feat: add configurable medium model fleet slot

adapters/models/openai_compatible_local.go

@@ -22,9 +22,16 @@ import (
 type OpenAICompatibleLocalAdapter struct {
 	base   *url.URL
 	client *http.Client
+	apiKey string
 }
 
 func NewOpenAICompatibleLocalAdapter(raw string, transport http.RoundTripper) (*OpenAICompatibleLocalAdapter, error) {
+	return NewOpenAICompatibleLocalAdapterWithAPIKey(raw, "", transport)
+}
+
+// NewOpenAICompatibleLocalAdapterWithAPIKey creates an adapter for a gateway
+// whose bearer credential was resolved by the trusted runtime boundary.
+func NewOpenAICompatibleLocalAdapterWithAPIKey(raw, apiKey string, transport http.RoundTripper) (*OpenAICompatibleLocalAdapter, error) {
 	base, err := url.Parse(raw)
 	if err != nil || base.Scheme != "http" || base.Host == "" || strings.TrimSuffix(base.Path, "/") != "/v1" || base.RawQuery != "" || base.Fragment != "" || base.User != nil {
 		return nil, errors.New("invalid local compatible endpoint")
@@ -32,7 +39,7 @@ func NewOpenAICompatibleLocalAdapter(raw string, transport http.RoundTripper) (*
 	if transport == nil {
 		transport = http.DefaultTransport
 	}
-	return &OpenAICompatibleLocalAdapter{base: base, client: &http.Client{Transport: transport, Timeout: 10 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}}, nil
+	return &OpenAICompatibleLocalAdapter{base: base, client: &http.Client{Transport: transport, Timeout: 10 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}, apiKey: strings.TrimSpace(apiKey)}, nil
 }
 
 type compatibleModelsResponse struct {
@@ -145,6 +152,9 @@ func (a *OpenAICompatibleLocalAdapter) requestJSON(ctx context.Context, method,
 		return 0, err
 	}
 	request.Header.Set("Accept", "application/json")
+	if a.apiKey != "" {
+		request.Header.Set("Authorization", "Bearer "+a.apiKey)
+	}
 	if input != nil {
 		request.Header.Set("Content-Type", "application/json")
 	}

adapters/models/openai_compatible_local_test.go

@@ -0,0 +1,42 @@
+package models
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+type captureRoundTripper struct {
+	authorization string
+}
+
+func (t *captureRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) {
+	t.authorization = request.Header.Get("Authorization")
+	return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader(`{"data":[]}`)), Header: make(http.Header), Request: request}, nil
+}
+
+func TestOpenAICompatibleLocalAdapterUsesResolvedAPIKey(t *testing.T) {
+	transport := &captureRoundTripper{}
+	adapter, err := NewOpenAICompatibleLocalAdapterWithAPIKey("http://gateway/v1", "resolved-key", transport)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, _ = adapter.Discover(context.Background())
+	if transport.authorization != "Bearer resolved-key" {
+		t.Fatalf("unexpected authorization header: %q", transport.authorization)
+	}
+}
+
+func TestOpenAICompatibleLocalAdapterDoesNotSendAuthorizationWithoutKey(t *testing.T) {
+	transport := &captureRoundTripper{}
+	adapter, err := NewOpenAICompatibleLocalAdapter("http://gateway/v1", transport)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, _ = adapter.Discover(context.Background())
+	if transport.authorization != "" {
+		t.Fatalf("unexpected authorization header")
+	}
+}

cmd/cognitive-worker/fleet_status.go

@@ -17,6 +17,8 @@ type fleetEndpoint struct {
 	ModelID    string
 	Tier       capability.FleetTier
 	URL        string
+	Headers    map[string]string
+	Client     *http.Client
 }
 
 type fleetStatusResponse struct {
@@ -37,7 +39,14 @@ func fleetReadinessHandler(client *http.Client, preferred capability.FleetTier,
 			}
 			request, err := http.NewRequestWithContext(r.Context(), http.MethodGet, endpoint.URL, nil)
 			if err == nil {
-				response, requestErr := client.Do(request)
+				for name, value := range endpoint.Headers {
+					request.Header.Set(name, value)
+				}
+				probeClient := endpoint.Client
+				if probeClient == nil {
+					probeClient = client
+				}
+				response, requestErr := probeClient.Do(request)
 				if requestErr == nil {
 					response.Body.Close()
 					if response.StatusCode >= 200 && response.StatusCode < 300 {

cmd/cognitive-worker/fleet_status_test.go

@@ -25,3 +25,22 @@ func TestFleetReadinessSelectsLifeboatWhenPrimaryTiersUnavailable(t *testing.T)
 		t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String())
 	}
 }
+
+func TestFleetReadinessSendsConfiguredProviderHeaders(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Authorization") != "Bearer fleet-key" {
+			t.Fatalf("authorization=%q", r.Header.Get("Authorization"))
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+	handler := fleetReadinessHandler(server.Client(), capability.FleetTierFast, []fleetEndpoint{{
+		ProviderID: "cpu", ModelID: "cpu-model", Tier: capability.FleetTierFast, URL: server.URL,
+		Headers: map[string]string{"Authorization": "Bearer fleet-key"},
+	}})
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/v1/fleet/readiness", nil))
+	if recorder.Code != http.StatusOK || !strings.Contains(recorder.Body.String(), `"ready":true`) {
+		t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String())
+	}
+}

