docs: record durable agent canary evidence

Merge pull request 'fix: make agent canary replayable' (#171 ) from codex/wp-301-agent-canary-replayable into main
fix: make agent canary replayable
2026-08-23 03:18:57 +03:00 · 2026-08-23 00:11:50 +00:00 · 2026-08-23 03:10:07 +03:00 · 2026-08-23 00:05:20 +00:00 · 2026-08-23 03:03:43 +03:00 · 2026-08-23 03:01:35 +03:00
34 changed files with 770 additions and 349 deletions
@@ -199,6 +199,26 @@ func (r *WorkRepository) LoadWorkGraph(ctx context.Context, graphID string, revi
 	return graph, nil
 }

+func (r *WorkRepository) SaveGraphSynthesis(ctx context.Context, conflict work.ConflictSet, candidates []work.ResultCandidate, synthesis work.GraphSynthesisCandidate) error {
+	tx, err := r.pool.Begin(ctx)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback(ctx)
+	for _, candidate := range candidates {
+		if _, err := tx.Exec(ctx, `INSERT INTO work.graph_result_candidates(result_candidate_id,graph_id,graph_revision,node_id,author_run_id,artifact_refs,evidence_summary,summary) VALUES($1,$2,$3,$4,$5,$6,$7,$8) ON CONFLICT(result_candidate_id) DO NOTHING`, candidate.ID, candidate.GraphID, candidate.GraphRevision, candidate.NodeID, candidate.AuthorRunID, candidate.ArtifactRefs, candidate.EvidenceSummary, candidate.Summary); err != nil {
+			return err
+		}
+	}
+	if _, err := tx.Exec(ctx, `INSERT INTO work.graph_conflicts(conflict_id,graph_id,graph_revision,node_id,candidate_ids,resolved) VALUES($1,$2,$3,$4,$5,$6) ON CONFLICT(conflict_id) DO NOTHING`, conflict.ID, conflict.GraphID, conflict.GraphRevision, conflict.NodeID, conflict.CandidateIDs, conflict.Resolved); err != nil {
+		return err
+	}
+	if _, err := tx.Exec(ctx, `INSERT INTO work.graph_synthesis_candidates(synthesis_id,graph_id,graph_revision,node_id,candidate_ids,selected_candidate_id,dissent_candidate_ids,verifier_run_id,verifier_identity,evidence_refs,summary,state) VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12) ON CONFLICT(synthesis_id) DO NOTHING`, synthesis.ID, synthesis.GraphID, synthesis.GraphRevision, synthesis.NodeID, synthesis.CandidateIDs, synthesis.SelectedCandidateID, synthesis.DissentCandidateIDs, synthesis.VerifierRunID, synthesis.VerifierIdentity, synthesis.EvidenceRefs, synthesis.Summary, synthesis.State); err != nil {
+		return err
+	}
+	return tx.Commit(ctx)
+}
+
 func (r *WorkRepository) RecoverStaleClaims(ctx context.Context, nowUnixMillis, staleAfterMillis int64) (int64, error) {
 	command, err := r.pool.Exec(ctx, `UPDATE work.agent_dispatch_queue SET state='QUEUED',claimed_by='',updated_at_unix_millis=$1 WHERE state='CLAIMED' AND updated_at_unix_millis <= $2`, nowUnixMillis, nowUnixMillis-staleAfterMillis)
 	if err != nil {
@@ -6,12 +6,16 @@ import (
 	"flag"
 	"fmt"
 	"os"
+	"path/filepath"
+	"strings"
 	"time"

 	"git.cin.su/m/Assistant/adapters/postgres"
+	secretcontracts "git.cin.su/m/Assistant/contracts/secrets"
 	"git.cin.su/m/Assistant/contracts/work"
 	"git.cin.su/m/Assistant/modules/work/application"
 	"git.cin.su/m/Assistant/modules/work/ports"
+	platformsecrets "git.cin.su/m/Assistant/platform/secrets"
 )

 type memoryStore struct{ writes int }
@@ -30,14 +34,24 @@ func main() {
 	enabled := flag.Bool("enable-canary", false, "explicitly enable the manual canary")
 	implementation := flag.String("implementation", "fake-worker", "allowlisted deterministic implementation")
 	postgresMode := flag.Bool("postgres", false, "use the Work PostgreSQL repository instead of in-memory storage")
+	runID := flag.String("run-id", "", "optional unique canary run suffix; generated when omitted")
 	flag.Parse()

-	now := time.UnixMilli(1_700_000_000_000)
-	intent := work.AgentDispatchIntent{DispatchID: "manual-dispatch-1", IdempotencyKey: "manual-idempotency-1", DelegationID: "manual-delegation-1", RunID: "manual-run-1", ImplementationID: *implementation, ImplementationRevision: 1, SourceRevision: "manual-source-1", WorktreeID: "manual-worktree-1", VerificationPlanRef: "manual-verification-1", CreatedAtUnixMillis: now.UnixMilli()}
+	suffix := *runID
+	if suffix == "" {
+		suffix = fmt.Sprintf("%d", time.Now().UnixNano())
+	}
+	now := time.Now().UTC()
+	intent := work.AgentDispatchIntent{DispatchID: "manual-dispatch-" + suffix, IdempotencyKey: "manual-idempotency-" + suffix, DelegationID: work.DelegationID("manual-delegation-" + suffix), RunID: work.AgentRunID("manual-run-" + suffix), ImplementationID: *implementation, ImplementationRevision: 1, SourceRevision: "manual-source-" + suffix, WorktreeID: "manual-worktree-" + suffix, VerificationPlanRef: "manual-verification-" + suffix, CreatedAtUnixMillis: now.UnixMilli()}
 	var store ports.ExecutionStore = &memoryStore{}
 	var closeStore func()
 	if *postgresMode {
-		repository, err := postgres.OpenWork(context.Background(), postgres.ContinuityConfig{Host: os.Getenv("POSTGRES_HOST"), Port: os.Getenv("POSTGRES_PORT"), Database: os.Getenv("POSTGRES_DATABASE"), User: os.Getenv("WORK_POSTGRES_USER"), Password: os.Getenv("WORK_POSTGRES_PASSWORD")})
+		password, err := resolveDatabasePassword()
+		if err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+		repository, err := postgres.OpenWork(context.Background(), postgres.ContinuityConfig{Host: os.Getenv("POSTGRES_HOST"), Port: os.Getenv("POSTGRES_PORT"), Database: os.Getenv("POSTGRES_DATABASE"), User: os.Getenv("WORK_POSTGRES_USER"), Password: password})
 		if err != nil {
 			fmt.Fprintln(os.Stderr, err)
 			os.Exit(1)
@@ -67,3 +81,27 @@ func main() {
 		os.Exit(1)
 	}
 }
+
+func resolveDatabasePassword() (string, error) {
+	if _, ok := os.LookupEnv("WORK_POSTGRES_PASSWORD"); ok {
+		return "", fmt.Errorf("WORK_POSTGRES_PASSWORD direct environment secret is forbidden")
+	}
+	path, ref := os.Getenv("WORK_POSTGRES_PASSWORD_FILE"), os.Getenv("WORK_POSTGRES_CREDENTIAL_REF")
+	if path == "" || ref == "" {
+		return "", fmt.Errorf("WORK_POSTGRES_PASSWORD_FILE and WORK_POSTGRES_CREDENTIAL_REF are required")
+	}
+	root := os.Getenv("SECRET_BACKEND_ROOT")
+	if root == "" {
+		root = "/run/secrets"
+	}
+	cleanRoot := filepath.Clean(root)
+	cleanPath := filepath.Clean(path)
+	if cleanPath != cleanRoot && !strings.HasPrefix(cleanPath, cleanRoot+string(os.PathSeparator)) {
+		return "", fmt.Errorf("database password file escapes protected secret root")
+	}
+	resolver, err := platformsecrets.NewFileResolver(cleanRoot)
+	if err != nil {
+		return "", err
+	}
+	return resolver.ResolveFile(secretcontracts.SecretFileRef{CredentialRef: secretcontracts.CredentialRef(ref), Purpose: secretcontracts.SecretPurposeDatabasePassword, Consumer: secretcontracts.RuntimeConsumerWorkWorker, Path: cleanPath})
+}
@@ -0,0 +1,23 @@
+package main
+
+import (
+	"path/filepath"
+	"testing"
+)
+
+func TestResolveDatabasePasswordRejectsDirectEnvironmentSecret(t *testing.T) {
+	t.Setenv("WORK_POSTGRES_PASSWORD", "literal-secret")
+	if _, err := resolveDatabasePassword(); err == nil {
+		t.Fatal("direct database password environment variable was accepted")
+	}
+}
+
+func TestResolveDatabasePasswordRejectsPathOutsideProtectedRoot(t *testing.T) {
+	root := t.TempDir()
+	t.Setenv("SECRET_BACKEND_ROOT", root)
+	t.Setenv("WORK_POSTGRES_PASSWORD_FILE", filepath.Join(root, "..", "outside"))
+	t.Setenv("WORK_POSTGRES_CREDENTIAL_REF", "credential://domovoy/work/db-password/v1")
+	if _, err := resolveDatabasePassword(); err == nil {
+		t.Fatal("database password path outside protected root was accepted")
+	}
+}
@@ -55,6 +55,19 @@ func main() {
 		}
 		writeJSON(w, graph)
 	})
+	mux.HandleFunc("POST /v1/work-graphs/synthesis", func(w http.ResponseWriter, r *http.Request) {
+		var request application.GraphSynthesisRequest
+		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 4<<20)).Decode(&request); err != nil {
+			http.Error(w, "invalid graph synthesis request", http.StatusBadRequest)
+			return
+		}
+		conflict, synthesis, err := application.SynthesizeGraph(r.Context(), repository, request)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusUnprocessableEntity)
+			return
+		}
+		writeJSON(w, map[string]any{"conflict": conflict, "synthesis": synthesis})
+	})
 	addr := os.Getenv("LISTEN_ADDR")
 	if addr == "" {
 		addr = ":8088"
@@ -53,21 +53,43 @@ type WorkGraph struct {
 }

 type ResultCandidate struct {
-	ID              string
-	GraphID         string
-	GraphRevision   int64
-	NodeID          GraphNodeID
-	AuthorRunID     AgentRunID
-	ArtifactRefs    []EvidenceRef
-	EvidenceSummary string
-	Summary         string
+	ID              string        `json:"id"`
+	GraphID         string        `json:"graph_id"`
+	GraphRevision   int64         `json:"graph_revision"`
+	NodeID          GraphNodeID   `json:"node_id"`
+	AuthorRunID     AgentRunID    `json:"author_run_id"`
+	ArtifactRefs    []EvidenceRef `json:"artifact_refs"`
+	EvidenceSummary string        `json:"evidence_summary"`
+	Summary         string        `json:"summary"`
 }

