test: cover operations status surfaces

adapters/models/openai_compatible_local.go

@@ -22,9 +22,16 @@ import (
 type OpenAICompatibleLocalAdapter struct {
 	base   *url.URL
 	client *http.Client
+	apiKey string
 }
 
 func NewOpenAICompatibleLocalAdapter(raw string, transport http.RoundTripper) (*OpenAICompatibleLocalAdapter, error) {
+	return NewOpenAICompatibleLocalAdapterWithAPIKey(raw, "", transport)
+}
+
+// NewOpenAICompatibleLocalAdapterWithAPIKey creates an adapter for a gateway
+// whose bearer credential was resolved by the trusted runtime boundary.
+func NewOpenAICompatibleLocalAdapterWithAPIKey(raw, apiKey string, transport http.RoundTripper) (*OpenAICompatibleLocalAdapter, error) {
 	base, err := url.Parse(raw)
 	if err != nil || base.Scheme != "http" || base.Host == "" || strings.TrimSuffix(base.Path, "/") != "/v1" || base.RawQuery != "" || base.Fragment != "" || base.User != nil {
 		return nil, errors.New("invalid local compatible endpoint")
@@ -32,7 +39,7 @@ func NewOpenAICompatibleLocalAdapter(raw string, transport http.RoundTripper) (*
 	if transport == nil {
 		transport = http.DefaultTransport
 	}
-	return &OpenAICompatibleLocalAdapter{base: base, client: &http.Client{Transport: transport, Timeout: 10 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}}, nil
+	return &OpenAICompatibleLocalAdapter{base: base, client: &http.Client{Transport: transport, Timeout: 10 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}, apiKey: strings.TrimSpace(apiKey)}, nil
 }
 
 type compatibleModelsResponse struct {
@@ -145,6 +152,9 @@ func (a *OpenAICompatibleLocalAdapter) requestJSON(ctx context.Context, method,
 		return 0, err
 	}
 	request.Header.Set("Accept", "application/json")
+	if a.apiKey != "" {
+		request.Header.Set("Authorization", "Bearer "+a.apiKey)
+	}
 	if input != nil {
 		request.Header.Set("Content-Type", "application/json")
 	}

adapters/models/openai_compatible_local_test.go

@@ -0,0 +1,42 @@
+package models
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+type captureRoundTripper struct {
+	authorization string
+}
+
+func (t *captureRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) {
+	t.authorization = request.Header.Get("Authorization")
+	return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader(`{"data":[]}`)), Header: make(http.Header), Request: request}, nil
+}
+
+func TestOpenAICompatibleLocalAdapterUsesResolvedAPIKey(t *testing.T) {
+	transport := &captureRoundTripper{}
+	adapter, err := NewOpenAICompatibleLocalAdapterWithAPIKey("http://gateway/v1", "resolved-key", transport)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, _ = adapter.Discover(context.Background())
+	if transport.authorization != "Bearer resolved-key" {
+		t.Fatalf("unexpected authorization header: %q", transport.authorization)
+	}
+}
+
+func TestOpenAICompatibleLocalAdapterDoesNotSendAuthorizationWithoutKey(t *testing.T) {
+	transport := &captureRoundTripper{}
+	adapter, err := NewOpenAICompatibleLocalAdapter("http://gateway/v1", transport)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, _ = adapter.Discover(context.Background())
+	if transport.authorization != "" {
+		t.Fatalf("unexpected authorization header")
+	}
+}

cmd/cognitive-worker/main.go

@@ -10,6 +10,8 @@ import (
 	"git.cin.su/m/Assistant/contracts/capability"
 	"git.cin.su/m/Assistant/contracts/cognitive"
 	"git.cin.su/m/Assistant/contracts/identity"
+	secretcontracts "git.cin.su/m/Assistant/contracts/secrets"
+	platformsecrets "git.cin.su/m/Assistant/platform/secrets"
 	"git.cin.su/m/Assistant/runtime/health"
 	"io"
 	"log"
@@ -43,11 +45,21 @@ func main() {
 	discoveries := map[string]providerRegistration{}
 	var builtinLocal *providerRegistration
 	externalRecovery := []providerRegistration{}
-	cpuAdapter, err := models.NewOpenAICompatibleLocalAdapter(envOr("LOCAL_CPU_PROVIDER_URL", "http://docker.cin.su:18082/v1"), nil)
+	cpuAPIKey, err := loadLocalCPUProviderAPIKey()
 	if err != nil {
 		log.Fatal(err)
 	}
-	cpu := providerRegistration{ProviderInstanceID: "local-cpu-primary", Kind: "openai-compatible-chat-v1", EndpointRef: "local-cpu-primary-v1", AuthMode: capability.AuthNone, BillingMode: capability.BillingFree, DataPolicy: capability.DataPolicyLocalOnly, Provider: cpuAdapter, Discovery: cpuAdapter}
+	cpuAdapter, err := models.NewOpenAICompatibleLocalAdapterWithAPIKey(envOr("LOCAL_CPU_PROVIDER_URL", "http://docker.cin.su:18082/v1"), cpuAPIKey, nil)
+	if err != nil {
+		log.Fatal(err)
+	}
+	cpuAuthMode := capability.AuthNone
+	cpuCredentialRef := capability.CredentialRef("")
+	if cpuAPIKey != "" {
+		cpuAuthMode = capability.AuthKey
+		cpuCredentialRef = capability.CredentialRef(envOr("LOCAL_CPU_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-cpu/provider-api-key/v1"))
+	}
+	cpu := providerRegistration{ProviderInstanceID: "local-cpu-primary", Kind: "openai-compatible-chat-v1", EndpointRef: "local-cpu-primary-v1", CredentialRef: cpuCredentialRef, AuthMode: cpuAuthMode, BillingMode: capability.BillingFree, DataPolicy: capability.DataPolicyLocalOnly, Provider: cpuAdapter, Discovery: cpuAdapter}
 	providers[cpu.Kind] = append(providers[cpu.Kind], cpu)
 	discoveries["cpu"] = cpu
 	if lifeboat, enabled, lifeboatErr := newLifeboatProvider(os.Getenv("LOCAL_LIFEBOAT_PROVIDER_URL")); lifeboatErr != nil {
@@ -145,6 +157,25 @@ func refreshProviderDiscoveries(resolver bindingResolver, service discoveryServi
 	}
 }
 
