Merge origin/main before cognitive provider secret release

adapters/models/openai_compatible_local.go

@@ -22,9 +22,16 @@ import (
 type OpenAICompatibleLocalAdapter struct {
 	base   *url.URL
 	client *http.Client
+	apiKey string
 }
 
 func NewOpenAICompatibleLocalAdapter(raw string, transport http.RoundTripper) (*OpenAICompatibleLocalAdapter, error) {
+	return NewOpenAICompatibleLocalAdapterWithAPIKey(raw, "", transport)
+}
+
+// NewOpenAICompatibleLocalAdapterWithAPIKey creates an adapter for a gateway
+// whose bearer credential was resolved by the trusted runtime boundary.
+func NewOpenAICompatibleLocalAdapterWithAPIKey(raw, apiKey string, transport http.RoundTripper) (*OpenAICompatibleLocalAdapter, error) {
 	base, err := url.Parse(raw)
 	if err != nil || base.Scheme != "http" || base.Host == "" || strings.TrimSuffix(base.Path, "/") != "/v1" || base.RawQuery != "" || base.Fragment != "" || base.User != nil {
 		return nil, errors.New("invalid local compatible endpoint")
@@ -32,7 +39,7 @@ func NewOpenAICompatibleLocalAdapter(raw string, transport http.RoundTripper) (*
 	if transport == nil {
 		transport = http.DefaultTransport
 	}
-	return &OpenAICompatibleLocalAdapter{base: base, client: &http.Client{Transport: transport, Timeout: 10 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}}, nil
+	return &OpenAICompatibleLocalAdapter{base: base, client: &http.Client{Transport: transport, Timeout: 10 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}, apiKey: strings.TrimSpace(apiKey)}, nil
 }
 
 type compatibleModelsResponse struct {
@@ -145,6 +152,9 @@ func (a *OpenAICompatibleLocalAdapter) requestJSON(ctx context.Context, method,
 		return 0, err
 	}
 	request.Header.Set("Accept", "application/json")
+	if a.apiKey != "" {
+		request.Header.Set("Authorization", "Bearer "+a.apiKey)
+	}
 	if input != nil {
 		request.Header.Set("Content-Type", "application/json")
 	}

adapters/models/openai_compatible_local_test.go

@@ -0,0 +1,42 @@
+package models
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+type captureRoundTripper struct {
+	authorization string
+}
+
+func (t *captureRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) {
+	t.authorization = request.Header.Get("Authorization")
+	return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader(`{"data":[]}`)), Header: make(http.Header), Request: request}, nil
+}
+
+func TestOpenAICompatibleLocalAdapterUsesResolvedAPIKey(t *testing.T) {
+	transport := &captureRoundTripper{}
+	adapter, err := NewOpenAICompatibleLocalAdapterWithAPIKey("http://gateway/v1", "resolved-key", transport)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, _ = adapter.Discover(context.Background())
+	if transport.authorization != "Bearer resolved-key" {
+		t.Fatalf("unexpected authorization header: %q", transport.authorization)
+	}
+}
+
+func TestOpenAICompatibleLocalAdapterDoesNotSendAuthorizationWithoutKey(t *testing.T) {
+	transport := &captureRoundTripper{}
+	adapter, err := NewOpenAICompatibleLocalAdapter("http://gateway/v1", transport)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, _ = adapter.Discover(context.Background())
+	if transport.authorization != "" {
+		t.Fatalf("unexpected authorization header")
+	}
+}

cmd/agent-worker/main.go

@@ -20,6 +20,7 @@ import (
 
 func main() {
 	workerID := flag.String("worker-id", "agent-worker-1", "durable worker identity")
+	statusAddr := flag.String("status-addr", ":8090", "internal status HTTP address")
 	staleAfter := flag.Duration("stale-after", 10*time.Minute, "age after which a claimed item is recovered")
 	leaseTTL := flag.Duration("lease-ttl", 15*time.Minute, "executor lease duration")
 	pollInterval := flag.Duration("poll-interval", 5*time.Second, "database-owned idle wake-up interval")
@@ -47,6 +48,11 @@ func main() {
 	} else {
 		fmt.Fprintln(os.Stderr, "agent execution bridge is not configured; dispatch claims are disabled; recovery-only mode")
 	}
+	go func() {
+		if serveErr := http.ListenAndServe(*statusAddr, workerStatusHandler(executor != nil)); serveErr != nil {
+			fmt.Fprintln(os.Stderr, "agent worker status server:", serveErr)
+		}
+	}()
 	ctx := context.Background()
 	for {
 		var result application.WorkerCycleResult