 type ConflictSet struct {
-	ID            string
-	GraphID       string
-	GraphRevision int64
-	NodeID        GraphNodeID
-	CandidateIDs  []string
-	Resolved      bool
+	ID            string      `json:"id"`
+	GraphID       string      `json:"graph_id"`
+	GraphRevision int64       `json:"graph_revision"`
+	NodeID        GraphNodeID `json:"node_id"`
+	CandidateIDs  []string    `json:"candidate_ids"`
+	Resolved      bool        `json:"resolved"`
+}
+
+type GraphSynthesisState string
+
+const GraphSynthesisVerified GraphSynthesisState = "VERIFIED"
+
+// GraphSynthesisCandidate retains every competing result while recording the
+// independently verified selection. It is a candidate, not an external action
+// or authority grant.
+type GraphSynthesisCandidate struct {
+	ID                  string              `json:"id"`
+	GraphID             string              `json:"graph_id"`
+	GraphRevision       int64               `json:"graph_revision"`
+	NodeID              GraphNodeID         `json:"node_id"`
+	CandidateIDs        []string            `json:"candidate_ids"`
+	SelectedCandidateID string              `json:"selected_candidate_id"`
+	DissentCandidateIDs []string            `json:"dissent_candidate_ids"`
+	VerifierRunID       AgentRunID          `json:"verifier_run_id"`
+	VerifierIdentity    string              `json:"verifier_identity"`
+	EvidenceRefs        []EvidenceRef       `json:"evidence_refs"`
+	Summary             string              `json:"summary"`
+	State               GraphSynthesisState `json:"state"`
 }
@@ -82,3 +82,48 @@ type ExtensionProposal struct {
 	Assumptions            []string
 	CreatedAtUnixMillis    int64
 }
+
+type DevelopmentScaffoldStage string
+
+const DevelopmentScaffoldSandboxed DevelopmentScaffoldStage = "SANDBOXED"
+
+// DevelopmentScaffoldRequest describes the boundary a later control plane
+// would use to create an isolated worktree. This value object itself performs
+// no checkout or filesystem operation.
+type DevelopmentScaffoldRequest struct {
+	ID                  string
+	ProposalRef         string
+	BaseRepoRevision    string
+	WorktreeRef         string
+	TaskIntent          string
+	Modules             []string
+	AllowedPaths        []string
+	ForbiddenPaths      []string
+	ProtectedPaths      []string
+	RequiredTests       []string
+	ArtifactLineageRefs []string
+	ProtectedMainAccess string
+	ProductionAccess    string
+	SecretAccess        string
+	CreatedAt           time.Time
+}
+
+// DevelopmentScaffold is a provenance-linked task-packet candidate. It has
+// no executable instruction, credential, checkout handle or authority grant.
+type DevelopmentScaffold struct {
+	ID                  string
+	Stage               DevelopmentScaffoldStage
+	ProposalRef         string
+	BaseRepoRevision    string
+	WorktreeRef         string
+	TaskIntent          string
+	Modules             []string
+	AllowedPaths        []string
+	ForbiddenPaths      []string
+	RequiredTests       []string
+	ArtifactLineageRefs []string
+	ProtectedMainAccess string
+	ProductionAccess    string
+	SecretAccess        string
+	CreatedAtUnixMillis int64
+}
@@ -0,0 +1,58 @@
+BEGIN;
+
+SET ROLE work_role;
+
+CREATE TABLE IF NOT EXISTS work.graph_result_candidates (
+  result_candidate_id TEXT PRIMARY KEY,
+  graph_id TEXT NOT NULL,
+  graph_revision BIGINT NOT NULL,
+  node_id TEXT NOT NULL,
+  author_run_id TEXT NOT NULL,
+  artifact_refs TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[],
+  evidence_summary TEXT NOT NULL,
+  summary TEXT NOT NULL,
+  recorded_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CHECK (result_candidate_id <> ''), CHECK (graph_id <> ''), CHECK (graph_revision > 0),
+  CHECK (node_id <> ''), CHECK (author_run_id <> ''), CHECK (evidence_summary <> ''), CHECK (summary <> ''),
+  FOREIGN KEY (graph_id, graph_revision) REFERENCES work.graphs(graph_id, revision)
+);
+
+CREATE TABLE IF NOT EXISTS work.graph_conflicts (
+  conflict_id TEXT PRIMARY KEY,
+  graph_id TEXT NOT NULL,
+  graph_revision BIGINT NOT NULL,
+  node_id TEXT NOT NULL,
+  candidate_ids TEXT[] NOT NULL,
+  resolved BOOLEAN NOT NULL DEFAULT FALSE,
+  recorded_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CHECK (conflict_id <> ''), CHECK (graph_id <> ''), CHECK (graph_revision > 0), CHECK (node_id <> ''),
+  CHECK (cardinality(candidate_ids) >= 2),
+  FOREIGN KEY (graph_id, graph_revision) REFERENCES work.graphs(graph_id, revision)
+);
+
+CREATE TABLE IF NOT EXISTS work.graph_synthesis_candidates (
+  synthesis_id TEXT PRIMARY KEY,
+  graph_id TEXT NOT NULL,
+  graph_revision BIGINT NOT NULL,
+  node_id TEXT NOT NULL,
+  candidate_ids TEXT[] NOT NULL,
+  selected_candidate_id TEXT NOT NULL,
+  dissent_candidate_ids TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[],
+  verifier_run_id TEXT NOT NULL,
+  verifier_identity TEXT NOT NULL,
+  evidence_refs TEXT[] NOT NULL,
+  summary TEXT NOT NULL,
+  state TEXT NOT NULL,
+  recorded_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CHECK (synthesis_id <> ''), CHECK (graph_id <> ''), CHECK (graph_revision > 0), CHECK (node_id <> ''),
+  CHECK (cardinality(candidate_ids) >= 2), CHECK (selected_candidate_id <> ''), CHECK (verifier_run_id <> ''),
+  CHECK (verifier_identity <> ''), CHECK (cardinality(evidence_refs) >= 1), CHECK (summary <> ''), CHECK (state = 'VERIFIED'),
+  FOREIGN KEY (graph_id, graph_revision) REFERENCES work.graphs(graph_id, revision)
+);
+
+CREATE INDEX IF NOT EXISTS graph_result_candidates_node_idx ON work.graph_result_candidates(graph_id, graph_revision, node_id);
+CREATE INDEX IF NOT EXISTS graph_conflicts_node_idx ON work.graph_conflicts(graph_id, graph_revision, node_id);
+CREATE INDEX IF NOT EXISTS graph_synthesis_node_idx ON work.graph_synthesis_candidates(graph_id, graph_revision, node_id);
+
+RESET ROLE;
+COMMIT;
@@ -99,8 +99,12 @@ services:
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      WORK_POSTGRES_USER: work_role
-      WORK_POSTGRES_PASSWORD: ${WORK_DB_PASSWORD}
+      WORK_POSTGRES_CREDENTIAL_REF: credential://domovoy/work/db-password/v1
+      WORK_POSTGRES_PASSWORD_FILE: /run/secrets/work_db_password
+      SECRET_BACKEND_ROOT: /run/secrets
    depends_on: { postgres: { condition: service_healthy } }
+    volumes:
+      - assistant_core_secrets:/run/secrets:ro

  agent-worker:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: agent-worker, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
@@ -1,5 +1,5 @@
 {
-  "task_file": "dev/tasks/DEV-000186-extension-proposal-generator.json",
-  "task_id": "DEV-000186",
+  "task_file": "dev/tasks/DEV-000196-agent-canary-live-evidence.json",
+  "task_id": "DEV-000196",
  "task_revision": 1
 }
@@ -0,0 +1,26 @@
+{
+  "task_id": "DEV-000187",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "a09a7e8",
+  "risk_tier": "E",
+  "intent": "Add a fail-closed typed scaffold candidate factory that produces an isolated task-packet descriptor without creating files, reading secrets, or accessing protected main/production.",
+  "requirement_ids": ["WP-602", "Scoped task packet candidate", "Isolated worktree provenance", "Protected path denial"],
+  "allowed_change_scope": {
+    "modules": ["work-agent-execution"],
+    "paths": ["contracts/work/self_development.go", "modules/work/domain/self_development.go", "modules/work/domain/self_development_test.go", "tests/semantic_evolution/self_development_contract_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000187-scaffold-task-packet-candidate.json"]
+  },
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "cmd/**", "adapters/**", "deploy/**", "contracts/authority/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["Existing ExtensionProposal", "ADR-0022 governed development boundary"], "may_change": ["typed Work scaffold candidate value objects"]},
+  "semantic_owner": "work-agent-execution",
+  "canonical_state": ["No durable state; isolated scaffold candidate value object only"],
+  "state_transitions": ["proposal -> SANDBOXED task-packet candidate", "invalid scope/policy -> rejected result"],
+  "side_effects_and_privileges": ["No filesystem mutation, source checkout, secret access, provider call, deployment, promotion, or authority expansion"],
+  "persistence_and_migrations": ["No schema or migration changes"],
+  "failure_retry_restart": ["Deterministic validation is rerunnable; invalid or protected scope fails closed"],
+  "assumptions": ["A later external development control plane performs actual worktree creation", "Human governance remains promotion authority"],
+  "acceptance_scenarios": ["valid proposal produces scoped SANDBOXED descriptor", "absolute/traversal/protected path is rejected", "production and secret access policies must be DENIED", "missing provenance or test plan is rejected", "descriptor contains no command or credential material"],
+  "required_tests": ["go test ./modules/work/domain ./tests/semantic_evolution", "go vet ./...", "go run ./cmd/devctl preflight -task dev/tasks/DEV-000187-scaffold-task-packet-candidate.json", "go run ./cmd/devctl check-diff -task dev/tasks/DEV-000187-scaffold-task-packet-candidate.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_CONFLICT"]
+}
@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000188",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "4d9d1b8",
+  "risk_tier": "E",
+  "intent": "Add typed Work Graph synthesis and independent-verifier gating so conflicting node results remain attributable and cannot be resolved by the producing run.",
+  "requirement_ids": ["WP-403", "ResultCandidate conflict retention", "Synthesis candidate", "Independent graph verifier"],
+  "allowed_change_scope": {"modules": ["work-agent-execution"], "paths": ["contracts/work/graph.go", "modules/work/domain/graph_scheduler.go", "tests/agent_execution/graph_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000188-graph-synthesis-independent-verifier.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "cmd/**", "adapters/**", "deploy/**", "contracts/authority/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["Existing WorkGraph, ResultCandidate and ConflictSet contracts", "IndependentVerification semantics"], "may_change": ["typed GraphSynthesisCandidate contract"]},
+  "semantic_owner": "work-agent-execution",
+  "canonical_state": ["No new persistence; typed graph synthesis candidate only"],
+  "state_transitions": ["conflicting candidates -> attributable synthesis candidate", "verified independent synthesis -> resolved conflict", "failed/forged/self-verification -> rejected"],
+  "side_effects_and_privileges": ["No external mutation, provider call, deployment, or authority expansion"],
+  "persistence_and_migrations": ["No schema or migration changes"],
+  "failure_retry_restart": ["Dissent and candidate lineage are retained; verifier must differ from every producer; rejected synthesis does not resolve conflict"],
+  "assumptions": ["Durable persistence and runtime orchestration already exist and are unchanged", "A later runtime task may persist this typed result"],
+  "acceptance_scenarios": ["conflicting candidates remain attributable", "same producer cannot verify synthesis", "unknown candidate or missing evidence fails closed", "successful independent verification retains dissent and resolves conflict"],
+  "required_tests": ["go test ./tests/agent_execution", "go vet ./...", "go run ./cmd/devctl preflight -task dev/tasks/DEV-000188-graph-synthesis-independent-verifier.json", "go run ./cmd/devctl check-diff -task dev/tasks/DEV-000188-graph-synthesis-independent-verifier.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_CONFLICT"]
+}
@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000189",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "41bc4b5",
+  "risk_tier": "E",
+  "intent": "Persist Work Graph result candidates, conflicts and independently verified synthesis through the work owner and expose the governed synthesis runtime path.",
+  "requirement_ids": ["WP-403", "Durable graph result evidence", "Durable conflict resolution", "Synthesis runtime endpoint"],
+  "allowed_change_scope": {"modules": ["work-agent-execution", "work-storage", "work-graph-runtime"], "paths": ["contracts/work/graph.go", "database/migrations/036_work_graph_result_synthesis.sql", "adapters/postgres/work_repository.go", "modules/work/ports/graph.go", "modules/work/application/graph_runtime.go", "cmd/work-graph-runtime/main.go", "tests/agent_execution/graph_persistence_sql_test.go", "tests/agent_execution/graph_runtime_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000189-durable-graph-synthesis-runtime.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "contracts/authority/**", "modules/epistemics/**", "deploy/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 1},
+  "contracts": {"consume": ["Existing Work Graph ResultCandidate/ConflictSet/GraphSynthesisCandidate contracts", "WP-403 independent verifier gate"], "may_change": ["GraphResult JSON serialization tags", "GraphStore persistence port"]},
+  "semantic_owner": "work-agent-execution",
+  "canonical_state": ["work.graph_result_candidates", "work.graph_conflicts", "work.graph_synthesis_candidates"],
+  "state_transitions": ["result candidate append -> conflict append -> independently verified synthesis append", "failed verification does not persist a resolved synthesis"],
+  "side_effects_and_privileges": ["Work schema writes only; no external mutation, provider call, secret expansion, or authority change"],
+  "persistence_and_migrations": ["Append-only migration 036; one owner-local transaction persists candidates, conflict and synthesis"],
+  "failure_retry_restart": ["Idempotent exact-record inserts; transaction rollback preserves no partial resolution; restart reloads durable evidence"],
+  "assumptions": ["Production migration runner applies migration before runtime endpoint use", "Authenticated upstream boundary already protects runtime access"],
+  "acceptance_scenarios": ["SQL is revision scoped and work-owned", "runtime rejects invalid/self-verifying synthesis", "successful synthesis persists all candidates, dissent and verifier identity atomically", "production canary returns durable success without external side effect"],
+  "required_tests": ["go test ./...", "go vet ./...", "go run ./cmd/devctl preflight -task dev/tasks/DEV-000189-durable-graph-synthesis-runtime.json", "go run ./cmd/devctl check-diff -task dev/tasks/DEV-000189-durable-graph-synthesis-runtime.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl independent", "git diff --check", "CI", "production migration/readiness and authenticated synthesis canary"],
+  "terminal_gap_states": ["BLOCKED_BY_MIGRATION_DECISION", "BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_CONFLICT"]
+}
@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000190",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "5b92cd6a587b1084aa677076fbfb2b05cf8f83d4",
+  "risk_tier": "E",
+  "intent": "Synchronize the project audit status and append-only live evidence with verified production state after the Work Graph and Truth runtime canaries.",
+  "requirement_ids": ["AUDIT-COMPLETION-TRUTH", "live evidence provenance", "current production status"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/PROJECT_STATUS.md", "docs/evidence/audit-runtime-status-2026-08-23-v1.json", "docs/evidence/truth-runtime-canary-2026-08-23-v1.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000190-live-audit-status-sync.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "modules/**", "cmd/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing runtime status contracts", "existing Truth bundle contract"], "may_change": ["audit status projections", "append-only live evidence records"]},
+  "semantic_owner": "project-governance",
+  "canonical_state": ["docs/PROJECT_STATUS.md", "docs/evidence/audit-runtime-status-2026-08-23-v1.json", "docs/evidence/truth-runtime-canary-2026-08-23-v1.json"],
+  "state_transitions": ["stale status projection -> current evidence-backed status"],
+  "side_effects_and_privileges": ["documentation and evidence only; no runtime mutation, secret access or deployment configuration change"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["uncertain or unavailable live evidence remains explicitly pending; no inferred success"],
+  "assumptions": ["production revision and canary identifiers are taken from the verified live checks recorded with this task"],
+  "acceptance_scenarios": ["status reports revision 5b92cd6", "fleet reports FAST selected with all four tiers ready", "agent worker reports recovery-only because bridge is absent", "Truth canary evidence records persisted PROVISIONAL/UNVERIFIED bundle", "authenticated UI and bridge gaps remain explicit"],
+  "required_tests": ["go test ./...", "go vet ./...", "go run ./cmd/devctl preflight -task dev/tasks/DEV-000190-live-audit-status-sync.json", "go run ./cmd/devctl check-diff -task dev/tasks/DEV-000190-live-audit-status-sync.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl independent", "git diff --check", "CI", "production public health check"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}
@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000191",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "5d9124d0dff3777814291c0cd9a69c9d74974cb7",
+  "risk_tier": "E",
+  "intent": "Remove obsolete historical status prose and one superseded unreferenced fleet evidence duplicate while retaining current positive and negative direction evidence, governance lineage and runtime artifacts.",
+  "requirement_ids": ["content hygiene", "current audit directions", "preserve good/bad evidence"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/PROJECT_STATUS.md", "docs/evidence/audit-runtime-status-2026-08-23-v1.json", "docs/evidence/wp-200-wp-301-fleet-execution-status-2026-08-22-v1.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000191-cleanup-obsolete-audit-descriptions.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "modules/**", "cmd/**", "contracts/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["governance lineage and current audit evidence"], "may_change": ["status projection and retained evidence index"]},
+  "semantic_owner": "project-governance",
+  "canonical_state": ["docs/PROJECT_STATUS.md", "docs/evidence/audit-runtime-status-2026-08-23-v1.json"],
+  "state_transitions": ["historical verbose status -> concise current good/bad direction status", "superseded duplicate evidence -> removed after reference check"],
+  "side_effects_and_privileges": ["documentation deletion only; no runtime, schema, secret or deployment mutation"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["retain any file with an active reference or unique evidence; deletion is limited to the named unreferenced duplicate"],
+  "assumptions": ["historical task packets and evidence referenced by them remain retained for provenance"],
+  "acceptance_scenarios": ["status file contains only current direction summaries and governance pointer", "production revision is current", "old status sections are absent", "only the explicitly superseded unreferenced fleet duplicate is removed", "all runtime and architecture files remain unchanged"],
+  "required_tests": ["go test ./...", "go vet ./...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl independent", "git diff --check", "CI", "production public health check"],
+  "terminal_gap_states": ["BLOCKED_BY_CONFLICT", "BLOCKED_BY_SPEC_GAP"]
+}
@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000192",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "413a432e8c661ff702779c5288049eaede948c1b",
+  "risk_tier": "E",
+  "intent": "Record live reconciliation evidence for the durable Learning reflection worker and update the audit direction without changing runtime behavior.",
+  "requirement_ids": ["Learning reflection loop", "reflection backlog reconciliation", "live evidence provenance"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/PROJECT_STATUS.md", "docs/evidence/reflection-runtime-reconciliation-2026-08-23-v1.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000192-reflection-live-reconciliation-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "modules/**", "cmd/**", "contracts/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["reflection worker status contract", "epistemics reflection candidate state"], "may_change": ["audit status projection", "append-only live evidence record"]},
+  "semantic_owner": "project-governance",
+  "canonical_state": ["epistemics.reflection_candidates"],
+  "state_transitions": ["open backlog assessment -> reconciled resolved state evidence"],
+  "side_effects_and_privileges": ["documentation and evidence only; no database mutation"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["worker no-op and durable state query are retained as evidence; no inferred candidate resolution"],
+  "assumptions": ["the production worker's one-shot no-candidate result and the authoritative state query were captured from docker.cin.su"],
+  "acceptance_scenarios": ["worker runs without a pending candidate", "database state reports 31 RESOLVED reflection candidates and no OPEN backlog", "status marks the reflection loop reconciled", "Agent Execution and UI gaps remain explicit"],
+  "required_tests": ["go test ./...", "go vet ./...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl independent", "git diff --check", "CI", "production public health check"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}
@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000193",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "bb18cb4f1c18aee7c22ddbe7259123f96f779b8c",
+  "risk_tier": "E",
+  "intent": "Record the current live model fleet degradation and truthful FAST-first fallback selection after the opportunistic HEAVY provider timeout.",
+  "requirement_ids": ["model fleet/failover", "CPU-first current operation", "truthful degraded readiness"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/PROJECT_STATUS.md", "docs/evidence/audit-runtime-status-2026-08-23-v1.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000193-fleet-live-degraded-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "modules/**", "cmd/**", "contracts/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["live /v1/fleet/readiness response", "existing FleetReadiness and fallback policy"], "may_change": ["fleet evidence projection"]},
+  "semantic_owner": "project-governance",
+  "canonical_state": ["cognitive-worker fleet readiness projection"],
+  "state_transitions": ["HEAVY ready -> timeout/unavailable", "preferred FAST remains selected", "LIFEBOAT remains fallback tier"],
+  "side_effects_and_privileges": ["documentation and evidence only; no provider activation or deployment configuration mutation"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["provider timeout remains degraded evidence; no unavailable model is claimed ready"],
+  "assumptions": ["the live endpoint response was captured from docker.cin.su after the current production deployment"],
+  "acceptance_scenarios": ["FAST/MEDIUM/LIFEBOAT are ready", "HEAVY timeout is explicit", "FAST is selected for CPU-first operation", "LIFEBOAT is the declared fallback", "Agent bridge and authenticated UI gaps remain unchanged"],
+  "required_tests": ["go test ./...", "go vet ./...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl independent", "git diff --check", "CI", "production public health check"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}
@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000194",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "c1db571a39514e65156123b7f9394645183cf2ab",
+  "risk_tier": "E",
+  "intent": "Move the explicit production Agent Execution dry-run canary from direct database secret environment input to protected file/CredentialRef storage and preserve durable lease/callback evidence.",
+  "requirement_ids": ["Agent Execution runtime and recovery", "protected canary configuration", "durable lease/callback canary"],
+  "allowed_change_scope": {"modules": ["agent-canary", "deployment"], "paths": ["cmd/agent-canary/main.go", "cmd/agent-canary/main_test.go", "deploy/docker-compose.prod.yml", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000194-agent-canary-protected-storage.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "modules/**", "contracts/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing protected secret resolver", "existing ExecutionStore and dry-run canary contract"], "may_change": ["agent-canary runtime configuration"]},
+  "semantic_owner": "work-agent-execution",
+  "canonical_state": ["work.agent_dispatch_intents", "work.agent_leases", "work.agent_callback_heads"],
+  "state_transitions": ["explicit canary -> durable dispatch intent -> lease -> heartbeat callback -> result callback"],
+  "side_effects_and_privileges": ["manual opt-in dry-run only; protected database credential read; no external provider or source mutation"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["missing/invalid protected secret fails before database open; direct secret env is rejected; canary remains explicit opt-in"],
+  "assumptions": ["the production compose secret volume already contains the work database credential reference used by agent-worker"],
+  "acceptance_scenarios": ["direct password environment is rejected", "path outside protected root is rejected", "compose renders canary with protected file/ref only", "production opt-in canary writes lease and callback evidence", "normal agent-worker remains recovery-only without an external bridge"],
+  "required_tests": ["go test ./...", "go vet ./...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl independent", "git diff --check", "CI", "production canary and public health check"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}
@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000195",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "7252296a74ab7ff236fae865d63692e0fc6a777d",
+  "risk_tier": "E",
+  "intent": "Make the explicit Agent Execution dry-run canary replayable by generating unique dispatch, lease and callback identities per invocation while retaining durable evidence.",
+  "requirement_ids": ["Agent Execution runtime and recovery", "replayable durable canary", "lease/callback evidence"],
+  "allowed_change_scope": {"modules": ["agent-canary"], "paths": ["cmd/agent-canary/main.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000195-replayable-agent-canary-run-ids.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "modules/**", "contracts/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing canary dry-run contract", "existing durable Work execution records"], "may_change": ["canary identity generation"]},
+  "semantic_owner": "work-agent-execution",
+  "canonical_state": ["work.agent_dispatch_intents", "work.agent_leases", "work.agent_callback_heads"],
+  "state_transitions": ["each explicit canary invocation creates a fresh dispatch identity and durable lease/callback chain"],
+  "side_effects_and_privileges": ["manual dry-run only; no external execution or source mutation"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["repeated invocation does not reuse prior canary identity; lease conflicts remain explicit errors"],
+  "assumptions": ["the protected-storage canary configuration from DEV-000194 is already in main"],
+  "acceptance_scenarios": ["default invocation generates a unique suffix", "operator-supplied run-id remains attributable", "two production canary invocations persist independent durable records"],
+  "required_tests": ["go test ./...", "go vet ./...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl independent", "git diff --check", "CI", "production canary and public health check"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}
@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000196",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "6854458e21ad7ec1c4b736dfabf916ae4f7fac12",
+  "risk_tier": "E",
+  "intent": "Record independently verified production evidence for the protected replayable Agent Execution dry-run canary.",
+  "requirement_ids": ["Agent Execution runtime and recovery", "durable canary evidence"],
+  "allowed_change_scope": {"modules": ["governance status", "evidence"], "paths": ["docs/PROJECT_STATUS.md", "docs/evidence/agent-execution-dry-run-canary-2026-08-23-v1.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000196-agent-canary-live-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "modules/**", "contracts/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing protected canary contract", "existing durable Work execution records"], "may_change": ["status projection and evidence only"]},
+  "semantic_owner": "governance",
+  "canonical_state": ["work.agent_dispatch_intents", "work.agent_leases", "work.agent_callback_heads"],
+  "state_transitions": ["none; evidence records already completed canary state"],
+  "side_effects_and_privileges": ["read-only status/evidence change after an explicit manual dry-run canary"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["no runtime retry; retain the negative external-bridge finding"],
+  "assumptions": ["the production canary output and database rows were captured without secret values"],
+  "acceptance_scenarios": ["evidence contains callback_count 2", "evidence contains durable dispatch intent, ACTIVE lease and callback sequence 2", "status explicitly retains the external bridge gap"],
+  "required_tests": ["go test ./...", "go vet ./...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl independent", "git diff --check", "CI", "production public health check"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}
@@ -1,304 +1,23 @@
 # Assistant project status

