feat(work): add independent task verifier runtime

feat(capability): require verifier evidence for quality (#197)

cmd/agent-worker/main.go

@@ -52,7 +52,7 @@ func main() {
 		// The local evaluator keeps task-qualification work alive, but it is not
 		// an external Agent Execution Bridge and must never be reported as one.
 		localFallback = true
-		executor = newTaskEvaluationExecutor(envOr("COGNITIVE_WORKER_URL", "http://cognitive-worker:8083"), envOr("WORK_GRAPH_RUNTIME_URL", "http://work-graph-runtime:8088"), &http.Client{Timeout: *leaseTTL})
+		executor = newTaskEvaluationExecutor(envOr("COGNITIVE_WORKER_URL", "http://cognitive-worker:8083"), envOr("WORK_GRAPH_RUNTIME_URL", "http://work-graph-runtime:8088"), envOr("TASK_VERIFIER_URL", "http://task-verifier:8091"), &http.Client{Timeout: *leaseTTL})
 		fmt.Fprintln(os.Stderr, "protected agent execution bridge URL is not configured; task evaluations use the local durable evaluator, other work remains in fallback")
 	}
 	go func() {

cmd/agent-worker/task_evaluation_executor.go

@@ -18,15 +18,16 @@ import (
 type taskEvaluationExecutor struct {
 	cognitiveURL string
 	callbackURL  string
+	verifierURL  string
 	client       *http.Client
 	fallback     localFallbackExecutor
 }
 
-func newTaskEvaluationExecutor(cognitiveURL, callbackURL string, client *http.Client) taskEvaluationExecutor {
+func newTaskEvaluationExecutor(cognitiveURL, callbackURL, verifierURL string, client *http.Client) taskEvaluationExecutor {
 	if client == nil {
 		client = http.DefaultClient
 	}
-	return taskEvaluationExecutor{cognitiveURL: strings.TrimRight(cognitiveURL, "/"), callbackURL: strings.TrimRight(callbackURL, "/"), client: client, fallback: newLocalFallbackExecutor()}
+	return taskEvaluationExecutor{cognitiveURL: strings.TrimRight(cognitiveURL, "/"), callbackURL: strings.TrimRight(callbackURL, "/"), verifierURL: strings.TrimRight(verifierURL, "/"), client: client, fallback: newLocalFallbackExecutor()}
 }
 
 func (e taskEvaluationExecutor) Execute(ctx context.Context, request work.AgentExecutionRequest) (work.AgentExecutionResult, error) {
@@ -38,7 +39,7 @@ func (e taskEvaluationExecutor) Execute(ctx context.Context, request work.AgentE
 	if execution.GraphID == "" || execution.NodeID == "" || execution.BindingRevision < 1 || execution.ActorID == "" || execution.PrincipalID == "" || execution.ScopeID == "" {
 		return e.fallback.Execute(ctx, request)
 	}
-	if e.cognitiveURL == "" || e.callbackURL == "" {
+	if e.cognitiveURL == "" || e.callbackURL == "" || e.verifierURL == "" {
 		return e.fallback.Execute(ctx, request)
 	}
 	payload := capability.TaskEvaluationExecutionRequest{Profile: *intent.TaskEvaluationProfile, CapabilityID: intent.TaskEvaluationProfile.CapabilityID, BindingID: intent.TaskEvaluationBindingID, BindingRevision: execution.BindingRevision, ActorID: execution.ActorID, PrincipalID: execution.PrincipalID, ScopeID: execution.ScopeID, Cases: intent.TaskEvaluationCases, MaxOutputBytes: 4096}
@@ -46,13 +47,29 @@ func (e taskEvaluationExecutor) Execute(ctx context.Context, request work.AgentE
 	if err != nil {
 		return work.AgentExecutionResult{}, err
 	}
-	if len(response.Observations) == 0 || response.ObservedAtUnixMillis < 1 {
+	if len(response.Responses) == 0 || response.ObservedAtUnixMillis < 1 {
 		return work.AgentExecutionResult{}, fmt.Errorf("task evaluation returned no observations")
 	}
 	if len(intent.TaskEvaluationCases) == 0 {
 		return work.AgentExecutionResult{}, fmt.Errorf("task evaluation cases are missing")
 	}
-	evaluation, err := capabilitydomain.BuildTaskEvaluation(*intent.TaskEvaluationProfile, capability.TaskEvaluationID("evaluation:"+intent.DispatchID), response.BindingID, response.BindingRevision, intent.TaskEvaluationProfile.CapabilityID, response.Observations, artifact.ArtifactID(intent.TaskEvaluationCases[0].EvidenceArtifactRef), response.ObservedAtUnixMillis)
+	caseByID := make(map[string]capability.TaskEvaluationCase, len(intent.TaskEvaluationCases))
+	for _, item := range intent.TaskEvaluationCases {
+		caseByID[item.CaseID] = item
+	}
+	observations := make([]capability.TaskCaseObservation, 0, len(response.Responses))
+	for _, item := range response.Responses {
+		caseValue, ok := caseByID[item.CaseID]
+		if !ok || caseValue.Verification.Mode == "" {
+			return e.fallback.Execute(ctx, request)
+		}
+		verified, verifyErr := postJSON[capability.TaskCaseVerificationResponse](ctx, e.client, e.verifierURL+"/v1/task-evaluations/verify", capability.TaskCaseVerificationRequest{CaseID: item.CaseID, ResponseText: item.ResponseText, LatencyMicros: item.LatencyMicros, EvidenceArtifactRef: item.EvidenceArtifactRef, Verification: caseValue.Verification})
+		if verifyErr != nil {
+			return e.fallback.Execute(ctx, request)
+		}
+		observations = append(observations, capability.TaskCaseObservation{CaseID: verified.CaseID, Result: verified.Result, QualityScoreMillis: verified.QualityScoreMillis, LatencyMicros: verified.LatencyMicros, CriticalFailure: verified.CriticalFailure, EvidenceArtifactRef: verified.EvidenceArtifactRef, VerificationEvidenceRef: verified.VerificationEvidenceRef, VerifierIdentity: verified.VerifierIdentity})
+	}
+	evaluation, err := capabilitydomain.BuildTaskEvaluation(*intent.TaskEvaluationProfile, capability.TaskEvaluationID("evaluation:"+intent.DispatchID), response.BindingID, response.BindingRevision, intent.TaskEvaluationProfile.CapabilityID, observations, artifact.ArtifactID(intent.TaskEvaluationCases[0].EvidenceArtifactRef), response.ObservedAtUnixMillis)
 	if err != nil {
 		return work.AgentExecutionResult{}, err
 	}