cmd/cognitive-worker/main.go

@@ -10,6 +10,8 @@ import (
 	"git.cin.su/m/Assistant/contracts/capability"
 	"git.cin.su/m/Assistant/contracts/cognitive"
 	"git.cin.su/m/Assistant/contracts/identity"
+	secretcontracts "git.cin.su/m/Assistant/contracts/secrets"
+	platformsecrets "git.cin.su/m/Assistant/platform/secrets"
 	"git.cin.su/m/Assistant/runtime/health"
 	"io"
 	"log"
@@ -43,13 +45,44 @@ func main() {
 	discoveries := map[string]providerRegistration{}
 	var builtinLocal *providerRegistration
 	externalRecovery := []providerRegistration{}
-	cpuAdapter, err := models.NewOpenAICompatibleLocalAdapter(envOr("LOCAL_CPU_PROVIDER_URL", "http://docker.cin.su:18082/v1"), nil)
+	cpuAPIKey, err := loadProviderAPIKey("LOCAL_CPU_PROVIDER_API_KEY", "LOCAL_CPU_PROVIDER_API_KEY_FILE", "LOCAL_CPU_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-cpu/provider-api-key/v1")
 	if err != nil {
 		log.Fatal(err)
 	}
-	cpu := providerRegistration{ProviderInstanceID: "local-cpu-primary", Kind: "openai-compatible-chat-v1", EndpointRef: "local-cpu-primary-v1", AuthMode: capability.AuthNone, BillingMode: capability.BillingFree, DataPolicy: capability.DataPolicyLocalOnly, Provider: cpuAdapter, Discovery: cpuAdapter}
+	cpuAdapter, err := models.NewOpenAICompatibleLocalAdapterWithAPIKey(envOr("LOCAL_CPU_PROVIDER_URL", "http://docker.cin.su:18082/v1"), cpuAPIKey, nil)
+	if err != nil {
+		log.Fatal(err)
+	}
+	cpuAuthMode := capability.AuthNone
+	cpuCredentialRef := capability.CredentialRef("")
+	if cpuAPIKey != "" {
+		cpuAuthMode = capability.AuthKey
+		cpuCredentialRef = capability.CredentialRef(envOr("LOCAL_CPU_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-cpu/provider-api-key/v1"))
+	}
+	cpu := providerRegistration{ProviderInstanceID: "local-cpu-primary", Kind: "openai-compatible-chat-v1", EndpointRef: "local-cpu-primary-v1", CredentialRef: cpuCredentialRef, AuthMode: cpuAuthMode, BillingMode: capability.BillingFree, DataPolicy: capability.DataPolicyLocalOnly, Provider: cpuAdapter, Discovery: cpuAdapter}
 	providers[cpu.Kind] = append(providers[cpu.Kind], cpu)
 	discoveries["cpu"] = cpu
+	mediumURL := strings.TrimSpace(os.Getenv("LOCAL_MEDIUM_PROVIDER_URL"))
+	mediumAPIKey := ""
+	if mediumURL != "" {
+		mediumAPIKey, err = loadProviderAPIKey("LOCAL_MEDIUM_PROVIDER_API_KEY", "LOCAL_MEDIUM_PROVIDER_API_KEY_FILE", "LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-medium/provider-api-key/v1")
+		if err != nil {
+			log.Fatal(err)
+		}
+		mediumAdapter, adapterErr := models.NewOpenAICompatibleLocalAdapterWithAPIKey(strings.TrimRight(mediumURL, "/"), mediumAPIKey, nil)
+		if adapterErr != nil {
+			log.Fatal(adapterErr)
+		}
+		mediumAuthMode := capability.AuthNone
+		mediumCredentialRef := capability.CredentialRef("")
+		if mediumAPIKey != "" {
+			mediumAuthMode = capability.AuthKey
+			mediumCredentialRef = capability.CredentialRef(envOr("LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-medium/provider-api-key/v1"))
+		}
+		medium := providerRegistration{ProviderInstanceID: "local-medium-primary", Kind: "openai-compatible-chat-v1", EndpointRef: "local-medium-primary-v1", CredentialRef: mediumCredentialRef, AuthMode: mediumAuthMode, BillingMode: capability.BillingFree, DataPolicy: capability.DataPolicyLocalOnly, Provider: mediumAdapter, Discovery: mediumAdapter}
+		providers[medium.Kind] = append(providers[medium.Kind], medium)
+		discoveries["medium"] = medium
+	}
 	if lifeboat, enabled, lifeboatErr := newLifeboatProvider(os.Getenv("LOCAL_LIFEBOAT_PROVIDER_URL")); lifeboatErr != nil {
 		log.Fatal(lifeboatErr)
 	} else if enabled {
@@ -73,18 +106,40 @@ func main() {
 	gateway := cognitiveGateway{resolver: resolver, providers: providers, builtinLocal: builtinLocal, externalRecovery: externalRecovery, now: time.Now, allowCanary: os.Getenv("COGNITIVE_ALLOW_CANARY") == "true", canaryMaxOutputBytes: 4096, admission: newHTTPAdmissionClient(envOr("CORE_RUNTIME_URL", "http://core-runtime:8080"), &http.Client{Timeout: 5 * time.Second})}
 	mux.Handle("/healthz", health.Handler{Runtime: "cognitive-worker", SemanticGeneration: 1, ArchitectureGeneration: 1})
 	readinessClient := &http.Client{Timeout: 2 * time.Second}
+	cpuReadinessClient := &http.Client{Timeout: 10 * time.Second}
+	mediumReadinessClient := &http.Client{Timeout: 10 * time.Second}
 	lifeboatURL := strings.TrimSuffix(strings.TrimRight(envOr("LOCAL_LIFEBOAT_PROVIDER_URL", "http://cognitive-lifeboat:8086/v1"), "/"), "/v1") + "/health"
-	mux.Handle("/readyz", health.ReadinessHandler{Runtime: "cognitive-worker", Probes: []health.Probe{
-		health.HTTPProbe(readinessClient, strings.TrimRight(envOr("CORE_RUNTIME_URL", "http://core-runtime:8080"), "/")+"/healthz"),
-		health.OptionalHTTPProbe(readinessClient, strings.TrimRight(envOr("LOCAL_CPU_PROVIDER_URL", "http://docker.cin.su:18082/v1"), "/")+"/models"),
-		health.HTTPProbe(readinessClient, lifeboatURL),
-		health.OptionalHTTPProbe(readinessClient, strings.TrimRight(envOr("LOCAL_GPU_PROVIDER_URL", "http://192.168.220.91:11434"), "/")+"/api/tags"),
-	}})
 	fleetClient := &http.Client{Timeout: 2 * time.Second}
 	preferredFleet := capability.FleetTier(envOr("COGNITIVE_PREFERRED_FLEET_TIER", string(capability.FleetTierHeavy)))
+	cpuFleetHeaders := map[string]string{}
+	if cpuAPIKey != "" {
+		cpuFleetHeaders["Authorization"] = "Bearer " + cpuAPIKey
+	}
+	cpuEndpoint := strings.TrimRight(envOr("LOCAL_CPU_PROVIDER_URL", "http://docker.cin.su:18082/v1"), "/") + "/models"
+	cpuHealthProbe := health.OptionalHTTPProbeWithHeaders(cpuReadinessClient, cpuEndpoint, cpuFleetHeaders)
+	cpuHealthProbe.Timeout = 10 * time.Second
+	mediumEndpoint := ""
+	mediumHeaders := map[string]string{}
+	mediumHealthProbe := health.Probe{}
+	if mediumURL != "" {
+		mediumEndpoint = strings.TrimRight(mediumURL, "/") + "/models"
+		if mediumAPIKey != "" {
+			mediumHeaders["Authorization"] = "Bearer " + mediumAPIKey
+		}
+		mediumHealthProbe = health.OptionalHTTPProbeWithHeaders(mediumReadinessClient, mediumEndpoint, mediumHeaders)
+		mediumHealthProbe.Timeout = 10 * time.Second
+	}
+	readinessProbes := []health.Probe{
+		health.HTTPProbe(readinessClient, strings.TrimRight(envOr("CORE_RUNTIME_URL", "http://core-runtime:8080"), "/")+"/healthz"),
+		cpuHealthProbe,
+		mediumHealthProbe,
+		health.HTTPProbe(readinessClient, lifeboatURL),
+		health.OptionalHTTPProbe(readinessClient, strings.TrimRight(envOr("LOCAL_GPU_PROVIDER_URL", "http://192.168.220.91:11434"), "/")+"/api/tags"),
+	}
+	mux.Handle("/readyz", health.ReadinessHandler{Runtime: "cognitive-worker", Probes: readinessProbes})
 	mux.Handle("/v1/fleet/readiness", fleetReadinessHandler(fleetClient, preferredFleet, []fleetEndpoint{
-		{ProviderID: "local-cpu-primary", ModelID: "local-cpu-model", Tier: capability.FleetTierFast, URL: strings.TrimRight(envOr("LOCAL_CPU_PROVIDER_URL", "http://docker.cin.su:18082/v1"), "/") + "/models"},
-		{ProviderID: "local-medium-unconfigured", ModelID: "medium-unconfigured", Tier: capability.FleetTierMedium},
+		{ProviderID: "local-cpu-primary", ModelID: "local-cpu-model", Tier: capability.FleetTierFast, URL: cpuEndpoint, Headers: cpuFleetHeaders, Client: &http.Client{Timeout: 10 * time.Second}},
+		{ProviderID: "local-medium-primary", ModelID: "local-medium-model", Tier: capability.FleetTierMedium, URL: mediumEndpoint, Headers: mediumHeaders, Client: mediumReadinessClient},
 		{ProviderID: "local-gpu-opportunistic", ModelID: "gpu-opportunistic", Tier: capability.FleetTierHeavy, URL: strings.TrimRight(envOr("LOCAL_GPU_PROVIDER_URL", "http://192.168.220.91:11434"), "/") + "/api/tags"},
 		{ProviderID: "cognitive-lifeboat", ModelID: "qwen3-8b-lifeboat", Tier: capability.FleetTierLifeboat, URL: lifeboatURL},
 	}))
@@ -145,6 +200,32 @@ func refreshProviderDiscoveries(resolver bindingResolver, service discoveryServi
 	}
 }
 
+func loadProviderAPIKey(directEnvName, fileEnvName, refEnvName, defaultRef string) (string, error) {
+	if _, set := os.LookupEnv(directEnvName); set {
+		return "", fmt.Errorf("%s direct environment secret is forbidden; use %s", directEnvName, fileEnvName)
+	}
+	fileName := strings.TrimSpace(os.Getenv(fileEnvName))
+	if fileName == "" {
+		return "", nil
+	}
+	ref := strings.TrimSpace(os.Getenv(refEnvName))
+	if ref == "" {
+		ref = defaultRef
+	}
+	if ref == "" {
+		return "", fmt.Errorf("%s is required when %s is configured", refEnvName, fileEnvName)
+	}
+	resolver, err := platformsecrets.NewFileResolver(envOr("SECRET_BACKEND_ROOT", "/run/secrets"))
+	if err != nil {
+		return "", err
+	}
+	return resolver.ResolveFile(secretcontracts.SecretFileRef{CredentialRef: secretcontracts.CredentialRef(ref), Purpose: secretcontracts.SecretPurposeProviderAPIKey, Consumer: secretcontracts.RuntimeConsumerCognitive, Path: fileName})
+}
+
+func loadLocalCPUProviderAPIKey() (string, error) {
+	return loadProviderAPIKey("LOCAL_CPU_PROVIDER_API_KEY", "LOCAL_CPU_PROVIDER_API_KEY_FILE", "LOCAL_CPU_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-cpu/provider-api-key/v1")
+}
+
 func deterministicAdvisory(w http.ResponseWriter, r *http.Request) {
 	request, ok := decodeAdvisoryRequest(w, r)
 	if !ok {