-## Current audit delta — 2026-08-22
+## Current audit delta — 2026-08-23

- `CURRENT_PRODUCTION_REVISION = 5960844fcb7b9bfba9c24e18a5d15b569d0d3a08`; public `/healthz` is healthy. Current runtime evidence: `docs/evidence/audit-runtime-status-2026-08-22-v4.json`.
+- `CURRENT_PRODUCTION_STATUS = LIVE_HEALTHY`; public `/healthz` is healthy. The exact deployed revision is authoritative in the deployment log and merge record, not duplicated in this mutable status projection. Evidence: `docs/evidence/audit-runtime-status-2026-08-23-v1.json`.
 - `FAST_PROVIDER_STATUS = LIVE_SMOKE_SUPPORTED`: local CPU gateway authentication is configured through a protected file reference; four bounded local-only advisory cases completed through cognitive-worker. Evidence: `docs/evidence/wp-601-fast-gateway-live-smoke-2026-08-22-v1.json`.
- `MEDIUM_PROVIDER_STATUS = LIVE_AVAILABLE_UNQUALIFIED`; after adapter timeout was extended and benchmark output capped at 256 bytes, all four cases still timed out at 60 seconds. Evidence: `docs/evidence/wp-200-medium-qualification-2026-08-22-v3.json`; no activation was attempted.
- `HEAVY_PROVIDER_STATUS = LIVE_QUALIFIED_UNACTIVATED`; discovery refreshed the stale GPU registry and current `gemma4:26b` passed all four bounded cases (`SUPPORTED`, 1000‰ quality, 0‰ critical failures). Evidence: `docs/evidence/wp-200-heavy-qualification-2026-08-22-v2.json`; binding remains INACTIVE and no activation was attempted.
- `AGENT_EXECUTION_STATUS = RECOVERY_ONLY`; optional `AGENT_EXECUTION_BRIDGE_URL` is wired into production compose but remains unset, and no Codex/bridge runtime is deployed. Durable recovery and status endpoints remain active.
- `FLEET_EXECUTION_EVIDENCE = docs/evidence/audit-runtime-status-2026-08-22-v4.json`; FAST, MEDIUM, HEAVY and LIFEBOAT are currently readiness-ready, selected tier is HEAVY, Heavy gemma4:26b is qualified but inactive, and Medium remains unqualified.
- `BACKUP_RESTORE_EVIDENCE = docs/evidence/wp-002-postgres-restore-2026-08-22-v1.json`; latest backup checksum and isolated restore verified with 11 schemas and 60 tables.
- `UI_AUTHENTICATED_ACCEPTANCE = PENDING`; public login UI is reachable, but no authenticated browser session was available for cabinet visual acceptance.
- `SECURITY_NOTE = one production executor secret was rotated after an accidental diagnostic disclosure; values are not retained in repository evidence.`
-
-Audit date: 2026-08-22. Historical governance checkpoint: DEV-000099 revision 1.
+- `MEDIUM_PROVIDER_STATUS = LIVE_AVAILABLE_UNQUALIFIED`; bounded qualification timed out, so no activation was attempted. Evidence: `docs/evidence/wp-200-medium-qualification-2026-08-22-v3.json`.
+- `HEAVY_PROVIDER_STATUS = LIVE_QUALIFIED_UNACTIVATED`; the qualified GPU binding remains inactive. Evidence: `docs/evidence/wp-200-heavy-qualification-2026-08-22-v2.json`.
+- `AGENT_EXECUTION_STATUS = DURABLE_DRY_RUN_CANARY_VERIFIED`; the explicit production canary persisted a dispatch intent, an ACTIVE lease and callback head sequence 2. No independently operated bridge endpoint is configured, so bridge-backed execution remains unavailable. Evidence: `docs/evidence/agent-execution-dry-run-canary-2026-08-23-v1.json`.
+- `FLEET_EXECUTION_EVIDENCE = docs/evidence/audit-runtime-status-2026-08-23-v1.json`; FAST, MEDIUM and LIFEBOAT are ready, HEAVY is explicitly degraded by provider timeout, FAST remains preferred/selected, and LIFEBOAT is the fallback tier.
+- `TRUTH_RESEARCH_STATUS = LIVE_CANARY_PERSISTED`; the web research canary preserved an OBSERVED/COMPLETE/NO-CONFLICT source chain while leaving the claim UNVERIFIED and belief PROVISIONAL. Evidence: `docs/evidence/truth-runtime-canary-2026-08-23-v1.json`.
+- `LEARNING_REFLECTION_STATUS = LIVE_RECONCILED`; reflection worker returned no pending candidate and the durable state contains 31 RESOLVED candidates with no OPEN backlog. Evidence: `docs/evidence/reflection-runtime-reconciliation-2026-08-23-v1.json`.
+- `BACKUP_RESTORE_STATUS = VERIFIED`; latest checksum and isolated restore evidence is retained in `docs/evidence/wp-002-postgres-restore-2026-08-22-v1.json`.
+- `GOVERNED_SELF_DEVELOPMENT_STATUS = PROPOSAL_AND_SCAFFOLD_ONLY`; no bridge-backed source mutation, promotion or rollback is claimed.
+- `UI_AUTHENTICATED_ACCEPTANCE = PENDING`; public login UI is reachable, but authenticated cabinet visual acceptance remains unproven.