+func loadLocalCPUProviderAPIKey() (string, error) {
+	if _, set := os.LookupEnv("LOCAL_CPU_PROVIDER_API_KEY"); set {
+		return "", fmt.Errorf("LOCAL_CPU_PROVIDER_API_KEY direct environment secret is forbidden; use LOCAL_CPU_PROVIDER_API_KEY_FILE")
+	}
+	fileName := strings.TrimSpace(os.Getenv("LOCAL_CPU_PROVIDER_API_KEY_FILE"))
+	if fileName == "" {
+		return "", nil
+	}
+	ref := strings.TrimSpace(os.Getenv("LOCAL_CPU_PROVIDER_CREDENTIAL_REF"))
+	if ref == "" {
+		return "", fmt.Errorf("LOCAL_CPU_PROVIDER_CREDENTIAL_REF is required when LOCAL_CPU_PROVIDER_API_KEY_FILE is configured")
+	}
+	resolver, err := platformsecrets.NewFileResolver(envOr("SECRET_BACKEND_ROOT", "/run/secrets"))
+	if err != nil {
+		return "", err
+	}
+	return resolver.ResolveFile(secretcontracts.SecretFileRef{CredentialRef: secretcontracts.CredentialRef(ref), Purpose: secretcontracts.SecretPurposeProviderAPIKey, Consumer: secretcontracts.RuntimeConsumerCognitive, Path: fileName})
+}
+
 func deterministicAdvisory(w http.ResponseWriter, r *http.Request) {
 	request, ok := decodeAdvisoryRequest(w, r)
 	if !ok {

cmd/cognitive-worker/main_test.go

@@ -1,6 +1,10 @@
 package main
 
-import "testing"
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
 
 func TestLifeboatProviderIsOptionalAndLocalAdapterBacked(t *testing.T) {
 	if _, enabled, err := newLifeboatProvider(""); err != nil || enabled {
@@ -14,3 +18,28 @@ func TestLifeboatProviderIsOptionalAndLocalAdapterBacked(t *testing.T) {
 		t.Fatalf("unexpected lifeboat registration: %+v", provider)
 	}
 }
+
+func TestLoadLocalCPUProviderAPIKeyUsesProtectedFileReference(t *testing.T) {
+	t.Setenv("LOCAL_CPU_PROVIDER_API_KEY", "")
+	_ = os.Unsetenv("LOCAL_CPU_PROVIDER_API_KEY")
+	root := t.TempDir()
+	path := filepath.Join(root, "local_cpu_provider_api_key")
+	if err := os.WriteFile(path, []byte("resolved-key\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("LOCAL_CPU_PROVIDER_API_KEY_FILE", path)
+	t.Setenv("LOCAL_CPU_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-cpu/provider-api-key/v1")
+	t.Setenv("SECRET_BACKEND_ROOT", root)
+	key, err := loadLocalCPUProviderAPIKey()
+	if err != nil || key != "resolved-key" {
+		t.Fatalf("unexpected key resolution result: err=%v", err)
+	}
+}
+
+func TestLoadLocalCPUProviderAPIKeyRejectsDirectEnvironmentSecret(t *testing.T) {
+	t.Setenv("LOCAL_CPU_PROVIDER_API_KEY", "must-not-be-used")
+	t.Setenv("LOCAL_CPU_PROVIDER_API_KEY_FILE", "")
+	if _, err := loadLocalCPUProviderAPIKey(); err == nil {
+		t.Fatal("expected direct environment secret to be rejected")
+	}
+}

contracts/secrets/types.go

@@ -9,6 +9,7 @@ type SecretPurpose string
 
 const (
 	SecretPurposeDatabasePassword SecretPurpose = "DATABASE_PASSWORD"
+	SecretPurposeProviderAPIKey   SecretPurpose = "PROVIDER_API_KEY"
 )
 
 // RuntimeConsumer identifies a trusted runtime allowed to resolve a credential.
@@ -18,6 +19,7 @@ const (
 	RuntimeConsumerCore             RuntimeConsumer = "core-runtime"
 	RuntimeConsumerWorkWorker       RuntimeConsumer = "agent-worker"
 	RuntimeConsumerEpistemicsWorker RuntimeConsumer = "reflection-worker"
+	RuntimeConsumerCognitive        RuntimeConsumer = "cognitive-worker"
 )
 