cmd/cognitive-worker/main_test.go

@@ -1,6 +1,10 @@
 package main
 
-import "testing"
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
 
 func TestLifeboatProviderIsOptionalAndLocalAdapterBacked(t *testing.T) {
 	if _, enabled, err := newLifeboatProvider(""); err != nil || enabled {
@@ -14,3 +18,53 @@ func TestLifeboatProviderIsOptionalAndLocalAdapterBacked(t *testing.T) {
 		t.Fatalf("unexpected lifeboat registration: %+v", provider)
 	}
 }
+
+func TestLoadLocalCPUProviderAPIKeyUsesProtectedFileReference(t *testing.T) {
+	t.Setenv("LOCAL_CPU_PROVIDER_API_KEY", "")
+	_ = os.Unsetenv("LOCAL_CPU_PROVIDER_API_KEY")
+	root := t.TempDir()
+	path := filepath.Join(root, "local_cpu_provider_api_key")
+	if err := os.WriteFile(path, []byte("resolved-key\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("LOCAL_CPU_PROVIDER_API_KEY_FILE", path)
+	t.Setenv("LOCAL_CPU_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-cpu/provider-api-key/v1")
+	t.Setenv("SECRET_BACKEND_ROOT", root)
+	key, err := loadLocalCPUProviderAPIKey()
+	if err != nil || key != "resolved-key" {
+		t.Fatalf("unexpected key resolution result: err=%v", err)
+	}
+}
+
+func TestLoadLocalCPUProviderAPIKeyRejectsDirectEnvironmentSecret(t *testing.T) {
+	t.Setenv("LOCAL_CPU_PROVIDER_API_KEY", "must-not-be-used")
+	t.Setenv("LOCAL_CPU_PROVIDER_API_KEY_FILE", "")
+	if _, err := loadLocalCPUProviderAPIKey(); err == nil {
+		t.Fatal("expected direct environment secret to be rejected")
+	}
+}
+
+func TestLoadProviderAPIKeySupportsMediumCredentialRef(t *testing.T) {
+	t.Setenv("LOCAL_MEDIUM_PROVIDER_API_KEY", "")
+	_ = os.Unsetenv("LOCAL_MEDIUM_PROVIDER_API_KEY")
+	root := t.TempDir()
+	path := filepath.Join(root, "medium_provider_api_key")
+	if err := os.WriteFile(path, []byte("medium-key\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("LOCAL_MEDIUM_PROVIDER_API_KEY_FILE", path)
+	t.Setenv("LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-medium/provider-api-key/v1")
+	t.Setenv("SECRET_BACKEND_ROOT", root)
+	key, err := loadProviderAPIKey("LOCAL_MEDIUM_PROVIDER_API_KEY", "LOCAL_MEDIUM_PROVIDER_API_KEY_FILE", "LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-medium/provider-api-key/v1")
+	if err != nil || key != "medium-key" {
+		t.Fatalf("unexpected medium key resolution result: err=%v", err)
+	}
+}
+
+func TestLoadProviderAPIKeyRejectsMediumDirectEnvironmentSecret(t *testing.T) {
+	t.Setenv("LOCAL_MEDIUM_PROVIDER_API_KEY", "must-not-be-used")
+	t.Setenv("LOCAL_MEDIUM_PROVIDER_API_KEY_FILE", "")
+	if _, err := loadProviderAPIKey("LOCAL_MEDIUM_PROVIDER_API_KEY", "LOCAL_MEDIUM_PROVIDER_API_KEY_FILE", "LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-medium/provider-api-key/v1"); err == nil {
+		t.Fatal("expected direct medium environment secret to be rejected")
+	}
+}

contracts/secrets/types.go

@@ -9,6 +9,7 @@ type SecretPurpose string
 
 const (
 	SecretPurposeDatabasePassword SecretPurpose = "DATABASE_PASSWORD"
+	SecretPurposeProviderAPIKey   SecretPurpose = "PROVIDER_API_KEY"
 )
 
 // RuntimeConsumer identifies a trusted runtime allowed to resolve a credential.
@@ -18,6 +19,7 @@ const (
 	RuntimeConsumerCore             RuntimeConsumer = "core-runtime"
 	RuntimeConsumerWorkWorker       RuntimeConsumer = "agent-worker"
 	RuntimeConsumerEpistemicsWorker RuntimeConsumer = "reflection-worker"
+	RuntimeConsumerCognitive        RuntimeConsumer = "cognitive-worker"
 )
 
 // SecretFileRef is bootstrap delivery metadata for the V1 protected local

deploy/docker-compose.prod.yml

@@ -114,6 +114,7 @@ services:
       WORK_POSTGRES_CREDENTIAL_REF: credential://domovoy/work/db-password/v1
       WORK_POSTGRES_PASSWORD_FILE: /run/secrets/work_db_password
       SECRET_BACKEND_ROOT: /run/secrets
+      AGENT_EXECUTION_BRIDGE_URL: ${AGENT_EXECUTION_BRIDGE_URL:-}
     depends_on: { postgres: { condition: service_healthy } }
     volumes:
       - assistant_core_secrets:/run/secrets:ro
@@ -211,11 +212,18 @@ services:
       LISTEN_ADDR: ":8083"
       CORE_RUNTIME_URL: http://core-runtime:8080
       LOCAL_CPU_PROVIDER_URL: http://docker.cin.su:18082/v1
+      LOCAL_CPU_PROVIDER_API_KEY_FILE: ${LOCAL_CPU_PROVIDER_API_KEY_FILE:-}
+      LOCAL_CPU_PROVIDER_CREDENTIAL_REF: ${LOCAL_CPU_PROVIDER_CREDENTIAL_REF:-credential://domovoy/local-cpu/provider-api-key/v1}
+      LOCAL_MEDIUM_PROVIDER_URL: ${LOCAL_MEDIUM_PROVIDER_URL:-}
+      LOCAL_MEDIUM_PROVIDER_API_KEY_FILE: ${LOCAL_MEDIUM_PROVIDER_API_KEY_FILE:-}
+      LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF: ${LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF:-credential://domovoy/local-medium/provider-api-key/v1}
       LOCAL_LIFEBOAT_PROVIDER_URL: http://cognitive-lifeboat:8086/v1
       LOCAL_GPU_PROVIDER_URL: http://192.168.220.91:11434
       COGNITIVE_OWNER_PRINCIPAL_ID: domovoy-creator-principal
       COGNITIVE_ALLOW_CANARY: "true"
     depends_on: [core-runtime, cognitive-lifeboat]
+    volumes:
+      - assistant_core_secrets:/run/secrets:ro
 
   cognitive-lifeboat:
     image: ghcr.io/ggml-org/llama.cpp:server

dev/ACTIVE_TASK.json

@@ -1,5 +1,5 @@
 {
-  "task_file": "dev/tasks/DEV-000151-agent-worker-status-ui.json",
-  "task_id": "DEV-000151",
+  "task_file": "dev/tasks/DEV-000168-configurable-medium-fleet-slot.json",
+  "task_id": "DEV-000168",
   "task_revision": 1
 }

dev/tasks/DEV-000152-cognitive-provider-secret-reference.json

@@ -0,0 +1,35 @@
+{
+  "task_id": "DEV-000152",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "624c41d4f6dae8c8d341aec09485efbba78bc76f",
+  "risk_tier": "E",
+  "intent": "Enable cognitive-worker to authenticate the local OpenAI-compatible CPU gateway through a typed file-backed credential reference without exposing provider key material in environment, source, or logs.",
+  "requirement_ids": ["AUDIT-WP-003", "AUDIT-WP-201", "CONSTITUTION-1.3.28"],
+  "allowed_change_scope": {
+    "modules": ["capability", "cognitive"],
+    "paths": [
+      "contracts/secrets/types.go",
+      "platform/secrets/**",
+      "adapters/models/openai_compatible_local.go",
+      "adapters/models/openai_compatible_local_test.go",
+      "cmd/cognitive-worker/main.go",
+      "cmd/cognitive-worker/main_test.go",
+      "dev/ACTIVE_TASK.json",
+      "dev/tasks/DEV-000152-cognitive-provider-secret-reference.json"
+    ]
+  },
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/devctl/**", ".gitea/**", "deploy/**", "database/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["typed CredentialRef", "protected file-backed secret resolver"], "may_change": ["secret purpose and trusted runtime consumer enum values"]},
+  "semantic_owner": "capability",
+  "canonical_state": ["provider credential material remains external to repository and database"],
+  "state_transitions": ["cognitive-worker sends a bearer credential only when a trusted file-backed reference resolves successfully"],
+  "side_effects_and_privileges": ["none; adapter receives resolved material from runtime bootstrap and never persists it"],
+  "persistence_and_migrations": ["no database migration"],
+  "failure_retry_restart": ["direct secret environment configuration fails closed", "missing reference or unreadable file fails startup", "no configured key preserves existing unauthenticated development behavior"],
+  "assumptions": ["production operators provision the gateway key into the protected secret volume separately; this task does not copy or reveal it"],
+  "acceptance_scenarios": ["resolved key becomes Authorization Bearer header", "no key sends no Authorization header", "direct environment secret is rejected", "secret value is absent from logs and repository"],
+  "required_tests": ["unit", "go test", "go vet", "architecture preflight", "check-diff", "git diff --check", "independent", "exact diff scope", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT", "BLOCKED_BY_ARCHITECTURE_GAP"]
+}