cmd/agent-worker/status.go

@@ -0,0 +1,40 @@
+package main
+
+import (
+	"encoding/json"
+	"net/http"
+)
+
+type workerStatusResponse struct {
+	Runtime            string `json:"runtime"`
+	ExecutorConfigured bool   `json:"executor_configured"`
+	Mode               string `json:"mode"`
+	Ready              bool   `json:"ready"`
+	Reason             string `json:"reason"`
+}
+
+func workerStatusHandler(executorConfigured bool) http.Handler {
+	status := workerStatusResponse{
+		Runtime:            "agent-worker",
+		ExecutorConfigured: executorConfigured,
+		Mode:               "recovery-only",
+		Ready:              false,
+		Reason:             "AGENT_EXECUTION_BRIDGE_URL is not configured",
+	}
+	if executorConfigured {
+		status.Mode = "execution"
+		status.Ready = true
+		status.Reason = "typed agent execution bridge configured"
+	}
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet || (r.URL.Path != "/healthz" && r.URL.Path != "/readyz" && r.URL.Path != "/status") {
+			http.NotFound(w, r)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		if r.URL.Path == "/readyz" && !status.Ready {
+			w.WriteHeader(http.StatusServiceUnavailable)
+		}
+		_ = json.NewEncoder(w).Encode(status)
+	})
+}

cmd/agent-worker/status_test.go

@@ -0,0 +1,33 @@
+package main
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestWorkerStatusReportsRecoveryOnlyWithoutExecutor(t *testing.T) {
+	response := httptest.NewRecorder()
+	workerStatusHandler(false).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/status", nil))
+	var value workerStatusResponse
+	if err := json.NewDecoder(response.Body).Decode(&value); err != nil {
+		t.Fatal(err)
+	}
+	if response.Code != http.StatusOK || value.Ready || value.Mode != "recovery-only" || value.ExecutorConfigured {
+		t.Fatalf("unexpected status: code=%d value=%+v", response.Code, value)
+	}
+}
+
+func TestWorkerReadyzRequiresExecutor(t *testing.T) {
+	response := httptest.NewRecorder()
+	workerStatusHandler(false).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/readyz", nil))
+	if response.Code != http.StatusServiceUnavailable {
+		t.Fatalf("readyz status=%d", response.Code)
+	}
+	response = httptest.NewRecorder()
+	workerStatusHandler(true).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/readyz", nil))
+	if response.Code != http.StatusOK {
+		t.Fatalf("configured readyz status=%d", response.Code)
+	}
+}

cmd/cognitive-worker/main.go

@@ -10,6 +10,8 @@ import (
 	"git.cin.su/m/Assistant/contracts/capability"
 	"git.cin.su/m/Assistant/contracts/cognitive"
 	"git.cin.su/m/Assistant/contracts/identity"
+	secretcontracts "git.cin.su/m/Assistant/contracts/secrets"
+	platformsecrets "git.cin.su/m/Assistant/platform/secrets"
 	"git.cin.su/m/Assistant/runtime/health"
 	"io"
 	"log"
@@ -43,11 +45,21 @@ func main() {
 	discoveries := map[string]providerRegistration{}
 	var builtinLocal *providerRegistration
 	externalRecovery := []providerRegistration{}
-	cpuAdapter, err := models.NewOpenAICompatibleLocalAdapter(envOr("LOCAL_CPU_PROVIDER_URL", "http://docker.cin.su:18082/v1"), nil)
+	cpuAPIKey, err := loadLocalCPUProviderAPIKey()
 	if err != nil {
 		log.Fatal(err)
 	}
-	cpu := providerRegistration{ProviderInstanceID: "local-cpu-primary", Kind: "openai-compatible-chat-v1", EndpointRef: "local-cpu-primary-v1", AuthMode: capability.AuthNone, BillingMode: capability.BillingFree, DataPolicy: capability.DataPolicyLocalOnly, Provider: cpuAdapter, Discovery: cpuAdapter}
+	cpuAdapter, err := models.NewOpenAICompatibleLocalAdapterWithAPIKey(envOr("LOCAL_CPU_PROVIDER_URL", "http://docker.cin.su:18082/v1"), cpuAPIKey, nil)
+	if err != nil {
+		log.Fatal(err)
+	}
+	cpuAuthMode := capability.AuthNone
+	cpuCredentialRef := capability.CredentialRef("")
+	if cpuAPIKey != "" {
+		cpuAuthMode = capability.AuthKey
+		cpuCredentialRef = capability.CredentialRef(envOr("LOCAL_CPU_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-cpu/provider-api-key/v1"))
+	}
+	cpu := providerRegistration{ProviderInstanceID: "local-cpu-primary", Kind: "openai-compatible-chat-v1", EndpointRef: "local-cpu-primary-v1", CredentialRef: cpuCredentialRef, AuthMode: cpuAuthMode, BillingMode: capability.BillingFree, DataPolicy: capability.DataPolicyLocalOnly, Provider: cpuAdapter, Discovery: cpuAdapter}
 	providers[cpu.Kind] = append(providers[cpu.Kind], cpu)
 	discoveries["cpu"] = cpu
 	if lifeboat, enabled, lifeboatErr := newLifeboatProvider(os.Getenv("LOCAL_LIFEBOAT_PROVIDER_URL")); lifeboatErr != nil {
@@ -145,6 +157,25 @@ func refreshProviderDiscoveries(resolver bindingResolver, service discoveryServi
 	}
 }
 