 // SecretFileRef is bootstrap delivery metadata for the V1 protected local

deploy/docker-compose.prod.yml

@@ -114,6 +114,7 @@ services:
       WORK_POSTGRES_CREDENTIAL_REF: credential://domovoy/work/db-password/v1
       WORK_POSTGRES_PASSWORD_FILE: /run/secrets/work_db_password
       SECRET_BACKEND_ROOT: /run/secrets
+      AGENT_EXECUTION_BRIDGE_URL: ${AGENT_EXECUTION_BRIDGE_URL:-}
     depends_on: { postgres: { condition: service_healthy } }
     volumes:
       - assistant_core_secrets:/run/secrets:ro
@@ -211,11 +212,15 @@ services:
       LISTEN_ADDR: ":8083"
       CORE_RUNTIME_URL: http://core-runtime:8080
       LOCAL_CPU_PROVIDER_URL: http://docker.cin.su:18082/v1
+      LOCAL_CPU_PROVIDER_API_KEY_FILE: ${LOCAL_CPU_PROVIDER_API_KEY_FILE:-}
+      LOCAL_CPU_PROVIDER_CREDENTIAL_REF: ${LOCAL_CPU_PROVIDER_CREDENTIAL_REF:-credential://domovoy/local-cpu/provider-api-key/v1}
       LOCAL_LIFEBOAT_PROVIDER_URL: http://cognitive-lifeboat:8086/v1
       LOCAL_GPU_PROVIDER_URL: http://192.168.220.91:11434
       COGNITIVE_OWNER_PRINCIPAL_ID: domovoy-creator-principal
       COGNITIVE_ALLOW_CANARY: "true"
     depends_on: [core-runtime, cognitive-lifeboat]
+    volumes:
+      - assistant_core_secrets:/run/secrets:ro
 
   cognitive-lifeboat:
     image: ghcr.io/ggml-org/llama.cpp:server

dev/ACTIVE_TASK.json

@@ -1,5 +1,5 @@
 {
-  "task_file": "dev/tasks/DEV-000151-agent-worker-status-ui.json",
-  "task_id": "DEV-000151",
+  "task_file": "dev/tasks/DEV-000163-operations-ui-contract-refresh.json",
+  "task_id": "DEV-000163",
   "task_revision": 1
 }

dev/tasks/DEV-000152-cognitive-provider-secret-reference.json

@@ -0,0 +1,35 @@
+{
+  "task_id": "DEV-000152",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "624c41d4f6dae8c8d341aec09485efbba78bc76f",
+  "risk_tier": "E",
+  "intent": "Enable cognitive-worker to authenticate the local OpenAI-compatible CPU gateway through a typed file-backed credential reference without exposing provider key material in environment, source, or logs.",
+  "requirement_ids": ["AUDIT-WP-003", "AUDIT-WP-201", "CONSTITUTION-1.3.28"],
+  "allowed_change_scope": {
+    "modules": ["capability", "cognitive"],
+    "paths": [
+      "contracts/secrets/types.go",
+      "platform/secrets/**",
+      "adapters/models/openai_compatible_local.go",
+      "adapters/models/openai_compatible_local_test.go",
+      "cmd/cognitive-worker/main.go",
+      "cmd/cognitive-worker/main_test.go",
+      "dev/ACTIVE_TASK.json",
+      "dev/tasks/DEV-000152-cognitive-provider-secret-reference.json"
+    ]
+  },
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/devctl/**", ".gitea/**", "deploy/**", "database/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["typed CredentialRef", "protected file-backed secret resolver"], "may_change": ["secret purpose and trusted runtime consumer enum values"]},
+  "semantic_owner": "capability",
+  "canonical_state": ["provider credential material remains external to repository and database"],
+  "state_transitions": ["cognitive-worker sends a bearer credential only when a trusted file-backed reference resolves successfully"],
+  "side_effects_and_privileges": ["none; adapter receives resolved material from runtime bootstrap and never persists it"],
+  "persistence_and_migrations": ["no database migration"],
+  "failure_retry_restart": ["direct secret environment configuration fails closed", "missing reference or unreadable file fails startup", "no configured key preserves existing unauthenticated development behavior"],
+  "assumptions": ["production operators provision the gateway key into the protected secret volume separately; this task does not copy or reveal it"],
+  "acceptance_scenarios": ["resolved key becomes Authorization Bearer header", "no key sends no Authorization header", "direct environment secret is rejected", "secret value is absent from logs and repository"],
+  "required_tests": ["unit", "go test", "go vet", "architecture preflight", "check-diff", "git diff --check", "independent", "exact diff scope", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT", "BLOCKED_BY_ARCHITECTURE_GAP"]
+}

dev/tasks/DEV-000153-fleet-secret-wiring.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000153",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "dbbc54171d9c8a9edaa93e5ff5870d3ec434d799",
+  "risk_tier": "E",
+  "intent": "Wire the production cognitive-worker to the existing protected secret volume for optional local CPU gateway authentication without placing credential material in compose environment values.",
+  "requirement_ids": ["AUDIT-WP-003", "AUDIT-WP-201", "CONSTITUTION-1.3.28"],
+  "allowed_change_scope": {"modules": ["cognitive"], "paths": ["deploy/docker-compose.prod.yml", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000153-fleet-secret-wiring.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/devctl/**", ".gitea/**", "database/**", "contracts/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["assistant_core_secrets read-only volume", "optional LOCAL_CPU_PROVIDER_API_KEY_FILE reference"], "may_change": []},
+  "semantic_owner": "capability",
+  "canonical_state": ["provider credential material remains outside repository and compose environment"],
+  "state_transitions": ["when operators provision the referenced file, cognitive-worker resolves it and authenticates the local CPU gateway; when absent, existing recovery behavior remains available"],
+  "side_effects_and_privileges": ["read-only mount only; no secret value is added to compose"],
+  "persistence_and_migrations": ["no database migration"],
+  "failure_retry_restart": ["empty optional file reference preserves current unauthenticated startup", "configured missing credential file fails closed at worker startup"],
+  "assumptions": ["the gateway credential is provisioned by production operators into assistant_core_secrets; this task does not copy or reveal it"],
+  "acceptance_scenarios": ["compose renders with empty optional key path", "cognitive-worker receives read-only /run/secrets mount", "no literal provider credential occurs in repository or compose", "CI and production deployment succeed"],
+  "required_tests": ["go test", "go vet", "docker compose config", "architecture preflight", "check-diff", "git diff --check", "independent", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT", "BLOCKED_BY_ARCHITECTURE_GAP"]
+}