 ## Current governance checkpoint

- `DEV_000099_STATUS = COMPLETED`
- `LAST_COMPLETED = DEV-000098 Governance Sentinel V2: full task-packet validation, scope-conflict rejection, architecture/base checks, required-test enforcement and independent verifier`
- `ACTIVE_TASK = dev/tasks/DEV-000099-governance-consolidation.json revision 1`
- `LINEAGE_DECISION = docs/GOVERNANCE_LINEAGE_DECISION_2026-08-22.md; DEV-000073 historical variants are preserved as evidence and are not current authority`
- `REGISTRY_STATUS = YAML and JSON semantic mirrors agree; human registry projection synchronized with ADR-0017 ownership and current protected paths`
- `PRODUCTION_DOMAIN = docker.cin.su; shared docker-test remains prohibited`
- `RUNTIME_CHANGE = none; this governance consolidation changes repository authority/projections only`
- `NEXT_RECOMMENDED_STEP = create a separately scoped WP-002 production recovery task packet; production changes remain pending that packet`
-
-Audit date: 2026-08-17. Active implementation: DEV-000072 revision 1.
-
-## DEV-000072 checkpoint
-
- `DEV_000072_STATUS = LOCAL_ACCEPTANCE_PASS`
- `LAST_COMPLETED = semantic deferral boundary V1 implementation plus regression/generalization acceptance: deterministic semantic candidates, cognitive interpretation gateway path, owner-local candidate provenance persistence, mixed-intent planning input propagation, punctuation/metamorphic stability fixes, capability-gap/reminder/work-path repair, and live A/B/C trace evidence`
- `ARCHITECTURE_CHANGE = none; interaction owner remains unchanged and no new cross-owner dependency was accepted`
- `SEMANTIC_BOUNDARY_CHANGE = deterministic interpretation no longer acts as unquestionable final truth for low-confidence / broader-interpretation / mixed-intent cases; core runtime can request typed cognitive reinterpretation through the existing provider-neutral gateway`
- `PERSISTENCE_CHANGE = migration 027 adds secondary speech act / applicability / selection reason on interaction interpretations plus semantic candidate provenance tables`
- `GIT_ANCESTRY_STATUS = PASS: current branch merge-base equals origin/main at 64870798b9a50f895c99d24441703f366df5c98a; DEV-000071 commit c1aff60443829892ba70104f40b55de01f186a7f is contained in origin/main`
- `CHECK_DIFF_STATUS = PASS: diff scope checks OK for DEV-000072 against base 64870798b9a50f895c99d24441703f366df5c98a`
- `KNOWN_BASELINE_COMPARISON = suite_v1 baseline failed_available 4 / intent 0 / capability 3 / consequence 1 -> current failed_available 0 / intent 0 / capability 0 / consequence 0`
- `HOLDOUT_AND_GENERALIZATION_COMPARISON = suite_v2 baseline failed_available 18 / intent 3 / capability 7 / consequence 4 / unknown 7 -> current failed_available 0 / intent 0 / capability 0 / consequence 0 / unknown 0`
- `UNNECESSARY_COGNITION = no observed increase in suite_v1 or suite_v2 current-run`
- `UNNECESSARY_CLARIFICATION = current replay counts remain observable (suite_v1 1, suite_v2 5) and are recorded explicitly for operator review rather than hidden by aggregate PASS`
- `LIVE_TRACE_EVIDENCE = PASS: raw CPU Qwen understood "ты кто" and punctuation-free modal request; Domovoy semantic path now routes "ты кто" and "можешь расказать об утре" into cognition-worthy interpretation; gateway-to-same-CPU trace preserved question semantics`
- `METAMORPHIC_EVIDENCE = docs/evidence/semantic-deferral-metamorphic-evidence-2026-08-17-v1.json`
- `RAW_MODEL_BOUNDARY = recorded explicitly: raw cognitive models identify themselves as provider/model provenance; this is not patched inside Interaction and remains a later context-compilation milestone`
- `TESTS_PASS = go test ./...; go vet ./...; go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json; go run ./cmd/devctl check-architecture; go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json; tests/cognitive_advisory/cognitive_worker_env_policy_test.ps1; tests/owner_acl/verify.ps1 -DockerContext docker-prod -PostgresContainer assistant-postgres-1; ASSISTANT_LIVE_SEMANTIC_TRACE=1 go test ./cmd/cognitive-worker -run TestLiveInterpretationTrace -v`
- `COGNITIVE_CONTEXT_GAP = still open by design in this milestone: raw providers identify themselves as Qwen/Gemma provenance when Domovoy identity/context is not compiled into the prompt`
- `PRODUCTION_STATUS = pending promotion/deploy from this checkpoint`
- `NEXT_RECOMMENDED_STEP = finish DEV-000072 production promotion, apply migration 027, redeploy runtime, and verify live /chat against the promoted artifact`
-
-## DEV-000071 checkpoint
-
- `DEV_000071_STATUS = COMPLETED`
- `LAST_COMPLETED = factual production cognitive-path audit, real router reality report, preserved suite_v1 baseline, new 50-case generalization/holdout structural corpus, new 16-case free-form cognitive baseline against the eligible local CPU binding, and provenance-preserving production failure evidence`
- `ARCHITECTURE_CHANGE = none; milestone remains audit/evaluation/evidence only`
- `RUNTIME_CHANGE = none; no behavior patching and no lifecycle/activation changes were made to improve scores`
- `PRODUCTION_COGNITIVE_PATH_AUDIT = docs/evidence/production-cognitive-path-audit-2026-08-17-v1.json`
- `REAL_PRODUCTION_FINDING = "обратись к модели gemma4 и спроси сколько звезд на небе" was persisted as ASSERTION by deterministic-v1, never invoked the Cognitive Gateway, and therefore never reached the provider-neutral router`
- `REGISTERED_COGNITIVE_IMPLEMENTATIONS = local-cpu-primary VALIDATED/AVAILABLE; local-gpu-opportunistic DISCOVERED/UNKNOWN; openai-bootstrap DISCOVERED/UNKNOWN disabled`
- `ELIGIBLE_COGNITIVE_IMPLEMENTATIONS = exactly one observed eligible binding in production: local CPU binding-9e5e9779cd10b907c3695374 in CANARY`
- `OLLAMA_HUMAN_CHAT_INVOCATION_COUNT = 0 observed gateway invocations`
- `CPU_GATEWAY_INVOCATION_COUNT = 14`
- `ROUTER_REALITY = provider-neutral architecture exists, but current production does not demonstrate meaningful live choice among multiple eligible cognitive bindings`
- `DETERMINISTIC_BOUNDARY = deterministic interpretation can defer to cognition, but a wrong deterministic interpretation can still terminate the path before cognition; no evidence that cognition revises interpretation later in the current /chat path`
- `CENTRAL_HYPOTHESIS = SUPPORTED`
- `SUITE_V1_STATUS = preserved unchanged`
- `GENERALIZATION_SUITE = tests/reality_evaluation/suite_v2_generalization.json`
- `GENERALIZATION_BASELINE_RESULTS = TOTAL_CASES 50; DEVELOPMENT_CASES 29; HOLDOUT_CASES 21; SOLVED_AUTONOMOUSLY 26; CORRECT_HUMAN_INTERVENTION 1; GENUINE_CAPABILITY_GAPS 5; FAILED_WITH_AVAILABLE_CAPABILITY 18`
- `GENERALIZATION_FAILURE_COUNTS = INTENT_FAILURES 3; CONTEXT_FAILURES 0; CAPABILITY_SELECTION_FAILURES 7; CONSEQUENCE_REASONING_FAILURES 4; CAPABILITY_FAILURES 7; UNKNOWN_FAILURES 7`
- `GENERALIZATION_WORST_FAILURES = real production ask-model wording collapses to ASSERTION; ask-model typo variant also collapses to ASSERTION; "подумай и скажи как лучше поступить" falls through to non-cognitive deterministic handling; mixed investigate+patch request plans investigation but drops MODIFY_CODE requirement; correction wording still swallows code-edit intent in "исправь ..."`
- `COGNITIVE_BASELINE_ARTIFACT = docs/evidence/cognitive-generalization-baseline-2026-08-17-v1.json`
- `COGNITIVE_BASELINE_RESULTS = TOTAL_CASES 16; DEVELOPMENT_CASES 9; HOLDOUT_CASES 7; PASSED_CASES 7`
- `COGNITIVE_FAILURE_COUNTS = UNSUPPORTED_CERTAINTY 0; ANTI_SYCOPHANCY_FAILURES 1; UNCERTAINTY_FAILURES 6; CAPABILITY_FAILURES 2; CONSEQUENCE_FAILURES 0; FABRICATED_OBSERVATION_FAILURES 1; FABRICATED_ACTION_FAILURES 0`
- `COGNITIVE_FINDINGS = current eligible CPU binding is strongest on preference preservation, no-access honesty and non-fabricated destructive caution, but weak on explicit uncertainty phrasing, capability-gap wording, and preserving the boundary between suggestion and actual external execution`
- `ENDPOINT_CHECKS = CPU /v1/models AVAILABLE; GPU Ollama /api/tags AVAILABLE; GPU availability does not imply production router eligibility`
- `EVALUATOR_STATUS = PASS: structural baseline uses objective deterministic evidence; cognitive baseline is explicitly heuristic and marked as evidence-for-review rather than truth`
- `HUMAN_REVIEW_STATUS = PASS: all new artifacts are operator-readable and replayable`
- `PRODUCTION_STATUS = healthy`
- `PRODUCTION_REVISION = 3aa981bc596575926549f6133a1dad1a863e913f`
- `PRODUCTION_REDEPLOYED = no runtime redeploy required; milestone changes are tooling/evidence/status only`
- `TESTS_PASS = go test ./...; go vet ./...; go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json; go run ./cmd/devctl check-architecture; go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json; tests/cognitive_advisory/cognitive_worker_env_policy_test.ps1; tests/owner_acl/verify.ps1 -DockerContext docker-prod -PostgresContainer assistant-postgres-1; CPU endpoint /v1/models; GPU Ollama /api/tags; production /healthz`
- `WHAT_RESULTS_ACTUALLY_SHOW = Domovoy is no longer just missing cosmetic natural-language coverage; the measured gap is structural: some natural action-like utterances are finalized by deterministic interpretation before cognition and routing can help. Multi-provider architecture exists, but production evidence still shows only one effective human-chat cognitive path through the CPU canary binding.`
- `NEXT_RECOMMENDED_REVISION = targeted behavior work only after this baseline: treat deterministic interpretation as a revisable candidate for ambiguous action-like utterances, broaden ask-model / think / mixed-intent routing, and improve cognitive uncertainty/capability-gap phrasing without weakening truthfulness or non-execution guarantees`
-
-## DEV-000070 checkpoint
-
- `DEV_000070_STATUS = COMPLETED`
- `LAST_COMPLETED = replayable Reality Evaluation Harness V1 with 38 heterogeneous cases, deterministic objective evaluator, operator-readable baseline report, and committed baseline artifact`
- `ADR_STATUS = no new ADR required`
- `ARCHITECTURE_CHANGE = none; evaluation remains tooling/evidence, not a new canonical owner`
- `NEW_CANONICAL_TYPES = none`
- `EVALUATION_CASE_FORMAT = versioned JSON corpus at tests/reality_evaluation/suite_v1.json with scenario ID, multi-turn conversation, context/evidence, risk context, expected properties and prohibited properties`
- `BASELINE_RESULTS = TOTAL_CASES 38; SOLVED_AUTONOMOUSLY 25; CORRECT_HUMAN_INTERVENTION 4; UNNECESSARY_HUMAN_INTERVENTION 0; GENUINE_CAPABILITY_GAPS 5; FAILED_WITH_AVAILABLE_CAPABILITY 4`
- `FAILURE_COUNTS = TRUTHFULNESS_FAILURES 0; FALSE_EXECUTION_CLAIMS 0; INTENT_FAILURES 0; CONTEXT_FAILURES 0; CAPABILITY_SELECTION_FAILURES 3; CONSEQUENCE_REASONING_FAILURES 1; CONTINUATION_FAILURES 0; UNKNOWN_FAILURES 1`
- `WORST_FAILURES = A02 identity question routed as ANSWER instead of COGNITION; J01 correction wording ("исправь") captures a software-edit request as CORRECTION instead of durable work; J02 investigate+patch wording falls through to ANSWER instead of durable work planning; M01 destructive delete with known no-backup risk lacks explicit consequence-aware clarification`
- `EVALUATOR_INDEPENDENCE_STATUS = PASS: objective deterministic checks over speech act, focus/context, work creation, capability requirements, delegation candidates and non-execution claims; no self-grading model used`
- `HUMAN_REVIEW_STATUS = PASS: operator-readable Markdown report plus per-case JSON artifact with review slots; normal /chat unchanged`
- `REPLAY_STATUS = PASS: same versioned corpus can be rerun through cmd/cognitive-benchmark/realityeval without changing expectations`
- `PRODUCTION_STATUS = healthy`
- `PRODUCTION_REVISION = 4352e00491eaed6da032003a6bf032a4c6990fe7`
- `PRODUCTION_REDEPLOYED = no runtime redeploy required; milestone changes are tooling/evidence/status only`
- `TESTS_PASS = go test ./...; go vet ./...; go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json; go run ./cmd/devctl check-architecture; go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json; tests/cognitive_advisory/cognitive_worker_env_policy_test.ps1; tests/owner_acl/verify.ps1 -DockerContext docker-prod -PostgresContainer assistant-postgres-1; production creator-web /healthz HTTP 200; docker-prod image revision confirmation`
- `WHAT_RESULTS_ACTUALLY_SHOW = current Domovoy is already strong on explicit intent preservation, append-only correction history, contextual project focus, honest capability-gap handling and avoiding false success claims; the clearest baseline weakness is consequence reasoning when destructive risk context is known but not surfaced by the deterministic layer`
- `NEXT_RECOMMENDED_REVISION = target evidence-backed behavior fixes only: (1) identity/social questions should consistently route to cognition, (2) correction wording must not swallow software-edit intents, (3) investigate+patch mixed requests should create durable work, (4) destructive requests with known no-backup context should force consequence-aware clarification`
-
-## DEV-000069 checkpoint
-
- `DEV_000069_STATUS = PRODUCTION_ACTIVE`
- `LAST_COMPLETED = ADR-0017 accepted; general agent delegation / Codex bridge production baseline; live delegation persistence and resume lifecycle; production continuation regression fix for CONTINUED/REJECTED attention response projection; live production delegation resumed on the same Delegation after human Continue`
- `ADR_STATUS = ADR-0017 accepted`
- `OWNERSHIP_STATUS = no new owner; Work owns Delegation / AgentRun / AgentResult / DelegationVerification; Continuity owns AttentionItem / HumanResponse; Epistemics owns ExperienceRecord`
- `DELEGATION_LIFECYCLE_STATUS = PASS: Delegation persisted; AgentRun #1 reached EXECUTION_WINDOW_EXHAUSTED; AgentRun #2 reached HUMAN_DECISION_REQUIRED/BLOCKED; same Delegation resumed into AgentRun #3 after authenticated human continuation`
- `EXECUTION_WINDOW_STATUS = PASS: exhaustion checkpoint did not fail higher-level Delegation; same Delegation resumed without requesting the human to restate the full task`
- `HUMAN_DECISION_STATUS = PASS: production created AGENT_DELEGATION AttentionItem with human-readable question; authenticated human continuation path is now persisted without continuity DB constraint failure`
- `RESULT_VERIFICATION_STATUS = in progress at this checkpoint: live docs-only artifact path is the accepted verification target for the resumed coding-agent run`
- `NON_CODEX_TRANSFER_STATUS = PASS at architecture level: canonical HumanIntent / Work / Delegation / AgentRun contracts remain agent-neutral and do not require Codex-specific canonical entities`
- `REGRESSION_FIX_STATUS = PASS: migration 026 allows attention response projection outcomes CONTINUED / REJECTED so resolved delegation attention can persist without 500`
- `TESTS_PASS = go test ./...; go vet ./...; go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json; go run ./cmd/devctl check-architecture; go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json; tests/cognitive_advisory/cognitive_worker_env_policy_test.ps1; tests/owner_acl/verify.ps1 -DockerContext docker-prod -PostgresContainer assistant-postgres-1; production artifact confirmation; production health; live continuity response endpoint returned 201 CONTINUED`
- `LIVE_ACCEPTANCE = PASS IN PROGRESS: external /chat created real delegation f693ed472239d083e39e8fd87efba9b7; real run #1 exhausted; real run #2 blocked for human decision; production response continuation bug reproduced, fixed, promoted and redeployed; same delegation resumed into run #3 9345bfaf4b5c538f01207442806cf375`
- `PRODUCTION_STATUS = healthy`
- `PRODUCTION_REVISION = 4352e00491eaed6da032003a6bf032a4c6990fe7`
- `ACTIVE_COGNITIVE_BINDINGS = CPU CANARY allowed only where explicitly requested; no ACTIVE binding promotion`
- `OPENAI_REAL_CREDENTIAL = not required / not activated`
-
-## DEV-000067 checkpoint
-
- `DEV_000067_STATUS = PRODUCTION_FOUNDATION_ACTIVE`
- `LAST_COMPLETED = ADR-0016 accepted; no new Learning owner; Epistemics-owned SystemExpectation / ExperienceRecord / ReflectionCandidate contracts; Capability-owned SkillProfile / FastPathDecision lifecycle contracts; append-only migration 023; owner-local regression tests for positive reminder experience, user correction reflection, fast-path decline, and repeated failure skill degradation`
- `ADR_STATUS = ADR-0016 accepted`
- `OWNERSHIP_STATUS = no new owner; Experience/Expectation/Reflection belong to Epistemics; Skill/FastPath lifecycle belongs to Capability; Interaction/Continuity/Work/Capability state is referenced by typed refs only`
- `LEARNING_BOUNDARY_STATUS = no LearningManager, no self-modifying loop, no prompt optimizer, no automatic source/deployment/Authority mutation`
- `EXPERIENCE_STATUS = can represent OriginalHumanIntent, HumanUtterance, context refs, help method, capability usage/gap refs, expectation, actual outcome, HumanResponse/correction refs, verification evidence`
- `REFLECTION_STATUS = deterministic ReflectionCandidate foundation exists; future cognitive reflection must route through Cognitive Gateway/Router and produce validated candidates only`
- `SKILL_STATUS = SkillProfile lifecycle CANDIDATE/EVALUATING/VALIDATED/DEGRADED/SUSPENDED/RETIRED; fast path can decline with NOT_APPLICABLE/LOW_CONFIDENCE/OUT_OF_DISTRIBUTION/CONFLICT/STALE and return to thinking`
- `EVIDENCE_RETENTION_STATUS = skill degradation/replacement preserves supporting and failure experience refs; no source evidence deletion path introduced`
- `RUNTIME_STATUS = persistence foundation is present; production runtime credential wiring for Epistemics writes is intentionally not expanded in this checkpoint`
- `NOTIFICATION_RECEIVER_STATUS = local receiver endpoint corrected to canonical assistant.cin.su spelling`
- `PRODUCTION_SCHEMA_STATUS = migration 023 applied; epistemics system_expectations / experience_records / reflection_candidates present; capability skill_profiles / skill_profile_heads present; seed skill skill-obvious-reminder-response-v1 VALIDATED`
- `TESTS_PASS = go test ./...; go vet ./...; go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json; go run ./cmd/devctl check-architecture; go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json; tests/cognitive_advisory/cognitive_worker_env_policy_test.ps1; tests/owner_acl/verify.ps1 -DockerContext docker-prod -PostgresContainer assistant-postgres-1; notification receiver no-display poll; production health; production /chat HTTP 200`
- `PRODUCTION_STATUS = healthy`
- `PRODUCTION_REVISION = origin/main 2de2885f2f143d41ce0d9cf09ca12a6e5751c52c; Docker runtime artifact not rebuilt because new runtime paths are not activated and migration/script/status were sufficient`
- `ACTIVE_COGNITIVE_BINDINGS = none; CPU CANARY unchanged`
- `OPENAI_REAL_CREDENTIAL = not required / not activated`
-
-## DEV-000066 checkpoint
-
- `DEV_000066_STATUS = PRODUCTION_ACTIVE`
- `LAST_COMPLETED = ADR-0015 accepted; Continuity-owned HumanResponse contract foundation; ResponseTargetResolution semantics; append-only human_responses migration; Attention response projection fields; deterministic COMPLETE/SNOOZE/CANCEL/DISMISS interpretation; Creator Web response buttons over ordinary /chat; ActiveProjectFocus leak regression under Interaction semantics`
- `ADR_STATUS = ADR-0015 accepted`
- `OWNERSHIP_STATUS = no new owner; HumanResponse and response target resolution belong to Continuity; Interaction remains utterance/original-intent owner`
- `REMINDER_RESPONSE_STATUS = COMPLETE records USER_REPORTED_COMPLETE, SNOOZE rearms same ProspectiveItem, CANCEL suppresses reminder; ambiguous target asks clarification`
- `CONTEXT_STATUS = ActiveProjectFocus treated as contextual evidence, not global mode; unrelated new intents do not inherit stale project focus`
- `HUMAN_SURFACE_STATUS = /chat remains primary; Today buttons send natural language through the same backend semantics`
- `AUTHORITY_STATUS = no new external mutation authority; human reported completion is not verified world truth`
- `LLM_FREE_STATUS = obvious response operations are deterministic and do not require cognitive model`
- `TESTS_PASS = go test ./...; go vet ./...; go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json; go run ./cmd/devctl check-architecture; go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json; tests/cognitive_advisory/cognitive_worker_env_policy_test.ps1; tests/owner_acl/verify.ps1 -DockerContext docker-prod -PostgresContainer assistant-postgres-1`
- `LIVE_ACCEPTANCE = PASS: external /chat created real reminders; SNOOZE after delivery re-armed the same ProspectiveItem and redelivered once without duplicate AttentionItem; COMPLETE after delivery closed Attention as USER_REPORTED_COMPLETE; CANCEL before delivery suppressed ProspectiveItem and produced no AttentionItem after due window; stale UPO ActiveProjectFocus cleared`
- `PRODUCTION_STATUS = healthy`
- `PRODUCTION_REVISION = 071adb5ecbf31325678a557c371c512c486d8274`
- `ACTIVE_COGNITIVE_BINDINGS = none; CPU CANARY unchanged`
- `OPENAI_REAL_CREDENTIAL = not required / not activated`
-
-## DEV-000065 checkpoint
-
- `DEV_000065_STATUS = COMPLETED`
- `LAST_COMPLETED = ADR-0014 accepted; Continuity-owned AttentionItem contract and persistence; due reminder scanner; Commit internal prospective notification endpoint; human-facing Chat / Today / History surface; relative reminder parsing for "через N минут"; deterministic due-delivery regression tests; notification binding origin corrected to assistant.cin.su revision 2`
-## DEV-000068 checkpoint
-
- `DEV_000068_STATUS = COMPLETED`
- `LAST_COMPLETED = Runtime Experience + Reflection Loop V1: production runtime now records meaningful ExperienceRecords, deterministic ReflectionCandidates and SkillProfile evidence from /chat, reminder response, correction, capability and fast-path-decline outcomes`
- `RUNTIME_EXPERIENCE_LOOP = ACTIVE for production interactions; no LearningManager and no automatic self-modification`
- `REFLECTION_STATUS = deterministic candidate generation only; candidates cannot mutate skills, Authority, source code, deployment or canonical lifecycle`