cmd/agent-worker/task_evaluation_executor_test.go

@@ -13,9 +13,14 @@ import (
 
 func TestTaskEvaluationExecutorInvokesAggregatesAndCallbacks(t *testing.T) {
 	profile := capability.TaskEvaluationProfile{ID: "profile-1", Revision: 1, CapabilityID: "capability-1", Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "general-v1", RequiredCaseIDs: []string{"case-1"}, QualityWeightMillis: 600, ReliabilityWeightMillis: 300, LatencyWeightMillis: 100}
+	verification := capability.TaskCaseVerification{Mode: capability.TaskCaseVerificationExactText, ExpectedText: "answer", MinimumQualityMillis: 900}
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/v1/task-evaluations/execute" {
-			_ = json.NewEncoder(w).Encode(capability.TaskEvaluationExecutionResponse{ProfileID: profile.ID, BindingID: "binding-1", BindingRevision: 3, Observations: []capability.TaskCaseObservation{{CaseID: "case-1", Result: capability.EvaluationSupported, EvidenceArtifactRef: "artifact-1"}}, ObservedAtUnixMillis: 10})
+			_ = json.NewEncoder(w).Encode(capability.TaskEvaluationExecutionResponse{ProfileID: profile.ID, BindingID: "binding-1", BindingRevision: 3, Responses: []capability.TaskCaseResponse{{CaseID: "case-1", ResponseText: "answer", LatencyMicros: 2, EvidenceArtifactRef: "artifact-1"}}, ObservedAtUnixMillis: 10})
+			return
+		}
+		if r.URL.Path == "/v1/task-evaluations/verify" {
+			_ = json.NewEncoder(w).Encode(capability.TaskCaseVerificationResponse{CaseID: "case-1", Result: capability.EvaluationSupported, QualityScoreMillis: 900, LatencyMicros: 2, EvidenceArtifactRef: "artifact-1", VerificationEvidenceRef: "verify-1", VerifierIdentity: "verifier-1"})
 			return
 		}
 		if r.URL.Path == "/v1/work-graphs/task-evaluations/callback" {
@@ -30,8 +35,8 @@ func TestTaskEvaluationExecutorInvokesAggregatesAndCallbacks(t *testing.T) {
 		http.NotFound(w, r)
 	}))
 	defer server.Close()
-	executor := newTaskEvaluationExecutor(server.URL, server.URL, server.Client())
-	result, err := executor.Execute(context.Background(), work.AgentExecutionRequest{Intent: work.AgentDispatchIntent{DispatchID: "dispatch-1", TaskEvaluationBindingID: "binding-1", TaskEvaluationProfile: &profile, TaskEvaluationCases: []capability.TaskEvaluationCase{{CaseID: "case-1", Prompt: "answer", EvidenceArtifactRef: "artifact-1"}}, TaskEvaluationExecution: &work.TaskEvaluationDispatchContext{GraphID: "graph-1", GraphRevision: 1, NodeID: "node-1", BindingRevision: 3, ActorID: "actor-1", PrincipalID: "principal-1", ScopeID: "scope-1"}}})
+	executor := newTaskEvaluationExecutor(server.URL, server.URL, server.URL, server.Client())
+	result, err := executor.Execute(context.Background(), work.AgentExecutionRequest{Intent: work.AgentDispatchIntent{DispatchID: "dispatch-1", TaskEvaluationBindingID: "binding-1", TaskEvaluationProfile: &profile, TaskEvaluationCases: []capability.TaskEvaluationCase{{CaseID: "case-1", Prompt: "answer", EvidenceArtifactRef: "artifact-1", Verification: verification}}, TaskEvaluationExecution: &work.TaskEvaluationDispatchContext{GraphID: "graph-1", GraphRevision: 1, NodeID: "node-1", BindingRevision: 3, ActorID: "actor-1", PrincipalID: "principal-1", ScopeID: "scope-1"}}})
 	if err != nil || result.State != work.AgentExecutionCompleted || result.OutcomeRef == "" {
 		t.Fatalf("result=%+v err=%v", result, err)
 	}