+func loadLocalCPUProviderAPIKey() (string, error) {
+	if _, set := os.LookupEnv("LOCAL_CPU_PROVIDER_API_KEY"); set {
+		return "", fmt.Errorf("LOCAL_CPU_PROVIDER_API_KEY direct environment secret is forbidden; use LOCAL_CPU_PROVIDER_API_KEY_FILE")
+	}
+	fileName := strings.TrimSpace(os.Getenv("LOCAL_CPU_PROVIDER_API_KEY_FILE"))
+	if fileName == "" {
+		return "", nil
+	}
+	ref := strings.TrimSpace(os.Getenv("LOCAL_CPU_PROVIDER_CREDENTIAL_REF"))
+	if ref == "" {
+		return "", fmt.Errorf("LOCAL_CPU_PROVIDER_CREDENTIAL_REF is required when LOCAL_CPU_PROVIDER_API_KEY_FILE is configured")
+	}
+	resolver, err := platformsecrets.NewFileResolver(envOr("SECRET_BACKEND_ROOT", "/run/secrets"))
+	if err != nil {
+		return "", err
+	}
+	return resolver.ResolveFile(secretcontracts.SecretFileRef{CredentialRef: secretcontracts.CredentialRef(ref), Purpose: secretcontracts.SecretPurposeProviderAPIKey, Consumer: secretcontracts.RuntimeConsumerCognitive, Path: fileName})
+}
+
 func deterministicAdvisory(w http.ResponseWriter, r *http.Request) {
 	request, ok := decodeAdvisoryRequest(w, r)
 	if !ok {

cmd/cognitive-worker/main_test.go

@@ -1,6 +1,10 @@
 package main
 
-import "testing"
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
 
 func TestLifeboatProviderIsOptionalAndLocalAdapterBacked(t *testing.T) {
 	if _, enabled, err := newLifeboatProvider(""); err != nil || enabled {
@@ -14,3 +18,28 @@ func TestLifeboatProviderIsOptionalAndLocalAdapterBacked(t *testing.T) {
 		t.Fatalf("unexpected lifeboat registration: %+v", provider)
 	}
 }
+
+func TestLoadLocalCPUProviderAPIKeyUsesProtectedFileReference(t *testing.T) {
+	t.Setenv("LOCAL_CPU_PROVIDER_API_KEY", "")
+	_ = os.Unsetenv("LOCAL_CPU_PROVIDER_API_KEY")
+	root := t.TempDir()
+	path := filepath.Join(root, "local_cpu_provider_api_key")
+	if err := os.WriteFile(path, []byte("resolved-key\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("LOCAL_CPU_PROVIDER_API_KEY_FILE", path)
+	t.Setenv("LOCAL_CPU_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-cpu/provider-api-key/v1")
+	t.Setenv("SECRET_BACKEND_ROOT", root)
+	key, err := loadLocalCPUProviderAPIKey()
+	if err != nil || key != "resolved-key" {
+		t.Fatalf("unexpected key resolution result: err=%v", err)
+	}
+}
+
+func TestLoadLocalCPUProviderAPIKeyRejectsDirectEnvironmentSecret(t *testing.T) {
+	t.Setenv("LOCAL_CPU_PROVIDER_API_KEY", "must-not-be-used")
+	t.Setenv("LOCAL_CPU_PROVIDER_API_KEY_FILE", "")
+	if _, err := loadLocalCPUProviderAPIKey(); err == nil {
+		t.Fatal("expected direct environment secret to be rejected")
+	}
+}

