merge: authenticated acceptance harness remediation

adapters/notificationexecutor/executor.go

@@ -37,10 +37,12 @@ type DeliveryRequest struct {
 }
 
 type Receipt struct {
-	ReceiptID      string                        `json:"receipt_id"`
-	ActionIntentID commitcontract.ActionIntentID `json:"action_intent_id"`
-	RequestDigest  string                        `json:"request_digest"`
-	AcceptedAt     int64                         `json:"accepted_at_unix_millis"`
+	ReceiptID                 string                        `json:"receipt_id"`
+	ActionIntentID            commitcontract.ActionIntentID `json:"action_intent_id"`
+	RequestDigest             string                        `json:"request_digest"`
+	AcceptedAt                int64                         `json:"accepted_at_unix_millis"`
+	DeliveryMode              string                        `json:"delivery_mode,omitempty"`
+	ExternalDeliveryAttempted bool                          `json:"external_delivery_attempted"`
 }
 
 func Digest(payload Payload) (string, error) {
@@ -76,11 +78,27 @@ func PayloadFromAction(action commitcontract.AuthorizedAction) (Payload, error)
 
 type Executor struct {
 	binding        capability.Binding
+	candidate      *capability.CandidateBinding
 	secret         string
 	client         *http.Client
 	executeAllowed bool
 }
 
+// NewShadow accepts only a Capability-owned SHADOW binding.  Its caller does
+// not supply an endpoint; the target remains inside the resolved binding.
+func NewShadow(binding capability.CandidateBinding, secret string, client *http.Client) (*Executor, error) {
+	if capabilitydomain.ValidateCandidateBinding(binding) != nil || binding.Context.Mode != capability.CandidateBindingModeShadow || binding.Status != capability.CandidateBindingActive {
+		return nil, ErrInvalidNotification
+	}
+	stable := capability.Binding{ID: binding.BaseActiveBindingID, Revision: binding.BaseActiveBindingRevision, OwnerPrincipalID: binding.Context.PrincipalID}
+	value, err := newExecutor(stable, secret, client, true)
+	if err != nil {
+		return nil, err
+	}
+	value.candidate = &binding
+	return value, nil
+}
+
 func New(binding capability.Binding, secret string, client *http.Client) (*Executor, error) {
 	if err := capabilitydomain.UsableBinding(binding); err != nil {
 		return nil, ErrInvalidNotification
@@ -116,7 +134,7 @@ func (e *Executor) Execute(action commitcontract.AuthorizedAction) ports.Executi
 	if err != nil {
 		return ports.ExecutionResult{Known: true}
 	}
-	endpoint, err := e.endpoint(e.binding.DeliveryPath, string(action.Proposal.IntentID))
+	endpoint, err := e.endpoint(e.deliveryPath(), string(action.Proposal.IntentID))
 	if err != nil {
 		return ports.ExecutionResult{Known: true}
 	}
@@ -127,6 +145,10 @@ func (e *Executor) Execute(action commitcontract.AuthorizedAction) ports.Executi
 	request.Header.Set("Authorization", "Bearer "+e.secret)
 	request.Header.Set("Content-Type", "application/json")
 	request.Header.Set("Accept", "application/json")
+	if e.candidate != nil {
+		request.Header.Set("X-Candidate-Release", e.candidate.Context.ReleaseSetID)
+		request.Header.Set("X-Candidate-Task", e.candidate.Context.TaskID)
+	}
 	response, err := e.client.Do(request)
 	if err != nil {
 		return ports.ExecutionResult{}
@@ -139,10 +161,14 @@ func (e *Executor) Execute(action commitcontract.AuthorizedAction) ports.Executi
 		return ports.ExecutionResult{}
 	}
 	receipt, err := decodeReceipt(response.Body)
-	if err != nil || !matchingReceipt(receipt, action) {
+	if err != nil || !matchingReceipt(receipt, action) || (e.candidate != nil && (receipt.DeliveryMode != "SHADOW" || receipt.ExternalDeliveryAttempted)) {
 		return ports.ExecutionResult{}
 	}
-	return ports.ExecutionResult{Known: true, Succeeded: true}
+	result := ports.ExecutionResult{Known: true, Succeeded: true}
+	if e.candidate != nil {
+		result.Receipt = &commitcontract.ExecutionReceipt{ID: receipt.ReceiptID, ExecutorImplementationRef: "notification-shadow-receiver-v1", ExternalOperationRef: "SHADOW_CAPTURED", ExternalRequestID: string(receipt.ActionIntentID), RequestDigest: receipt.RequestDigest, DispatchAtUnixMillis: receipt.AcceptedAt, ExecutorResult: commitcontract.ExecutorAccepted, ReconciliationKey: receipt.ReceiptID, DeliveryMode: "SHADOW", ExternalDeliveryAttempted: false, ReleaseSetID: e.candidate.Context.ReleaseSetID, TaskID: e.candidate.Context.TaskID, TaskRevision: e.candidate.Context.TaskRevision, CapabilityBindingID: string(e.candidate.ID), CapabilityBindingRevision: e.candidate.Revision, TargetReference: e.candidate.Context.TargetRef}
+	}
+	return result
 }
 