cmd/cognitive-worker/task_evaluation.go

@@ -44,6 +44,7 @@ func (g cognitiveGateway) taskEvaluationHandler(w http.ResponseWriter, r *http.R
 		caseSet[id] = struct{}{}
 	}
 	observations := make([]capability.TaskCaseObservation, len(request.Cases))
+	responses := make([]capability.TaskCaseResponse, len(request.Cases))
 	var wg sync.WaitGroup
 	seenCases := make(map[string]struct{}, len(request.Cases))
 	for i, item := range request.Cases {
@@ -67,10 +68,12 @@ func (g cognitiveGateway) taskEvaluationHandler(w http.ResponseWriter, r *http.R
 			invocation := cognitive.AdvisoryRequest{Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(fmt.Sprintf("task-evaluation:%s:%s", request.Profile.ID, item.CaseID)), ActorID: request.ActorID, PrincipalID: request.PrincipalID, ScopeID: request.ScopeID, Message: item.Prompt, MaxOutputBytes: int(request.MaxOutputBytes), ProviderBindingID: selected.Binding.ID, ProviderBindingRevision: selected.Binding.Revision, ProviderInstanceID: selected.Provider.ID, ModelDescriptorID: selected.Model.ID, ProviderModelID: selected.Model.ProviderModelID}
 			response, invokeErr := g.invokeAdmitted(r.Context(), string(invocation.RequestID), provider, invocation, int(request.MaxOutputBytes))
 			observation := capability.TaskCaseObservation{CaseID: item.CaseID, LatencyMicros: time.Since(started).Microseconds(), EvidenceArtifactRef: item.EvidenceArtifactRef}
+			responses[index] = capability.TaskCaseResponse{CaseID: item.CaseID, ResponseText: response.AdvisoryText, LatencyMicros: observation.LatencyMicros, EvidenceArtifactRef: item.EvidenceArtifactRef}
 			if invokeErr == nil && response.FinishReason == cognitive.FinishCompleted && response.AdvisoryText != "" {
-				observation.Result = capability.EvaluationSupported
-				// Invocation success proves reachability/support for this case,
-				// not semantic answer quality. A verifier may score quality later.
+				// Invocation success proves reachability only. Without an
+				// independent verifier and answer evidence, semantic support and
+				// quality must remain UNKNOWN rather than becoming false evidence.
+				observation.Result = capability.EvaluationUnknown
 				observation.QualityScoreMillis = 0
 			} else {
 				observation.Result = capability.EvaluationUnknown
@@ -84,7 +87,7 @@ func (g cognitiveGateway) taskEvaluationHandler(w http.ResponseWriter, r *http.R
 		return
 	}
 	wg.Wait()
-	writeTaskEvaluationJSON(w, capability.TaskEvaluationExecutionResponse{ProfileID: request.Profile.ID, BindingID: selected.Binding.ID, BindingRevision: selected.Binding.Revision, Observations: observations, ObservedAtUnixMillis: time.Now().UnixMilli()})
+	writeTaskEvaluationJSON(w, capability.TaskEvaluationExecutionResponse{ProfileID: request.Profile.ID, BindingID: selected.Binding.ID, BindingRevision: selected.Binding.Revision, Observations: observations, Responses: responses, ObservedAtUnixMillis: time.Now().UnixMilli()})
 }
 
 func writeTaskEvaluationJSON(w http.ResponseWriter, value any) {

cmd/cognitive-worker/task_evaluation_test.go

@@ -47,7 +47,12 @@ func TestTaskEvaluationHandlerInvokesEveryBoundedCase(t *testing.T) {
 	if err := json.Unmarshal(recorder.Body.Bytes(), &response); err != nil {
 		t.Fatal(err)
 	}
-	if len(response.Observations) != 2 || response.Observations[0].Result != capability.EvaluationSupported || response.Observations[1].Result != capability.EvaluationSupported {
+	if len(response.Observations) != 2 || response.Observations[0].Result != capability.EvaluationUnknown || response.Observations[1].Result != capability.EvaluationUnknown {
 		t.Fatalf("unexpected observations: %+v", response.Observations)
 	}
+	for _, observation := range response.Observations {
+		if observation.QualityScoreMillis != 0 || observation.CriticalFailure {
+			t.Fatalf("reachability-only evidence must not carry quality or failure claims: %+v", observation)
+		}
+	}
 }

cmd/task-verifier/main.go

@@ -0,0 +1,64 @@
+package main
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+)
+
+const verifierIdentity = "deterministic-task-verifier-v1"
+
+func main() {
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"runtime":"task-verifier","status":"ok"}`))
+	})
+	mux.HandleFunc("POST /v1/task-evaluations/verify", verifyHandler)
+	addr := ":8091"
+	if value := strings.TrimSpace(os.Getenv("LISTEN_ADDR")); value != "" {
+		addr = value
+	}
+	if err := http.ListenAndServe(addr, mux); err != nil {
+		panic(err)
+	}
+}
+
+func verifyHandler(w http.ResponseWriter, r *http.Request) {
+	var request capability.TaskCaseVerificationRequest
+	decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&request); err != nil || request.CaseID == "" || request.ResponseText == "" || request.EvidenceArtifactRef == "" || request.LatencyMicros < 0 || request.Verification.Mode != capability.TaskCaseVerificationExactText || request.Verification.ExpectedText == "" || request.Verification.MinimumQualityMillis < 0 || request.Verification.MinimumQualityMillis > 1000 {
+		http.Error(w, "invalid task verification request", http.StatusBadRequest)
+		return
+	}
+	matched := strings.TrimSpace(request.ResponseText) == strings.TrimSpace(request.Verification.ExpectedText)
+	quality := int64(0)
+	result := capability.EvaluationUnsupported
+	if matched {
+		quality = request.Verification.MinimumQualityMillis
+		if quality == 0 {
+			quality = 1000
+		}
+		result = capability.EvaluationSupported
+	}
+	evidence := verificationEvidence(request, matched)
+	writeJSON(w, capability.TaskCaseVerificationResponse{CaseID: request.CaseID, Result: result, QualityScoreMillis: quality, LatencyMicros: request.LatencyMicros, EvidenceArtifactRef: request.EvidenceArtifactRef, VerificationEvidenceRef: evidence, VerifierIdentity: verifierIdentity})
+}
+
+func verificationEvidence(request capability.TaskCaseVerificationRequest, matched bool) string {
+	payload := fmt.Sprintf("%s|%s|%s|%t", verifierIdentity, request.CaseID, request.EvidenceArtifactRef, matched)
+	digest := sha256.Sum256([]byte(payload))
+	return "verification:" + hex.EncodeToString(digest[:])
+}
+
+func writeJSON(w http.ResponseWriter, value any) {
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(value)
+}