cmd/creator-web/main.go

@@ -15,6 +15,7 @@ func main() {
 		envOr("COMMIT_RUNTIME_URL", "http://commit-runtime:8082"),
 		&http.Client{Timeout: 10 * time.Second},
 		envOr("COGNITIVE_RUNTIME_URL", "http://cognitive-worker:8083"),
+		envOr("AGENT_WORKER_URL", "http://agent-worker:8090"),
 	)
 	if err != nil {
 		log.Fatal(err)

cmd/creator-web/server.go

@@ -33,13 +33,14 @@ const (
 var staticFiles embed.FS
 
 type gateway struct {
-	core       *url.URL
-	continuity *url.URL
-	commit     *url.URL
-	cognitive  *url.URL
-	client     *http.Client
-	static     http.Handler
-	build      buildMetadata
+	core        *url.URL
+	continuity  *url.URL
+	commit      *url.URL
+	cognitive   *url.URL
+	agentWorker *url.URL
+	client      *http.Client
+	static      http.Handler
+	build       buildMetadata
 }
 
 type buildMetadata struct {
@@ -76,6 +77,14 @@ func newHandler(coreURL, continuityURL, commitURL string, client *http.Client, c
 	if err != nil {
 		return nil, err
 	}
+	agentWorkerURL := "http://agent-worker:8090"
+	if len(cognitiveURLs) > 1 {
+		agentWorkerURL = cognitiveURLs[1]
+	}
+	agentWorker, err := parseRuntimeURL(agentWorkerURL, "Agent worker")
+	if err != nil {
+		return nil, err
+	}
 	assets, err := fs.Sub(staticFiles, "static")
 	if err != nil {
 		return nil, fmt.Errorf("load embedded console: %w", err)
@@ -96,7 +105,7 @@ func newHandler(coreURL, continuityURL, commitURL string, client *http.Client, c
 	if len(revision) > 12 {
 		revision = revision[:12]
 	}
-	return securityHeaders(&gateway{core: core, continuity: continuity, commit: commit, cognitive: cognitiveRuntime, client: client, static: http.FileServer(http.FS(assets)), build: buildMetadata{revision: revision, updated: updated}}), nil
+	return securityHeaders(&gateway{core: core, continuity: continuity, commit: commit, cognitive: cognitiveRuntime, agentWorker: agentWorker, client: client, static: http.FileServer(http.FS(assets)), build: buildMetadata{revision: revision, updated: updated}}), nil
 }
 
 func parseRuntimeURL(rawURL, name string) (*url.URL, error) {
@@ -130,6 +139,10 @@ func (g *gateway) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			g.handleFleetReadiness(w, r)
 			return
 		}
+		if r.Method == http.MethodGet && r.URL.Path == "/api/agent-worker/status" {
+			g.handleAgentWorkerStatus(w, r)
+			return
+		}
 		g.forwardAPI(w, r)
 		return
 	}
@@ -290,6 +303,44 @@ func (g *gateway) handleFleetReadiness(w http.ResponseWriter, r *http.Request) {
 	_, _ = io.Copy(w, io.LimitReader(response.Body, maxResponseBytes))
 }
 