- `SKILL_EVIDENCE_STATUS = skill-obvious-reminder-response-v1 accumulates evidence from target-resolution outcomes; current production SkillProfile status is SUSPENDED after repeated ambiguous/unsupported acceptance probes, demonstrating deterministic degradation without deletion`
- `FAST_PATH_STATUS = uncertain/unsupported continuation can decline and return to clarification/fallback instead of guessed mutation`
- `OPERATOR_INSPECTION = Creator Console exposes recent ExperienceRecords, ReflectionCandidates and SkillProfile status through authenticated proxy`
- `HUMAN_CHAT_URL = https://assistant.cin.su/chat`
- `ACTIVE_COGNITIVE_BINDINGS = none; CPU CANARY unchanged`
- `OPENAI_REAL_CREDENTIAL = not required / not activated`
- `TESTS_PASS = go test ./...; go vet ./...; go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json; go run ./cmd/devctl check-architecture; go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json; tests/cognitive_advisory/cognitive_worker_env_policy_test.ps1; tests/owner_acl/verify.ps1 -DockerContext docker-prod -PostgresContainer assistant-postgres-1; production artifact confirmation; production health`
- `LIVE_ACCEPTANCE = PASS: reminder completion produced positive ExperienceRecord; explicit correction produced USER_CORRECTED ExperienceRecord and ReflectionCandidate; unsupported/uncertain continuation produced fast-path decline/fallback evidence without guessed mutation; operator learning feed returns ExperienceRecords, ReflectionCandidates and SUSPENDED SkillProfile status; /chat reachable and human-facing replies did not expose learning IDs`
- `PRODUCTION_STATUS = healthy`
- `PRODUCTION_REVISION = runtime artifact 4bfca4fe24dfebda1f248003e3b9e42a0a9f9dad`
- `NEXT_RECOMMENDED_REVISION = DEV-000069 only after separate approval; no next milestone started automatically`
-
- `ADR_STATUS = ADR-0014 accepted`
- `OWNERSHIP_STATUS = no new owner; AttentionItem belongs to Continuity; notification delivery remains Commit/Capability/receiver path`
- `REMINDER_LIFECYCLE_STATUS = ARMED -> TRIGGERED -> REVALIDATING -> DELIVERED implemented for due scanner`
- `REMINDER_DELIVERY_STATUS = PASS: production live delayed reminder delivered through Commit deliver-prospective-notification-v1 and immutable receiver receipt`
- `ATTENTION_STATUS = typed AttentionItem PENDING -> DELIVERING -> DELIVERED foundation implemented`
- `HUMAN_SURFACE_STATUS = /chat remains primary; Today/Attention and History added; Operator Console preserved at /`
- `AUTHORITY_STATUS = external notification still requires Commit authorization, current Creator authority context, and active Capability notification binding`
- `LLM_FREE_STATUS = deterministic reminder firing does not require cognitive model; LLM-free env policy regression PASS`
- `TESTS_PASS = go test ./...; go vet ./...; go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json; go run ./cmd/devctl check-architecture; go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json; tests/cognitive_advisory/cognitive_worker_env_policy_test.ps1; tests/owner_acl/verify.ps1 -DockerContext docker-prod -PostgresContainer assistant-postgres-1; production live delayed reminder acceptance; production /chat attention and capability-gap acceptance`
- `LIVE_ACCEPTANCE = PASS: "Напомни мне через 3 минуты проверить уведомление." persisted ARMED reminder, transitioned to DELIVERED, generated AttentionItem, delivered notification through Commit, persisted SUCCEEDED attempt and receiver receipt, duplicate counts action_attempts=1 attention_items=1; "Отправь Ивану письмо." returned readable capability gap; "Что сейчас требует моего внимания?" answered from canonical Today with cognition=not_requested`
- `PRODUCTION_STATUS = healthy`
- `PRODUCTION_REVISION = origin/main 1113ced623896f1498d606653d71f36c361e9bb0; creator-web deployed at 1113ced623896f1498d606653d71f36c361e9bb0; continuity-runtime deployed at 2ec53e40cf19c609193c1aa74955573cac7abfe1; core-runtime/commit-runtime deployed at a0dce634f3c6efec0481f730c9dcc12797749ec4`
- `KNOWN_LIMITATION = one early DEV-000065 live probe occurred before notification binding origin revision 2 and produced UNKNOWN_OUTCOME; later regression prevents UNKNOWN_OUTCOME from being marked as delivered`
- `NEXT_STEP = Human response operations for attention/reminders: Done/Snooze/Cancel semantic commands, if separately approved`
-
-## DEV-000064 checkpoint
-
- `DEV_000064_STATUS = COMPLETED`
- `LAST_COMPLETED = ADR-0013, Capability-owned generic implementation registry/resolution/selection/gap contracts, deterministic evidence-weighted resolver V1, capability gap acquisition strategy foundation, generic capability usage observations, Continuity reminder metadata, authenticated creator reminder registration endpoint, /chat reminder scheduling path, /chat SEND_EMAIL gap path, capability-aware "what can you do" response`
- `CAPABILITY_REGISTRY_STATUS = generic CapabilityImplementation + CapabilityGap + CapabilityUsageObservation foundation added under existing capability owner`
- `COGNITIVE_RELATION_STATUS = cognition remains resolved/invoked through existing Cognitive Registry/Gateway; no parallel cognitive router introduced`
- `REMINDER_CAPABILITY_STATUS = internal-reminder-scheduler-v1 seeded as VALIDATED/ACTIVE/AVAILABLE implementation for SCHEDULE_REMINDER`
- `CAPABILITY_GAP_STATUS = unsupported SEND_EMAIL persists CapabilityGap with OriginalHumanIntent/Utterance correlation`
- `AUTHORITY_STATUS = capability and CredentialRef do not grant Authority; reminder registration requires authenticated creator session and creates only Continuity-owned prospective state`
- `ACTIVE_COGNITIVE_BINDINGS = none; CPU CANARY unchanged`
- `OPENAI_REAL_CREDENTIAL = not required / not activated`
- `TESTS_PASS = go test ./...; go vet ./...; go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json; go run ./cmd/devctl check-architecture; go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json; tests/cognitive_advisory/cognitive_worker_env_policy_test.ps1; tests/owner_acl/verify.ps1 -DockerContext docker-prod -PostgresContainer assistant-postgres-1; production live /chat acceptance`
- `LIVE_ACCEPTANCE = PASS: reminder created through external /chat and verified as Continuity ARMED prospective item; unsupported SEND_EMAIL created CapabilityGap; "Привет. Что ты умеешь?" returned capability-aware response; simple code explanation completed through Cognitive Gateway without durable Work`
- `PRODUCTION_REVISION = 8fe596264e89b8f346c9e0cd297c5ccb2d5f76bb`
- `PRODUCTION_HEALTH = healthy`
- `NEXT_STEP = Direct delivery/revalidation loop for reminders or next concrete capability adapter, if separately approved`
-
-## DEV-000063 checkpoint
-
- `DEV_000063_STATUS = COMPLETED`
- `LAST_COMPLETED = ADR-0012, HelpPath optionality foundation, Work-owned Goal/PlanCandidate/WorkPlan/PlanStep/CapabilityRequirement/DelegationCandidate contracts, deterministic planning V1, optional durable Work creation from /chat, capability-gap/self-extension readiness tests, migration 017, production deployment and live /chat acceptance`
- `HELP_PATH_OPTIONALITY = enabled; simple answer/cognition/direct capability/capability gap can bypass durable Goal/Work/Plan`
- `GOAL_WORK_PLAN_OPTIONALITY = enabled; durable records are created only for complex work/planning cases`
- `PROJECT_NEUTRALITY = project context is optional opaque Work reference; Project is not mandatory context`
- `CODEX_NEUTRALITY = no Codex-specific canonical entity or executor selection`
- `TESTS_PASS = go test ./...; go vet ./...; go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json; go run ./cmd/devctl check-architecture; go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json; tests/cognitive_advisory/cognitive_worker_env_policy_test.ps1; tests/owner_acl/verify.ps1 -DockerContext docker-prod -PostgresContainer assistant-postgres-1; production live /chat acceptance`
- `LIVE_ACCEPTANCE = PASS: simple help uses cognition without Work; reminder uses direct scheduling-capability path without Work; complex УПО investigation creates one Work Goal/Plan; capability gap remains executor-neutral without Work`
- `PRODUCTION_REVISION = 9d50a3ec635782b59ab3335808d6d1e026be48a4`
- `PRODUCTION_HEALTH = healthy`
- `NEXT_STEP = DEV-000064 capability resolution/acquisition or concrete scheduler/mail/codex adapter foundation, if separately approved`
- `REAL_BLOCKERS = none known`
-
-## DEV-000062 checkpoint
-
- `DEV_000062_STATUS = COMPLETED`
- `LAST_COMPLETED = DEV-000062 packet rev.1, ADR-0011, Interaction/Situation/Epistemics contract extensions, Situation Project Registry V1, active project focus semantics, Interaction utterance interpretation/project references, append-only correction/supersession foundation, Core Runtime semantic persistence wiring, Creator Web /chat focus display, production deployment and live /chat acceptance`
- `TESTS_PASS = go test ./...; go vet ./...; go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json; go run ./cmd/devctl check-architecture; go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json; tests/cognitive_advisory/cognitive_worker_env_policy_test.ps1; tests/owner_acl/verify.ps1 -DockerContext docker-prod -PostgresContainer assistant-postgres-1; production live /chat acceptance`
- `ACTIVE_BINDINGS = none`
- `CANARY_BINDING = unchanged; not promoted to ACTIVE`
- `OPENAI_REAL_CREDENTIAL = not required / not activated`
- `PRODUCTION_REVISION = 445e9edd7c5b614b58dd925f89aa9fe49cf0a1d6`
- `HUMAN_CHAT_URL = https://assistant.cin.su/chat`
- `LIVE_ACCEPTANCE = PASS: explicit УПО focus, unverified assertion, directive/no execution, correction, explicit Assistant focus, current-focus question answered without cognition`
- `NEXT_STEP = DEV-000063 Project Copilot planning, if separately approved`
- `REAL_BLOCKERS = none known`
-
-## Current milestone
-
-**Provider-neutral Cognitive Architecture + Local AI integration.**
-
- Docker production baseline at `9e99a04c…` is completed and healthy.
- The OpenAI integration is a bootstrap adapter only. Real OpenAI credentials and production traffic are intentionally deferred.
- The current milestone integrates one normally available local CPU provider and one opportunistic local Ollama/GPU provider through typed discovery, health and routing boundaries.
- Discovery never activates a provider, model or binding. Until a later benchmark and explicit promotion task, all discovered bindings remain `INACTIVE` and production remains fully LLM-free.
- DEV-000057 executed a bounded synthetic qualification corpus against all 11 current local model revisions. Four exact binding revisions demonstrated the minimum advisory threshold; seven remain unsupported. Qualification evidence does not change lifecycle or activation.
- DEV-000058 promoted the exact CPU `Qwen2.5-3B-Instruct-Q4_K_M` lineage to `VALIDATED/CANARY` through an authenticated, evidence-gated, append-only CAS transition. Ordinary routing still excludes it; only an explicit `AllowCanary` request can select it. All other current bindings remain `INACTIVE`.
- DEV-000059 enables that exact canary behind a fail-closed cognitive-worker flag and a 4 KiB output clamp. Five authenticated synthetic Creator requests completed through the full production path with typed usage observations, zero failures and zero API cost. The binding remains `CANARY`, not `ACTIVE`.
-
-## Cognitive Foundation baseline
-
- `COGNITIVE_FOUNDATION = COMPLETED`
- `PRODUCTION_REGISTRY = RUNNING`
- `LOCAL_CPU_CANARY = WORKING`
- `CANARY_SUCCESSFUL_REQUESTS = 5`
- `ACTIVE_BINDINGS = none`
- `OPENAI_REAL_CREDENTIAL = not required / not activated`
- `NEXT_MILESTONE = Human Interaction + Intent/Evidence Semantics + Project Copilot Foundation`
-
-DEV-000060 corrects the LLM-free production audit with an exact, fail-closed cognitive-worker environment allowlist. Non-secret local provider endpoint variables are permitted only by name; plaintext credentials remain prohibited and secret-file references are restricted to the existing `OPENAI_API_KEY_FILE` mechanism under `/run/secrets`.
-
-## Delivered
-
- Foundation V1 is frozen and all exit criteria pass.
- The single Creator account authenticates at `https://assistent.cin.su`; authentication does not imply Authority.
- Creator can inspect the bounded operational view, register and satisfy Continuity prospective items, inspect action history, and explicitly request the accepted notification operation.
- `deliver-prospective-notification-v1` executes only through Capability binding, current Authority and Commit/Executor validation. Its success evidence is an immutable receiver receipt.
- Production runs on `docker.cin.su`; the project does not use the shared test Docker host.
- PostgreSQL backup/restore, encrypted off-host backup, production health monitoring and the current-user Windows notification projection are installed and healthy.
-
-## Evidence from DEV-000044
-
- `go test ./...`, `go vet ./...`, architecture preflight/checks and PowerShell parsing pass.
- `Test-DomovoyProductionHealth.ps1` reports `healthy` for the production stack, HTTPS/DNS/TLS, backups and registered Windows tasks.
- `tests/creator_commit/verify-remote.ps1` passes the authenticated Creator → Commit → notification receiver receipt flow on `docker-prod`.
- The smoke harness was corrected to preserve HTTP Authorization headers under Windows PowerShell 5.1 native-command argument handling.
-
-## Remaining work requiring a new task decision
-
-1. **Cognitive canary observation:** collect bounded usage/reliability evidence for the exact CPU canary revision before any separate `ACTIVE` decision. GPU candidates remain inactive.
-2. **Product breadth:** notification delivery is the only accepted real external operation. Any additional operation needs its own proposal, authority model, idempotency/reconciliation semantics and Capability binding.
-3. **Artifact and Epistemics product behavior:** their ownership boundaries exist, but no product task has yet specified durable user-facing workflows for them.
-
-DEV-000045 closes the DEV-000044 artifact-provenance finding for new promotions by stamping the merged Git revision into OCI labels, recording exact promoted image IDs outside the repository, and making production monitoring reject label or digest drift. Images that predate DEV-000045 remain historically unverifiable from the image alone.
-
-ADR-0006 and DEV-000046 establish the provider-neutral, non-canonical Creator advisory boundary. DEV-000048 connects it to authenticated Creator Web and adds the advisory console; until a provider/data-egress decision is accepted, it deliberately reports `PROVIDER_UNAVAILABLE` and sends nothing outside the private runtime topology.
-
-DEV-000049 adds and executes a repeatable production audit for that boundary. It proves that an authenticated 16 KiB message reaches only the deterministic unavailable binding, unauthenticated and browser-supplied authority fields fail closed, the request sentinel is absent from cognitive-worker logs, and the cognitive worker has no database, Commit/Executor, Creator or provider credential environment/mount.
-
-ADR-0007 accepts OpenAI Responses API with immutable snapshot `gpt-5.4-mini-2026-03-17` and Mode A per-request retention disclosure as the first real provider binding class. DEV-000050 implements its standard-library adapter and adversarial fake-transport tests: fixed origin/payload, message-only egress, no tools or provider memory, redirect/proxy denial, no retry, strict output mapping and fail-closed timeout/refusal/unavailable/invalid states. The adapter is not wired into the runtime; production remains on `deterministic-fake` with no provider credential or egress.
-
-DEV-000051 adds an optional cognitive-worker runtime gate for that adapter. It is disabled when `OPENAI_API_KEY_FILE` is absent, rejects direct environment credentials, bounds and validates the secret file, and returns 503 before parsing an OpenAI request while disabled. Production configuration and Creator Web routing are unchanged, so the gate is not active and no provider egress occurs.
-
-DEV-000052 promotes the disabled gate without adding a credential, mount or provider environment variable. DEV-000053 adds the server-selected Creator Web routing policy: deterministic behavior remains the default, while the accepted OpenAI Mode A route can only be selected by server configuration and requires a fresh per-request egress acknowledgement. The browser receives authenticated binding metadata for disclosure but cannot select the provider, model or binding. The message and acknowledgement are not persisted.
-
-These are explicit scope decisions, not hidden incomplete steps in DEV-000043. No production secret is stored in the repository.
+- `ACTIVE_TASK = dev/tasks/DEV-000196-agent-canary-live-evidence.json revision 1`
+- `LINEAGE_DECISION = docs/GOVERNANCE_LINEAGE_DECISION_2026-08-22.md`; historical packets remain provenance and are not current authority.
+- `REGISTRY_STATUS = YAML and JSON semantic mirrors agree`
+- `PRODUCTION_DOMAIN = docker.cin.su`; shared docker-test is not used for this project.
+- `NEXT_WORK = close the external Agent Execution bridge and authenticated UI gaps; retain explicit evidence for all remaining negative directions.`
@@ -0,0 +1,25 @@
+{
+  "captured_at": "2026-08-23",
+  "environment": "production",
+  "endpoint": "internal agent-canary profile on docker.cin.su",
+  "run_id": "manual-run-1787444046393734499",
+  "dispatch_id": "manual-dispatch-1787444046393734499",
+  "canary_output": {
+    "callback_count": 2,
+    "store_writes": 0
+  },
+  "durable_database_verification": {
+    "dispatch_intent": "manual-dispatch-1787444046393734499",
+    "lease": {
+      "run_id": "manual-run-1787444046393734499",
+      "worker_id": "manual-worker",
+      "state": "ACTIVE"
+    },
+    "callback_head": {
+      "run_id": "manual-run-1787444046393734499",
+      "last_sequence": 2
+    }
+  },
+  "interpretation": "The explicit protected dry-run canary is replayable and its dispatch, lease and callback chain are durable. This does not prove execution through an independently operated external bridge; the production agent worker remains recovery-only until that bridge is configured and qualified.",
+  "secrets_exposed": false
+}
@@ -0,0 +1,15 @@
+{
+  "captured_at": "2026-08-23",
+  "production_status": "LIVE_HEALTHY",
+  "public_health": {"url": "https://assistant.cin.su/healthz", "status": "ok"},
+  "runtime_readiness": {
+    "core": "ready",
+    "research": "ready",
+    "work_graph": "ready",
+    "reflection_worker": "running",
+    "agent_worker": {"ready": false, "mode": "recovery-only", "executor_configured": false, "reason": "protected agent execution bridge URL is not configured"}
+  },
+  "fleet": {"ready_tiers": ["FAST", "MEDIUM", "LIFEBOAT"], "preferred_tier": "FAST", "selected_tier": "FAST", "fallback_tier": "LIFEBOAT", "heavy": {"ready": false, "reason": "provider /v1/models request timed out"}},
+  "work_graph_canary": {"endpoint": "internal work-graph-runtime /v1/work-graphs/synthesis", "result": "HTTP 200; candidates, conflict and VERIFIED synthesis persisted"},
+  "interpretation": "Readiness and canary evidence prove runtime behavior only; they do not prove external Agent Execution bridge availability or authenticated UI acceptance."
+}
@@ -0,0 +1,7 @@
+{
+  "captured_at": "2026-08-23",
+  "runtime": "reflection-worker",
+  "one_shot_result": "no reflection candidate",
+  "durable_state": {"reflection_candidates": {"RESOLVED": 31, "OPEN": 0, "other": 0}},
+  "interpretation": "The durable reflection candidate backlog is reconciled. This proves the current worker/state loop, not autonomous source mutation or skill promotion."
+}
@@ -0,0 +1,10 @@
+{
+  "captured_at": "2026-08-23",
+  "runtime": "research-runtime",
+  "endpoint": "/v1/research/web/evaluate",
+  "plan_id": "live-truth-canary-20260822-2325",
+  "source_locator": "https://assistant.cin.su/healthz",
+  "result": {"finding_state": "SUPPORTED", "evidence": "OBSERVED", "coverage": "COMPLETE", "conflict": "NONE"},
+  "durable_persistence": {"truth_bundle": "persisted", "claim_verification": "UNVERIFIED", "belief_state": "PROVISIONAL"},
+  "interpretation": "The runtime preserves source-chain evidence and does not promote an unverified claim to a verified belief."
+}
@@ -1,30 +0,0 @@
-{
-  "evidence_id": "wp-200-wp-301-fleet-execution-status-2026-08-22-v1",
-  "captured_at": "2026-08-22",
-  "production_revision": "03c3484ee1488ebc3b2349ab6ba5c8005c895110",
-  "source": "read-only internal status probes on docker.cin.su",
-  "fleet_readiness": {
-    "preferred_tier": "HEAVY",
-    "selected_tier": "LIFEBOAT",
-    "ready_tiers": ["LIFEBOAT"],
-    "members": [
-      {"provider_instance_id": "local-cpu-primary", "tier": "FAST", "ready": false, "reason": "status=401 UNAUTHORIZED"},
-      {"provider_instance_id": "local-medium-unconfigured", "tier": "MEDIUM", "ready": false, "reason": "NOT_CONFIGURED"},
-      {"provider_instance_id": "local-gpu-opportunistic", "tier": "HEAVY", "ready": false, "reason": "context deadline exceeded while awaiting headers"},
-      {"provider_instance_id": "cognitive-lifeboat", "tier": "LIFEBOAT", "ready": true, "reason": "AVAILABLE"}
-    ]
-  },
-  "agent_execution": {
-    "runtime": "agent-worker",
-    "executor_configured": false,
-    "mode": "recovery-only",
-    "ready": false,
-    "reason": "AGENT_EXECUTION_BRIDGE_URL is not configured"
-  },
-  "interpretation": [
-    "Fleet readiness currently selects the local Lifeboat fallback.",
-    "The FAST provider has a live bounded gateway smoke recorded separately; the fleet readiness probe itself receives 401 from the model catalog endpoint.",
-    "No Medium runtime or Heavy GPU runtime is ready, and no Agent Execution bridge is deployed.",
-    "This artifact records evidence only and does not activate or promote any binding."
-  ]
-}
@@ -25,6 +25,28 @@ type GraphCompleteRequest struct {
 	Succeeded bool             `json:"succeeded"`
 }