dev/tasks/DEV-000154-fast-live-smoke-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000154",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "283f5c044c3bf6739c8ed859412cd736754e3177",
+  "risk_tier": "E",
+  "intent": "Record bounded production evidence that the authenticated local CPU provider is available and invokable through the cognitive boundary.",
+  "requirement_ids": ["AUDIT-WP-003", "AUDIT-WP-201", "WP-601"],
+  "allowed_change_scope": {"modules": ["capability", "cognitive"], "paths": ["docs/evidence/wp-601-fast-gateway-live-smoke-2026-08-22-v1.json", "docs/evidence/WP-601-FAST-GATEWAY-LIVE-SMOKE-2026-08-22.md", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000154-fast-live-smoke-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/devctl/**", ".gitea/**", "database/**", "deploy/**", "contracts/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["production cognitive discovery and bounded advisory response evidence"], "may_change": []},
+  "semantic_owner": "capability",
+  "canonical_state": ["none; append-only evidence artifact only"],
+  "state_transitions": ["none; evidence does not activate or promote a binding"],
+  "side_effects_and_privileges": ["four bounded local-only synthetic advisory requests"],
+  "persistence_and_migrations": ["no database migration"],
+  "failure_retry_restart": ["not applicable to evidence artifact"],
+  "assumptions": ["provider key remains in protected production volume and is not copied to repository or logs"],
+  "acceptance_scenarios": ["evidence records available API_KEY provider", "four requests complete with expected sentinels", "limitations remain explicit", "no secret material is present"],
+  "required_tests": ["JSON validation", "go test", "go vet", "architecture preflight", "check-diff", "git diff --check", "independent", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT", "BLOCKED_BY_ARCHITECTURE_GAP"]
+}

dev/tasks/DEV-000155-current-audit-status.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000155",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "5703ab3ed5e22a5424a2db7f19886c0305e54280",
+  "risk_tier": "E",
+  "intent": "Synchronize the project status projection with current live audit evidence, explicitly distinguishing completed runtime foundations from external blockers.",
+  "requirement_ids": ["AUDIT-TRUTHFUL-STATUS", "WP-003", "WP-301", "WP-800"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/PROJECT_STATUS.md", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000155-current-audit-status.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/devctl/**", ".gitea/**", "database/**", "deploy/**", "contracts/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["live audit observations and committed evidence artifacts"], "may_change": []},
+  "semantic_owner": "none; documentation projection",
+  "canonical_state": ["none"],
+  "state_transitions": ["none"],
+  "side_effects_and_privileges": ["none"],
+  "persistence_and_migrations": ["no database migration"],
+  "failure_retry_restart": ["not applicable"],
+  "assumptions": ["status projection remains subordinate to runtime evidence and does not declare blocked items complete"],
+  "acceptance_scenarios": ["current revision and FAST evidence are referenced", "Medium/Heavy and bridge gaps are explicit", "UI acceptance remains pending without session", "no secret value appears"],
+  "required_tests": ["JSON validation", "go test", "go vet", "architecture preflight", "check-diff", "git diff --check", "independent", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT", "BLOCKED_BY_ARCHITECTURE_GAP"]
+}

