Allow review of backed research answers

Reviewed-on: #401

adapters/developmentexecutor/executor.go

@@ -0,0 +1,197 @@
+// Package developmentexecutor contains the local, read-only verification
+// adapter for governed development candidates. It is deliberately not a
+// source mutator, promotion authority, secret resolver, or deployment tool.
+package developmentexecutor
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+type CheckKind string
+
+const (
+	CheckGoTest       CheckKind = "GO_TEST"
+	CheckGoVet        CheckKind = "GO_VET"
+	CheckGitDiffCheck CheckKind = "GIT_DIFF_CHECK"
+)
+
+type Check struct {
+	Kind     CheckKind
+	Packages []string
+}
+
+type Plan struct {
+	Worktree            string
+	WorktreeID          string
+	BaseRepoRevision    string
+	ProtectedMainAccess string
+	ProductionAccess    string
+	SecretAccess        string
+	Checks              []Check
+}
+
+type CheckResult struct {
+	Kind           CheckKind `json:"kind"`
+	Passed         bool      `json:"passed"`
+	ExitCode       int       `json:"exit_code"`
+	DurationMillis int64     `json:"duration_millis"`
+}
+
+type Result struct {
+	WorktreeID       string        `json:"worktree_id"`
+	BaseRepoRevision string        `json:"base_repo_revision"`
+	Passed           bool          `json:"passed"`
+	Checks           []CheckResult `json:"checks"`
+	EvidenceRef      string        `json:"evidence_ref"`
+}
+
+var (
+	ErrInvalidPlan       = errors.New("invalid governed verification plan")
+	ErrUnsupportedCheck  = errors.New("unsupported governed verification check")
+	ErrProtectedWorktree = errors.New("protected worktree is not executable")
+)
+
+type CommandRunner interface {
+	Run(context.Context, string, string, []string) int
+}
+
+type OSCommandRunner struct{}
+
+func (OSCommandRunner) Run(ctx context.Context, dir, name string, args []string) int {
+	command := exec.CommandContext(ctx, name, args...)
+	command.Dir = dir
+	command.Stdin = nil
+	command.Stdout = io.Discard
+	command.Stderr = io.Discard
+	command.Env = safeEnvironment()
+	if err := command.Run(); err != nil {
+		if exitErr, ok := err.(*exec.ExitError); ok {
+			return exitErr.ExitCode()
+		}
+		return -1
+	}
+	return 0
+}
+
+func ValidatePlan(plan Plan) error {
+	if strings.TrimSpace(plan.Worktree) == "" || strings.TrimSpace(plan.WorktreeID) == "" || strings.TrimSpace(plan.BaseRepoRevision) == "" || len(plan.Checks) == 0 {
+		return ErrInvalidPlan
+	}
+	if !filepath.IsAbs(plan.Worktree) {
+		return ErrInvalidPlan
+	}
+	if plan.ProtectedMainAccess != "DENIED" || plan.ProductionAccess != "DENIED" || plan.SecretAccess != "DENIED" {
+		return ErrProtectedWorktree
+	}
+	switch strings.ToLower(filepath.Base(filepath.Clean(plan.WorktreeID))) {
+	case "main", "protected-main", "production":
+		return ErrProtectedWorktree
+	}
+	for _, check := range plan.Checks {
+		if err := validateCheck(check); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateCheck(check Check) error {
+	switch check.Kind {
+	case CheckGoTest, CheckGoVet:
+		if len(check.Packages) == 0 {
+			return ErrInvalidPlan
+		}
+		for _, packagePath := range check.Packages {
+			if strings.TrimSpace(packagePath) == "" || strings.ContainsAny(packagePath, ";&|`$()<>\r\n") || unsafePackagePath(packagePath) {
+				return ErrInvalidPlan
+			}
+		}
+	case CheckGitDiffCheck:
+		if len(check.Packages) != 0 {
+			return ErrInvalidPlan
+		}
+	default:
+		return ErrUnsupportedCheck
+	}
+	return nil
+}
+
+func unsafePackagePath(value string) bool {
+	value = strings.ReplaceAll(value, "\\", "/")
+	for _, part := range strings.Split(value, "/") {
+		if part == ".." {
+			return true
+		}
+	}
+	return strings.HasPrefix(value, "../") || strings.HasPrefix(value, "/") || (len(value) > 1 && value[1] == ':')
+}
+
+func Execute(ctx context.Context, plan Plan, runner CommandRunner) (Result, error) {
+	if err := ValidatePlan(plan); err != nil {
+		return Result{}, err
+	}
+	if runner == nil {
+		runner = OSCommandRunner{}
+	}
+	if _, err := os.Stat(plan.Worktree); err != nil {
+		return Result{}, fmt.Errorf("worktree unavailable: %w", err)
+	}
+	result := Result{WorktreeID: plan.WorktreeID, BaseRepoRevision: plan.BaseRepoRevision, Passed: true, Checks: make([]CheckResult, 0, len(plan.Checks))}
+	for _, check := range plan.Checks {
+		started := time.Now()
+		name, args := commandFor(check)
+		exitCode := runner.Run(ctx, plan.Worktree, name, args)
+		passed := exitCode == 0
+		result.Checks = append(result.Checks, CheckResult{Kind: check.Kind, Passed: passed, ExitCode: exitCode, DurationMillis: time.Since(started).Milliseconds()})
+		if !passed {
+			result.Passed = false
+		}
+		if ctx.Err() != nil {
+			result.Passed = false
+			break
+		}
+	}
+	result.EvidenceRef = evidenceRef(result)
+	return result, nil
+}
+
+func commandFor(check Check) (string, []string) {
+	switch check.Kind {
+	case CheckGoTest:
+		return "go", append([]string{"test"}, check.Packages...)
+	case CheckGoVet:
+		return "go", append([]string{"vet"}, check.Packages...)
+	default:
+		return "git", []string{"diff", "--check"}
+	}
+}
+
+func evidenceRef(result Result) string {
+	hash := sha256.New()
+	_, _ = fmt.Fprintf(hash, "%s|%s|%t|", result.WorktreeID, result.BaseRepoRevision, result.Passed)
+	for _, check := range result.Checks {
+		_, _ = fmt.Fprintf(hash, "%s|%t|%d|", check.Kind, check.Passed, check.ExitCode)
+	}
+	return "verification:" + hex.EncodeToString(hash.Sum(nil))
+}
+
+func safeEnvironment() []string {
+	allowed := []string{"PATH", "SystemRoot", "TEMP", "TMP", "GOROOT", "GOPATH", "GOMODCACHE"}
+	result := make([]string, 0, len(allowed))
+	for _, name := range allowed {
+		if value, ok := os.LookupEnv(name); ok && value != "" {
+			result = append(result, name+"="+value)
+		}
+	}
+	return result
+}

adapters/developmentexecutor/executor_test.go

@@ -0,0 +1,70 @@
+package developmentexecutor
+
+import (
+	"context"
+	"errors"
+	"path/filepath"
+	"testing"
+)
+
+type fakeRunner struct {
+	calls []string
+	exits []int
+}
+
+func (r *fakeRunner) Run(_ context.Context, _ string, name string, args []string) int {
+	call := name
+	for _, arg := range args {
+		call += " " + arg
+	}
+	r.calls = append(r.calls, call)
+	if len(r.exits) == 0 {
+		return 0
+	}
+	exit := r.exits[0]
+	r.exits = r.exits[1:]
+	return exit
+}
+
+func validPlan(t *testing.T) Plan {
+	t.Helper()
+	worktree, err := filepath.Abs(".")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return Plan{Worktree: worktree, WorktreeID: "sandbox-1", BaseRepoRevision: "revision-1", ProtectedMainAccess: "DENIED", ProductionAccess: "DENIED", SecretAccess: "DENIED", Checks: []Check{{Kind: CheckGoTest, Packages: []string{"./modules/work/..."}}, {Kind: CheckGoVet, Packages: []string{"./modules/work/..."}}, {Kind: CheckGitDiffCheck}}}
+}
+
+func TestExecuteRunsOnlyTypedChecksAndReturnsEvidence(t *testing.T) {
+	runner := &fakeRunner{}
+	result, err := Execute(context.Background(), validPlan(t), runner)
+	if err != nil || !result.Passed || len(result.Checks) != 3 || result.EvidenceRef == "" {
+		t.Fatalf("result=%+v err=%v", result, err)
+	}
+	if len(runner.calls) != 3 || runner.calls[0] != "go test ./modules/work/..." || runner.calls[2] != "git diff --check" {
+		t.Fatalf("calls=%v", runner.calls)
+	}
+}
+
+func TestExecuteFailureCannotBecomeVerificationSuccess(t *testing.T) {
+	runner := &fakeRunner{exits: []int{1, 0}}
+	plan := validPlan(t)
+	plan.Checks = []Check{{Kind: CheckGoTest, Packages: []string{"./..."}}, {Kind: CheckGitDiffCheck}}
+	result, err := Execute(context.Background(), plan, runner)
+	if err != nil || result.Passed || result.Checks[0].Passed || result.EvidenceRef == "" {
+		t.Fatalf("failed result was overclaimed: %+v err=%v", result, err)
+	}
+}
+
+func TestValidatePlanRejectsProtectedAndShellLikeInputs(t *testing.T) {
+	protected := validPlan(t)
+	protected.WorktreeID = "production"
+	if !errors.Is(ValidatePlan(protected), ErrProtectedWorktree) {
+		t.Fatal("protected worktree accepted")
+	}
+	injection := validPlan(t)
+	injection.Checks = []Check{{Kind: CheckGoTest, Packages: []string{"./...; echo leaked"}}}
+	if !errors.Is(ValidatePlan(injection), ErrInvalidPlan) {
+		t.Fatal("shell-like package accepted")
+	}
+}

adapters/models/openai_compatible_local.go

@@ -122,10 +122,10 @@ type compatibleChatResponse struct {
 }
 
 func (a *OpenAICompatibleLocalAdapter) Advise(ctx context.Context, request cognitive.AdvisoryRequest) (cognitive.AdvisoryResponse, error) {
-	if err := ValidateAdvisoryRequest(request); err != nil || request.ProviderModelID == "" || len(request.Context) != 0 {
+	if err := ValidateAdvisoryRequest(request); err != nil || request.ProviderModelID == "" {
 		return cognitive.AdvisoryResponse{}, ErrInvalidAdvisory
 	}
-	payload := compatibleChatRequest{Model: string(request.ProviderModelID), Messages: []compatibleMessage{{Role: "system", Content: "Provide non-canonical advisory text only. Never claim that an action occurred."}, {Role: "user", Content: request.Message}}, Temperature: 0, Stream: false, MaxTokens: request.MaxOutputBytes / 4, ChatTemplateKwargs: compatibleTemplateKwargs{EnableThinking: false}}
+	payload := compatibleChatRequest{Model: string(request.ProviderModelID), Messages: []compatibleMessage{{Role: "system", Content: "Ты отвечаешь от имени Домового — локального помощника пользователя. Не называй себя именем модели, поставщиком или внутренним runtime. Если спрашивают имя, ответь: «Меня зовут Домовой». Понимай смысл сообщения и помогай довести цель до полезного результата. По умолчанию отвечай кратко, примерно одним-тремя предложениями; подробности давай только по просьбе. Отвечай только некатегоричным текстом совета; не утверждай, что внешнее действие уже выполнено."}, {Role: "user", Content: localAdvisoryMessage(request)}}, Temperature: 0, Stream: false, MaxTokens: request.MaxOutputBytes / 4, ChatTemplateKwargs: compatibleTemplateKwargs{EnableThinking: false}}
 	var result compatibleChatResponse
 	status, err := a.requestJSON(ctx, http.MethodPost, "/chat/completions", payload, &result)
 	if err != nil {
@@ -151,6 +151,19 @@ func (a *OpenAICompatibleLocalAdapter) Advise(ctx context.Context, request cogni
 	return response, nil
 }
 
+func localAdvisoryMessage(request cognitive.AdvisoryRequest) string {
+	if len(request.Context) == 0 {
+		return request.Message
+	}
+	var builder strings.Builder
+	builder.WriteString(request.Message)
+	builder.WriteString("\n\nRelevant local context:\n")
+	for _, excerpt := range request.Context {
+		fmt.Fprintf(&builder, "- [%s/%s] %s\n", excerpt.SourceKind, excerpt.SourceID, excerpt.Text)
+	}
+	return builder.String()
+}
+
 func (a *OpenAICompatibleLocalAdapter) requestJSON(ctx context.Context, method, path string, input, output any) (int, error) {
 	var body io.Reader
 	if input != nil {

adapters/models/openai_compatible_local_test.go

@@ -92,3 +92,32 @@ func TestOpenAICompatibleLocalAdapterDisablesTemplateThinkingForBoundedAdvisory(
 		t.Fatal("expected bounded advisory to disable template thinking")
 	}
 }
+
+func TestOpenAICompatibleLocalAdapterPassesLocalContextToAdvisory(t *testing.T) {
+	transport := &captureRoundTripper{}
+	adapter, err := NewOpenAICompatibleLocalAdapter("http://gateway/v1", transport)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = adapter.Advise(context.Background(), cognitive.AdvisoryRequest{
+		Version: cognitive.CreatorAdvisoryV1, RequestID: "request-context", ActorID: "actor", PrincipalID: "principal", ScopeID: "scope",
+		Message: "Продолжи разговор", Locale: "ru-RU", MaxOutputBytes: 256, ProviderBindingID: "binding-1", ProviderBindingRevision: 1,
+		ProviderInstanceID: "provider-1", ModelDescriptorID: "model-1", ProviderModelID: capability.ProviderModelID("local-model"),
+		Context: []cognitive.ContextExcerpt{{ID: "focus", SourceKind: "situation", SourceID: "focus-1", Revision: 1, Sensitivity: cognitive.SensitivityPrivateAllowed, Text: "Активный проект: Домовой"}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var payload struct {
+		Messages []struct {
+			Role    string `json:"role"`
+			Content string `json:"content"`
+		} `json:"messages"`
+	}
+	if err := json.Unmarshal(transport.body, &payload); err != nil {
+		t.Fatal(err)
+	}
+	if len(payload.Messages) != 2 || !strings.Contains(payload.Messages[1].Content, "Активный проект: Домовой") {
+		t.Fatalf("local context was not passed to advisory: %+v", payload.Messages)
+	}
+}

adapters/multimodal/client.go

@@ -0,0 +1,509 @@
+package multimodal
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"mime/multipart"
+	"net/http"
+	"net/textproto"
+	"net/url"
+	"strings"
+	"time"
+)
+
+var ErrEmptyResult = errors.New("multimodal provider returned an empty result")
+
+type SpeechClient struct {
+	BaseURL string
+	Client  *http.Client
+}
+
+type VisionClient struct {
+	BaseURL string
+	Client  *http.Client
+}
+
+type ImageGenerationClient struct {
+	BaseURL string
+	Client  *http.Client
+}
+
+type VideoUnderstandingClient struct {
+	BaseURL string
+	Client  *http.Client
+}
+
+type GeneratedImage struct {
+	DataBase64  string
+	SourceURL   string
+	ContentType string
+}
+
+type ImageGenerator interface {
+	Generate(ctx context.Context, model, prompt, size string) (GeneratedImage, error)
+}
+
+// ComfyImageGenerationClient is the replaceable transport for a ComfyUI
+// image-generation skill. The workflow is deliberately kept in this adapter:
+// the core only selects a capability and supplies the user's prompt.
+type ComfyImageGenerationClient struct {
+	BaseURL      string
+	Client       *http.Client
+	PollInterval time.Duration
+	PollTimeout  time.Duration
+}
+
+func (c SpeechClient) Transcribe(ctx context.Context, filename, contentType string, data []byte) (string, error) {
+	if len(data) == 0 {
+		return "", errors.New("audio payload is empty")
+	}
+	body := &bytes.Buffer{}
+	writer := multipart.NewWriter(body)
+	header := make(textproto.MIMEHeader)
+	header.Set("Content-Disposition", fmt.Sprintf(`form-data; name="file"; filename="%s"`, strings.ReplaceAll(filename, `"`, "")))
+	header.Set("Content-Type", contentType)
+	part, err := writer.CreatePart(header)
+	if err != nil {
+		return "", err
+	}
+	if _, err := part.Write(data); err != nil {
+		return "", err
+	}
+	if err := writer.WriteField("response_format", "json"); err != nil {
+		return "", err
+	}
+	if err := writer.Close(); err != nil {
+		return "", err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, strings.TrimRight(c.BaseURL, "/")+"/inference", body)
+	if err != nil {
+		return "", err
+	}
+	request.Header.Set("Content-Type", writer.FormDataContentType())
+	response, err := c.client().Do(request)
+	if err != nil {
+		return "", err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("speech provider status %d", response.StatusCode)
+	}
+	var result struct {
+		Text string `json:"text"`
+	}
+	if err := json.NewDecoder(io.LimitReader(response.Body, 1<<20)).Decode(&result); err != nil {
+		return "", err
+	}
+	if strings.TrimSpace(result.Text) == "" {
+		return "", ErrEmptyResult
+	}
+	return strings.TrimSpace(result.Text), nil
+}
+
+func (c VisionClient) Describe(ctx context.Context, model, contentType string, data []byte, instruction string) (string, error) {
+	if len(data) == 0 {
+		return "", errors.New("image payload is empty")
+	}
+	payload := struct {
+		Model    string `json:"model"`
+		Messages []struct {
+			Role    string `json:"role"`
+			Content []struct {
+				Type     string `json:"type"`
+				Text     string `json:"text,omitempty"`
+				ImageURL *struct {
+					URL string `json:"url"`
+				} `json:"image_url,omitempty"`
+			} `json:"content"`
+		} `json:"messages"`
+		MaxTokens int `json:"max_tokens"`
+	}{}
+	payload.Model = model
+	payload.MaxTokens = 1024
+	payload.Messages = append(payload.Messages, struct {
+		Role    string `json:"role"`
+		Content []struct {
+			Type     string `json:"type"`
+			Text     string `json:"text,omitempty"`
+			ImageURL *struct {
+				URL string `json:"url"`
+			} `json:"image_url,omitempty"`
+		} `json:"content"`
+	}{Role: "user", Content: []struct {
+		Type     string `json:"type"`
+		Text     string `json:"text,omitempty"`
+		ImageURL *struct {
+			URL string `json:"url"`
+		} `json:"image_url,omitempty"`
+	}{
+		{Type: "text", Text: instruction},
+		{Type: "image_url", ImageURL: &struct {
+			URL string `json:"url"`
+		}{URL: "data:" + contentType + ";base64," + encodeBase64(data)},
+		}}})
+	encoded, err := json.Marshal(payload)
+	if err != nil {
+		return "", err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, strings.TrimRight(c.BaseURL, "/")+"/chat/completions", bytes.NewReader(encoded))
+	if err != nil {
+		return "", err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	response, err := c.client().Do(request)
+	if err != nil {
+		return "", err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("vision provider status %d", response.StatusCode)
+	}
+	var result struct {
+		Choices []struct {
+			Message struct {
+				Content          string `json:"content"`
+				ReasoningContent string `json:"reasoning_content"`
+			} `json:"message"`
+		} `json:"choices"`
+	}
+	if err := json.NewDecoder(io.LimitReader(response.Body, 2<<20)).Decode(&result); err != nil {
+		return "", err
+	}
+	if len(result.Choices) == 0 {
+		return "", ErrEmptyResult
+	}
+	text := strings.TrimSpace(result.Choices[0].Message.Content)
+	if text == "" {
+		text = strings.TrimSpace(result.Choices[0].Message.ReasoningContent)
+	}
+	if text == "" {
+		return "", ErrEmptyResult
+	}
+	return text, nil
+}
+
+// Generate uses an OpenAI-compatible image-generation skill. The provider is
+// selected outside the core by the capability binding; this adapter contains
+// transport only and never decides what the user meant.
+func (c ImageGenerationClient) Generate(ctx context.Context, model, prompt, size string) (GeneratedImage, error) {
+	if strings.TrimSpace(prompt) == "" {
+		return GeneratedImage{}, errors.New("image prompt is empty")
+	}
+	payload := struct {
+		Model          string `json:"model"`
+		Prompt         string `json:"prompt"`
+		Size           string `json:"size,omitempty"`
+		ResponseFormat string `json:"response_format,omitempty"`
+	}{Model: model, Prompt: prompt, Size: size, ResponseFormat: "b64_json"}
+	encoded, err := json.Marshal(payload)
+	if err != nil {
+		return GeneratedImage{}, err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, strings.TrimRight(c.BaseURL, "/")+"/images/generations", bytes.NewReader(encoded))
+	if err != nil {
+		return GeneratedImage{}, err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	response, err := c.client().Do(request)
+	if err != nil {
+		return GeneratedImage{}, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode > 299 {
+		return GeneratedImage{}, fmt.Errorf("image provider status %d", response.StatusCode)
+	}
+	var result struct {
+		Data []struct {
+			Base64 string `json:"b64_json"`
+			URL    string `json:"url"`
+		} `json:"data"`
+	}
+	if err := json.NewDecoder(io.LimitReader(response.Body, 32<<20)).Decode(&result); err != nil {
+		return GeneratedImage{}, err
+	}
+	if len(result.Data) == 0 || (strings.TrimSpace(result.Data[0].Base64) == "" && strings.TrimSpace(result.Data[0].URL) == "") {
+		return GeneratedImage{}, ErrEmptyResult
+	}
+	return GeneratedImage{DataBase64: result.Data[0].Base64, SourceURL: result.Data[0].URL, ContentType: "image/png"}, nil
+}
+
+func (c ComfyImageGenerationClient) Generate(ctx context.Context, model, prompt, size string) (GeneratedImage, error) {
+	if strings.TrimSpace(prompt) == "" {
+		return GeneratedImage{}, errors.New("image prompt is empty")
+	}
+	width, height := imageSize(size)
+	workflow := map[string]any{
+		"3":  map[string]any{"inputs": map[string]any{"seed": time.Now().UnixNano(), "steps": 8, "cfg": 1.0, "sampler_name": "euler", "scheduler": "simple", "denoise": 1.0, "model": []any{"16", 0}, "positive": []any{"6", 0}, "negative": []any{"7", 0}, "latent_image": []any{"13", 0}}, "class_type": "KSampler"},
+		"6":  map[string]any{"inputs": map[string]any{"text": prompt, "clip": []any{"18", 0}}, "class_type": "CLIPTextEncode"},
+		"7":  map[string]any{"inputs": map[string]any{"text": "blurry, ugly, distorted", "clip": []any{"18", 0}}, "class_type": "CLIPTextEncode"},
+		"8":  map[string]any{"inputs": map[string]any{"samples": []any{"3", 0}, "vae": []any{"17", 0}}, "class_type": "VAEDecode"},
+		"9":  map[string]any{"inputs": map[string]any{"filename_prefix": "domovoy", "images": []any{"8", 0}}, "class_type": "SaveImage"},
+		"13": map[string]any{"inputs": map[string]any{"width": width, "height": height, "batch_size": 1}, "class_type": "EmptySD3LatentImage"},
+		"16": map[string]any{"inputs": map[string]any{"unet_name": "z_image_turbo_bf16.safetensors", "weight_dtype": "default"}, "class_type": "UNETLoader"},
+		"17": map[string]any{"inputs": map[string]any{"vae_name": "ae.safetensors"}, "class_type": "VAELoader"},
+		"18": map[string]any{"inputs": map[string]any{"clip_name": "qwen_3_4b.safetensors", "type": "lumina2", "device": "default"}, "class_type": "CLIPLoader"},
+	}
+	payload := map[string]any{"prompt": workflow, "client_id": fmt.Sprintf("domovoy-%d", time.Now().UnixNano())}
+	encoded, err := json.Marshal(payload)
+	if err != nil {
+		return GeneratedImage{}, err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, strings.TrimRight(c.BaseURL, "/")+"/prompt", bytes.NewReader(encoded))
+	if err != nil {
+		return GeneratedImage{}, err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	response, err := c.client().Do(request)
+	if err != nil {
+		return GeneratedImage{}, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode > 299 {
+		return GeneratedImage{}, fmt.Errorf("comfy provider status %d", response.StatusCode)
+	}
+	var accepted struct {
+		PromptID string `json:"prompt_id"`
+	}
+	if err := json.NewDecoder(io.LimitReader(response.Body, 1<<20)).Decode(&accepted); err != nil {
+		return GeneratedImage{}, err
+	}
+	if accepted.PromptID == "" {
+		return GeneratedImage{}, ErrEmptyResult
+	}
+	// A caller timeout must remove only this prompt. ComfyUI's global
+	// /interrupt endpoint can otherwise stop unrelated users' work and leave
+	// queued requests in an ambiguous state.
+	defer func() {
+		if ctx.Err() != nil {
+			cancelCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+			if err := c.cancelPrompt(cancelCtx, accepted.PromptID); err != nil {
+				// The original context error is more useful to the caller; the
+				// provider cleanup failure remains observable in the server log.
+				log.Printf("comfy prompt cleanup failed for %s: %v", accepted.PromptID, err)
+			}
+		}
+	}()
+
+	interval := c.PollInterval
+	if interval <= 0 {
+		interval = time.Second
+	}
+	timeout := c.PollTimeout
+	if timeout <= 0 {
+		timeout = 10 * time.Minute
+	}
+	deadline := time.NewTimer(timeout)
+	defer deadline.Stop()
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+	for {
+		image, done, err := c.historyImage(ctx, accepted.PromptID)
+		if err != nil {
+			return GeneratedImage{}, err
+		}
+		if done {
+			return image, nil
+		}
+		select {
+		case <-ctx.Done():
+			return GeneratedImage{}, ctx.Err()
+		case <-deadline.C:
+			return GeneratedImage{}, context.DeadlineExceeded
+		case <-ticker.C:
+		}
+	}
+}
+
+func (c ComfyImageGenerationClient) cancelPrompt(ctx context.Context, promptID string) error {
+	if strings.TrimSpace(promptID) == "" {
+		return errors.New("comfy prompt id is empty")
+	}
+	payload, err := json.Marshal(map[string][]string{"delete": {promptID}})
+	if err != nil {
+		return err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, strings.TrimRight(c.BaseURL, "/")+"/queue", bytes.NewReader(payload))
+	if err != nil {
+		return err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	response, err := c.client().Do(request)
+	if err != nil {
+		return err
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode > 299 {
+		return fmt.Errorf("comfy prompt cleanup status %d", response.StatusCode)
+	}
+	return nil
+}
+
+func (c ComfyImageGenerationClient) historyImage(ctx context.Context, promptID string) (GeneratedImage, bool, error) {
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, strings.TrimRight(c.BaseURL, "/")+"/history/"+url.PathEscape(promptID), nil)
+	if err != nil {
+		return GeneratedImage{}, false, err
+	}
+	response, err := c.client().Do(request)
+	if err != nil {
+		return GeneratedImage{}, false, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode == http.StatusNotFound {
+		return GeneratedImage{}, false, nil
+	}
+	if response.StatusCode < 200 || response.StatusCode > 299 {
+		return GeneratedImage{}, false, fmt.Errorf("comfy history status %d", response.StatusCode)
+	}
+	var history map[string]struct {
+		Outputs map[string]struct {
+			Images []struct {
+				Filename  string `json:"filename"`
+				Subfolder string `json:"subfolder"`
+				Type      string `json:"type"`
+			} `json:"images"`
+		} `json:"outputs"`
+	}
+	if err := json.NewDecoder(io.LimitReader(response.Body, 4<<20)).Decode(&history); err != nil {
+		return GeneratedImage{}, false, err
+	}
+	record, ok := history[promptID]
+	if !ok {
+		return GeneratedImage{}, false, nil
+	}
+	for _, output := range record.Outputs {
+		for _, image := range output.Images {
+			if image.Filename == "" {
+				continue
+			}
+			query := url.Values{"filename": {image.Filename}, "subfolder": {image.Subfolder}, "type": {image.Type}}
+			imageRequest, err := http.NewRequestWithContext(ctx, http.MethodGet, strings.TrimRight(c.BaseURL, "/")+"/view?"+query.Encode(), nil)
+			if err != nil {
+				return GeneratedImage{}, false, err
+			}
+			imageResponse, err := c.client().Do(imageRequest)
+			if err != nil {
+				return GeneratedImage{}, false, err
+			}
+			data, readErr := io.ReadAll(io.LimitReader(imageResponse.Body, 32<<20))
+			imageResponse.Body.Close()
+			if readErr != nil {
+				return GeneratedImage{}, false, readErr
+			}
+			if imageResponse.StatusCode < 200 || imageResponse.StatusCode > 299 || len(data) == 0 {
+				return GeneratedImage{}, false, ErrEmptyResult
+			}
+			contentType := imageResponse.Header.Get("Content-Type")
+			if contentType == "" {
+				contentType = "image/png"
+			}
+			return GeneratedImage{DataBase64: encodeBase64(data), ContentType: contentType}, true, nil
+		}
+	}
+	return GeneratedImage{}, true, ErrEmptyResult
+}
+
+func imageSize(size string) (int, int) {
+	parts := strings.Split(strings.TrimSpace(size), "x")
+	if len(parts) == 2 {
+		var width, height int
+		if _, err := fmt.Sscanf(size, "%dx%d", &width, &height); err == nil && width >= 256 && height >= 256 && width <= 2048 && height <= 2048 {
+			return width, height
+		}
+	}
+	return 512, 512
+}
+
+// Describe accepts a video skill endpoint that performs its own bounded frame
+// sampling. Frame extraction is provider-owned so the core does not acquire a
+// media-processing dependency or hide a policy in orchestration code.
+func (c VideoUnderstandingClient) Describe(ctx context.Context, model, filename, contentType string, data []byte, instruction string) (string, error) {
+	if len(data) == 0 {
+		return "", errors.New("video payload is empty")
+	}
+	body := &bytes.Buffer{}
+	writer := multipart.NewWriter(body)
+	header := make(textproto.MIMEHeader)
+	header.Set("Content-Disposition", fmt.Sprintf(`form-data; name="file"; filename="%s"`, strings.ReplaceAll(filename, `"`, "")))
+	header.Set("Content-Type", contentType)
+	part, err := writer.CreatePart(header)
+	if err != nil {
+		return "", err
+	}
+	if _, err := part.Write(data); err != nil {
+		return "", err
+	}
+	_ = writer.WriteField("model", model)
+	_ = writer.WriteField("instruction", instruction)
+	if err := writer.Close(); err != nil {
+		return "", err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, strings.TrimRight(c.BaseURL, "/")+"/understand", body)
+	if err != nil {
+		return "", err
+	}
+	request.Header.Set("Content-Type", writer.FormDataContentType())
+	response, err := c.client().Do(request)
+	if err != nil {
+		return "", err
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode > 299 {
+		return "", fmt.Errorf("video provider status %d", response.StatusCode)
+	}
+	var result struct {
+		Text string `json:"text"`
+	}
+	if err := json.NewDecoder(io.LimitReader(response.Body, 2<<20)).Decode(&result); err != nil {
+		return "", err
+	}
+	if strings.TrimSpace(result.Text) == "" {
+		return "", ErrEmptyResult
+	}
+	return strings.TrimSpace(result.Text), nil
+}
+
+func (c SpeechClient) client() *http.Client {
+	if c.Client != nil {
+		return c.Client
+	}
+	return http.DefaultClient
+}
+
+func (c VisionClient) client() *http.Client {
+	if c.Client != nil {
+		return c.Client
+	}
+	return http.DefaultClient
+}
+
+func (c ImageGenerationClient) client() *http.Client {
+	if c.Client != nil {
+		return c.Client
+	}
+	return http.DefaultClient
+}
+
+func (c ComfyImageGenerationClient) client() *http.Client {
+	if c.Client != nil {
+		return c.Client
+	}
+	return http.DefaultClient
+}
+
+func (c VideoUnderstandingClient) client() *http.Client {
+	if c.Client != nil {
+		return c.Client
+	}
+	return http.DefaultClient
+}
+
+func encodeBase64(data []byte) string {
+	return base64.StdEncoding.EncodeToString(data)
+}

adapters/multimodal/client_test.go

@@ -0,0 +1,209 @@
+package multimodal
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestSpeechClientSendsMultipartAndReturnsTranscript(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/inference" || r.Method != http.MethodPost {
+			t.Fatalf("unexpected speech request: %s %s", r.Method, r.URL.Path)
+		}
+		if err := r.ParseMultipartForm(1 << 20); err != nil {
+			t.Fatal(err)
+		}
+		file, _, err := r.FormFile("file")
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer file.Close()
+		data, _ := io.ReadAll(file)
+		if string(data) != "audio" {
+			t.Fatalf("audio payload = %q", data)
+		}
+		_ = json.NewEncoder(w).Encode(map[string]string{"text": "распознанная фраза"})
+	}))
+	defer server.Close()
+	text, err := (SpeechClient{BaseURL: server.URL, Client: server.Client()}).Transcribe(context.Background(), "voice.wav", "audio/wav", []byte("audio"))
+	if err != nil || text != "распознанная фраза" {
+		t.Fatalf("transcript=%q err=%v", text, err)
+	}
+}
+
+func TestVisionClientSendsImageDataAndInstruction(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var payload struct {
+			Messages []struct {
+				Content []struct {
+					Type     string `json:"type"`
+					Text     string `json:"text"`
+					ImageURL *struct {
+						URL string `json:"url"`
+					} `json:"image_url"`
+				} `json:"content"`
+			} `json:"messages"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
+			t.Fatal(err)
+		}
+		if len(payload.Messages) != 1 || len(payload.Messages[0].Content) != 2 || !strings.Contains(payload.Messages[0].Content[0].Text, "Опиши") || payload.Messages[0].Content[1].ImageURL == nil || !strings.HasPrefix(payload.Messages[0].Content[1].ImageURL.URL, "data:image/png;base64,") {
+			t.Fatalf("unexpected vision payload: %+v", payload)
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{"choices": []any{map[string]any{"message": map[string]string{"content": "на изображении круг"}}}})
+	}))
+	defer server.Close()
+	text, err := (VisionClient{BaseURL: server.URL + "/v1", Client: server.Client()}).Describe(context.Background(), "vision-model", "image/png", []byte{0, 1, 2}, "Опиши изображение")
+	if err != nil || text != "на изображении круг" {
+		t.Fatalf("description=%q err=%v", text, err)
+	}
+}
+
+func TestVisionClientUsesReasoningContentWhenProviderOmitsContent(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_ = json.NewEncoder(w).Encode(map[string]any{"choices": []any{map[string]any{
+			"message": map[string]string{"content": "", "reasoning_content": "чёрный квадрат"},
+		}}})
+	}))
+	defer server.Close()
+	text, err := (VisionClient{BaseURL: server.URL, Client: server.Client()}).Describe(context.Background(), "vision-model", "image/png", []byte("image"), "Опиши изображение")
+	if err != nil || text != "чёрный квадрат" {
+		t.Fatalf("description=%q err=%v", text, err)
+	}
+}
+
+func TestImageGenerationClientSendsPromptAndReturnsBase64(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/images/generations" || r.Method != http.MethodPost {
+			t.Fatalf("unexpected image request: %s %s", r.Method, r.URL.Path)
+		}
+		var payload struct {
+			Model  string `json:"model"`
+			Prompt string `json:"prompt"`
+			Size   string `json:"size"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
+			t.Fatal(err)
+		}
+		if payload.Model != "image-model" || payload.Prompt != "green bird" || payload.Size != "1024x1024" {
+			t.Fatalf("unexpected image payload: %+v", payload)
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{"data": []any{map[string]string{"b64_json": "aW1hZ2U="}}})
+	}))
+	defer server.Close()
+	image, err := (ImageGenerationClient{BaseURL: server.URL, Client: server.Client()}).Generate(context.Background(), "image-model", "green bird", "1024x1024")
+	if err != nil || image.DataBase64 != "aW1hZ2U=" || image.ContentType != "image/png" {
+		t.Fatalf("image=%+v err=%v", image, err)
+	}
+}
+
+func TestVideoUnderstandingClientSendsMultipartAndReturnsDescription(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/understand" || r.Method != http.MethodPost {
+			t.Fatalf("unexpected video request: %s %s", r.Method, r.URL.Path)
+		}
+		if err := r.ParseMultipartForm(1 << 20); err != nil {
+			t.Fatal(err)
+		}
+		if r.FormValue("model") != "video-model" || r.FormValue("instruction") != "describe movement" {
+			t.Fatalf("unexpected video fields: model=%q instruction=%q", r.FormValue("model"), r.FormValue("instruction"))
+		}
+		file, _, err := r.FormFile("file")
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer file.Close()
+		data, _ := io.ReadAll(file)
+		if string(data) != "video" {
+			t.Fatalf("video payload=%q", data)
+		}
+		_ = json.NewEncoder(w).Encode(map[string]string{"text": "человек идёт"})
+	}))
+	defer server.Close()
+	text, err := (VideoUnderstandingClient{BaseURL: server.URL, Client: server.Client()}).Describe(context.Background(), "video-model", "clip.mp4", "video/mp4", []byte("video"), "describe movement")
+	if err != nil || text != "человек идёт" {
+		t.Fatalf("description=%q err=%v", text, err)
+	}
+}
+
+func TestComfyImageGenerationClientRunsWorkflowAndReturnsImage(t *testing.T) {
+	polls := 0
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/prompt":
+			var payload struct {
+				Prompt map[string]any `json:"prompt"`
+			}
+			if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
+				t.Fatal(err)
+			}
+			if payload.Prompt["6"].(map[string]any)["inputs"].(map[string]any)["text"] != "red bird" {
+				t.Fatalf("prompt was not forwarded: %+v", payload.Prompt["6"])
+			}
+			_ = json.NewEncoder(w).Encode(map[string]string{"prompt_id": "test-prompt"})
+		case "/history/test-prompt":
+			polls++
+			if polls == 1 {
+				_, _ = w.Write([]byte(`{}`))
+				return
+			}
+			_ = json.NewEncoder(w).Encode(map[string]any{"test-prompt": map[string]any{"outputs": map[string]any{"9": map[string]any{"images": []any{map[string]string{"filename": "out.png", "subfolder": "", "type": "output"}}}}}})
+		case "/view":
+			w.Header().Set("Content-Type", "image/png")
+			_, _ = w.Write([]byte("png"))
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+	image, err := (ComfyImageGenerationClient{BaseURL: server.URL, Client: server.Client(), PollInterval: time.Millisecond, PollTimeout: time.Second}).Generate(context.Background(), "", "red bird", "256x256")
+	if err != nil || image.DataBase64 != "cG5n" || image.ContentType != "image/png" {
+		t.Fatalf("image=%+v err=%v", image, err)
+	}
+}
+
+func TestComfyImageGenerationClientDeletesOnlyCancelledPrompt(t *testing.T) {
+	var deleted []string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/prompt":
+			_ = json.NewEncoder(w).Encode(map[string]string{"prompt_id": "cancel-me"})
+		case "/history/cancel-me":
+			<-r.Context().Done()
+		case "/queue":
+			var payload struct {
+				Delete []string `json:"delete"`
+			}
+			if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
+				t.Fatal(err)
+			}
+			deleted = append(deleted, payload.Delete...)
+			w.WriteHeader(http.StatusNoContent)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan error, 1)
+	go func() {
+		_, err := (ComfyImageGenerationClient{BaseURL: server.URL, Client: server.Client(), PollInterval: time.Millisecond, PollTimeout: time.Minute}).Generate(ctx, "", "red bird", "256x256")
+		done <- err
+	}()
+	time.Sleep(10 * time.Millisecond)
+	cancel()
+	if err := <-done; !errors.Is(err, context.Canceled) {
+		t.Fatalf("err=%v", err)
+	}
+	if len(deleted) != 1 || deleted[0] != "cancel-me" {
+		t.Fatalf("deleted=%v", deleted)
+	}
+}

adapters/postgres/capability_repository.go

@@ -505,6 +505,14 @@ func (r *CapabilityRepository) loadCognitiveEvidence(ctx context.Context, value
 	if err == nil {
 		value.Performance = &performance
 	}
+	var qualification capability.ModelQualificationObservation
+	err = r.pool.QueryRow(ctx, `SELECT observation_id,provider_instance_id,provider_model_id,status,finish_reason,latency_millis,output_observed,quality_assessed,category,observed_at_unix_millis FROM capability.cognitive_model_qualification_observations WHERE provider_instance_id=$1 AND provider_model_id=$2 ORDER BY observed_at_unix_millis DESC LIMIT 1`, value.Provider.ID, value.Model.ProviderModelID).Scan(&qualification.ID, &qualification.ProviderInstanceID, &qualification.ProviderModelID, &qualification.Status, &qualification.FinishReason, &qualification.LatencyMillis, &qualification.OutputObserved, &qualification.QualityAssessed, &qualification.Category, &qualification.ObservedAtUnixMillis)
+	if err != nil && !errors.Is(err, pgx.ErrNoRows) {
+		return err
+	}
+	if err == nil {
+		value.Qualification = &qualification
+	}
 	if profileID != "" {
 		var taskEvaluation capability.TaskEvaluation
 		err = r.pool.QueryRow(ctx, `SELECT evaluation_id,task_profile_id,binding_id,binding_revision,capability_id,result,quality_score_millis,reliability_score_millis,latency_score_millis,overall_score_millis,critical_failure_millis,benchmark_version,artifact_id,observed_at_unix_millis FROM capability.cognitive_task_evaluations WHERE task_profile_id=$1 AND binding_id=$2 AND binding_revision=$3 ORDER BY observed_at_unix_millis DESC LIMIT 1`, profileID, value.Binding.ID, value.Binding.Revision).Scan(&taskEvaluation.ID, &taskEvaluation.ProfileID, &taskEvaluation.BindingID, &taskEvaluation.BindingRevision, &taskEvaluation.CapabilityID, &taskEvaluation.Result, &taskEvaluation.QualityScoreMillis, &taskEvaluation.ReliabilityScoreMillis, &taskEvaluation.LatencyScoreMillis, &taskEvaluation.OverallScoreMillis, &taskEvaluation.CriticalFailureMillis, &taskEvaluation.BenchmarkVersion, &taskEvaluation.ArtifactID, &taskEvaluation.ObservedAtUnixMillis)
@@ -633,3 +641,8 @@ func (r *CapabilityRepository) SaveTaskEvaluation(ctx context.Context, value cap
 	_, err := r.pool.Exec(ctx, `INSERT INTO capability.cognitive_task_evaluations (evaluation_id,task_profile_id,binding_id,binding_revision,capability_id,result,quality_score_millis,reliability_score_millis,latency_score_millis,overall_score_millis,critical_failure_millis,benchmark_version,artifact_id,observed_at_unix_millis) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14) ON CONFLICT DO NOTHING`, value.ID, value.ProfileID, value.BindingID, value.BindingRevision, value.CapabilityID, value.Result, value.QualityScoreMillis, value.ReliabilityScoreMillis, value.LatencyScoreMillis, value.OverallScoreMillis, value.CriticalFailureMillis, value.BenchmarkVersion, value.ArtifactID, value.ObservedAtUnixMillis)
 	return err
 }
+
+func (r *CapabilityRepository) SaveModelQualificationObservation(ctx context.Context, value capability.ModelQualificationObservation) error {
+	_, err := r.pool.Exec(ctx, `INSERT INTO capability.cognitive_model_qualification_observations (observation_id,provider_instance_id,provider_model_id,status,finish_reason,latency_millis,output_observed,quality_assessed,category,observed_at_unix_millis) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10) ON CONFLICT DO NOTHING`, value.ID, value.ProviderInstanceID, value.ProviderModelID, value.Status, value.FinishReason, value.LatencyMillis, value.OutputObserved, value.QualityAssessed, value.Category, value.ObservedAtUnixMillis)
+	return err
+}

adapters/postgres/epistemics_repository.go

@@ -11,6 +11,14 @@ import (
 
 type EpistemicsRepository struct{ pool *pgxpool.Pool }
 
+type TruthRuntimeStatus struct {
+	BundleCount          int64            `json:"bundle_count"`
+	ClaimsByVerification map[string]int64 `json:"claims_by_verification"`
+	BeliefsByState       map[string]int64 `json:"beliefs_by_state"`
+	SourcesByFreshness   map[string]int64 `json:"sources_by_freshness"`
+	ObservedAtUnixMillis int64            `json:"observed_at_unix_millis"`
+}
+
 func OpenEpistemics(ctx context.Context, config ContinuityConfig) (*EpistemicsRepository, error) {
 	pool, err := openPool(ctx, config)
 	if err != nil {
@@ -25,6 +33,49 @@ func (r *EpistemicsRepository) Ping(ctx context.Context) error {
 	return r.pool.Ping(ctx)
 }
 
+// TruthRuntimeStatus is a read-only projection of durable truth bundles.
+// It does not promote claims, revise beliefs, or mutate epistemic state.
+func (r *EpistemicsRepository) TruthRuntimeStatus(ctx context.Context) (TruthRuntimeStatus, error) {
+	status := TruthRuntimeStatus{
+		ClaimsByVerification: map[string]int64{},
+		BeliefsByState:       map[string]int64{},
+		SourcesByFreshness:   map[string]int64{},
+		ObservedAtUnixMillis: time.Now().UnixMilli(),
+	}
+	if err := r.pool.QueryRow(ctx, `SELECT count(*) FROM epistemics.truth_bundles`).Scan(&status.BundleCount); err != nil {
+		return TruthRuntimeStatus{}, err
+	}
+	queries := []struct {
+		query       string
+		destination map[string]int64
+	}{
+		{`SELECT claim_verification, count(*) FROM epistemics.truth_bundles GROUP BY claim_verification`, status.ClaimsByVerification},
+		{`SELECT belief_state, count(*) FROM epistemics.truth_bundles GROUP BY belief_state`, status.BeliefsByState},
+		{`SELECT snapshot_freshness, count(*) FROM epistemics.truth_bundles GROUP BY snapshot_freshness`, status.SourcesByFreshness},
+	}
+	for _, item := range queries {
+		rows, err := r.pool.Query(ctx, item.query)
+		if err != nil {
+			return TruthRuntimeStatus{}, err
+		}
+		for rows.Next() {
+			var state string
+			var count int64
+			if err := rows.Scan(&state, &count); err != nil {
+				rows.Close()
+				return TruthRuntimeStatus{}, err
+			}
+			item.destination[state] = count
+		}
+		if err := rows.Err(); err != nil {
+			rows.Close()
+			return TruthRuntimeStatus{}, err
+		}
+		rows.Close()
+	}
+	return status, nil
+}
+
 func (r *EpistemicsRepository) SaveSystemExpectation(ctx context.Context, value epistemics.SystemExpectation) error {
 	_, err := r.pool.Exec(ctx, `INSERT INTO epistemics.system_expectations (
 		expectation_id, original_intent_id, source_utterance_id, expected_outcome, expected_effect,
@@ -99,7 +150,7 @@ func (r *EpistemicsRepository) ClaimReflectionCandidate(ctx context.Context, wor
 	var value epistemics.ReflectionCandidate
 	err = tx.QueryRow(ctx, `SELECT reflection_candidate_id,trigger,state,source_experience_id,original_intent_id,source_utterance_id,summary,evidence_refs,requires_cognition,recorded_at_unix_millis,revision,claimed_by,claim_expires_at_unix_millis
 		FROM epistemics.reflection_candidates
-		WHERE state='OPEN' AND (claim_expires_at_unix_millis=0 OR claim_expires_at_unix_millis < $1)
+		WHERE state='OPEN' AND requires_cognition=false AND (claim_expires_at_unix_millis=0 OR claim_expires_at_unix_millis < $1)
 		ORDER BY recorded_at_unix_millis,reflection_candidate_id
 		FOR UPDATE SKIP LOCKED LIMIT 1`, nowUnixMillis).Scan(&value.ID, &value.Trigger, &value.State, &value.SourceExperienceID, &value.OriginalIntentID, &value.SourceUtteranceID, &value.Summary, &value.EvidenceRefs, &value.RequiresCognition, &value.RecordedAtUnixMillis, &value.Revision, &value.ClaimedBy, &value.ClaimExpiresAtUnixMillis)
 	if err != nil {

adapters/postgres/interaction_repository.go

@@ -3,6 +3,7 @@ package postgres
 import (
 	"context"
 