+func (g *gateway) handleAgentWorkerStatus(w http.ResponseWriter, r *http.Request) {
+	authorization := r.Header.Get("Authorization")
+	if authorization == "" {
+		http.Error(w, "creator session denied", http.StatusUnauthorized)
+		return
+	}
+	var session identity.CreatorSession
+	status, err := g.getTrustedJSON(r, g.core, "/v1/creator/sessions/current", "", authorization, &session)
+	if err != nil {
+		http.Error(w, "creator session unavailable", http.StatusBadGateway)
+		return
+	}
+	if status != http.StatusOK || session.ActorID == "" || session.PrincipalID == "" {
+		if status == 0 {
+			status = http.StatusUnauthorized
+		}
+		http.Error(w, "creator session denied", status)
+		return
+	}
+	target := *g.agentWorker
+	target.Path = "/status"
+	request, err := http.NewRequestWithContext(r.Context(), http.MethodGet, target.String(), nil)
+	if err != nil {
+		http.Error(w, "agent worker status unavailable", http.StatusBadGateway)
+		return
+	}
+	response, err := g.client.Do(request)
+	if err != nil {
+		http.Error(w, "agent worker status unavailable", http.StatusBadGateway)
+		return
+	}
+	defer response.Body.Close()
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(response.StatusCode)
+	_, _ = io.Copy(w, io.LimitReader(response.Body, maxResponseBytes))
+}
+
 func (g *gateway) handleAdvisory(w http.ResponseWriter, r *http.Request) {
 	var browserRequest browserAdvisoryRequest
 	if err := decodeStrictJSON(r.Body, maxAdvisoryRequestBytes, &browserRequest); err != nil || browserRequest.Message == "" || len(browserRequest.Message) > 16*1024 || !validID(browserRequest.SessionID) || !validID(browserRequest.WorkspaceID) {

cmd/creator-web/server_test.go

@@ -42,6 +42,39 @@ func TestCreatorRouteAllowsOnlyBoundedDelegationReads(t *testing.T) {
 	}
 }
 
+func TestAgentWorkerStatusProxyRequiresCreatorSession(t *testing.T) {
+	core := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1/creator/sessions/current" || r.Header.Get("Authorization") != "Bearer bounded-session" {
+			t.Fatalf("unexpected session request path=%s auth=%q", r.URL.Path, r.Header.Get("Authorization"))
+		}
+		_, _ = io.WriteString(w, `{"ActorID":"creator-actor","PrincipalID":"creator-principal","ExpiresAtUnix":2000000000}`)
+	}))
+	defer core.Close()
+	worker := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/status" {
+			t.Fatalf("unexpected worker path %s", r.URL.Path)
+		}
+		_, _ = io.WriteString(w, `{"runtime":"agent-worker","executor_configured":false,"mode":"recovery-only","ready":false,"reason":"bridge missing"}`)
+	}))
+	defer worker.Close()
+	handler, err := newHandler(core.URL, "http://continuity.invalid", "http://commit.invalid", core.Client(), "http://cognitive.invalid", worker.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	denied := httptest.NewRecorder()
+	handler.ServeHTTP(denied, httptest.NewRequest(http.MethodGet, "/api/agent-worker/status", nil))
+	if denied.Code != http.StatusUnauthorized {
+		t.Fatalf("unauthenticated status=%d", denied.Code)
+	}
+	request := httptest.NewRequest(http.MethodGet, "/api/agent-worker/status", nil)
+	request.Header.Set("Authorization", "Bearer bounded-session")
+	response := httptest.NewRecorder()
+	handler.ServeHTTP(response, request)
+	if response.Code != http.StatusOK || !strings.Contains(response.Body.String(), `"mode":"recovery-only"`) || response.Header().Get("Cache-Control") != "no-store" {
+		t.Fatalf("response=%d cache=%q body=%s", response.Code, response.Header().Get("Cache-Control"), response.Body.String())
+	}
+}
+
 func TestFleetReadinessRequiresCreatorSessionAndProxiesCognitiveState(t *testing.T) {
 	core := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != "/v1/creator/sessions/current" || r.Header.Get("Authorization") != "Bearer bounded-session" {

cmd/creator-web/static/assets/console.css

@@ -281,6 +281,11 @@ html[data-reduced-motion="true"] *, html[data-reduced-motion="true"] *::before,
 .agent-details span { display: block; color: var(--faint); font: 9px/1 var(--mono); letter-spacing: .1em; text-transform: uppercase; }
 .agent-details strong { display: block; margin-top: 7px; overflow: hidden; color: var(--ink); font: 600 10px/1.4 var(--mono); text-overflow: ellipsis; white-space: nowrap; }
 .agent-details p { grid-column: 1 / -1; margin: 0; padding-top: 12px; border-top: 1px solid var(--line-soft); color: var(--muted); font: 10px/1.5 var(--mono); }
+.agent-worker-status { margin: 0 18px 16px; padding-top: 13px; display: grid; grid-template-columns: auto 1fr; gap: 6px 14px; border-top: 1px solid var(--line-soft); }
+.agent-worker-status span { color: var(--faint); font: 9px/1 var(--mono); letter-spacing: .1em; text-transform: uppercase; }
+.agent-worker-status strong { color: var(--warn); font: 600 10px/1.3 var(--mono); }
+.agent-worker-status strong[data-state="ready"] { color: var(--good); }
+.agent-worker-status p { grid-column: 1 / -1; margin: 0; color: var(--muted); font: 10px/1.45 var(--mono); }
 