dev/tasks/DEV-000156-fleet-execution-status-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000156",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "03c3484ee1488ebc3b2349ab6ba5c8005c895110",
+  "risk_tier": "E",
+  "intent": "Capture fresh production evidence for model fleet readiness and Agent Execution capability without changing runtime behavior.",
+  "requirement_ids": ["WP-200", "WP-301", "AUDIT-TRUTHFUL-STATUS"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/evidence/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000156-fleet-execution-status-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/**", "modules/**", "contracts/**", "adapters/**", "database/**", "deploy/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["fleet readiness response", "agent-worker status response"], "may_change": []},
+  "semantic_owner": "none; evidence projection",
+  "canonical_state": [],
+  "state_transitions": ["evidence only; no activation, promotion or configuration change"],
+  "side_effects_and_privileges": ["bounded read-only production status probes"],
+  "persistence_and_migrations": ["immutable JSON evidence artifact only"],
+  "failure_retry_restart": ["probe failures are recorded as observed facts; no retry-dependent claim"],
+  "assumptions": ["all probes are internal read-only GET requests", "no secret values are collected"],
+  "acceptance_scenarios": ["FAST readiness auth mismatch is distinguished from successful bounded gateway smoke", "MEDIUM remains NOT_CONFIGURED", "HEAVY timeout is recorded", "LIFEBOAT is the selected fallback", "Agent Execution is recovery-only", "no secret value appears"],
+  "required_tests": ["JSON validation", "go test", "go vet", "preflight", "check-diff", "git diff --check", "independent", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000157-postgres-restore-evidence.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000157",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "077f16e50ca22e14dbf00214005f0fe98a1c8308",
+  "risk_tier": "E",
+  "intent": "Capture fresh production PostgreSQL backup checksum and isolated restore verification evidence without changing the production database.",
+  "requirement_ids": ["WP-002", "AUDIT-RECOVERY-TRUTH"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/evidence/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000157-postgres-restore-evidence.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/**", "modules/**", "contracts/**", "adapters/**", "database/**", "deploy/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["backup artifact format", "restore verification output"], "may_change": []},
+  "semantic_owner": "none; evidence projection",
+  "canonical_state": [],
+  "state_transitions": ["evidence only; no production database mutation"],
+  "side_effects_and_privileges": ["isolated temporary restore container created and removed by the existing verifier"],
+  "persistence_and_migrations": ["immutable JSON evidence artifact only"],
+  "failure_retry_restart": ["checksum or restore failure is recorded as failure; no blind retry claim"],
+  "assumptions": ["the standard verifier uses tmpfs and cleans up its temporary container", "backup contents and credentials are not copied into repository evidence"],
+  "acceptance_scenarios": ["latest backup directory is selected", "checksums pass", "isolated restore reports expected schema/table counts", "production database remains untouched"],
+  "required_tests": ["JSON validation", "go test", "go vet", "preflight", "check-diff", "git diff --check", "independent", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000158-status-evidence-consolidation.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000158",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "3a52c18bef7e29a0369ad1edf05adeed1be5935e",
+  "risk_tier": "E",
+  "intent": "Synchronize the project status projection with the latest production revision and committed fleet/recovery evidence.",
+  "requirement_ids": ["AUDIT-TRUTHFUL-STATUS", "WP-002", "WP-200", "WP-301"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/PROJECT_STATUS.md", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000158-status-evidence-consolidation.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/**", "modules/**", "contracts/**", "adapters/**", "database/**", "deploy/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["production revision", "committed fleet evidence", "committed restore evidence"], "may_change": []},
+  "semantic_owner": "none; documentation projection",
+  "canonical_state": [],
+  "state_transitions": ["evidence projection only"],
+  "side_effects_and_privileges": ["none"],
+  "persistence_and_migrations": ["no database migration"],
+  "failure_retry_restart": ["not applicable"],
+  "assumptions": ["status remains subordinate to live evidence and does not declare unavailable capabilities complete"],
+  "acceptance_scenarios": ["latest production revision is shown", "fleet and restore evidence are linked", "remaining gaps remain explicit", "no secret value appears"],
+  "required_tests": ["JSON validation", "go test", "go vet", "preflight", "check-diff", "git diff --check", "independent", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000159-agent-bridge-config-wiring.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000159",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "e1186757bfcf9a349ce0ced603f4a4ebdad636fe",
+  "risk_tier": "E",
+  "intent": "Expose the already-supported optional Agent Execution bridge URL to the production agent-worker without enabling it when unset.",
+  "requirement_ids": ["WP-301", "Agent Execution runtime and recovery"],
+  "allowed_change_scope": {"modules": ["deployment", "work-agent-execution"], "paths": ["deploy/docker-compose.prod.yml", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000159-agent-bridge-config-wiring.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "contracts/**", "cmd/**", "modules/**", "adapters/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["AGENT_EXECUTION_BRIDGE_URL deployment variable", "agent-worker optional bridge behavior"], "may_change": []},
+  "semantic_owner": "deployment projection; work-agent-execution remains owner",
+  "canonical_state": ["none"],
+  "state_transitions": ["unset URL -> recovery-only; configured URL -> existing typed HTTP executor path"],
+  "side_effects_and_privileges": ["deployment privileged-surface review is declared; no effective new privilege; no credential forwarding; no outbound call when variable is empty"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["existing worker fail-closed and stale recovery behavior remains unchanged"],
+  "assumptions": ["an independently operated bridge is still required before enabling the variable in production", "empty default preserves current recovery-only behavior"],
+  "acceptance_scenarios": ["production compose renders with empty bridge URL", "agent-worker remains recovery-only when unset", "configured URL is available to the process without source secret", "no bridge runtime is fabricated"],
+  "required_tests": ["JSON validation", "docker compose config", "go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000160-status-after-bridge-wiring.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000160",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "ada2da0c6c93d630f7699bd05abd32031c11544c",
+  "risk_tier": "E",
+  "intent": "Synchronize project status with the latest bridge wiring deployment and preserve the explicit external capability gap.",
+  "requirement_ids": ["AUDIT-TRUTHFUL-STATUS", "WP-301"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/PROJECT_STATUS.md", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000160-status-after-bridge-wiring.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/**", "modules/**", "contracts/**", "adapters/**", "database/**", "deploy/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["production revision", "optional bridge configuration state"], "may_change": []},
+  "semantic_owner": "none; documentation projection",
+  "canonical_state": [],
+  "state_transitions": ["evidence projection only"],
+  "side_effects_and_privileges": ["none"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["not applicable"],
+  "assumptions": ["unset bridge URL remains truthful recovery-only state"],
+  "acceptance_scenarios": ["current production revision is shown", "bridge wiring and missing runtime are distinguished", "no secret value appears"],
+  "required_tests": ["JSON validation", "go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000161-completion-audit-matrix.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000161",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "3cf44ada8afd75fb008cf8d5965caf9c3f5b0462",
+  "risk_tier": "E",
+  "intent": "Publish a requirement-by-requirement completion matrix for the audit objective, distinguishing repository proof, production proof and external gaps.",
+  "requirement_ids": ["AUDIT-COMPLETION-TRUTH", "WP-301", "WP-601", "WP-800"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/evidence/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000161-completion-audit-matrix.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/**", "modules/**", "contracts/**", "adapters/**", "database/**", "deploy/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["audit roadmap", "committed task packets", "production evidence artifacts"], "may_change": []},
+  "semantic_owner": "none; audit evidence projection",
+  "canonical_state": [],
+  "state_transitions": ["evidence projection only"],
+  "side_effects_and_privileges": ["none"],
+  "persistence_and_migrations": ["immutable JSON evidence artifact only"],
+  "failure_retry_restart": ["not applicable"],
+  "assumptions": ["unknown or externally blocked requirements are not marked complete", "matrix claims are limited to cited evidence scope"],
+  "acceptance_scenarios": ["all seven objective areas have a status", "production and repository proof are distinguished", "remaining external gaps are explicit", "no secret value appears"],
+  "required_tests": ["JSON validation", "go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000162-status-after-completion-matrix.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000162",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0010",
+  "base_repo_revision": "bda71caecece67e5ef225ac250a7a80c4bc84d94",
+  "risk_tier": "E",
+  "intent": "Refresh current production revision in project status and completion evidence after the audit matrix deployment.",
+  "requirement_ids": ["AUDIT-TRUTHFUL-STATUS"],
+  "allowed_change_scope": {"modules": [], "paths": ["docs/PROJECT_STATUS.md", "docs/evidence/audit-completion-matrix-2026-08-22-v1.json", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000162-status-after-completion-matrix.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/**", "modules/**", "contracts/**", "adapters/**", "database/**", "deploy/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["current production revision", "completion matrix evidence"], "may_change": []},
+  "semantic_owner": "none; documentation projection",
+  "canonical_state": [],
+  "state_transitions": ["evidence projection only"],
+  "side_effects_and_privileges": ["none"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["not applicable"],
+  "assumptions": ["matrix remains NOT_COMPLETE until external gaps are actually verified"],
+  "acceptance_scenarios": ["status and matrix point to bda71ca", "no completion claim is widened", "no secret value appears"],
+  "required_tests": ["JSON validation", "go test", "go vet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT"]
+}