dev/tasks/DEV-000153-fleet-secret-wiring.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000153",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "dbbc54171d9c8a9edaa93e5ff5870d3ec434d799",
+  "risk_tier": "E",
+  "intent": "Wire the production cognitive-worker to the existing protected secret volume for optional local CPU gateway authentication without placing credential material in compose environment values.",
+  "requirement_ids": ["AUDIT-WP-003", "AUDIT-WP-201", "CONSTITUTION-1.3.28"],
+  "allowed_change_scope": {"modules": ["cognitive"], "paths": ["deploy/docker-compose.prod.yml", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000153-fleet-secret-wiring.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/devctl/**", ".gitea/**", "database/**", "contracts/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["assistant_core_secrets read-only volume", "optional LOCAL_CPU_PROVIDER_API_KEY_FILE reference"], "may_change": []},
+  "semantic_owner": "capability",
+  "canonical_state": ["provider credential material remains outside repository and compose environment"],
+  "state_transitions": ["when operators provision the referenced file, cognitive-worker resolves it and authenticates the local CPU gateway; when absent, existing recovery behavior remains available"],
+  "side_effects_and_privileges": ["read-only mount only; no secret value is added to compose"],
+  "persistence_and_migrations": ["no database migration"],
+  "failure_retry_restart": ["empty optional file reference preserves current unauthenticated startup", "configured missing credential file fails closed at worker startup"],
+  "assumptions": ["the gateway credential is provisioned by production operators into assistant_core_secrets; this task does not copy or reveal it"],
+  "acceptance_scenarios": ["compose renders with empty optional key path", "cognitive-worker receives read-only /run/secrets mount", "no literal provider credential occurs in repository or compose", "CI and production deployment succeed"],
+  "required_tests": ["go test", "go vet", "docker compose config", "architecture preflight", "check-diff", "git diff --check", "independent", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT", "BLOCKED_BY_ARCHITECTURE_GAP"]
+}

dev/tasks/DEV-000154-fast-live-smoke-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000154",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "283f5c044c3bf6739c8ed859412cd736754e3177",
+  "risk_tier": "E",
+  "intent": "Record bounded production evidence that the authenticated local CPU provider is available and invokable through the cognitive boundary.",
+  "requirement_ids": ["AUDIT-WP-003", "AUDIT-WP-201", "WP-601"],
+  "allowed_change_scope": {"modules": ["capability", "cognitive"], "paths": ["docs/evidence/wp-601-fast-gateway-live-smoke-2026-08-22-v1.json", "docs/evidence/WP-601-FAST-GATEWAY-LIVE-SMOKE-2026-08-22.md", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000154-fast-live-smoke-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/devctl/**", ".gitea/**", "database/**", "deploy/**", "contracts/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["production cognitive discovery and bounded advisory response evidence"], "may_change": []},
+  "semantic_owner": "capability",
+  "canonical_state": ["none; append-only evidence artifact only"],
+  "state_transitions": ["none; evidence does not activate or promote a binding"],
+  "side_effects_and_privileges": ["four bounded local-only synthetic advisory requests"],
+  "persistence_and_migrations": ["no database migration"],
+  "failure_retry_restart": ["not applicable to evidence artifact"],
+  "assumptions": ["provider key remains in protected production volume and is not copied to repository or logs"],
+  "acceptance_scenarios": ["evidence records available API_KEY provider", "four requests complete with expected sentinels", "limitations remain explicit", "no secret material is present"],
+  "required_tests": ["JSON validation", "go test", "go vet", "architecture preflight", "check-diff", "git diff --check", "independent", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT", "BLOCKED_BY_ARCHITECTURE_GAP"]
+}

dev/tasks/DEV-000155-current-audit-status.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000155",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "5703ab3ed5e22a5424a2db7f19886c0305e54280",
+  "risk_tier": "E",
+  "intent": "Synchronize the project status projection with current live audit evidence, explicitly distinguishing completed runtime foundations from external blockers.",
+  "requirement_ids": ["AUDIT-TRUTHFUL-STATUS", "WP-003", "WP-301", "WP-800"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/PROJECT_STATUS.md", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000155-current-audit-status.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/devctl/**", ".gitea/**", "database/**", "deploy/**", "contracts/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["live audit observations and committed evidence artifacts"], "may_change": []},
+  "semantic_owner": "none; documentation projection",
+  "canonical_state": ["none"],
+  "state_transitions": ["none"],
+  "side_effects_and_privileges": ["none"],
+  "persistence_and_migrations": ["no database migration"],
+  "failure_retry_restart": ["not applicable"],
+  "assumptions": ["status projection remains subordinate to runtime evidence and does not declare blocked items complete"],
+  "acceptance_scenarios": ["current revision and FAST evidence are referenced", "Medium/Heavy and bridge gaps are explicit", "UI acceptance remains pending without session", "no secret value appears"],
+  "required_tests": ["JSON validation", "go test", "go vet", "architecture preflight", "check-diff", "git diff --check", "independent", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT", "BLOCKED_BY_ARCHITECTURE_GAP"]
+}