+	"git.cin.su/m/Assistant/contracts/identity"
 	"git.cin.su/m/Assistant/contracts/interaction"
 	"github.com/jackc/pgx/v5/pgxpool"
 )
@@ -98,3 +99,22 @@ func (r *InteractionRepository) Utterances(ctx context.Context, id interaction.C
 	}
 	return out, rows.Err()
 }
+
+// RecentUtterancesForPrincipal provides durable conversational context when a
+// client starts a fresh conversation instead of carrying the previous ID.
+func (r *InteractionRepository) RecentUtterancesForPrincipal(ctx context.Context, principalID identity.PrincipalID, limit int) ([]interaction.HumanUtterance, error) {
+	rows, err := r.pool.Query(ctx, `SELECT utterance_id,conversation_id,actor_id,principal_id,channel,received_at_unix_millis,correlation_id,content,content_ref,speech_act,interpretation_state,corrects_utterance_id FROM interaction.utterances WHERE principal_id=$1 ORDER BY received_at_unix_millis DESC, utterance_id DESC LIMIT $2`, principalID, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []interaction.HumanUtterance
+	for rows.Next() {
+		var u interaction.HumanUtterance
+		if err := rows.Scan(&u.ID, &u.ConversationID, &u.ActorID, &u.PrincipalID, &u.Channel, &u.ReceivedAtUnixMillis, &u.CorrelationID, &u.Content, &u.ContentRef, &u.SpeechAct, &u.InterpretationState, &u.CorrectsUtteranceID); err != nil {
+			return nil, err
+		}
+		out = append(out, u)
+	}
+	return out, rows.Err()
+}

adapters/postgres/work_repository.go

@@ -32,6 +32,54 @@ func OpenWork(ctx context.Context, config ContinuityConfig) (*WorkRepository, er
 	}
 	return &WorkRepository{pool}, nil
 }
+
+// WorkGraphRuntimeStatus is a read-only operational projection owned by Work.
+// It is not canonical graph state and cannot advance any lifecycle.
+type WorkGraphRuntimeStatus struct {
+	GraphsByState        map[string]int64 `json:"graphs_by_state"`
+	NodesByState         map[string]int64 `json:"nodes_by_state"`
+	QueueByState         map[string]int64 `json:"queue_by_state"`
+	ObservedAtUnixMillis int64            `json:"observed_at_unix_millis"`
+}
+
+func (r *WorkRepository) RuntimeStatus(ctx context.Context) (WorkGraphRuntimeStatus, error) {
+	status := WorkGraphRuntimeStatus{
+		GraphsByState:        map[string]int64{},
+		NodesByState:         map[string]int64{},
+		QueueByState:         map[string]int64{},
+		ObservedAtUnixMillis: time.Now().UnixMilli(),
+	}
+	queries := []struct {
+		query       string
+		destination map[string]int64
+	}{
+		{`SELECT state, count(*) FROM work.graphs GROUP BY state`, status.GraphsByState},
+		{`SELECT state, count(*) FROM work.graph_nodes GROUP BY state`, status.NodesByState},
+		{`SELECT state, count(*) FROM work.agent_dispatch_queue GROUP BY state`, status.QueueByState},
+	}
+	for _, item := range queries {
+		rows, err := r.pool.Query(ctx, item.query)
+		if err != nil {
+			return WorkGraphRuntimeStatus{}, err
+		}
+		for rows.Next() {
+			var state string
+			var count int64
+			if err := rows.Scan(&state, &count); err != nil {
+				rows.Close()
+				return WorkGraphRuntimeStatus{}, err
+			}
+			item.destination[state] = count
+		}
+		if err := rows.Err(); err != nil {
+			rows.Close()
+			return WorkGraphRuntimeStatus{}, err
+		}
+		rows.Close()
+	}
+	return status, nil
+}
+
 func (r *WorkRepository) Close()                         { r.pool.Close() }
 func (r *WorkRepository) Ping(ctx context.Context) error { return r.pool.Ping(ctx) }
 func (r *WorkRepository) Create(ctx context.Context, target work.TaskTarget) error {
@@ -263,7 +311,7 @@ func (r *WorkRepository) SaveWorkGraph(ctx context.Context, graph work.WorkGraph
 		return err
 	}
 	defer tx.Rollback(ctx)
-	if _, err := tx.Exec(ctx, `INSERT INTO work.graphs(graph_id,revision,state,max_parallel,max_attempts,parent_graph_id,parent_graph_revision,trigger_evidence_ref) VALUES($1,$2,$3,$4,$5,$6,$7,$8) ON CONFLICT(graph_id,revision) DO NOTHING`, graph.ID, graph.Revision, graph.State, graph.Budget.MaxParallel, graph.Budget.MaxAttempts, graph.ParentGraphID, graph.ParentGraphRevision, graph.TriggerEvidenceRef); err != nil {
+	if _, err := tx.Exec(ctx, `INSERT INTO work.graphs(graph_id,revision,state,max_parallel,max_attempts,parent_graph_id,parent_graph_revision,trigger_evidence_ref,orchestration_bound,orchestration_goal_id,orchestration_goal_state,orchestration_search_round,orchestration_max_round,orchestration_cancel_requested,orchestration_verification_ready,orchestration_unresolved) VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16) ON CONFLICT(graph_id,revision) DO NOTHING`, graph.ID, graph.Revision, graph.State, graph.Budget.MaxParallel, graph.Budget.MaxAttempts, graph.ParentGraphID, graph.ParentGraphRevision, graph.TriggerEvidenceRef, graph.SearchInputBound, graph.SearchInput.GoalID, graph.SearchInput.GoalState, graph.SearchInput.SearchRound, graph.SearchInput.MaxRound, graph.SearchInput.CancelRequested, graph.SearchInput.VerificationReady, graph.SearchInput.Unresolved); err != nil {
 		return err
 	}
 	for _, node := range graph.Nodes {
@@ -285,7 +333,7 @@ func (r *WorkRepository) SaveWorkGraph(ctx context.Context, graph work.WorkGraph
 
 func (r *WorkRepository) LoadWorkGraph(ctx context.Context, graphID string, revision int64) (work.WorkGraph, error) {
 	var graph work.WorkGraph
-	err := r.pool.QueryRow(ctx, `SELECT graph_id,revision,state,max_parallel,max_attempts,parent_graph_id,parent_graph_revision,trigger_evidence_ref FROM work.graphs WHERE graph_id=$1 AND revision=$2`, graphID, revision).Scan(&graph.ID, &graph.Revision, &graph.State, &graph.Budget.MaxParallel, &graph.Budget.MaxAttempts, &graph.ParentGraphID, &graph.ParentGraphRevision, &graph.TriggerEvidenceRef)
+	err := r.pool.QueryRow(ctx, `SELECT graph_id,revision,state,max_parallel,max_attempts,parent_graph_id,parent_graph_revision,trigger_evidence_ref,orchestration_bound,orchestration_goal_id,orchestration_goal_state,orchestration_search_round,orchestration_max_round,orchestration_cancel_requested,orchestration_verification_ready,orchestration_unresolved FROM work.graphs WHERE graph_id=$1 AND revision=$2`, graphID, revision).Scan(&graph.ID, &graph.Revision, &graph.State, &graph.Budget.MaxParallel, &graph.Budget.MaxAttempts, &graph.ParentGraphID, &graph.ParentGraphRevision, &graph.TriggerEvidenceRef, &graph.SearchInputBound, &graph.SearchInput.GoalID, &graph.SearchInput.GoalState, &graph.SearchInput.SearchRound, &graph.SearchInput.MaxRound, &graph.SearchInput.CancelRequested, &graph.SearchInput.VerificationReady, &graph.SearchInput.Unresolved)
 	if err != nil {
 		return work.WorkGraph{}, fmt.Errorf("load graph: %w", err)
 	}
@@ -351,6 +399,14 @@ func (r *WorkRepository) SaveGraphSynthesis(ctx context.Context, conflict work.C
 	return tx.Commit(ctx)
 }
 
+func (r *WorkRepository) SaveGraphResultCandidate(ctx context.Context, candidate work.ResultCandidate) error {
+	if candidate.ID == "" || candidate.GraphID == "" || candidate.GraphRevision < 1 || candidate.NodeID == "" || candidate.AuthorRunID == "" || candidate.EvidenceSummary == "" || candidate.Summary == "" {
+		return errors.New("invalid graph result candidate")
+	}
+	_, err := r.pool.Exec(ctx, `INSERT INTO work.graph_result_candidates(result_candidate_id,graph_id,graph_revision,node_id,author_run_id,artifact_refs,evidence_summary,summary) VALUES($1,$2,$3,$4,$5,$6,$7,$8) ON CONFLICT(result_candidate_id) DO NOTHING`, candidate.ID, candidate.GraphID, candidate.GraphRevision, candidate.NodeID, candidate.AuthorRunID, candidate.ArtifactRefs, candidate.EvidenceSummary, candidate.Summary)
+	return err
+}
+
 func (r *WorkRepository) RecoverStaleClaims(ctx context.Context, nowUnixMillis, staleAfterMillis int64) (int64, error) {
 	tx, err := r.pool.Begin(ctx)
 	if err != nil {

adapters/research/search_connector.go

@@ -0,0 +1,276 @@
+package research
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"errors"
+	"html"
+	"io"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"git.cin.su/m/Assistant/contracts/epistemics"
+)
+
+var ErrSearchRejected = errors.New("web search request rejected")
+
+var (
+	searchLinkPattern    = regexp.MustCompile(`(?is)(<a[^>]+class=["'][^"']*result__a[^"']*["'][^>]*>)(.*?)</a>`)
+	searchSnippetPattern = regexp.MustCompile(`(?is)<a[^>]+class=["'][^"']*result__snippet[^"']*["'][^>]*>(.*?)</a>`)
+	bingLinkPattern      = regexp.MustCompile(`(?is)<li[^>]+class=["'][^"']*b_algo[^"']*["'][^>]*>.*?<h2[^>]*>(<a[^>]*>)(.*?)</a>`)
+	bingSnippetPattern   = regexp.MustCompile(`(?is)<li[^>]+class=["'][^"']*b_algo[^"']*["'][^>]*>.*?<p[^>]*>(.*?)</p>`)
+	tagPattern           = regexp.MustCompile(`(?s)<[^>]*>`)
+	termPattern          = regexp.MustCompile(`(?i)[\p{L}\p{N}]{2,}`)
+)
+
+var searchStopTerms = map[string]struct{}{
+	"какая": {}, "какое": {}, "какие": {}, "какой": {}, "что": {}, "как": {}, "где": {}, "когда": {}, "почему": {}, "мне": {}, "пожалуйста": {},
+	"what": {}, "which": {}, "where": {}, "when": {}, "why": {}, "how": {}, "please": {}, "the": {}, "this": {},
+}
+
+// SearchConnector uses a configured HTTPS search endpoint. It does not know
+// cities, weather terms, entities or model names: the complete semantic query
+// comes from the interpretation layer.
+type SearchConnector struct {
+	Client            *http.Client
+	EndpointTemplate  string
+	AllowedHosts      map[string]struct{}
+	FallbackEndpoints []SearchEndpoint
+	MaxBytes          int64
+	MaxResults        int
+}
+
+// SearchEndpoint is an independently allowlisted web-search route. The
+// connector tries routes in order and stops at the first relevant evidence.
+// This is a source-recovery policy, not a question-type classifier.
+type SearchEndpoint struct {
+	Template     string
+	AllowedHosts map[string]struct{}
+}
+
+func (c SearchConnector) Collect(ctx context.Context, request epistemics.WebSearchRequest, nowUnixMillis int64) ([]epistemics.ResearchCandidate, error) {
+	if request.Plan.Validate() != nil || strings.TrimSpace(request.Query) == "" || nowUnixMillis < 1 || !strings.Contains(c.EndpointTemplate, "%s") {
+		return nil, ErrSearchRejected
+	}
+	endpoints := make([]SearchEndpoint, 0, 1+len(c.FallbackEndpoints))
+	endpoints = append(endpoints, SearchEndpoint{Template: c.EndpointTemplate, AllowedHosts: c.AllowedHosts})
+	endpoints = append(endpoints, c.FallbackEndpoints...)
+	var lastErr error
+	for _, candidateEndpoint := range endpoints {
+		results, err := c.collectEndpoint(ctx, candidateEndpoint, request, nowUnixMillis)
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		if len(results) > 0 {
+			return results, nil
+		}
+	}
+	if lastErr != nil {
+		return nil, lastErr
+	}
+	return nil, nil
+}
+
+func (c SearchConnector) collectEndpoint(ctx context.Context, configured SearchEndpoint, request epistemics.WebSearchRequest, nowUnixMillis int64) ([]epistemics.ResearchCandidate, error) {
+	if !strings.Contains(configured.Template, "%s") {
+		return nil, ErrSearchRejected
+	}
+	searchQuery := enrichedSearchQuery(request.Query)
+	endpoint, err := url.Parse(strings.Replace(configured.Template, "%s", url.QueryEscape(searchQuery), 1))
+	if err != nil || endpoint.Scheme != "https" || endpoint.Host == "" || !allowedHost(configured.AllowedHosts, strings.ToLower(endpoint.Hostname())) {
+		return nil, ErrSearchRejected
+	}
+	client := c.Client
+	if client == nil {
+		client = &http.Client{}
+	}
+	maxBytes := c.MaxBytes
+	if maxBytes <= 0 || maxBytes > 4<<20 {
+		maxBytes = 512 << 10
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint.String(), nil)
+	if err != nil {
+		return nil, ErrSearchRejected
+	}
+	// Search providers commonly return a consent/challenge shell to the
+	// default Go client. A neutral browser identification improves the same
+	// generic evidence path for every query without selecting by topic.
+	req.Header.Set("User-Agent", "Mozilla/5.0 (compatible; DomovoyResearch/1.0)")
+	response, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		return nil, ErrSearchRejected
+	}
+	body, err := io.ReadAll(io.LimitReader(response.Body, maxBytes+1))
+	if err != nil || len(body) == 0 || int64(len(body)) > maxBytes {
+		return nil, ErrSearchRejected
+	}
+	links := searchLinkPattern.FindAllSubmatch(body, c.limit())
+	snippets := searchSnippetPattern.FindAllSubmatch(body, c.limit())
+	if len(links) == 0 {
+		links = bingLinkPattern.FindAllSubmatch(body, c.limit())
+		snippets = bingSnippetPattern.FindAllSubmatch(body, c.limit())
+	}
+	if len(links) == 0 {
+		return nil, nil
+	}
+	digest := sha256.Sum256(body)
+	digestText := "sha256:" + hex.EncodeToString(digest[:])
+	base := hex.EncodeToString(digest[:])
+	sourceID := epistemics.SourceID("source:search:" + base)
+	snapshotID := epistemics.SourceSnapshotID("snapshot:search:" + base)
+	results := make([]epistemics.ResearchCandidate, 0, len(links))
+	for index, link := range links {
+		linkURL := resolveSearchResultLocator(extractHref(string(link[1])), endpoint)
+		title := cleanHTML(string(link[2]))
+		snippet := ""
+		if index < len(snippets) {
+			snippet = cleanHTML(string(snippets[index][1]))
+		}
+		statement := strings.TrimSpace(strings.Trim(title+" — "+snippet, " —"))
+		if statement == "" || !searchStatementRelatesToQuery(request.Query, statement) {
+			continue
+		}
+		ordinal := strconv.Itoa(index)
+		excerptID := epistemics.SourceExcerptID("excerpt:search:" + base + ":" + ordinal)
+		results = append(results, epistemics.ResearchCandidate{
+			PropositionKey: request.PropositionKey + ":result:" + ordinal,
+			Statement:      statement,
+			Source:         epistemics.Source{ID: sourceID, Kind: "web-search", Locator: linkURL, Title: title, Publisher: sourcePublisher(linkURL, endpoint.Hostname())},
+			Snapshot:       epistemics.SourceSnapshot{ID: snapshotID, SourceID: sourceID, ContentDigest: digestText, CapturedAtUnixMillis: nowUnixMillis, Freshness: epistemics.FreshnessCurrent},
+			Excerpt:        epistemics.SourceExcerpt{ID: excerptID, SnapshotID: snapshotID, Text: statement, Start: 0, End: int64(len(statement))},
+			Evidence:       epistemics.EvidenceObserved, Coverage: epistemics.CoverageComplete, Conflict: epistemics.ConflictNone,
+		})
+	}
+	return results, nil
+}
+
+// searchStatementRelatesToQuery is a bounded relevance gate, not a truth
+// check. It prevents generic search pages from becoming apparent evidence
+// when their content has no substantive relation to the requested query.
+func searchStatementRelatesToQuery(query, statement string) bool {
+	terms := termPattern.FindAllString(strings.ToLower(query), -1)
+	content := strings.ToLower(statement)
+	productCue := containsSearchTerm(terms, "видеокарт", "gpu", "процессор", "телефон", "ноутбук", "монитор")
+	if productCue && hasNumericSearchTerm(terms) {
+		contentTerms := termPattern.FindAllString(content, -1)
+		return hasNumericSearchTerm(contentTerms) && containsSearchTerm(contentTerms, "видеокарт", "gpu", "процессор", "телефон", "ноутбук", "монитор")
+	}
+	usable := 0
+	for _, term := range terms {
+		if _, stop := searchStopTerms[term]; stop || len([]rune(term)) < 4 {
+			continue
+		}
+		usable++
+		runes := []rune(term)
+		prefixLen := 5
+		if len(runes) < prefixLen {
+			prefixLen = len(runes)
+		}
+		if strings.Contains(content, string(runes[:prefixLen])) {
+			return true
+		}
+	}
+	return usable == 0
+}
+
+func containsSearchTerm(values []string, wanted ...string) bool {
+	for _, value := range values {
+		for _, candidate := range wanted {
+			if strings.Contains(value, candidate) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func hasNumericSearchTerm(values []string) bool {
+	for _, value := range values {
+		for _, runeValue := range value {
+			if runeValue >= '0' && runeValue <= '9' {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func enrichedSearchQuery(query string) string {
+	trimmed := strings.TrimSpace(query)
+	lower := strings.ToLower(trimmed)
+	if (strings.Contains(lower, "цен") || strings.Contains(lower, "стоим")) && !strings.Contains(lower, "куп") {
+		return trimmed + " цена купить сегодня"
+	}
+	return trimmed
+}
+
+func allowedHost(hosts map[string]struct{}, host string) bool { _, ok := hosts[host]; return ok }
+func (c SearchConnector) limit() int {
+	if c.MaxResults <= 0 || c.MaxResults > 8 {
+		return 3
+	}
+	return c.MaxResults
+}
+func cleanHTML(value string) string {
+	return strings.Join(strings.Fields(html.UnescapeString(tagPattern.ReplaceAllString(value, ""))), " ")
+}
+
+func extractHref(tag string) string {
+	match := regexp.MustCompile(`(?is)\bhref=["']([^"']+)["']`).FindStringSubmatch(tag)
+	if len(match) == 2 {
+		return match[1]
+	}
+	return ""
+}
+
+func resolveSearchResultLocator(raw string, searchEndpoint *url.URL) string {
+	value := strings.TrimSpace(html.UnescapeString(raw))
+	if value == "" {
+		return searchEndpoint.String()
+	}
+	parsed, err := url.Parse(value)
+	if err != nil {
+		return searchEndpoint.String()
+	}
+	if target := parsed.Query().Get("uddg"); target != "" {
+		value = target
+		parsed, err = url.Parse(target)
+		if err != nil {
+			return searchEndpoint.String()
+		}
+	}
+	if target := parsed.Query().Get("u"); strings.HasPrefix(target, "a1") {
+		if decoded, decodeErr := base64.RawURLEncoding.DecodeString(strings.TrimPrefix(target, "a1")); decodeErr == nil {
+			if targetURL, parseErr := url.Parse(string(decoded)); parseErr == nil {
+				parsed = targetURL
+			}
+		}
+	}
+	if parsed.Scheme == "" {
+		parsed.Scheme = "https"
+	}
+	if parsed.Host == "" && strings.HasPrefix(value, "//") {
+		parsed, err = url.Parse("https:" + value)
+	}
+	if err != nil || parsed.Scheme != "https" || parsed.Host == "" {
+		return searchEndpoint.String()
+	}
+	return parsed.String()
+}
+
+func sourcePublisher(locator, fallback string) string {
+	if parsed, err := url.Parse(locator); err == nil && parsed.Hostname() != "" {
+		return parsed.Hostname()
+	}
+	return fallback
+}

adapters/research/search_connector_test.go

@@ -0,0 +1,57 @@
+package research
+
+import (
+	"context"
+	"crypto/tls"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/epistemics"
+)
+
+func TestSearchConnectorFallsBackToAnotherAllowedSource(t *testing.T) {
+	primary := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(`<html><body>no usable results</body></html>`))
+	}))
+	defer primary.Close()
+	fallback := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(`<a class="result__a" href="https://example.test">Казань: текущая температура 18 °C</a><a class="result__snippet">Наблюдается переменная облачность.</a>`))
+	}))
+	defer fallback.Close()
+	client := fallback.Client()
+	client.Transport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // test servers only
+	request := epistemics.WebSearchRequest{Plan: epistemics.ResearchPlan{ID: "plan:test", Question: "какая погода в Казани", SourceClasses: []string{"web-search"}, FreshnessPolicy: string(epistemics.FreshnessCurrent)}, PropositionKey: "question:test", Query: "какая погода в Казани"}
+	connector := SearchConnector{
+		Client:           client,
+		EndpointTemplate: primary.URL + "?q=%s",
+		AllowedHosts:     map[string]struct{}{strings.TrimPrefix(primary.URL, "https://"): {}},
+		FallbackEndpoints: []SearchEndpoint{{
+			Template:     fallback.URL + "?q=%s",
+			AllowedHosts: map[string]struct{}{strings.TrimPrefix(fallback.URL, "https://"): {}},
+		}},
+	}
+	// The allowlist is hostname-only; test servers include an ephemeral port.
+	connector.AllowedHosts = map[string]struct{}{strings.Split(strings.TrimPrefix(primary.URL, "https://"), ":")[0]: {}}
+	connector.FallbackEndpoints[0].AllowedHosts = map[string]struct{}{strings.Split(strings.TrimPrefix(fallback.URL, "https://"), ":")[0]: {}}
+	results, err := connector.Collect(context.Background(), request, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(results) != 1 || !strings.Contains(results[0].Statement, "18") {
+		t.Fatalf("fallback evidence = %#v", results)
+	}
+	if results[0].Source.Locator != "https://example.test" || results[0].Source.Publisher != "example.test" {
+		t.Fatalf("search result source = %#v", results[0].Source)
+	}
+}
+
+func TestEnrichedSearchQueryAddsPriceSignalsOnlyToPriceRequests(t *testing.T) {
+	if got := enrichedSearchQuery("проверь цену на видеокарту 4090"); got != "проверь цену на видеокарту 4090 цена купить сегодня" {
+		t.Fatalf("price query = %q", got)
+	}
+	if got := enrichedSearchQuery("какая погода в Казани"); got != "какая погода в Казани" {
+		t.Fatalf("non-price query = %q", got)
+	}
+}

architecture/adrs/ADR-0014-assistant-presence-attention-human-surface.md

@@ -32,7 +32,7 @@ The system already has the correct outbound mutation foundation: Commit owns aut
 
 ## Non-goals
 
-- No Gmail, MCP, Codex Bridge, browser automation, mobile app, voice, or self-extension loop.
+- No Gmail, MCP, Codex Bridge, mobile app, voice, or self-extension loop. Browser automation is allowed only under ADR-0019 as bounded read-only observation; it is not a human-surface command or mutation channel.
 - No new canonical owner.
 - No generic scheduler/event-bus/autonomous-agent loop.
 - No new third-party dependency.

architecture/adrs/ADR-0015-human-response-continuation-semantics.md

@@ -30,7 +30,7 @@ Examples include: a reminder after notification, waiting work requiring a decisi
 
 ## Non-goals
 
-- No Codex Bridge, Gmail, MCP, voice, mobile, browser automation, self-extension loop, or generalized orchestration.
+- No Codex Bridge, Gmail, MCP, voice, mobile, self-extension loop, or generalized orchestration. Browser observation may be used only through the bounded read-only capability defined by ADR-0019 and cannot continue or mutate a response target.
 - No universal object ontology.
 - No reminder-specific parallel subsystem.
 

architecture/adrs/ADR-0019-bounded-site-browser-observation.md

@@ -0,0 +1,34 @@
+# ADR-0019 — Bounded Site-Browser Observation
+
+Status: Accepted
+
+Task: DEV-000293
+
+## Context
+
+Search snippets are insufficient for dynamic pages such as marketplaces: they may expose a category page while hiding the current product price behind client-side rendering. Domovoy needs a replaceable observation capability that can inspect an allowlisted rendered page without becoming an account agent, universal scraper, or external mutation path.
+
+## Decision
+
+1. Browser automation is allowed only as a server-owned, read-only observation capability behind the existing Capability and research adapter boundaries.
+2. The browser runtime may navigate only to an explicit HTTPS host allowlist and bounded navigation policy. Browser-supplied or model-supplied authority, credentials, proxy settings, cookies, headers, download paths, or arbitrary JavaScript are rejected.
+3. The capability may load public pages and wait for bounded client-side rendering. It may read visible text and explicitly declared structured-data selectors, then return an Epistemics Observation with source URL, observed time, coverage, and failure state.
+4. Login, cookies, account state, CAPTCHA solving, checkout, form submission, uploads, downloads, purchases, messages, mutations, and external side effects are out of scope.
+5. A blocked page, challenge, timeout, partial DOM, missing price, or conflicting value remains `UNKNOWN`, `PARTIAL`, or `NOT_OBSERVED`; it never becomes a verified fact by model interpretation alone.
+6. Browser observation is optional. Search-only routing remains the fallback when the capability is unavailable, degraded, or not allowlisted for the requested host.
+7. Capability owns availability, host policy, health and limits. Epistemics owns the resulting observation and provenance. No new canonical owner or database schema is introduced.
+8. The first implementation may be development-only. Production activation requires independent capability health, allowlist evidence, adversarial navigation tests, and a live read-only smoke test.
+
+## Boundaries
+
+- Core/domain code does not import a browser or provider runtime.
+- The browser adapter performs only bounded GET/navigation observation and cannot reach Commit/Executor.
+- Secrets remain outside the browser runtime and its artifacts, logs, screenshots, page content and chat context.
+- An observation is evidence for answer synthesis, not an instruction to mutate a site or canonical state.
+
+## Consequences
+
+- Dynamic public pages can provide stronger evidence than search snippets when the site permits it.
+- Site-specific selectors and host policy are replaceable adapter configuration, not semantic domain logic.
+- Browser unavailability is a capability gap, not a runtime-wide outage.
+- The old blanket prohibition on browser automation is replaced by this narrower, testable boundary.

cmd/agent-execution-bridge/main.go

@@ -0,0 +1,211 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"git.cin.su/m/Assistant/contracts/artifact"
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/cognitive"
+	"git.cin.su/m/Assistant/contracts/work"
+	capabilitydomain "git.cin.su/m/Assistant/modules/capability/domain"
+)
+
+type bridge struct {
+	cognitiveURL string
+	callbackURL  string
+	verifierURL  string
+	client       *http.Client
+}
+
+func main() {
+	b := bridge{
+		cognitiveURL: strings.TrimRight(envOr("COGNITIVE_WORKER_URL", "http://cognitive-worker:8083"), "/"),
+		callbackURL:  strings.TrimRight(envOr("WORK_GRAPH_RUNTIME_URL", "http://work-graph-runtime:8088"), "/"),
+		verifierURL:  strings.TrimRight(envOr("TASK_VERIFIER_URL", "http://task-verifier:8091"), "/"),
+		client:       &http.Client{Timeout: 10 * time.Minute},
+	}
+	mux := http.NewServeMux()
+	mux.HandleFunc("/healthz", healthHandler)
+	mux.HandleFunc("/readyz", healthHandler)
+	mux.HandleFunc("/v1/execute", b.executeHandler)
+	addr := envOr("LISTEN_ADDR", ":8092")
+	if err := http.ListenAndServe(addr, mux); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func (b bridge) executeHandler(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	var request work.AgentExecutionRequest
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&request); err != nil {
+		http.Error(w, "invalid execution request", http.StatusBadRequest)
+		return
+	}
+	result, err := b.execute(r.Context(), request)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadGateway)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(result)
+}
+
+func (b bridge) execute(ctx context.Context, request work.AgentExecutionRequest) (work.AgentExecutionResult, error) {
+	now := time.Now().UnixMilli()
+	intent := request.Intent
+	if intent.TaskEvaluationExecution != nil && intent.TaskEvaluationExecution.GenericMessage != "" {
+		return b.executeGenericCognitiveWork(ctx, request, *intent.TaskEvaluationExecution)
+	}
+	if intent.TaskEvaluationExecution == nil || intent.TaskEvaluationProfile == nil || len(intent.TaskEvaluationCases) == 0 {
+		return work.AgentExecutionResult{State: work.AgentExecutionWaiting, Summary: "локальный bridge не поддерживает это намерение; работа сохранена и ожидает подходящего исполнителя", ObservedAtUnixMillis: now}, nil
+	}
+	execution := intent.TaskEvaluationExecution
+	if execution.GraphID == "" || execution.NodeID == "" || execution.BindingRevision < 1 || execution.ActorID == "" || execution.PrincipalID == "" || execution.ScopeID == "" {
+		return work.AgentExecutionResult{State: work.AgentExecutionWaiting, Summary: "контекст task-evaluation неполон; работа сохранена для повторной маршрутизации", ObservedAtUnixMillis: now}, nil
+	}
+	payload := capability.TaskEvaluationExecutionRequest{Profile: *intent.TaskEvaluationProfile, CapabilityID: intent.TaskEvaluationProfile.CapabilityID, BindingID: intent.TaskEvaluationBindingID, BindingRevision: execution.BindingRevision, ActorID: execution.ActorID, PrincipalID: execution.PrincipalID, ScopeID: execution.ScopeID, Cases: intent.TaskEvaluationCases, MaxOutputBytes: 4096}
+	response, err := postJSON[capability.TaskEvaluationExecutionResponse](ctx, b.client, b.cognitiveURL+"/v1/task-evaluations/execute", payload)
+	if err != nil {
+		return work.AgentExecutionResult{}, err
+	}
+	if len(response.Responses) == 0 || response.ObservedAtUnixMillis < 1 {
+		return work.AgentExecutionResult{}, fmt.Errorf("task evaluation returned no observations")
+	}
+	caseByID := make(map[string]capability.TaskEvaluationCase, len(intent.TaskEvaluationCases))
+	for _, item := range intent.TaskEvaluationCases {
+		caseByID[item.CaseID] = item
+	}
+	observations := response.Observations
+	if !hasCriticalFailure(observations) {
+		observations = make([]capability.TaskCaseObservation, 0, len(response.Responses))
+		for _, item := range response.Responses {
+			caseValue, ok := caseByID[item.CaseID]
+			if !ok || caseValue.Verification.Mode == "" {
+				return work.AgentExecutionResult{State: work.AgentExecutionWaiting, Summary: "task-evaluation case has no bounded verifier; work remains waiting", ObservedAtUnixMillis: time.Now().UnixMilli()}, nil
+			}
+			verified, verifyErr := postJSON[capability.TaskCaseVerificationResponse](ctx, b.client, b.verifierURL+"/v1/task-evaluations/verify", capability.TaskCaseVerificationRequest{CaseID: item.CaseID, ResponseText: item.ResponseText, LatencyMicros: item.LatencyMicros, EvidenceArtifactRef: item.EvidenceArtifactRef, Verification: caseValue.Verification})
+			if verifyErr != nil {
+				return work.AgentExecutionResult{}, verifyErr
+			}
+			observations = append(observations, capability.TaskCaseObservation{CaseID: verified.CaseID, Result: verified.Result, QualityScoreMillis: verified.QualityScoreMillis, LatencyMicros: verified.LatencyMicros, CriticalFailure: verified.CriticalFailure, EvidenceArtifactRef: verified.EvidenceArtifactRef, VerificationEvidenceRef: verified.VerificationEvidenceRef, VerifierIdentity: verified.VerifierIdentity})
+		}
+	}
+	evaluation, err := capabilitydomain.BuildTaskEvaluation(*intent.TaskEvaluationProfile, capability.TaskEvaluationID("evaluation:"+intent.DispatchID), response.BindingID, response.BindingRevision, intent.TaskEvaluationProfile.CapabilityID, observations, artifact.ArtifactID(intent.TaskEvaluationCases[0].EvidenceArtifactRef), response.ObservedAtUnixMillis)
+	if err != nil {
+		return work.AgentExecutionResult{}, err
+	}
+	callback := work.TaskEvaluationEvidenceCallback{GraphID: execution.GraphID, Revision: execution.GraphRevision, NodeID: execution.NodeID, Evaluation: evaluation, Succeeded: true}
+	if _, err := postJSON[json.RawMessage](ctx, b.client, b.callbackURL+"/v1/work-graphs/task-evaluations/callback", callback); err != nil {
+		return work.AgentExecutionResult{}, err
+	}
+	return work.AgentExecutionResult{State: work.AgentExecutionCompleted, Summary: "local bridge executed task evaluation and persisted verifier callback", OutcomeRef: string(evaluation.ID), ArtifactRefs: []string{string(evaluation.ArtifactID)}, ObservedAtUnixMillis: time.Now().UnixMilli()}, nil
+}
+
+func (b bridge) executeGenericCognitiveWork(ctx context.Context, request work.AgentExecutionRequest, execution work.TaskEvaluationDispatchContext) (work.AgentExecutionResult, error) {
+	if execution.GraphID == "" || execution.NodeID == "" || execution.ActorID == "" || execution.PrincipalID == "" || execution.ScopeID == "" {
+		return work.AgentExecutionResult{State: work.AgentExecutionWaiting, Summary: "generic cognitive work context is incomplete; durable work remains waiting for rerouting", ObservedAtUnixMillis: time.Now().UnixMilli()}, nil
+	}
+	maxOutputBytes := execution.GenericMaxOutputBytes
+	if maxOutputBytes < 1 {
+		maxOutputBytes = 4096
+	}
+	dataPolicy := capability.DataPolicy(execution.GenericDataPolicy)
+	if dataPolicy == "" {
+		dataPolicy = capability.DataPolicyLocalOnly
+	}
+	response, err := postJSON[cognitive.GatewayAdvisoryResponse](ctx, b.client, b.cognitiveURL+"/v1/advisories", cognitive.GatewayAdvisoryRequest{
+		Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID("agent-work:" + request.Intent.DispatchID), ActorID: execution.ActorID,
+		PrincipalID: execution.PrincipalID, ScopeID: execution.ScopeID, Message: execution.GenericMessage, Locale: execution.GenericLocale,
+		MaxOutputBytes: maxOutputBytes, DataPolicy: dataPolicy, Meaning: cognitive.TaskMeaning{SpeechAct: "DIRECTIVE", RequestedOutcome: execution.GenericPurpose},
+	})
+	if err != nil {
+		return work.AgentExecutionResult{}, err
+	}
+	if response.FinishReason != cognitive.FinishCompleted || strings.TrimSpace(response.AdvisoryText) == "" {
+		return work.AgentExecutionResult{}, fmt.Errorf("generic cognitive work did not complete: %s", response.FinishReason)
+	}
+	candidateID := "candidate:" + request.Intent.DispatchID
+	artifactRef := work.EvidenceRef("agent-output:" + request.Intent.DispatchID)
+	verification, err := postJSON[work.GenericCandidateVerificationResponse](ctx, b.client, b.verifierURL+"/v1/work-graphs/candidates/verify", work.GenericCandidateVerificationRequest{
+		GraphID: execution.GraphID, GraphRevision: execution.GraphRevision, NodeID: execution.NodeID, AuthorRunID: request.Intent.RunID, CandidateID: candidateID, Summary: response.AdvisoryText, EvidenceRefs: []work.EvidenceRef{artifactRef},
+	})
+	if err != nil {
+		return work.AgentExecutionResult{}, err
+	}
+	if !verification.Verified || verification.VerificationEvidenceRef == "" || verification.VerifierIdentity == "" {
+		return work.AgentExecutionResult{State: work.AgentExecutionWaiting, Summary: "generic candidate envelope was not independently verified; work remains waiting", ObservedAtUnixMillis: time.Now().UnixMilli()}, nil
+	}
+	candidate := work.GraphResultCallback{GraphID: execution.GraphID, Revision: execution.GraphRevision, Candidate: work.ResultCandidate{
+		ID: candidateID, GraphID: execution.GraphID, GraphRevision: execution.GraphRevision, NodeID: execution.NodeID,
+		AuthorRunID: request.Intent.RunID, ArtifactRefs: []work.EvidenceRef{artifactRef, work.EvidenceRef(verification.VerificationEvidenceRef)}, EvidenceSummary: "candidate attribution and evidence envelope independently verified; semantic content remains unverified",
+		Summary: response.AdvisoryText,
+	}}
+	if _, err := postJSON[json.RawMessage](ctx, b.client, b.callbackURL+"/v1/work-graphs/result-callback", candidate); err != nil {
+		return work.AgentExecutionResult{}, err
+	}
+	return work.AgentExecutionResult{State: work.AgentExecutionCompleted, Summary: "local cognitive specialist produced a candidate for independent verification", OutcomeRef: "candidate:" + request.Intent.DispatchID, ArtifactRefs: []string{"agent-output:" + request.Intent.DispatchID}, ObservedAtUnixMillis: time.Now().UnixMilli()}, nil
+}
+
+func hasCriticalFailure(observations []capability.TaskCaseObservation) bool {
+	for _, observation := range observations {
+		if observation.CriticalFailure {
+			return true
+		}
+	}
+	return false
+}
+
+func postJSON[T any](ctx context.Context, client *http.Client, url string, payload any) (T, error) {
+	var result T
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return result, err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(body))
+	if err != nil {
+		return result, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := client.Do(req)
+	if err != nil {
+		return result, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return result, fmt.Errorf("POST %s: status %s", url, resp.Status)
+	}
+	if resp.StatusCode == http.StatusNoContent {
+		return result, nil
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return result, err
+	}
+	return result, nil
+}
+
+func healthHandler(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_, _ = w.Write([]byte(`{"runtime":"agent-execution-bridge","status":"ok","capabilities":["task-evaluation","generic-cognitive-work"]}`))
+}
+
+func envOr(name, fallback string) string {
+	if value := strings.TrimSpace(os.Getenv(name)); value != "" {
+		return value
+	}
+	return fallback
+}

cmd/agent-execution-bridge/main_test.go

@@ -0,0 +1,88 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/cognitive"
+	"git.cin.su/m/Assistant/contracts/work"
+)
+
+func TestBridgeWaitsForUnsupportedIntent(t *testing.T) {
+	b := bridge{client: http.DefaultClient}
+	result, err := b.execute(context.Background(), work.AgentExecutionRequest{Intent: work.AgentDispatchIntent{DispatchID: "dispatch-unsupported"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.State != work.AgentExecutionWaiting || result.ObservedAtUnixMillis < 1 {
+		t.Fatalf("result=%+v", result)
+	}
+}
+
+func TestHealthHandlerExposesBoundedCapability(t *testing.T) {
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequest(http.MethodGet, "/healthz", nil)
+	healthHandler(recorder, request)
+	if recorder.Code != http.StatusOK || recorder.Body.String() == "" {
+		t.Fatalf("status=%d body=%q", recorder.Code, recorder.Body.String())
+	}
+}
+
+func TestBridgeRunsTaskEvaluationThroughVerifierAndCallback(t *testing.T) {
+	profile := capability.TaskEvaluationProfile{ID: "profile-1", Revision: 1, CapabilityID: "capability-1", Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "general-v1", RequiredCaseIDs: []string{"case-1"}, QualityWeightMillis: 600, ReliabilityWeightMillis: 300, LatencyWeightMillis: 100}
+	verification := capability.TaskCaseVerification{Mode: capability.TaskCaseVerificationExactText, ExpectedText: "answer", MinimumQualityMillis: 900}
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/v1/task-evaluations/execute":
+			_ = json.NewEncoder(w).Encode(capability.TaskEvaluationExecutionResponse{ProfileID: profile.ID, BindingID: "binding-1", BindingRevision: 3, Responses: []capability.TaskCaseResponse{{CaseID: "case-1", ResponseText: "answer", LatencyMicros: 2, EvidenceArtifactRef: "artifact-1"}}, ObservedAtUnixMillis: 10})
+		case "/v1/task-evaluations/verify":
+			_ = json.NewEncoder(w).Encode(capability.TaskCaseVerificationResponse{CaseID: "case-1", Result: capability.EvaluationSupported, QualityScoreMillis: 900, LatencyMicros: 2, EvidenceArtifactRef: "artifact-1", VerificationEvidenceRef: "verify-1", VerifierIdentity: "verifier-1"})
+		case "/v1/work-graphs/task-evaluations/callback":
+			w.WriteHeader(http.StatusNoContent)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+	b := bridge{cognitiveURL: server.URL, callbackURL: server.URL, verifierURL: server.URL, client: server.Client()}
+	result, err := b.execute(context.Background(), work.AgentExecutionRequest{Intent: work.AgentDispatchIntent{DispatchID: "dispatch-1", TaskEvaluationBindingID: "binding-1", TaskEvaluationProfile: &profile, TaskEvaluationCases: []capability.TaskEvaluationCase{{CaseID: "case-1", Prompt: "answer", EvidenceArtifactRef: "artifact-1", Verification: verification}}, TaskEvaluationExecution: &work.TaskEvaluationDispatchContext{GraphID: "graph-1", GraphRevision: 1, NodeID: "node-1", BindingRevision: 3, ActorID: "actor-1", PrincipalID: "principal-1", ScopeID: "scope-1"}}})
+	if err != nil || result.State != work.AgentExecutionCompleted || result.OutcomeRef == "" {
+		t.Fatalf("result=%+v err=%v", result, err)
+	}
+}
+
+func TestBridgeRunsGenericCognitiveWorkAsUnverifiedGraphCandidate(t *testing.T) {
+	var callback work.GraphResultCallback
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/v1/advisories":
+			var request cognitive.GatewayAdvisoryRequest
+			if err := json.NewDecoder(r.Body).Decode(&request); err != nil || request.Message != "find the bounded solution" {
+				t.Fatalf("unexpected advisory request: %+v err=%v", request, err)
+			}
+			_ = json.NewEncoder(w).Encode(cognitive.GatewayAdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: request.RequestID, AdvisoryText: "candidate answer", FinishReason: cognitive.FinishCompleted})
+		case "/v1/work-graphs/result-callback":
+			if err := json.NewDecoder(r.Body).Decode(&callback); err != nil {
+				t.Fatal(err)
+			}
+			w.WriteHeader(http.StatusNoContent)
+		case "/v1/work-graphs/candidates/verify":
+			_ = json.NewEncoder(w).Encode(work.GenericCandidateVerificationResponse{Verified: true, VerificationEvidenceRef: "verification:generic-1", VerifierIdentity: "deterministic-generic-envelope-verifier-v1", Summary: "envelope verified"})
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+	b := bridge{cognitiveURL: server.URL, callbackURL: server.URL, verifierURL: server.URL, client: server.Client()}
+	result, err := b.execute(context.Background(), work.AgentExecutionRequest{Intent: work.AgentDispatchIntent{
+		DispatchID: "dispatch-generic", RunID: "run-generic",
+		TaskEvaluationExecution: &work.TaskEvaluationDispatchContext{GraphID: "graph-1", GraphRevision: 2, NodeID: "node-1", ActorID: "actor-1", PrincipalID: "principal-1", ScopeID: "scope-1", GenericMessage: "find the bounded solution", GenericPurpose: "investigate", GenericDataPolicy: string(capability.DataPolicyLocalOnly)},
+	}})
+	if err != nil || result.State != work.AgentExecutionCompleted || callback.Candidate.Summary != "candidate answer" || callback.Candidate.AuthorRunID != "run-generic" || len(callback.Candidate.ArtifactRefs) != 2 {
+		t.Fatalf("result=%+v callback=%+v err=%v", result, callback, err)
+	}
+}

cmd/agent-worker/local_fallback.go

@@ -7,26 +7,26 @@ import (
 	"git.cin.su/m/Assistant/contracts/work"
 )
 
-// localFallbackExecutor keeps the durable work path alive when no external
-// executor is reachable. It never claims that an external action happened.
-// The work owner records the WAITING callback and can retry after a bridge is
+// localExecutor provides the bounded local execution capability. It never
+// claims that an unsupported or external action happened. The work owner
+// records the WAITING callback and can retry after a suitable executor is
 // configured or a human chooses the next step.
-type localFallbackExecutor struct {
+type localExecutor struct {
 	now func() time.Time
 }
 
-func newLocalFallbackExecutor() localFallbackExecutor {
-	return localFallbackExecutor{now: time.Now}
+func newLocalExecutor() localExecutor {
+	return localExecutor{now: time.Now}
 }
 
-func (e localFallbackExecutor) Execute(_ context.Context, request work.AgentExecutionRequest) (work.AgentExecutionResult, error) {
+func (e localExecutor) Execute(_ context.Context, request work.AgentExecutionRequest) (work.AgentExecutionResult, error) {
 	now := time.Now()
 	if e.now != nil {
 		now = e.now()
 	}
 	return work.AgentExecutionResult{
 		State:                work.AgentExecutionWaiting,
-		Summary:              "Внешний Agent Execution Bridge недоступен; локальный fallback сохранил durable работу и ожидает исполнителя.",
+		Summary:              "Локальный исполнитель не поддерживает эту операцию; durable работа сохранена и ожидает подходящего исполнителя.",
 		ObservedAtUnixMillis: now.UnixMilli(),
 	}, nil
 }

cmd/agent-worker/local_fallback_test.go

@@ -8,9 +8,9 @@ import (
 	"git.cin.su/m/Assistant/contracts/work"
 )
 
-func TestLocalFallbackNeverClaimsExternalExecution(t *testing.T) {
+func TestLocalExecutorNeverClaimsUnsupportedExecution(t *testing.T) {
 	when := time.UnixMilli(1_700_000_000_000)
-	executor := localFallbackExecutor{now: func() time.Time { return when }}
+	executor := localExecutor{now: func() time.Time { return when }}
 	result, err := executor.Execute(context.Background(), work.AgentExecutionRequest{Intent: work.AgentDispatchIntent{DispatchID: "dispatch-1"}})
 	if err != nil {
 		t.Fatal(err)
@@ -19,6 +19,6 @@ func TestLocalFallbackNeverClaimsExternalExecution(t *testing.T) {
 		t.Fatalf("unexpected fallback result: %+v", result)
 	}
 	if result.OutcomeRef != "" || result.Summary == "" {
-		t.Fatalf("fallback must not claim an outcome: %+v", result)
+		t.Fatalf("local executor must not claim an outcome: %+v", result)
 	}
 }

cmd/agent-worker/main.go

@@ -42,26 +42,29 @@ func main() {
 	defer repository.Close()
 	var executor ports.AgentExecutor
 	localFallback := false
-	if bridgeURL, bridgeConfigured := loadProtectedBridgeURL(); bridgeConfigured {
+	if bridgeURL, bridgeConfigured := loadConfiguredBridgeURL(); bridgeConfigured {
 		executor, err = agentbridge.NewHTTPExecutor(bridgeURL, &http.Client{Timeout: *leaseTTL})
 		if err != nil {
 			fmt.Fprintln(os.Stderr, err)
 			os.Exit(1)
 		}
 	} else {
-		// The local evaluator keeps task-qualification work alive, but it is not
-		// an external Agent Execution Bridge and must never be reported as one.
+		// The local executor keeps supported task-qualification work alive, but
+		// it is not an external Agent Execution Bridge and must never be reported
+		// as one. Unsupported work remains durably WAITING.
 		localFallback = true
-		executor = newTaskEvaluationExecutor(envOr("COGNITIVE_WORKER_URL", "http://cognitive-worker:8083"), envOr("WORK_GRAPH_RUNTIME_URL", "http://work-graph-runtime:8088"), &http.Client{Timeout: *leaseTTL})
+		executor = newTaskEvaluationExecutor(envOr("COGNITIVE_WORKER_URL", "http://cognitive-worker:8083"), envOr("WORK_GRAPH_RUNTIME_URL", "http://work-graph-runtime:8088"), envOr("TASK_VERIFIER_URL", "http://task-verifier:8091"), &http.Client{Timeout: *leaseTTL})
 		fmt.Fprintln(os.Stderr, "protected agent execution bridge URL is not configured; task evaluations use the local durable evaluator, other work remains in fallback")
 	}
+	runtimeStatus := newAgentWorkerRuntimeStatus()
 	go func() {
-		if serveErr := http.ListenAndServe(*statusAddr, workerStatusHandler(executor != nil && !localFallback, localFallback)); serveErr != nil {
+		if serveErr := http.ListenAndServe(*statusAddr, workerStatusHandler(executor != nil && !localFallback, localFallback, runtimeStatus)); serveErr != nil {
 			fmt.Fprintln(os.Stderr, "agent worker status server:", serveErr)
 		}
 	}()
 	ctx := context.Background()
 	for {
+		runtimeStatus.cycleStarted(time.Now())
 		var result application.WorkerCycleResult
 		var cycleErr error
 		if executor == nil {
@@ -70,11 +73,19 @@ func main() {
 			result, cycleErr = application.ExecuteWorkerCycleWithExecutor(ctx, repository, executor, *workerID, work.AgentFencingToken(1), time.Now().UTC(), *staleAfter, *leaseTTL)
 		}
 		if cycleErr != nil {
+			runtimeStatus.cycleFailed(time.Now(), cycleErr)
 			fmt.Fprintln(os.Stderr, cycleErr)
 			if *once {
 				os.Exit(1)
 			}
 		}
+		cycleResult := "idle"
+		if result.Completed {
+			cycleResult = "completed"
+		} else if result.RecoveredClaims > 0 {
+			cycleResult = "recovered"
+		}
+		runtimeStatus.cycleFinished(time.Now(), result.RecoveredClaims, result.DispatchID, cycleResult)
 		if cycleErr == nil && (result.Completed || result.RecoveredClaims > 0) {
 			_ = json.NewEncoder(os.Stdout).Encode(result)
 		}
@@ -88,6 +99,19 @@ func main() {
 	}
 }
 