dev/tasks/DEV-000163-operations-ui-contract-refresh.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000163",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "c25a6346d0615f66ddb411450fcc7a36c62d2b48",
+  "risk_tier": "E",
+  "intent": "Extend authenticated cabinet contract tests to cover truthful model-fleet and Agent Execution status surfaces already implemented in Creator Web.",
+  "requirement_ids": ["WP-801", "WP-802", "WP-805", "Authenticated cabinet acceptance"],
+  "allowed_change_scope": {"modules": ["creator-web"], "paths": ["tests/creator_web/cabinet_acceptance_contract_test.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000163-operations-ui-contract-refresh.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "deploy/**", "database/**", "cmd/**", "contracts/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["existing authenticated Creator Web status routes and static cabinet"], "may_change": ["acceptance tests only"]},
+  "semantic_owner": "creator-web",
+  "canonical_state": ["none; tests inspect existing UI contract"],
+  "state_transitions": ["authenticated session gates truthful status requests"],
+  "side_effects_and_privileges": ["no external mutation; no credentials embedded"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["missing status surface fails CI"],
+  "assumptions": ["live authenticated browser visual acceptance remains a separate production verification"],
+  "acceptance_scenarios": ["fleet and executor status controls exist", "server exposes authenticated routes", "console renders actual selected tier and worker mode", "responsive/reduced-motion tests remain active"],
+  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_AUTHENTICATED_BROWSER_SESSION", "BLOCKED_BY_CONFLICT"]
+}

docs/PROJECT_STATUS.md

@@ -1,6 +1,18 @@
 # Assistant project status
 
-Audit date: 2026-08-22. Active implementation: DEV-000099 revision 1.
+## Current audit delta — 2026-08-22
+
+- `CURRENT_PRODUCTION_REVISION = bda71caecece67e5ef225ac250a7a80c4bc84d94`; public `/healthz` is healthy.
+- `FAST_PROVIDER_STATUS = LIVE_SMOKE_SUPPORTED`: local CPU gateway authentication is configured through a protected file reference; four bounded local-only advisory cases completed through cognitive-worker. Evidence: `docs/evidence/wp-601-fast-gateway-live-smoke-2026-08-22-v1.json`.
+- `MEDIUM_PROVIDER_STATUS = NOT_CONFIGURED`; no medium runtime is registered in production.
+- `HEAVY_PROVIDER_STATUS = UNAVAILABLE`; GPU endpoint `192.168.220.91:11434` timed out during live discovery.
+- `AGENT_EXECUTION_STATUS = RECOVERY_ONLY`; optional `AGENT_EXECUTION_BRIDGE_URL` is wired into production compose but remains unset, and no Codex/bridge runtime is deployed. Durable recovery and status endpoints remain active.
+- `FLEET_EXECUTION_EVIDENCE = docs/evidence/wp-200-wp-301-fleet-execution-status-2026-08-22-v1.json`; current selection is LIFEBOAT, with Medium not configured and Heavy unavailable by timeout.
+- `BACKUP_RESTORE_EVIDENCE = docs/evidence/wp-002-postgres-restore-2026-08-22-v1.json`; latest backup checksum and isolated restore verified with 11 schemas and 60 tables.
+- `UI_AUTHENTICATED_ACCEPTANCE = PENDING`; public login UI is reachable, but no authenticated browser session was available for cabinet visual acceptance.
+- `SECURITY_NOTE = one production executor secret was rotated after an accidental diagnostic disclosure; values are not retained in repository evidence.`
+
+Audit date: 2026-08-22. Historical governance checkpoint: DEV-000099 revision 1.
 