+type GraphSynthesisRequest struct {
+	Conflict          work.ConflictSet       `json:"conflict"`
+	Candidates        []work.ResultCandidate `json:"candidates"`
+	SelectedCandidate string                 `json:"selected_candidate_id"`
+	VerifierRunID     work.AgentRunID        `json:"verifier_run_id"`
+	VerifierIdentity  string                 `json:"verifier_identity"`
+	EvidenceRefs      []work.EvidenceRef     `json:"evidence_refs"`
+	Summary           string                 `json:"summary"`
+	Verified          bool                   `json:"verified"`
+}
+
+func SynthesizeGraph(ctx context.Context, store ports.GraphResultStore, request GraphSynthesisRequest) (work.ConflictSet, work.GraphSynthesisCandidate, error) {
+	conflict, synthesis, err := domain.BuildVerifiedGraphSynthesis(request.Conflict, request.Candidates, request.SelectedCandidate, request.VerifierRunID, request.VerifierIdentity, request.EvidenceRefs, request.Summary, request.Verified)
+	if err != nil {
+		return work.ConflictSet{}, work.GraphSynthesisCandidate{}, err
+	}
+	if err := store.SaveGraphSynthesis(ctx, conflict, request.Candidates, synthesis); err != nil {
+		return work.ConflictSet{}, work.GraphSynthesisCandidate{}, err
+	}
+	return conflict, synthesis, nil
+}
+
 func AdmitAndSchedule(ctx context.Context, store ports.GraphStore, request GraphScheduleRequest) (work.WorkGraph, []work.GraphNodeID, error) {
 	if request.Now < 1 {
 		request.Now = time.Now().UnixMilli()
@@ -8,10 +8,57 @@ import (
 )