dev/tasks/DEV-000156-fleet-execution-status-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000156",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "03c3484ee1488ebc3b2349ab6ba5c8005c895110",
+  "risk_tier": "E",
+  "intent": "Capture fresh production evidence for model fleet readiness and Agent Execution capability without changing runtime behavior.",
+  "requirement_ids": ["WP-200", "WP-301", "AUDIT-TRUTHFUL-STATUS"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/evidence/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000156-fleet-execution-status-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/**", "modules/**", "contracts/**", "adapters/**", "database/**", "deploy/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["fleet readiness response", "agent-worker status response"], "may_change": []},
+  "semantic_owner": "none; evidence projection",
+  "canonical_state": [],
+  "state_transitions": ["evidence only; no activation, promotion or configuration change"],
+  "side_effects_and_privileges": ["bounded read-only production status probes"],
+  "persistence_and_migrations": ["immutable JSON evidence artifact only"],
+  "failure_retry_restart": ["probe failures are recorded as observed facts; no retry-dependent claim"],
+  "assumptions": ["all probes are internal read-only GET requests", "no secret values are collected"],
+  "acceptance_scenarios": ["FAST readiness auth mismatch is distinguished from successful bounded gateway smoke", "MEDIUM remains NOT_CONFIGURED", "HEAVY timeout is recorded", "LIFEBOAT is the selected fallback", "Agent Execution is recovery-only", "no secret value appears"],
+  "required_tests": ["JSON validation", "go test", "go vet", "preflight", "check-diff", "git diff --check", "independent", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000157-postgres-restore-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000157",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "077f16e50ca22e14dbf00214005f0fe98a1c8308",
+  "risk_tier": "E",
+  "intent": "Capture fresh production PostgreSQL backup checksum and isolated restore verification evidence without changing the production database.",
+  "requirement_ids": ["WP-002", "AUDIT-RECOVERY-TRUTH"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/evidence/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000157-postgres-restore-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/**", "modules/**", "contracts/**", "adapters/**", "database/**", "deploy/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["backup artifact format", "restore verification output"], "may_change": []},
+  "semantic_owner": "none; evidence projection",
+  "canonical_state": [],
+  "state_transitions": ["evidence only; no production database mutation"],
+  "side_effects_and_privileges": ["isolated temporary restore container created and removed by the existing verifier"],
+  "persistence_and_migrations": ["immutable JSON evidence artifact only"],
+  "failure_retry_restart": ["checksum or restore failure is recorded as failure; no blind retry claim"],
+  "assumptions": ["the standard verifier uses tmpfs and cleans up its temporary container", "backup contents and credentials are not copied into repository evidence"],
+  "acceptance_scenarios": ["latest backup directory is selected", "checksums pass", "isolated restore reports expected schema/table counts", "production database remains untouched"],
+  "required_tests": ["JSON validation", "go test", "go vet", "preflight", "check-diff", "git diff --check", "independent", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000158-status-evidence-consolidation.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000158",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "3a52c18bef7e29a0369ad1edf05adeed1be5935e",
+  "risk_tier": "E",
+  "intent": "Synchronize the project status projection with the latest production revision and committed fleet/recovery evidence.",
+  "requirement_ids": ["AUDIT-TRUTHFUL-STATUS", "WP-002", "WP-200", "WP-301"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/PROJECT_STATUS.md", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000158-status-evidence-consolidation.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/**", "modules/**", "contracts/**", "adapters/**", "database/**", "deploy/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["production revision", "committed fleet evidence", "committed restore evidence"], "may_change": []},
+  "semantic_owner": "none; documentation projection",
+  "canonical_state": [],
+  "state_transitions": ["evidence projection only"],
+  "side_effects_and_privileges": ["none"],
+  "persistence_and_migrations": ["no database migration"],
+  "failure_retry_restart": ["not applicable"],
+  "assumptions": ["status remains subordinate to live evidence and does not declare unavailable capabilities complete"],
+  "acceptance_scenarios": ["latest production revision is shown", "fleet and restore evidence are linked", "remaining gaps remain explicit", "no secret value appears"],
+  "required_tests": ["JSON validation", "go test", "go vet", "preflight", "check-diff", "git diff --check", "independent", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000159-agent-bridge-config-wiring.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000159",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "e1186757bfcf9a349ce0ced603f4a4ebdad636fe",
+  "risk_tier": "E",
+  "intent": "Expose the already-supported optional Agent Execution bridge URL to the production agent-worker without enabling it when unset.",
+  "requirement_ids": ["WP-301", "Agent Execution runtime and recovery"],
+  "allowed_change_scope": {"modules": ["deployment", "work-agent-execution"], "paths": ["deploy/docker-compose.prod.yml", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000159-agent-bridge-config-wiring.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "contracts/**", "cmd/**", "modules/**", "adapters/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["AGENT_EXECUTION_BRIDGE_URL deployment variable", "agent-worker optional bridge behavior"], "may_change": []},
+  "semantic_owner": "deployment projection; work-agent-execution remains owner",
+  "canonical_state": ["none"],
+  "state_transitions": ["unset URL -> recovery-only; configured URL -> existing typed HTTP executor path"],
+  "side_effects_and_privileges": ["deployment privileged-surface review is declared; no effective new privilege; no credential forwarding; no outbound call when variable is empty"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["existing worker fail-closed and stale recovery behavior remains unchanged"],
+  "assumptions": ["an independently operated bridge is still required before enabling the variable in production", "empty default preserves current recovery-only behavior"],
+  "acceptance_scenarios": ["production compose renders with empty bridge URL", "agent-worker remains recovery-only when unset", "configured URL is available to the process without source secret", "no bridge runtime is fabricated"],
+  "required_tests": ["JSON validation", "docker compose config", "go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000160-status-after-bridge-wiring.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000160",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "ada2da0c6c93d630f7699bd05abd32031c11544c",
+  "risk_tier": "E",
+  "intent": "Synchronize project status with the latest bridge wiring deployment and preserve the explicit external capability gap.",
+  "requirement_ids": ["AUDIT-TRUTHFUL-STATUS", "WP-301"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/PROJECT_STATUS.md", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000160-status-after-bridge-wiring.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/**", "modules/**", "contracts/**", "adapters/**", "database/**", "deploy/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["production revision", "optional bridge configuration state"], "may_change": []},
+  "semantic_owner": "none; documentation projection",
+  "canonical_state": [],
+  "state_transitions": ["evidence projection only"],
+  "side_effects_and_privileges": ["none"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["not applicable"],
+  "assumptions": ["unset bridge URL remains truthful recovery-only state"],
+  "acceptance_scenarios": ["current production revision is shown", "bridge wiring and missing runtime are distinguished", "no secret value appears"],
+  "required_tests": ["JSON validation", "go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000161-completion-audit-matrix.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000161",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "3cf44ada8afd75fb008cf8d5965caf9c3f5b0462",
+  "risk_tier": "E",
+  "intent": "Publish a requirement-by-requirement completion matrix for the audit objective, distinguishing repository proof, production proof and external gaps.",
+  "requirement_ids": ["AUDIT-COMPLETION-TRUTH", "WP-301", "WP-601", "WP-800"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/evidence/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000161-completion-audit-matrix.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/**", "modules/**", "contracts/**", "adapters/**", "database/**", "deploy/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["audit roadmap", "committed task packets", "production evidence artifacts"], "may_change": []},
+  "semantic_owner": "none; audit evidence projection",
+  "canonical_state": [],
+  "state_transitions": ["evidence projection only"],
+  "side_effects_and_privileges": ["none"],
+  "persistence_and_migrations": ["immutable JSON evidence artifact only"],
+  "failure_retry_restart": ["not applicable"],
+  "assumptions": ["unknown or externally blocked requirements are not marked complete", "matrix claims are limited to cited evidence scope"],
+  "acceptance_scenarios": ["all seven objective areas have a status", "production and repository proof are distinguished", "remaining external gaps are explicit", "no secret value appears"],
+  "required_tests": ["JSON validation", "go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000162-status-after-completion-matrix.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000162",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "bda71caecece67e5ef225ac250a7a80c4bc84d94",
+  "risk_tier": "E",
+  "intent": "Refresh current production revision in project status and completion evidence after the audit matrix deployment.",
+  "requirement_ids": ["AUDIT-TRUTHFUL-STATUS"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/PROJECT_STATUS.md", "docs/evidence/audit-completion-matrix-2026-08-22-v1.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000162-status-after-completion-matrix.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/**", "modules/**", "contracts/**", "adapters/**", "database/**", "deploy/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["current production revision", "completion matrix evidence"], "may_change": []},
+  "semantic_owner": "none; documentation projection",
+  "canonical_state": [],
+  "state_transitions": ["evidence projection only"],
+  "side_effects_and_privileges": ["none"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["not applicable"],
+  "assumptions": ["matrix remains NOT_COMPLETE until external gaps are actually verified"],
+  "acceptance_scenarios": ["status and matrix point to bda71ca", "no completion claim is widened", "no secret value appears"],
+  "required_tests": ["JSON validation", "go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000163-operations-ui-contract-refresh.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000163",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "c25a6346d0615f66ddb411450fcc7a36c62d2b48",
+  "risk_tier": "E",
+  "intent": "Extend authenticated cabinet contract tests to cover truthful model-fleet and Agent Execution status surfaces already implemented in Creator Web.",
+  "requirement_ids": ["WP-801", "WP-802", "WP-805", "Authenticated cabinet acceptance"],
+  "allowed_change_scope": {"modules": ["creator-web"], "paths": ["tests/creator_web/cabinet_acceptance_contract_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000163-operations-ui-contract-refresh.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "deploy/**", "database/**", "cmd/**", "contracts/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing authenticated Creator Web status routes and static cabinet"], "may_change": ["acceptance tests only"]},
+  "semantic_owner": "creator-web",
+  "canonical_state": ["none; tests inspect existing UI contract"],
+  "state_transitions": ["authenticated session gates truthful status requests"],
+  "side_effects_and_privileges": ["no external mutation; no credentials embedded"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["missing status surface fails CI"],
+  "assumptions": ["live authenticated browser visual acceptance remains a separate production verification"],
+  "acceptance_scenarios": ["fleet and executor status controls exist", "server exposes authenticated routes", "console renders actual selected tier and worker mode", "responsive/reduced-motion tests remain active"],
+  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_AUTHENTICATED_BROWSER_SESSION", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000164-authorized-fleet-readiness.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000164",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "65a60d5f068e3d8f70733c4ee96bfbb9d9943d5e",
+  "risk_tier": "E",
+  "intent": "Make live model-fleet readiness use the existing file-backed CPU provider API key so FAST status reflects the authenticated provider path.",
+  "requirement_ids": ["WP-601", "Model fleet/failover"],
+  "allowed_change_scope": {"modules": ["cognitive-worker", "capability"], "paths": ["cmd/cognitive-worker/main.go", "cmd/cognitive-worker/fleet_status.go", "cmd/cognitive-worker/fleet_status_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000164-authorized-fleet-readiness.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "adapters/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing provider API key resolver", "fleet readiness response"], "may_change": ["fleet readiness probe request headers"]},
+  "semantic_owner": "capability/cognitive-worker",
+  "canonical_state": [],
+  "state_transitions": ["authenticated provider probe -> truthful FAST readiness"],
+  "side_effects_and_privileges": ["uses existing in-memory resolved key only for the internal provider probe; no key logging or persistence"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["401 remains a typed unavailable result when key is absent or rejected; GPU/Medium behavior unchanged"],
+  "assumptions": ["OpenAI-compatible local provider uses Bearer authentication as the existing model adapter does"],
+  "acceptance_scenarios": ["fleet readiness sends Bearer header when CPU key is configured", "FAST is ready when authenticated /models succeeds", "no Authorization header is sent without a key", "Lifeboat fallback remains unchanged"],
+  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production fleet readiness"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000165-authorized-cpu-health-probe.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000165",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "5d5afc88883c7f79e3b051c790642e41386666ec",
+  "risk_tier": "E",
+  "intent": "Use the existing file-backed CPU provider API key in cognitive-worker readiness probes so /readyz and fleet readiness report consistent provider state.",
+  "requirement_ids": ["WP-601", "Model fleet/failover"],
+  "allowed_change_scope": {"modules": ["cognitive-worker", "platform-health"], "paths": ["runtime/health/server.go", "runtime/health/server_test.go", "cmd/cognitive-worker/main.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000165-authorized-cpu-health-probe.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "adapters/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing health Probe contract", "existing provider API key resolver"], "may_change": ["health probe header support"]},
+  "semantic_owner": "cognitive-worker/platform health",
+  "canonical_state": [],
+  "state_transitions": ["authenticated CPU probe -> consistent readiness evidence"],
+  "side_effects_and_privileges": ["resolved key is used only in outbound probe header; never logged or persisted"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["provider timeout or rejected key remains degraded; no fallback behavior changed"],
+  "assumptions": ["the local provider uses Bearer authentication"],
+  "acceptance_scenarios": ["health probe sends configured header", "cognitive /readyz uses authenticated CPU probe", "GPU remains optional", "no key is sent when absent"],
+  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production /readyz and fleet readiness"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000166-per-provider-readiness-timeouts.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000166",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "4086b7522460a78afc341d996ca7874505018871",
+  "risk_tier": "E",
+  "intent": "Give the authenticated CPU readiness probe the provider adapter timeout while retaining short opportunistic GPU probing.",
+  "requirement_ids": ["WP-601", "Model fleet/failover"],
+  "allowed_change_scope": {"modules": ["cognitive-worker", "platform-health"], "paths": ["runtime/health/server.go", "runtime/health/server_test.go", "cmd/cognitive-worker/main.go", "cmd/cognitive-worker/fleet_status.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000166-per-provider-readiness-timeouts.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "adapters/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing health Probe contract", "existing fleet readiness probe"], "may_change": ["per-probe timeout metadata"]},
+  "semantic_owner": "cognitive-worker/platform health",
+  "canonical_state": [],
+  "state_transitions": ["provider-specific probe deadline -> truthful readiness result"],
+  "side_effects_and_privileges": ["no new privilege; existing provider auth only"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["CPU gets bounded 10-second probe; GPU retains 2-second opportunistic timeout"],
+  "assumptions": ["CPU provider catalog may take longer than opportunistic probes while remaining within adapter bounds"],
+  "acceptance_scenarios": ["per-probe health timeout is honored", "CPU fleet client uses 10 seconds", "GPU remains bounded", "Lifeboat fallback remains unchanged"],
+  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production /readyz and fleet readiness"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000167-cpu-readiness-client-timeout.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000167",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "c7b57daaf8233b0f0e79c77c02e92040378921d5",
+  "risk_tier": "E",
+  "intent": "Use the bounded CPU provider HTTP client for the authenticated readiness probe so /readyz reports the same truthful result as fleet readiness.",
+  "requirement_ids": ["WP-601", "Model fleet/failover"],
+  "allowed_change_scope": {"modules": ["cognitive-worker"], "paths": ["cmd/cognitive-worker/main.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000167-cpu-readiness-client-timeout.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "adapters/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing readiness Probe contract", "existing authenticated CPU fleet endpoint"], "may_change": []},
+  "semantic_owner": "cognitive-worker",
+  "canonical_state": [],
+  "state_transitions": ["CPU provider response -> consistent /readyz and fleet readiness state"],
+  "side_effects_and_privileges": ["no new privilege; existing provider auth only"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["CPU readiness remains bounded at 10 seconds; opportunistic GPU remains 2 seconds"],
+  "assumptions": ["The CPU provider is authenticated with the existing file-backed API key"],
+  "acceptance_scenarios": ["/readyz can report CPU AVAILABLE when fleet readiness reports CPU AVAILABLE", "GPU remains bounded", "Lifeboat fallback remains unchanged"],
+  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI", "production /readyz and fleet readiness"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000168-configurable-medium-fleet-slot.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000168",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "205d8f620603ccf3e0138f6beb93156450664314",
+  "risk_tier": "E",
+  "intent": "Make the MEDIUM model-fleet slot a real optional OpenAI-compatible provider path with protected file credentials, discovery, readiness and gateway registration.",
+  "requirement_ids": ["WP-200", "WP-301", "Model fleet/failover"],
+  "allowed_change_scope": {"modules": ["cognitive-worker", "deployment-policy", "tests"], "paths": ["cmd/cognitive-worker/main.go", "cmd/cognitive-worker/main_test.go", "deploy/docker-compose.prod.yml", "tests/cognitive_advisory/cognitive_worker_env_policy.ps1", "tests/cognitive_advisory/cognitive_worker_env_policy_test.ps1", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000168-configurable-medium-fleet-slot.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "contracts/**", "adapters/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing provider adapter contract", "existing discovery registration", "existing fleet readiness contract", "existing CredentialRef file contract"], "may_change": []},
+  "semantic_owner": "cognitive-worker/capability registration boundary",
+  "canonical_state": [],
+  "state_transitions": ["MEDIUM endpoint absent -> NOT_CONFIGURED", "MEDIUM endpoint configured -> discovery/readiness registration", "available provider -> eligible gateway binding subject to core registry policy"],
+  "side_effects_and_privileges": ["declares one new deployment configuration surface for an existing read-only secret volume; provider key is resolved only through the existing protected file CredentialRef"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["medium probe has a bounded 10-second client timeout; absent endpoint remains NOT_CONFIGURED; fallback selection remains Lifeboat when preferred tiers are unavailable"],
+  "assumptions": ["A real medium OpenAI-compatible runtime may be supplied later through deployment environment injection", "No production medium runtime is claimed by this change"],
+  "acceptance_scenarios": ["empty medium URL produces NOT_CONFIGURED without startup failure", "configured medium URL is registered for discovery and fleet readiness", "direct medium secret environment is rejected", "medium CredentialRef file is accepted", "CPU/GPU/Lifeboat behavior remains unchanged"],
+  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "environment policy tests", "CI", "production fleet readiness"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