cmd/task-verifier/main_test.go

@@ -0,0 +1,31 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+)
+
+func TestVerifyExactTextProducesIndependentEvidence(t *testing.T) {
+	payload, _ := json.Marshal(capability.TaskCaseVerificationRequest{CaseID: "case-1", ResponseText: " answer ", EvidenceArtifactRef: "case-artifact", Verification: capability.TaskCaseVerification{Mode: capability.TaskCaseVerificationExactText, ExpectedText: "answer", MinimumQualityMillis: 900}})
+	recorder := httptest.NewRecorder()
+	verifyHandler(recorder, httptest.NewRequest(http.MethodPost, "/v1/task-evaluations/verify", bytes.NewReader(payload)))
+	var response capability.TaskCaseVerificationResponse
+	if recorder.Code != http.StatusOK || json.NewDecoder(recorder.Body).Decode(&response) != nil || response.Result != capability.EvaluationSupported || response.QualityScoreMillis != 900 || response.VerifierIdentity == "" || response.VerificationEvidenceRef == "" {
+		t.Fatalf("unexpected verification response: code=%d body=%s value=%+v", recorder.Code, recorder.Body.String(), response)
+	}
+}
+
+func TestVerifyMismatchIsUnsupportedWithEvidence(t *testing.T) {
+	payload, _ := json.Marshal(capability.TaskCaseVerificationRequest{CaseID: "case-1", ResponseText: "wrong", EvidenceArtifactRef: "case-artifact", Verification: capability.TaskCaseVerification{Mode: capability.TaskCaseVerificationExactText, ExpectedText: "answer", MinimumQualityMillis: 900}})
+	recorder := httptest.NewRecorder()
+	verifyHandler(recorder, httptest.NewRequest(http.MethodPost, "/v1/task-evaluations/verify", bytes.NewReader(payload)))
+	var response capability.TaskCaseVerificationResponse
+	if recorder.Code != http.StatusOK || json.NewDecoder(recorder.Body).Decode(&response) != nil || response.Result != capability.EvaluationUnsupported || response.QualityScoreMillis != 0 || response.VerificationEvidenceRef == "" {
+		t.Fatalf("unexpected mismatch response: code=%d body=%s value=%+v", recorder.Code, recorder.Body.String(), response)
+	}
+}

contracts/capability/task_evaluation.go

@@ -70,6 +70,18 @@ type TaskEvaluationExpansionRequest struct {
 	BenchmarkVersion   string
 }
 
+type TaskCaseVerificationMode string
+
+const TaskCaseVerificationExactText TaskCaseVerificationMode = "EXACT_TEXT"
+
+// TaskCaseVerification is a bounded, task-owned rubric. The expected text is
+// test data, not model output, and is never sent to the cognitive provider.
+type TaskCaseVerification struct {
+	Mode                 TaskCaseVerificationMode
+	ExpectedText         string
+	MinimumQualityMillis int64
+}
+
 // TaskCaseObservation is produced by the bounded evaluator and verifier. A
 // score without a case result and evidence reference is not accepted as
 // qualification evidence.
@@ -80,6 +92,10 @@ type TaskCaseObservation struct {
 	LatencyMicros       int64
 	CriticalFailure     bool
 	EvidenceArtifactRef string
+	// VerificationEvidenceRef and VerifierIdentity are required whenever an
+	// observation claims semantic support or a non-zero quality score.
+	VerificationEvidenceRef string
+	VerifierIdentity        string
 }
 
 // TaskEvaluation is durable evidence for one model/binding revision under one

contracts/capability/task_evaluation_execution.go

@@ -11,6 +11,33 @@ type TaskEvaluationCase struct {
 	CaseID              string
 	Prompt              string
 	EvidenceArtifactRef string
+	Verification        TaskCaseVerification
+}
+
+type TaskCaseResponse struct {
+	CaseID              string
+	ResponseText        string
+	LatencyMicros       int64
+	EvidenceArtifactRef string
+}
+
+type TaskCaseVerificationRequest struct {
+	CaseID              string
+	ResponseText        string
+	LatencyMicros       int64
+	EvidenceArtifactRef string
+	Verification        TaskCaseVerification
+}
+
+type TaskCaseVerificationResponse struct {
+	CaseID                  string
+	Result                  EvaluationResult
+	QualityScoreMillis      int64
+	LatencyMicros           int64
+	CriticalFailure         bool
+	EvidenceArtifactRef     string
+	VerificationEvidenceRef string
+	VerifierIdentity        string
 }
 
 type TaskEvaluationExecutionRequest struct {
@@ -31,5 +58,6 @@ type TaskEvaluationExecutionResponse struct {
 	BindingID            CapabilityBindingID
 	BindingRevision      int64
 	Observations         []TaskCaseObservation
+	Responses            []TaskCaseResponse
 	ObservedAtUnixMillis int64
 }

deploy/docker-compose.prod.yml

@@ -118,10 +118,24 @@ services:
       WORK_POSTGRES_CREDENTIAL_REF: credential://domovoy/work/db-password/v1
       WORK_POSTGRES_PASSWORD_FILE: /run/secrets/work_db_password
       SECRET_BACKEND_ROOT: /run/secrets
-    depends_on: { postgres: { condition: service_healthy } }
+      TASK_VERIFIER_URL: http://task-verifier:8091
+    depends_on:
+      postgres: { condition: service_healthy }
+      task-verifier: { condition: service_healthy }
     volumes:
       - assistant_core_secrets:/run/secrets:ro
 