 .learning-grid { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); }
 .learning-grid article { min-width: 0; border-right: 1px solid var(--line-soft); }

cmd/creator-web/static/assets/console.js

@@ -174,6 +174,7 @@ async function showConsole() {
     loadLearning();
     loadFleetReadiness();
     loadAgentDelegation();
+    loadAgentWorkerStatus();
   }
   runDiagnostics();
 }
@@ -448,6 +449,7 @@ async function loadDashboard() {
   work.push(loadLearning());
   work.push(loadFleetReadiness());
   work.push(loadAgentDelegation());
+  work.push(loadAgentWorkerStatus());
   if (context["capability-id"]) work.push(loadCapability(context["capability-id"]));
   else setSignal("capability", "не выбрана", "idle");
 
@@ -580,6 +582,19 @@ async function loadAgentDelegation() {
   }
 }
 
+async function loadAgentWorkerStatus() {
+  try {
+    const status = await request("/api/agent-worker/status");
+    setText("agent-worker-state", status.mode || "UNKNOWN");
+    setText("agent-worker-message", status.reason || "Причина не указана.");
+    byId("agent-worker-state").dataset.state = status.ready === true ? "ready" : "degraded";
+  } catch (error) {
+    setText("agent-worker-state", "НЕДОСТУПЕН");
+    setText("agent-worker-message", safeClientError(error));
+    byId("agent-worker-state").dataset.state = "degraded";
+  }
+}
+
 async function loadLearning() {
   const experienceList = byId("experience-list");
   const reflectionList = byId("reflection-list");

cmd/creator-web/static/index.html

@@ -204,6 +204,7 @@
           <div><span>Последний blocker</span><strong id="agent-blocker">—</strong></div>
           <p id="agent-next-step">—</p>
         </div>
+        <div class="agent-worker-status"><span>Executor capability</span><strong id="agent-worker-state">ПРОВЕРКА НЕ ВЫПОЛНЯЛАСЬ</strong><p id="agent-worker-message">Статус worker виден только в авторизованной диагностике.</p></div>
       </section>
 
       <section class="activity-panel" aria-labelledby="activity-title" data-page="operations">

contracts/secrets/types.go

@@ -9,6 +9,7 @@ type SecretPurpose string
 
 const (
 	SecretPurposeDatabasePassword SecretPurpose = "DATABASE_PASSWORD"
+	SecretPurposeProviderAPIKey   SecretPurpose = "PROVIDER_API_KEY"
 )
 
 // RuntimeConsumer identifies a trusted runtime allowed to resolve a credential.
@@ -18,6 +19,7 @@ const (
 	RuntimeConsumerCore             RuntimeConsumer = "core-runtime"
 	RuntimeConsumerWorkWorker       RuntimeConsumer = "agent-worker"
 	RuntimeConsumerEpistemicsWorker RuntimeConsumer = "reflection-worker"
+	RuntimeConsumerCognitive        RuntimeConsumer = "cognitive-worker"
 )
 
 // SecretFileRef is bootstrap delivery metadata for the V1 protected local

deploy/docker-compose.prod.yml

@@ -105,7 +105,7 @@ services:
   agent-worker:
     build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: agent-worker, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
     restart: unless-stopped
-    command: ["-worker-id", "agent-worker-production"]
+    command: ["-worker-id", "agent-worker-production", "-status-addr", ":8090"]
     environment:
       POSTGRES_HOST: postgres
       POSTGRES_PORT: "5432"
@@ -257,6 +257,7 @@ services:
       CONTINUITY_RUNTIME_URL: http://continuity-runtime:8081
       COMMIT_RUNTIME_URL: http://commit-runtime:8082
       COGNITIVE_RUNTIME_URL: http://cognitive-worker:8083
+      AGENT_WORKER_URL: http://agent-worker:8090
       ASSISTANT_BUILD_REVISION: ${ASSISTANT_SOURCE_REVISION:-unknown}
     ports: ["${CREATOR_WEB_PORT:-18080}:8084"]
     depends_on: [core-runtime, continuity-runtime, commit-runtime, cognitive-worker]