+func loadConfiguredBridgeURL() (string, bool) {
+	if bridgeURL, configured := loadProtectedBridgeURL(); configured {
+		return bridgeURL, true
+	}
+	// The URL is routing configuration, not a credential. A protected file
+	// remains preferred when an independently operated bridge is supplied.
+	value := strings.TrimSpace(os.Getenv("AGENT_EXECUTION_BRIDGE_URL"))
+	if value == "" || !strings.HasPrefix(value, "http://") && !strings.HasPrefix(value, "https://") {
+		return "", false
+	}
+	return value, true
+}
+
 func loadProtectedBridgeURL() (string, bool) {
 	return loadProtectedBridgeURLFrom("/run/secrets", "/run/secrets/agent_execution_bridge_url")
 }

cmd/agent-worker/status.go

@@ -3,35 +3,106 @@ package main
 import (
 	"encoding/json"
 	"net/http"
+	"sync"
+	"time"
 )
 
 type workerStatusResponse struct {
-	Runtime            string `json:"runtime"`
-	ExecutorConfigured bool   `json:"executor_configured"`
-	Mode               string `json:"mode"`
-	Ready              bool   `json:"ready"`
-	Reason             string `json:"reason"`
-	LocalFallback      bool   `json:"local_fallback"`
+	Runtime              string    `json:"runtime"`
+	ExecutorConfigured   bool      `json:"executor_configured"`
+	Mode                 string    `json:"mode"`
+	Ready                bool      `json:"ready"`
+	Reason               string    `json:"reason"`
+	LocalFallback        bool      `json:"local_fallback"`
+	LocalExecutor        bool      `json:"local_executor"`
+	Capabilities         []string  `json:"capabilities,omitempty"`
+	StartedAt            time.Time `json:"started_at,omitempty"`
+	LastCycleAt          time.Time `json:"last_cycle_at,omitempty"`
+	LastCompletedAt      time.Time `json:"last_completed_at,omitempty"`
+	LastRecoveredClaims  int64     `json:"last_recovered_claims"`
+	TotalRecoveredClaims int64     `json:"total_recovered_claims"`
+	LastDispatchID       string    `json:"last_dispatch_id,omitempty"`
+	LastResult           string    `json:"last_result,omitempty"`
+	LastError            string    `json:"last_error,omitempty"`
 }
 
-func workerStatusHandler(executorConfigured bool, localFallback ...bool) http.Handler {
-	local := len(localFallback) > 0 && localFallback[0]
-	status := workerStatusResponse{
+type agentWorkerRuntimeStatus struct {
+	mu                   sync.RWMutex
+	startedAt            time.Time
+	lastCycleAt          time.Time
+	lastCompletedAt      time.Time
+	lastRecoveredClaims  int64
+	totalRecoveredClaims int64
+	lastDispatchID       string
+	lastResult           string
+	lastError            string
+}
+
+func newAgentWorkerRuntimeStatus() *agentWorkerRuntimeStatus {
+	return &agentWorkerRuntimeStatus{startedAt: time.Now().UTC()}
+}
+
+func (s *agentWorkerRuntimeStatus) cycleStarted(at time.Time) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.lastCycleAt = at.UTC()
+	s.lastResult = "running"
+	s.lastError = ""
+}
+
+func (s *agentWorkerRuntimeStatus) cycleFinished(at time.Time, recoveredClaims int64, dispatchID string, result string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.lastCompletedAt = at.UTC()
+	s.lastRecoveredClaims = recoveredClaims
+	s.totalRecoveredClaims += recoveredClaims
+	s.lastDispatchID = dispatchID
+	s.lastResult = result
+	s.lastError = ""
+}
+
+func (s *agentWorkerRuntimeStatus) cycleFailed(at time.Time, err error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.lastCompletedAt = at.UTC()
+	s.lastResult = "failed"
+	s.lastError = err.Error()
+}
+
+func workerStatusHandler(executorConfigured bool, localFallback ...interface{}) http.Handler {
+	local := false
+	var runtime *agentWorkerRuntimeStatus
+	for _, argument := range localFallback {
+		switch value := argument.(type) {
+		case bool:
+			local = value
+		case *agentWorkerRuntimeStatus:
+			runtime = value
+		}
+	}
+	if runtime == nil {
+		runtime = newAgentWorkerRuntimeStatus()
+	}
+	baseStatus := workerStatusResponse{
 		Runtime:            "agent-worker",
 		ExecutorConfigured: executorConfigured,
 		Mode:               "recovery-only",
 		Ready:              false,
 		Reason:             "protected agent execution bridge URL is not configured",
 		LocalFallback:      local,
+		LocalExecutor:      local,
 	}
 	if local {
-		status.Mode = "local-fallback"
-		status.Reason = "external bridge unavailable; durable work is retained without external mutation"
+		baseStatus.Mode = "local-executor"
+		baseStatus.Ready = true
+		baseStatus.Reason = "bounded local task-evaluation capability is ready; unsupported work remains durably waiting"
+		baseStatus.Capabilities = []string{"task-evaluation"}
 	}
 	if executorConfigured {
-		status.Mode = "execution"
-		status.Ready = true
-		status.Reason = "typed agent execution bridge configured"
+		baseStatus.Mode = "execution"
+		baseStatus.Ready = true
+		baseStatus.Reason = "typed agent execution bridge configured"
+		baseStatus.Capabilities = []string{"task-evaluation", "generic-cognitive-work"}
 	}
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodGet || (r.URL.Path != "/healthz" && r.URL.Path != "/readyz" && r.URL.Path != "/status") {
@@ -39,9 +110,20 @@ func workerStatusHandler(executorConfigured bool, localFallback ...bool) http.Ha
 			return
 		}
 		w.Header().Set("Content-Type", "application/json")
-		if r.URL.Path == "/readyz" && !status.Ready {
+		if r.URL.Path == "/readyz" && !baseStatus.Ready {
 			w.WriteHeader(http.StatusServiceUnavailable)
 		}
-		_ = json.NewEncoder(w).Encode(status)
+		response := baseStatus
+		runtime.mu.RLock()
+		response.StartedAt = runtime.startedAt
+		response.LastCycleAt = runtime.lastCycleAt
+		response.LastCompletedAt = runtime.lastCompletedAt
+		response.LastRecoveredClaims = runtime.lastRecoveredClaims
+		response.TotalRecoveredClaims = runtime.totalRecoveredClaims
+		response.LastDispatchID = runtime.lastDispatchID
+		response.LastResult = runtime.lastResult
+		response.LastError = runtime.lastError
+		runtime.mu.RUnlock()
+		_ = json.NewEncoder(w).Encode(response)
 	})
 }

cmd/agent-worker/status_test.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 )
 
 func TestLoadProtectedBridgeURL(t *testing.T) {
@@ -38,16 +39,19 @@ func TestWorkerStatusReportsRecoveryOnlyWithoutExecutor(t *testing.T) {
 	}
 }
 
-func TestWorkerStatusReportsLocalFallback(t *testing.T) {
+func TestWorkerStatusReportsLocalExecutorCapabilityReady(t *testing.T) {
 	response := httptest.NewRecorder()
 	workerStatusHandler(false, true).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/status", nil))
 	var value workerStatusResponse
 	if err := json.NewDecoder(response.Body).Decode(&value); err != nil {
 		t.Fatal(err)
 	}
-	if response.Code != http.StatusOK || value.Ready || value.Mode != "local-fallback" || !value.LocalFallback {
+	if response.Code != http.StatusOK || !value.Ready || value.Mode != "local-executor" || !value.LocalFallback || !value.LocalExecutor {
 		t.Fatalf("unexpected status: code=%d value=%+v", response.Code, value)
 	}
+	if len(value.Capabilities) != 1 || value.Capabilities[0] != "task-evaluation" {
+		t.Fatalf("unexpected local capabilities: %+v", value.Capabilities)
+	}
 }
 
 func TestWorkerStatusDoesNotCallLocalFallbackAnExternalExecutor(t *testing.T) {
@@ -57,20 +61,54 @@ func TestWorkerStatusDoesNotCallLocalFallbackAnExternalExecutor(t *testing.T) {
 	if err := json.NewDecoder(response.Body).Decode(&value); err != nil {
 		t.Fatal(err)
 	}
-	if value.ExecutorConfigured || value.Ready || !value.LocalFallback || value.Mode != "local-fallback" {
+	if value.ExecutorConfigured || !value.Ready || !value.LocalFallback || !value.LocalExecutor || value.Mode != "local-executor" {
 		t.Fatalf("local fallback was presented as external execution: %+v", value)
 	}
 }
 
-func TestWorkerReadyzRequiresExecutor(t *testing.T) {
+func TestWorkerReadyzRequiresAnAdvertisedCapability(t *testing.T) {
 	response := httptest.NewRecorder()
 	workerStatusHandler(false).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/readyz", nil))
 	if response.Code != http.StatusServiceUnavailable {
 		t.Fatalf("readyz status=%d", response.Code)
 	}
 	response = httptest.NewRecorder()
+	workerStatusHandler(false, true).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/readyz", nil))
+	if response.Code != http.StatusOK {
+		t.Fatalf("local capability readyz status=%d", response.Code)
+	}
+	response = httptest.NewRecorder()
 	workerStatusHandler(true).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/readyz", nil))
 	if response.Code != http.StatusOK {
 		t.Fatalf("configured readyz status=%d", response.Code)
 	}
 }
+
+func TestWorkerStatusReportsRecoveryCycle(t *testing.T) {
+	runtime := newAgentWorkerRuntimeStatus()
+	runtime.cycleStarted(time.Date(2026, 8, 23, 10, 0, 0, 0, time.UTC))
+	runtime.cycleFinished(time.Date(2026, 8, 23, 10, 0, 1, 0, time.UTC), 3, "dispatch-1", "recovered")
+	response := httptest.NewRecorder()
+	workerStatusHandler(false, true, runtime).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/status", nil))
+	var value workerStatusResponse
+	if err := json.NewDecoder(response.Body).Decode(&value); err != nil {
+		t.Fatal(err)
+	}
+	if value.LastRecoveredClaims != 3 || value.TotalRecoveredClaims != 3 || value.LastDispatchID != "dispatch-1" || value.LastResult != "recovered" {
+		t.Fatalf("recovery evidence missing: %+v", value)
+	}
+}
+
+func TestWorkerStatusReportsCycleError(t *testing.T) {
+	runtime := newAgentWorkerRuntimeStatus()
+	runtime.cycleFailed(time.Date(2026, 8, 23, 10, 0, 1, 0, time.UTC), os.ErrClosed)
+	response := httptest.NewRecorder()
+	workerStatusHandler(false, runtime).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/status", nil))
+	var value workerStatusResponse
+	if err := json.NewDecoder(response.Body).Decode(&value); err != nil {
+		t.Fatal(err)
+	}
+	if value.LastResult != "failed" || value.LastError == "" {
+		t.Fatalf("cycle error missing: %+v", value)
+	}
+}

cmd/agent-worker/task_evaluation_executor.go

@@ -18,15 +18,16 @@ import (
 type taskEvaluationExecutor struct {
 	cognitiveURL string
 	callbackURL  string
+	verifierURL  string
 	client       *http.Client
-	fallback     localFallbackExecutor
+	fallback     localExecutor
 }
 
-func newTaskEvaluationExecutor(cognitiveURL, callbackURL string, client *http.Client) taskEvaluationExecutor {
+func newTaskEvaluationExecutor(cognitiveURL, callbackURL, verifierURL string, client *http.Client) taskEvaluationExecutor {
 	if client == nil {
 		client = http.DefaultClient
 	}
-	return taskEvaluationExecutor{cognitiveURL: strings.TrimRight(cognitiveURL, "/"), callbackURL: strings.TrimRight(callbackURL, "/"), client: client, fallback: newLocalFallbackExecutor()}
+	return taskEvaluationExecutor{cognitiveURL: strings.TrimRight(cognitiveURL, "/"), callbackURL: strings.TrimRight(callbackURL, "/"), verifierURL: strings.TrimRight(verifierURL, "/"), client: client, fallback: newLocalExecutor()}
 }
 
 func (e taskEvaluationExecutor) Execute(ctx context.Context, request work.AgentExecutionRequest) (work.AgentExecutionResult, error) {
@@ -38,7 +39,7 @@ func (e taskEvaluationExecutor) Execute(ctx context.Context, request work.AgentE
 	if execution.GraphID == "" || execution.NodeID == "" || execution.BindingRevision < 1 || execution.ActorID == "" || execution.PrincipalID == "" || execution.ScopeID == "" {
 		return e.fallback.Execute(ctx, request)
 	}
-	if e.cognitiveURL == "" || e.callbackURL == "" {
+	if e.cognitiveURL == "" || e.callbackURL == "" || e.verifierURL == "" {
 		return e.fallback.Execute(ctx, request)
 	}
 	payload := capability.TaskEvaluationExecutionRequest{Profile: *intent.TaskEvaluationProfile, CapabilityID: intent.TaskEvaluationProfile.CapabilityID, BindingID: intent.TaskEvaluationBindingID, BindingRevision: execution.BindingRevision, ActorID: execution.ActorID, PrincipalID: execution.PrincipalID, ScopeID: execution.ScopeID, Cases: intent.TaskEvaluationCases, MaxOutputBytes: 4096}
@@ -46,13 +47,40 @@ func (e taskEvaluationExecutor) Execute(ctx context.Context, request work.AgentE
 	if err != nil {
 		return work.AgentExecutionResult{}, err
 	}
-	if len(response.Observations) == 0 || response.ObservedAtUnixMillis < 1 {
+	if len(response.Responses) == 0 || response.ObservedAtUnixMillis < 1 {
 		return work.AgentExecutionResult{}, fmt.Errorf("task evaluation returned no observations")
 	}
+	if len(response.Observations) == len(intent.TaskEvaluationCases) && taskEvaluationHasCriticalFailure(response.Observations) {
+		evaluation, err := capabilitydomain.BuildTaskEvaluation(*intent.TaskEvaluationProfile, capability.TaskEvaluationID("evaluation:"+intent.DispatchID), response.BindingID, response.BindingRevision, intent.TaskEvaluationProfile.CapabilityID, response.Observations, artifact.ArtifactID(intent.TaskEvaluationCases[0].EvidenceArtifactRef), response.ObservedAtUnixMillis)
+		if err != nil {
+			return work.AgentExecutionResult{}, err
+		}
+		callback := work.TaskEvaluationEvidenceCallback{GraphID: execution.GraphID, Revision: execution.GraphRevision, NodeID: execution.NodeID, Evaluation: evaluation, Succeeded: true}
+		if _, err := postJSON[json.RawMessage](ctx, e.client, e.callbackURL+"/v1/work-graphs/task-evaluations/callback", callback); err != nil {
+			return work.AgentExecutionResult{}, err
+		}
+		return work.AgentExecutionResult{State: work.AgentExecutionCompleted, Summary: "task evaluation recorded as UNKNOWN after bounded provider recovery", OutcomeRef: string(evaluation.ID), ArtifactRefs: []string{string(evaluation.ArtifactID)}, ObservedAtUnixMillis: time.Now().UnixMilli()}, nil
+	}
 	if len(intent.TaskEvaluationCases) == 0 {
 		return work.AgentExecutionResult{}, fmt.Errorf("task evaluation cases are missing")
 	}
-	evaluation, err := capabilitydomain.BuildTaskEvaluation(*intent.TaskEvaluationProfile, capability.TaskEvaluationID("evaluation:"+intent.DispatchID), response.BindingID, response.BindingRevision, intent.TaskEvaluationProfile.CapabilityID, response.Observations, artifact.ArtifactID(intent.TaskEvaluationCases[0].EvidenceArtifactRef), response.ObservedAtUnixMillis)
+	caseByID := make(map[string]capability.TaskEvaluationCase, len(intent.TaskEvaluationCases))
+	for _, item := range intent.TaskEvaluationCases {
+		caseByID[item.CaseID] = item
+	}
+	observations := make([]capability.TaskCaseObservation, 0, len(response.Responses))
+	for _, item := range response.Responses {
+		caseValue, ok := caseByID[item.CaseID]
+		if !ok || caseValue.Verification.Mode == "" {
+			return e.fallback.Execute(ctx, request)
+		}
+		verified, verifyErr := postJSON[capability.TaskCaseVerificationResponse](ctx, e.client, e.verifierURL+"/v1/task-evaluations/verify", capability.TaskCaseVerificationRequest{CaseID: item.CaseID, ResponseText: item.ResponseText, LatencyMicros: item.LatencyMicros, EvidenceArtifactRef: item.EvidenceArtifactRef, Verification: caseValue.Verification})
+		if verifyErr != nil {
+			return e.fallback.Execute(ctx, request)
+		}
+		observations = append(observations, capability.TaskCaseObservation{CaseID: verified.CaseID, Result: verified.Result, QualityScoreMillis: verified.QualityScoreMillis, LatencyMicros: verified.LatencyMicros, CriticalFailure: verified.CriticalFailure, EvidenceArtifactRef: verified.EvidenceArtifactRef, VerificationEvidenceRef: verified.VerificationEvidenceRef, VerifierIdentity: verified.VerifierIdentity})
+	}
+	evaluation, err := capabilitydomain.BuildTaskEvaluation(*intent.TaskEvaluationProfile, capability.TaskEvaluationID("evaluation:"+intent.DispatchID), response.BindingID, response.BindingRevision, intent.TaskEvaluationProfile.CapabilityID, observations, artifact.ArtifactID(intent.TaskEvaluationCases[0].EvidenceArtifactRef), response.ObservedAtUnixMillis)
 	if err != nil {
 		return work.AgentExecutionResult{}, err
 	}
@@ -63,6 +91,15 @@ func (e taskEvaluationExecutor) Execute(ctx context.Context, request work.AgentE
 	return work.AgentExecutionResult{State: work.AgentExecutionCompleted, Summary: "task evaluation executed, aggregated and accepted by Work Graph callback", OutcomeRef: string(evaluation.ID), ArtifactRefs: []string{string(evaluation.ArtifactID)}, ObservedAtUnixMillis: time.Now().UnixMilli()}, nil
 }
 
+func taskEvaluationHasCriticalFailure(observations []capability.TaskCaseObservation) bool {
+	for _, observation := range observations {
+		if observation.CriticalFailure {
+			return true
+		}
+	}
+	return false
+}
+
 func postJSON[T any](ctx context.Context, client *http.Client, url string, payload any) (T, error) {
 	var result T
 	body, err := json.Marshal(payload)

cmd/agent-worker/task_evaluation_executor_test.go

@@ -13,9 +13,14 @@ import (
 
 func TestTaskEvaluationExecutorInvokesAggregatesAndCallbacks(t *testing.T) {
 	profile := capability.TaskEvaluationProfile{ID: "profile-1", Revision: 1, CapabilityID: "capability-1", Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "general-v1", RequiredCaseIDs: []string{"case-1"}, QualityWeightMillis: 600, ReliabilityWeightMillis: 300, LatencyWeightMillis: 100}
+	verification := capability.TaskCaseVerification{Mode: capability.TaskCaseVerificationExactText, ExpectedText: "answer", MinimumQualityMillis: 900}
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/v1/task-evaluations/execute" {
-			_ = json.NewEncoder(w).Encode(capability.TaskEvaluationExecutionResponse{ProfileID: profile.ID, BindingID: "binding-1", BindingRevision: 3, Observations: []capability.TaskCaseObservation{{CaseID: "case-1", Result: capability.EvaluationSupported, EvidenceArtifactRef: "artifact-1"}}, ObservedAtUnixMillis: 10})
+			_ = json.NewEncoder(w).Encode(capability.TaskEvaluationExecutionResponse{ProfileID: profile.ID, BindingID: "binding-1", BindingRevision: 3, Responses: []capability.TaskCaseResponse{{CaseID: "case-1", ResponseText: "answer", LatencyMicros: 2, EvidenceArtifactRef: "artifact-1"}}, ObservedAtUnixMillis: 10})
+			return
+		}
+		if r.URL.Path == "/v1/task-evaluations/verify" {
+			_ = json.NewEncoder(w).Encode(capability.TaskCaseVerificationResponse{CaseID: "case-1", Result: capability.EvaluationSupported, QualityScoreMillis: 900, LatencyMicros: 2, EvidenceArtifactRef: "artifact-1", VerificationEvidenceRef: "verify-1", VerifierIdentity: "verifier-1"})
 			return
 		}
 		if r.URL.Path == "/v1/work-graphs/task-evaluations/callback" {
@@ -30,8 +35,37 @@ func TestTaskEvaluationExecutorInvokesAggregatesAndCallbacks(t *testing.T) {
 		http.NotFound(w, r)
 	}))
 	defer server.Close()
-	executor := newTaskEvaluationExecutor(server.URL, server.URL, server.Client())
-	result, err := executor.Execute(context.Background(), work.AgentExecutionRequest{Intent: work.AgentDispatchIntent{DispatchID: "dispatch-1", TaskEvaluationBindingID: "binding-1", TaskEvaluationProfile: &profile, TaskEvaluationCases: []capability.TaskEvaluationCase{{CaseID: "case-1", Prompt: "answer", EvidenceArtifactRef: "artifact-1"}}, TaskEvaluationExecution: &work.TaskEvaluationDispatchContext{GraphID: "graph-1", GraphRevision: 1, NodeID: "node-1", BindingRevision: 3, ActorID: "actor-1", PrincipalID: "principal-1", ScopeID: "scope-1"}}})
+	executor := newTaskEvaluationExecutor(server.URL, server.URL, server.URL, server.Client())
+	result, err := executor.Execute(context.Background(), work.AgentExecutionRequest{Intent: work.AgentDispatchIntent{DispatchID: "dispatch-1", TaskEvaluationBindingID: "binding-1", TaskEvaluationProfile: &profile, TaskEvaluationCases: []capability.TaskEvaluationCase{{CaseID: "case-1", Prompt: "answer", EvidenceArtifactRef: "artifact-1", Verification: verification}}, TaskEvaluationExecution: &work.TaskEvaluationDispatchContext{GraphID: "graph-1", GraphRevision: 1, NodeID: "node-1", BindingRevision: 3, ActorID: "actor-1", PrincipalID: "principal-1", ScopeID: "scope-1"}}})
+	if err != nil || result.State != work.AgentExecutionCompleted || result.OutcomeRef == "" {
+		t.Fatalf("result=%+v err=%v", result, err)
+	}
+}
+
+func TestTaskEvaluationExecutorPersistsUnknownAfterProviderFailure(t *testing.T) {
+	profile := capability.TaskEvaluationProfile{ID: "profile-unknown", Revision: 1, CapabilityID: "capability-1", Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "unknown-v1", RequiredCaseIDs: []string{"case-1"}, QualityWeightMillis: 600, ReliabilityWeightMillis: 300, LatencyWeightMillis: 100}
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/v1/task-evaluations/execute" {
+			_ = json.NewEncoder(w).Encode(capability.TaskEvaluationExecutionResponse{ProfileID: profile.ID, BindingID: "binding-1", BindingRevision: 3, Observations: []capability.TaskCaseObservation{{CaseID: "case-1", Result: capability.EvaluationUnknown, CriticalFailure: true, EvidenceArtifactRef: "artifact-1"}}, Responses: []capability.TaskCaseResponse{{CaseID: "case-1", EvidenceArtifactRef: "artifact-1"}}, ObservedAtUnixMillis: 10})
+			return
+		}
+		if r.URL.Path == "/v1/work-graphs/task-evaluations/callback" {
+			var callback work.TaskEvaluationEvidenceCallback
+			if err := json.NewDecoder(r.Body).Decode(&callback); err != nil || callback.Evaluation.Result != capability.EvaluationUnknown || !callback.Succeeded {
+				http.Error(w, "invalid unknown callback", http.StatusBadRequest)
+				return
+			}
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+		if r.URL.Path == "/v1/task-evaluations/verify" {
+			t.Errorf("verifier must not be called for a provider failure")
+		}
+		http.NotFound(w, r)
+	}))
+	defer server.Close()
+	executor := newTaskEvaluationExecutor(server.URL, server.URL, server.URL, server.Client())
+	result, err := executor.Execute(context.Background(), work.AgentExecutionRequest{Intent: work.AgentDispatchIntent{DispatchID: "dispatch-unknown", TaskEvaluationBindingID: "binding-1", TaskEvaluationProfile: &profile, TaskEvaluationCases: []capability.TaskEvaluationCase{{CaseID: "case-1", Prompt: "answer", EvidenceArtifactRef: "artifact-1"}}, TaskEvaluationExecution: &work.TaskEvaluationDispatchContext{GraphID: "graph-1", GraphRevision: 1, NodeID: "node-1", BindingRevision: 3, ActorID: "actor-1", PrincipalID: "principal-1", ScopeID: "scope-1"}}})
 	if err != nil || result.State != work.AgentExecutionCompleted || result.OutcomeRef == "" {
 		t.Fatalf("result=%+v err=%v", result, err)
 	}

cmd/cognitive-worker/discovery.go

@@ -3,6 +3,7 @@ package main
 import (
 	"encoding/json"
 	"net/http"
+	"sort"
 	"time"
 
 	"git.cin.su/m/Assistant/contracts/capability"
@@ -17,6 +18,10 @@ type discoveryService struct {
 }
 
 func (s discoveryService) handler(w http.ResponseWriter, r *http.Request) {
+	if r.Method == http.MethodGet && r.URL.Path == "/v1/provider-discovery/status" {
+		s.statusHandler(w, r)
+		return
+	}
 	registration, ok := s.providers[r.PathValue("provider")]
 	if !ok || registration.Discovery == nil {
 		http.Error(w, "provider discovery not found", http.StatusNotFound)
@@ -35,3 +40,42 @@ func (s discoveryService) handler(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
 	_ = json.NewEncoder(w).Encode(result)
 }
+
+type discoveryStatus struct {
+	Provider             string                          `json:"provider"`
+	ProviderKind         capability.ProviderKind         `json:"provider_kind"`
+	Health               capability.HealthState          `json:"health"`
+	FailureClass         capability.CognitiveFailureType `json:"failure_class,omitempty"`
+	ObservedAtUnixMillis int64                           `json:"observed_at_unix_millis"`
+	Models               []discoveredModelStatus         `json:"models"`
+}
+
+type discoveredModelStatus struct {
+	ProviderModelID capability.ProviderModelID   `json:"provider_model_id"`
+	Fingerprint     capability.ModelFingerprint  `json:"fingerprint,omitempty"`
+	Capabilities    []capability.ModelCapability `json:"capabilities,omitempty"`
+}
+
+func (s discoveryService) statusHandler(w http.ResponseWriter, r *http.Request) {
+	providers := make([]string, 0, len(s.providers))
+	for name := range s.providers {
+		providers = append(providers, name)
+	}
+	sort.Strings(providers)
+	result := make([]discoveryStatus, 0, len(providers))
+	for _, name := range providers {
+		registration := s.providers[name]
+		status := discoveryStatus{Provider: name, ProviderKind: registration.Kind, Health: capability.HealthUnknown, ObservedAtUnixMillis: s.now().UnixMilli(), Models: []discoveredModelStatus{}}
+		if registration.Discovery != nil {
+			models, probe := registration.Discovery.Discover(r.Context())
+			status.Health = probe.Health
+			status.FailureClass = capability.CognitiveFailureType(probe.Failure)
+			for _, model := range models {
+				status.Models = append(status.Models, discoveredModelStatus{ProviderModelID: model.ProviderModelID, Fingerprint: model.Fingerprint, Capabilities: model.Capabilities})
+			}
+		}
+		result = append(result, status)
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(result)
+}

cmd/cognitive-worker/discovery_test.go

@@ -0,0 +1,52 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"git.cin.su/m/Assistant/adapters/models"
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/cognitive"
+	"git.cin.su/m/Assistant/contracts/identity"
+)
+
+type discoveryTestProvider struct{}
+
+func (discoveryTestProvider) Probe(context.Context) models.ProviderProbe {
+	return models.ProviderProbe{Health: capability.HealthAvailable}
+}
+func (discoveryTestProvider) Discover(context.Context) ([]models.DiscoveredModel, models.ProviderProbe) {
+	return []models.DiscoveredModel{{ProviderModelID: "local-model", Fingerprint: "fingerprint-1", Capabilities: []capability.ModelCapability{capability.CapabilityAdvisory}}}, models.ProviderProbe{Health: capability.HealthAvailable}
+}
+func (discoveryTestProvider) Advise(context.Context, cognitive.AdvisoryRequest) (cognitive.AdvisoryResponse, error) {
+	return cognitive.AdvisoryResponse{}, nil
+}
+
+func TestDiscoveryStatusIsReadOnlyAndDoesNotExposeCredentialMetadata(t *testing.T) {
+	service := discoveryService{
+		providers: map[string]providerRegistration{"cpu": {ProviderInstanceID: "provider-1", Kind: "openai-compatible-chat-v1", CredentialRef: "credential://must-not-be-returned", Discovery: discoveryTestProvider{}}},
+		owner:     identity.PrincipalID("owner-1"),
+		now:       func() time.Time { return time.UnixMilli(1234) },
+	}
+	response := httptest.NewRecorder()
+	service.handler(response, httptest.NewRequest(http.MethodGet, "/v1/provider-discovery/status", nil))
+	if response.Code != http.StatusOK {
+		t.Fatalf("status=%d", response.Code)
+	}
+	body := response.Body.String()
+	var result []discoveryStatus
+	if err := json.NewDecoder(strings.NewReader(body)).Decode(&result); err != nil {
+		t.Fatal(err)
+	}
+	if len(result) != 1 || result[0].Provider != "cpu" || result[0].Health != capability.HealthAvailable || len(result[0].Models) != 1 || result[0].ObservedAtUnixMillis != 1234 {
+		t.Fatalf("unexpected discovery status: %+v", result)
+	}
+	if strings.Contains(body, "must-not-be-returned") || strings.Contains(body, "credential://") {
+		t.Fatalf("credential metadata leaked in discovery status: %s", body)
+	}
+}

cmd/cognitive-worker/fleet_status.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net/http"
 	"strings"
+	"sync"
 	"time"
 
 	"git.cin.su/m/Assistant/contracts/capability"
@@ -31,35 +32,16 @@ type fleetStatusResponse struct {
 func fleetReadinessHandler(client *http.Client, preferred capability.FleetTier, endpoints []fleetEndpoint) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		members := make([]capability.FleetMember, 0, len(endpoints))
-		for _, endpoint := range endpoints {
-			member := capability.FleetMember{ProviderInstanceID: capability.ProviderInstanceID(endpoint.ProviderID), ModelDescriptorID: capability.ModelDescriptorID(endpoint.ModelID), Tier: endpoint.Tier, Reason: "NOT_CONFIGURED"}
-			if strings.TrimSpace(endpoint.URL) == "" {
-				members = append(members, member)
-				continue
-			}
-			request, err := http.NewRequestWithContext(r.Context(), http.MethodGet, endpoint.URL, nil)
-			if err == nil {
-				for name, value := range endpoint.Headers {
-					request.Header.Set(name, value)
-				}
-				probeClient := endpoint.Client
-				if probeClient == nil {
-					probeClient = client
-				}
-				response, requestErr := probeClient.Do(request)
-				if requestErr == nil {
-					response.Body.Close()
-					if response.StatusCode >= 200 && response.StatusCode < 300 {
-						member.Ready, member.Reason = true, "AVAILABLE"
-					} else {
-						member.Reason = fmt.Sprintf("status=%s", response.Status)
-					}
-				} else {
-					member.Reason = requestErr.Error()
-				}
-			}
-			members = append(members, member)
+		members = make([]capability.FleetMember, len(endpoints))
+		var waitGroup sync.WaitGroup
+		for index, endpoint := range endpoints {
+			waitGroup.Add(1)
+			go func(index int, endpoint fleetEndpoint) {
+				defer waitGroup.Done()
+				members[index] = probeFleetEndpoint(r.Context(), client, endpoint)
+			}(index, endpoint)
 		}
+		waitGroup.Wait()
 		readiness, err := fleetdomain.BuildFleetReadiness(time.Now().UnixMilli(), members)
 		response := fleetStatusResponse{Readiness: readiness, Preferred: preferred}
 		if err == nil {
@@ -76,4 +58,37 @@ func fleetReadinessHandler(client *http.Client, preferred capability.FleetTier,
 	})
 }
 
+func probeFleetEndpoint(parent context.Context, fallbackClient *http.Client, endpoint fleetEndpoint) capability.FleetMember {
+	member := capability.FleetMember{ProviderInstanceID: capability.ProviderInstanceID(endpoint.ProviderID), ModelDescriptorID: capability.ModelDescriptorID(endpoint.ModelID), Tier: endpoint.Tier, Reason: "NOT_CONFIGURED"}
+	if strings.TrimSpace(endpoint.URL) == "" {
+		return member
+	}
+	ctx, cancel := context.WithTimeout(parent, 2*time.Second)
+	defer cancel()
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint.URL, nil)
+	if err != nil {
+		member.Reason = err.Error()
+		return member
+	}
+	for name, value := range endpoint.Headers {
+		request.Header.Set(name, value)
+	}
+	probeClient := endpoint.Client
+	if probeClient == nil {
+		probeClient = fallbackClient
+	}
+	response, requestErr := probeClient.Do(request)
+	if requestErr != nil {
+		member.Reason = requestErr.Error()
+		return member
+	}
+	defer response.Body.Close()
+	if response.StatusCode >= 200 && response.StatusCode < 300 {
+		member.Ready, member.Reason = true, "AVAILABLE"
+	} else {
+		member.Reason = fmt.Sprintf("status=%s", response.Status)
+	}
+	return member
+}
+
 func fleetContext(ctx context.Context) context.Context { return ctx }

cmd/cognitive-worker/fleet_status_test.go

@@ -5,6 +5,7 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 
 	"git.cin.su/m/Assistant/contracts/capability"
 )
@@ -26,6 +27,29 @@ func TestFleetReadinessSelectsBestAvailablePrimaryTierBeforeLifeboat(t *testing.
 	}
 }
 
+func TestFleetReadinessDoesNotWaitForSlowMembersSerially(t *testing.T) {
+	slow := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		time.Sleep(150 * time.Millisecond)
+		w.WriteHeader(http.StatusServiceUnavailable)
+	}))
+	defer slow.Close()
+	fast := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusOK) }))
+	defer fast.Close()
+	handler := fleetReadinessHandler(fast.Client(), capability.FleetTierFast, []fleetEndpoint{
+		{ProviderID: "slow", ModelID: "slow-model", Tier: capability.FleetTierMedium, URL: slow.URL},
+		{ProviderID: "lifeboat", ModelID: "lifeboat-model", Tier: capability.FleetTierLifeboat, URL: fast.URL},
+	})
+	started := time.Now()
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/v1/fleet/readiness", nil))
+	if recorder.Code != http.StatusOK || !strings.Contains(recorder.Body.String(), `"selected_tier":"LIFEBOAT"`) {
+		t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String())
+	}
+	if elapsed := time.Since(started); elapsed >= 300*time.Millisecond {
+		t.Fatalf("fleet readiness was serialized: elapsed=%s", elapsed)
+	}
+}
+
 func TestFleetReadinessSendsConfiguredProviderHeaders(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Header.Get("Authorization") != "Bearer fleet-key" {

cmd/cognitive-worker/gateway.go

@@ -186,27 +186,61 @@ func selectionObjectiveForMeaning(meaning cognitive.TaskMeaning, message string)
 }
 
 func builtinAdvisory(request cognitive.GatewayAdvisoryRequest) cognitive.GatewayAdvisoryResponse {
-	text := "Я рядом и продолжаю работу во встроенном режиме Домового. Внешний когнитивный маршрут сейчас недоступен, поэтому опираюсь на уже установленный смысл сообщения и локальные возможности."
+	if request.Meaning.SpeechAct == "RESPONSE_REVIEW" {
+		const marker = "Черновик ответа:"
+		if index := strings.LastIndex(request.Message, marker); index >= 0 {
+			if draft := strings.TrimSpace(request.Message[index+len(marker):]); draft != "" {
+				return cognitive.GatewayAdvisoryResponse{Version: request.Version, RequestID: request.RequestID, AdvisoryText: draft, FinishReason: cognitive.FinishCompleted}
+			}
+		}
+	}
+	text := "Понял."
+	identityText := request.Meaning.RequestedOutcome
+	if identityText == "" {
+		identityText = request.Message
+	}
+	if request.Meaning.SpeechAct == "QUESTION" && isIdentityInquiry(identityText) {
+		text = "Я — Домовой, ваш помощник."
+	}
 	switch request.Meaning.InformationRequestKind {
 	case interaction.InformationRequestCognitiveModelInventory:
-		text = "Запрос понят как проверка моделей. Встроенный режим Домового доступен; я могу показать подключённые модели по назначению, качеству, скорости и стоимости. Ключи и пароли в разговор не нужны."
+		text = "Сейчас не смог проверить подключённые модели."
 	case interaction.InformationRequestCapabilityInventory:
-		text = "Запрос понят как проверка возможностей. Я могу объяснить доступные capabilities и отличить то, что уже подключено, от того, что пока является только планом или capability gap."
+		text = "Сейчас не смог проверить доступные возможности."
 	case interaction.InformationRequestCognitiveChannelStatus:
-		text = "Запрос понят как проверка когнитивного канала. Локальный режим остаётся доступен; я объясню наблюдаемое состояние и что можно сделать без ожидания внешней модели."
+		text = "Локальный канал Домового доступен; подробности состояния дам по запросу."
 	case interaction.InformationRequestCognitiveRecovery:
-		text = "Запрос понят как восстановление ИИ. Начинаю с локального маршрута: фиксирую, что недоступно, проверяю безопасные варианты восстановления и сформулирую следующий обратимый шаг."
+		text = "Встроенный канал сейчас недоступен."
 	default:
 		switch request.Meaning.SpeechAct {
 		case "REQUEST_TO_INVESTIGATE":
-			text = "Я принял это как исследование. Даже без внешней модели могу сформулировать гипотезы, отделить известное от неизвестного и предложить следующий проверяемый шаг."
+			text = "Понял задачу, но пока не смог получить проверяемый результат."
 		case "QUESTION":
-			text = "Я отвечаю во встроенном режиме Домового. Если для полного ответа не хватает внешней модели, объясню это прямо и продолжу с тем, что можно проверить локально."
+			if !isIdentityInquiry(identityText) {
+				text = "Пока не смог получить проверяемый ответ."
+			}
+		case "CONVERSATIONAL":
+			text = "Я — Домовой, ваш помощник."
 		}
 	}
 	return cognitive.GatewayAdvisoryResponse{Version: request.Version, RequestID: request.RequestID, AdvisoryText: text, FinishReason: cognitive.FinishCompleted}
 }
 
+func isIdentityInquiry(message string) bool {
+	tokens := strings.Fields(strings.ToLower(strings.NewReplacer("?", " ", "!", " ", ",", " ").Replace(message)))
+	hasIdentitySubject := false
+	hasAssistantReference := false
+	for _, token := range tokens {
+		switch token {
+		case "кто", "зовут", "имя":
+			hasIdentitySubject = true
+		case "ты", "тебя", "тебе", "вы", "вас":
+			hasAssistantReference = true
+		}
+	}
+	return hasIdentitySubject && hasAssistantReference
+}
+
 func (g cognitiveGateway) invokeBuiltinAdvisory(ctx context.Context, request cognitive.GatewayAdvisoryRequest, maxOutputBytes int) cognitive.GatewayAdvisoryResponse {
 	if g.builtinLocal != nil && g.builtinLocal.Provider != nil {
 		invocation := cognitive.AdvisoryRequest{Version: request.Version, RequestID: request.RequestID, ActorID: request.ActorID, PrincipalID: request.PrincipalID, ScopeID: request.ScopeID, Message: request.Message, Context: request.Context, Locale: request.Locale, MaxOutputBytes: maxOutputBytes, ProviderBindingID: "builtin-local-binding-v1", ProviderBindingRevision: 1, ProviderInstanceID: "builtin-local-lifeboat-v1", ModelDescriptorID: "builtin-local-model-v1", ProviderModelID: "domovoy-lifeboat"}
@@ -298,12 +332,21 @@ func fallbackEligible(reason cognitive.FinishReason) bool {
 }
 
 func (g cognitiveGateway) provider(selected capability.ResolvedCognitiveBinding) advisoryProvider {
+	var byStableID advisoryProvider
 	for _, registration := range g.providers[selected.Provider.Kind] {
 		if registration.EndpointRef == selected.Provider.EndpointRef && registration.CredentialRef == selected.Provider.CredentialRef {
 			return registration.Provider
 		}
+		// Capability revisions can legitimately retain an older credential
+		// reference while the protected runtime has rotated or reloaded the
+		// current credential. ProviderInstanceID is the stable owner identity;
+		// use it after exact metadata matching so stale non-secret metadata does
+		// not force an unnecessary builtin fallback.
+		if byStableID == nil && registration.ProviderInstanceID == selected.Provider.ID && registration.Kind == selected.Provider.Kind {
+			byStableID = registration.Provider
+		}
 	}
-	return nil
+	return byStableID
 }
 
 func writeGatewayResponse(w http.ResponseWriter, response cognitive.GatewayAdvisoryResponse) {

cmd/cognitive-worker/gateway_registry_test.go

@@ -88,6 +88,19 @@ func TestActiveRegistryBindingReachesProviderAdapter(t *testing.T) {
 	}
 }
 
+func TestProviderUsesStableInstanceWhenCredentialMetadataIsStale(t *testing.T) {
+	provider := &stubAdvisoryProvider{}
+	gateway := cognitiveGateway{providers: map[capability.ProviderKind][]providerRegistration{
+		"provider-kind-1": {{ProviderInstanceID: "provider-1", Kind: "provider-kind-1", EndpointRef: "current-endpoint", CredentialRef: "current-credential", Provider: provider}},
+	}}
+	selected := gatewaySelection()
+	selected.Provider.EndpointRef = "old-endpoint"
+	selected.Provider.CredentialRef = ""
+	if got := gateway.provider(selected); got != provider {
+		t.Fatalf("stable provider identity was not used for stale metadata")
+	}
+}
+
 func TestCanaryFlagIsForwardedToCapabilityResolver(t *testing.T) {
 	registry := &registryStub{err: errors.New("stop after resolve")}
 	gateway := cognitiveGateway{resolver: registry, providers: map[capability.ProviderKind][]providerRegistration{}, now: time.Now, allowCanary: true}
@@ -172,11 +185,34 @@ func TestNoActiveBindingUsesBuiltInProviderWithoutInvocation(t *testing.T) {
 func TestBuiltInAdvisoryUsesTrustedInformationIntentInsteadOfMessageKeywords(t *testing.T) {
 	request := cognitive.GatewayAdvisoryRequest{Version: cognitive.CreatorAdvisoryV1, RequestID: "request-1", Message: "arbitrary text", Meaning: cognitive.TaskMeaning{InformationRequestKind: interaction.InformationRequestCognitiveRecovery}}
 	response := builtinAdvisory(request)
-	if !strings.Contains(response.AdvisoryText, "восстановление ИИ") {
+	if response.AdvisoryText != "Встроенный канал сейчас недоступен." {
 		t.Fatalf("unexpected recovery response: %q", response.AdvisoryText)
 	}
 }
 
+func TestBuiltInAdvisoryIdentityIsNaturalAndDoesNotMentionResponseLength(t *testing.T) {
+	response := builtinAdvisory(cognitive.GatewayAdvisoryRequest{
+		Version:   cognitive.CreatorAdvisoryV1,
+		RequestID: "request-identity",
+		Meaning:   cognitive.TaskMeaning{SpeechAct: "QUESTION", RequestedOutcome: "ты кто?"},
+	})
+	if response.AdvisoryText != "Я — Домовой, ваш помощник." {
+		t.Fatalf("unexpected identity response: %q", response.AdvisoryText)
+	}
+	if strings.Contains(response.AdvisoryText, "коротко") || strings.Contains(response.AdvisoryText, "подробност") {
+		t.Fatalf("identity response contains style meta-text: %q", response.AdvisoryText)
+	}
+	messageResponse := builtinAdvisory(cognitive.GatewayAdvisoryRequest{
+		Version:   cognitive.CreatorAdvisoryV1,
+		RequestID: "request-identity-message",
+		Message:   "как тебя зовут?",
+		Meaning:   cognitive.TaskMeaning{SpeechAct: "QUESTION"},
+	})
+	if messageResponse.AdvisoryText != "Я — Домовой, ваш помощник." {
+		t.Fatalf("unexpected message identity response: %q", messageResponse.AdvisoryText)
+	}
+}
+
 func TestNoActiveBindingInvokesBuiltInLocalProvider(t *testing.T) {
 	registry := &registryStub{err: errors.New("no active binding")}
 	provider := &stubAdvisoryProvider{response: cognitive.AdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: "request-1", AdvisoryText: "локальный ответ", FinishReason: cognitive.FinishCompleted}}

cmd/cognitive-worker/interpretation.go

@@ -67,12 +67,18 @@ func (g cognitiveGateway) interpretationHandler(w http.ResponseWriter, r *http.R
 	}
 	g.observe(r.Context(), selected, response, started)
 	if response.FinishReason != cognitive.FinishCompleted {
-		writeInterpretationResponse(w, cognitive.GatewayInterpretationResponse{Version: request.Version, RequestID: request.RequestID, FinishReason: response.FinishReason, Usage: response.Usage})
+		// A selected provider can become unavailable after discovery. Semantic
+		// routing must still retain the deterministic interpretation and use the
+		// local lifeboat rather than turn an ordinary conversation into a
+		// degraded reply solely because one provider failed.
+		writeInterpretationResponse(w, g.interpretWithBuiltin(r.Context(), request, maxOutputBytes))
 		return
 	}
 	candidate, ok := parseInterpretationCandidate(response.AdvisoryText)
 	if !ok {
-		writeInterpretationResponse(w, cognitive.GatewayInterpretationResponse{Version: request.Version, RequestID: request.RequestID, FinishReason: cognitive.FinishInvalidStructuredOutput, Usage: response.Usage})
+		// Structured interpretation is a transport contract. A malformed model
+		// answer is not a reason to discard the available local fallback.
+		writeInterpretationResponse(w, g.interpretWithBuiltin(r.Context(), request, maxOutputBytes))
 		return
 	}
 	writeInterpretationResponse(w, cognitive.GatewayInterpretationResponse{Version: request.Version, RequestID: request.RequestID, Candidate: candidate, FinishReason: cognitive.FinishCompleted, Usage: response.Usage})
@@ -163,8 +169,8 @@ func interpretationPrompt(request cognitive.GatewayInterpretationRequest) string
 Allowed speech acts: DIRECTIVE, ASSERTION, DECISION, PREFERENCE, QUESTION, HYPOTHESIS, CORRECTION, REQUEST_TO_INVESTIGATE, CONFIRMATION, REJECTION, CANCELLATION, CONVERSATIONAL, UNKNOWN.
 Allowed applicability: APPLICABLE, LOW_CONFIDENCE, MIXED_INTENT, NEEDS_BROADER_INTERPRETATION, CLARIFICATION_REQUIRED.
 Allowed clarification: NOT_REQUIRED or REQUIRED.
-Capability hints may only contain known capability kinds like COGNITIVE_REASONING, MODIFY_CODE, RUN_TESTS, SEND_EMAIL, SCHEDULE_REMINDER, VERIFY_FACT, INSPECT_PROJECT, READ_DATABASE, QUERY_LOGS.
-Interpret the human utterance semantically. Do not claim action execution. Do not treat punctuation alone as decisive. If uncertain, set applicability accordingly.
+Capability hints may only contain known capability kinds like COGNITIVE_REASONING, WEB_RESEARCH, MODIFY_CODE, RUN_TESTS, SEND_EMAIL, SCHEDULE_REMINDER, VERIFY_FACT, INSPECT_PROJECT, READ_DATABASE, QUERY_LOGS.
+Interpret the human utterance semantically. Do not claim action execution. A question asking for a current, external or otherwise source-dependent fact should receive WEB_RESEARCH; do not answer that fact from model memory. A request to discuss hypotheses or options is different and may receive COGNITIVE_REASONING. Do not treat punctuation alone as decisive. If uncertain, set applicability accordingly.
 Message: %q
 Deterministic primary: %s
 Deterministic secondary: %s

cmd/cognitive-worker/interpretation_test.go

@@ -1,9 +1,15 @@
 package main
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
 	"testing"
+	"time"
 