+  task-verifier:
+    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: task-verifier, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
+    restart: unless-stopped
+    environment:
+      LISTEN_ADDR: :8091
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8091/healthz >/dev/null"]
+      interval: 10s
+      timeout: 3s
+      retries: 10
+
   work-graph-runtime:
     build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: work-graph-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
     restart: unless-stopped

dev/ACTIVE_TASK.json

@@ -1,5 +1,5 @@
 {
-  "task_file": "dev/tasks/DEV-000216-agent-worker-status-truth.json",
-  "task_id": "DEV-000216",
+  "task_file": "dev/tasks/DEV-000221-task-verifier-runtime.json",
+  "task_id": "DEV-000221",
   "task_revision": 1
 }

dev/tasks/DEV-000217-current-status-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000217",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "05a246ea3f240a77be769969ad62a236fba33bac",
+  "risk_tier": "E",
+  "intent": "Refresh the project status projection and redacted live evidence after the agent-worker truthful fallback fix without changing runtime behavior.",
+  "requirement_ids": ["current audit evidence", "task lineage accuracy", "negative-state transparency"],
+  "allowed_change_scope": {"modules": ["operations-evidence"], "paths": ["docs/PROJECT_STATUS.md", "docs/evidence/audit-runtime-status-2026-08-23-v2.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000217-current-status-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/**", "modules/**", "contracts/**", "database/**", "deploy/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["live health/readiness/status responses", "merged task lineage"], "may_change": ["operations status projection and redacted evidence artifact"]},
+  "semantic_owner": "operations-evidence projection",
+  "canonical_state": ["none; docs and evidence are rebuildable projections"],
+  "state_transitions": ["stale status projection -> current evidence projection"],
+  "side_effects_and_privileges": ["read-only live checks; no secrets, credentials or runtime mutation"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["evidence records unavailable/degraded states explicitly; no success inferred from missing data"],
+  "assumptions": ["historical evidence remains immutable and is not rewritten"],
+  "acceptance_scenarios": ["active task points to the current merged packet", "bridge absence is reported as local fallback", "GPU timeout is reported as degraded without changing FAST preference", "authenticated UI availability is not claimed without a current signed-in session", "no secret value appears in the projection"],
+  "required_tests": ["go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production public health and runtime status"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000218-automatic-expansion-policy.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000218",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "ab840878fe7d21a0a6aeb69193a3d58ea23a56e0",
+  "risk_tier": "E",
+  "intent": "Add a conservative deterministic policy gate for creating additional model-evaluation profiles only after general evaluation evidence remains unresolved.",
+  "requirement_ids": ["general-first evaluation", "bounded additional evaluation", "no unnecessary fleet-wide tests"],
+  "allowed_change_scope": {"modules": ["capability"], "paths": ["modules/capability/domain/task_evaluation.go", "modules/capability/domain/task_evaluation_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000218-automatic-expansion-policy.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "cmd/**", "contracts/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["TaskEvaluationProfile", "TaskEvaluation", "TaskEvaluationExpansionRequest"], "may_change": []},
+  "semantic_owner": "capability owns model qualification evidence and expansion policy",
+  "canonical_state": ["none; this packet creates no persistence or activation authority"],
+  "state_transitions": ["general COMPLETED/PARTIAL unresolved evidence -> bounded additional profile candidate", "qualified candidate -> no expansion"],
+  "side_effects_and_privileges": ["pure deterministic decision; no provider call, no model invocation, no mutation"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["missing trigger evidence or additional cases fails closed; repeated decision is deterministic"],
+  "assumptions": ["a later task supplies task-specific additional cases from an unresolved outcome and schedules them through the existing Work Graph"],
+  "acceptance_scenarios": ["general graph not completed/partial does not expand", "unknown/unsupported/low-scoring candidates expand only with evidence and new cases", "one qualified candidate suppresses expansion", "no provider or hardware label changes the decision"],
+  "required_tests": ["go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production public health check"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000219-reachability-not-quality.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000219",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "7476f43ffa57d55f5a5a9bddc7f1c74e9b87ae0e",
+  "risk_tier": "E",
+  "intent": "Prevent task-evaluation invocation success from being recorded as semantic model quality or support without independent verifier evidence.",
+  "requirement_ids": ["truthful model evidence", "independent verification", "no false qualification"],
+  "allowed_change_scope": {"modules": ["cognitive-worker"], "paths": ["cmd/cognitive-worker/task_evaluation.go", "cmd/cognitive-worker/task_evaluation_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000219-reachability-not-quality.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "modules/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["TaskEvaluationExecutionRequest/Response", "TaskCaseObservation", "Cognitive Gateway"], "may_change": []},
+  "semantic_owner": "capability evidence remains owner; cognitive-worker only records invocation observation",
+  "canonical_state": ["existing task-evaluation evidence; no new persistence"],
+  "state_transitions": ["successful invocation -> UNKNOWN reachability observation", "independent verifier evidence -> future supported/quality observation"],
+  "side_effects_and_privileges": ["no additional provider calls or privileges"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["unknown evidence remains retryable/eligible for a separately verified evaluation; no promotion follows invocation alone"],
+  "assumptions": ["a later verifier task will attach answer-quality evidence and score cases"],
+  "acceptance_scenarios": ["nonempty provider response is not SUPPORTED", "quality score remains zero", "provider invocation failure remains UNKNOWN with critical failure", "no model/hardware label can manufacture quality evidence"],
+  "required_tests": ["go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production public health check"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000220-verifier-evidence-boundary.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000220",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "66ed523248ea6cf0a41383e2206d9a70eeaafda8",
+  "risk_tier": "E",
+  "intent": "Require explicit independent verifier identity and evidence before task evaluation can claim semantic support or non-zero quality.",
+  "requirement_ids": ["independent verifier evidence", "no false quality", "typed model qualification"],
+  "allowed_change_scope": {"modules": ["capability", "agent-worker"], "paths": ["contracts/capability/task_evaluation.go", "modules/capability/domain/task_evaluation.go", "modules/capability/domain/task_evaluation_test.go", "cmd/agent-worker/task_evaluation_executor_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000220-verifier-evidence-boundary.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "cmd/cognitive-worker/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["TaskCaseObservation", "TaskEvaluation", "existing Work Graph callback"], "may_change": ["typed observation fields for verifier evidence"]},
+  "semantic_owner": "capability owns qualification evidence; verifier remains independent of provider invocation",
+  "canonical_state": ["existing capability task-evaluation evidence"],
+  "state_transitions": ["reachability UNKNOWN -> separately verified SUPPORTED only with evidence"],
+  "side_effects_and_privileges": ["no provider invocation or external mutation"],
+  "persistence_and_migrations": ["existing task evaluation persistence is unchanged"],
+  "failure_retry_restart": ["missing verifier fields fail closed; unknown reachability remains non-promotable"],
+  "assumptions": ["a later verifier runtime will produce VerificationEvidenceRef and VerifierIdentity"],
+  "acceptance_scenarios": ["supported without verifier is rejected", "unknown with zero quality remains valid", "verified supported observation aggregates normally", "no hardware/provider name bypasses the boundary"],
+  "required_tests": ["go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production public health check"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000221-task-verifier-runtime.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000221",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "0aab10863cb23824688029c0bab6734f100b4610",
+  "risk_tier": "E",
+  "intent": "Provide an independent deterministic task-verifier runtime and wire model task evaluation through response evidence rather than provider self-assertion.",
+  "requirement_ids": ["independent verifier runtime", "typed answer evidence", "quality qualification boundary", "degraded verifier fallback"],
+  "allowed_change_scope": {"modules": ["capability", "cognitive-worker", "agent-worker", "task-verifier", "deployment"], "paths": ["contracts/capability/task_evaluation.go", "contracts/capability/task_evaluation_execution.go", "cmd/cognitive-worker/task_evaluation.go", "cmd/agent-worker/main.go", "cmd/agent-worker/task_evaluation_executor.go", "cmd/agent-worker/task_evaluation_executor_test.go", "cmd/task-verifier/**", "deploy/docker-compose.prod.yml", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000221-task-verifier-runtime.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "modules/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["TaskEvaluationCase", "TaskEvaluationExecutionRequest/Response", "TaskCaseObservation", "existing worker callback"], "may_change": ["typed verification spec, response envelope and verifier result" ]},
+  "semantic_owner": "capability owns evidence; task-verifier is a replaceable independent verifier adapter and does not own canonical state",
+  "canonical_state": ["existing capability task-evaluation evidence only; verifier has no database"],
+  "state_transitions": ["provider response -> bounded response evidence -> verifier result -> TaskCaseObservation -> TaskEvaluation"],
+  "side_effects_and_privileges": ["local network calls only; no secrets; no external mutation; no authority expansion"],
+  "persistence_and_migrations": ["none; verifier evidence is carried through existing callback and capability persistence"],
+  "failure_retry_restart": ["verifier unavailable returns local fallback/waiting; no quality or promotion claim is made"],
+  "assumptions": ["initial verifier mode is exact-text for bounded deterministic cases; future verifiers may add typed modes under separate task packets"],
+  "acceptance_scenarios": ["exact response produces supported evidence with verifier identity", "mismatch produces unsupported evidence", "cognitive worker never asserts support from invocation alone", "worker wires verifier result before callback", "verifier process has health endpoint and production compose dependency", "verifier loss does not produce false quality"],
+  "required_tests": ["go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production public health and verifier health check"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