 var (
-	ErrGraphBudgetExceeded = errors.New("work graph budget exceeded")
-	ErrConflictUnresolved  = errors.New("conflict resolution is not explicit")
+	ErrGraphBudgetExceeded    = errors.New("work graph budget exceeded")
+	ErrConflictUnresolved     = errors.New("conflict resolution is not explicit")
+	ErrGraphSynthesisRejected = errors.New("graph synthesis rejected")
 )

+// BuildVerifiedGraphSynthesis resolves a conflict only after an independent
+// verifier has evaluated all candidates. The verifier may not be any result
+// producer, and every candidate remains in the returned lineage.
+func BuildVerifiedGraphSynthesis(conflict work.ConflictSet, candidates []work.ResultCandidate, selectedCandidate string, verifierRunID work.AgentRunID, verifierIdentity string, evidence []work.EvidenceRef, summary string, verified bool) (work.ConflictSet, work.GraphSynthesisCandidate, error) {
+	if conflict.ID == "" || conflict.GraphID == "" || conflict.GraphRevision < 1 || conflict.NodeID == "" || conflict.Resolved || len(conflict.CandidateIDs) < 2 || selectedCandidate == "" || verifierRunID == "" || verifierIdentity == "" || len(evidence) == 0 || summary == "" || !verified {
+		return work.ConflictSet{}, work.GraphSynthesisCandidate{}, ErrGraphSynthesisRejected
+	}
+	candidateByID := make(map[string]work.ResultCandidate, len(candidates))
+	for _, candidate := range candidates {
+		if candidate.ID == "" || candidate.GraphID != conflict.GraphID || candidate.GraphRevision != conflict.GraphRevision || candidate.NodeID != conflict.NodeID || candidate.AuthorRunID == "" {
+			return work.ConflictSet{}, work.GraphSynthesisCandidate{}, ErrGraphSynthesisRejected
+		}
+		candidateByID[candidate.ID] = candidate
+		if candidate.AuthorRunID == verifierRunID {
+			return work.ConflictSet{}, work.GraphSynthesisCandidate{}, ErrGraphSynthesisRejected
+		}
+	}
+	ordered := append([]string(nil), conflict.CandidateIDs...)
+	for _, id := range ordered {
+		if _, ok := candidateByID[id]; !ok {
+			return work.ConflictSet{}, work.GraphSynthesisCandidate{}, ErrGraphSynthesisRejected
+		}
+	}
+	if !containsString(ordered, selectedCandidate) {
+		return work.ConflictSet{}, work.GraphSynthesisCandidate{}, ErrGraphSynthesisRejected
+	}
+	dissent := make([]string, 0, len(ordered)-1)
+	for _, id := range ordered {
+		if id != selectedCandidate {
+			dissent = append(dissent, id)
+		}
+	}
+	conflict.Resolved = true
+	synthesis := work.GraphSynthesisCandidate{ID: conflict.ID + ":synthesis", GraphID: conflict.GraphID, GraphRevision: conflict.GraphRevision, NodeID: conflict.NodeID, CandidateIDs: ordered, SelectedCandidateID: selectedCandidate, DissentCandidateIDs: dissent, VerifierRunID: verifierRunID, VerifierIdentity: verifierIdentity, EvidenceRefs: append([]work.EvidenceRef(nil), evidence...), Summary: summary, State: work.GraphSynthesisVerified}
+	return conflict, synthesis, nil
+}
+
+func containsString(values []string, target string) bool {
+	for _, value := range values {
+		if value == target {
+			return true
+		}
+	}
+	return false
+}
+
 func ScheduleReadyNodes(graph work.WorkGraph, active int) ([]work.GraphNodeID, error) {
 	if err := ValidateWorkGraph(graph); err != nil {
 		return nil, err
@@ -11,6 +11,7 @@ import (
 var ErrInvalidDevelopmentGate = errors.New("invalid governed self-development gate")
 var ErrInsufficientExtensionEvidence = errors.New("insufficient repeated extension evidence")
 var ErrInvalidExtensionProposal = errors.New("invalid extension proposal")
+var ErrInvalidDevelopmentScaffold = errors.New("invalid development scaffold candidate")

 // BuildExtensionProposal deterministically turns a repeated evidence signal
 // into a proposal. It retains every distinct evidence reference for lineage,
@@ -86,6 +87,64 @@ func cleanStrings(values []string) []string {
 	return result
 }

+// BuildDevelopmentScaffold creates only a typed, isolated candidate. The
+// caller supplies the protected path set so this domain function cannot infer
+// or widen repository authority from ambient process state.
+func BuildDevelopmentScaffold(request work.DevelopmentScaffoldRequest) (work.DevelopmentScaffold, error) {
+	modules := cleanStrings(request.Modules)
+	allowed := cleanPaths(request.AllowedPaths)
+	forbidden := cleanPaths(request.ForbiddenPaths)
+	protected := cleanPaths(request.ProtectedPaths)
+	tests := cleanStrings(request.RequiredTests)
+	lineage := cleanStrings(request.ArtifactLineageRefs)
+	if request.ID == "" || request.ProposalRef == "" || strings.TrimSpace(request.BaseRepoRevision) == "" || strings.TrimSpace(request.WorktreeRef) == "" || strings.TrimSpace(request.TaskIntent) == "" || request.CreatedAt.IsZero() || len(modules) == 0 || len(allowed) == 0 || len(tests) == 0 || len(lineage) == 0 || request.ProtectedMainAccess != "DENIED" || request.ProductionAccess != "DENIED" || request.SecretAccess != "DENIED" {
+		return work.DevelopmentScaffold{}, ErrInvalidDevelopmentScaffold
+	}
+	for _, path := range allowed {
+		if unsafePath(path) || pathMatchesAny(path, forbidden) || pathMatchesAny(path, protected) {
+			return work.DevelopmentScaffold{}, ErrInvalidDevelopmentScaffold
+		}
+	}
+	worktree := strings.ToLower(strings.TrimSpace(request.WorktreeRef))
+	if worktree == "main" || worktree == "protected-main" || worktree == "production" {
+		return work.DevelopmentScaffold{}, ErrInvalidDevelopmentScaffold
+	}
+	return work.DevelopmentScaffold{ID: request.ID, Stage: work.DevelopmentScaffoldSandboxed, ProposalRef: request.ProposalRef, BaseRepoRevision: strings.TrimSpace(request.BaseRepoRevision), WorktreeRef: strings.TrimSpace(request.WorktreeRef), TaskIntent: strings.TrimSpace(request.TaskIntent), Modules: modules, AllowedPaths: allowed, ForbiddenPaths: forbidden, RequiredTests: tests, ArtifactLineageRefs: lineage, ProtectedMainAccess: "DENIED", ProductionAccess: "DENIED", SecretAccess: "DENIED", CreatedAtUnixMillis: request.CreatedAt.UnixMilli()}, nil
+}
+
+func cleanPaths(values []string) []string {
+	result := make([]string, 0, len(values))
+	seen := make(map[string]struct{}, len(values))
+	for _, value := range values {
+		value = strings.TrimSpace(strings.ReplaceAll(value, "\\", "/"))
+		if value == "" {
+			continue
+		}
+		if _, ok := seen[value]; ok {
+			continue
+		}
+		seen[value] = struct{}{}
+		result = append(result, value)
+	}
+	return result
+}
+
+func unsafePath(path string) bool {
+	return strings.HasPrefix(path, "/") || strings.HasPrefix(path, "~") || (len(path) > 1 && path[1] == ':') || slices.Contains(strings.Split(path, "/"), "..")
+}
+
+func pathMatchesAny(path string, scopes []string) bool {
+	for _, scope := range scopes {
+		scope = strings.TrimSuffix(scope, "/")
+		scope = strings.TrimSuffix(scope, "**")
+		scope = strings.TrimSuffix(scope, "/")
+		if path == scope || strings.HasPrefix(path, scope+"/") {
+			return true
+		}
+	}
+	return false
+}
+
 func AdvanceDevelopmentGate(current work.DevelopmentGate, next work.DevelopmentStage) (work.DevelopmentGate, error) {
 	if err := ValidateDevelopmentGate(current); err != nil {
 		return work.DevelopmentGate{}, err
@@ -51,6 +51,22 @@ func TestBuildExtensionProposalRejectsSingleFailureAndIncompleteGovernance(t *te
 	}
 }