+	"git.cin.su/m/Assistant/contracts/capability"
 	"git.cin.su/m/Assistant/contracts/cognitive"
 )
 
@@ -24,3 +30,32 @@ func TestBuiltinInterpretationTimeoutRetainsDeterministicCandidate(t *testing.T)
 		t.Fatalf("candidate did not retain deterministic meaning: %+v", response.Candidate)
 	}
 }
+
+func TestInterpretationProviderFailureUsesLocalLifeboat(t *testing.T) {
+	selected := gatewaySelection()
+	selected.Binding.DataPolicy = capability.DataPolicyLocalOnly
+	primary := &stubAdvisoryProvider{response: cognitive.AdvisoryResponse{FinishReason: cognitive.FinishProviderUnavailable}}
+	lifeboat := &stubAdvisoryProvider{response: cognitive.AdvisoryResponse{AdvisoryText: `{"primary_speech_act":"QUESTION","secondary_speech_act":"","confidence_millis":900,"applicability":"APPLICABLE","requested_outcome":"","needs_cognition":true,"clarification":"NOT_REQUIRED","selection_reason":"local lifeboat","capability_hints":["COGNITIVE_REASONING"]}`, FinishReason: cognitive.FinishCompleted}}
+	gateway := cognitiveGateway{
+		resolver: &registryStub{selected: selected},
+		providers: map[capability.ProviderKind][]providerRegistration{
+			selected.Provider.Kind: {{ProviderInstanceID: selected.Provider.ID, Kind: selected.Provider.Kind, Provider: primary}},
+		},
+		builtinLocal: &providerRegistration{Provider: lifeboat},
+		now:          time.Now,
+	}
+	request := cognitive.GatewayInterpretationRequest{Version: cognitive.CreatorAdvisoryV1, RequestID: "request-1", ActorID: "actor-1", PrincipalID: "principal-1", ScopeID: "scope-1", Message: "сколько фигур в шахматах?", Locale: "ru", MaxOutputBytes: 4096, DataPolicy: capability.DataPolicyLocalOnly, DeterministicSpeechAct: "QUESTION", DeterministicConfidence: 800, DeterministicApplicability: cognitive.InterpretationApplicable}
+	payload, _ := json.Marshal(request)
+	recorder := httptest.NewRecorder()
+	gateway.interpretationHandler(recorder, httptest.NewRequest(http.MethodPost, "/v1/interpretations", bytes.NewReader(payload)))
+	if recorder.Code != http.StatusOK || !primary.called || !lifeboat.called {
+		t.Fatalf("status=%d primary=%t lifeboat=%t body=%s", recorder.Code, primary.called, lifeboat.called, recorder.Body.String())
+	}
+	var response cognitive.GatewayInterpretationResponse
+	if err := json.Unmarshal(recorder.Body.Bytes(), &response); err != nil {
+		t.Fatal(err)
+	}
+	if response.FinishReason != cognitive.FinishCompleted || response.Candidate.SelectionReason != "local lifeboat" {
+		t.Fatalf("response=%+v", response)
+	}
+}

cmd/cognitive-worker/main.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"git.cin.su/m/Assistant/adapters/models"
+	"git.cin.su/m/Assistant/adapters/multimodal"
 	"git.cin.su/m/Assistant/contracts/capability"
 	"git.cin.su/m/Assistant/contracts/cognitive"
 	"git.cin.su/m/Assistant/contracts/identity"
@@ -97,7 +98,8 @@ func main() {
 	if gpuErr != nil {
 		log.Printf("optional GPU provider disabled: %v", gpuErr)
 	} else if gpuConfigured {
-		gpuAdapter, adapterErr := models.NewOpenAICompatibleLocalAdapterWithAPIKey(gpuURL, gpuKey, nil)
+		gpuTimeout := durationEnv("LOCAL_GPU_PROVIDER_TIMEOUT", 60*time.Second)
+		gpuAdapter, adapterErr := models.NewOpenAICompatibleLocalAdapterWithAPIKeyAndTimeout(gpuURL, gpuKey, nil, gpuTimeout)
 		if adapterErr != nil {
 			log.Printf("optional GPU provider disabled: %v", adapterErr)
 		} else {
@@ -125,7 +127,9 @@ func main() {
 	}
 	cpuEndpoint := strings.TrimRight(envOr("LOCAL_CPU_PROVIDER_URL", "http://docker.cin.su:18082/v1"), "/") + "/models"
 	cpuHealthProbe := health.OptionalHTTPProbeWithHeaders(cpuReadinessClient, cpuEndpoint, cpuFleetHeaders)
-	cpuHealthProbe.Timeout = 10 * time.Second
+	// Opportunistic providers must not hide a ready local lifeboat. Keep their
+	// readiness budget short; their detailed fleet state is reported separately.
+	cpuHealthProbe.Timeout = 2 * time.Second
 	mediumEndpoint := ""
 	mediumHeaders := map[string]string{}
 	mediumHealthProbe := health.Probe{}
@@ -135,7 +139,7 @@ func main() {
 			mediumHeaders["Authorization"] = "Bearer " + mediumAPIKey
 		}
 		mediumHealthProbe = health.OptionalHTTPProbeWithHeaders(mediumReadinessClient, mediumEndpoint, mediumHeaders)
-		mediumHealthProbe.Timeout = 10 * time.Second
+		mediumHealthProbe.Timeout = 2 * time.Second
 	}
 	readinessProbes := []health.Probe{
 		health.HTTPProbe(readinessClient, strings.TrimRight(envOr("CORE_RUNTIME_URL", "http://core-runtime:8080"), "/")+"/healthz"),
@@ -148,7 +152,7 @@ func main() {
 	if gpuConfigured {
 		gpuHeaders := map[string]string{"Authorization": "Bearer " + gpuKey}
 		gpuProbe := health.OptionalHTTPProbeWithHeaders(readinessClient, strings.TrimRight(gpuURL, "/")+"/models", gpuHeaders)
-		gpuProbe.Timeout = 10 * time.Second
+		gpuProbe.Timeout = 2 * time.Second
 		readinessProbes = append(readinessProbes, gpuProbe)
 	}
 
@@ -167,8 +171,30 @@ func main() {
 	mux.HandleFunc("POST /v1/advisories", gateway.advisoryHandler)
 	mux.HandleFunc("POST /v1/interpretations", gateway.interpretationHandler)
 	mux.HandleFunc("POST /v1/task-evaluations/execute", gateway.taskEvaluationHandler)
+	imageGenerator := multimodal.ImageGenerator(multimodal.ImageGenerationClient{BaseURL: os.Getenv("LOCAL_IMAGE_PROVIDER_URL"), Client: &http.Client{Timeout: 300 * time.Second}})
+	if strings.EqualFold(strings.TrimSpace(os.Getenv("LOCAL_IMAGE_PROVIDER_KIND")), "comfyui") {
+		imageGenerator = multimodal.ComfyImageGenerationClient{BaseURL: os.Getenv("LOCAL_IMAGE_PROVIDER_URL"), Client: &http.Client{Timeout: 300 * time.Second}, PollTimeout: 15 * time.Minute}
+	}
+	multimodalGateway := multimodalGateway{
+		speech:           multimodal.SpeechClient{BaseURL: envOr("LOCAL_SPEECH_PROVIDER_URL", "http://llm-local-speech:8080"), Client: &http.Client{Timeout: 120 * time.Second}},
+		vision:           multimodal.VisionClient{BaseURL: envOr("LOCAL_VISION_PROVIDER_URL", "http://llm-local-vision:8080/v1"), Client: &http.Client{Timeout: 180 * time.Second}},
+		imageGenerator:   imageGenerator,
+		imageProviderURL: os.Getenv("LOCAL_IMAGE_PROVIDER_URL"),
+		video:            multimodal.VideoUnderstandingClient{BaseURL: os.Getenv("LOCAL_VIDEO_PROVIDER_URL"), Client: &http.Client{Timeout: 300 * time.Second}},
+		model:            envOr("LOCAL_VISION_MODEL", "/models/gemma-4-26B-A4B-it-UD-Q4_K_M.gguf"),
+		imageModel:       os.Getenv("LOCAL_IMAGE_MODEL"),
+		videoModel:       os.Getenv("LOCAL_VIDEO_MODEL"),
+		now:              time.Now,
+	}
+	mux.HandleFunc("POST /v1/multimodal/transcribe", multimodalGateway.handler(capability.MultimodalTranscribe))
+	mux.HandleFunc("POST /v1/multimodal/understand", multimodalGateway.handler(capability.MultimodalUnderstand))
+	mux.HandleFunc("POST /v1/multimodal/ocr", multimodalGateway.handler(capability.MultimodalRecognizeOCR))
+	mux.HandleFunc("POST /v1/multimodal/video-understand", multimodalGateway.handler(capability.MultimodalUnderstandVideo))
+	mux.HandleFunc("POST /v1/multimodal/generate-image", multimodalGateway.handler(capability.MultimodalGenerateImage))
 	discovery := discoveryService{resolver: resolver, providers: discoveries, owner: identity.PrincipalID(envOr("COGNITIVE_OWNER_PRINCIPAL_ID", "domovoy-creator-principal")), now: time.Now}
 	mux.HandleFunc("POST /v1/provider-discovery/{provider}", discovery.handler)
+	mux.Handle("POST /v1/provider-discovery/{provider}/qualify", modelQualificationHandler(discoveries, string(envOr("COGNITIVE_OWNER_PRINCIPAL_ID", "domovoy-creator-principal")), httpQualificationObserver{resolver: resolver}))
+	mux.HandleFunc("GET /v1/provider-discovery/status", discovery.statusHandler)
 	refreshProviderDiscoveries(resolver, discovery)
 	log.Printf("cognitive-worker listening on %s", addr)
 	if err := http.ListenAndServe(addr, mux); err != nil {

cmd/cognitive-worker/main_test.go

@@ -4,6 +4,7 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 )
 
 func TestLifeboatProviderIsOptionalAndLocalAdapterBacked(t *testing.T) {
@@ -19,6 +20,21 @@ func TestLifeboatProviderIsOptionalAndLocalAdapterBacked(t *testing.T) {
 	}
 }
 
+func TestGPUProviderTimeoutUsesBoundedConfigurableDefault(t *testing.T) {
+	t.Setenv("LOCAL_GPU_PROVIDER_TIMEOUT", "")
+	if got := durationEnv("LOCAL_GPU_PROVIDER_TIMEOUT", 60*time.Second); got != 60*time.Second {
+		t.Fatalf("default GPU timeout=%s", got)
+	}
+	t.Setenv("LOCAL_GPU_PROVIDER_TIMEOUT", "31s")
+	if got := durationEnv("LOCAL_GPU_PROVIDER_TIMEOUT", 60*time.Second); got != 31*time.Second {
+		t.Fatalf("configured GPU timeout=%s", got)
+	}
+	t.Setenv("LOCAL_GPU_PROVIDER_TIMEOUT", "invalid")
+	if got := durationEnv("LOCAL_GPU_PROVIDER_TIMEOUT", 60*time.Second); got != 60*time.Second {
+		t.Fatalf("invalid GPU timeout=%s", got)
+	}
+}
+
 func TestLoadLocalCPUProviderAPIKeyUsesProtectedFileReference(t *testing.T) {
 	t.Setenv("LOCAL_CPU_PROVIDER_API_KEY", "")
 	_ = os.Unsetenv("LOCAL_CPU_PROVIDER_API_KEY")

cmd/cognitive-worker/model_qualification.go

@@ -0,0 +1,167 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"slices"
+	"sync"
+	"time"
+
+	"git.cin.su/m/Assistant/adapters/models"
+	"git.cin.su/m/Assistant/contracts/authority"
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/cognitive"
+	"git.cin.su/m/Assistant/contracts/identity"
+	"git.cin.su/m/Assistant/platform/ids"
+)
+
+type qualificationObserver interface {
+	ObserveQualification(context.Context, capability.ModelQualificationObservation) error
+}
+
+type httpQualificationObserver struct{ resolver *httpBindingResolver }
+
+func (o httpQualificationObserver) ObserveQualification(ctx context.Context, value capability.ModelQualificationObservation) error {
+	if o.resolver == nil {
+		return fmt.Errorf("qualification observer resolver is nil")
+	}
+	return o.resolver.post(ctx, "/v1/cognitive-registry/model-qualification-observations", value, nil)
+}
+
+type modelQualificationRequest struct {
+	Prompt         string                       `json:"prompt"`
+	MaxOutputBytes int                          `json:"max_output_bytes"`
+	ModelIDs       []capability.ProviderModelID `json:"model_ids,omitempty"`
+}
+
+type modelQualificationResult struct {
+	ProviderModelID capability.ProviderModelID     `json:"provider_model_id"`
+	Status          string                         `json:"status"`
+	FinishReason    cognitive.FinishReason         `json:"finish_reason,omitempty"`
+	LatencyMillis   int64                          `json:"latency_millis"`
+	OutputObserved  bool                           `json:"output_observed"`
+	QualityAssessed bool                           `json:"quality_assessed"`
+	Category        capability.ModelRatingCategory `json:"category"`
+	Error           string                         `json:"error,omitempty"`
+}
+
+type modelQualificationResponse struct {
+	Provider             capability.ProviderInstanceID `json:"provider"`
+	ObservedAtUnixMillis int64                         `json:"observed_at_unix_millis"`
+	Results              []modelQualificationResult    `json:"results"`
+}
+
+func modelQualificationHandler(providers map[string]providerRegistration, owner string, observers ...qualificationObserver) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		name := r.PathValue("provider")
+		registration, ok := providers[name]
+		if !ok || registration.Discovery == nil || registration.Provider == nil {
+			http.Error(w, "provider qualification not found", http.StatusNotFound)
+			return
+		}
+		var request modelQualificationRequest
+		if !decodeJSON(w, r, 16<<10, &request) || request.Prompt == "" {
+			return
+		}
+		if request.MaxOutputBytes < 1 {
+			request.MaxOutputBytes = 512
+		}
+		if request.MaxOutputBytes > 4096 {
+			http.Error(w, "max_output_bytes exceeds qualification bound", http.StatusBadRequest)
+			return
+		}
+		modelsFound, probe := registration.Discovery.Discover(r.Context())
+		if probe.Health != capability.HealthAvailable || len(modelsFound) == 0 {
+			http.Error(w, "provider unavailable for qualification", http.StatusServiceUnavailable)
+			return
+		}
+		if len(request.ModelIDs) > 0 {
+			modelsFound = slices.DeleteFunc(modelsFound, func(model models.DiscoveredModel) bool {
+				return !slices.Contains(request.ModelIDs, model.ProviderModelID)
+			})
+		}
+		if len(modelsFound) == 0 {
+			http.Error(w, "requested model not discovered", http.StatusNotFound)
+			return
+		}
+		if len(modelsFound) > 16 {
+			modelsFound = modelsFound[:16]
+		}
+		results := qualifyModels(r.Context(), registration, owner, request.Prompt, request.MaxOutputBytes, modelsFound)
+		if len(observers) > 0 && observers[0] != nil {
+			if err := persistQualificationResults(r.Context(), observers[0], registration, results); err != nil {
+				http.Error(w, "persist model qualification observation", http.StatusBadGateway)
+				return
+			}
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = jsonEncode(w, modelQualificationResponse{Provider: registration.ProviderInstanceID, ObservedAtUnixMillis: time.Now().UnixMilli(), Results: results})
+	})
+}
+
+func qualifyModels(ctx context.Context, registration providerRegistration, owner, prompt string, maxOutputBytes int, discovered []models.DiscoveredModel) []modelQualificationResult {
+	results := make([]modelQualificationResult, len(discovered))
+	var wg sync.WaitGroup
+	for index, model := range discovered {
+		wg.Add(1)
+		go func(index int, model models.DiscoveredModel) {
+			defer wg.Done()
+			started := time.Now()
+			request := cognitive.AdvisoryRequest{Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(fmt.Sprintf("qualification:%s:%d", model.ProviderModelID, started.UnixNano())), ActorID: identity.ActorID("qualification-runtime"), PrincipalID: identity.PrincipalID(owner), ScopeID: authority.ScopeID("qualification-scope"), Message: prompt, Locale: "en-US", MaxOutputBytes: maxOutputBytes, ProviderBindingID: "qualification-binding-v1", ProviderBindingRevision: 1, ProviderInstanceID: registration.ProviderInstanceID, ModelDescriptorID: capability.ModelDescriptorID("qualification-" + string(model.ProviderModelID)), ProviderModelID: model.ProviderModelID}
+			response, err := registration.Provider.Advise(ctx, request)
+			result := modelQualificationResult{ProviderModelID: model.ProviderModelID, LatencyMillis: time.Since(started).Milliseconds(), QualityAssessed: false, Category: capability.ModelRatingUnrated}
+			if err != nil {
+				result.Status = "UNAVAILABLE"
+				result.FinishReason = cognitive.FinishProviderUnavailable
+				result.Error = err.Error()
+				results[index] = result
+				return
+			}
+			result.FinishReason = response.FinishReason
+			result.OutputObserved = response.AdvisoryText != ""
+			if response.FinishReason == cognitive.FinishCompleted && result.OutputObserved {
+				result.Status = "REACHABLE"
+			} else {
+				result.Status = "RESPONDED_WITHOUT_QUALIFICATION"
+			}
+			results[index] = result
+		}(index, model)
+	}
+	wg.Wait()
+	return results
+}
+
+func persistQualificationResults(ctx context.Context, observer qualificationObserver, registration providerRegistration, results []modelQualificationResult) error {
+	for _, result := range results {
+		observationID, err := ids.New()
+		if err != nil {
+			return err
+		}
+		status := capability.ModelQualificationRespondedWithoutRating
+		switch result.Status {
+		case "REACHABLE":
+			status = capability.ModelQualificationReachable
+		case "UNAVAILABLE":
+			status = capability.ModelQualificationUnavailable
+		}
+		observation := capability.ModelQualificationObservation{
+			ID: capability.ModelQualificationObservationID(observationID), ProviderInstanceID: registration.ProviderInstanceID, ProviderModelID: result.ProviderModelID,
+			Status: status, FinishReason: string(result.FinishReason), LatencyMillis: result.LatencyMillis,
+			OutputObserved: result.OutputObserved, QualityAssessed: false, Category: capability.ModelRatingUnrated,
+			ObservedAtUnixMillis: time.Now().UnixMilli(),
+		}
+		if err := observation.Validate(); err != nil {
+			return err
+		}
+		if err := observer.ObserveQualification(ctx, observation); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func jsonEncode(w http.ResponseWriter, value any) error {
+	return json.NewEncoder(w).Encode(value)
+}

cmd/cognitive-worker/model_qualification_test.go

@@ -0,0 +1,85 @@
+package main
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"git.cin.su/m/Assistant/adapters/models"
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/cognitive"
+)
+
+type qualificationProvider struct{}
+
+func (qualificationProvider) Probe(context.Context) models.ProviderProbe {
+	return models.ProviderProbe{Health: capability.HealthAvailable}
+}
+func (qualificationProvider) Discover(context.Context) ([]models.DiscoveredModel, models.ProviderProbe) {
+	return []models.DiscoveredModel{{ProviderModelID: "model-a"}, {ProviderModelID: "model-b"}}, models.ProviderProbe{Health: capability.HealthAvailable}
+}
+func (qualificationProvider) Advise(_ context.Context, request cognitive.AdvisoryRequest) (cognitive.AdvisoryResponse, error) {
+	if err := models.ValidateAdvisoryRequest(request); err != nil {
+		return cognitive.AdvisoryResponse{}, err
+	}
+	return cognitive.AdvisoryResponse{Version: request.Version, RequestID: request.RequestID, AdvisoryText: "reachable", FinishReason: cognitive.FinishCompleted}, nil
+}
+
+func TestModelQualificationUsesDiscoveredModelsAndLeavesQualityUnrated(t *testing.T) {
+	provider := qualificationProvider{}
+	mux := http.NewServeMux()
+	mux.Handle("POST /v1/provider-discovery/{provider}/qualify", modelQualificationHandler(map[string]providerRegistration{"gpu": {ProviderInstanceID: "gpu", Provider: provider, Discovery: provider}}, "owner"))
+	server := httptest.NewServer(mux)
+	defer server.Close()
+	request := httptest.NewRequest(http.MethodPost, server.URL+"/v1/provider-discovery/gpu/qualify", strings.NewReader(`{"prompt":"ready","max_output_bytes":128}`))
+	request.Header.Set("Content-Type", "application/json")
+	response := httptest.NewRecorder()
+	mux.ServeHTTP(response, request)
+	if response.Code != http.StatusOK {
+		t.Fatalf("qualification status=%d body=%s", response.Code, response.Body.String())
+	}
+	if !strings.Contains(response.Body.String(), `"status":"REACHABLE"`) || !strings.Contains(response.Body.String(), `"category":"UNRATED"`) || strings.Contains(response.Body.String(), `"quality_assessed":true`) {
+		t.Fatalf("qualification overclaimed quality: %s", response.Body.String())
+	}
+}
+
+func TestModelQualificationRejectsUnboundedOutput(t *testing.T) {
+	provider := qualificationProvider{}
+	mux := http.NewServeMux()
+	mux.Handle("POST /v1/provider-discovery/{provider}/qualify", modelQualificationHandler(map[string]providerRegistration{"cpu": {ProviderInstanceID: "cpu", Provider: provider, Discovery: provider}}, "owner"))
+	request := httptest.NewRequest(http.MethodPost, "/v1/provider-discovery/cpu/qualify", strings.NewReader(`{"prompt":"ready","max_output_bytes":8192}`))
+	request.Header.Set("Content-Type", "application/json")
+	response := httptest.NewRecorder()
+	mux.ServeHTTP(response, request)
+	if response.Code != http.StatusBadRequest {
+		t.Fatalf("unbounded qualification status=%d", response.Code)
+	}
+}
+
+type qualificationObserverStub struct {
+	observations []capability.ModelQualificationObservation
+}
+
+func (s *qualificationObserverStub) ObserveQualification(_ context.Context, value capability.ModelQualificationObservation) error {
+	s.observations = append(s.observations, value)
+	return nil
+}
+
+func TestModelQualificationPersistsReachabilityWithoutQuality(t *testing.T) {
+	provider := qualificationProvider{}
+	observer := &qualificationObserverStub{}
+	mux := http.NewServeMux()
+	mux.Handle("POST /v1/provider-discovery/{provider}/qualify", modelQualificationHandler(map[string]providerRegistration{"cpu": {ProviderInstanceID: "cpu", Provider: provider, Discovery: provider}}, "owner", observer))
+	request := httptest.NewRequest(http.MethodPost, "/v1/provider-discovery/cpu/qualify", strings.NewReader(`{"prompt":"ready","max_output_bytes":128,"model_ids":["model-a"]}`))
+	request.Header.Set("Content-Type", "application/json")
+	response := httptest.NewRecorder()
+	mux.ServeHTTP(response, request)
+	if response.Code != http.StatusOK || len(observer.observations) != 1 {
+		t.Fatalf("qualification persistence status=%d observations=%d body=%s", response.Code, len(observer.observations), response.Body.String())
+	}
+	if err := observer.observations[0].Validate(); err != nil || observer.observations[0].Status != capability.ModelQualificationReachable {
+		t.Fatalf("invalid qualification observation: %+v err=%v", observer.observations[0], err)
+	}
+}

cmd/cognitive-worker/multimodal.go

@@ -0,0 +1,138 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"git.cin.su/m/Assistant/adapters/multimodal"
+	"git.cin.su/m/Assistant/contracts/capability"
+)
+
+const maxMultimodalUploadBytes = 12 << 20
+
+type multimodalGateway struct {
+	speech           multimodal.SpeechClient
+	vision           multimodal.VisionClient
+	imageGenerator   multimodal.ImageGenerator
+	imageProviderURL string
+	video            multimodal.VideoUnderstandingClient
+	model            string
+	imageModel       string
+	videoModel       string
+	now              func() time.Time
+}
+
+func (g multimodalGateway) handler(operation capability.MultimodalOperation) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		r.Body = http.MaxBytesReader(w, r.Body, maxMultimodalUploadBytes)
+		if err := r.ParseMultipartForm(maxMultimodalUploadBytes); err != nil {
+			http.Error(w, "media upload is too large or invalid", http.StatusRequestEntityTooLarge)
+			return
+		}
+		if operation == capability.MultimodalGenerateImage {
+			if strings.TrimSpace(g.imageProviderURL) == "" {
+				http.Error(w, "local image generation capability unavailable", http.StatusBadGateway)
+				return
+			}
+			prompt := r.FormValue("prompt")
+			image, err := g.imageGenerator.Generate(r.Context(), g.imageModel, prompt, imageRequestSize(prompt, r.FormValue("size")))
+			if err != nil || strings.TrimSpace(image.DataBase64) == "" {
+				logMultimodalFailure(operation, err)
+				http.Error(w, "local image generation capability unavailable", http.StatusBadGateway)
+				return
+			}
+			result := capability.MultimodalResponse{Operation: operation, Provider: "local-image-generator", ObservedAt: g.now().UnixMilli(), ContentType: image.ContentType, DataBase64: image.DataBase64}
+			w.Header().Set("Content-Type", "application/json")
+			_ = json.NewEncoder(w).Encode(result)
+			return
+		}
+		file, header, err := r.FormFile("file")
+		if err != nil {
+			http.Error(w, "media file is required", http.StatusBadRequest)
+			return
+		}
+		defer file.Close()
+		data, err := io.ReadAll(io.LimitReader(file, maxMultimodalUploadBytes+1))
+		if err != nil || len(data) == 0 || len(data) > maxMultimodalUploadBytes {
+			http.Error(w, "media file is invalid", http.StatusBadRequest)
+			return
+		}
+		contentType := header.Header.Get("Content-Type")
+		if contentType == "" {
+			contentType = "application/octet-stream"
+		}
+		var text string
+		if operation == capability.MultimodalTranscribe {
+			text, err = g.speech.Transcribe(r.Context(), header.Filename, contentType, data)
+		} else if operation == capability.MultimodalUnderstandVideo {
+			if strings.TrimSpace(g.video.BaseURL) == "" {
+				http.Error(w, "local video understanding capability unavailable", http.StatusBadGateway)
+				return
+			}
+			text, err = g.video.Describe(r.Context(), g.videoModel, header.Filename, contentType, data, r.FormValue("instruction"))
+		} else {
+			instruction := "Опиши, что изображено на фотографии, коротко и по существу. Не выдумывай нечитаемые детали."
+			if operation == capability.MultimodalRecognizeOCR {
+				instruction = "Точно распознай весь читаемый текст на изображении. Сохрани строки и символы; нечитаемые места обозначь как [неразборчиво]. Не добавляй пояснений."
+			}
+			text, err = g.vision.Describe(r.Context(), g.model, contentType, data, instruction)
+		}
+		if err != nil {
+			logMultimodalFailure(operation, err)
+			http.Error(w, "local media capability unavailable", http.StatusBadGateway)
+			return
+		}
+		result := capability.MultimodalResponse{Operation: operation, Text: strings.TrimSpace(text), ObservedAt: g.now().UnixMilli(), ConfidenceNote: "Результат получен локальным специализированным сервисом; нечитаемые или неоднозначные фрагменты требуют проверки."}
+		if operation == capability.MultimodalTranscribe {
+			result.Provider = "local-whisper"
+		} else {
+			result.Provider = "local-vision"
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(result)
+	}
+}
+
+// imageRequestSize is a transport-level normalization for the local image
+// capability.  An explicit, valid size always wins.  When the caller only
+// expresses a conventional output-quality target, the capability translates it
+// to a supported provider size without exposing provider workflow details to
+// the interaction core.  This policy is deliberately local and replaceable
+// with the image capability implementation.
+func imageRequestSize(prompt, requested string) string {
+	if isImageSize(requested) {
+		return strings.TrimSpace(requested)
+	}
+	words := strings.Fields(strings.ToLower(prompt))
+	for index, word := range words {
+		switch word {
+		case "4k", "uhd":
+			return "2048x2048"
+		case "hd":
+			return "1024x1024"
+		case "ultra":
+			if index+1 < len(words) && words[index+1] == "hd" {
+				return "2048x2048"
+			}
+		}
+	}
+	return ""
+}
+
+func isImageSize(value string) bool {
+	var width, height int
+	if _, err := fmt.Sscanf(strings.TrimSpace(value), "%dx%d", &width, &height); err != nil {
+		return false
+	}
+	return width >= 256 && height >= 256 && width <= 2048 && height <= 2048
+}
+
+func logMultimodalFailure(operation capability.MultimodalOperation, err error) {
+	// Keep provider details in server diagnostics; never return them to chat.
+	log.Printf("multimodal operation %s failed: %v", operation, err)
+}

cmd/cognitive-worker/multimodal_test.go

@@ -0,0 +1,96 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"git.cin.su/m/Assistant/adapters/multimodal"
+	"git.cin.su/m/Assistant/contracts/capability"
+)
+
+func TestMultimodalTranscriptionHandlerReturnsLocalResult(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/inference" || r.Method != http.MethodPost {
+			t.Fatalf("unexpected upstream request: %s %s", r.Method, r.URL.Path)
+		}
+		_ = json.NewEncoder(w).Encode(map[string]string{"text": "добрый день"})
+	}))
+	defer upstream.Close()
+	server := multimodalGateway{speech: multimodal.SpeechClient{BaseURL: upstream.URL, Client: upstream.Client()}, now: time.Now}
+	request := multipartRequest(t, "/v1/multimodal/transcribe", "voice.wav", []byte("audio"))
+	response := httptest.NewRecorder()
+	server.handler(capability.MultimodalTranscribe)(response, request)
+	if response.Code != http.StatusOK || !bytes.Contains(response.Body.Bytes(), []byte("добрый день")) {
+		t.Fatalf("status=%d body=%s", response.Code, response.Body.String())
+	}
+}
+
+func TestMultimodalImageGenerationFailsClosedWhenSkillIsUnbound(t *testing.T) {
+	server := multimodalGateway{now: time.Now}
+	body := &bytes.Buffer{}
+	writer := multipart.NewWriter(body)
+	if err := writer.WriteField("prompt", "green bird"); err != nil || writer.Close() != nil {
+		t.Fatal("failed to build generation request")
+	}
+	request := httptest.NewRequest(http.MethodPost, "/v1/multimodal/generate-image", body)
+	request.Header.Set("Content-Type", writer.FormDataContentType())
+	response := httptest.NewRecorder()
+	server.handler(capability.MultimodalGenerateImage)(response, request)
+	if response.Code != http.StatusBadGateway || !bytes.Contains(response.Body.Bytes(), []byte("unavailable")) {
+		t.Fatalf("status=%d body=%s", response.Code, response.Body.String())
+	}
+}
+
+func TestImageRequestSizeUsesExplicitSizeOrQualityTarget(t *testing.T) {
+	for _, test := range []struct {
+		name      string
+		prompt    string
+		requested string
+		want      string
+	}{
+		{name: "explicit", prompt: "нарисуй птицу", requested: "768x512", want: "768x512"},
+		{name: "hd", prompt: "нарисуй птицу в HD", want: "1024x1024"},
+		{name: "uhd", prompt: "draw a bird in UHD", want: "2048x2048"},
+		{name: "ordinary", prompt: "нарисуй птицу", want: ""},
+		{name: "invalid explicit", prompt: "нарисуй птицу", requested: "100x100", want: ""},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			if got := imageRequestSize(test.prompt, test.requested); got != test.want {
+				t.Fatalf("imageRequestSize(%q, %q) = %q, want %q", test.prompt, test.requested, got, test.want)
+			}
+		})
+	}
+}
+
+func TestMultimodalVideoUnderstandingFailsClosedWhenSkillIsUnbound(t *testing.T) {
+	server := multimodalGateway{now: time.Now}
+	request := multipartRequest(t, "/v1/multimodal/video-understand", "clip.mp4", []byte("video"))
+	response := httptest.NewRecorder()
+	server.handler(capability.MultimodalUnderstandVideo)(response, request)
+	if response.Code != http.StatusBadGateway || !bytes.Contains(response.Body.Bytes(), []byte("unavailable")) {
+		t.Fatalf("status=%d body=%s", response.Code, response.Body.String())
+	}
+}
+
+func multipartRequest(t *testing.T, path, filename string, data []byte) *http.Request {
+	t.Helper()
+	body := &bytes.Buffer{}
+	writer := multipart.NewWriter(body)
+	part, err := writer.CreateFormFile("file", filename)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := part.Write(data); err != nil || writer.Close() != nil {
+		t.Fatal("failed to build multipart request")
+	}
+	request := httptest.NewRequest(http.MethodPost, path, body)
+	request = request.WithContext(context.Background())
+	request.Header.Set("Content-Type", writer.FormDataContentType())
+	return request
+}

cmd/cognitive-worker/task_evaluation.go

@@ -1,9 +1,11 @@
 package main
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"strings"
 	"sync"
 	"time"
 
@@ -34,19 +36,13 @@ func (g cognitiveGateway) taskEvaluationHandler(w http.ResponseWriter, r *http.R
 		http.Error(w, "external egress acknowledgement required", http.StatusBadRequest)
 		return
 	}
-	provider := g.provider(selected)
-	if provider == nil {
-		http.Error(w, "cognitive provider unavailable", http.StatusServiceUnavailable)
-		return
-	}
+
 	caseSet := make(map[string]struct{}, len(request.Profile.RequiredCaseIDs))
+	seenCases := make(map[string]struct{}, len(request.Cases))
 	for _, id := range request.Profile.RequiredCaseIDs {
 		caseSet[id] = struct{}{}
 	}
-	observations := make([]capability.TaskCaseObservation, len(request.Cases))
-	var wg sync.WaitGroup
-	seenCases := make(map[string]struct{}, len(request.Cases))
-	for i, item := range request.Cases {
+	for _, item := range request.Cases {
 		if item.CaseID == "" || item.Prompt == "" || item.EvidenceArtifactRef == "" {
 			http.Error(w, "invalid task evaluation case", http.StatusBadRequest)
 			return
@@ -60,31 +56,81 @@ func (g cognitiveGateway) taskEvaluationHandler(w http.ResponseWriter, r *http.R
 			return
 		}
 		seenCases[item.CaseID] = struct{}{}
-		wg.Add(1)
-		go func(index int, item capability.TaskEvaluationCase) {
-			defer wg.Done()
-			started := time.Now()
-			invocation := cognitive.AdvisoryRequest{Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(fmt.Sprintf("task-evaluation:%s:%s", request.Profile.ID, item.CaseID)), ActorID: request.ActorID, PrincipalID: request.PrincipalID, ScopeID: request.ScopeID, Message: item.Prompt, MaxOutputBytes: int(request.MaxOutputBytes), ProviderBindingID: selected.Binding.ID, ProviderBindingRevision: selected.Binding.Revision, ProviderInstanceID: selected.Provider.ID, ModelDescriptorID: selected.Model.ID, ProviderModelID: selected.Model.ProviderModelID}
-			response, invokeErr := g.invokeAdmitted(r.Context(), string(invocation.RequestID), provider, invocation, int(request.MaxOutputBytes))
-			observation := capability.TaskCaseObservation{CaseID: item.CaseID, LatencyMicros: time.Since(started).Microseconds(), EvidenceArtifactRef: item.EvidenceArtifactRef}
-			if invokeErr == nil && response.FinishReason == cognitive.FinishCompleted && response.AdvisoryText != "" {
-				observation.Result = capability.EvaluationSupported
-				// Invocation success proves reachability/support for this case,
-				// not semantic answer quality. A verifier may score quality later.
-				observation.QualityScoreMillis = 0
-			} else {
-				observation.Result = capability.EvaluationUnknown
-				observation.CriticalFailure = invokeErr != nil
-			}
-			observations[index] = observation
-		}(i, item)
 	}
 	if len(seenCases) != len(caseSet) {
 		http.Error(w, "task evaluation case set is incomplete", http.StatusBadRequest)
 		return
 	}
+
+	// One bounded fan-out wave uses one binding snapshot. If that candidate is
+	// unavailable, only this binding is excluded and the existing resolver
+	// chooses the next eligible candidate. Provider output remains untrusted
+	// until the independent verifier accepts it downstream.
+	requirement := capability.CognitiveRequirement{CapabilityID: request.CapabilityID, OwnerPrincipalID: request.PrincipalID, DataPolicy: selected.Binding.DataPolicy, RequiredModalities: []capability.ModelModality{capability.ModalityText}, RequiredCapabilities: []capability.ModelCapability{capability.CapabilityAdvisory}, AllowCanary: g.allowCanary, MaxOutputBytes: request.MaxOutputBytes}
+	var observations []capability.TaskCaseObservation
+	var responses []capability.TaskCaseResponse
+	for attempt := 0; attempt < 3; attempt++ {
+		provider := g.provider(selected)
+		if provider == nil {
+			observations, responses = taskEvaluationUnavailable(request.Cases)
+		} else {
+			observations, responses = g.executeTaskEvaluationCases(r.Context(), request, selected, provider)
+		}
+		if taskEvaluationResponsesUsable(responses) {
+			break
+		}
+		requirement.ExcludedBindingIDs = append(requirement.ExcludedBindingIDs, selected.Binding.ID)
+		fallback, resolveErr := g.resolver.Resolve(r.Context(), requirement)
+		fallbackProvider := g.provider(fallback)
+		if resolveErr != nil || fallbackProvider == nil || fallback.Binding.ID == selected.Binding.ID || (fallback.Binding.DataPolicy != capability.DataPolicyLocalOnly && !request.EgressAcknowledged) {
+			break
+		}
+		selected = fallback
+	}
+
+	writeTaskEvaluationJSON(w, capability.TaskEvaluationExecutionResponse{ProfileID: request.Profile.ID, BindingID: selected.Binding.ID, BindingRevision: selected.Binding.Revision, Observations: observations, Responses: responses, ObservedAtUnixMillis: time.Now().UnixMilli()})
+}
+
+func (g cognitiveGateway) executeTaskEvaluationCases(ctx context.Context, request capability.TaskEvaluationExecutionRequest, selected capability.ResolvedCognitiveBinding, provider advisoryProvider) ([]capability.TaskCaseObservation, []capability.TaskCaseResponse) {
+	observations := make([]capability.TaskCaseObservation, len(request.Cases))
+	responses := make([]capability.TaskCaseResponse, len(request.Cases))
+	var wg sync.WaitGroup
+	for i, item := range request.Cases {
+		wg.Add(1)
+		go func(index int, item capability.TaskEvaluationCase) {
+			defer wg.Done()
+			started := time.Now()
+			invocation := cognitive.AdvisoryRequest{Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(fmt.Sprintf("task-evaluation:%s:%s", request.Profile.ID, item.CaseID)), ActorID: request.ActorID, PrincipalID: request.PrincipalID, ScopeID: request.ScopeID, Message: item.Prompt, MaxOutputBytes: int(request.MaxOutputBytes), ProviderBindingID: selected.Binding.ID, ProviderBindingRevision: selected.Binding.Revision, ProviderInstanceID: selected.Provider.ID, ModelDescriptorID: selected.Model.ID, ProviderModelID: selected.Model.ProviderModelID}
+			response, invokeErr := g.invokeAdmitted(ctx, string(invocation.RequestID), provider, invocation, int(request.MaxOutputBytes))
+			latency := time.Since(started).Microseconds()
+			observations[index] = capability.TaskCaseObservation{CaseID: item.CaseID, Result: capability.EvaluationUnknown, CriticalFailure: invokeErr != nil || response.FinishReason != cognitive.FinishCompleted || strings.TrimSpace(response.AdvisoryText) == "", EvidenceArtifactRef: item.EvidenceArtifactRef, LatencyMicros: latency}
+			responses[index] = capability.TaskCaseResponse{CaseID: item.CaseID, ResponseText: response.AdvisoryText, LatencyMicros: latency, EvidenceArtifactRef: item.EvidenceArtifactRef}
+		}(i, item)
+	}
 	wg.Wait()
-	writeTaskEvaluationJSON(w, capability.TaskEvaluationExecutionResponse{ProfileID: request.Profile.ID, BindingID: selected.Binding.ID, BindingRevision: selected.Binding.Revision, Observations: observations, ObservedAtUnixMillis: time.Now().UnixMilli()})
+	return observations, responses
+}
+
+func taskEvaluationUnavailable(cases []capability.TaskEvaluationCase) ([]capability.TaskCaseObservation, []capability.TaskCaseResponse) {
+	observations := make([]capability.TaskCaseObservation, len(cases))
+	responses := make([]capability.TaskCaseResponse, len(cases))
+	for i, item := range cases {
+		observations[i] = capability.TaskCaseObservation{CaseID: item.CaseID, Result: capability.EvaluationUnknown, CriticalFailure: true, EvidenceArtifactRef: item.EvidenceArtifactRef}
+		responses[i] = capability.TaskCaseResponse{CaseID: item.CaseID, EvidenceArtifactRef: item.EvidenceArtifactRef}
+	}
+	return observations, responses
+}
+
+func taskEvaluationResponsesUsable(responses []capability.TaskCaseResponse) bool {
+	if len(responses) == 0 {
+		return false
+	}
+	for _, response := range responses {
+		if strings.TrimSpace(response.ResponseText) == "" {
+			return false
+		}
+	}
+	return true
 }
 
 func writeTaskEvaluationJSON(w http.ResponseWriter, value any) {

cmd/cognitive-worker/task_evaluation_test.go

@@ -47,7 +47,99 @@ func TestTaskEvaluationHandlerInvokesEveryBoundedCase(t *testing.T) {
 	if err := json.Unmarshal(recorder.Body.Bytes(), &response); err != nil {
 		t.Fatal(err)
 	}
-	if len(response.Observations) != 2 || response.Observations[0].Result != capability.EvaluationSupported || response.Observations[1].Result != capability.EvaluationSupported {
+	if len(response.Observations) != 2 || response.Observations[0].Result != capability.EvaluationUnknown || response.Observations[1].Result != capability.EvaluationUnknown {
 		t.Fatalf("unexpected observations: %+v", response.Observations)
 	}
+	for _, observation := range response.Observations {
+		if observation.QualityScoreMillis != 0 || observation.CriticalFailure {
+			t.Fatalf("reachability-only evidence must not carry quality or failure claims: %+v", observation)
+		}
+	}
+}
+
+type taskEvaluationFailoverRegistry struct {
+	primary, fallback capability.ResolvedCognitiveBinding
+	resolveCalls      int
+}
+
+func (s *taskEvaluationFailoverRegistry) ResolveCandidate(context.Context, capability.CapabilityBindingID, int64) (capability.ResolvedCognitiveBinding, error) {
+	return s.primary, nil
+}
+
+func (s *taskEvaluationFailoverRegistry) Resolve(_ context.Context, requirement capability.CognitiveRequirement) (capability.ResolvedCognitiveBinding, error) {
+	s.resolveCalls++
+	if len(requirement.ExcludedBindingIDs) == 0 {
+		return s.primary, nil
+	}
+	return s.fallback, nil
+}
+
+func (s *taskEvaluationFailoverRegistry) Observe(context.Context, capability.CognitiveUsageObservation) error {
+	return nil
+}
+
+func (s *taskEvaluationFailoverRegistry) RegisterDiscovery(context.Context, capability.CognitiveDiscoverySnapshot) (capability.CognitiveDiscoveryRegistration, error) {
+	return capability.CognitiveDiscoveryRegistration{}, nil
+}
+
+func TestTaskEvaluationExcludesUnavailableCandidateAndUsesFallback(t *testing.T) {
+	primary := gatewaySelection()
+	fallback := primary
+	fallback.Binding.ID = "binding-fallback"
+	fallback.Binding.Revision = 7
+	fallback.Binding.ProviderInstanceID = "provider-fallback"
+	fallback.Provider.ID = "provider-fallback"
+	fallback.Provider.Kind = "provider-fallback-kind"
+	fallback.Provider.EndpointRef = "fallback-endpoint"
+	fallback.Provider.CredentialRef = "fallback-credential"
+	fallback.Model.ProviderInstanceID = "provider-fallback"
+	registry := &taskEvaluationFailoverRegistry{primary: primary, fallback: fallback}
+	primaryProvider := &stubAdvisoryProvider{response: cognitive.AdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, FinishReason: cognitive.FinishProviderUnavailable}}
+	fallbackProvider := &stubAdvisoryProvider{response: cognitive.AdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, FinishReason: cognitive.FinishCompleted, AdvisoryText: "fallback response"}}
+	gateway := cognitiveGateway{resolver: registry, providers: map[capability.ProviderKind][]providerRegistration{
+		primary.Provider.Kind:  {{ProviderInstanceID: primary.Provider.ID, Kind: primary.Provider.Kind, EndpointRef: primary.Provider.EndpointRef, CredentialRef: primary.Provider.CredentialRef, Provider: primaryProvider}},
+		fallback.Provider.Kind: {{ProviderInstanceID: fallback.Provider.ID, Kind: fallback.Provider.Kind, EndpointRef: fallback.Provider.EndpointRef, CredentialRef: fallback.Provider.CredentialRef, Provider: fallbackProvider}},
+	}, now: func() time.Time { return time.UnixMilli(1000) }}
+	profile := capability.TaskEvaluationProfile{ID: "profile-failover", Revision: 1, CapabilityID: primary.Binding.CapabilityID, Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "failover-v1", RequiredCaseIDs: []string{"case-a"}, QualityWeightMillis: 600, ReliabilityWeightMillis: 300, LatencyWeightMillis: 100}
+	request := capability.TaskEvaluationExecutionRequest{Profile: profile, CapabilityID: profile.CapabilityID, BindingID: primary.Binding.ID, BindingRevision: primary.Binding.Revision, ActorID: identity.ActorID("actor-1"), PrincipalID: primary.Binding.OwnerPrincipalID, ScopeID: authority.ScopeID("scope-1"), MaxOutputBytes: 512, EgressAcknowledged: true, Cases: []capability.TaskEvaluationCase{{CaseID: "case-a", Prompt: "one", EvidenceArtifactRef: "artifact:a"}}}
+	payload, _ := json.Marshal(request)
+	recorder := httptest.NewRecorder()
+	gateway.taskEvaluationHandler(recorder, httptest.NewRequest(http.MethodPost, "/v1/task-evaluations/execute", bytes.NewReader(payload)))
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String())
+	}
+	var response capability.TaskEvaluationExecutionResponse
+	if err := json.Unmarshal(recorder.Body.Bytes(), &response); err != nil {
+		t.Fatal(err)
+	}
+	if response.BindingID != fallback.Binding.ID || !primaryProvider.called || !fallbackProvider.called || registry.resolveCalls != 1 {
+		t.Fatalf("failover binding=%s primary_called=%t fallback_called=%t resolve_calls=%d", response.BindingID, primaryProvider.called, fallbackProvider.called, registry.resolveCalls)
+	}
+	if response.Observations[0].CriticalFailure || response.Responses[0].ResponseText != "fallback response" {
+		t.Fatalf("fallback response was not usable: %+v %+v", response.Observations, response.Responses)
+	}
+}
+
+func TestTaskEvaluationUnavailableResponseIsMarkedCriticalUnknown(t *testing.T) {
+	selected := gatewaySelection()
+	registry := &taskEvaluationFailoverRegistry{primary: selected, fallback: selected}
+	provider := &stubAdvisoryProvider{response: cognitive.AdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, FinishReason: cognitive.FinishTimeout}}
+	gateway := cognitiveGateway{resolver: registry, providers: map[capability.ProviderKind][]providerRegistration{
+		selected.Provider.Kind: {{ProviderInstanceID: selected.Provider.ID, Kind: selected.Provider.Kind, EndpointRef: selected.Provider.EndpointRef, CredentialRef: selected.Provider.CredentialRef, Provider: provider}},
+	}, now: func() time.Time { return time.UnixMilli(1000) }}
+	profile := capability.TaskEvaluationProfile{ID: "profile-unknown", Revision: 1, CapabilityID: selected.Binding.CapabilityID, Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "unknown-v1", RequiredCaseIDs: []string{"case-a"}, QualityWeightMillis: 600, ReliabilityWeightMillis: 300, LatencyWeightMillis: 100}
+	request := capability.TaskEvaluationExecutionRequest{Profile: profile, CapabilityID: profile.CapabilityID, BindingID: selected.Binding.ID, BindingRevision: selected.Binding.Revision, ActorID: identity.ActorID("actor-1"), PrincipalID: selected.Binding.OwnerPrincipalID, ScopeID: authority.ScopeID("scope-1"), MaxOutputBytes: 512, EgressAcknowledged: true, Cases: []capability.TaskEvaluationCase{{CaseID: "case-a", Prompt: "one", EvidenceArtifactRef: "artifact:a"}}}
+	payload, _ := json.Marshal(request)
+	recorder := httptest.NewRecorder()
+	gateway.taskEvaluationHandler(recorder, httptest.NewRequest(http.MethodPost, "/v1/task-evaluations/execute", bytes.NewReader(payload)))
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String())
+	}
+	var response capability.TaskEvaluationExecutionResponse
+	if err := json.Unmarshal(recorder.Body.Bytes(), &response); err != nil {
+		t.Fatal(err)
+	}
+	if len(response.Observations) != 1 || response.Observations[0].Result != capability.EvaluationUnknown || !response.Observations[0].CriticalFailure {
+		t.Fatalf("unavailable response was overclaimed: %+v", response.Observations)
+	}
 }