docs/PROJECT_STATUS.md

@@ -13,13 +13,15 @@
 - `BACKUP_RESTORE_STATUS = VERIFIED`; latest checksum and isolated restore evidence is retained in `docs/evidence/wp-002-postgres-restore-2026-08-22-v1.json`.
 - `GOVERNED_SELF_DEVELOPMENT_STATUS = DURABLE_GATE_PERSISTED`; Work-owned revisioned gate storage and optimistic-concurrency persistence are live. No bridge-backed source mutation, promotion or rollback is claimed. Evidence: `docs/evidence/governed-development-gate-persistence-2026-08-23-v1.json`.
 - `UI_AUTHENTICATED_ACCEPTANCE = AUTHENTICATED_QUICK_SMOKE_PASS`; browser-driven smoke completed in the active production session: chat response received, admin login accepted, diagnostics 7/7 passed, operations fleet 4/4 READY, and action history loaded. Deep mutation, delegation-specific and long-running acceptance remain intentionally deferred.
+- `CURRENT_UI_SESSION_STATUS = NO_CURRENT_AUTHENTICATED_SESSION`; the historical quick-smoke evidence above is retained, but the current acceptance run has no signed-in browser session, so no new authenticated visual result is claimed. Public cabinet shell and unauthenticated protection were checked separately.
+- `AGENT_WORKER_STATUS_CORRECTION = LIVE_TRUTHFUL_LOCAL_FALLBACK`; after DEV-000216, absence of the protected bridge is reported as `executor_configured=false`, `mode=local-fallback`, `ready=false`; local task evaluation is not represented as external agent execution. Evidence: `docs/evidence/audit-runtime-status-2026-08-23-v2.json`.
 
 ## Current governance checkpoint
 
 - `COMPLETION_MATRIX = docs/evidence/audit-completion-matrix-2026-08-23-v3.json`; all seven objective areas are mapped to current repository/production proof, with external bridge, GPU promotion/quality and deep-acceptance gaps explicit.
 
-- `ACTIVE_TASK = dev/tasks/DEV-000207-gpu-invocation-qualification.json revision 1`
+- `ACTIVE_TASK = dev/tasks/DEV-000217-current-status-evidence.json revision 1`
 - `LINEAGE_DECISION = docs/GOVERNANCE_LINEAGE_DECISION_2026-08-22.md`; historical packets remain provenance and are not current authority.
 - `REGISTRY_STATUS = YAML and JSON semantic mirrors agree`
 - `PRODUCTION_DOMAIN = docker.cin.su`; shared docker-test is not used for this project.
-- `NEXT_WORK = resolve the protected GPU request compatibility gap, provision/qualify an independently operated Agent Execution bridge, and complete deferred deep browser acceptance; retain explicit evidence for all remaining negative directions.`
+- `NEXT_WORK = provision/qualify an independently operated Agent Execution bridge when available, complete deferred deep browser acceptance with a signed-in session, and add task-quality verification only when live work produces an unresolved case; retain explicit evidence for all remaining negative directions.`