docs/PROJECT_STATUS.md

@@ -1,6 +1,18 @@
 # Assistant project status
 
-Audit date: 2026-08-22. Active implementation: DEV-000099 revision 1.
+## Current audit delta — 2026-08-22
+
+- `CURRENT_PRODUCTION_REVISION = bda71caecece67e5ef225ac250a7a80c4bc84d94`; public `/healthz` is healthy.
+- `FAST_PROVIDER_STATUS = LIVE_SMOKE_SUPPORTED`: local CPU gateway authentication is configured through a protected file reference; four bounded local-only advisory cases completed through cognitive-worker. Evidence: `docs/evidence/wp-601-fast-gateway-live-smoke-2026-08-22-v1.json`.
+- `MEDIUM_PROVIDER_STATUS = NOT_CONFIGURED`; no medium runtime is registered in production.
+- `HEAVY_PROVIDER_STATUS = UNAVAILABLE`; GPU endpoint `192.168.220.91:11434` timed out during live discovery.
+- `AGENT_EXECUTION_STATUS = RECOVERY_ONLY`; optional `AGENT_EXECUTION_BRIDGE_URL` is wired into production compose but remains unset, and no Codex/bridge runtime is deployed. Durable recovery and status endpoints remain active.
+- `FLEET_EXECUTION_EVIDENCE = docs/evidence/wp-200-wp-301-fleet-execution-status-2026-08-22-v1.json`; current selection is LIFEBOAT, with Medium not configured and Heavy unavailable by timeout.
+- `BACKUP_RESTORE_EVIDENCE = docs/evidence/wp-002-postgres-restore-2026-08-22-v1.json`; latest backup checksum and isolated restore verified with 11 schemas and 60 tables.
+- `UI_AUTHENTICATED_ACCEPTANCE = PENDING`; public login UI is reachable, but no authenticated browser session was available for cabinet visual acceptance.
+- `SECURITY_NOTE = one production executor secret was rotated after an accidental diagnostic disclosure; values are not retained in repository evidence.`
+
+Audit date: 2026-08-22. Historical governance checkpoint: DEV-000099 revision 1.
 