cmd/core-runtime/chat_orchestrator.go

@@ -0,0 +1,82 @@
+package main
+
+import (
+	"sort"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	interactiondomain "git.cin.su/m/Assistant/modules/interaction/domain"
+)
+
+type chatRouteKind string
+
+const (
+	chatRouteResearch     chatRouteKind = "RESEARCH"
+	chatRouteConversation chatRouteKind = "CONVERSATION"
+	chatRouteMedia        chatRouteKind = "MEDIA"
+	chatRouteAction       chatRouteKind = "ACTION"
+	chatRouteAgent        chatRouteKind = "AGENT"
+)
+
+type chatRoute struct {
+	Kind       chatRouteKind
+	Capability capability.CapabilityKind
+	Profile    string
+	Order      int
+}
+
+// buildChatRoutePlan creates one bounded route per meaning-bearing capability.
+// A failed research route must not suppress the local conversational route or
+// an unrelated action route.
+func buildChatRoutePlan(result interactiondomain.SemanticResult) []chatRoute {
+	seen := make(map[capability.CapabilityKind]struct{})
+	routes := make([]chatRoute, 0, len(result.CapabilityHints)+1)
+	add := func(kind chatRouteKind, capabilityKind capability.CapabilityKind, profile string, order int) {
+		if capabilityKind != "" {
+			if _, exists := seen[capabilityKind]; exists {
+				return
+			}
+			seen[capabilityKind] = struct{}{}
+		}
+		routes = append(routes, chatRoute{Kind: kind, Capability: capabilityKind, Profile: profile, Order: order})
+	}
+	for _, hint := range result.CapabilityHints {
+		switch capability.CapabilityKind(hint) {
+		case capability.CapabilityKindWebResearch:
+			add(chatRouteResearch, capability.CapabilityKindWebResearch, "truth-research-v1", 10)
+		case capability.CapabilityKindImageGeneration:
+			add(chatRouteMedia, capability.CapabilityKindImageGeneration, "local-image-generation-v1", 5)
+		case capability.CapabilityKindCognitiveReasoning, capability.CapabilityKindVerifyFact:
+			add(chatRouteConversation, capability.CapabilityKind(hint), "local-reasoning-v1", 20)
+		case capability.CapabilityKindScheduleReminder:
+			add(chatRouteAction, capability.CapabilityKindScheduleReminder, "continuity-reminder-v1", 30)
+		case capability.CapabilityKindModifyCode, capability.CapabilityKindRunTests, capability.CapabilityKindInspectProject:
+			add(chatRouteAgent, capability.CapabilityKind(hint), "software-agent-v1", 40)
+		case capability.CapabilityKindSendEmail, capability.CapabilityKindReadEmail:
+			add(chatRouteAgent, capability.CapabilityKind(hint), "communication-agent-v1", 50)
+		case capability.CapabilityKindReadDatabase, capability.CapabilityKindQueryLogs:
+			add(chatRouteAgent, capability.CapabilityKind(hint), "diagnostics-agent-v1", 60)
+		}
+	}
+	if result.NeedsCognition || len(routes) == 0 {
+		add(chatRouteConversation, capability.CapabilityKindCognitiveReasoning, "local-reasoning-v1", 20)
+	}
+	sort.SliceStable(routes, func(i, j int) bool { return routes[i].Order < routes[j].Order })
+	return routes
+}
+
+func hasChatRoute(routes []chatRoute, kind chatRouteKind) bool {
+	for _, route := range routes {
+		if route.Kind == kind {
+			return true
+		}
+	}
+	return false
+}
+
+// specializedRouteBypassesGeneralInterpretation keeps a concrete capability
+// route stable. General cognition may still be used later to assess evidence,
+// but it must not replace an executable research or media route with a vague
+// conversational clarification before the capability is attempted.
+func specializedRouteBypassesGeneralInterpretation(routes []chatRoute) bool {
+	return hasChatRoute(routes, chatRouteMedia) || hasChatRoute(routes, chatRouteResearch)
+}

cmd/core-runtime/chat_orchestrator_test.go

@@ -0,0 +1,53 @@
+package main
+
+import (
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	interactiondomain "git.cin.su/m/Assistant/modules/interaction/domain"
+)
+
+func TestBuildChatRoutePlanPreservesMultipleMeaningfulRoutes(t *testing.T) {
+	planned := buildChatRoutePlan(interactiondomain.SemanticResult{
+		NeedsCognition:  true,
+		CapabilityHints: []string{"WEB_RESEARCH", "MODIFY_CODE", "RUN_TESTS", "SCHEDULE_REMINDER"},
+	})
+	if len(planned) != 5 {
+		t.Fatalf("expected five deduplicated routes, got %+v", planned)
+	}
+	want := []struct {
+		kind    chatRouteKind
+		profile string
+		cap     capability.CapabilityKind
+	}{
+		{chatRouteResearch, "truth-research-v1", capability.CapabilityKindWebResearch},
+		{chatRouteConversation, "local-reasoning-v1", capability.CapabilityKindCognitiveReasoning},
+		{chatRouteAction, "continuity-reminder-v1", capability.CapabilityKindScheduleReminder},
+		{chatRouteAgent, "software-agent-v1", capability.CapabilityKindModifyCode},
+		{chatRouteAgent, "software-agent-v1", capability.CapabilityKindRunTests},
+	}
+	for index, expected := range want {
+		if planned[index].Kind != expected.kind || planned[index].Profile != expected.profile || planned[index].Capability != expected.cap {
+			t.Fatalf("route %d = %+v, want %+v", index, planned[index], expected)
+		}
+	}
+}
+
+func TestBuildChatRoutePlanAlwaysKeepsLocalConversationRoute(t *testing.T) {
+	planned := buildChatRoutePlan(interactiondomain.SemanticResult{NeedsCognition: true})
+	if len(planned) != 1 || planned[0].Kind != chatRouteConversation || planned[0].Profile != "local-reasoning-v1" {
+		t.Fatalf("unexpected local route: %+v", planned)
+	}
+}
+
+func TestSpecializedRouteBypassesGeneralInterpretation(t *testing.T) {
+	if !specializedRouteBypassesGeneralInterpretation([]chatRoute{{Kind: chatRouteResearch}}) {
+		t.Fatal("research route must execute before general cognition")
+	}
+	if !specializedRouteBypassesGeneralInterpretation([]chatRoute{{Kind: chatRouteMedia}}) {
+		t.Fatal("media route must execute before general cognition")
+	}
+	if specializedRouteBypassesGeneralInterpretation([]chatRoute{{Kind: chatRouteConversation}}) {
+		t.Fatal("conversation-only route must retain general cognition")
+	}
+}

cmd/core-runtime/cognitive_interpretation.go

@@ -5,8 +5,13 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"hash/fnv"
+	"io"
+	"mime/multipart"
 	"net/http"
 	"net/url"
+	"strings"
+	"time"
 
 	"git.cin.su/m/Assistant/contracts/authority"
 	"git.cin.su/m/Assistant/contracts/capability"
@@ -20,6 +25,109 @@ import (
 type cognitiveInterpretationClient struct {
 	baseURL *url.URL
 	client  *http.Client
+	media   *http.Client
+}
+
+// ReviewResponse asks the cognitive gateway to turn a locally assembled draft
+// into a natural answer. The draft remains the safe fallback when cognition is
+// unavailable; the model does not mutate canonical state or execute actions.
+func (c cognitiveInterpretationClient) ReviewResponse(ctx context.Context, session identity.CreatorSession, userMessage, draft, personalMemory string, meaning cognitive.TaskMeaning) (string, error) {
+	requestID, err := ids.New()
+	if err != nil {
+		return "", err
+	}
+	prompt := "Ты редактор финального ответа Домового. Проверь черновик по смыслу и подготовь естественный ответ человеку. Учитывай весь запрос, включая недостающие параметры для конкретного результата. Если данных не хватает, задай один короткий полезный уточняющий вопрос, например откуда и куда ехать. Не выдавай поисковые сниппеты как выполненное действие и не показывай служебные URL поисковой выдачи. Сохрани проверяемые факты, названия источников, прямые ссылки и ограничения. Не выдумывай факты и не утверждай невыполненные действия. Сначала внутренне проверь, что ответ начинается с содержания, решающего вопрос. Не повторяй вопрос пользователя в качестве заголовка или вступления, если это не нужно для смысла. Представление, имя помощника, приветствие или предложение дополнительной помощи допустимы только если пользователь сам спросил об этом; иначе убери их. Верни только готовый ответ без разбора проверки, служебных слов и упоминания моделей. Если черновик уже адекватен, верни его без лишних добавлений.\n\nСообщение пользователя:\n" + userMessage + "\n\nЧерновик ответа:\n" + draft
+	context := []cognitive.ContextExcerpt{}
+	if strings.TrimSpace(personalMemory) != "" {
+		context = append(context, cognitive.ContextExcerpt{ID: "personal-memory", SourceKind: "derived-personal-memory", SourceID: "interaction:human-utterances", Revision: 1, Sensitivity: cognitive.SensitivityPrivateAllowed, Text: personalMemory})
+	}
+	target := *c.baseURL
+	target.Path = "/v1/advisories"
+	payload, err := json.Marshal(cognitive.GatewayAdvisoryRequest{
+		Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(requestID),
+		ActorID: session.ActorID, PrincipalID: session.PrincipalID,
+		ScopeID: authority.ScopeID("domovoy-global-scope"), Message: prompt,
+		Context: context, Locale: "ru", MaxOutputBytes: 2048, DataPolicy: capability.DataPolicyLocalOnly,
+		Meaning: cognitive.TaskMeaning{
+			SpeechAct:              "RESPONSE_REVIEW",
+			CapabilityHints:        meaning.CapabilityHints,
+			RequestedOutcome:       meaning.RequestedOutcome,
+			InformationRequestKind: meaning.InformationRequestKind,
+			ConfidenceMillis:       meaning.ConfidenceMillis,
+		},
+	})
+	if err != nil {
+		return "", err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, target.String(), bytes.NewReader(payload))
+	if err != nil {
+		return "", err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	response, err := c.client.Do(request)
+	if err != nil {
+		return "", err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("cognitive response review status %d", response.StatusCode)
+	}
+	var result cognitive.GatewayAdvisoryResponse
+	if err := json.NewDecoder(response.Body).Decode(&result); err != nil {
+		return "", err
+	}
+	if result.FinishReason != cognitive.FinishCompleted || strings.TrimSpace(result.AdvisoryText) == "" {
+		return "", fmt.Errorf("cognitive response review incomplete: %s", result.FinishReason)
+	}
+	return strings.TrimSpace(result.AdvisoryText), nil
+}
+
+// AnswerStableKnowledge asks the local cognitive route for a short answer to a
+// non-current question only after evidence retrieval did not produce a usable
+// result. The model decides whether its knowledge is stable enough; it must
+// explicitly decline changing or source-dependent facts instead of guessing.
+func (c cognitiveInterpretationClient) AnswerStableKnowledge(ctx context.Context, session identity.CreatorSession, userMessage, personalMemory string, meaning cognitive.TaskMeaning) (string, error) {
+	requestID, err := ids.New()
+	if err != nil {
+		return "", err
+	}
+	prompt := "Ты отвечаешь как Домовой на обычный вопрос пользователя. Сначала пойми цель вопроса и верни короткий естественный ответ по устойчивому общеизвестному знанию. Начинай сразу с ответа и не представляйся, если пользователь не спросил об имени. Не называй модель или внутреннюю систему. Если истинность ответа зависит от текущего наблюдения, внешнего источника или инструмента, верни ровно NEEDS_VERIFIED_RESEARCH. Не придумывай факты.\n\nВопрос пользователя:\n" + userMessage
+	context := []cognitive.ContextExcerpt{}
+	if strings.TrimSpace(personalMemory) != "" {
+		context = append(context, cognitive.ContextExcerpt{ID: "personal-memory", SourceKind: "derived-personal-memory", SourceID: "interaction:human-utterances", Revision: 1, Sensitivity: cognitive.SensitivityPrivateAllowed, Text: personalMemory})
+	}
+	target := *c.baseURL
+	target.Path = "/v1/advisories"
+	payload, err := json.Marshal(cognitive.GatewayAdvisoryRequest{
+		Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(requestID),
+		ActorID: session.ActorID, PrincipalID: session.PrincipalID, ScopeID: authority.ScopeID("domovoy-global-scope"),
+		Message: prompt, Context: context, Locale: "ru", MaxOutputBytes: 1024, DataPolicy: capability.DataPolicyLocalOnly,
+		Meaning: cognitive.TaskMeaning{SpeechAct: "STABLE_KNOWLEDGE_ANSWER", CapabilityHints: meaning.CapabilityHints, RequestedOutcome: meaning.RequestedOutcome, InformationRequestKind: meaning.InformationRequestKind, ConfidenceMillis: meaning.ConfidenceMillis},
+	})
+	if err != nil {
+		return "", err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, target.String(), bytes.NewReader(payload))
+	if err != nil {
+		return "", err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	response, err := c.client.Do(request)
+	if err != nil {
+		return "", err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("cognitive stable knowledge status %d", response.StatusCode)
+	}
+	var result cognitive.GatewayAdvisoryResponse
+	if err := json.NewDecoder(response.Body).Decode(&result); err != nil {
+		return "", err
+	}
+	if result.FinishReason != cognitive.FinishCompleted || strings.TrimSpace(result.AdvisoryText) == "" {
+		return "", fmt.Errorf("cognitive stable knowledge incomplete: %s", result.FinishReason)
+	}
+	return strings.TrimSpace(result.AdvisoryText), nil
 }
 
 func newCognitiveInterpretationClient(rawURL string, client *http.Client) (cognitiveInterpretationClient, error) {
@@ -30,7 +138,7 @@ func newCognitiveInterpretationClient(rawURL string, client *http.Client) (cogni
 	if client == nil {
 		client = http.DefaultClient
 	}
-	return cognitiveInterpretationClient{baseURL: base, client: client}, nil
+	return cognitiveInterpretationClient{baseURL: base, client: client, media: &http.Client{Timeout: 15 * time.Minute}}, nil
 }
 
 func (c cognitiveInterpretationClient) Interpret(ctx context.Context, request cognitive.GatewayInterpretationRequest) (cognitive.GatewayInterpretationResponse, error) {
@@ -60,20 +168,107 @@ func (c cognitiveInterpretationClient) Interpret(ctx context.Context, request co
 	return result, nil
 }
 
+func (c cognitiveInterpretationClient) GenerateImage(ctx context.Context, prompt, size string) (capability.MultimodalResponse, error) {
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+	if err := writer.WriteField("prompt", prompt); err != nil {
+		return capability.MultimodalResponse{}, err
+	}
+	if strings.TrimSpace(size) != "" {
+		if err := writer.WriteField("size", size); err != nil {
+			return capability.MultimodalResponse{}, err
+		}
+	}
+	if err := writer.Close(); err != nil {
+		return capability.MultimodalResponse{}, err
+	}
+	target := *c.baseURL
+	target.Path = "/v1/multimodal/generate-image"
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, target.String(), &body)
+	if err != nil {
+		return capability.MultimodalResponse{}, err
+	}
+	request.Header.Set("Content-Type", writer.FormDataContentType())
+	client := c.media
+	if client == nil {
+		client = c.client
+	}
+	response, err := client.Do(request)
+	if err != nil {
+		return capability.MultimodalResponse{}, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return capability.MultimodalResponse{}, fmt.Errorf("image generation status %d", response.StatusCode)
+	}
+	var result capability.MultimodalResponse
+	if err := json.NewDecoder(io.LimitReader(response.Body, 32<<20)).Decode(&result); err != nil {
+		return capability.MultimodalResponse{}, err
+	}
+	if strings.TrimSpace(result.DataBase64) == "" {
+		return capability.MultimodalResponse{}, fmt.Errorf("image generation returned empty payload")
+	}
+	return result, nil
+}
+
 func shouldRequestBroaderInterpretation(result interactiondomain.SemanticResult) bool {
-	// The built-in advisory channel is the default conversational path. A
-	// simple question must not first wait for the slower, strict JSON
-	// interpretation route: that route exists for ambiguity and work routing,
-	// not as a prerequisite for talking to Domovoy.
-	if isSimpleLocalQuestion(result) {
+	return shouldRequestSemanticInterpretation(result)
+}
+
+// shouldRequestSemanticInterpretation keeps the deterministic layer as a
+// fast reflex, not as the meaning authority. Questions, requests, directives,
+// mixed signals and capability-bearing messages go through cognitive
+// interpretation; only stable low-risk conversational/assertive reflexes may
+// answer without it.
+func shouldRequestSemanticInterpretation(result interactiondomain.SemanticResult) bool {
+	if result.Interpretation.Clarification == interaction.ClarificationRequired {
 		return false
 	}
-	switch result.Interpretation.Applicability {
-	case interaction.SemanticNeedsBroaderInterpret, interaction.SemanticLowConfidence, interaction.SemanticMixedIntent:
+	// Structured, read-only information intents already have a semantic owner
+	// in core-runtime. Sending them through the slower advisory interpretation
+	// path only adds latency and can make a healthy runtime look unavailable.
+	if result.InformationRequestKind != "" {
+		return false
+	}
+	if result.NeedsCognition || len(result.CapabilityHints) > 0 {
 		return true
+	}
+	if result.Interpretation.Applicability != interaction.SemanticApplicable {
+		return true
+	}
+	switch result.Interpretation.SpeechAct {
+	case interaction.SpeechActConversational, interaction.SpeechActConfirmation, interaction.SpeechActRejection:
+		return false
+	case interaction.SpeechActPreference:
+		// Explicit user preferences are durable interaction context. A sampled
+		// advisory audit must not reinterpret or erase them.
+		return false
+	case interaction.SpeechActAssertion:
+		return result.Interpretation.ConfidenceMillis < 850
 	default:
+		return true
+	}
+}
+
+const (
+	deterministicReflexAuditInterval = 10 * time.Minute
+	deterministicReflexAuditSample   = uint32(16)
+)
+
+// shouldAuditDeterministicReflex samples stable reflexes in a time bucket.
+// This is observability, not a correctness gate: a failed audit leaves the
+// reflex usable, while a successful disagreement can replace it with the
+// cognitive candidate and becomes durable evidence through the normal
+// candidate store.
+func shouldAuditDeterministicReflex(result interactiondomain.SemanticResult, utteranceID string, now time.Time) bool {
+	if shouldRequestSemanticInterpretation(result) || utteranceID == "" {
 		return false
 	}
+	bucket := now.Unix() / int64(deterministicReflexAuditInterval/time.Second)
+	hash := fnv.New32a()
+	_, _ = hash.Write([]byte(utteranceID))
+	_, _ = hash.Write([]byte(fmt.Sprintf(":%d", bucket)))
+	return hash.Sum32()%deterministicReflexAuditSample == 0
 }
 
 func isSimpleLocalQuestion(result interactiondomain.SemanticResult) bool {

cmd/core-runtime/cognitive_interpretation_test.go

@@ -1,13 +1,110 @@
 package main
 
 import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
 	"testing"
+	"time"
 
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/cognitive"
+	"git.cin.su/m/Assistant/contracts/identity"
 	"git.cin.su/m/Assistant/contracts/interaction"
 	interactiondomain "git.cin.su/m/Assistant/modules/interaction/domain"
 )
 
-func TestSimpleQuestionUsesBuiltInAdvisoryWithoutStrictInterpretation(t *testing.T) {
+func TestReviewResponseUsesCognitiveGatewayAndReturnsOnlyDraftAnswer(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var request cognitive.GatewayAdvisoryRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Fatalf("decode review request: %v", err)
+		}
+		if request.Message == "" || request.Meaning.SpeechAct == "" {
+			t.Fatalf("review request did not carry semantic context: %+v", request)
+		}
+		if !strings.Contains(request.Message, "ответ начинается с содержания") || !strings.Contains(request.Message, "Не повторяй вопрос пользователя") || !strings.Contains(request.Message, "только если пользователь сам спросил") {
+			t.Fatalf("review request lacks the conversational quality contract: %q", request.Message)
+		}
+		if len(request.Context) != 1 || !strings.Contains(request.Context[0].Text, "красный цвет") {
+			t.Fatalf("review request did not carry compact personal memory: %+v", request.Context)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(cognitive.GatewayAdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: request.RequestID, AdvisoryText: "Меня зовут Дед. Я Домовой.", FinishReason: cognitive.FinishCompleted})
+	}))
+	defer server.Close()
+	client, err := newCognitiveInterpretationClient(server.URL, server.Client())
+	if err != nil {
+		t.Fatal(err)
+	}
+	reviewed, err := client.ReviewResponse(context.Background(), identity.CreatorSession{ActorID: "actor", PrincipalID: "principal"}, "кто ты?", "Я — Домовой.", "Предпочтение пользователя (его сообщение): красный цвет", cognitive.TaskMeaning{SpeechAct: "QUESTION"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if reviewed != "Меня зовут Дед. Я Домовой." {
+		t.Fatalf("unexpected reviewed response %q", reviewed)
+	}
+}
+
+func TestAnswerStableKnowledgeUsesLocalOnlyCognitiveRoute(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var request cognitive.GatewayAdvisoryRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Fatalf("decode stable knowledge request: %v", err)
+		}
+		if request.DataPolicy != capability.DataPolicyLocalOnly || request.Meaning.SpeechAct != "STABLE_KNOWLEDGE_ANSWER" {
+			t.Fatalf("unexpected stable knowledge request: %+v", request)
+		}
+		_ = json.NewEncoder(w).Encode(cognitive.GatewayAdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: request.RequestID, AdvisoryText: "Санкт-Петербург — город в России.", FinishReason: cognitive.FinishCompleted})
+	}))
+	defer server.Close()
+	client, err := newCognitiveInterpretationClient(server.URL, server.Client())
+	if err != nil {
+		t.Fatal(err)
+	}
+	answer, err := client.AnswerStableKnowledge(context.Background(), identity.CreatorSession{ActorID: "actor", PrincipalID: "principal"}, "Питер — это где?", "", cognitive.TaskMeaning{SpeechAct: "QUESTION"})
+	if err != nil || answer != "Санкт-Петербург — город в России." {
+		t.Fatalf("answer=%q err=%v", answer, err)
+	}
+}
+
+func TestGenerateImageUsesDedicatedCognitiveMediaRoute(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost || r.URL.Path != "/v1/multimodal/generate-image" {
+			t.Fatalf("unexpected image route: %s %s", r.Method, r.URL.Path)
+		}
+		if err := r.ParseMultipartForm(1 << 20); err != nil {
+			t.Fatalf("parse image request: %v", err)
+		}
+		if !strings.Contains(r.FormValue("prompt"), "собаку") {
+			t.Fatalf("prompt was not preserved: %q", r.FormValue("prompt"))
+		}
+		_ = json.NewEncoder(w).Encode(capability.MultimodalResponse{Operation: capability.MultimodalGenerateImage, ContentType: "image/png", DataBase64: "cG5n"})
+	}))
+	defer server.Close()
+	client, err := newCognitiveInterpretationClient(server.URL, server.Client())
+	if err != nil {
+		t.Fatal(err)
+	}
+	image, err := client.GenerateImage(context.Background(), "нарисуй собаку", "")
+	if err != nil || image.DataBase64 != "cG5n" || image.ContentType != "image/png" {
+		t.Fatalf("image=%+v err=%v", image, err)
+	}
+}
+
+func TestReviewPreservesResearchEvidence(t *testing.T) {
+	draft := "Нашёл вариант. Источник: Aviasales (https://www.aviasales.ru/search)"
+	if reviewPreservesResearchEvidence("Нашёл вариант на Авиасейлс.", draft) {
+		t.Fatal("review without the direct source must be rejected")
+	}
+	if !reviewPreservesResearchEvidence("Нашёл вариант. Источник: Aviasales (https://www.aviasales.ru/search)", draft) {
+		t.Fatal("review with the direct source must be accepted")
+	}
+}
+
+func TestSimpleQuestionUsesStrictInterpretationForSemanticRouting(t *testing.T) {
 	result := interactiondomain.SemanticResult{
 		Interpretation: interaction.UtteranceInterpretation{
 			SpeechAct:     interaction.SpeechActQuestion,
@@ -16,8 +113,8 @@ func TestSimpleQuestionUsesBuiltInAdvisoryWithoutStrictInterpretation(t *testing
 		},
 		CapabilityHints: []string{"COGNITIVE_REASONING", "VERIFY_FACT"},
 	}
-	if shouldRequestBroaderInterpretation(result) {
-		t.Fatal("simple question must go directly to the built-in advisory path")
+	if !shouldRequestBroaderInterpretation(result) {
+		t.Fatal("simple question must reach semantic interpretation before any answer")
 	}
 }
 
@@ -34,3 +131,51 @@ func TestOperationalQuestionStillUsesStrictInterpretation(t *testing.T) {
 		t.Fatal("operational question must retain strict interpretation routing")
 	}
 }
+
+func TestStructuredInventoryUsesDirectReadOnlySemanticRoute(t *testing.T) {
+	result := interactiondomain.SemanticResult{
+		Interpretation: interaction.UtteranceInterpretation{
+			SpeechAct:        interaction.SpeechActDirective,
+			Applicability:    interaction.SemanticApplicable,
+			ConfidenceMillis: 980,
+		},
+		InformationRequestKind: interaction.InformationRequestCognitiveModelInventory,
+	}
+	if shouldRequestSemanticInterpretation(result) {
+		t.Fatal("structured model inventory must use the direct read-only semantic route")
+	}
+}
+
+func TestStableReflexIsPeriodicallySampledForDrift(t *testing.T) {
+	result := interactiondomain.SemanticResult{Interpretation: interaction.UtteranceInterpretation{
+		SpeechAct: interaction.SpeechActConversational, Applicability: interaction.SemanticApplicable,
+	}}
+	found := false
+	for minute := 0; minute < 160; minute++ {
+		if shouldAuditDeterministicReflex(result, "utterance-drift-probe", time.Unix(int64(minute)*60, 0)) {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatal("stable reflex was never sampled during the audit window")
+	}
+}
+
+func TestMeaningfulSignalsAreNotReflexOnly(t *testing.T) {
+	for _, act := range []interaction.SpeechAct{interaction.SpeechActQuestion, interaction.SpeechActRequestToInvestigate, interaction.SpeechActDirective} {
+		result := interactiondomain.SemanticResult{Interpretation: interaction.UtteranceInterpretation{SpeechAct: act, Applicability: interaction.SemanticApplicable}}
+		if !shouldRequestSemanticInterpretation(result) {
+			t.Fatalf("%s must prefer cognitive interpretation", act)
+		}
+	}
+}
+
+func TestExplicitPreferenceIsNotReinterpretedByCognitiveAudit(t *testing.T) {
+	result := interactiondomain.SemanticResult{Interpretation: interaction.UtteranceInterpretation{
+		SpeechAct: interaction.SpeechActPreference, Applicability: interaction.SemanticApplicable,
+	}}
+	if shouldRequestSemanticInterpretation(result) || shouldAuditDeterministicReflex(result, "preference", time.Unix(0, 0)) {
+		t.Fatal("explicit preference must remain on the deterministic durable-context path")
+	}
+}

cmd/core-runtime/development_gate.go

@@ -0,0 +1,129 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"time"
+
+	"git.cin.su/m/Assistant/adapters/developmentexecutor"
+	"git.cin.su/m/Assistant/contracts/work"
+	workdomain "git.cin.su/m/Assistant/modules/work/domain"
+	"git.cin.su/m/Assistant/modules/work/ports"
+)
+
+var errDevelopmentGateCreate = errors.New("development gate must start at evidence collected with revision one")
+var errDevelopmentGateNotIsolated = errors.New("development gate is not isolated")
+var errDevelopmentVerifierNotIndependent = errors.New("development verifier is not independent")
+var errDevelopmentWorktreeMismatch = errors.New("verification worktree does not match gate")
+var errDevelopmentChecksFailed = errors.New("development verification checks failed")
+var errDevelopmentEvidenceRequired = errors.New("development transition evidence is required")
+var errDevelopmentEvidenceStage = errors.New("development transition evidence does not match stage")
+
+type developmentGateVerificationRequest struct {
+	GateID           string
+	ExpectedRevision int64
+	VerifierRunID    work.AgentRunID
+	Plan             developmentexecutor.Plan
+}
+
+type developmentGateEvidenceRequest struct {
+	GateID           string
+	ExpectedRevision int64
+	NextStage        work.DevelopmentStage
+	EvidenceRef      string
+}
+
+func recordDevelopmentGateEvidence(ctx context.Context, store ports.DevelopmentGateStore, request developmentGateEvidenceRequest, now time.Time) (work.DevelopmentGate, error) {
+	gate, err := store.LoadDevelopmentGate(ctx, request.GateID)
+	if err != nil {
+		return work.DevelopmentGate{}, err
+	}
+	if request.ExpectedRevision < 1 || gate.Revision != request.ExpectedRevision {
+		return gate, errDevelopmentGateNotIsolated
+	}
+	if strings.TrimSpace(request.EvidenceRef) == "" {
+		return gate, errDevelopmentEvidenceRequired
+	}
+	switch request.NextStage {
+	case work.DevelopmentCanary:
+		gate.CanaryEvidence = strings.TrimSpace(request.EvidenceRef)
+	case work.DevelopmentPromoted:
+		gate.PromotionRef = strings.TrimSpace(request.EvidenceRef)
+	case work.DevelopmentRolledBack:
+		gate.RollbackRef = strings.TrimSpace(request.EvidenceRef)
+	default:
+		return gate, errDevelopmentEvidenceStage
+	}
+	advanced, err := advanceDevelopmentGate(gate, request.NextStage, now)
+	if err != nil {
+		return gate, err
+	}
+	if err := store.SaveDevelopmentGate(ctx, advanced, request.ExpectedRevision); err != nil {
+		return gate, err
+	}
+	return advanced, nil
+}
+
+func verifyDevelopmentGate(ctx context.Context, store ports.DevelopmentGateStore, request developmentGateVerificationRequest, now time.Time, runner developmentexecutor.CommandRunner) (work.DevelopmentGate, developmentexecutor.Result, error) {
+	gate, err := store.LoadDevelopmentGate(ctx, request.GateID)
+	if err != nil {
+		return work.DevelopmentGate{}, developmentexecutor.Result{}, err
+	}
+	if request.ExpectedRevision < 1 || gate.Revision != request.ExpectedRevision || gate.Stage != work.DevelopmentIsolated {
+		return gate, developmentexecutor.Result{}, errDevelopmentGateNotIsolated
+	}
+	if request.VerifierRunID == "" || sameRun(request.VerifierRunID, gate.ProducerRunRefs) {
+		return gate, developmentexecutor.Result{}, errDevelopmentVerifierNotIndependent
+	}
+	if request.Plan.WorktreeID != gate.WorktreeRef {
+		return gate, developmentexecutor.Result{}, errDevelopmentWorktreeMismatch
+	}
+	result, err := developmentexecutor.Execute(ctx, request.Plan, runner)
+	if err != nil {
+		return gate, result, err
+	}
+	if !result.Passed {
+		return gate, result, errDevelopmentChecksFailed
+	}
+	gate.VerifierRunRefs = append(append([]work.AgentRunID(nil), gate.VerifierRunRefs...), request.VerifierRunID)
+	gate.VerificationEvidence = result.EvidenceRef
+	advanced, err := advanceDevelopmentGate(gate, work.DevelopmentVerified, now)
+	if err != nil {
+		return gate, result, err
+	}
+	if err := store.SaveDevelopmentGate(ctx, advanced, request.ExpectedRevision); err != nil {
+		return gate, result, err
+	}
+	return advanced, result, nil
+}
+
+func sameRun(value work.AgentRunID, runs []work.AgentRunID) bool {
+	for _, run := range runs {
+		if run == value {
+			return true
+		}
+	}
+	return false
+}
+
+func prepareDevelopmentGate(value work.DevelopmentGate, now time.Time) (work.DevelopmentGate, error) {
+	if value.Stage != work.DevelopmentEvidenceCollected || value.Revision != 1 {
+		return work.DevelopmentGate{}, errDevelopmentGateCreate
+	}
+	value.UpdatedAtUnixMillis = now.UnixMilli()
+	if err := workdomain.ValidateDevelopmentGate(value); err != nil {
+		return work.DevelopmentGate{}, err
+	}
+	return value, nil
+}
+
+func advanceDevelopmentGate(value work.DevelopmentGate, next work.DevelopmentStage, now time.Time) (work.DevelopmentGate, error) {
+	advanced, err := workdomain.AdvanceDevelopmentGate(value, next)
+	if err != nil {
+		return work.DevelopmentGate{}, err
+	}
+	advanced.Revision = value.Revision + 1
+	advanced.UpdatedAtUnixMillis = now.UnixMilli()
+	return advanced, nil
+}

cmd/core-runtime/development_gate_test.go

@@ -0,0 +1,182 @@
+package main
+
+import (
+	"context"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"git.cin.su/m/Assistant/adapters/developmentexecutor"
+	"git.cin.su/m/Assistant/contracts/work"
+)
+
+type developmentGateStoreStub struct {
+	gate     work.DevelopmentGate
+	saved    bool
+	expected int64
+}
+
+func (s *developmentGateStoreStub) LoadDevelopmentGate(context.Context, string) (work.DevelopmentGate, error) {
+	return s.gate, nil
+}
+
+func (s *developmentGateStoreStub) SaveDevelopmentGate(_ context.Context, gate work.DevelopmentGate, expected int64) error {
+	s.gate = gate
+	s.saved = true
+	s.expected = expected
+	return nil
+}
+
+type developmentCommandRunnerStub struct {
+	exitCodes []int
+	commands  int
+}
+
+func (r *developmentCommandRunnerStub) Run(context.Context, string, string, []string) int {
+	code := 0
+	if r.commands < len(r.exitCodes) {
+		code = r.exitCodes[r.commands]
+	}
+	r.commands++
+	return code
+}
+
+func validDevelopmentVerificationPlan(t *testing.T, worktreeID string) developmentexecutor.Plan {
+	t.Helper()
+	worktree, err := filepath.Abs(".")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return developmentexecutor.Plan{
+		Worktree:            worktree,
+		WorktreeID:          worktreeID,
+		BaseRepoRevision:    "base-revision",
+		ProtectedMainAccess: "DENIED",
+		ProductionAccess:    "DENIED",
+		SecretAccess:        "DENIED",
+		Checks:              []developmentexecutor.Check{{Kind: developmentexecutor.CheckGitDiffCheck}},
+	}
+}
+
+func isolatedDevelopmentGate() work.DevelopmentGate {
+	return work.DevelopmentGate{
+		ID:                   "gate-1",
+		Revision:             4,
+		Stage:                work.DevelopmentIsolated,
+		EvidenceRefs:         []string{"evidence-1"},
+		ProposalRef:          "proposal-1",
+		TaskPacketRef:        "task-1",
+		WorktreeRef:          "sandbox-1",
+		ProducerRunRefs:      []work.AgentRunID{"producer-1"},
+		VerifierRunRefs:      nil,
+		VerificationEvidence: "",
+	}
+}
+
+func TestVerifyDevelopmentGatePersistsVerifiedWithIndependentEvidence(t *testing.T) {
+	store := &developmentGateStoreStub{gate: isolatedDevelopmentGate()}
+	runner := &developmentCommandRunnerStub{exitCodes: []int{0}}
+	gate, result, err := verifyDevelopmentGate(context.Background(), store, developmentGateVerificationRequest{
+		GateID:           "gate-1",
+		ExpectedRevision: 4,
+		VerifierRunID:    "verifier-1",
+		Plan:             validDevelopmentVerificationPlan(t, "sandbox-1"),
+	}, time.UnixMilli(20), runner)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !result.Passed || gate.Stage != work.DevelopmentVerified || gate.Revision != 5 {
+		t.Fatalf("verification did not advance gate: gate=%#v result=%#v", gate, result)
+	}
+	if !store.saved || store.expected != 4 || gate.VerificationEvidence == "" {
+		t.Fatalf("verification was not durably persisted: store=%#v gate=%#v", store, gate)
+	}
+}
+
+func TestVerifyDevelopmentGateLeavesIsolatedOnFailedChecks(t *testing.T) {
+	store := &developmentGateStoreStub{gate: isolatedDevelopmentGate()}
+	gate, result, err := verifyDevelopmentGate(context.Background(), store, developmentGateVerificationRequest{
+		GateID:           "gate-1",
+		ExpectedRevision: 4,
+		VerifierRunID:    "verifier-1",
+		Plan:             validDevelopmentVerificationPlan(t, "sandbox-1"),
+	}, time.UnixMilli(20), &developmentCommandRunnerStub{exitCodes: []int{1}})
+	if err != errDevelopmentChecksFailed || result.Passed || gate.Stage != work.DevelopmentIsolated || store.saved {
+		t.Fatalf("failed checks changed gate unexpectedly: gate=%#v result=%#v err=%v store=%#v", gate, result, err, store)
+	}
+}
+
+func TestVerifyDevelopmentGateRejectsProducerAsVerifier(t *testing.T) {
+	store := &developmentGateStoreStub{gate: isolatedDevelopmentGate()}
+	_, _, err := verifyDevelopmentGate(context.Background(), store, developmentGateVerificationRequest{
+		GateID:           "gate-1",
+		ExpectedRevision: 4,
+		VerifierRunID:    "producer-1",
+		Plan:             validDevelopmentVerificationPlan(t, "sandbox-1"),
+	}, time.UnixMilli(20), &developmentCommandRunnerStub{exitCodes: []int{0}})
+	if err != errDevelopmentVerifierNotIndependent {
+		t.Fatalf("producer was accepted as verifier: %v", err)
+	}
+}
+
+func TestRecordDevelopmentGateEvidenceAdvancesCanaryAndPromotion(t *testing.T) {
+	store := &developmentGateStoreStub{gate: work.DevelopmentGate{
+		ID: "gate-1", Revision: 6, Stage: work.DevelopmentVerified,
+		EvidenceRefs: []string{"evidence-1"}, ProposalRef: "proposal-1", TaskPacketRef: "task-1", WorktreeRef: "sandbox-1",
+		ProducerRunRefs: []work.AgentRunID{"producer-1"}, VerifierRunRefs: []work.AgentRunID{"verifier-1"}, VerificationEvidence: "verification-1",
+	}}
+	gate, err := recordDevelopmentGateEvidence(context.Background(), store, developmentGateEvidenceRequest{GateID: "gate-1", ExpectedRevision: 6, NextStage: work.DevelopmentCanary, EvidenceRef: "canary-1"}, time.UnixMilli(30))
+	if err != nil || gate.Stage != work.DevelopmentCanary || gate.Revision != 7 || gate.CanaryEvidence != "canary-1" {
+		t.Fatalf("canary transition failed: gate=%#v err=%v", gate, err)
+	}
+	gate, err = recordDevelopmentGateEvidence(context.Background(), store, developmentGateEvidenceRequest{GateID: "gate-1", ExpectedRevision: 7, NextStage: work.DevelopmentPromoted, EvidenceRef: "promotion-1"}, time.UnixMilli(31))
+	if err != nil || gate.Stage != work.DevelopmentPromoted || gate.Revision != 8 || gate.PromotionRef != "promotion-1" {
+		t.Fatalf("promotion transition failed: gate=%#v err=%v", gate, err)
+	}
+}
+
+func TestRecordDevelopmentGateEvidenceSupportsCanaryRollbackAndRejectsMissingEvidence(t *testing.T) {
+	store := &developmentGateStoreStub{gate: work.DevelopmentGate{ID: "gate-1", Revision: 2, Stage: work.DevelopmentCanary, EvidenceRefs: []string{"evidence-1"}, CanaryEvidence: "canary-1"}}
+	gate, err := recordDevelopmentGateEvidence(context.Background(), store, developmentGateEvidenceRequest{GateID: "gate-1", ExpectedRevision: 2, NextStage: work.DevelopmentRolledBack, EvidenceRef: "rollback-1"}, time.UnixMilli(40))
+	if err != nil || gate.Stage != work.DevelopmentRolledBack || gate.RollbackRef != "rollback-1" {
+		t.Fatalf("rollback transition failed: gate=%#v err=%v", gate, err)
+	}
+	store = &developmentGateStoreStub{gate: work.DevelopmentGate{ID: "gate-2", Revision: 2, Stage: work.DevelopmentCanary, EvidenceRefs: []string{"evidence-1"}, CanaryEvidence: "canary-1"}}
+	gate, err = recordDevelopmentGateEvidence(context.Background(), store, developmentGateEvidenceRequest{GateID: "gate-2", ExpectedRevision: 2, NextStage: work.DevelopmentRolledBack}, time.UnixMilli(40))
+	if err != errDevelopmentEvidenceRequired || gate.Stage != work.DevelopmentCanary || store.saved {
+		t.Fatalf("missing rollback evidence changed gate: gate=%#v err=%v store=%#v", gate, err, store)
+	}
+}
+
+func TestDevelopmentGateControllerRequiresSequentialVerifiedEvidence(t *testing.T) {
+	now := time.UnixMilli(10)
+	gate, err := prepareDevelopmentGate(work.DevelopmentGate{ID: "gate-1", Revision: 1, Stage: work.DevelopmentEvidenceCollected, EvidenceRefs: []string{"evidence-1"}}, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	gate.ProposalRef = "proposal-1"
+	gate, err = advanceDevelopmentGate(gate, work.DevelopmentProposalCreated, now)
+	if err != nil || gate.Revision != 2 {
+		t.Fatalf("proposal transition failed: %#v %v", gate, err)
+	}
+	gate.TaskPacketRef = "task-1"
+	gate, err = advanceDevelopmentGate(gate, work.DevelopmentTaskAdmitted, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	gate.WorktreeRef = "isolated-worktree"
+	gate, err = advanceDevelopmentGate(gate, work.DevelopmentIsolated, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	gate.ProducerRunRefs = []work.AgentRunID{"producer"}
+	gate.VerifierRunRefs = []work.AgentRunID{"verifier"}
+	gate.VerificationEvidence = "verification-1"
+	gate, err = advanceDevelopmentGate(gate, work.DevelopmentVerified, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := advanceDevelopmentGate(gate, work.DevelopmentPromoted, now); err == nil {
+		t.Fatal("promotion bypassed canary")
+	}
+}

cmd/core-runtime/household_scenario_test.go

@@ -0,0 +1,123 @@
+package main
+
+import (
+	"testing"
+	"time"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	interactiondomain "git.cin.su/m/Assistant/modules/interaction/domain"
+)
+
+func TestHouseholdResearchAndActionRoutesRemainIndependent(t *testing.T) {
+	candidate := interactiondomain.BuildDeterministicCandidate("проверь погоду в Казани, найди кафе рядом и напомни вечером позвонить", "", time.Unix(10, 0).UnixMilli())
+	planned := buildChatRoutePlan(interactiondomain.SemanticResult{NeedsCognition: candidate.NeedsCognition, CapabilityHints: candidate.CapabilityHints})
+	want := map[chatRouteKind]bool{chatRouteResearch: false, chatRouteConversation: false, chatRouteAction: false}
+	for _, route := range planned {
+		if _, ok := want[route.Kind]; ok {
+			want[route.Kind] = true
+		}
+	}
+	for kind, present := range want {
+		if !present {
+			t.Fatalf("route %s missing for mixed household request: candidate=%+v routes=%+v", kind, candidate, planned)
+		}
+	}
+}
+
+func TestHouseholdCreativeRouteDoesNotUseResearch(t *testing.T) {
+	candidate := interactiondomain.BuildDeterministicCandidate("расскажи сказку о Колобке", "", time.Unix(10, 0).UnixMilli())
+	for _, hint := range candidate.CapabilityHints {
+		if capability.CapabilityKind(hint) == capability.CapabilityKindWebResearch {
+			t.Fatalf("creative request selected web research: %+v", candidate)
+		}
+	}
+	if !interactiondomain.IsCreativeRequest("расскажи сказку о Колобке") {
+		t.Fatal("creative request was not recognized")
+	}
+}
+
+func TestHouseholdMarketplaceBrandSearchUsesResearchRoute(t *testing.T) {
+	candidate := interactiondomain.BuildDeterministicCandidate("найди на WB бренд marka-wear", "", time.Unix(10, 0).UnixMilli())
+	decomposition := interactiondomain.DecomposeTaskWithLexicon("найди на WB бренд marka-wear", interactiondomain.TaskLexicon{ObjectAliases: []interactiondomain.TaskLexiconEntry{{Alias: "бренд", Value: "BRAND"}}, SourceAliases: []interactiondomain.TaskLexiconEntry{{Alias: "wb", Value: "WILDBERRIES"}}})
+	if decomposition.Intent != interactiondomain.TaskIntentSearch || decomposition.Object != "BRAND" || decomposition.Source != "WILDBERRIES" || decomposition.Target != "marka-wear" || len(decomposition.Missing) != 0 {
+		t.Fatalf("marketplace request was not split into executable atoms: %+v", decomposition)
+	}
+	routes := buildChatRoutePlan(interactiondomain.SemanticResult{NeedsCognition: candidate.NeedsCognition, CapabilityHints: candidate.CapabilityHints})
+	if !hasChatRoute(routes, chatRouteResearch) {
+		t.Fatalf("marketplace brand request did not select research route: candidate=%+v routes=%+v", candidate, routes)
+	}
+}
+
+func TestHouseholdSemanticMemoryControlsMarketplaceAlias(t *testing.T) {
+	withoutMemory := interactiondomain.DecomposeTask("найди на WB бренд marka-wear")
+	if withoutMemory.Source != "" || withoutMemory.Object != "" {
+		t.Fatalf("core invented marketplace meaning without memory: %+v", withoutMemory)
+	}
+	withMemory := interactiondomain.DecomposeTaskWithLexicon("поищи марку marka-wear в Wildberries", interactiondomain.TaskLexicon{
+		ObjectAliases: []interactiondomain.TaskLexiconEntry{{Alias: "марку", Value: "BRAND"}},
+		SourceAliases: []interactiondomain.TaskLexiconEntry{{Alias: "wildberries", Value: "WILDBERRIES"}},
+	})
+	if withMemory.Intent != interactiondomain.TaskIntentSearch || withMemory.Object != "BRAND" || withMemory.Source != "WILDBERRIES" || withMemory.Target != "marka-wear" || !withMemory.NeedsResearch {
+		t.Fatalf("semantic memory did not control marketplace decomposition: %+v", withMemory)
+	}
+}
+
+func TestHouseholdBearDrawingUsesCreativeLocalRoute(t *testing.T) {
+	candidate := interactiondomain.BuildDeterministicCandidate("нарисуй бурого медведя", "", time.Unix(10, 0).UnixMilli())
+	decomposition := interactiondomain.DecomposeTaskWithLexicon("нарисуй бурого медведя", interactiondomain.TaskLexicon{ObjectAliases: []interactiondomain.TaskLexiconEntry{{Alias: "медвед", Value: "IMAGE"}}})
+	if decomposition.Intent != interactiondomain.TaskIntentCreate || decomposition.Object != "IMAGE" || decomposition.Target != "бурого медведя" || decomposition.NeedsResearch {
+		t.Fatalf("creative request was not split into local execution atoms: %+v", decomposition)
+	}
+	routes := buildChatRoutePlan(interactiondomain.SemanticResult{NeedsCognition: candidate.NeedsCognition, CapabilityHints: candidate.CapabilityHints})
+	if !hasChatRoute(routes, chatRouteMedia) {
+		t.Fatalf("creative image request did not select media route: candidate=%+v routes=%+v", candidate, routes)
+	}
+	for _, hint := range candidate.CapabilityHints {
+		if capability.CapabilityKind(hint) == capability.CapabilityKindWebResearch {
+			t.Fatalf("bear drawing selected web research: %+v", candidate)
+		}
+	}
+	for _, message := range []string{"нарисуй бурого медведя", "нарисуй птицу", "нарисуй зеленую птицу", "нарисуй птицу в HD", "нарисуй коня"} {
+		if got := interactiondomain.CreativeDeterministicReply(message); got != "" {
+			t.Fatalf("creative request %q received a canned reply=%q", message, got)
+		}
+	}
+}
+
+func TestHouseholdRouteMatrixKeepsMeaningBoundaries(t *testing.T) {
+	tests := []struct {
+		message      string
+		wantResearch bool
+		wantCreative bool
+		wantHint     string
+	}{
+		{message: "найди на WB бренд marka-wear", wantResearch: true},
+		{message: "какая погода в Казани?", wantResearch: true},
+		{message: "найди билеты до Сочи", wantResearch: true},
+		{message: "нарисуй птицу", wantCreative: true},
+		{message: "расскажи сказку о Колобке", wantCreative: true},
+		{message: "что такое гравитация?", wantHint: "COGNITIVE_REASONING"},
+	}
+	for _, test := range tests {
+		candidate := interactiondomain.BuildDeterministicCandidate(test.message, "", time.Unix(10, 0).UnixMilli())
+		if interactiondomain.IsCreativeRequest(test.message) != test.wantCreative {
+			t.Fatalf("message=%q creative=%v want=%v candidate=%+v", test.message, interactiondomain.IsCreativeRequest(test.message), test.wantCreative, candidate)
+		}
+		gotResearch := false
+		gotHint := false
+		for _, hint := range candidate.CapabilityHints {
+			if hint == "WEB_RESEARCH" {
+				gotResearch = true
+			}
+			if hint == test.wantHint {
+				gotHint = true
+			}
+		}
+		if gotResearch != test.wantResearch {
+			t.Fatalf("message=%q research=%v want=%v candidate=%+v", test.message, gotResearch, test.wantResearch, candidate)
+		}
+		if test.wantHint != "" && !gotHint {
+			t.Fatalf("message=%q missing hint=%q candidate=%+v", test.message, test.wantHint, candidate)
+		}
+	}
+}

cmd/core-runtime/information_request_test.go

@@ -0,0 +1,27 @@
+package main
+
+import (
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/interaction"
+)
+
+func TestSpecializedInformationReplyIsNotOverwrittenByResearch(t *testing.T) {
+	for _, kind := range []interaction.InformationRequestKind{
+		interaction.InformationRequestMemoryInventory,
+		interaction.InformationRequestCapabilityInventory,
+		interaction.InformationRequestCognitiveModelInventory,
+		interaction.InformationRequestCognitiveChannelStatus,
+		interaction.InformationRequestCognitiveRecovery,
+	} {
+		if shouldRunGeneralResearch(kind) {
+			t.Fatalf("specialized information request %q must bypass general research", kind)
+		}
+	}
+	if !shouldRunGeneralResearch(interaction.InformationRequestTimeDifference) {
+		t.Fatal("time difference must use the current-data research route")
+	}
+	if !shouldRunGeneralResearch("") {
+		t.Fatal("ordinary research requests must still use general research")
+	}
+}

cmd/core-runtime/main_test.go

@@ -11,10 +11,140 @@ import (
 	"time"
 