docs/evidence/audit-runtime-status-2026-08-23-v2.json

@@ -0,0 +1,33 @@
+{
+  "observed_on": "2026-08-23",
+  "source": "production docker.cin.su read-only live checks",
+  "public": {
+    "healthz": {"status": 200, "runtime": "creator-web"}
+  },
+  "agent_worker": {
+    "runtime": "agent-worker",
+    "executor_configured": false,
+    "mode": "local-fallback",
+    "ready": false,
+    "local_fallback": true,
+    "reason": "external bridge unavailable; durable work is retained without external mutation"
+  },
+  "fleet": {
+    "preferred_tier": "FAST",
+    "selected_tier": "FAST",
+    "ready_tiers": ["FAST", "MEDIUM", "LIFEBOAT"],
+    "fallback_tier": "LIFEBOAT",
+    "heavy": {"ready": false, "reason_class": "provider timeout"}
+  },
+  "runtimes": {
+    "core": "ready",
+    "work_graph": "ready",
+    "research": "ready",
+    "reflection_worker": "running"
+  },
+  "ui": {
+    "public_admin_shell": "available",
+    "authenticated_browser_session": "not_available_for_current_acceptance"
+  },
+  "secret_policy": "values omitted; only typed states and reason classes retained"
+}

modules/capability/domain/task_evaluation.go

@@ -2,6 +2,7 @@ package domain
 
 import (
 	"errors"
+	"fmt"
 
 	"git.cin.su/m/Assistant/contracts/artifact"
 	"git.cin.su/m/Assistant/contracts/capability"
@@ -9,6 +10,35 @@ import (
 
 var ErrInvalidTaskEvaluation = errors.New("invalid task evaluation")
 
+const automaticExpansionMinimumOverallScore int64 = 700
+
+// AutomaticTaskEvaluationExpansion decides whether a completed general
+// evaluation has evidence that warrants a bounded additional profile. It is
+// deliberately conservative: one supported candidate above the quality
+// threshold suppresses expansion, while unknown/unsupported/low-scoring or
+// critically failing candidates keep the unresolved path explicit.
+func AutomaticTaskEvaluationExpansion(parent capability.TaskEvaluationProfile, parentGraphState string, evaluations []capability.TaskEvaluation, request capability.TaskEvaluationExpansionRequest, profileID capability.TaskEvaluationProfileID, revision int64) (capability.TaskEvaluationProfile, bool, error) {
+	if parentGraphState != "COMPLETED" && parentGraphState != "PARTIAL" {
+		return capability.TaskEvaluationProfile{}, false, nil
+	}
+	if len(evaluations) == 0 {
+		return capability.TaskEvaluationProfile{}, false, nil
+	}
+	for _, evaluation := range evaluations {
+		if evaluation.Result == capability.EvaluationSupported && evaluation.OverallScoreMillis >= automaticExpansionMinimumOverallScore && evaluation.CriticalFailureMillis == 0 {
+			return capability.TaskEvaluationProfile{}, false, nil
+		}
+	}
+	if request.TriggerEvidenceRef == "" || len(request.NewCaseIDs) == 0 {
+		return capability.TaskEvaluationProfile{}, false, fmt.Errorf("unresolved task evaluation requires trigger evidence and additional cases")
+	}
+	profile, err := BuildAdditionalTaskEvaluationProfile(parent, request, profileID, revision)
+	if err != nil {
+		return capability.TaskEvaluationProfile{}, false, err
+	}
+	return profile, true, nil
+}
+
 func BuildAdditionalTaskEvaluationProfile(parent capability.TaskEvaluationProfile, request capability.TaskEvaluationExpansionRequest, profileID capability.TaskEvaluationProfileID, revision int64) (capability.TaskEvaluationProfile, error) {
 	if err := parent.Validate(); err != nil || parent.Stage != capability.TaskEvaluationGeneral || request.ParentProfileID != parent.ID || request.CapabilityID != parent.CapabilityID || request.TriggerEvidenceRef == "" || len(request.NewCaseIDs) == 0 || profileID == "" || revision < 1 || request.BenchmarkVersion == "" {
 		return capability.TaskEvaluationProfile{}, ErrInvalidTaskEvaluation
@@ -55,6 +85,12 @@ func BuildTaskEvaluation(profile capability.TaskEvaluationProfile, evaluationID
 		if _, ok := seen[observation.CaseID]; ok || observation.EvidenceArtifactRef == "" || observation.QualityScoreMillis < 0 || observation.QualityScoreMillis > 1000 || observation.LatencyMicros < 0 {
 			return capability.TaskEvaluation{}, ErrInvalidTaskEvaluation
 		}
+		if observation.Result == capability.EvaluationSupported && (observation.VerificationEvidenceRef == "" || observation.VerifierIdentity == "") {
+			return capability.TaskEvaluation{}, ErrInvalidTaskEvaluation
+		}
+		if observation.Result == capability.EvaluationUnknown && observation.QualityScoreMillis != 0 {
+			return capability.TaskEvaluation{}, ErrInvalidTaskEvaluation
+		}
 		seen[observation.CaseID] = struct{}{}
 		qualityTotal += observation.QualityScoreMillis
 		latencyTotal += observation.LatencyMicros