dev/ACTIVE_TASK.json

@@ -1,5 +1,5 @@
 {
-  "task_file": "dev/tasks/DEV-000150-agent-operations-ui.json",
-  "task_id": "DEV-000150",
+  "task_file": "dev/tasks/DEV-000152-cognitive-provider-secret-reference.json",
+  "task_id": "DEV-000152",
   "task_revision": 1
 }

dev/tasks/DEV-000151-agent-worker-status-ui.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000151",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "6871e36657a10e8ad7fb1e059efdc2dde394ebbd",
+  "risk_tier": "E",
+  "intent": "Expose truthful agent-worker executor capability status to the authenticated operations cabinet while preserving recovery-only behavior when no bridge is configured.",
+  "requirement_ids": ["WP-301", "WP-804", "INV-TOPO-001"],
+  "allowed_change_scope": {"modules": ["work", "interaction", "agent-worker"], "paths": ["cmd/agent-worker/**", "cmd/creator-web/**", "deploy/docker-compose.prod.yml", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000151-agent-worker-status-ui.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", ".gitea/**", "database/**", "contracts/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["creator session", "agent-worker status HTTP response"], "may_change": []},
+  "semantic_owner": "work",
+  "canonical_state": [],
+  "state_transitions": ["executor configured -> execution status; executor absent -> recovery-only status"],
+  "side_effects_and_privileges": ["read-only internal status endpoint and authenticated UI proxy"],
+  "persistence_and_migrations": [],
+  "failure_retry_restart": ["status remains truthful across worker restart; no dispatch claim is introduced"],
+  "assumptions": ["agent-worker and creator-web share the production compose network", "AGENT_EXECUTION_BRIDGE_URL remains the only execution activation input"],
+  "acceptance_scenarios": ["worker status reports recovery-only when bridge absent", "readyz is non-ready without executor", "unauthenticated public status proxy returns 401", "authenticated cabinet renders degraded capability reason", "compose wiring reaches internal worker status"],
+  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "git diff --check", "check-architecture", "independent", "docker compose config"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000152-cognitive-provider-secret-reference.json

@@ -0,0 +1,35 @@
+{
+  "task_id": "DEV-000152",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "624c41d4f6dae8c8d341aec09485efbba78bc76f",
+  "risk_tier": "E",
+  "intent": "Enable cognitive-worker to authenticate the local OpenAI-compatible CPU gateway through a typed file-backed credential reference without exposing provider key material in environment, source, or logs.",
+  "requirement_ids": ["AUDIT-WP-003", "AUDIT-WP-201", "CONSTITUTION-1.3.28"],
+  "allowed_change_scope": {
+    "modules": ["capability", "cognitive"],
+    "paths": [
+      "contracts/secrets/types.go",
+      "platform/secrets/**",
+      "adapters/models/openai_compatible_local.go",
+      "adapters/models/openai_compatible_local_test.go",
+      "cmd/cognitive-worker/main.go",
+      "cmd/cognitive-worker/main_test.go",
+      "dev/ACTIVE_TASK.json",
+      "dev/tasks/DEV-000152-cognitive-provider-secret-reference.json"
+    ]
+  },
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/devctl/**", ".gitea/**", "deploy/**", "database/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["typed CredentialRef", "protected file-backed secret resolver"], "may_change": ["secret purpose and trusted runtime consumer enum values"]},
+  "semantic_owner": "capability",
+  "canonical_state": ["provider credential material remains external to repository and database"],
+  "state_transitions": ["cognitive-worker sends a bearer credential only when a trusted file-backed reference resolves successfully"],
+  "side_effects_and_privileges": ["none; adapter receives resolved material from runtime bootstrap and never persists it"],
+  "persistence_and_migrations": ["no database migration"],
+  "failure_retry_restart": ["direct secret environment configuration fails closed", "missing reference or unreadable file fails startup", "no configured key preserves existing unauthenticated development behavior"],
+  "assumptions": ["production operators provision the gateway key into the protected secret volume separately; this task does not copy or reveal it"],
+  "acceptance_scenarios": ["resolved key becomes Authorization Bearer header", "no key sends no Authorization header", "direct environment secret is rejected", "secret value is absent from logs and repository"],
+  "required_tests": ["unit", "go test", "go vet", "architecture preflight", "check-diff", "git diff --check", "independent", "exact diff scope", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT", "BLOCKED_BY_ARCHITECTURE_GAP"]
+}