 ## Current governance checkpoint
 

docs/evidence/WP-601-FAST-GATEWAY-LIVE-SMOKE-2026-08-22.md

@@ -0,0 +1,14 @@
+# WP-601 FAST gateway live smoke
+
+Observed `2026-08-22T14:41:47Z` on production revision `283f5c044c3bf6739c8ed859412cd736754e3177`.
+
+The protected provider reference was enabled in production without retaining
+credential material in the repository or evidence. Cognitive discovery reported
+`local-cpu-primary` as `AVAILABLE` with `AuthMode=API_KEY` and observed models
+`Qwen3.6-27B-UD-Q4_K_XL` and `dspark-DeepSeek-V4-Flash-0731-Q8_0`.
+
+Four bounded local-only advisory requests crossed the cognitive boundary and
+completed with the expected sentinel response: 4/4, zero failures. This proves
+availability and invocation of FAST; it does not promote a binding or claim that
+MEDIUM/HEAVY are available. Existing Lifeboat qualification remains the fallback
+evidence.

docs/evidence/audit-completion-matrix-2026-08-22-v1.json

@@ -0,0 +1,18 @@
+{
+  "evidence_id": "audit-completion-matrix-2026-08-22-v1",
+  "captured_at": "2026-08-22",
+  "production_revision": "bda71caecece67e5ef225ac250a7a80c4bc84d94",
+  "objective": "Dovести оставшиеся пункты аудита Domovoy до проверяемого состояния",
+  "matrix": [
+    {"area":"Agent Execution runtime and recovery","status":"PARTIAL_EXTERNAL_GAP","repository_proof":["dev/tasks/DEV-000145-agent-execution-bridge-runtime.json","adapters/agentbridge/http.go","cmd/agent-worker/main.go"],"production_proof":["docs/evidence/wp-200-wp-301-fleet-execution-status-2026-08-22-v1.json"],"missing":"independently operated bridge endpoint is not configured; live worker is recovery-only"},
+    {"area":"Multi-Agent Work Graph","status":"REPOSITORY_AND_RUNTIME_FOUNDATION_VERIFIED","repository_proof":["dev/tasks/DEV-000131-work-graph-harness.json","dev/tasks/DEV-000146-work-graph-runtime.json","tests/agent_execution/graph_runtime_test.go"],"production_proof":["docs/PROJECT_STATUS.md"],"missing":"no claim of external agent execution fan-out is made while bridge is absent"},
+    {"area":"Truth/Research runtime","status":"REPOSITORY_AND_RUNTIME_FOUNDATION_VERIFIED","repository_proof":["dev/tasks/DEV-000134-truth-bundle-compiler.json","dev/tasks/DEV-000143-research-runtime-orchestration.json","tests/research_runtime"],"production_proof":["docs/PROJECT_STATUS.md"],"missing":"authenticated end-to-end research acceptance is not claimed here"},
+    {"area":"Learning reflection loop","status":"REPOSITORY_AND_RUNTIME_FOUNDATION_VERIFIED","repository_proof":["dev/tasks/DEV-000135-reflection-worker.json","cmd/reflection-worker/main.go","tests/research_contracts/reflection_worker_sql_test.go"],"production_proof":["docs/PROJECT_STATUS.md"],"missing":"no claim of fully closed historical candidate backlog"},
+    {"area":"Model fleet/failover","status":"PARTIAL_EXTERNAL_GAP","repository_proof":["dev/tasks/DEV-000144-fleet-readiness-runtime.json","cmd/cognitive-worker/fleet_status.go"],"production_proof":["docs/evidence/wp-200-wp-301-fleet-execution-status-2026-08-22-v1.json"],"missing":"Medium is not configured; Heavy GPU probe times out; Lifeboat is selected fallback"},
+    {"area":"Governed self-development","status":"REPOSITORY_FOUNDATION_VERIFIED","repository_proof":["dev/tasks/DEV-000137-governed-self-development-gate.json","tests/semantic_evolution"],"production_proof":["docs/PROJECT_STATUS.md"],"missing":"real bridge-backed self-development execution is not claimed"},
+    {"area":"UI/operations acceptance","status":"PARTIAL_EXTERNAL_GAP","repository_proof":["dev/tasks/DEV-000138-ui-operations-acceptance-contract.json","tests/creator_web/cabinet_acceptance_contract_test.go","dev/tasks/DEV-000150-agent-operations-ui.json","dev/tasks/DEV-000151-agent-worker-status-ui.json"],"production_proof":["docs/PROJECT_STATUS.md"],"missing":"authenticated browser visual acceptance is pending because no signed-in session is available"}
+  ],
+  "overall_status":"NOT_COMPLETE",
+  "completion_rule":"The objective is not complete until every PARTIAL_EXTERNAL_GAP has live evidence for its missing capability and authenticated UI acceptance is recorded.",
+  "secrets":"No secret values included."
+}

docs/evidence/wp-002-postgres-restore-2026-08-22-v1.json

@@ -0,0 +1,16 @@
+{
+  "evidence_id": "wp-002-postgres-restore-2026-08-22-v1",
+  "captured_at": "2026-08-22",
+  "production_host": "docker.cin.su",
+  "source": "standard read-only backup verifier",
+  "selected_backup": "20260822T001501Z",
+  "checksum": "OK",
+  "restore": {
+    "database": "assistant",
+    "schemas": 11,
+    "tables": 60,
+    "result": "verified"
+  },
+  "safety": "restore was performed in an isolated temporary PostgreSQL container and cleaned up by the verifier; production database was not restored over or modified",
+  "limitations": ["this evidence verifies the latest available backup artifact and isolated restore, not a full disaster-recovery cutover" ]
+}