 ## Current governance checkpoint
 

docs/evidence/WP-601-FAST-GATEWAY-LIVE-SMOKE-2026-08-22.md

@@ -0,0 +1,14 @@
+# WP-601 FAST gateway live smoke
+
+Observed `2026-08-22T14:41:47Z` on production revision `283f5c044c3bf6739c8ed859412cd736754e3177`.
+
+The protected provider reference was enabled in production without retaining
+credential material in the repository or evidence. Cognitive discovery reported
+`local-cpu-primary` as `AVAILABLE` with `AuthMode=API_KEY` and observed models
+`Qwen3.6-27B-UD-Q4_K_XL` and `dspark-DeepSeek-V4-Flash-0731-Q8_0`.
+
+Four bounded local-only advisory requests crossed the cognitive boundary and
+completed with the expected sentinel response: 4/4, zero failures. This proves
+availability and invocation of FAST; it does not promote a binding or claim that
+MEDIUM/HEAVY are available. Existing Lifeboat qualification remains the fallback
+evidence.

docs/evidence/audit-completion-matrix-2026-08-22-v1.json

@@ -0,0 +1,18 @@
+{
+  "evidence_id": "audit-completion-matrix-2026-08-22-v1",
+  "captured_at": "2026-08-22",
+  "production_revision": "bda71caecece67e5ef225ac250a7a80c4bc84d94",
+  "objective": "Dovести оставшиеся пункты аудита Domovoy до проверяемого состояния",
+  "matrix": [
+    {"area":"Agent Execution runtime and recovery","status":"PARTIAL_EXTERNAL_GAP","repository_proof":["dev/tasks/DEV-000145-agent-execution-bridge-runtime.json","adapters/agentbridge/http.go","cmd/agent-worker/main.go"],"production_proof":["docs/evidence/wp-200-wp-301-fleet-execution-status-2026-08-22-v1.json"],"missing":"independently operated bridge endpoint is not configured; live worker is recovery-only"},
+    {"area":"Multi-Agent Work Graph","status":"REPOSITORY_AND_RUNTIME_FOUNDATION_VERIFIED","repository_proof":["dev/tasks/DEV-000131-work-graph-harness.json","dev/tasks/DEV-000146-work-graph-runtime.json","tests/agent_execution/graph_runtime_test.go"],"production_proof":["docs/PROJECT_STATUS.md"],"missing":"no claim of external agent execution fan-out is made while bridge is absent"},
+    {"area":"Truth/Research runtime","status":"REPOSITORY_AND_RUNTIME_FOUNDATION_VERIFIED","repository_proof":["dev/tasks/DEV-000134-truth-bundle-compiler.json","dev/tasks/DEV-000143-research-runtime-orchestration.json","tests/research_runtime"],"production_proof":["docs/PROJECT_STATUS.md"],"missing":"authenticated end-to-end research acceptance is not claimed here"},
+    {"area":"Learning reflection loop","status":"REPOSITORY_AND_RUNTIME_FOUNDATION_VERIFIED","repository_proof":["dev/tasks/DEV-000135-reflection-worker.json","cmd/reflection-worker/main.go","tests/research_contracts/reflection_worker_sql_test.go"],"production_proof":["docs/PROJECT_STATUS.md"],"missing":"no claim of fully closed historical candidate backlog"},
+    {"area":"Model fleet/failover","status":"PARTIAL_EXTERNAL_GAP","repository_proof":["dev/tasks/DEV-000144-fleet-readiness-runtime.json","cmd/cognitive-worker/fleet_status.go"],"production_proof":["docs/evidence/wp-200-wp-301-fleet-execution-status-2026-08-22-v1.json"],"missing":"Medium is not configured; Heavy GPU probe times out; Lifeboat is selected fallback"},
+    {"area":"Governed self-development","status":"REPOSITORY_FOUNDATION_VERIFIED","repository_proof":["dev/tasks/DEV-000137-governed-self-development-gate.json","tests/semantic_evolution"],"production_proof":["docs/PROJECT_STATUS.md"],"missing":"real bridge-backed self-development execution is not claimed"},
+    {"area":"UI/operations acceptance","status":"PARTIAL_EXTERNAL_GAP","repository_proof":["dev/tasks/DEV-000138-ui-operations-acceptance-contract.json","tests/creator_web/cabinet_acceptance_contract_test.go","dev/tasks/DEV-000150-agent-operations-ui.json","dev/tasks/DEV-000151-agent-worker-status-ui.json"],"production_proof":["docs/PROJECT_STATUS.md"],"missing":"authenticated browser visual acceptance is pending because no signed-in session is available"}
+  ],
+  "overall_status":"NOT_COMPLETE",
+  "completion_rule":"The objective is not complete until every PARTIAL_EXTERNAL_GAP has live evidence for its missing capability and authenticated UI acceptance is recorded.",
+  "secrets":"No secret values included."
+}

docs/evidence/wp-002-postgres-restore-2026-08-22-v1.json

@@ -0,0 +1,16 @@
+{
+  "evidence_id": "wp-002-postgres-restore-2026-08-22-v1",
+  "captured_at": "2026-08-22",
+  "production_host": "docker.cin.su",
+  "source": "standard read-only backup verifier",
+  "selected_backup": "20260822T001501Z",
+  "checksum": "OK",
+  "restore": {
+    "database": "assistant",
+    "schemas": 11,
+    "tables": 60,
+    "result": "verified"
+  },
+  "safety": "restore was performed in an isolated temporary PostgreSQL container and cleaned up by the verifier; production database was not restored over or modified",
+  "limitations": ["this evidence verifies the latest available backup artifact and isolated restore, not a full disaster-recovery cutover" ]
+}

docs/evidence/wp-200-wp-301-fleet-execution-status-2026-08-22-v1.json

@@ -0,0 +1,30 @@
+{
+  "evidence_id": "wp-200-wp-301-fleet-execution-status-2026-08-22-v1",
+  "captured_at": "2026-08-22",
+  "production_revision": "03c3484ee1488ebc3b2349ab6ba5c8005c895110",
+  "source": "read-only internal status probes on docker.cin.su",
+  "fleet_readiness": {
+    "preferred_tier": "HEAVY",
+    "selected_tier": "LIFEBOAT",
+    "ready_tiers": ["LIFEBOAT"],
+    "members": [
+      {"provider_instance_id": "local-cpu-primary", "tier": "FAST", "ready": false, "reason": "status=401 UNAUTHORIZED"},
+      {"provider_instance_id": "local-medium-unconfigured", "tier": "MEDIUM", "ready": false, "reason": "NOT_CONFIGURED"},
+      {"provider_instance_id": "local-gpu-opportunistic", "tier": "HEAVY", "ready": false, "reason": "context deadline exceeded while awaiting headers"},
+      {"provider_instance_id": "cognitive-lifeboat", "tier": "LIFEBOAT", "ready": true, "reason": "AVAILABLE"}
+    ]
+  },
+  "agent_execution": {
+    "runtime": "agent-worker",
+    "executor_configured": false,
+    "mode": "recovery-only",
+    "ready": false,
+    "reason": "AGENT_EXECUTION_BRIDGE_URL is not configured"
+  },
+  "interpretation": [
+    "Fleet readiness currently selects the local Lifeboat fallback.",
+    "The FAST provider has a live bounded gateway smoke recorded separately; the fleet readiness probe itself receives 401 from the model catalog endpoint.",
+    "No Medium runtime or Heavy GPU runtime is ready, and no Agent Execution bridge is deployed.",
+    "This artifact records evidence only and does not activate or promote any binding."
+  ]
+}