 	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/epistemics"
 	"git.cin.su/m/Assistant/contracts/interaction"
 	interactiondomain "git.cin.su/m/Assistant/modules/interaction/domain"
 )
 
+func TestHumanResearchExcerptRemovesSearchResultHeading(t *testing.T) {
+	got := humanResearchExcerpt("погода в Санкт-Петербурге", "Погода в Санкт-Петербурге — Прогноз погоды — Сейчас пасмурно, температура +14°")
+	if got != "Сейчас пасмурно, температура +14°" || strings.Contains(got, "Прогноз погоды") {
+		t.Fatalf("human research excerpt = %q", got)
+	}
+}
+
+func TestNearestFlightEvidenceDoesNotClaimMissingDepartureTime(t *testing.T) {
+	if !nearestFlightQuery("ближайший рейс Москва Казань сегодня") {
+		t.Fatal("nearest flight query was not recognized")
+	}
+	if containsFlightTimeEvidence("Казань составляет 1 ч 25 мин. График вылетов доступен онлайн") {
+		t.Fatal("duration was mistaken for a departure time")
+	}
+	if !containsFlightTimeEvidence("Ближайший вылет в 18:40") {
+		t.Fatal("departure time was not recognized")
+	}
+}
+
+func TestNearestFlightReplyFiltersUnrelatedSearchSnippets(t *testing.T) {
+	result := epistemics.ResearchResult{Findings: []epistemics.ResearchFinding{
+		{State: epistemics.FindingSupported, Source: epistemics.Source{Locator: "https://naidy.example", Title: "Мебельная фурнитура"}, Excerpt: epistemics.SourceExcerpt{Text: "Комплектующие для мебели оптом и в розницу."}},
+		{State: epistemics.FindingSupported, Source: epistemics.Source{Locator: "https://rasp.example", Title: "Рейсы Москва — Казань"}, Excerpt: epistemics.SourceExcerpt{Text: "Расписание самолётов Москва — Казань, время вылета и прилёта."}},
+	}}
+	reply, backed := renderResearchReply("ближайшие авиарейсы Москва Казань сегодня", result, nil)
+	if !backed || !strings.Contains(reply, "Рейсы Москва") || strings.Contains(reply, "Мебельная") {
+		t.Fatalf("unrelated source leaked into flight reply: %q", reply)
+	}
+}
+
+func TestNearestFlightEvidenceRequiresBothRouteEndpointsWhenKnown(t *testing.T) {
+	query := "ближайшие авиарейсы Москва Казань сегодня"
+	matched := epistemics.ResearchFinding{Source: epistemics.Source{Title: "Рейсы Москва — Казань"}, Excerpt: epistemics.SourceExcerpt{Text: "Расписание авиарейсов из Москвы в Казань."}}
+	if !researchFindingMatchesIntent(query, matched) {
+		t.Fatal("route evidence with both endpoints was rejected")
+	}
+	unrelated := epistemics.ResearchFinding{Source: epistemics.Source{Title: "Рейсы Москва — Казань", Locator: "https://example.test/moscow-kazan"}, Excerpt: epistemics.SourceExcerpt{Text: "Рейсы Москва — Казань — Ближайшие к Казани города; цена указана ориентировочно."}}
+	if researchFindingMatchesIntent(query, unrelated) {
+		t.Fatal("one-ended travel evidence was accepted")
+	}
+}
+
+func TestTicketReplyRejectsGenericCategoryPageWithoutDestination(t *testing.T) {
+	query := "найди билеты до Ялты сегодня"
+	generic := epistemics.ResearchFinding{Source: epistemics.Source{Title: "Купить билеты", Locator: "https://tickets.example"}, Excerpt: epistemics.SourceExcerpt{Text: "Поиск авиабилетов среди множества направлений."}}
+	if researchFindingMatchesIntent(query, generic) {
+		t.Fatal("generic ticket category was presented as destination result")
+	}
+	relevant := epistemics.ResearchFinding{Source: epistemics.Source{Title: "Билеты"}, Excerpt: epistemics.SourceExcerpt{Text: "Билеты до Ялты: варианты на сегодня."}}
+	if !researchFindingMatchesIntent(query, relevant) {
+		t.Fatal("destination-specific ticket result was rejected")
+	}
+}
+
+func TestDistanceReplyRejectsCalculatorPageWithoutDistance(t *testing.T) {
+	query := "расстояние между Москве и Сочи в километрах по прямой и по дороге"
+	calculator := epistemics.ResearchFinding{Source: epistemics.Source{Title: "Расчет расстояний"}, Excerpt: epistemics.SourceExcerpt{Text: "Калькулятор рассчитывает точное расстояние между городами."}}
+	if researchFindingMatchesIntent(query, calculator) {
+		t.Fatal("distance calculator landing page was presented without a measured distance")
+	}
+	measured := epistemics.ResearchFinding{Source: epistemics.Source{Title: "Маршрут"}, Excerpt: epistemics.SourceExcerpt{Text: "Расстояние по дороге составляет 1 620 км."}}
+	if !researchFindingMatchesIntent(query, measured) {
+		t.Fatal("measured distance evidence was rejected")
+	}
+}
+
+func TestResearchReplyRejectsGenericLandingPageForConcreteIdentifier(t *testing.T) {
+	result := epistemics.ResearchResult{Findings: []epistemics.ResearchFinding{{
+		State:   epistemics.FindingSupported,
+		Source:  epistemics.Source{Locator: "https://market.example", Title: "Интернет-магазин"},
+		Excerpt: epistemics.SourceExcerpt{Text: "Широкий ассортимент товаров и услуг."},
+	}}}
+	reply, backed := renderResearchReply("на WB бренд marka-wear", result, nil)
+	if backed || !strings.Contains(reply, "marka-wear") || strings.Contains(reply, "wildberries") || !strings.Contains(reply, "уточните написание") {
+		t.Fatalf("generic page was presented as a brand result: %q", reply)
+	}
+}
+
+func TestResearchReplyKeepsFindingContainingConcreteIdentifier(t *testing.T) {
+	result := epistemics.ResearchResult{Findings: []epistemics.ResearchFinding{{
+		State:   epistemics.FindingSupported,
+		Source:  epistemics.Source{Locator: "https://market.example/marka-wear", Title: "Marka-wear"},
+		Excerpt: epistemics.SourceExcerpt{Text: "Бренд marka-wear: товары и карточки."},
+	}}}
+	reply, backed := renderResearchReply("на WB бренд marka-wear", result, nil)
+	if !backed || !strings.Contains(strings.ToLower(reply), "marka-wear") {
+		t.Fatalf("concrete identifier finding was rejected: %q", reply)
+	}
+}
+
+func TestResearchIdentifiersExcludeSearchDate(t *testing.T) {
+	identifiers := requestedResearchIdentifiers("ближайший поезд в Петербург сегодня 26.08.2026")
+	if len(identifiers) != 0 {
+		t.Fatalf("search date was treated as a concrete identifier: %#v", identifiers)
+	}
+}
+
+func TestResearchQueryKeepsDistanceRelationBeforeSearchNormalization(t *testing.T) {
+	history := []interaction.HumanUtterance{{Content: "я сейчас в Москве"}}
+	query := interactiondomain.TravelResearchQuery("сколько километров до Сочи?", history, time.Time{})
+	query = interactiondomain.SearchQueryWithLexicon(query, interactiondomain.TaskLexicon{})
+	if query != "расстояние между Москве и Сочи в километрах по прямой и по дороге" {
+		t.Fatalf("distance query lost remembered origin: %q", query)
+	}
+}
+
+func TestResponseReviewPreservesAttemptedResearchOutcome(t *testing.T) {
+	if reviewMayReplacePlanningReply(false, false, true, false, "Уточните аэропорт.", "Пока не смог получить проверяемый ответ.") {
+		t.Fatal("review replaced an honest unbacked research outcome")
+	}
+	if !reviewMayReplacePlanningReply(false, false, true, true, "Расписание. Источник: https://example.test", "Расписание. Источник: https://example.test") {
+		t.Fatal("review should be able to improve a source-backed research outcome")
+	}
+	if reviewMayReplacePlanningReply(false, false, true, true, "Расписание без ссылки", "Расписание. Источник: https://example.test") {
+		t.Fatal("review dropped the research evidence")
+	}
+	if !reviewMayReplacePlanningReply(false, false, false, false, "Нормальный ответ", "Черновик") {
+		t.Fatal("ordinary conversation review was unexpectedly blocked")
+	}
+	if !reviewMayReplacePlanningReply(true, true, false, false, "Санкт-Петербург — город в России.", "Меня зовут Домовой. Санкт-Петербург — город в России.") {
+		t.Fatal("stable-knowledge draft must be eligible for semantic quality review")
+	}
+	// The caller must not mark a source-backed research result as immutable
+	// semantic state: it may be rewritten, but only with its evidence retained.
+	if !reviewMayReplacePlanningReply(false, false, true, true, "Из Москвы в Сочи можно добраться самолётом или поездом. Источник: https://example.test", "Сырые результаты. Источник: https://example.test") {
+		t.Fatal("source-backed research draft must be eligible for human-facing review")
+	}
+}
+
 func TestBearerTokenRequiresBearerScheme(t *testing.T) {
 	request := httptest.NewRequest("GET", "/", nil)
 	request.Header.Set("Authorization", "Basic value")
@@ -27,6 +157,59 @@ func TestBearerTokenRequiresBearerScheme(t *testing.T) {
 	}
 }
 
+func TestLatestAssistantNameUsesNewestDurablePreference(t *testing.T) {
+	history := []interaction.HumanUtterance{
+		{Content: "я назову тебя Дед", ReceivedAtUnixMillis: 20},
+		{Content: "теперь тебя зовут Фея", ReceivedAtUnixMillis: 30},
+	}
+	if got := latestAssistantName(history); got != "Фея" {
+		t.Fatalf("latest assistant name = %q", got)
+	}
+}
+
+func TestHumanMemoryInventoryUsesNewestPreference(t *testing.T) {
+	history := []interaction.HumanUtterance{
+		{Content: "мне нравится синий цвет", ReceivedAtUnixMillis: 20},
+		{Content: "мне нравится красный цвет", ReceivedAtUnixMillis: 30},
+	}
+	got := humanMemoryInventory(history, "Фея")
+	if !strings.Contains(got, "красный") || strings.Contains(got, "синий") {
+		t.Fatalf("memory inventory did not select newest preference: %q", got)
+	}
+}
+
+func TestContainsScheduleTimeEvidence(t *testing.T) {
+	if containsScheduleTimeEvidence("расписание поездов и цена билета") {
+		t.Fatal("a price or schedule label is not a departure time")
+	}
+	if !containsScheduleTimeEvidence("Отправление в 07:45") {
+		t.Fatal("expected an explicit departure time to be recognized")
+	}
+}
+
+func TestInternetStatusQueryRecognizesConnectionChecks(t *testing.T) {
+	for _, query := range []string{"проверь, работает ли интернет", "есть доступ к сети?"} {
+		if !isInternetStatusQuery(query) {
+			t.Fatalf("connection check was not recognized: %q", query)
+		}
+	}
+	if isInternetStatusQuery("найди интернет-магазин") {
+		t.Fatal("ordinary search must not be treated as a connectivity check")
+	}
+}
+
+func TestInternetStatusReplyDoesNotLeakIncidentalSearchResults(t *testing.T) {
+	result := epistemics.ResearchResult{Findings: []epistemics.ResearchFinding{{
+		State:   epistemics.FindingSupported,
+		Source:  epistemics.Source{Locator: "https://example.test", Title: "Incidental page"},
+		Excerpt: epistemics.SourceExcerpt{Text: "A response was received."},
+	}}}
+	reply, backed := renderResearchReply("проверь, работает ли интернет", result, nil)
+	if !backed || reply != "Интернет работает: Домовой получил ответ от внешнего источника." {
+		t.Fatalf("unexpected internet status reply: %q", reply)
+	}
+}
+
 func TestCognitiveChannelQuestionUsesHumanSafeHealthReply(t *testing.T) {
 	reply := humanCognitiveChannelReply(interaction.InformationRequestCognitiveChannelStatus, interaction.SpeechActQuestion, capability.Health{State: capability.HealthAvailable, CapabilityID: "provider-secret-model"}, nil)
 	if !strings.Contains(reply, "доступен") || strings.Contains(reply, "provider-secret-model") {
@@ -34,16 +217,23 @@ func TestCognitiveChannelQuestionUsesHumanSafeHealthReply(t *testing.T) {
 	}
 }
 
+func TestCurrentModelReplyDoesNotInventProvider(t *testing.T) {
+	reply := humanCurrentCognitiveModelReply(capability.Health{State: capability.HealthDegraded, CapabilityID: "provider-secret-model"}, nil)
+	if !strings.Contains(reply, "встроенным режимом") || !strings.Contains(reply, "ограничениями") || strings.Contains(reply, "provider-secret-model") {
+		t.Fatalf("unexpected current-model reply: %q", reply)
+	}
+}
+
 func TestCognitiveConfigurationRequestDoesNotPretendToMutate(t *testing.T) {
 	reply := humanCognitiveChannelReply(interaction.InformationRequestCognitiveRecovery, interaction.SpeechActDirective, capability.Health{State: capability.HealthUnavailable}, nil)
-	if !strings.Contains(reply, "Домовой жив") || !strings.Contains(reply, "аварийн") {
+	if reply != "Канал мышления недоступен. Домовой остаётся на связи." {
 		t.Fatalf("unexpected configuration reply: %q", reply)
 	}
 }
 
 func TestCognitiveDegradedReplyKeepsDomovoyAlive(t *testing.T) {
 	reply := humanCognitiveDegradedReply("Помоги настроить локальную модель")
-	if !strings.Contains(reply, "Домовой жив") || !strings.Contains(reply, "принято") {
+	if strings.Contains(reply, "когнитивный канал") || strings.Contains(reply, "Повторю") || !strings.Contains(reply, "не выдумываю") {
 		t.Fatalf("unexpected degraded reply: %q", reply)
 	}
 }
@@ -74,11 +264,21 @@ func TestHumanCognitiveModelInventoryDoesNotExposeSecrets(t *testing.T) {
 		Provider: capability.ProviderInstance{Kind: "openai-compatible-chat-v1", CredentialRef: "secret-ref", AuthMode: capability.AuthKey, BillingMode: capability.BillingPerRequest, RequestCostMicros: &cost, Health: capability.HealthAvailable},
 		Model:    capability.ModelDescriptor{ProviderModelID: "example-model", Health: capability.HealthAvailable},
 	}}, nil)
-	if strings.Contains(text, "secret-ref") || strings.Contains(text, "25") || !strings.Contains(text, "example-model") || !strings.Contains(text, "API-ключ") {
+	if strings.Contains(text, "secret-ref") || strings.Contains(text, "25") || !strings.Contains(text, "example-model") || !strings.Contains(text, "активна") {
 		t.Fatalf("unsafe or incomplete inventory: %q", text)
 	}
 }
 
+func TestHumanCognitiveModelInventoryDeduplicatesAndPrioritizesAvailable(t *testing.T) {
+	text := humanCognitiveModelInventory([]capability.ResolvedCognitiveBinding{
+		{Binding: capability.CognitiveBinding{Activation: capability.ActivationInactive}, Provider: capability.ProviderInstance{Health: capability.HealthUnavailable}, Model: capability.ModelDescriptor{ProviderModelID: "same-model", Health: capability.HealthUnavailable}},
+		{Binding: capability.CognitiveBinding{Activation: capability.ActivationActive}, Provider: capability.ProviderInstance{Health: capability.HealthAvailable}, Model: capability.ModelDescriptor{ProviderModelID: "same-model", Health: capability.HealthAvailable}},
+	}, nil)
+	if strings.Count(text, "same-model") != 1 || !strings.Contains(text, "same-model — активна") {
+		t.Fatalf("expected one active model entry, got %q", text)
+	}
+}
+
 func TestCreatorSessionHandlerAcceptsConfiguredCredentials(t *testing.T) {
 	handler := creatorSessionHandler("recovery", "m", "password", []byte("01234567890123456789012345678901"), func() time.Time { return time.Unix(1000, 0) })
 	request := httptest.NewRequest(http.MethodPost, "/v1/creator/sessions", strings.NewReader(`{"username":"m","password":"password"}`))

cmd/core-runtime/research_client.go

@@ -0,0 +1,78 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"git.cin.su/m/Assistant/contracts/epistemics"
+)
+
+type researchRuntimeClient struct {
+	baseURL string
+	client  *http.Client
+}
+
+func newResearchRuntimeClient(rawURL string, client *http.Client) (researchRuntimeClient, error) {
+	base := strings.TrimRight(strings.TrimSpace(rawURL), "/")
+	if base == "" {
+		return researchRuntimeClient{}, fmt.Errorf("research runtime URL is empty")
+	}
+	if client == nil {
+		client = http.DefaultClient
+	}
+	return researchRuntimeClient{baseURL: base, client: client}, nil
+}
+
+func (c researchRuntimeClient) EvaluateWeb(ctx context.Context, request epistemics.WebResearchRequest) (epistemics.ResearchResult, error) {
+	payload, err := json.Marshal(request)
+	if err != nil {
+		return epistemics.ResearchResult{}, err
+	}
+	httpRequest, err := http.NewRequestWithContext(ctx, http.MethodPost, c.baseURL+"/v1/research/web/evaluate", bytes.NewReader(payload))
+	if err != nil {
+		return epistemics.ResearchResult{}, err
+	}
+	httpRequest.Header.Set("Content-Type", "application/json")
+	response, err := c.client.Do(httpRequest)
+	if err != nil {
+		return epistemics.ResearchResult{}, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		return epistemics.ResearchResult{}, fmt.Errorf("research runtime status %d", response.StatusCode)
+	}
+	var result epistemics.ResearchResult
+	if err := json.NewDecoder(response.Body).Decode(&result); err != nil {
+		return epistemics.ResearchResult{}, err
+	}
+	return result, nil
+}
+
+func (c researchRuntimeClient) SearchWeb(ctx context.Context, request epistemics.WebSearchRequest) (epistemics.ResearchResult, error) {
+	payload, err := json.Marshal(request)
+	if err != nil {
+		return epistemics.ResearchResult{}, err
+	}
+	httpRequest, err := http.NewRequestWithContext(ctx, http.MethodPost, c.baseURL+"/v1/research/web/search", bytes.NewReader(payload))
+	if err != nil {
+		return epistemics.ResearchResult{}, err
+	}
+	httpRequest.Header.Set("Content-Type", "application/json")
+	response, err := c.client.Do(httpRequest)
+	if err != nil {
+		return epistemics.ResearchResult{}, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		return epistemics.ResearchResult{}, fmt.Errorf("research search status %d", response.StatusCode)
+	}
+	var result epistemics.ResearchResult
+	if err := json.NewDecoder(response.Body).Decode(&result); err != nil {
+		return epistemics.ResearchResult{}, err
+	}
+	return result, nil
+}

cmd/core-runtime/research_client_test.go

@@ -0,0 +1,33 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/epistemics"
+)
+
+func TestResearchRuntimeClientForwardsBoundedWebRequest(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost || r.URL.Path != "/v1/research/web/evaluate" || r.Header.Get("Content-Type") != "application/json" {
+			t.Fatalf("unexpected request: %s %s", r.Method, r.URL.Path)
+		}
+		var request epistemics.WebResearchRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil || request.URL != "https://assistant.cin.su/healthz" {
+			t.Fatalf("unexpected request body: %#v %v", request, err)
+		}
+		_ = json.NewEncoder(w).Encode(epistemics.ResearchResult{PlanID: request.Plan.ID, Findings: []epistemics.ResearchFinding{{PropositionKey: request.PropositionKey, State: epistemics.FindingSupported}}})
+	}))
+	defer server.Close()
+	client, err := newResearchRuntimeClient(server.URL, server.Client())
+	if err != nil {
+		t.Fatal(err)
+	}
+	result, err := client.EvaluateWeb(context.Background(), epistemics.WebResearchRequest{Plan: epistemics.ResearchPlan{ID: "plan-1"}, PropositionKey: "health", URL: "https://assistant.cin.su/healthz"})
+	if err != nil || result.PlanID != "plan-1" || len(result.Findings) != 1 || result.Findings[0].State != epistemics.FindingSupported {
+		t.Fatalf("unexpected result: %#v %v", result, err)
+	}
+}

cmd/creator-web/chat_test.go

@@ -40,6 +40,11 @@ func TestChatPageServedWithoutInternalIDs(t *testing.T) {
 	if !strings.Contains(body, "версия 0123456789ab") || !strings.Contains(body, "обновлено 22.08.2026 03:04 UTC") || !strings.Contains(body, "datetime=\"2026-08-22T03:04:05Z\"") {
 		t.Fatalf("/chat does not render build metadata: %q", body)
 	}
+	for _, required := range []string{"media-tools", "audio-input", "image-input", "ocr-input"} {
+		if !strings.Contains(body, required) {
+			t.Fatalf("/chat is missing multimodal control %q", required)
+		}
+	}
 	for _, path := range []string{"/", "/chat.html"} {
 		alternate := httptest.NewRecorder()
 		handler.ServeHTTP(alternate, httptest.NewRequest(http.MethodGet, path, nil))
@@ -60,6 +65,11 @@ func TestChatScriptExplainsSessionAndRuntimeFailures(t *testing.T) {
 			t.Fatalf("chat script is missing recovery message %q", required)
 		}
 	}
+	for _, required := range []string{"uploadMedia", "/api/multimodal/transcribe", "/api/multimodal/understand", "/api/multimodal/ocr"} {
+		if !strings.Contains(script, required) {
+			t.Fatalf("chat script is missing multimodal route %q", required)
+		}
+	}
 }
 
 func TestPublicSurfacesSeparateChatAndConsole(t *testing.T) {
@@ -151,6 +161,128 @@ func TestChatMessageUsesCoreAndLocalOnlyCognitiveGateway(t *testing.T) {
 	}
 }
 
+func TestChatMessageDoesNotExposeUnverifiedQuestionAsFact(t *testing.T) {
+	core := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == "/v1/creator/sessions/current":
+			_ = json.NewEncoder(w).Encode(identity.CreatorSession{ActorID: "actor-1", PrincipalID: "principal-1"})
+		case r.Method == http.MethodPost && r.URL.Path == "/v1/creator/chat/messages":
+			w.WriteHeader(http.StatusCreated)
+			_ = json.NewEncoder(w).Encode(interaction.ChatMessageResponse{ConversationID: "conversation-1", UtteranceID: "utterance-1", SpeechAct: interaction.SpeechActQuestion, NeedsCognition: true, CapabilityHints: []capability.CapabilityKind{capability.CapabilityKindWebResearch}, FallbackText: "небезопасная модельная догадка"})
+		default:
+			t.Fatalf("unexpected core route %s %s", r.Method, r.URL.Path)
+		}
+	}))
+	defer core.Close()
+	cognitiveRuntime := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost || r.URL.Path != "/v1/advisories" {
+			t.Fatalf("unexpected cognitive route: %s %s", r.Method, r.URL.Path)
+		}
+		var request cognitive.GatewayAdvisoryRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Fatal(err)
+		}
+		_ = json.NewEncoder(w).Encode(cognitive.GatewayAdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: request.RequestID, AdvisoryText: "Я продолжаю искать проверяемый ответ через доступный источник.", FinishReason: cognitive.FinishCompleted})
+	}))
+	defer cognitiveRuntime.Close()
+	handler, err := newHandler(core.URL, "http://continuity", "http://commit", core.Client(), cognitiveRuntime.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := httptest.NewRequest(http.MethodPost, "/api/chat/messages", strings.NewReader(`{"message":"Какая погода?"}`))
+	request.Header.Set("Authorization", "Bearer session-token")
+	request.Header.Set("Content-Type", "application/json")
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, request)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d body=%s", recorder.Code, recorder.Body.String())
+	}
+	var response browserChatResponse
+	if err := json.NewDecoder(recorder.Body).Decode(&response); err != nil {
+		t.Fatal(err)
+	}
+	if response.Cognition != string(cognitive.FinishCompleted) || strings.Contains(response.ReplyText, "небезопасная") || !strings.Contains(response.ReplyText, "продолжаю искать") {
+		t.Fatalf("unexpected research recovery response: %#v", response)
+	}
+}
+
+func TestChatMessageUsesLocalAdvisoryForOrdinaryConversationalQuestion(t *testing.T) {
+	core := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == "/v1/creator/sessions/current":
+			_ = json.NewEncoder(w).Encode(identity.CreatorSession{ActorID: "actor-1", PrincipalID: "principal-1"})
+		case r.Method == http.MethodPost && r.URL.Path == "/v1/creator/chat/messages":
+			w.WriteHeader(http.StatusCreated)
+			_ = json.NewEncoder(w).Encode(interaction.ChatMessageResponse{ConversationID: "conversation-1", UtteranceID: "utterance-1", SpeechAct: interaction.SpeechActQuestion, NeedsCognition: true, FallbackText: "fallback"})
+		default:
+			t.Fatalf("unexpected core route %s %s", r.Method, r.URL.Path)
+		}
+	}))
+	defer core.Close()
+	cognitiveRuntime := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1/advisories" {
+			t.Fatalf("unexpected cognitive path %s", r.URL.Path)
+		}
+		var request cognitive.GatewayAdvisoryRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Fatal(err)
+		}
+		_ = json.NewEncoder(w).Encode(cognitive.GatewayAdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: request.RequestID, AdvisoryText: "Я рядом. Давай поговорим.", FinishReason: cognitive.FinishCompleted})
+	}))
+	defer cognitiveRuntime.Close()
+	handler, err := newHandler(core.URL, "http://continuity", "http://commit", core.Client(), cognitiveRuntime.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := httptest.NewRequest(http.MethodPost, "/api/chat/messages", strings.NewReader(`{"message":"Как ты?"}`))
+	request.Header.Set("Authorization", "Bearer session-token")
+	request.Header.Set("Content-Type", "application/json")
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, request)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d body=%s", recorder.Code, recorder.Body.String())
+	}
+	var response browserChatResponse
+	if err := json.NewDecoder(recorder.Body).Decode(&response); err != nil {
+		t.Fatal(err)
+	}
+	if response.ReplyText != "Я рядом. Давай поговорим." || response.Cognition != string(cognitive.FinishCompleted) {
+		t.Fatalf("unexpected conversational response: %#v", response)
+	}
+}
+
+func TestChatMessagePreservesCompletedCoreAnswerInsteadOfSecondAdvisory(t *testing.T) {
+	core := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == "/v1/creator/sessions/current":
+			_ = json.NewEncoder(w).Encode(identity.CreatorSession{ActorID: "actor-1", PrincipalID: "principal-1"})
+		case r.Method == http.MethodPost && r.URL.Path == "/v1/creator/chat/messages":
+			w.WriteHeader(http.StatusCreated)
+			_ = json.NewEncoder(w).Encode(interaction.ChatMessageResponse{ConversationID: "conversation-1", UtteranceID: "utterance-1", SpeechAct: interaction.SpeechActQuestion, NeedsCognition: true, FallbackText: "fallback", PlanningReply: "Готовый ответ ядра."})
+		default:
+			t.Fatalf("unexpected core route %s %s", r.Method, r.URL.Path)
+		}
+	}))
+	defer core.Close()
+	cognitiveRuntime := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Fatal("completed core answer must not be replaced by a second advisory")
+	}))
+	defer cognitiveRuntime.Close()
+	handler, err := newHandler(core.URL, "http://continuity", "http://commit", core.Client(), cognitiveRuntime.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := httptest.NewRequest(http.MethodPost, "/api/chat/messages", strings.NewReader(`{"message":"Обычный вопрос"}`))
+	request.Header.Set("Authorization", "Bearer session-token")
+	request.Header.Set("Content-Type", "application/json")
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, request)
+	var response browserChatResponse
+	if recorder.Code != http.StatusOK || json.NewDecoder(recorder.Body).Decode(&response) != nil || response.ReplyText != "Готовый ответ ядра." {
+		t.Fatalf("unexpected browser response: status=%d body=%s", recorder.Code, recorder.Body.String())
+	}
+}
+
 func TestChatMessageReturnsHumanCapabilityMetadata(t *testing.T) {
 	core := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch {

cmd/creator-web/main.go

@@ -13,7 +13,14 @@ func main() {
 		envOr("CORE_RUNTIME_URL", "http://core-runtime:8080"),
 		envOr("CONTINUITY_RUNTIME_URL", "http://continuity-runtime:8081"),
 		envOr("COMMIT_RUNTIME_URL", "http://commit-runtime:8082"),
-		&http.Client{Timeout: 10 * time.Second},
+		// Core chat may spend several seconds on semantic interpretation and
+		// local cognition. Keep the browser gateway alive long enough to return
+		// the completed response instead of converting a successful core 201
+		// into a misleading 502.
+		// A cold local model may need more than one short HTTP round-trip to
+		// load on CPU. Keep the browser gateway aligned with the cognition
+		// deadline instead of turning that wait into a false unavailable reply.
+		&http.Client{Timeout: 15 * time.Minute},
 		envOr("COGNITIVE_RUNTIME_URL", "http://cognitive-worker:8083"),
 		envOr("AGENT_WORKER_URL", "http://agent-worker:8090"),
 	)

cmd/creator-web/multimodal_test.go

@@ -0,0 +1,57 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/identity"
+)
+
+func TestMultimodalUploadRequiresSessionAndProxiesLocalResult(t *testing.T) {
+	core := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1/creator/sessions/current" || r.Header.Get("Authorization") != "Bearer session" {
+			t.Fatalf("unexpected session request: %s %q", r.URL.Path, r.Header.Get("Authorization"))
+		}
+		_ = json.NewEncoder(w).Encode(identity.CreatorSession{ActorID: "actor", PrincipalID: "principal"})
+	}))
+	defer core.Close()
+	cognitive := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1/multimodal/transcribe" || r.Method != http.MethodPost {
+			t.Fatalf("unexpected multimodal request: %s %s", r.Method, r.URL.Path)
+		}
+		_ = json.NewEncoder(w).Encode(capability.MultimodalResponse{Operation: capability.MultimodalTranscribe, Text: "локальный текст", Provider: "local-whisper", ObservedAt: 1})
+	}))
+	defer cognitive.Close()
+	handler, err := newHandler(core.URL, "http://continuity.invalid", "http://commit.invalid", core.Client(), cognitive.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	denied := httptest.NewRecorder()
+	handler.ServeHTTP(denied, httptest.NewRequest(http.MethodPost, "/api/multimodal/transcribe", bytes.NewReader(nil)))
+	if denied.Code != http.StatusUnauthorized {
+		t.Fatalf("unauthenticated upload status=%d", denied.Code)
+	}
+	body := &bytes.Buffer{}
+	writer := multipart.NewWriter(body)
+	part, err := writer.CreateFormFile("file", "voice.wav")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, _ = part.Write([]byte("audio"))
+	if err := writer.Close(); err != nil {
+		t.Fatal(err)
+	}
+	request := httptest.NewRequest(http.MethodPost, "/api/multimodal/transcribe", body)
+	request.Header.Set("Authorization", "Bearer session")
+	request.Header.Set("Content-Type", writer.FormDataContentType())
+	response := httptest.NewRecorder()
+	handler.ServeHTTP(response, request)
+	if response.Code != http.StatusOK || !bytes.Contains(response.Body.Bytes(), []byte("локальный текст")) {
+		t.Fatalf("status=%d body=%s", response.Code, response.Body.String())
+	}
+}

cmd/creator-web/responsive_test.go

@@ -0,0 +1,53 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestCreatorConsoleResponsiveGuardrails(t *testing.T) {
+	html, err := staticFiles.ReadFile("static/index.html")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(html), `<meta name="viewport" content="width=device-width, initial-scale=1">`) {
+		t.Fatal("creator console is missing responsive viewport metadata")
+	}
+	css, err := staticFiles.ReadFile("static/assets/console.css")
+	if err != nil {
+		t.Fatal(err)
+	}
+	stylesheet := string(css)
+	for _, guard := range []string{
+		"@media (max-width: 680px)",
+		".console { display: block; }",
+		".diagnostic-list { grid-template-columns: 1fr; }",
+		".agent-details { grid-template-columns: 1fr; gap: 14px; }",
+		".fleet-list { grid-template-columns: repeat(2, minmax(0, 1fr)); }",
+		".section-nav { display: flex;",
+		"overflow-x: auto",
+	} {
+		if !strings.Contains(stylesheet, guard) {
+			t.Fatalf("responsive guardrail missing: %s", guard)
+		}
+	}
+}
+
+func TestChatResponsiveGuardrailsConstrainMobileGridItem(t *testing.T) {
+	css, err := staticFiles.ReadFile("static/assets/chat.css")
+	if err != nil {
+		t.Fatal(err)
+	}
+	stylesheet := string(css)
+	for _, guard := range []string{
+		".chat-view { width: 100%; min-width: 0;",
+		"@media (max-width: 640px)",
+		".chat-layout { height: auto; display: block; }",
+		".chat-header > .operator-link, .build-meta { display: none; }",
+		".chat-header .cognitive-console-link { flex: 0 1 110px;",
+	} {
+		if !strings.Contains(stylesheet, guard) {
+			t.Fatalf("chat responsive guardrail missing: %s", guard)
+		}
+	}
+}

cmd/creator-web/server.go

@@ -7,7 +7,9 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"mime/multipart"
 	"net/http"
+	"net/textproto"
 	"net/url"
 	"os"
 	"strings"
@@ -26,7 +28,11 @@ import (
 const (
 	maxRequestBytes         = 8 << 10
 	maxAdvisoryRequestBytes = 20 << 10
-	maxResponseBytes        = 1 << 20
+	// Chat responses may contain a locally generated image encoded as base64.
+	// Keep the gateway limit aligned with the bounded media transport (32 MiB),
+	// otherwise a successfully generated image is incorrectly surfaced as an
+	// unavailable runtime to the human.
+	maxResponseBytes = 32 << 20
 )
 
 //go:embed static
@@ -135,6 +141,10 @@ func (g *gateway) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			g.handleChatMessage(w, r)
 			return
 		}
+		if r.Method == http.MethodPost && strings.HasPrefix(r.URL.Path, "/api/multimodal/") {
+			g.handleMultimodal(w, r)
+			return
+		}
 		if r.Method == http.MethodGet && r.URL.Path == "/api/fleet/readiness" {
 			g.handleFleetReadiness(w, r)
 			return
@@ -150,7 +160,7 @@ func (g *gateway) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
 		return
 	}
-	if r.URL.Path == "/" || r.URL.Path == "/chat" || r.URL.Path == "/chat.html" {
+	if r.URL.Path == "/" || r.URL.Path == "/login" || r.URL.Path == "/chat" || r.URL.Path == "/chat.html" {
 		g.serveEmbeddedHTML(w, "chat.html")
 		return
 	}
@@ -209,10 +219,13 @@ type browserChatResponse struct {
 	CapabilityKind                 string                      `json:"capability_kind"`
 	CapabilityHints                []capability.CapabilityKind `json:"capability_hints,omitempty"`
 	RequestedOutcome               string                      `json:"requested_outcome,omitempty"`
+	ResearchBacked                 bool                        `json:"research_backed"`
 	InterpretationConfidenceMillis int64                       `json:"interpretation_confidence_millis,omitempty"`
 	DelegationID                   string                      `json:"delegation_id"`
 	DelegationState                string                      `json:"delegation_state"`
 	ReminderScheduled              bool                        `json:"reminder_scheduled"`
+	GeneratedImageContentType      string                      `json:"generated_image_content_type,omitempty"`
+	GeneratedImageBase64           string                      `json:"generated_image_base64,omitempty"`
 }
 
 func (g *gateway) handleAdvisoryPolicy(w http.ResponseWriter, r *http.Request) {
@@ -467,7 +480,10 @@ func (g *gateway) handleChatMessage(w http.ResponseWriter, r *http.Request) {
 			saved.NeedsCognition = false
 		}
 	}
-	if saved.NeedsCognition && !saved.WorkPlanned && saved.Clarification != interaction.ClarificationRequired {
+	// Core owns the completed planning answer. The browser may ask for a local
+	// advisory only when core explicitly left the turn unanswered; otherwise a
+	// second model pass can replace a grounded result with a weaker one.
+	if saved.NeedsCognition && saved.PlanningReply == "" && !saved.WorkPlanned && saved.Clarification != interaction.ClarificationRequired {
 		cognition = "unavailable"
 		requestID, idErr := ids.New()
 		if idErr == nil {
@@ -478,7 +494,7 @@ func (g *gateway) handleChatMessage(w http.ResponseWriter, r *http.Request) {
 				status, err = g.postTrustedJSON(r, g.cognitive, "/v1/advisories", "", payload, &advisory)
 				if err == nil && status == http.StatusOK && validAdvisoryResponse(advisory, trusted) {
 					cognition = string(advisory.FinishReason)
-					if advisory.FinishReason == cognitive.FinishCompleted {
+					if advisory.FinishReason == cognitive.FinishCompleted && (strings.TrimSpace(saved.FallbackText) == "" || !isBoilerplateAdvisory(advisory.AdvisoryText)) {
 						reply = advisory.AdvisoryText
 					}
 				}
@@ -501,21 +517,43 @@ func (g *gateway) handleChatMessage(w http.ResponseWriter, r *http.Request) {
 		CapabilityKind:                 string(saved.CapabilityKind),
 		CapabilityHints:                saved.CapabilityHints,
 		RequestedOutcome:               saved.RequestedOutcome,
+		ResearchBacked:                 saved.ResearchBacked,
 		InterpretationConfidenceMillis: saved.InterpretationConfidenceMillis,
 		DelegationID:                   saved.DelegationID,
 		DelegationState:                saved.DelegationState,
 		ReminderScheduled:              saved.Reminder != nil,
+		GeneratedImageContentType:      saved.GeneratedImageContentType,
+		GeneratedImageBase64:           saved.GeneratedImageBase64,
 	})
 }
 
-func localChatContext(saved interaction.ChatMessageResponse) []cognitive.ContextExcerpt {
-	if strings.TrimSpace(saved.ActiveProjectName) == "" {
-		return []cognitive.ContextExcerpt{}
+func isBoilerplateAdvisory(value string) bool {
+	normalized := strings.ToLower(strings.TrimSpace(value))
+	switch normalized {
+	case "я рядом.", "я рядом", "понял.", "понял", "принял.", "принял":
+		return true
+	default:
+		return strings.Contains(normalized, "я — домов") || strings.Contains(normalized, "я - домов") || strings.Contains(normalized, "меня зовут домов")
 	}
-	bundle, err := cognitive.CompileContext(cognitive.ContextCompileInput{
-		DataPolicy: capability.DataPolicyLocalOnly,
-		MaxBytes:   2048,
-		Candidates: []cognitive.ContextCandidate{{
+}
+
+func localChatContext(saved interaction.ChatMessageResponse) []cognitive.ContextExcerpt {
+	assistantName := strings.TrimSpace(saved.AssistantName)
+	if assistantName == "" {
+		assistantName = "Домовой"
+	}
+	candidates := []cognitive.ContextCandidate{{
+		Excerpt: cognitive.ContextExcerpt{
+			ID:          "assistant-identity",
+			SourceKind:  "assistant-identity-policy",
+			SourceID:    "domovoy",
+			Sensitivity: cognitive.SensitivityPublic,
+			Text:        "Ты — " + assistantName + ", локальный помощник пользователя. Отвечай от имени «" + assistantName + "». Не называй себя Qwen, Alibaba Cloud, поставщиком модели или внутренним runtime. Если спрашивают имя, скажи: «Меня зовут " + assistantName + ".» Твоя задача — понять смысл запроса, найти путь к цели и довести помощь до полезного конечного результата; не ограничивайся пересказом отказа модели.",
+		},
+		Relevance: 100,
+	}}
+	if strings.TrimSpace(saved.ActiveProjectName) != "" {
+		candidates = append(candidates, cognitive.ContextCandidate{
 			Excerpt: cognitive.ContextExcerpt{
 				ID:          cognitive.ContextExcerptID("active-project-focus"),
 				SourceKind:  "situation-active-project",
@@ -523,8 +561,13 @@ func localChatContext(saved interaction.ChatMessageResponse) []cognitive.Context
 				Sensitivity: cognitive.SensitivityPrivateAllowed,
 				Text:        "Текущий проект: " + strings.TrimSpace(saved.ActiveProjectName),
 			},
-			Relevance: 100,
-		}},
+			Relevance: 90,
+		})
+	}
+	bundle, err := cognitive.CompileContext(cognitive.ContextCompileInput{
+		DataPolicy: capability.DataPolicyLocalOnly,
+		MaxBytes:   2048,
+		Candidates: candidates,
 	})
 	if err != nil {
 		return []cognitive.ContextExcerpt{}
@@ -638,6 +681,104 @@ func (g *gateway) postTrustedJSON(r *http.Request, upstream *url.URL, path, auth
 	return response.StatusCode, nil
 }
 
+func (g *gateway) handleMultimodal(w http.ResponseWriter, r *http.Request) {
+	authorization := r.Header.Get("Authorization")
+	if authorization == "" {
+		http.Error(w, "creator session denied", http.StatusUnauthorized)
+		return
+	}
+	var session identity.CreatorSession
+	status, err := g.getTrustedJSON(r, g.core, "/v1/creator/sessions/current", "", authorization, &session)
+	if err != nil || status != http.StatusOK || session.ActorID == "" || session.PrincipalID == "" {
+		http.Error(w, "creator session denied", http.StatusUnauthorized)
+		return
+	}
+	const maxMediaBytes = 12 << 20
+	r.Body = http.MaxBytesReader(w, r.Body, maxMediaBytes)
+	if err := r.ParseMultipartForm(maxMediaBytes); err != nil {
+		http.Error(w, "media upload is too large or invalid", http.StatusRequestEntityTooLarge)
+		return
+	}
+	path := ""
+	switch r.URL.Path {
+	case "/api/multimodal/transcribe":
+		path = "/v1/multimodal/transcribe"
+	case "/api/multimodal/understand":
+		path = "/v1/multimodal/understand"
+	case "/api/multimodal/ocr":
+		path = "/v1/multimodal/ocr"
+	case "/api/multimodal/video-understand":
+		path = "/v1/multimodal/video-understand"
+	case "/api/multimodal/generate-image":
+		path = "/v1/multimodal/generate-image"
+	default:
+		http.Error(w, "multimodal route not found", http.StatusNotFound)
+		return
+	}
+	body := &bytes.Buffer{}
+	writer := multipart.NewWriter(body)
+	if r.URL.Path == "/api/multimodal/generate-image" {
+		_ = writer.WriteField("prompt", r.FormValue("prompt"))
+		_ = writer.WriteField("size", r.FormValue("size"))
+	} else {
+		if r.URL.Path == "/api/multimodal/video-understand" {
+			_ = writer.WriteField("instruction", r.FormValue("instruction"))
+		}
+		file, header, err := r.FormFile("file")
+		if err != nil {
+			http.Error(w, "media file is required", http.StatusBadRequest)
+			return
+		}
+		defer file.Close()
+		data, err := io.ReadAll(io.LimitReader(file, maxMediaBytes+1))
+		if err != nil || len(data) == 0 || len(data) > maxMediaBytes {
+			http.Error(w, "media file is invalid", http.StatusBadRequest)
+			return
+		}
+		mediaHeader := make(textproto.MIMEHeader)
+		mediaHeader.Set("Content-Disposition", fmt.Sprintf(`form-data; name="file"; filename="%s"`, strings.ReplaceAll(header.Filename, `"`, "")))
+		mediaType := header.Header.Get("Content-Type")
+		if mediaType == "" {
+			mediaType = "application/octet-stream"
+		}
+		mediaHeader.Set("Content-Type", mediaType)
+		part, err := writer.CreatePart(mediaHeader)
+		if err != nil {
+			http.Error(w, "media upload unavailable", http.StatusServiceUnavailable)
+			return
+		}
+		if _, err := part.Write(data); err != nil {
+			http.Error(w, "media upload unavailable", http.StatusServiceUnavailable)
+			return
+		}
+	}
+	if err := writer.Close(); err != nil {
+		http.Error(w, "media upload unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	target := *g.cognitive
+	target.Path = path
+	request, err := http.NewRequestWithContext(r.Context(), http.MethodPost, target.String(), body)
+	if err != nil {
+		http.Error(w, "media capability unavailable", http.StatusBadGateway)
+		return
+	}
+	request.Header.Set("Content-Type", writer.FormDataContentType())
+	response, err := g.client.Do(request)
+	if err != nil {
+		http.Error(w, "media capability unavailable", http.StatusBadGateway)
+		return
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		_, _ = io.Copy(io.Discard, io.LimitReader(response.Body, maxResponseBytes))
+		http.Error(w, "media capability unavailable", http.StatusBadGateway)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_, _ = io.Copy(w, io.LimitReader(response.Body, maxResponseBytes))
+}
+
 func decodeStrictJSON(reader io.Reader, limit int64, destination any) error {
 	decoder := json.NewDecoder(io.LimitReader(reader, limit+1))
 	decoder.DisallowUnknownFields()

cmd/creator-web/server_test.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -13,13 +14,43 @@ import (
 	"git.cin.su/m/Assistant/contracts/interaction"
 )
 