docs/evidence/wp-200-wp-301-fleet-execution-status-2026-08-22-v1.json

@@ -0,0 +1,30 @@
+{
+  "evidence_id": "wp-200-wp-301-fleet-execution-status-2026-08-22-v1",
+  "captured_at": "2026-08-22",
+  "production_revision": "03c3484ee1488ebc3b2349ab6ba5c8005c895110",
+  "source": "read-only internal status probes on docker.cin.su",
+  "fleet_readiness": {
+    "preferred_tier": "HEAVY",
+    "selected_tier": "LIFEBOAT",
+    "ready_tiers": ["LIFEBOAT"],
+    "members": [
+      {"provider_instance_id": "local-cpu-primary", "tier": "FAST", "ready": false, "reason": "status=401 UNAUTHORIZED"},
+      {"provider_instance_id": "local-medium-unconfigured", "tier": "MEDIUM", "ready": false, "reason": "NOT_CONFIGURED"},
+      {"provider_instance_id": "local-gpu-opportunistic", "tier": "HEAVY", "ready": false, "reason": "context deadline exceeded while awaiting headers"},
+      {"provider_instance_id": "cognitive-lifeboat", "tier": "LIFEBOAT", "ready": true, "reason": "AVAILABLE"}
+    ]
+  },
+  "agent_execution": {
+    "runtime": "agent-worker",
+    "executor_configured": false,
+    "mode": "recovery-only",
+    "ready": false,
+    "reason": "AGENT_EXECUTION_BRIDGE_URL is not configured"
+  },
+  "interpretation": [
+    "Fleet readiness currently selects the local Lifeboat fallback.",
+    "The FAST provider has a live bounded gateway smoke recorded separately; the fleet readiness probe itself receives 401 from the model catalog endpoint.",
+    "No Medium runtime or Heavy GPU runtime is ready, and no Agent Execution bridge is deployed.",
+    "This artifact records evidence only and does not activate or promote any binding."
+  ]
+}

docs/evidence/wp-601-fast-gateway-live-smoke-2026-08-22-v1.json

@@ -0,0 +1,31 @@
+{
+  "artifact_id": "wp-601-fast-gateway-live-smoke-2026-08-22-v1",
+  "observed_at": "2026-08-22T14:41:47.1155793Z",
+  "production_revision": "283f5c044c3bf6739c8ed859412cd736754e3177",
+  "endpoint": "assistant.cin.su",
+  "runtime_path": "creator-web -> cognitive-worker -> local-cpu-primary -> llm-local-gateway",
+  "credential_material": "not retained; protected file reference only",
+  "provider": {
+    "provider_instance_id": "local-cpu-primary",
+    "provider_kind": "openai-compatible-chat-v1",
+    "health": "AVAILABLE",
+    "auth_mode": "API_KEY",
+    "credential_ref": "credential://domovoy/local-cpu/provider-api-key/v1",
+    "models_observed": [
+      "Qwen3.6-27B-UD-Q4_K_XL",
+      "dspark-DeepSeek-V4-Flash-0731-Q8_0"
+    ]
+  },
+  "cases": [
+    {"request_id": "live-fast-smoke-20260822", "expected": "FAST_OK", "actual": "FAST_OK", "finish_reason": "COMPLETED", "input_units": 36, "output_units": 3},
+    {"request_id": "live-fast-case-1-20260822", "expected": "CASE_OK_1", "actual": "CASE_OK_1", "finish_reason": "COMPLETED", "input_units": 38, "output_units": 5},
+    {"request_id": "live-fast-case-2-20260822", "expected": "CASE_OK_2", "actual": "CASE_OK_2", "finish_reason": "COMPLETED", "input_units": 38, "output_units": 5},
+    {"request_id": "live-fast-case-3-20260822", "expected": "CASE_OK_3", "actual": "CASE_OK_3", "finish_reason": "COMPLETED", "input_units": 38, "output_units": 5}
+  ],
+  "summary": {"cases": 4, "completed": 4, "failed": 0, "qualification": "LIVE_SMOKE_SUPPORTED"},
+  "limitations": [
+    "This is availability and bounded invocation evidence, not a binding promotion.",
+    "Medium and heavy fleet members remain unconfigured/unavailable.",
+    "Fallback qualification remains covered by the existing Lifeboat evidence."
+  ]
+}

tests/creator_web/cabinet_acceptance_contract_test.go

@@ -52,3 +52,41 @@ func TestCreatorCabinetResponsiveAndReducedMotionRulesExist(t *testing.T) {
 		}
 	}
 }
+
+func TestCreatorCabinetExposesFleetAndExecutorTruthfulStatusSurfaces(t *testing.T) {
+	markupBytes, err := os.ReadFile("../../cmd/creator-web/static/index.html")
+	if err != nil {
+		t.Fatal(err)
+	}
+	markup := string(markupBytes)
+	for _, marker := range []string{
+		`id="fleet-summary"`, `id="fleet-selected"`, `id="fleet-list"`,
+		`id="agent-worker-state"`, `id="agent-worker-message"`,
+	} {
+		if !strings.Contains(markup, marker) {
+			t.Fatalf("operations cabinet missing truthful status surface %q", marker)
+		}
+	}
+
+	serverBytes, err := os.ReadFile("../../cmd/creator-web/server.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	server := string(serverBytes)
+	for _, marker := range []string{`r.URL.Path == "/api/fleet/readiness"`, `r.URL.Path == "/api/agent-worker/status"`} {
+		if !strings.Contains(server, marker) {
+			t.Fatalf("creator server missing authenticated status route %q", marker)
+		}
+	}
+
+	consoleBytes, err := os.ReadFile("../../cmd/creator-web/static/assets/console.js")
+	if err != nil {
+		t.Fatal(err)
+	}
+	console := string(consoleBytes)
+	for _, marker := range []string{`request("/api/fleet/readiness")`, `request("/api/agent-worker/status")`, `result.selected_tier || "не выбран"`, `status.mode || "UNKNOWN"`} {
+		if !strings.Contains(console, marker) {
+			t.Fatalf("console missing truthful status rendering %q", marker)
+		}
+	}
+}