docs/evidence/wp-601-fast-gateway-live-smoke-2026-08-22-v1.json

@@ -0,0 +1,31 @@
+{
+  "artifact_id": "wp-601-fast-gateway-live-smoke-2026-08-22-v1",
+  "observed_at": "2026-08-22T14:41:47.1155793Z",
+  "production_revision": "283f5c044c3bf6739c8ed859412cd736754e3177",
+  "endpoint": "assistant.cin.su",
+  "runtime_path": "creator-web -> cognitive-worker -> local-cpu-primary -> llm-local-gateway",
+  "credential_material": "not retained; protected file reference only",
+  "provider": {
+    "provider_instance_id": "local-cpu-primary",
+    "provider_kind": "openai-compatible-chat-v1",
+    "health": "AVAILABLE",
+    "auth_mode": "API_KEY",
+    "credential_ref": "credential://domovoy/local-cpu/provider-api-key/v1",
+    "models_observed": [
+      "Qwen3.6-27B-UD-Q4_K_XL",
+      "dspark-DeepSeek-V4-Flash-0731-Q8_0"
+    ]
+  },
+  "cases": [
+    {"request_id": "live-fast-smoke-20260822", "expected": "FAST_OK", "actual": "FAST_OK", "finish_reason": "COMPLETED", "input_units": 36, "output_units": 3},
+    {"request_id": "live-fast-case-1-20260822", "expected": "CASE_OK_1", "actual": "CASE_OK_1", "finish_reason": "COMPLETED", "input_units": 38, "output_units": 5},
+    {"request_id": "live-fast-case-2-20260822", "expected": "CASE_OK_2", "actual": "CASE_OK_2", "finish_reason": "COMPLETED", "input_units": 38, "output_units": 5},
+    {"request_id": "live-fast-case-3-20260822", "expected": "CASE_OK_3", "actual": "CASE_OK_3", "finish_reason": "COMPLETED", "input_units": 38, "output_units": 5}
+  ],
+  "summary": {"cases": 4, "completed": 4, "failed": 0, "qualification": "LIVE_SMOKE_SUPPORTED"},
+  "limitations": [
+    "This is availability and bounded invocation evidence, not a binding promotion.",
+    "Medium and heavy fleet members remain unconfigured/unavailable.",
+    "Fallback qualification remains covered by the existing Lifeboat evidence."
+  ]
+}

runtime/health/server.go

@@ -29,6 +29,7 @@ type Probe struct {
 	Name     string
 	Check    func(context.Context) error
 	Optional bool
+	Timeout  time.Duration
 }
 
 type Result struct {
@@ -56,7 +57,11 @@ func (h ReadinessHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		if probe.Check == nil {
 			result.State, result.Reason, result.Detail = "DEGRADED", "PROBE_NOT_CONFIGURED", "probe is not configured"
 		} else {
-			ctx, cancel := context.WithTimeout(r.Context(), timeout)
+			probeTimeout := timeout
+			if probe.Timeout > 0 {
+				probeTimeout = probe.Timeout
+			}
+			ctx, cancel := context.WithTimeout(r.Context(), probeTimeout)
 			err := probe.Check(ctx)
 			cancel()
 			if err != nil {
@@ -82,11 +87,18 @@ func (h ReadinessHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 }
 
 func HTTPProbe(client *http.Client, endpoint string) Probe {
+	return HTTPProbeWithHeaders(client, endpoint, nil)
+}
+
+func HTTPProbeWithHeaders(client *http.Client, endpoint string, headers map[string]string) Probe {
 	return Probe{Name: endpoint, Check: func(ctx context.Context) error {
 		req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
 		if err != nil {
 			return err
 		}
+		for name, value := range headers {
+			req.Header.Set(name, value)
+		}
 		response, err := client.Do(req)
 		if err != nil {
 			return err
@@ -108,6 +120,12 @@ func OptionalHTTPProbe(client *http.Client, endpoint string) Probe {
 	return probe
 }
 
+func OptionalHTTPProbeWithHeaders(client *http.Client, endpoint string, headers map[string]string) Probe {
+	probe := HTTPProbeWithHeaders(client, endpoint, headers)
+	probe.Optional = true
+	return probe
+}
+
 func TCPProbe(name, host, port string) Probe {
 	return Probe{Name: name, Check: func(ctx context.Context) error {
 		connection, err := (&net.Dialer{}).DialContext(ctx, "tcp", net.JoinHostPort(host, port))

runtime/health/server_test.go

@@ -7,6 +7,7 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 )
 
 func TestReadinessReturns503WithTypedDependencyReason(t *testing.T) {
@@ -27,6 +28,31 @@ func TestReadinessReturns200WhenAllProbesPass(t *testing.T) {
 	}
 }
 
+func TestHTTPProbeWithHeadersSendsHeaders(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Authorization") != "Bearer health-key" {
+			t.Fatalf("authorization=%q", r.Header.Get("Authorization"))
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+	probe := HTTPProbeWithHeaders(server.Client(), server.URL, map[string]string{"Authorization": "Bearer health-key"})
+	if err := probe.Check(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestReadinessUsesPerProbeTimeout(t *testing.T) {
+	handler := ReadinessHandler{Runtime: "test", Timeout: time.Millisecond, Probes: []Probe{{
+		Name: "slow-but-required", Timeout: time.Second, Check: func(context.Context) error { return nil },
+	}}}
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/readyz", nil))
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("readiness response = %d %s", recorder.Code, recorder.Body.String())
+	}
+}
+
 func TestReadinessStaysAvailableWithOptionalDependencyDegraded(t *testing.T) {
 	handler := ReadinessHandler{Runtime: "test", Probes: []Probe{
 		{Name: "lifeboat", Check: func(context.Context) error { return nil }},

tests/cognitive_advisory/cognitive_worker_env_policy.ps1

@@ -3,6 +3,11 @@ Set-StrictMode -Version Latest
 $script:AllowedCognitiveWorkerEnvironment = @{
     'CORE_RUNTIME_URL' = 'http_url'
     'LOCAL_CPU_PROVIDER_URL' = 'http_url'
+    'LOCAL_CPU_PROVIDER_API_KEY_FILE' = 'secret_file'
+    'LOCAL_CPU_PROVIDER_CREDENTIAL_REF' = 'nonempty'
+    'LOCAL_MEDIUM_PROVIDER_URL' = 'http_url'
+    'LOCAL_MEDIUM_PROVIDER_API_KEY_FILE' = 'secret_file'
+    'LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF' = 'nonempty'
     'LOCAL_GPU_PROVIDER_URL' = 'http_url'
     'LOCAL_OLLAMA_PROVIDER_URL' = 'http_url'
     'COGNITIVE_OWNER_PRINCIPAL_ID' = 'nonempty'

tests/cognitive_advisory/cognitive_worker_env_policy_test.ps1

@@ -15,6 +15,8 @@ function Assert-PolicyFail([string]$Name, [string[]]$Environment) {
 }
 
 Assert-PolicyPass 'CPU provider endpoint' @('LOCAL_CPU_PROVIDER_URL=http://docker.cin.su:18082/v1')
+Assert-PolicyPass 'optional medium provider endpoint' @('LOCAL_MEDIUM_PROVIDER_URL=http://medium.example/v1')
+Assert-PolicyPass 'approved medium CredentialRef file' @('LOCAL_MEDIUM_PROVIDER_API_KEY_FILE=/run/secrets/medium_api_key', 'LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF=credential://domovoy/local-medium/provider-api-key/v1')
 Assert-PolicyPass 'Ollama provider endpoint' @('LOCAL_OLLAMA_PROVIDER_URL=http://192.168.220.91:11434')
 Assert-PolicyFail 'plaintext OpenAI API key' @('OPENAI_API_KEY=secret')
 Assert-PolicyFail 'plaintext provider token' @('PROVIDER_TOKEN=secret')

tests/creator_web/cabinet_acceptance_contract_test.go

@@ -52,3 +52,41 @@ func TestCreatorCabinetResponsiveAndReducedMotionRulesExist(t *testing.T) {
 		}
 	}
 }
+
+func TestCreatorCabinetExposesFleetAndExecutorTruthfulStatusSurfaces(t *testing.T) {
+	markupBytes, err := os.ReadFile("../../cmd/creator-web/static/index.html")
+	if err != nil {
+		t.Fatal(err)
+	}
+	markup := string(markupBytes)
+	for _, marker := range []string{
+		`id="fleet-summary"`, `id="fleet-selected"`, `id="fleet-list"`,
+		`id="agent-worker-state"`, `id="agent-worker-message"`,
+	} {
+		if !strings.Contains(markup, marker) {
+			t.Fatalf("operations cabinet missing truthful status surface %q", marker)
+		}
+	}
+
+	serverBytes, err := os.ReadFile("../../cmd/creator-web/server.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	server := string(serverBytes)
+	for _, marker := range []string{`r.URL.Path == "/api/fleet/readiness"`, `r.URL.Path == "/api/agent-worker/status"`} {
+		if !strings.Contains(server, marker) {
+			t.Fatalf("creator server missing authenticated status route %q", marker)
+		}
+	}
+
+	consoleBytes, err := os.ReadFile("../../cmd/creator-web/static/assets/console.js")
+	if err != nil {
+		t.Fatal(err)
+	}
+	console := string(consoleBytes)
+	for _, marker := range []string{`request("/api/fleet/readiness")`, `request("/api/agent-worker/status")`, `result.selected_tier || "не выбран"`, `status.mode || "UNKNOWN"`} {
+		if !strings.Contains(console, marker) {
+			t.Fatalf("console missing truthful status rendering %q", marker)
+		}
+	}
+}