-func TestLocalChatContextUsesOnlyActiveProject(t *testing.T) {
-	context := localChatContext(interaction.ChatMessageResponse{ActiveProjectName: "Домовой"})
-	if len(context) != 1 || context[0].SourceKind != "situation-active-project" || context[0].Text != "Текущий проект: Домовой" {
+func TestMaxResponseBytesAcceptsGeneratedImagePayload(t *testing.T) {
+	// A 1024px PNG can exceed the former 1 MiB gateway limit once base64
+	// encoded. The browser gateway must forward that successful core response.
+	payload, err := json.Marshal(interaction.ChatMessageResponse{
+		GeneratedImageContentType: "image/png",
+		GeneratedImageBase64:      strings.Repeat("A", 2<<20),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var decoded interaction.ChatMessageResponse
+	if err := decodeStrictJSON(bytes.NewReader(payload), maxResponseBytes, &decoded); err != nil {
+		t.Fatalf("generated image response must fit gateway limit: %v", err)
+	}
+	if len(decoded.GeneratedImageBase64) != 2<<20 {
+		t.Fatalf("generated image payload was truncated: %d", len(decoded.GeneratedImageBase64))
+	}
+}
+
+func TestLocalChatContextIncludesDomovoyIdentityAndOptionalActiveProject(t *testing.T) {
+	context := localChatContext(interaction.ChatMessageResponse{AssistantName: "Фея", ActiveProjectName: "Домовой"})
+	if len(context) != 2 || context[0].SourceID != "domovoy" || !strings.Contains(context[0].Text, "Ты — Фея") || !strings.Contains(context[0].Text, "Меня зовут Фея") || context[1].Text != "Текущий проект: Домовой" {
 		t.Fatalf("unexpected local context: %#v", context)
 	}
-	if empty := localChatContext(interaction.ChatMessageResponse{}); len(empty) != 0 {
-		t.Fatalf("expected empty context without active project: %#v", empty)
+	if empty := localChatContext(interaction.ChatMessageResponse{}); len(empty) != 1 || empty[0].SourceID != "domovoy" {
+		t.Fatalf("identity context must remain available without active project: %#v", empty)
+	}
+}
+
+func TestBoilerplateAdvisoryDoesNotReplaceUsefulFallback(t *testing.T) {
+	for _, value := range []string{"Я рядом", "Понял.", "Принял.", "Я — Домовой, ваш помощник."} {
+		if !isBoilerplateAdvisory(value) {
+			t.Fatalf("%q was not recognized as boilerplate", value)
+		}
+	}
+	if isBoilerplateAdvisory("Жили-были дед и баба.") {
+		t.Fatal("useful creative reply was treated as boilerplate")
 	}
 }
 
@@ -354,6 +385,18 @@ func TestConsoleAndSecurityHeaders(t *testing.T) {
 	}
 }
 
+func TestLoginRouteServesChatShell(t *testing.T) {
+	handler, err := newHandler("http://core-runtime:8080", "http://continuity-runtime:8081", "http://commit-runtime:8082", http.DefaultClient)
+	if err != nil {
+		t.Fatal(err)
+	}
+	response := httptest.NewRecorder()
+	handler.ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/login", nil))
+	if response.Code != http.StatusOK || !strings.Contains(response.Body.String(), "id=\"username\"") || !strings.Contains(response.Body.String(), "id=\"password\"") {
+		t.Fatalf("login response = %d", response.Code)
+	}
+}
+
 func TestAdvisoryModeRejectsInvalidConfiguration(t *testing.T) {
 	_, err := newHandlerWithAdvisoryMode("http://core.invalid", "http://continuity.invalid", "http://commit.invalid", http.DefaultClient, "browser-selected")
 	if err == nil || !strings.Contains(err.Error(), "invalid advisory binding mode") {

cmd/creator-web/static/assets/chat.css

@@ -29,7 +29,7 @@ textarea { resize: vertical; min-height: 84px; max-height: 240px; padding: 14px;
 .login-form button, .composer button { border: 0; color: #11150f; background: var(--signal); font-weight: 700; }
 .login-form button { width: 100%; height: 50px; margin-top: 18px; }
 #login-error { min-height: 20px; color: var(--bad); font-size: 13px; }
-.chat-view { height: 100vh; min-height: 0; display: grid; grid-template-rows: 64px minmax(0, 1fr); overflow: hidden; }
+.chat-view { width: 100%; min-width: 0; height: 100vh; min-height: 0; display: grid; grid-template-rows: 64px minmax(0, 1fr); overflow: hidden; }
 .chat-header { min-width: 0; display: flex; align-items: center; gap: 14px; padding: 0 22px; border-bottom: 1px solid var(--line); background: rgba(16, 23, 20, .98); }
 .chat-header a { color: var(--ink); text-decoration: none; font: 400 24px/1 var(--serif); }
 #active-focus { color: var(--good); }
@@ -56,6 +56,7 @@ textarea { resize: vertical; min-height: 84px; max-height: 240px; padding: 14px;
 .chat-header > .operator-link { flex: 0 0 auto; }
 .chat-layout { min-height: 0; height: 100%; display: grid; grid-template-columns: minmax(220px, 280px) minmax(0, 1fr) minmax(250px, 320px); }
 .chat-side { min-width: 0; min-height: 0; padding: 28px 20px; overflow-y: auto; background: #0e1512; }
+.generated-image { display: block; max-width: min(100%, 640px); height: auto; margin-top: 12px; border: 1px solid var(--line); }
 .chat-left { border-right: 1px solid var(--line); }
 .chat-right { border-left: 1px solid var(--line); }
 .side-intro h1, .side-intro h2 { margin: 12px 0; font: 400 clamp(28px, 2.5vw, 40px)/.95 var(--serif); letter-spacing: -.03em; }
@@ -75,6 +76,10 @@ textarea { resize: vertical; min-height: 84px; max-height: 240px; padding: 14px;
 .composer { width: min(100%, 920px); margin: 0 auto; padding: 16px 18px 10px; display: grid; grid-template-columns: minmax(0, 1fr) 130px; gap: 12px; background: linear-gradient(transparent, var(--base) 20%); }
 .composer button { height: 48px; align-self: end; }
 .composer button:disabled { cursor: wait; filter: saturate(.3); }
+.media-tools { width: min(100%, 920px); margin: 0 auto; padding: 0 18px 10px; display: flex; flex-wrap: wrap; align-items: center; gap: 8px; color: var(--muted); font: 10px/1 var(--mono); text-transform: uppercase; letter-spacing: .06em; }
+.media-tools label { display: inline-flex; align-items: center; gap: 6px; min-height: 30px; padding: 0 8px; border: 1px solid var(--line); color: var(--ink); cursor: pointer; }
+.media-tools input { max-width: 150px; font: 10px var(--mono); }
+.media-tools span { color: var(--signal); }
 .conversation-starters { width: min(100%, 920px); margin: -4px auto 0; padding: 0 18px 18px; display: flex; flex-wrap: wrap; align-items: center; gap: 8px; color: var(--muted); font: 10px/1 var(--mono); letter-spacing: .06em; text-transform: uppercase; }
 .conversation-starters button { min-height: 32px; padding: 0 10px; border: 1px solid var(--line); color: var(--ink); background: #101814; font: 10px/1 var(--mono); }
 .conversation-starters button:hover, .conversation-starters button:focus-visible { border-color: var(--signal); color: var(--signal); outline: none; }
@@ -107,9 +112,10 @@ textarea { resize: vertical; min-height: 84px; max-height: 240px; padding: 14px;
   .conversation-starters { align-items: stretch; }
   .conversation-starters span { width: 100%; }
   .chat-header { gap: 10px; padding: 0 12px; }
-  .chat-header .cognitive-status { display: inline-flex; max-width: 150px; overflow: hidden; text-overflow: ellipsis; }
-  .build-meta { font-size: 8px; letter-spacing: .04em; }
-  .build-meta time { font-size: 7px; }
+  .chat-header .cognitive-status { display: inline-flex; flex: 1 1 110px; min-width: 0; max-width: 110px; overflow: hidden; text-overflow: ellipsis; }
+  .chat-header .cognitive-console-link { flex: 0 1 110px; min-width: 0; overflow: hidden; text-overflow: ellipsis; }
+  .chat-header > .operator-link, .build-meta { display: none; }
+  .chat-header > #logout { flex: 0 0 38px; }
   .chat-layout { height: auto; display: block; }
   .chat-side, .chat-main { min-height: auto; max-height: none; overflow: visible; }
   .chat-left, .chat-right { border: 0; border-bottom: 1px solid var(--line); }

cmd/creator-web/static/assets/chat.js

@@ -103,7 +103,7 @@ function showLogin() {
   loginView.hidden = false;
 }
 
-function appendMessage(kind, text, meta = "") {
+function appendMessage(kind, text, meta = "", media = null) {
   const node = document.createElement("div");
   node.className = `message ${kind}`;
   node.textContent = text;
@@ -112,6 +112,13 @@ function appendMessage(kind, text, meta = "") {
     small.textContent = meta;
     node.appendChild(small);
   }
+  if (media?.data && media?.contentType) {
+    const image = document.createElement("img");
+    image.className = "generated-image";
+    image.alt = text || "Сгенерированное изображение";
+    image.src = `data:${media.contentType};base64,${media.data}`;
+    node.appendChild(image);
+  }
   messages.appendChild(node);
   messages.scrollTop = messages.scrollHeight;
   localHistory.push({kind, text, meta, at: new Date()});
@@ -132,6 +139,16 @@ async function api(path, options = {}) {
   return response.json();
 }
 
+async function uploadMedia(path, file) {
+  const body = new FormData();
+  body.append("file", file, file.name);
+  const headers = {};
+  if (token) headers.Authorization = `Bearer ${token}`;
+  const response = await fetch(path, {method: "POST", headers, body});
+  if (!response.ok) throw new ChatApiError(response.status, await response.text());
+  return response.json();
+}
+
 function expireSession(message = "") {
   token = "";
   conversationID = "";
@@ -267,7 +284,7 @@ async function sendChatMessage(text, options = {}) {
     conversationID = result.conversation_id;
     sessionStorage.setItem("domovoy.chat.conversation", conversationID);
     updateActiveFocus(result.active_focus, result.project_provenance);
-    appendMessage("assistant", result.reply_text || "Сообщение записано.", humanMeta(result));
+    appendMessage("assistant", result.reply_text || "Сообщение записано.", humanMeta(result), result.generated_image_base64 ? {contentType: result.generated_image_content_type || "image/png", data: result.generated_image_base64} : null);
     if (/что сейчас требует моего внимания/i.test(clean)) {
       await loadToday();
       activateTab("today-panel");
@@ -320,6 +337,34 @@ chatForm.addEventListener("submit", async (event) => {
   await sendChatMessage(text);
 });
 
+async function processMedia(input, path, label) {
+  const file = input?.files?.[0];
+  if (!file || !mediaStatus) return;
+  mediaStatus.textContent = `${label} обрабатывается...`;
+  input.value = "";
+  try {
+    const result = await uploadMedia(path, file);
+    const text = String(result.text || "").trim();
+    if (!text) throw new Error("empty media result");
+    mediaStatus.textContent = "Готово";
+    await sendChatMessage(`Пользователь передал ${label.toLowerCase()}. Обработай содержание и ответь по смыслу:\n${text}`);
+  } catch (error) {
+    if (error instanceof ChatApiError && (error.status === 401 || error.status === 403)) {
+      expireSession("Сессия устарела. Войдите снова, чтобы продолжить разговор.");
+    } else {
+      mediaStatus.textContent = `${label} сейчас недоступно.`;
+    }
+  }
+}
+
+const mediaStatus = document.querySelector("#media-status");
+const audioInput = document.querySelector("#audio-input");
+const imageInput = document.querySelector("#image-input");
+const ocrInput = document.querySelector("#ocr-input");
+if (audioInput) audioInput.addEventListener("change", () => processMedia(audioInput, "/api/multimodal/transcribe", "Распознанное аудио"));
+if (imageInput) imageInput.addEventListener("change", () => processMedia(imageInput, "/api/multimodal/understand", "Описание изображения"));
+if (ocrInput) ocrInput.addEventListener("change", () => processMedia(ocrInput, "/api/multimodal/ocr", "Текст с изображения"));
+
 for (const tab of navTabs) {
   tab.addEventListener("click", () => activateTab(tab.dataset.tab));
 }

cmd/creator-web/static/chat.html

@@ -60,6 +60,12 @@
               <textarea id="message" rows="3" maxlength="16384" placeholder="Напишите Домовому обычное сообщение..." required></textarea>
               <button id="send" type="submit">Отправить</button>
             </form>
+            <div class="media-tools" aria-label="Мультимодальные сообщения">
+              <label>Аудио <input id="audio-input" type="file" accept="audio/*"></label>
+              <label>Фото <input id="image-input" type="file" accept="image/*"></label>
+              <label>Текст с фото <input id="ocr-input" type="file" accept="image/*"></label>
+              <span id="media-status" role="status" aria-live="polite"></span>
+            </div>
             <div class="conversation-starters" aria-label="Частые вопросы">
               <span>Можно начать так:</span>
               <button type="button" data-starter="Проверь локальный канал мышления">Проверь канал</button>

cmd/reflection-worker/main.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"flag"
 	"fmt"
+	"log"
+	"net/http"
 	"os"
 	"time"
 
@@ -29,9 +31,21 @@ func main() {
 		panic(err)
 	}
 	defer repository.Close()
+	status := newWorkerStatus(*workerID, *once)
+	listenAddr := os.Getenv("REFLECTION_LISTEN_ADDR")
+	if listenAddr == "" {
+		listenAddr = ":8092"
+	}
+	go func() {
+		if err := http.ListenAndServe(listenAddr, status.handler()); err != nil {
+			log.Printf("reflection status server stopped: %v", err)
+		}
+	}()
 	for {
 		now := time.Now().UnixMilli()
+		status.cycleStarted(time.Now())
 		if _, err := repository.RecoverReflectionClaims(ctx, now); err != nil {
+			status.cycleFailed(time.Now(), err)
 			panic(err)
 		}
 		candidate, claimErr := repository.ClaimReflectionCandidate(ctx, *workerID, now, lease.Milliseconds())
@@ -39,16 +53,19 @@ func main() {
 			// This worker only closes the durable evaluation loop. Any cognitive
 			// proposal remains a candidate and must be admitted by a separate governed flow.
 			if err := repository.ResolveReflectionCandidate(ctx, candidate.ID, *workerID, time.Now().UnixMilli()); err != nil {
+				status.cycleFailed(time.Now(), err)
 				panic(err)
 			}
 			fmt.Printf("resolved reflection candidate %s\n", candidate.ID)
 		} else if *once {
 			fmt.Println("no reflection candidate")
 		}
+		status.cycleFinished(time.Now(), map[bool]string{true: "candidate-resolved", false: "idle"}[claimErr == nil])
 		if *once {
 			return
 		}
 		if err := repository.WaitForReflectionCandidate(ctx, *pollInterval); err != nil {
+			status.cycleFailed(time.Now(), err)
 			panic(err)
 		}
 	}

cmd/reflection-worker/status.go

@@ -0,0 +1,74 @@
+package main
+
+import (
+	"encoding/json"
+	"net/http"
+	"sync"
+	"time"
+
+	"git.cin.su/m/Assistant/runtime/health"
+)
+
+type workerStatus struct {
+	mu            sync.RWMutex
+	workerID      string
+	once          bool
+	startedAt     time.Time
+	lastCycleAt   time.Time
+	lastCompleted time.Time
+	lastResult    string
+	lastError     string
+}
+
+func newWorkerStatus(workerID string, once bool) *workerStatus {
+	return &workerStatus{workerID: workerID, once: once, startedAt: time.Now().UTC()}
+}
+
+func (s *workerStatus) cycleStarted(at time.Time) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.lastCycleAt = at.UTC()
+	s.lastResult = "running"
+	s.lastError = ""
+}
+
+func (s *workerStatus) cycleFinished(at time.Time, result string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.lastCompleted = at.UTC()
+	s.lastResult = result
+	s.lastError = ""
+}
+
+func (s *workerStatus) cycleFailed(at time.Time, err error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.lastCompleted = at.UTC()
+	s.lastResult = "failed"
+	s.lastError = err.Error()
+}
+
+func (s *workerStatus) handler() http.Handler {
+	mux := http.NewServeMux()
+	mux.Handle("/healthz", health.Handler{Runtime: "reflection-worker", SemanticGeneration: 1, ArchitectureGeneration: 1})
+	mux.HandleFunc("/status", func(w http.ResponseWriter, _ *http.Request) {
+		s.mu.RLock()
+		response := struct {
+			Runtime       string    `json:"runtime"`
+			WorkerID      string    `json:"worker_id"`
+			Mode          string    `json:"mode"`
+			StartedAt     time.Time `json:"started_at"`
+			LastCycleAt   time.Time `json:"last_cycle_at,omitempty"`
+			LastCompleted time.Time `json:"last_completed_at,omitempty"`
+			LastResult    string    `json:"last_result"`
+			LastError     string    `json:"last_error,omitempty"`
+		}{Runtime: "reflection-worker", WorkerID: s.workerID, Mode: "durable-reflection-loop", StartedAt: s.startedAt, LastCycleAt: s.lastCycleAt, LastCompleted: s.lastCompleted, LastResult: s.lastResult, LastError: s.lastError}
+		if s.once {
+			response.Mode = "durable-reflection-once"
+		}
+		s.mu.RUnlock()
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(response)
+	})
+	return mux
+}

cmd/reflection-worker/status_test.go

@@ -0,0 +1,35 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestWorkerStatusReportsCycle(t *testing.T) {
+	status := newWorkerStatus("test-worker", false)
+	status.cycleStarted(time.Date(2026, 8, 23, 10, 0, 0, 0, time.UTC))
+	status.cycleFinished(time.Date(2026, 8, 23, 10, 0, 1, 0, time.UTC), "idle")
+
+	recorder := httptest.NewRecorder()
+	status.handler().ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/status", nil))
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status code = %d, want 200", recorder.Code)
+	}
+	body := recorder.Body.String()
+	for _, expected := range []string{"\"runtime\":\"reflection-worker\"", "\"worker_id\":\"test-worker\"", "\"last_result\":\"idle\""} {
+		if !strings.Contains(body, expected) {
+			t.Fatalf("status body missing %q: %s", expected, body)
+		}
+	}
+}
+
+func TestWorkerHealthIsAvailable(t *testing.T) {
+	recorder := httptest.NewRecorder()
+	newWorkerStatus("test-worker", true).handler().ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/healthz", nil))
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("health status code = %d, want 200", recorder.Code)
+	}
+}

cmd/research-runtime/main.go

@@ -34,6 +34,7 @@ func main() {
 	mux := http.NewServeMux()
 	mux.Handle("/healthz", health.Handler{Runtime: "research-runtime", SemanticGeneration: 1, ArchitectureGeneration: 1})
 	mux.Handle("/readyz", health.ReadinessHandler{Runtime: "research-runtime", Probes: []health.Probe{{Name: "epistemics-postgres", Check: func(ctx context.Context) error { return repository.Ping(ctx) }}}})
+	mux.Handle("/v1/research/status", truthRuntimeStatusHandler(repository))
 	mux.HandleFunc("POST /v1/research/evaluate", func(w http.ResponseWriter, r *http.Request) {
 		var request epistemics.ResearchEvaluationRequest
 		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 2<<20)).Decode(&request); err != nil {
@@ -88,6 +89,35 @@ func main() {
 		w.Header().Set("Content-Type", "application/json")
 		_ = json.NewEncoder(w).Encode(result)
 	})
+	searchConnector := researchadapter.SearchConnector{
+		EndpointTemplate: os.Getenv("RESEARCH_SEARCH_URL_TEMPLATE"),
+		AllowedHosts:     allowedHosts(os.Getenv("RESEARCH_SEARCH_ALLOWED_HOSTS")),
+		FallbackEndpoints: []researchadapter.SearchEndpoint{{
+			Template:     "https://html.duckduckgo.com/html/?q=%s",
+			AllowedHosts: map[string]struct{}{"html.duckduckgo.com": {}},
+		}},
+		Client:     &http.Client{Timeout: 8 * time.Second},
+		MaxResults: 3,
+	}
+	mux.HandleFunc("POST /v1/research/web/search", func(w http.ResponseWriter, r *http.Request) {
+		var request epistemics.WebSearchRequest
+		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10)).Decode(&request); err != nil {
+			http.Error(w, "invalid web search request", http.StatusBadRequest)
+			return
+		}
+		candidates, err := searchConnector.Collect(r.Context(), request, time.Now().UnixMilli())
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusUnprocessableEntity)
+			return
+		}
+		result, err := application.EvaluateAndPersist(r.Context(), epistemics.ResearchEvaluationRequest{Plan: request.Plan, Candidates: candidates}, repository, time.Now().UnixMilli())
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusUnprocessableEntity)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(result)
+	})
 	addr := os.Getenv("LISTEN_ADDR")
 	if addr == "" {
 		addr = ":8087"

cmd/research-runtime/status.go

@@ -0,0 +1,47 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+
+	"git.cin.su/m/Assistant/adapters/postgres"
+)
+
+type truthRuntimeStatusReader interface {
+	TruthRuntimeStatus(context.Context) (postgres.TruthRuntimeStatus, error)
+}
+
+type truthRuntimeStatusResponse struct {
+	Runtime              string           `json:"runtime"`
+	Status               string           `json:"status"`
+	BundleCount          int64            `json:"bundle_count"`
+	ClaimsByVerification map[string]int64 `json:"claims_by_verification"`
+	BeliefsByState       map[string]int64 `json:"beliefs_by_state"`
+	SourcesByFreshness   map[string]int64 `json:"sources_by_freshness"`
+	ObservedAtUnixMillis int64            `json:"observed_at_unix_millis"`
+}
+
+func truthRuntimeStatusHandler(reader truthRuntimeStatusReader) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet || r.URL.Path != "/v1/research/status" {
+			http.NotFound(w, r)
+			return
+		}
+		status, err := reader.TruthRuntimeStatus(r.Context())
+		if err != nil {
+			http.Error(w, "research status unavailable", http.StatusServiceUnavailable)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(truthRuntimeStatusResponse{
+			Runtime:              "research-runtime",
+			Status:               "ready",
+			BundleCount:          status.BundleCount,
+			ClaimsByVerification: status.ClaimsByVerification,
+			BeliefsByState:       status.BeliefsByState,
+			SourcesByFreshness:   status.SourcesByFreshness,
+			ObservedAtUnixMillis: status.ObservedAtUnixMillis,
+		})
+	})
+}

cmd/research-runtime/status_test.go

@@ -0,0 +1,48 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"git.cin.su/m/Assistant/adapters/postgres"
+)
+
+type fakeTruthRuntimeStatusReader struct {
+	status postgres.TruthRuntimeStatus
+	err    error
+}
+
+func (f fakeTruthRuntimeStatusReader) TruthRuntimeStatus(context.Context) (postgres.TruthRuntimeStatus, error) {
+	return f.status, f.err
+}
+
+func TestTruthRuntimeStatusReportsEvidenceCounts(t *testing.T) {
+	response := httptest.NewRecorder()
+	truthRuntimeStatusHandler(fakeTruthRuntimeStatusReader{status: postgres.TruthRuntimeStatus{
+		BundleCount:          4,
+		ClaimsByVerification: map[string]int64{"UNVERIFIED": 3, "VERIFIED": 1},
+		BeliefsByState:       map[string]int64{"PROVISIONAL": 4},
+		SourcesByFreshness:   map[string]int64{"FRESH": 4},
+		ObservedAtUnixMillis: 1700000000000,
+	}}).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/v1/research/status", nil))
+	if response.Code != http.StatusOK {
+		t.Fatalf("status code = %d", response.Code)
+	}
+	for _, expected := range []string{"\"status\":\"ready\"", "\"bundle_count\":4", "\"VERIFIED\":1", "\"PROVISIONAL\":4", "1700000000000"} {
+		if !strings.Contains(response.Body.String(), expected) {
+			t.Fatalf("response missing %q: %s", expected, response.Body.String())
+		}
+	}
+}
+
+func TestTruthRuntimeStatusFailsClosedOnDatabaseError(t *testing.T) {
+	response := httptest.NewRecorder()
+	truthRuntimeStatusHandler(fakeTruthRuntimeStatusReader{err: errors.New("database unavailable")}).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/v1/research/status", nil))
+	if response.Code != http.StatusServiceUnavailable {
+		t.Fatalf("status code = %d", response.Code)
+	}
+}

cmd/task-verifier/main.go

@@ -0,0 +1,100 @@
+package main
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/work"
+)
+
+const verifierIdentity = "deterministic-task-verifier-v1"
+const genericVerifierIdentity = "deterministic-generic-envelope-verifier-v1"
+
+func main() {
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"runtime":"task-verifier","status":"ok"}`))
+	})
+	mux.HandleFunc("POST /v1/task-evaluations/verify", verifyHandler)
+	mux.HandleFunc("POST /v1/work-graphs/candidates/verify", genericCandidateVerifyHandler)
+	addr := ":8091"
+	if value := strings.TrimSpace(os.Getenv("LISTEN_ADDR")); value != "" {
+		addr = value
+	}
+	if err := http.ListenAndServe(addr, mux); err != nil {
+		panic(err)
+	}
+}
+
+func genericCandidateVerifyHandler(w http.ResponseWriter, r *http.Request) {
+	var request work.GenericCandidateVerificationRequest
+	decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&request); err != nil || request.GraphID == "" || request.GraphRevision < 1 || request.NodeID == "" || request.AuthorRunID == "" || request.CandidateID == "" || strings.TrimSpace(request.Summary) == "" || len(request.EvidenceRefs) == 0 {
+		http.Error(w, "invalid generic candidate envelope", http.StatusBadRequest)
+		return
+	}
+	payload := fmt.Sprintf("%s|%s|%d|%s|%s|%s|%s", genericVerifierIdentity, request.GraphID, request.GraphRevision, request.NodeID, request.AuthorRunID, request.CandidateID, strings.Join(evidenceRefStrings(request.EvidenceRefs), "|"))
+	digest := sha256.Sum256([]byte(payload))
+	writeJSON(w, work.GenericCandidateVerificationResponse{Verified: true, VerificationEvidenceRef: "verification:" + hex.EncodeToString(digest[:]), VerifierIdentity: genericVerifierIdentity, Summary: "candidate attribution and evidence envelope verified; semantic content remains unverified"})
+}
+
+func evidenceRefStrings(values []work.EvidenceRef) []string {
+	result := make([]string, len(values))
+	for i, value := range values {
+		result[i] = string(value)
+	}
+	return result
+}
+
+func verifyHandler(w http.ResponseWriter, r *http.Request) {
+	var request capability.TaskCaseVerificationRequest
+	decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&request); err != nil || request.CaseID == "" || request.ResponseText == "" || request.EvidenceArtifactRef == "" || request.LatencyMicros < 0 || (request.Verification.Mode != capability.TaskCaseVerificationExactText && request.Verification.Mode != capability.TaskCaseVerificationJSONFieldEquals) || (request.Verification.Mode == capability.TaskCaseVerificationJSONFieldEquals && request.Verification.FieldPath == "") || request.Verification.ExpectedText == "" || request.Verification.MinimumQualityMillis < 0 || request.Verification.MinimumQualityMillis > 1000 {
+		http.Error(w, "invalid task verification request", http.StatusBadRequest)
+		return
+	}
+	matched := matches(request)
+	quality := int64(0)
+	result := capability.EvaluationUnsupported
+	if matched {
+		quality = request.Verification.MinimumQualityMillis
+		if quality == 0 {
+			quality = 1000
+		}
+		result = capability.EvaluationSupported
+	}
+	evidence := verificationEvidence(request, matched)
+	writeJSON(w, capability.TaskCaseVerificationResponse{CaseID: request.CaseID, Result: result, QualityScoreMillis: quality, LatencyMicros: request.LatencyMicros, EvidenceArtifactRef: request.EvidenceArtifactRef, VerificationEvidenceRef: evidence, VerifierIdentity: verifierIdentity})
+}
+
+func verificationEvidence(request capability.TaskCaseVerificationRequest, matched bool) string {
+	payload := fmt.Sprintf("%s|%s|%s|%s|%s|%t", verifierIdentity, request.CaseID, request.EvidenceArtifactRef, request.Verification.Mode, request.Verification.FieldPath, matched)
+	digest := sha256.Sum256([]byte(payload))
+	return "verification:" + hex.EncodeToString(digest[:])
+}
+
+func matches(request capability.TaskCaseVerificationRequest) bool {
+	if request.Verification.Mode == capability.TaskCaseVerificationExactText {
+		return strings.TrimSpace(request.ResponseText) == strings.TrimSpace(request.Verification.ExpectedText)
+	}
+	var document map[string]json.RawMessage
+	if json.Unmarshal([]byte(request.ResponseText), &document) != nil {
+		return false
+	}
+	value, ok := document[request.Verification.FieldPath]
+	return ok && strings.TrimSpace(string(value)) == strings.TrimSpace(request.Verification.ExpectedText)
+}
+
+func writeJSON(w http.ResponseWriter, value any) {
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(value)
+}

cmd/task-verifier/main_test.go

@@ -0,0 +1,53 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/work"
+)
+
+func TestVerifyExactTextProducesIndependentEvidence(t *testing.T) {
+	payload, _ := json.Marshal(capability.TaskCaseVerificationRequest{CaseID: "case-1", ResponseText: " answer ", EvidenceArtifactRef: "case-artifact", Verification: capability.TaskCaseVerification{Mode: capability.TaskCaseVerificationExactText, ExpectedText: "answer", MinimumQualityMillis: 900}})
+	recorder := httptest.NewRecorder()
+	verifyHandler(recorder, httptest.NewRequest(http.MethodPost, "/v1/task-evaluations/verify", bytes.NewReader(payload)))
+	var response capability.TaskCaseVerificationResponse
+	if recorder.Code != http.StatusOK || json.NewDecoder(recorder.Body).Decode(&response) != nil || response.Result != capability.EvaluationSupported || response.QualityScoreMillis != 900 || response.VerifierIdentity == "" || response.VerificationEvidenceRef == "" {
+		t.Fatalf("unexpected verification response: code=%d body=%s value=%+v", recorder.Code, recorder.Body.String(), response)
+	}
+}
+
+func TestVerifyMismatchIsUnsupportedWithEvidence(t *testing.T) {
+	payload, _ := json.Marshal(capability.TaskCaseVerificationRequest{CaseID: "case-1", ResponseText: "wrong", EvidenceArtifactRef: "case-artifact", Verification: capability.TaskCaseVerification{Mode: capability.TaskCaseVerificationExactText, ExpectedText: "answer", MinimumQualityMillis: 900}})
+	recorder := httptest.NewRecorder()
+	verifyHandler(recorder, httptest.NewRequest(http.MethodPost, "/v1/task-evaluations/verify", bytes.NewReader(payload)))
+	var response capability.TaskCaseVerificationResponse
+	if recorder.Code != http.StatusOK || json.NewDecoder(recorder.Body).Decode(&response) != nil || response.Result != capability.EvaluationUnsupported || response.QualityScoreMillis != 0 || response.VerificationEvidenceRef == "" {
+		t.Fatalf("unexpected mismatch response: code=%d body=%s value=%+v", recorder.Code, recorder.Body.String(), response)
+	}
+}
+
+func TestVerifyJSONFieldEquals(t *testing.T) {
+	payload, _ := json.Marshal(capability.TaskCaseVerificationRequest{CaseID: "json-1", ResponseText: `{"answer":42}`, EvidenceArtifactRef: "case-artifact", Verification: capability.TaskCaseVerification{Mode: capability.TaskCaseVerificationJSONFieldEquals, FieldPath: "answer", ExpectedText: "42", MinimumQualityMillis: 850}})
+	recorder := httptest.NewRecorder()
+	verifyHandler(recorder, httptest.NewRequest(http.MethodPost, "/v1/task-evaluations/verify", bytes.NewReader(payload)))
+	var response capability.TaskCaseVerificationResponse
+	if recorder.Code != http.StatusOK || json.NewDecoder(recorder.Body).Decode(&response) != nil || response.Result != capability.EvaluationSupported || response.QualityScoreMillis != 850 {
+		t.Fatalf("unexpected JSON verification response: code=%d body=%s value=%+v", recorder.Code, recorder.Body.String(), response)
+	}
+}
+
+func TestVerifyGenericCandidateEnvelopeDoesNotClaimTruth(t *testing.T) {
+	payload, _ := json.Marshal(work.GenericCandidateVerificationRequest{GraphID: "graph-1", GraphRevision: 2, NodeID: "node-1", AuthorRunID: "run-1", CandidateID: "candidate-1", Summary: "model proposal", EvidenceRefs: []work.EvidenceRef{"agent-output:1"}})
+	recorder := httptest.NewRecorder()
+	genericCandidateVerifyHandler(recorder, httptest.NewRequest(http.MethodPost, "/v1/work-graphs/candidates/verify", bytes.NewReader(payload)))
+	var response work.GenericCandidateVerificationResponse
+	if recorder.Code != http.StatusOK || json.NewDecoder(recorder.Body).Decode(&response) != nil || !response.Verified || response.VerifierIdentity == "" || response.VerificationEvidenceRef == "" || !strings.Contains(response.Summary, "semantic content remains unverified") {
+		t.Fatalf("unexpected generic verification response: code=%d body=%s value=%+v", recorder.Code, recorder.Body.String(), response)
+	}
+}

cmd/work-graph-runtime/main.go

@@ -35,6 +35,7 @@ func main() {
 	mux := http.NewServeMux()
 	mux.Handle("/healthz", health.Handler{Runtime: "work-graph-runtime", SemanticGeneration: 1, ArchitectureGeneration: 1})
 	mux.Handle("/readyz", health.ReadinessHandler{Runtime: "work-graph-runtime", Probes: []health.Probe{{Name: "work-postgres", Check: func(ctx context.Context) error { return repository.Ping(ctx) }}}})
+	mux.Handle("/v1/work-graphs/status", workGraphStatusHandler(repository))
 	mux.HandleFunc("POST /v1/work-graphs/schedule", func(w http.ResponseWriter, r *http.Request) {
 		var request application.GraphScheduleRequest
 		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 4<<20)).Decode(&request); err != nil {
@@ -43,6 +44,7 @@ func main() {
 		}
 		graph, ready, err := application.AdmitAndSchedule(r.Context(), repository, request)
 		if err != nil {
+			log.Printf("work graph schedule rejected: %v", err)
 			http.Error(w, err.Error(), http.StatusUnprocessableEntity)
 			return
 		}
@@ -56,23 +58,77 @@ func main() {
 		}
 		graph, ready, err := application.AdmitAndScheduleTaskEvaluation(r.Context(), repository, request)
 		if err != nil {
+			log.Printf("task evaluation graph schedule rejected: %v", err)
 			http.Error(w, err.Error(), http.StatusUnprocessableEntity)
 			return
 		}
 		writeJSON(w, map[string]any{"graph": graph, "scheduled_nodes": ready})
 	})
+	mux.HandleFunc("POST /v1/work-graphs/task-evaluations/additional/schedule", func(w http.ResponseWriter, r *http.Request) {
+		var request application.TaskEvaluationExpansionScheduleRequest
+		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 4<<20)).Decode(&request); err != nil {
+			http.Error(w, "invalid additional task evaluation request", http.StatusBadRequest)
+			return
+		}
+		graph, ready, err := application.ScheduleAdditionalTaskEvaluation(r.Context(), repository, request)
+		if err != nil {
+			log.Printf("additional task evaluation schedule rejected: %v", err)
+			http.Error(w, err.Error(), http.StatusUnprocessableEntity)
+			return
+		}
+		writeJSON(w, map[string]any{"graph": graph, "scheduled_nodes": ready})
+	})
+	mux.HandleFunc("POST /v1/work-graphs/orchestration/next", func(w http.ResponseWriter, r *http.Request) {
+		var request work.SolutionSearchInput
+		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 32<<10)).Decode(&request); err != nil {
+			http.Error(w, "invalid orchestration input", http.StatusBadRequest)
+			return
+		}
+		decision, err := application.DecideSolutionSearch(request)
+		if err != nil {
+			http.Error(w, "invalid orchestration input", http.StatusUnprocessableEntity)
+			return
+		}
+		writeJSON(w, decision)
+	})
+	mux.HandleFunc("POST /v1/work-graphs/orchestration/wave", func(w http.ResponseWriter, r *http.Request) {
+		var request work.SolutionSearchWaveRequest
+		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&request); err != nil {
+			http.Error(w, "invalid orchestration wave request", http.StatusBadRequest)
+			return
+		}
+		result, err := application.OrchestrateSolutionSearch(r.Context(), repository, request)
+		if err != nil {
+			http.Error(w, "invalid orchestration wave request", http.StatusUnprocessableEntity)
+			return
+		}
+		writeJSON(w, result)
+	})
+	mux.HandleFunc("POST /v1/work-graphs/result-callback", func(w http.ResponseWriter, r *http.Request) {
+		var request work.GraphResultCallback
+		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&request); err != nil {
+			http.Error(w, "invalid graph result callback", http.StatusBadRequest)
+			return
+		}
+		graph, err := application.RecordGraphResultCandidate(r.Context(), repository, repository, request)
+		if err != nil {
+			http.Error(w, "invalid graph result callback", http.StatusUnprocessableEntity)
+			return
+		}
+		writeJSON(w, graph)
+	})
 	mux.HandleFunc("POST /v1/work-graphs/complete", func(w http.ResponseWriter, r *http.Request) {
 		var request application.GraphCompleteRequest
 		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10)).Decode(&request); err != nil {
 			http.Error(w, "invalid graph completion request", http.StatusBadRequest)
 			return
 		}
-		graph, err := application.CompleteGraphNode(r.Context(), repository, request.GraphID, request.Revision, request.NodeID, request.Succeeded)
+		result, err := application.CompleteGraphNodeWithReplan(r.Context(), repository, request)
 		if err != nil {
 			http.Error(w, err.Error(), http.StatusUnprocessableEntity)
 			return
 		}
-		writeJSON(w, graph)
+		writeJSON(w, result)
 	})
 	mux.HandleFunc("POST /v1/work-graphs/task-evaluations/callback", func(w http.ResponseWriter, r *http.Request) {
 		var request work.TaskEvaluationEvidenceCallback
@@ -93,12 +149,12 @@ func main() {
 			http.Error(w, "invalid graph synthesis request", http.StatusBadRequest)
 			return
 		}
-		conflict, synthesis, err := application.SynthesizeGraph(r.Context(), repository, request)
+		conflict, synthesis, graph, err := application.SynthesizeAndCompleteGraph(r.Context(), repository, repository, request)
 		if err != nil {
 			http.Error(w, err.Error(), http.StatusUnprocessableEntity)
 			return
 		}
-		writeJSON(w, map[string]any{"conflict": conflict, "synthesis": synthesis})
+		writeJSON(w, map[string]any{"conflict": conflict, "synthesis": synthesis, "graph": graph})
 	})
 	addr := os.Getenv("LISTEN_ADDR")
 	if addr == "" {

cmd/work-graph-runtime/status.go

@@ -0,0 +1,45 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+
+	"git.cin.su/m/Assistant/adapters/postgres"
+)
+
+type workGraphStatusReader interface {
+	RuntimeStatus(context.Context) (postgres.WorkGraphRuntimeStatus, error)
+}
+
+type workGraphStatusResponse struct {
+	Runtime              string           `json:"runtime"`
+	Status               string           `json:"status"`
+	GraphsByState        map[string]int64 `json:"graphs_by_state"`
+	NodesByState         map[string]int64 `json:"nodes_by_state"`
+	QueueByState         map[string]int64 `json:"queue_by_state"`
+	ObservedAtUnixMillis int64            `json:"observed_at_unix_millis"`
+}
+
+func workGraphStatusHandler(reader workGraphStatusReader) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet || r.URL.Path != "/v1/work-graphs/status" {
+			http.NotFound(w, r)
+			return
+		}
+		status, err := reader.RuntimeStatus(r.Context())
+		if err != nil {
+			http.Error(w, "work graph status unavailable", http.StatusServiceUnavailable)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(workGraphStatusResponse{
+			Runtime:              "work-graph-runtime",
+			Status:               "ready",
+			GraphsByState:        status.GraphsByState,
+			NodesByState:         status.NodesByState,
+			QueueByState:         status.QueueByState,
+			ObservedAtUnixMillis: status.ObservedAtUnixMillis,
+		})
+	})
+}

cmd/work-graph-runtime/status_test.go

@@ -0,0 +1,56 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"git.cin.su/m/Assistant/adapters/postgres"
+)
+
+type fakeWorkGraphStatusReader struct {
+	status postgres.WorkGraphRuntimeStatus
+	err    error
+}
+
+func (f fakeWorkGraphStatusReader) RuntimeStatus(context.Context) (postgres.WorkGraphRuntimeStatus, error) {
+	return f.status, f.err
+}
+
+func TestWorkGraphStatusReportsDurableCounts(t *testing.T) {
+	response := httptest.NewRecorder()
+	workGraphStatusHandler(fakeWorkGraphStatusReader{status: postgres.WorkGraphRuntimeStatus{
+		GraphsByState:        map[string]int64{"RUNNING": 2},
+		NodesByState:         map[string]int64{"LEASED": 3, "SUCCEEDED": 1},
+		QueueByState:         map[string]int64{"QUEUED": 3},
+		ObservedAtUnixMillis: 1700000000000,
+	}}).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/v1/work-graphs/status", nil))
+	if response.Code != http.StatusOK {
+		t.Fatalf("status code = %d", response.Code)
+	}
+	body := response.Body.String()
+	for _, expected := range []string{"\"status\":\"ready\"", "\"RUNNING\":2", "\"LEASED\":3", "\"QUEUED\":3", "1700000000000"} {
+		if !contains(body, expected) {
+			t.Fatalf("response missing %q: %s", expected, body)
+		}
+	}
+}
+
+func TestWorkGraphStatusFailsClosedOnDatabaseError(t *testing.T) {
+	response := httptest.NewRecorder()
+	workGraphStatusHandler(fakeWorkGraphStatusReader{err: errors.New("database unavailable")}).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/v1/work-graphs/status", nil))
+	if response.Code != http.StatusServiceUnavailable {
+		t.Fatalf("status code = %d", response.Code)
+	}
+}
+
+func contains(value, expected string) bool {
+	for i := 0; i+len(expected) <= len(value); i++ {
+		if value[i:i+len(expected)] == expected {
+			return true
+		}
+	}
+	return false
+}

contracts/capability/cognitive_registry.go

@@ -172,6 +172,7 @@ type ResolvedCognitiveBinding struct {
 	Evaluation     *EvaluatedCapability
 	Performance    *PerformanceEvidence
 	TaskEvaluation *TaskEvaluation
+	Qualification  *ModelQualificationObservation
 	Rating         *ModelRating
 }
 

contracts/capability/model_qualification.go

@@ -0,0 +1,47 @@
+package capability
+
+import (
+	"errors"
+
+	"git.cin.su/m/Assistant/platform/ids"
+)
+
+type ModelQualificationObservationID ids.ID
+type ModelQualificationStatus string
+
+const (
+	ModelQualificationReachable              ModelQualificationStatus = "REACHABLE"
+	ModelQualificationRespondedWithoutRating ModelQualificationStatus = "RESPONDED_WITHOUT_QUALIFICATION"
+	ModelQualificationUnavailable            ModelQualificationStatus = "UNAVAILABLE"
+)
+
+// ModelQualificationObservation is operational evidence only. It records
+// reachability and latency, never quality, activation, routing priority or
+// provider credentials.
+type ModelQualificationObservation struct {
+	ID                   ModelQualificationObservationID
+	ProviderInstanceID   ProviderInstanceID
+	ProviderModelID      ProviderModelID
+	Status               ModelQualificationStatus
+	FinishReason         string
+	LatencyMillis        int64
+	OutputObserved       bool
+	QualityAssessed      bool
+	Category             ModelRatingCategory
+	ObservedAtUnixMillis int64
+}
+
+func (o ModelQualificationObservation) Validate() error {
+	if o.ID == "" || o.ProviderInstanceID == "" || o.ProviderModelID == "" || o.FinishReason == "" || o.LatencyMillis < 0 || o.ObservedAtUnixMillis < 1 {
+		return errors.New("model qualification observation identity and timing are incomplete")
+	}
+	switch o.Status {
+	case ModelQualificationReachable, ModelQualificationRespondedWithoutRating, ModelQualificationUnavailable:
+	default:
+		return errors.New("model qualification observation status is unsupported")
+	}
+	if o.Category != ModelRatingUnrated || o.QualityAssessed {
+		return errors.New("model qualification observation cannot assert quality")
+	}
+	return nil
+}

contracts/capability/multimodal.go

@@ -0,0 +1,25 @@
+package capability
+
+// MultimodalOperation identifies one bounded local media skill. It is kept
+// separate from general cognition so health, routing and failure evidence do
+// not collapse into a generic model response.
+type MultimodalOperation string
+
+const (
+	MultimodalTranscribe      MultimodalOperation = "TRANSCRIBE_AUDIO"
+	MultimodalUnderstand      MultimodalOperation = "UNDERSTAND_IMAGE"
+	MultimodalRecognizeOCR    MultimodalOperation = "RECOGNIZE_OCR"
+	MultimodalUnderstandVideo MultimodalOperation = "UNDERSTAND_VIDEO"
+	MultimodalGenerateImage   MultimodalOperation = "GENERATE_IMAGE"
+	MultimodalGenerateVideo   MultimodalOperation = "GENERATE_VIDEO"
+)
+
+type MultimodalResponse struct {
+	Operation      MultimodalOperation `json:"operation"`
+	Text           string              `json:"text"`
+	Provider       string              `json:"provider,omitempty"`
+	ObservedAt     int64               `json:"observed_at_unix_millis"`
+	ConfidenceNote string              `json:"confidence_note,omitempty"`
+	ContentType    string              `json:"content_type,omitempty"`
+	DataBase64     string              `json:"data_base64,omitempty"`
+}

contracts/capability/task_evaluation.go

@@ -70,6 +70,22 @@ type TaskEvaluationExpansionRequest struct {
 	BenchmarkVersion   string
 }
 
+type TaskCaseVerificationMode string
+
+const (
+	TaskCaseVerificationExactText       TaskCaseVerificationMode = "EXACT_TEXT"
+	TaskCaseVerificationJSONFieldEquals TaskCaseVerificationMode = "JSON_FIELD_EQUALS"
+)
+
+// TaskCaseVerification is a bounded, task-owned rubric. The expected text is
+// test data, not model output, and is never sent to the cognitive provider.
+type TaskCaseVerification struct {
+	Mode                 TaskCaseVerificationMode
+	FieldPath            string
+	ExpectedText         string
+	MinimumQualityMillis int64
+}
+
 // TaskCaseObservation is produced by the bounded evaluator and verifier. A
 // score without a case result and evidence reference is not accepted as
 // qualification evidence.
@@ -80,6 +96,10 @@ type TaskCaseObservation struct {
 	LatencyMicros       int64
 	CriticalFailure     bool
 	EvidenceArtifactRef string
+	// VerificationEvidenceRef and VerifierIdentity are required whenever an
+	// observation claims semantic support or a non-zero quality score.
+	VerificationEvidenceRef string
+	VerifierIdentity        string
 }
 