modules/capability/domain/task_evaluation_test.go

@@ -10,14 +10,22 @@ import (
 func TestBuildTaskEvaluationAggregatesOnlyProfileCases(t *testing.T) {
 	profile := capability.TaskEvaluationProfile{ID: "research-v1", Revision: 1, CapabilityID: "creator-advisory", Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "research-v1", RequiredCaseIDs: []string{"claim", "uncertainty"}, QualityWeightMillis: 600, ReliabilityWeightMillis: 300, LatencyWeightMillis: 100}
 	value, err := BuildTaskEvaluation(profile, "evaluation-1", "binding-1", 2, "creator-advisory", []capability.TaskCaseObservation{
-		{CaseID: "claim", Result: capability.EvaluationSupported, QualityScoreMillis: 900, LatencyMicros: 400_000, EvidenceArtifactRef: "artifact-case-1"},
-		{CaseID: "uncertainty", Result: capability.EvaluationSupported, QualityScoreMillis: 800, LatencyMicros: 600_000, EvidenceArtifactRef: "artifact-case-2"},
+		{CaseID: "claim", Result: capability.EvaluationSupported, QualityScoreMillis: 900, LatencyMicros: 400_000, EvidenceArtifactRef: "artifact-case-1", VerificationEvidenceRef: "verify-case-1", VerifierIdentity: "verifier-1"},
+		{CaseID: "uncertainty", Result: capability.EvaluationSupported, QualityScoreMillis: 800, LatencyMicros: 600_000, EvidenceArtifactRef: "artifact-case-2", VerificationEvidenceRef: "verify-case-2", VerifierIdentity: "verifier-1"},
 	}, artifact.ArtifactID("artifact-summary"), 10)
 	if err != nil || value.Result != capability.EvaluationSupported || value.OverallScoreMillis == 0 || value.ProfileID != profile.ID {
 		t.Fatalf("evaluation=%+v err=%v", value, err)
 	}
 }
 
+func TestBuildTaskEvaluationRejectsSupportedWithoutIndependentVerifier(t *testing.T) {
+	profile := capability.TaskEvaluationProfile{ID: "quality-v1", Revision: 1, CapabilityID: "creator-advisory", Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "quality-v1", RequiredCaseIDs: []string{"case"}, QualityWeightMillis: 700, ReliabilityWeightMillis: 200, LatencyWeightMillis: 100}
+	_, err := BuildTaskEvaluation(profile, "evaluation-unverified", "binding-1", 1, profile.CapabilityID, []capability.TaskCaseObservation{{CaseID: "case", Result: capability.EvaluationSupported, QualityScoreMillis: 900, EvidenceArtifactRef: "artifact-case"}}, artifact.ArtifactID("artifact-summary"), 1)
+	if err == nil {
+		t.Fatal("supported observation without verifier evidence was accepted")
+	}
+}
+
 func TestBuildTaskEvaluationDoesNotPromoteUnknown(t *testing.T) {
 	profile := capability.TaskEvaluationProfile{ID: "coding-v1", Revision: 1, CapabilityID: "creator-advisory", Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "coding-v1", RequiredCaseIDs: []string{"compile"}, QualityWeightMillis: 700, ReliabilityWeightMillis: 200, LatencyWeightMillis: 100}
 	value, err := BuildTaskEvaluation(profile, "evaluation-2", "binding-1", 2, "creator-advisory", []capability.TaskCaseObservation{{CaseID: "compile", Result: capability.EvaluationUnknown, QualityScoreMillis: 0, LatencyMicros: 0, EvidenceArtifactRef: "artifact-case"}}, artifact.ArtifactID("artifact-summary"), 11)
@@ -33,3 +41,21 @@ func TestBuildAdditionalProfileRequiresUnresolvedEvidenceAndPreservesHistory(t *
 		t.Fatalf("profile=%+v err=%v", profile, err)
 	}
 }
+
+func TestAutomaticExpansionWaitsForGeneralGraphAndUnresolvedCandidates(t *testing.T) {
+	parent := capability.TaskEvaluationProfile{ID: "general-v1", Revision: 1, CapabilityID: "creator-advisory", Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "general-v1", RequiredCaseIDs: []string{"general"}, QualityWeightMillis: 700, ReliabilityWeightMillis: 200, LatencyWeightMillis: 100}
+	request := capability.TaskEvaluationExpansionRequest{ParentProfileID: parent.ID, CapabilityID: parent.CapabilityID, TriggerEvidenceRef: "outcome-unsolved", NewCaseIDs: []string{"edge-case"}, BenchmarkVersion: "additional-v1"}
+	value, expanded, err := AutomaticTaskEvaluationExpansion(parent, "COMPLETED", []capability.TaskEvaluation{{ID: "evaluation-1", ProfileID: parent.ID, BindingID: "binding-1", BindingRevision: 1, CapabilityID: parent.CapabilityID, Result: capability.EvaluationUnknown, OverallScoreMillis: 0, CriticalFailureMillis: 1000, BenchmarkVersion: parent.BenchmarkVersion, ArtifactID: "artifact-1", ObservedAtUnixMillis: 1}}, request, "additional-v1", 1)
+	if err != nil || !expanded || value.Stage != capability.TaskEvaluationAdditional || value.ParentProfileID != parent.ID {
+		t.Fatalf("expected bounded expansion, profile=%+v expanded=%t err=%v", value, expanded, err)
+	}
+}
+
+func TestAutomaticExpansionDoesNotRunWhenAQualifiedCandidateExists(t *testing.T) {
+	parent := capability.TaskEvaluationProfile{ID: "general-v1", Revision: 1, CapabilityID: "creator-advisory", Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "general-v1", RequiredCaseIDs: []string{"general"}, QualityWeightMillis: 700, ReliabilityWeightMillis: 200, LatencyWeightMillis: 100}
+	request := capability.TaskEvaluationExpansionRequest{ParentProfileID: parent.ID, CapabilityID: parent.CapabilityID, TriggerEvidenceRef: "outcome-unsolved", NewCaseIDs: []string{"edge-case"}, BenchmarkVersion: "additional-v1"}
+	value, expanded, err := AutomaticTaskEvaluationExpansion(parent, "PARTIAL", []capability.TaskEvaluation{{ID: "evaluation-1", ProfileID: parent.ID, BindingID: "binding-1", BindingRevision: 1, CapabilityID: parent.CapabilityID, Result: capability.EvaluationSupported, OverallScoreMillis: 850, CriticalFailureMillis: 0, BenchmarkVersion: parent.BenchmarkVersion, ArtifactID: "artifact-1", ObservedAtUnixMillis: 1}}, request, "additional-v1", 1)
+	if err != nil || expanded || value.ID != "" {
+		t.Fatalf("qualified candidate must suppress expansion: profile=%+v expanded=%t err=%v", value, expanded, err)
+	}
+}