+func TestBuildDevelopmentScaffoldFailsClosedForProtectedScope(t *testing.T) {
+	base := work.DevelopmentScaffoldRequest{ID: "scaffold-1", ProposalRef: "proposal-1", BaseRepoRevision: "abc123", WorktreeRef: "worktree-1", TaskIntent: "add reviewed adapter", Modules: []string{"capability"}, AllowedPaths: []string{"modules/capability/**"}, ForbiddenPaths: []string{"security/**"}, ProtectedPaths: []string{"architecture/**", "deploy/**"}, RequiredTests: []string{"go test ./..."}, ArtifactLineageRefs: []string{"proposal-1"}, ProtectedMainAccess: "DENIED", ProductionAccess: "DENIED", SecretAccess: "DENIED", CreatedAt: time.UnixMilli(1)}
+	scaffold, err := BuildDevelopmentScaffold(base)
+	if err != nil || scaffold.Stage != work.DevelopmentScaffoldSandboxed {
+		t.Fatalf("valid scaffold rejected: %+v %v", scaffold, err)
+	}
+	base.AllowedPaths = []string{"deploy/docker-compose.prod.yml"}
+	if _, err := BuildDevelopmentScaffold(base); err != ErrInvalidDevelopmentScaffold {
+		t.Fatalf("protected path must fail closed, got %v", err)
+	}
+	base.AllowedPaths = []string{"modules/capability/../security"}
+	if _, err := BuildDevelopmentScaffold(base); err != ErrInvalidDevelopmentScaffold {
+		t.Fatalf("traversal path must fail closed, got %v", err)
+	}
+}
+
 func TestGovernedSelfDevelopmentRejectsSameProducerAndVerifier(t *testing.T) {
 	gate := work.DevelopmentGate{ID: "dev-1", Stage: work.DevelopmentIsolated, EvidenceRefs: []string{"obs-1"}, ProducerRunRefs: []work.AgentRunID{"same"}, VerifierRunRefs: []work.AgentRunID{"same"}, VerificationEvidence: "verify-1"}
 	if _, err := AdvanceDevelopmentGate(gate, work.DevelopmentVerified); err == nil {
@@ -12,3 +12,7 @@ type GraphStore interface {
 	SaveDispatchIntent(context.Context, work.AgentDispatchIntent) error
 	EnqueueDispatch(context.Context, work.AgentDispatchQueueItem) error
 }
+
+type GraphResultStore interface {
+	SaveGraphSynthesis(context.Context, work.ConflictSet, []work.ResultCandidate, work.GraphSynthesisCandidate) error
+}
@@ -18,3 +18,16 @@ func TestGraphPersistenceMigrationIsRevisionScoped(t *testing.T) {
 		}
 	}
 }
+
+func TestGraphSynthesisMigrationIsWorkOwnedAndAtomicInputsExist(t *testing.T) {
+	data, err := os.ReadFile("../../database/migrations/036_work_graph_result_synthesis.sql")
+	if err != nil {
+		t.Fatal(err)
+	}
+	sql := string(data)
+	for _, marker := range []string{"work.graph_result_candidates", "work.graph_conflicts", "work.graph_synthesis_candidates", "verifier_run_id", "dissent_candidate_ids", "FOREIGN KEY (graph_id, graph_revision)", "SET ROLE work_role"} {
+		if !strings.Contains(sql, marker) {
+			t.Fatalf("graph synthesis persistence marker missing: %s", marker)
+		}
+	}
+}
@@ -2,7 +2,9 @@ package agent_execution_test

 import (
 	"context"
+	"encoding/json"
 	"strconv"
+	"strings"
 	"testing"

 	"git.cin.su/m/Assistant/contracts/work"
@@ -58,3 +60,37 @@ func TestGraphRuntimeSchedulesFanOutAndCompletesFanIn(t *testing.T) {
 		t.Fatalf("completed=%+v err=%v", completed, err)
 	}
 }
+
+type graphResultStoreStub struct {
+	conflict work.ConflictSet
+	count    int
+}
+
+func (s *graphResultStoreStub) SaveGraphSynthesis(_ context.Context, conflict work.ConflictSet, candidates []work.ResultCandidate, _ work.GraphSynthesisCandidate) error {
+	s.conflict = conflict
+	s.count = len(candidates)
+	return nil
+}
+
+func TestSynthesizeGraphPersistsVerifiedDissent(t *testing.T) {
+	store := &graphResultStoreStub{}
+	conflict, synthesis, err := application.SynthesizeGraph(context.Background(), store, application.GraphSynthesisRequest{
+		Conflict:          work.ConflictSet{ID: "conflict-1", GraphID: "graph-1", GraphRevision: 1, NodeID: "node-1", CandidateIDs: []string{"candidate-a", "candidate-b"}},
+		Candidates:        []work.ResultCandidate{{ID: "candidate-a", GraphID: "graph-1", GraphRevision: 1, NodeID: "node-1", AuthorRunID: "producer-a", EvidenceSummary: "a", Summary: "a"}, {ID: "candidate-b", GraphID: "graph-1", GraphRevision: 1, NodeID: "node-1", AuthorRunID: "producer-b", EvidenceSummary: "b", Summary: "b"}},
+		SelectedCandidate: "candidate-a", VerifierRunID: "verifier-1", VerifierIdentity: "independent", EvidenceRefs: []work.EvidenceRef{"tests:1"}, Summary: "verified", Verified: true,
+	})
+	if err != nil || !conflict.Resolved || synthesis.State != work.GraphSynthesisVerified || store.count != 2 || !store.conflict.Resolved {
+		t.Fatalf("unexpected runtime synthesis: conflict=%+v synthesis=%+v stored=%+v err=%v", conflict, synthesis, store.conflict, err)
+	}
+}
+
+func TestGraphSynthesisJSONUsesStableSnakeCaseContract(t *testing.T) {
+	payload, err := json.Marshal(application.GraphSynthesisRequest{Conflict: work.ConflictSet{ID: "c", GraphID: "g", GraphRevision: 1, NodeID: "n", CandidateIDs: []string{"a", "b"}}, SelectedCandidate: "a", VerifierRunID: "v", VerifierIdentity: "independent", EvidenceRefs: []work.EvidenceRef{"e"}, Summary: "s", Verified: true})
+	if err != nil || !strings.Contains(string(payload), `"graph_id":"g"`) || !strings.Contains(string(payload), `"selected_candidate_id":"a"`) {
+		t.Fatalf("unexpected synthesis JSON: %s err=%v", payload, err)
+	}
+	var decoded application.GraphSynthesisRequest
+	if err := json.Unmarshal(payload, &decoded); err != nil || decoded.Conflict.GraphID != "g" || decoded.SelectedCandidate != "a" || !decoded.Verified {
+		t.Fatalf("snake_case request did not round-trip: %+v err=%v", decoded, err)
+	}
+}
@@ -56,3 +56,18 @@ func TestGraphSchedulerEnforcesParallelBudgetAndExplicitConflict(t *testing.T) {
 		t.Fatalf("unknown candidate was accepted: %v", err)
 	}
 }
+
+func TestGraphSynthesisRequiresIndependentVerifierAndRetainsDissent(t *testing.T) {
+	conflict := work.ConflictSet{ID: "conflict-1", GraphID: "graph-1", GraphRevision: 1, NodeID: "node-1", CandidateIDs: []string{"candidate-a", "candidate-b"}}
+	candidates := []work.ResultCandidate{{ID: "candidate-a", GraphID: "graph-1", GraphRevision: 1, NodeID: "node-1", AuthorRunID: "producer-a", EvidenceSummary: "a"}, {ID: "candidate-b", GraphID: "graph-1", GraphRevision: 1, NodeID: "node-1", AuthorRunID: "producer-b", EvidenceSummary: "b"}}
+	resolved, synthesis, err := workdomain.BuildVerifiedGraphSynthesis(conflict, candidates, "candidate-a", "verifier-1", "independent-verifier", []work.EvidenceRef{"tests:1"}, "candidate a is supported", true)
+	if err != nil || !resolved.Resolved || synthesis.SelectedCandidateID != "candidate-a" || len(synthesis.DissentCandidateIDs) != 1 || synthesis.VerifierRunID == candidates[0].AuthorRunID {
+		t.Fatalf("unexpected synthesis: conflict=%+v synthesis=%+v err=%v", resolved, synthesis, err)
+	}
+	if _, _, err := workdomain.BuildVerifiedGraphSynthesis(conflict, candidates, "candidate-a", "producer-a", "producer", []work.EvidenceRef{"tests:1"}, "forged", true); err != workdomain.ErrGraphSynthesisRejected {
+		t.Fatalf("producer must not verify its own result, got %v", err)
+	}
+	if _, _, err := workdomain.BuildVerifiedGraphSynthesis(conflict, candidates, "candidate-a", "verifier-1", "independent-verifier", []work.EvidenceRef{"tests:1"}, "failed", false); err != workdomain.ErrGraphSynthesisRejected {
+		t.Fatalf("failed verification must not resolve conflict, got %v", err)
+	}
+}
@@ -26,3 +26,10 @@ func TestExtensionProposalIsProposalOnlyAndDeduplicatesSignals(t *testing.T) {
 		t.Fatalf("unexpected proposal stage/keys: %+v", proposal)
 	}
 }
+
+func TestDevelopmentScaffoldRequiresExplicitDeniedAccessPolicies(t *testing.T) {
+	_, err := workdomain.BuildDevelopmentScaffold(work.DevelopmentScaffoldRequest{ID: "s", ProposalRef: "p", BaseRepoRevision: "r", WorktreeRef: "isolated", TaskIntent: "test", Modules: []string{"work"}, AllowedPaths: []string{"modules/work/**"}, RequiredTests: []string{"go test ./..."}, ArtifactLineageRefs: []string{"p"}, ProtectedMainAccess: "DENIED", ProductionAccess: "DENIED", SecretAccess: "ALLOW", CreatedAt: time.UnixMilli(1)})
+	if err == nil {
+		t.Fatal("secret access must be denied explicitly")
+	}
+}
Author	SHA1	Message	Date
m	b52590c458	docs: record durable agent canary evidence CI / test (push) Successful in 1m6s Details CI / test (pull_request) Successful in 1m6s Details	2026-08-23 03:18:57 +03:00
m	6854458e21	Merge pull request 'fix: make agent canary replayable' (#171 ) from codex/wp-301-agent-canary-replayable into main CI / test (push) Successful in 1m6s Details	2026-08-23 00:11:50 +00:00
m	5658bed520	fix: make agent canary replayable CI / test (push) Successful in 1m4s Details CI / test (pull_request) Successful in 1m4s Details	2026-08-23 03:10:07 +03:00
m	7252296a74	Merge pull request 'fix: protect agent canary database credentials' (#170 ) from codex/wp-301-agent-canary-protected-config into main CI / test (push) Successful in 1m2s Details	2026-08-23 00:05:20 +00:00
m	348856a9c2	chore: align canary task base with main CI / test (push) Successful in 1m7s Details CI / test (pull_request) Successful in 1m9s Details	2026-08-23 03:03:43 +03:00
m	7779dc37d1	fix: protect agent canary database credentials CI / test (push) Failing after 45s Details CI / test (pull_request) Failing after 48s Details	2026-08-23 03:01:35 +03:00
m	c1db571a39	Merge pull request 'docs: record live degraded fleet readiness' (#169 ) from codex/wp-301-fleet-live-degraded-evidence into main CI / test (push) Successful in 1m9s Details	2026-08-22 23:53:36 +00:00
m	5f65f3d570	docs: record live degraded fleet readiness CI / test (push) Successful in 1m4s Details CI / test (pull_request) Successful in 1m4s Details	2026-08-23 02:51:51 +03:00
m	bb18cb4f1c	Merge pull request 'docs: record live reflection reconciliation' (#168 ) from codex/wp-500-reflection-live-evidence into main CI / test (push) Successful in 1m9s Details	2026-08-22 23:45:57 +00:00
m	3f7b1f6e9c	docs: record live reflection reconciliation CI / test (push) Successful in 1m0s Details CI / test (pull_request) Successful in 1m2s Details	2026-08-23 02:44:14 +03:00
m	413a432e8c	Merge pull request 'docs: avoid drifting production revision projection' (#167 ) from codex/cleanup-obsolete-docs into main CI / test (push) Successful in 1m13s Details	2026-08-22 23:40:16 +00:00
m	ca5f96115b	docs: avoid drifting production revision projection CI / test (push) Successful in 1m3s Details CI / test (pull_request) Successful in 1m2s Details	2026-08-23 02:38:10 +03:00
m	9fe2f37012	Merge pull request 'docs: align audit status with deployed revision' (#166 ) from codex/cleanup-obsolete-docs into main CI / test (push) Successful in 1m14s Details	2026-08-22 23:35:17 +00:00
m	b7247c9abd	docs: align audit status with deployed revision CI / test (push) Successful in 54s Details CI / test (pull_request) Successful in 1m2s Details	2026-08-23 02:33:33 +03:00
m	be8561c7d8	Merge pull request 'chore: remove obsolete audit status history' (#165 ) from codex/cleanup-obsolete-docs into main CI / test (push) Successful in 1m31s Details	2026-08-22 23:30:42 +00:00
m	b78083f0d9	chore: remove obsolete audit status history CI / test (push) Successful in 1m3s Details CI / test (pull_request) Successful in 1m3s Details	2026-08-23 02:28:48 +03:00
m	5d9124d0df	Merge pull request 'docs: synchronize live audit status evidence' (#164 ) from codex/wp-900-live-status-sync into main CI / test (push) Successful in 1m16s Details	2026-08-22 23:23:07 +00:00
m	b7a4c0f83e	chore: activate live audit status task CI / test (push) Successful in 1m1s Details CI / test (pull_request) Successful in 1m7s Details	2026-08-23 02:21:24 +03:00
m	50d4bdf174	docs: synchronize live audit status evidence CI / test (push) Failing after 44s Details CI / test (pull_request) Failing after 47s Details	2026-08-23 02:19:12 +03:00
m	5b92cd6a58	Merge pull request 'fix: serialize graph synthesis request fields' (#163 ) from codex/wp-403-graph-persistence into main CI / test (push) Successful in 1m17s Details	2026-08-22 23:10:08 +00:00
m	18d0911810	fix: serialize graph synthesis request fields CI / test (push) Successful in 55s Details CI / test (pull_request) Successful in 1m3s Details	2026-08-23 02:08:24 +03:00
m	dcf8cbc855	Merge pull request 'feat: persist verified graph synthesis runtime' (#162 ) from codex/wp-403-graph-persistence into main CI / test (push) Successful in 1m16s Details	2026-08-22 22:56:25 +00:00
m	3d30681279	feat: persist verified graph synthesis runtime CI / test (push) Successful in 3m1s Details CI / test (pull_request) Successful in 2m1s Details	2026-08-23 01:52:39 +03:00
m	41bc4b567b	Merge pull request 'feat: gate graph synthesis on independent verification' (#161 ) from codex/wp-403-conflict-synthesis into main CI / test (push) Successful in 1m3s Details	2026-08-22 22:45:18 +00:00
m	38f8f816d5	feat: gate graph synthesis on independent verification CI / test (push) Successful in 1m8s Details CI / test (pull_request) Successful in 1m33s Details	2026-08-23 01:43:35 +03:00
m	4d9d1b8023	Merge pull request 'feat: add isolated governed scaffold candidate' (#160 ) from codex/wp-602-scaffold-factory into main CI / test (push) Successful in 1m28s Details	2026-08-22 22:37:46 +00:00
m	c60a575fda	feat: add isolated governed scaffold candidate CI / test (push) Successful in 1m3s Details CI / test (pull_request) Successful in 57s Details	2026-08-23 01:36:03 +03:00
m	a09a7e811f	Merge pull request 'feat: generate governed extension proposals from repeated evidence' (#159 ) from codex/wp-500-reflection-worker into main CI / test (push) Successful in 1m10s Details	2026-08-22 22:29:49 +00:00