 // TaskEvaluation is durable evidence for one model/binding revision under one

contracts/capability/task_evaluation_execution.go

@@ -11,6 +11,33 @@ type TaskEvaluationCase struct {
 	CaseID              string
 	Prompt              string
 	EvidenceArtifactRef string
+	Verification        TaskCaseVerification
+}
+
+type TaskCaseResponse struct {
+	CaseID              string
+	ResponseText        string
+	LatencyMicros       int64
+	EvidenceArtifactRef string
+}
+
+type TaskCaseVerificationRequest struct {
+	CaseID              string
+	ResponseText        string
+	LatencyMicros       int64
+	EvidenceArtifactRef string
+	Verification        TaskCaseVerification
+}
+
+type TaskCaseVerificationResponse struct {
+	CaseID                  string
+	Result                  EvaluationResult
+	QualityScoreMillis      int64
+	LatencyMicros           int64
+	CriticalFailure         bool
+	EvidenceArtifactRef     string
+	VerificationEvidenceRef string
+	VerifierIdentity        string
 }
 
 type TaskEvaluationExecutionRequest struct {
@@ -31,5 +58,6 @@ type TaskEvaluationExecutionResponse struct {
 	BindingID            CapabilityBindingID
 	BindingRevision      int64
 	Observations         []TaskCaseObservation
+	Responses            []TaskCaseResponse
 	ObservedAtUnixMillis int64
 }

contracts/capability/types.go

@@ -29,6 +29,12 @@ const (
 	CapabilityKindCognitiveReasoning CapabilityKind = "COGNITIVE_REASONING"
 	CapabilityKindScheduleReminder   CapabilityKind = "SCHEDULE_REMINDER"
 	CapabilityKindVerifyFact         CapabilityKind = "VERIFY_FACT"
+	CapabilityKindSpeechToText       CapabilityKind = "SPEECH_TO_TEXT"
+	CapabilityKindImageUnderstanding CapabilityKind = "IMAGE_UNDERSTANDING"
+	CapabilityKindOCR                CapabilityKind = "OCR"
+	CapabilityKindVideoUnderstanding CapabilityKind = "VIDEO_UNDERSTANDING"
+	CapabilityKindImageGeneration    CapabilityKind = "IMAGE_GENERATION"
+	CapabilityKindVideoGeneration    CapabilityKind = "VIDEO_GENERATION"
 )
 
 // Binding is Capability-owned correctness state. SecretRef is an opaque

contracts/epistemics/research.go

@@ -96,6 +96,8 @@ type ResearchFinding struct {
 	Statement      string
 	Claim          Claim
 	Citations      []Citation
+	Source         Source
+	Excerpt        SourceExcerpt
 	State          ResearchFindingState
 	Reason         string
 }
@@ -131,6 +133,15 @@ type WebResearchRequest struct {
 	Statement      string
 }
 
+// WebSearchRequest asks the research runtime to discover bounded source
+// evidence for a human question. The provider is configured by the runtime;
+// the caller supplies meaning, not a provider URL or model choice.
+type WebSearchRequest struct {
+	Plan           ResearchPlan
+	PropositionKey string
+	Query          string
+}
+
 // ResolveCitation creates evidence only when all identifiers form one exact
 // source chain. It deliberately does not fetch, infer or rewrite source text.
 func ResolveCitation(source Source, snapshot SourceSnapshot, excerpt SourceExcerpt, evidence EvidenceKind, coverage CoverageState, conflict ConflictState, resolvedAtUnixMillis int64) (Citation, error) {

contracts/interaction/types.go

@@ -27,49 +27,54 @@ type SemanticCandidateSelectionState string
 type InformationRequestKind string
 
 const (
-	ChannelWebChat                            Channel                         = "WEB_CHAT"
-	ConversationOpen                          ConversationState               = "OPEN"
-	ConversationArchived                      ConversationState               = "ARCHIVED"
-	SpeechActDirective                        SpeechAct                       = "DIRECTIVE"
-	SpeechActAssertion                        SpeechAct                       = "ASSERTION"
-	SpeechActDecision                         SpeechAct                       = "DECISION"
-	SpeechActPreference                       SpeechAct                       = "PREFERENCE"
-	SpeechActQuestion                         SpeechAct                       = "QUESTION"
-	SpeechActHypothesis                       SpeechAct                       = "HYPOTHESIS"
-	SpeechActCorrection                       SpeechAct                       = "CORRECTION"
-	SpeechActRequestToInvestigate             SpeechAct                       = "REQUEST_TO_INVESTIGATE"
-	SpeechActConfirmation                     SpeechAct                       = "CONFIRMATION"
-	SpeechActRejection                        SpeechAct                       = "REJECTION"
-	SpeechActCancellation                     SpeechAct                       = "CANCELLATION"
-	SpeechActConversational                   SpeechAct                       = "CONVERSATIONAL"
-	SpeechActUnknown                          SpeechAct                       = "UNKNOWN"
-	InterpretationRecorded                    InterpretationState             = "RECORDED"
-	InterpretationInterpreted                 InterpretationState             = "INTERPRETED"
-	RelationCorrects                          InteractionRelationKind         = "CORRECTS"
-	RelationRespondsTo                        InteractionRelationKind         = "RESPONDS_TO"
-	RelationRequestsCognition                 InteractionRelationKind         = "REQUESTS_COGNITION"
-	RelationCognitionFallback                 InteractionRelationKind         = "COGNITION_FALLBACK"
-	RelationSupersedes                        InteractionRelationKind         = "SUPERSEDES"
-	RelationClarifies                         InteractionRelationKind         = "CLARIFIES"
-	ProjectRolePrimary                        ProjectReferenceRole            = "PRIMARY"
-	ProjectRoleRelated                        ProjectReferenceRole            = "RELATED"
-	ProjectRoleReferenceSource                ProjectReferenceRole            = "REFERENCE_SOURCE"
-	ClarificationNotRequired                  ClarificationState              = "NOT_REQUIRED"
-	ClarificationRequired                     ClarificationState              = "REQUIRED"
-	SemanticApplicable                        SemanticApplicability           = "APPLICABLE"
-	SemanticLowConfidence                     SemanticApplicability           = "LOW_CONFIDENCE"
-	SemanticMixedIntent                       SemanticApplicability           = "MIXED_INTENT"
-	SemanticNeedsBroaderInterpret             SemanticApplicability           = "NEEDS_BROADER_INTERPRETATION"
-	SemanticCandidateClarify                  SemanticApplicability           = "CLARIFICATION_REQUIRED"
-	CandidateSourceDeterministic              SemanticCandidateSource         = "DETERMINISTIC_V2"
-	CandidateSourceCognitive                  SemanticCandidateSource         = "COGNITIVE_V1"
-	CandidateSelected                         SemanticCandidateSelectionState = "SELECTED"
-	CandidateObserved                         SemanticCandidateSelectionState = "OBSERVED"
-	CandidateRejected                         SemanticCandidateSelectionState = "REJECTED"
-	InformationRequestCapabilityInventory     InformationRequestKind          = "CAPABILITY_INVENTORY"
-	InformationRequestCognitiveModelInventory InformationRequestKind          = "COGNITIVE_MODEL_INVENTORY"
-	InformationRequestCognitiveChannelStatus  InformationRequestKind          = "COGNITIVE_CHANNEL_STATUS"
-	InformationRequestCognitiveRecovery       InformationRequestKind          = "COGNITIVE_RECOVERY"
+	ChannelWebChat                               Channel                         = "WEB_CHAT"
+	ConversationOpen                             ConversationState               = "OPEN"
+	ConversationArchived                         ConversationState               = "ARCHIVED"
+	SpeechActDirective                           SpeechAct                       = "DIRECTIVE"
+	SpeechActAssertion                           SpeechAct                       = "ASSERTION"
+	SpeechActDecision                            SpeechAct                       = "DECISION"
+	SpeechActPreference                          SpeechAct                       = "PREFERENCE"
+	SpeechActQuestion                            SpeechAct                       = "QUESTION"
+	SpeechActHypothesis                          SpeechAct                       = "HYPOTHESIS"
+	SpeechActCorrection                          SpeechAct                       = "CORRECTION"
+	SpeechActRequestToInvestigate                SpeechAct                       = "REQUEST_TO_INVESTIGATE"
+	SpeechActConfirmation                        SpeechAct                       = "CONFIRMATION"
+	SpeechActRejection                           SpeechAct                       = "REJECTION"
+	SpeechActCancellation                        SpeechAct                       = "CANCELLATION"
+	SpeechActConversational                      SpeechAct                       = "CONVERSATIONAL"
+	SpeechActUnknown                             SpeechAct                       = "UNKNOWN"
+	InterpretationRecorded                       InterpretationState             = "RECORDED"
+	InterpretationInterpreted                    InterpretationState             = "INTERPRETED"
+	RelationCorrects                             InteractionRelationKind         = "CORRECTS"
+	RelationRespondsTo                           InteractionRelationKind         = "RESPONDS_TO"
+	RelationRequestsCognition                    InteractionRelationKind         = "REQUESTS_COGNITION"
+	RelationCognitionFallback                    InteractionRelationKind         = "COGNITION_FALLBACK"
+	RelationSupersedes                           InteractionRelationKind         = "SUPERSEDES"
+	RelationClarifies                            InteractionRelationKind         = "CLARIFIES"
+	ProjectRolePrimary                           ProjectReferenceRole            = "PRIMARY"
+	ProjectRoleRelated                           ProjectReferenceRole            = "RELATED"
+	ProjectRoleReferenceSource                   ProjectReferenceRole            = "REFERENCE_SOURCE"
+	ClarificationNotRequired                     ClarificationState              = "NOT_REQUIRED"
+	ClarificationRequired                        ClarificationState              = "REQUIRED"
+	SemanticApplicable                           SemanticApplicability           = "APPLICABLE"
+	SemanticLowConfidence                        SemanticApplicability           = "LOW_CONFIDENCE"
+	SemanticMixedIntent                          SemanticApplicability           = "MIXED_INTENT"
+	SemanticNeedsBroaderInterpret                SemanticApplicability           = "NEEDS_BROADER_INTERPRETATION"
+	SemanticCandidateClarify                     SemanticApplicability           = "CLARIFICATION_REQUIRED"
+	CandidateSourceDeterministic                 SemanticCandidateSource         = "DETERMINISTIC_V2"
+	CandidateSourceCognitive                     SemanticCandidateSource         = "COGNITIVE_V1"
+	CandidateSelected                            SemanticCandidateSelectionState = "SELECTED"
+	CandidateObserved                            SemanticCandidateSelectionState = "OBSERVED"
+	CandidateRejected                            SemanticCandidateSelectionState = "REJECTED"
+	InformationRequestCapabilityInventory        InformationRequestKind          = "CAPABILITY_INVENTORY"
+	InformationRequestLocalCapabilityInventory   InformationRequestKind          = "LOCAL_CAPABILITY_INVENTORY"
+	InformationRequestCognitiveModelInventory    InformationRequestKind          = "COGNITIVE_MODEL_INVENTORY"
+	InformationRequestCognitiveCurrentModel      InformationRequestKind          = "COGNITIVE_CURRENT_MODEL"
+	InformationRequestCognitiveChannelStatus     InformationRequestKind          = "COGNITIVE_CHANNEL_STATUS"
+	InformationRequestCognitiveRecovery          InformationRequestKind          = "COGNITIVE_RECOVERY"
+	InformationRequestMemoryInventory            InformationRequestKind          = "MEMORY_INVENTORY"
+	InformationRequestTimeDifference             InformationRequestKind          = "TIME_DIFFERENCE"
+	InformationRequestResearchFailureExplanation InformationRequestKind          = "RESEARCH_FAILURE_EXPLANATION"
 )
 
 type Conversation struct {
@@ -168,11 +173,13 @@ type ChatMessageResponse struct {
 	InterpretationState            InterpretationState
 	NeedsCognition                 bool
 	FallbackText                   string
+	AssistantName                  string
 	ActiveProjectName              string
 	ProjectProvenance              situation.ProjectResolutionProvenance
 	Clarification                  ClarificationState
 	WorkPlanned                    bool
 	PlanningReply                  string
+	ResearchBacked                 bool
 	CapabilityStatus               capability.CapabilityResolutionStatus
 	CapabilityKind                 capability.CapabilityKind
 	CapabilityHints                []capability.CapabilityKind
@@ -183,4 +190,6 @@ type ChatMessageResponse struct {
 	DelegationID                   string
 	DelegationState                string
 	Reminder                       *continuity.ProspectiveItem
+	GeneratedImageContentType      string
+	GeneratedImageBase64           string
 }

contracts/work/graph.go

@@ -21,14 +21,15 @@ const (
 	GraphFailed    GraphState = "FAILED"
 	GraphUnknown   GraphState = "UNKNOWN"
 
-	GraphNodeBlocked GraphNodeState = "BLOCKED_PREREQUISITE"
-	GraphNodeReady   GraphNodeState = "READY"
-	GraphNodeLeased  GraphNodeState = "LEASED"
-	GraphNodeRunning GraphNodeState = "RUNNING"
-	GraphNodeSuccess GraphNodeState = "SUCCEEDED"
-	GraphNodeFailed  GraphNodeState = "FAILED"
-	GraphNodeCancel  GraphNodeState = "CANCELLED"
-	GraphNodeUnknown GraphNodeState = "UNKNOWN"
+	GraphNodeBlocked   GraphNodeState = "BLOCKED_PREREQUISITE"
+	GraphNodeReady     GraphNodeState = "READY"
+	GraphNodeLeased    GraphNodeState = "LEASED"
+	GraphNodeRunning   GraphNodeState = "RUNNING"
+	GraphNodeVerifying GraphNodeState = "VERIFYING"
+	GraphNodeSuccess   GraphNodeState = "SUCCEEDED"
+	GraphNodeFailed    GraphNodeState = "FAILED"
+	GraphNodeCancel    GraphNodeState = "CANCELLED"
+	GraphNodeUnknown   GraphNodeState = "UNKNOWN"
 )
 
 type GraphBudget struct {
@@ -56,15 +57,17 @@ type GraphEdge struct {
 }
 
 type WorkGraph struct {
-	ID                  string      `json:"id"`
-	Revision            int64       `json:"revision"`
-	State               GraphState  `json:"state"`
-	Nodes               []GraphNode `json:"nodes"`
-	Edges               []GraphEdge `json:"edges"`
-	Budget              GraphBudget `json:"budget"`
-	ParentGraphID       string      `json:"parent_graph_id,omitempty"`
-	ParentGraphRevision int64       `json:"parent_graph_revision,omitempty"`
-	TriggerEvidenceRef  string      `json:"trigger_evidence_ref,omitempty"`
+	ID                  string              `json:"id"`
+	Revision            int64               `json:"revision"`
+	State               GraphState          `json:"state"`
+	Nodes               []GraphNode         `json:"nodes"`
+	Edges               []GraphEdge         `json:"edges"`
+	Budget              GraphBudget         `json:"budget"`
+	ParentGraphID       string              `json:"parent_graph_id,omitempty"`
+	ParentGraphRevision int64               `json:"parent_graph_revision,omitempty"`
+	TriggerEvidenceRef  string              `json:"trigger_evidence_ref,omitempty"`
+	SearchInputBound    bool                `json:"search_input_bound,omitempty"`
+	SearchInput         SolutionSearchInput `json:"search_input,omitempty"`
 }
 
 // TaskEvaluationGraphRequest describes a durable fan-out. The graph contains
@@ -110,6 +113,35 @@ type ResultCandidate struct {
 	Summary         string        `json:"summary"`
 }
 
+// GenericCandidateVerificationRequest asks the independent deterministic
+// verifier to validate attribution and evidence-envelope integrity. It does
+// not assert that the candidate's semantic content is true.
+type GenericCandidateVerificationRequest struct {
+	GraphID       string        `json:"graph_id"`
+	GraphRevision int64         `json:"graph_revision"`
+	NodeID        GraphNodeID   `json:"node_id"`
+	AuthorRunID   AgentRunID    `json:"author_run_id"`
+	CandidateID   string        `json:"candidate_id"`
+	Summary       string        `json:"summary"`
+	EvidenceRefs  []EvidenceRef `json:"evidence_refs"`
+}
+
+type GenericCandidateVerificationResponse struct {
+	Verified                bool   `json:"verified"`
+	VerificationEvidenceRef string `json:"verification_evidence_ref"`
+	VerifierIdentity        string `json:"verifier_identity"`
+	Summary                 string `json:"summary"`
+}
+
+// GraphResultCallback carries one agent's attributable candidate to Work.
+// Recording a candidate never makes the node successful; the node enters
+// VERIFYING until an independent synthesis/verifier accepts it.
+type GraphResultCallback struct {
+	GraphID   string          `json:"graph_id"`
+	Revision  int64           `json:"revision"`
+	Candidate ResultCandidate `json:"candidate"`
+}
+
 type ConflictSet struct {
 	ID            string      `json:"id"`
 	GraphID       string      `json:"graph_id"`

contracts/work/lease.go

@@ -83,4 +83,12 @@ type TaskEvaluationDispatchContext struct {
 	ActorID         identity.ActorID     `json:"actor_id"`
 	PrincipalID     identity.PrincipalID `json:"principal_id"`
 	ScopeID         authority.ScopeID    `json:"scope_id"`
+	// GenericMessage turns the existing durable dispatch context into a
+	// discriminated local cognitive-work payload without adding a second
+	// persistence column. It is ignored by task-evaluation executors.
+	GenericMessage        string `json:"generic_message,omitempty"`
+	GenericPurpose        string `json:"generic_purpose,omitempty"`
+	GenericLocale         string `json:"generic_locale,omitempty"`
+	GenericDataPolicy     string `json:"generic_data_policy,omitempty"`
+	GenericMaxOutputBytes int    `json:"generic_max_output_bytes,omitempty"`
 }

contracts/work/orchestration.go

@@ -0,0 +1,66 @@
+package work
+
+type OrchestrationState string
+type SearchOptionKind string
+
+const (
+	OrchestrationSearching OrchestrationState = "SEARCHING"
+	OrchestrationExecuting OrchestrationState = "EXECUTING"
+	OrchestrationVerifying OrchestrationState = "VERIFYING"
+	OrchestrationWaiting   OrchestrationState = "WAITING"
+	OrchestrationCompleted OrchestrationState = "COMPLETED"
+	OrchestrationCancelled OrchestrationState = "CANCELLED"
+
+	SearchOptionAgents     SearchOptionKind = "AGENT_TEAM"
+	SearchOptionCapability SearchOptionKind = "CAPABILITY_DISCOVERY"
+	SearchOptionResearch   SearchOptionKind = "TRUTH_RESEARCH"
+	SearchOptionReflection SearchOptionKind = "REFLECTION_MEMORY"
+	SearchOptionHuman      SearchOptionKind = "HUMAN_ATTENTION"
+)
+
+// SolutionSearchInput is the durable orchestration snapshot. The scheduler
+// stores the graph/goal separately; this value only decides the next bounded
+// search wave and never grants authority by itself.
+type SolutionSearchInput struct {
+	GoalID            GoalID
+	GoalState         GoalState
+	SearchRound       int
+	MaxRound          int
+	CancelRequested   bool
+	ActiveOptionCount int
+	VerificationReady bool
+	Unresolved        bool
+}
+
+type SolutionSearchDecision struct {
+	GoalID            GoalID
+	State             OrchestrationState
+	ContinueSearching bool
+	NextSearchRound   int
+	Options           []SearchOptionKind
+	Reason            string
+}
+
+type SolutionSearchWaveRequest struct {
+	Input               SolutionSearchInput      `json:"input"`
+	GraphID             string                   `json:"graph_id"`
+	IdempotencyPrefix   string                   `json:"idempotency_prefix"`
+	Dispatches          []SolutionSearchDispatch `json:"dispatches"`
+	Budget              GraphBudget              `json:"budget"`
+	ParentGraphID       string                   `json:"parent_graph_id,omitempty"`
+	ParentGraphRevision int64                    `json:"parent_graph_revision,omitempty"`
+	TriggerEvidenceRef  string                   `json:"trigger_evidence_ref,omitempty"`
+	NowUnixMillis       int64                    `json:"now_unix_millis"`
+}
+
+type SolutionSearchDispatch struct {
+	Option SearchOptionKind    `json:"option"`
+	Intent AgentDispatchIntent `json:"intent"`
+}
+
+type SolutionSearchWaveResult struct {
+	Decision          SolutionSearchDecision `json:"decision"`
+	Graph             WorkGraph              `json:"graph"`
+	ScheduledNodeIDs  []GraphNodeID          `json:"scheduled_node_ids,omitempty"`
+	GraphMaterialized bool                   `json:"graph_materialized"`
+}

database/migrations/044_work_graph_orchestration_snapshot.sql

@@ -0,0 +1,21 @@
+BEGIN;
+
+SET ROLE work_role;
+
+ALTER TABLE work.graphs ADD COLUMN IF NOT EXISTS orchestration_bound BOOLEAN NOT NULL DEFAULT FALSE;
+ALTER TABLE work.graphs ADD COLUMN IF NOT EXISTS orchestration_goal_id TEXT NOT NULL DEFAULT '';
+ALTER TABLE work.graphs ADD COLUMN IF NOT EXISTS orchestration_goal_state TEXT NOT NULL DEFAULT '';
+ALTER TABLE work.graphs ADD COLUMN IF NOT EXISTS orchestration_search_round INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE work.graphs ADD COLUMN IF NOT EXISTS orchestration_max_round INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE work.graphs ADD COLUMN IF NOT EXISTS orchestration_cancel_requested BOOLEAN NOT NULL DEFAULT FALSE;
+ALTER TABLE work.graphs ADD COLUMN IF NOT EXISTS orchestration_verification_ready BOOLEAN NOT NULL DEFAULT FALSE;
+ALTER TABLE work.graphs ADD COLUMN IF NOT EXISTS orchestration_unresolved BOOLEAN NOT NULL DEFAULT FALSE;
+
+ALTER TABLE work.graphs DROP CONSTRAINT IF EXISTS work_graphs_orchestration_snapshot_check;
+ALTER TABLE work.graphs ADD CONSTRAINT work_graphs_orchestration_snapshot_check CHECK (
+  (NOT orchestration_bound AND orchestration_goal_id = '' AND orchestration_search_round = 0 AND orchestration_max_round = 0)
+  OR (orchestration_bound AND orchestration_goal_id <> '' AND orchestration_search_round >= 1 AND orchestration_max_round >= 1)
+);
+
+RESET ROLE;
+COMMIT;

database/migrations/045_capability_model_qualification_observations.sql

@@ -0,0 +1,24 @@
+BEGIN;
+
+SET ROLE capability_role;
+
+CREATE TABLE IF NOT EXISTS capability.cognitive_model_qualification_observations (
+  observation_id TEXT PRIMARY KEY,
+  provider_instance_id TEXT NOT NULL,
+  provider_model_id TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('REACHABLE','RESPONDED_WITHOUT_QUALIFICATION','UNAVAILABLE')),
+  finish_reason TEXT NOT NULL,
+  latency_millis BIGINT NOT NULL CHECK (latency_millis >= 0),
+  output_observed BOOLEAN NOT NULL,
+  quality_assessed BOOLEAN NOT NULL DEFAULT FALSE CHECK (quality_assessed = FALSE),
+  category TEXT NOT NULL CHECK (category = 'UNRATED'),
+  observed_at_unix_millis BIGINT NOT NULL CHECK (observed_at_unix_millis > 0)
+);
+
+CREATE INDEX IF NOT EXISTS cognitive_model_qualification_lookup
+  ON capability.cognitive_model_qualification_observations(provider_instance_id, provider_model_id, observed_at_unix_millis DESC);
+
+GRANT SELECT, INSERT ON capability.cognitive_model_qualification_observations TO capability_role;
+
+RESET ROLE;
+COMMIT;

deploy/docker-compose.dev.yml

@@ -102,8 +102,11 @@ services:
       LISTEN_ADDR: ":8083"
       CORE_RUNTIME_URL: http://core-runtime:8080
       LOCAL_CPU_PROVIDER_URL: http://docker.cin.su:18082/v1
+      LOCAL_MEDIUM_PROVIDER_URL: ${LOCAL_MEDIUM_PROVIDER_URL:-http://docker.cin.su:18082/v1}
+      LOCAL_MEDIUM_PROVIDER_TIMEOUT: ${LOCAL_MEDIUM_PROVIDER_TIMEOUT:-120s}
       LOCAL_LIFEBOAT_PROVIDER_URL: ${LOCAL_LIFEBOAT_PROVIDER_URL:-}
       LOCAL_GPU_PROVIDER_URL: http://192.168.220.91:11434
+      COGNITIVE_ALLOW_CANARY: "true"
       COGNITIVE_OWNER_PRINCIPAL_ID: domovoy-creator-principal
     ports: ["19083:8083"]
 

deploy/docker-compose.prod.yml

@@ -118,10 +118,44 @@ services:
       WORK_POSTGRES_CREDENTIAL_REF: credential://domovoy/work/db-password/v1
       WORK_POSTGRES_PASSWORD_FILE: /run/secrets/work_db_password
       SECRET_BACKEND_ROOT: /run/secrets
-    depends_on: { postgres: { condition: service_healthy } }
+      TASK_VERIFIER_URL: http://task-verifier:8091
+      AGENT_EXECUTION_BRIDGE_URL: http://agent-execution-bridge:8092
+    depends_on:
+      postgres: { condition: service_healthy }
+      task-verifier: { condition: service_healthy }
+      agent-execution-bridge: { condition: service_healthy }
     volumes:
       - assistant_core_secrets:/run/secrets:ro
 
+  agent-execution-bridge:
+    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: agent-execution-bridge, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
+    restart: unless-stopped
+    environment:
+      LISTEN_ADDR: :8092
+      COGNITIVE_WORKER_URL: http://cognitive-worker:8083
+      WORK_GRAPH_RUNTIME_URL: http://work-graph-runtime:8088
+      TASK_VERIFIER_URL: http://task-verifier:8091
+    depends_on:
+      cognitive-worker: { condition: service_started }
+      task-verifier: { condition: service_healthy }
+      work-graph-runtime: { condition: service_started }
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8092/healthz >/dev/null"]
+      interval: 10s
+      timeout: 3s
+      retries: 10
+
+  task-verifier:
+    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: task-verifier, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
+    restart: unless-stopped
+    environment:
+      LISTEN_ADDR: :8091
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8091/healthz >/dev/null"]
+      interval: 10s
+      timeout: 3s
+      retries: 10
+
   work-graph-runtime:
     build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: work-graph-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
     restart: unless-stopped
@@ -161,6 +195,8 @@ services:
       LISTEN_ADDR: :8087
       RESEARCH_SOURCE_ROOT: /var/lib/research-sources
       RESEARCH_HTTP_ALLOWED_HOSTS: assistant.cin.su,git.cin.su
+      RESEARCH_SEARCH_URL_TEMPLATE: ${RESEARCH_SEARCH_URL_TEMPLATE:-https://www.bing.com/search?q=%s}
+      RESEARCH_SEARCH_ALLOWED_HOSTS: ${RESEARCH_SEARCH_ALLOWED_HOSTS:-www.bing.com}
       POSTGRES_HOST: postgres
       POSTGRES_PORT: "5432"
       POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
@@ -220,7 +256,11 @@ services:
       LOCAL_MEDIUM_PROVIDER_URL: ${LOCAL_MEDIUM_PROVIDER_URL:-http://llm-local-api:8080/v1}
       LOCAL_MEDIUM_PROVIDER_API_KEY_FILE: ${LOCAL_MEDIUM_PROVIDER_API_KEY_FILE:-}
       LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF: ${LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF:-credential://domovoy/local-medium/provider-api-key/v1}
+      LOCAL_GPU_PROVIDER_TIMEOUT: ${LOCAL_GPU_PROVIDER_TIMEOUT:-60s}
       LOCAL_LIFEBOAT_PROVIDER_URL: http://cognitive-lifeboat:8086/v1
+      LOCAL_IMAGE_PROVIDER_KIND: ${LOCAL_IMAGE_PROVIDER_KIND:-comfyui}
+      LOCAL_IMAGE_PROVIDER_URL: ${LOCAL_IMAGE_PROVIDER_URL:-http://comfyui:8188}
+      LOCAL_IMAGE_MODEL: ${LOCAL_IMAGE_MODEL:-z_image_turbo_bf16.safetensors}
       COGNITIVE_OWNER_PRINCIPAL_ID: domovoy-creator-principal
       COGNITIVE_ALLOW_CANARY: "true"
     depends_on: [core-runtime, cognitive-lifeboat]

dev/ACTIVE_TASK.json

@@ -1,5 +1,5 @@
 {
-  "task_file": "dev/tasks/DEV-000217-current-status-evidence.json",
-  "task_id": "DEV-000217",
-  "task_revision": 1
+  "task_file": "dev/tasks/DEV-000295-household-scenario-audit.json",
+  "task_id": "DEV-000295",
+  "task_revision": 2
 }

dev/tasks/DEV-000218-automatic-expansion-policy.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000218",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "ab840878fe7d21a0a6aeb69193a3d58ea23a56e0",
+  "risk_tier": "E",
+  "intent": "Add a conservative deterministic policy gate for creating additional model-evaluation profiles only after general evaluation evidence remains unresolved.",
+  "requirement_ids": ["general-first evaluation", "bounded additional evaluation", "no unnecessary fleet-wide tests"],
+  "allowed_change_scope": {"modules": ["capability"], "paths": ["modules/capability/domain/task_evaluation.go", "modules/capability/domain/task_evaluation_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000218-automatic-expansion-policy.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "cmd/**", "contracts/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["TaskEvaluationProfile", "TaskEvaluation", "TaskEvaluationExpansionRequest"], "may_change": []},
+  "semantic_owner": "capability owns model qualification evidence and expansion policy",
+  "canonical_state": ["none; this packet creates no persistence or activation authority"],
+  "state_transitions": ["general COMPLETED/PARTIAL unresolved evidence -> bounded additional profile candidate", "qualified candidate -> no expansion"],
+  "side_effects_and_privileges": ["pure deterministic decision; no provider call, no model invocation, no mutation"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["missing trigger evidence or additional cases fails closed; repeated decision is deterministic"],
+  "assumptions": ["a later task supplies task-specific additional cases from an unresolved outcome and schedules them through the existing Work Graph"],
+  "acceptance_scenarios": ["general graph not completed/partial does not expand", "unknown/unsupported/low-scoring candidates expand only with evidence and new cases", "one qualified candidate suppresses expansion", "no provider or hardware label changes the decision"],
+  "required_tests": ["go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production public health check"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000219-reachability-not-quality.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000219",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "7476f43ffa57d55f5a5a9bddc7f1c74e9b87ae0e",
+  "risk_tier": "E",
+  "intent": "Prevent task-evaluation invocation success from being recorded as semantic model quality or support without independent verifier evidence.",
+  "requirement_ids": ["truthful model evidence", "independent verification", "no false qualification"],
+  "allowed_change_scope": {"modules": ["cognitive-worker"], "paths": ["cmd/cognitive-worker/task_evaluation.go", "cmd/cognitive-worker/task_evaluation_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000219-reachability-not-quality.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "modules/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["TaskEvaluationExecutionRequest/Response", "TaskCaseObservation", "Cognitive Gateway"], "may_change": []},
+  "semantic_owner": "capability evidence remains owner; cognitive-worker only records invocation observation",
+  "canonical_state": ["existing task-evaluation evidence; no new persistence"],
+  "state_transitions": ["successful invocation -> UNKNOWN reachability observation", "independent verifier evidence -> future supported/quality observation"],
+  "side_effects_and_privileges": ["no additional provider calls or privileges"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["unknown evidence remains retryable/eligible for a separately verified evaluation; no promotion follows invocation alone"],
+  "assumptions": ["a later verifier task will attach answer-quality evidence and score cases"],
+  "acceptance_scenarios": ["nonempty provider response is not SUPPORTED", "quality score remains zero", "provider invocation failure remains UNKNOWN with critical failure", "no model/hardware label can manufacture quality evidence"],
+  "required_tests": ["go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production public health check"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000220-verifier-evidence-boundary.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000220",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "66ed523248ea6cf0a41383e2206d9a70eeaafda8",
+  "risk_tier": "E",
+  "intent": "Require explicit independent verifier identity and evidence before task evaluation can claim semantic support or non-zero quality.",
+  "requirement_ids": ["independent verifier evidence", "no false quality", "typed model qualification"],
+  "allowed_change_scope": {"modules": ["capability", "agent-worker"], "paths": ["contracts/capability/task_evaluation.go", "modules/capability/domain/task_evaluation.go", "modules/capability/domain/task_evaluation_test.go", "cmd/agent-worker/task_evaluation_executor_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000220-verifier-evidence-boundary.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "cmd/cognitive-worker/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["TaskCaseObservation", "TaskEvaluation", "existing Work Graph callback"], "may_change": ["typed observation fields for verifier evidence"]},
+  "semantic_owner": "capability owns qualification evidence; verifier remains independent of provider invocation",
+  "canonical_state": ["existing capability task-evaluation evidence"],
+  "state_transitions": ["reachability UNKNOWN -> separately verified SUPPORTED only with evidence"],
+  "side_effects_and_privileges": ["no provider invocation or external mutation"],
+  "persistence_and_migrations": ["existing task evaluation persistence is unchanged"],
+  "failure_retry_restart": ["missing verifier fields fail closed; unknown reachability remains non-promotable"],
+  "assumptions": ["a later verifier runtime will produce VerificationEvidenceRef and VerifierIdentity"],
+  "acceptance_scenarios": ["supported without verifier is rejected", "unknown with zero quality remains valid", "verified supported observation aggregates normally", "no hardware/provider name bypasses the boundary"],
+  "required_tests": ["go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production public health check"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000221-task-verifier-runtime.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000221",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "0aab10863cb23824688029c0bab6734f100b4610",
+  "risk_tier": "E",
+  "intent": "Provide an independent deterministic task-verifier runtime and wire model task evaluation through response evidence rather than provider self-assertion.",
+  "requirement_ids": ["independent verifier runtime", "typed answer evidence", "quality qualification boundary", "degraded verifier fallback"],
+  "allowed_change_scope": {"modules": ["capability", "cognitive-worker", "agent-worker", "task-verifier", "deployment"], "paths": ["contracts/capability/task_evaluation.go", "contracts/capability/task_evaluation_execution.go", "cmd/cognitive-worker/task_evaluation.go", "cmd/agent-worker/main.go", "cmd/agent-worker/task_evaluation_executor.go", "cmd/agent-worker/task_evaluation_executor_test.go", "cmd/task-verifier/**", "deploy/docker-compose.prod.yml", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000221-task-verifier-runtime.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "modules/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["TaskEvaluationCase", "TaskEvaluationExecutionRequest/Response", "TaskCaseObservation", "existing worker callback"], "may_change": ["typed verification spec, response envelope and verifier result" ]},
+  "semantic_owner": "capability owns evidence; task-verifier is a replaceable independent verifier adapter and does not own canonical state",
+  "canonical_state": ["existing capability task-evaluation evidence only; verifier has no database"],
+  "state_transitions": ["provider response -> bounded response evidence -> verifier result -> TaskCaseObservation -> TaskEvaluation"],
+  "side_effects_and_privileges": ["local network calls only; no secrets; no external mutation; no authority expansion"],
+  "persistence_and_migrations": ["none; verifier evidence is carried through existing callback and capability persistence"],
+  "failure_retry_restart": ["verifier unavailable returns local fallback/waiting; no quality or promotion claim is made"],
+  "assumptions": ["initial verifier mode is exact-text for bounded deterministic cases; future verifiers may add typed modes under separate task packets"],
+  "acceptance_scenarios": ["exact response produces supported evidence with verifier identity", "mismatch produces unsupported evidence", "cognitive worker never asserts support from invocation alone", "worker wires verifier result before callback", "verifier process has health endpoint and production compose dependency", "verifier loss does not produce false quality"],
+  "required_tests": ["go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production public health and verifier health check"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000222-verifier-modes-and-case-builder.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000222",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "d736500d9818a7748c3715c442edb695c5aed1100",
+  "risk_tier": "E",
+  "intent": "Extend the independent task verifier with a structured JSON field mode and add a bounded case builder driven by unresolved evidence.",
+  "requirement_ids": ["task-aware verification", "additional cases during lifetime", "general-first bounded expansion"],
+  "allowed_change_scope": {"modules": ["capability", "task-verifier"], "paths": ["contracts/capability/task_evaluation.go", "cmd/task-verifier/main.go", "cmd/task-verifier/main_test.go", "modules/capability/domain/task_evaluation.go", "modules/capability/domain/task_evaluation_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000222-verifier-modes-and-case-builder.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "cmd/core-runtime/**", "cmd/creator-web/**", "cmd/agent-worker/**", "cmd/cognitive-worker/**", "modules/identity/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["TaskCaseVerification", "TaskEvaluationCase", "unresolved outcome evidence"], "may_change": ["verification modes and bounded case construction" ]},
+  "semantic_owner": "capability owns evaluation policy; verifier remains stateless adapter",
+  "canonical_state": ["none; case builder returns candidates and does not persist or activate them"],
+  "state_transitions": ["unresolved evidence -> two bounded additional case candidates", "structured response -> verifier evidence -> supported/unsupported"],
+  "side_effects_and_privileges": ["no model calls, no external mutation, no secrets"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["invalid unresolved evidence fails closed; verifier remains stateless and repeatable"],
+  "assumptions": ["generated cases still require an explicit verification spec before quality can be claimed"],
+  "acceptance_scenarios": ["JSON field match verifies with evidence", "JSON mismatch is unsupported", "unresolved evidence yields exactly two bounded probes", "generated cases do not bypass verifier or promotion gate"],
+  "required_tests": ["go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production public health check"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000223-status-reconciliation.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000223",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "ee68e2207eff5535c79cc594637a971cea03d71c",
+  "risk_tier": "E",
+  "intent": "Reconcile the status projection with the merged DEV-000222 verifier stage and preserve explicit remaining runtime and UI gaps.",
+  "requirement_ids": ["current audit evidence", "task lineage accuracy", "negative-state transparency"],
+  "allowed_change_scope": {"modules": ["operations-evidence"], "paths": ["docs/PROJECT_STATUS.md", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000223-status-reconciliation.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/**", "modules/**", "contracts/**", "database/**", "deploy/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["merged task lineage", "existing redacted live evidence"], "may_change": ["operations status projection"]},
+  "semantic_owner": "operations-evidence projection",
+  "canonical_state": ["none; docs are rebuildable projections"],
+  "state_transitions": ["stale task pointer -> merged verifier stage pointer"],
+  "side_effects_and_privileges": ["none; documentation only"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["historical evidence remains immutable"],
+  "assumptions": ["DEV-000222 main revision ee68e22 is the current deployed baseline"],
+  "acceptance_scenarios": ["status names DEV-000222 as last completed", "remaining bridge and current authenticated UI gaps remain explicit", "no secret value is added"],
+  "required_tests": ["go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production public health check"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000224-live-fleet-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000224",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "c4411afaaf21886cba9b5ead586afb26d697a355",
+  "risk_tier": "E",
+  "intent": "Record the current production model-fleet readiness and dynamic tier selection without claiming quality or promotion.",
+  "requirement_ids": ["model fleet/failover", "GPU is not intelligence priority", "truthful operational evidence"],
+  "allowed_change_scope": {"modules": ["operations-evidence"], "paths": ["docs/PROJECT_STATUS.md", "docs/evidence/fleet-readiness-live-2026-08-23-v2.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000224-live-fleet-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/**", "modules/**", "contracts/**", "database/**", "deploy/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["live cognitive-worker fleet readiness response"], "may_change": ["redacted evidence and status projection"]},
+  "semantic_owner": "operations-evidence projection",
+  "canonical_state": ["none; evidence is a rebuildable projection"],
+  "state_transitions": ["live fleet readiness -> redacted evidence record"],
+  "side_effects_and_privileges": ["read-only production inspection"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["unavailable providers remain explicit; no missing data is promoted to ready"],
+  "assumptions": ["fleet endpoint response is authoritative for this observation window"],
+  "acceptance_scenarios": ["FAST unavailable selects available MEDIUM", "HEAVY availability does not imply priority", "LIFEBOAT remains fallback", "secret values are absent"],
+  "required_tests": ["go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production public health and fleet live check"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000225-login-route-fix.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000225",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "e080c34a772caa5d256ab9f4ae0d2568bb8a7fb9",
+  "risk_tier": "E",
+  "intent": "Serve the existing chat/login shell at the direct /login route so users can reach authentication without a 404.",
+  "requirement_ids": ["UI login direct route", "authenticated acceptance entrypoint"],
+  "allowed_change_scope": {"modules": ["creator-web"], "paths": ["cmd/creator-web/server.go", "cmd/creator-web/server_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000225-login-route-fix.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "modules/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing embedded chat/login shell"], "may_change": ["HTTP route mapping only"]},
+  "semantic_owner": "creator-web route projection",
+  "canonical_state": ["none"],
+  "state_transitions": ["GET /login -> existing chat shell"],
+  "side_effects_and_privileges": ["none; GET only"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["route remains deterministic and stateless"],
+  "assumptions": ["authentication behavior remains unchanged and is handled by the existing chat shell"],
+  "acceptance_scenarios": ["GET /login returns 200", "login inputs are present", "root route remains unchanged", "no credential values are added"],
+  "required_tests": ["go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production public health and /login check"],
+  "terminal_gap_states": ["BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000226-ui-acceptance-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000226",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "40b56798e23d852d26156b0bc2abbc518fd6b9b6",
+  "risk_tier": "E",
+  "intent": "Record current authenticated desktop/mobile UI and operations acceptance evidence without mutating production state.",
+  "requirement_ids": ["UI operations acceptance", "authenticated browser evidence", "responsive acceptance"],
+  "allowed_change_scope": {"modules": ["operations-evidence"], "paths": ["docs/PROJECT_STATUS.md", "docs/evidence/authenticated-ui-acceptance-2026-08-23-v2.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000226-ui-acceptance-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/**", "modules/**", "contracts/**", "database/**", "deploy/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["current authenticated browser DOM and visual state", "live production UI responses"], "may_change": ["redacted UI acceptance evidence and status projection"]},
+  "semantic_owner": "operations-evidence projection",
+  "canonical_state": ["none; evidence is rebuildable and redacted"],
+  "state_transitions": ["current browser acceptance -> evidence record"],
+  "side_effects_and_privileges": ["read-only navigation and section inspection; no production mutation"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["missing authenticated session or unavailable section must remain explicit"],
+  "assumptions": ["browser evidence reflects the deployed revision shown in the page metadata"],
+  "acceptance_scenarios": ["root chat authenticated", "diagnostics 7/7", "fleet 4/4 with fallback visible", "learning/reflection visible", "390x844 layout readable", "no secret values retained"],
+  "required_tests": ["go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production public health and authenticated browser evidence"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000227-local-executor.json

@@ -0,0 +1,47 @@
+{
+  "task_id": "DEV-000227",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "1f6ca363ee241b41a89bff1f1b603f15e9873b00",
+  "risk_tier": "E",
+  "intent": "Make the existing bounded local task-evaluation path an explicit local executor capability while preserving truthful durable waiting for unsupported work and keeping the external bridge optional.",
+  "requirement_ids": ["local executor", "truthful degraded execution", "optional external bridge"],
+  "allowed_change_scope": {
+    "modules": ["agent-worker", "operations-status"],
+    "paths": [
+      "cmd/agent-worker/local_fallback.go",
+      "cmd/agent-worker/local_fallback_test.go",
+      "cmd/agent-worker/task_evaluation_executor.go",
+      "cmd/agent-worker/status.go",
+      "cmd/agent-worker/status_test.go",
+      "cmd/agent-worker/main.go",
+      "dev/ACTIVE_TASK.json",
+      "dev/tasks/DEV-000227-local-executor.json",
+      "docs/PROJECT_STATUS.md"
+    ]
+  },
+  "forbidden_change_scope": {
+    "paths": ["architecture/**", "security/**", "contracts/**", "database/**", "deploy/**", "LLM-local/**"]
+  },
+  "allowed_architecture_delta": {
+    "new_cross_module_dependencies": 0,
+    "new_canonical_owners": 0,
+    "new_privileges": 0,
+    "new_third_party_dependencies": 0,
+    "new_database_owner_roles": 0
+  },
+  "contracts": {
+    "consume": ["work.AgentExecutor", "typed task-evaluation runtime endpoints"],
+    "may_change": ["agent-worker status projection adds local executor capability metadata"]
+  },
+  "semantic_owner": "work agent-worker runtime",
+  "canonical_state": ["existing durable Work dispatch, lease and callback state"],
+  "state_transitions": ["unsupported local request -> WAITING", "supported task evaluation -> verified callback"],
+  "side_effects_and_privileges": ["existing bounded internal task-evaluation calls and Work callback only; no external mutation authority"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["unsupported work remains durable WAITING; existing lease recovery remains authoritative"],
+  "assumptions": ["task-evaluation execution and verification endpoints are already deployed internal capabilities", "external bridge may remain absent"],
+  "acceptance_scenarios": ["local status names bounded local executor and capability", "unsupported work never claims completion", "task evaluation still executes, verifies and callbacks", "external bridge status remains separate", "no secret or new privilege is introduced"],
+  "required_tests": ["go test ./cmd/agent-worker/...", "go vet ./cmd/agent-worker/...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production status smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000228-controlled-discovery.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000228",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "2609f31e59d3914cdf4adcf23ec618705277d12a",
+  "risk_tier": "E",
+  "intent": "Expose a read-only, provider-neutral discovery status view so Domovoy can inspect available optional providers and models before requesting qualification, without exposing credential metadata or activating anything.",
+  "requirement_ids": ["controlled discovery", "provider qualification visibility", "optional external tools"],
+  "allowed_change_scope": {"modules": ["cognitive-worker", "operations-status"], "paths": ["cmd/cognitive-worker/discovery.go", "cmd/cognitive-worker/discovery_test.go", "cmd/cognitive-worker/main.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000228-controlled-discovery.json", "docs/PROJECT_STATUS.md"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "contracts/**", "database/**", "deploy/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing LocalProvider discovery probes", "existing capability model metadata"], "may_change": ["read-only cognitive-worker discovery status projection"]},
+  "semantic_owner": "cognitive-worker observation projection",
+  "canonical_state": ["existing Capability discovery registration remains the canonical persisted state"],
+  "state_transitions": ["provider probe -> observed discovery status", "discovery registration remains DISCOVERED/INACTIVE until qualification and promotion"],
+  "side_effects_and_privileges": ["read-only provider probe on explicit status request; no activation, mutation or credential disclosure"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["unavailable provider is reported with health/failure state; persisted discovery remains available through existing owner"],
+  "assumptions": ["provider discovery adapters already enforce bounded requests", "qualification remains a separate task-evaluation and promotion step"],
+  "acceptance_scenarios": ["status lists registered providers deterministically", "model inventory and probe health are visible", "credential references are not returned", "status does not activate or persist a provider", "unknown provider remains absent or unavailable"],
+  "required_tests": ["go test ./cmd/cognitive-worker/...", "go vet ./cmd/cognitive-worker/...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production status smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

dev/tasks/DEV-000229-research-runtime-bridge.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000229",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "22f839df99d8f6abd95f00cf99d34b4b45ace692",
+  "risk_tier": "E",
+  "intent": "Connect authenticated Domovoy/Core requests to the existing bounded Truth/Research web runtime while preserving source freshness, exact citations, conflicts and read-only connector policy.",
+  "requirement_ids": ["Truth/Research runtime", "authenticated internet research", "source evidence"],
+  "allowed_change_scope": {"modules": ["core-runtime", "research-runtime-bridge"], "paths": ["cmd/core-runtime/main.go", "cmd/core-runtime/research_client.go", "cmd/core-runtime/research_client_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000229-research-runtime-bridge.json", "docs/PROJECT_STATUS.md"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "contracts/**", "database/**", "deploy/**", "LLM-local/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing epistemics.WebResearchRequest and ResearchResult", "existing authenticated Creator session"], "may_change": ["authenticated Core-to-research runtime adapter route"]},
+  "semantic_owner": "epistemics research runtime; Core is an authenticated transport boundary",
+  "canonical_state": ["epistemics runtime remains sole owner of persisted truth bundles, claims, beliefs and citations"],
+  "state_transitions": ["authenticated request -> bounded web connector -> evaluated persisted finding"],
+  "side_effects_and_privileges": ["read-only outbound source fetches to preconfigured allowlisted hosts; authenticated user request persists evidence in epistemics owner"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["research runtime unavailable returns explicit gateway failure; no claim is emitted by Core"],
+  "assumptions": ["research runtime allowlist is configured outside code", "web connector retains exact source snapshot and does not invent citations"],
+  "acceptance_scenarios": ["unauthenticated research request is denied", "authenticated request reaches research runtime", "source evidence and finding are returned without fabricated claims", "research runtime remains bounded by allowlist", "no secret is forwarded or returned"],
+  "required_tests": ["go test ./cmd/core-runtime/...", "go vet ./cmd/core-runtime/...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production health and research-runtime readiness smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}