}
+	evaluation := capability.TaskEvaluation{ID: "evaluation-1", ProfileID: "profile-1", BindingID: "binding-1", BindingRevision: 2, CapabilityID: "capability-1", Result: capability.EvaluationSupported}
+	return graph, work.TaskEvaluationEvidenceCallback{GraphID: "graph-1", Revision: 1, NodeID: "node-1", Evaluation: evaluation, Succeeded: true}
+}
+
+func TestCompleteTaskEvaluationPersistsEvidenceBeforeGraphCompletion(t *testing.T) {
+	graph, callback := callbackRequest()
+	store := &callbackGraphStore{graph: graph}
+	sink := &callbackSink{}
+	completed, err := CompleteTaskEvaluationNode(context.Background(), store, sink, callback)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if sink.evaluation.ID != "evaluation-1" || store.saves != 1 || completed.State != work.GraphCompleted || completed.Nodes[0].State != work.GraphNodeSuccess {
+		t.Fatalf("callback did not complete in order: evaluation=%+v saves=%d graph=%+v", sink.evaluation, store.saves, completed)
+	}
+}
+
+func TestCompleteTaskEvaluationLeavesNodeOpenWhenCapabilityRejectsEvidence(t *testing.T) {
+	graph, callback := callbackRequest()
+	store := &callbackGraphStore{graph: graph}
+	sink := &callbackSink{err: errors.New("capability unavailable")}
+	if _, err := CompleteTaskEvaluationNode(context.Background(), store, sink, callback); err == nil {
+		t.Fatal("expected capability failure")
+	}
+	if store.saves != 0 {
+		t.Fatalf("graph was advanced after capability failure: saves=%d", store.saves)
+	}
+}
+
+func TestCompleteTaskEvaluationRejectsLineageMismatch(t *testing.T) {
+	graph, callback := callbackRequest()
+	callback.Evaluation.ProfileID = "profile-other"
+	store := &callbackGraphStore{graph: graph}
+	if _, err := CompleteTaskEvaluationNode(context.Background(), store, &callbackSink{}, callback); !errors.Is(err, ErrTaskEvaluationCallbackMismatch) {
+		t.Fatalf("expected lineage rejection, got %v", err)
+	}
+}

modules/work/application/task_evaluation_dispatch_test.go

@@ -0,0 +1,46 @@
+package application
+
+import (
+	"context"
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/work"
+)
+
+type taskGraphStore struct {
+	graph   work.WorkGraph
+	intents []work.AgentDispatchIntent
+}
+
+func (s *taskGraphStore) SaveWorkGraph(_ context.Context, graph work.WorkGraph) error {
+	s.graph = graph
+	return nil
+}
+func (s *taskGraphStore) LoadWorkGraph(context.Context, string, int64) (work.WorkGraph, error) {
+	return s.graph, nil
+}
+func (s *taskGraphStore) SaveDispatchIntent(_ context.Context, intent work.AgentDispatchIntent) error {
+	s.intents = append(s.intents, intent)
+	return nil
+}
+func (s *taskGraphStore) EnqueueDispatch(context.Context, work.AgentDispatchQueueItem) error {
+	return nil
+}
+
+func TestAdmitAndScheduleTaskEvaluationCarriesSpecialistContext(t *testing.T) {
+	store := &taskGraphStore{}
+	request := TaskEvaluationScheduleRequest{
+		Plan: work.TaskEvaluationGraphRequest{
+			GraphID: "graph-task", Profile: capability.TaskEvaluationProfile{ID: "profile-general", Revision: 1, CapabilityID: "capability-chat", Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "general-v1", RequiredCaseIDs: []string{"case-a", "case-b"}, QualityWeightMillis: 600, ReliabilityWeightMillis: 300, LatencyWeightMillis: 100},
+			BindingIDs: []capability.CapabilityBindingID{"binding-a"}, DispatchIDs: []string{"dispatch-a"}, IdempotencyPrefix: "eval", Budget: work.GraphBudget{MaxParallel: 1, MaxAttempts: 2},
+		},
+		Intents: []work.AgentDispatchIntent{{DispatchID: "dispatch-a", IdempotencyKey: "idem-a", DelegationID: "delegation-a", RunID: "run-a", ImplementationID: "impl", ImplementationRevision: 1, SourceRevision: "source", WorktreeID: "tree", VerificationPlanRef: "verify", CreatedAtUnixMillis: 1}},
+	}
+	if _, _, err := AdmitAndScheduleTaskEvaluation(context.Background(), store, request); err != nil {
+		t.Fatal(err)
+	}
+	if len(store.intents) != 1 || store.intents[0].TaskEvaluationProfileID != "profile-general" || store.intents[0].TaskEvaluationBindingID != "binding-a" || len(store.intents[0].TaskEvaluationCaseIDs) != 2 || store.intents[0].SpecialistPurpose != string(work.GraphNodePurposeTaskEvaluation) {
+		t.Fatalf("specialist context was not carried into dispatch: %+v", store.intents)
+	}
+}

modules/work/ports/graph.go

@@ -3,6 +3,7 @@ package ports
 import (
 	"context"
 
+	"git.cin.su/m/Assistant/contracts/capability"
 	"git.cin.su/m/Assistant/contracts/work"
 )
 
@@ -16,3 +17,9 @@ type GraphStore interface {
 type GraphResultStore interface {
 	SaveGraphSynthesis(context.Context, work.ConflictSet, []work.ResultCandidate, work.GraphSynthesisCandidate) error
 }
+
+// TaskEvaluationSink is a remote-capable boundary to Capability's owner.
+// Work never writes the capability schema directly.
+type TaskEvaluationSink interface {
+	SaveTaskEvaluation(context.Context, capability.TaskEvaluation) error
+}

tests/agent_execution/task_evaluation_dispatch_sql_test.go

@@ -0,0 +1,20 @@
+package agent_execution
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+func TestTaskEvaluationDispatchMigrationPersistsWorkerContext(t *testing.T) {
+	payload, err := os.ReadFile("../../database/migrations/040_task_evaluation_dispatch.sql")
+	if err != nil {
+		t.Fatal(err)
+	}
+	sql := strings.ToLower(string(payload))
+	for _, marker := range []string{"work.agent_dispatch_intents", "specialist_purpose", "task_evaluation_profile_id", "task_evaluation_binding_id", "task_evaluation_case_ids", "work.graphs", "parent_graph_id", "work.graph_nodes", "case_ids", "set role work_role"} {
+		if !strings.Contains(sql, strings.ToLower(marker)) {
+			t.Fatalf("migration missing %q", marker)
+		}
+	}
+}