 func (e *Executor) Reconcile(action commitcontract.AuthorizedAction) ports.ExecutionResult {
@@ -186,7 +212,11 @@ func (e *Executor) requestFor(action commitcontract.AuthorizedAction) (Payload,
 }
 
 func (e *Executor) endpoint(path, intent string) (string, error) {
-	base, err := url.Parse(e.binding.HTTPSOrigin)
+	origin := e.binding.HTTPSOrigin
+	if e.candidate != nil {
+		origin = e.candidate.TargetOrigin
+	}
+	base, err := url.Parse(origin)
 	if err != nil {
 		return "", err
 	}
@@ -195,6 +225,13 @@ func (e *Executor) endpoint(path, intent string) (string, error) {
 	return base.String(), nil
 }
 
+func (e *Executor) deliveryPath() string {
+	if e.candidate != nil {
+		return e.candidate.DeliveryPath
+	}
+	return e.binding.DeliveryPath
+}
+
 func decodeReceipt(reader io.Reader) (Receipt, error) {
 	var receipt Receipt
 	decoder := json.NewDecoder(io.LimitReader(reader, maxResponseBytes+1))

adapters/notificationexecutor/executor_test.go

@@ -9,6 +9,7 @@ import (
 	"git.cin.su/m/Assistant/contracts/capability"
 	commitcontract "git.cin.su/m/Assistant/contracts/commit"
 	"git.cin.su/m/Assistant/contracts/identity"
+	capabilitydomain "git.cin.su/m/Assistant/modules/capability/domain"
 )
 
 func testAction(t *testing.T) commitcontract.AuthorizedAction {
@@ -55,6 +56,35 @@ func TestExecutorPutAndReconcileMatchReceipt(t *testing.T) {
 	}
 }
 
+func TestShadowExecutorRequiresShadowReceipt(t *testing.T) {
+	action := testAction(t)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("X-Candidate-Release") != "assistant-slot-b" || r.Header.Get("X-Candidate-Task") != "GEN2-CAPABILITY-001" {
+			t.Fatalf("missing candidate context")
+		}
+		_ = json.NewEncoder(w).Encode(Receipt{ReceiptID: "shadow-receipt-1", ActionIntentID: action.Proposal.IntentID, RequestDigest: action.Proposal.NotificationSubject.RequestDigest, AcceptedAt: 1, DeliveryMode: "SHADOW", ExternalDeliveryAttempted: false})
+	}))
+	defer server.Close()
+	binding := capability.CandidateBinding{ID: "candidate-binding-1", Revision: 1, BaseActiveBindingID: "binding-1", BaseActiveBindingRevision: 1,
+		Context:      capability.CandidateReleaseContext{ReleaseSetID: "assistant-slot-b", Slot: "b", TaskID: "GEN2-CAPABILITY-001", TaskRevision: 7, PrincipalID: "owner-1", CapabilityID: commitcontract.CapabilityProspectiveNotification, ResourceScope: "synthetic-shadow-notification-v1", Mode: capability.CandidateBindingModeShadow, TargetKind: "NOTIFICATION_SHADOW_RECEIVER", TargetRef: "notification-receiver-candidate", AuthorityGrantID: "grant"},
+		TargetOrigin: server.URL, DeliveryPath: "/delivery/v1/deliveries", ReceiptPath: "/delivery/v1/receipts", Protocol: capability.ProtocolIdempotentReceiptV1, CreatedAtUnixMillis: 1, ExpiresAtUnixMillis: 100, Status: capability.CandidateBindingActive}
+	// The httptest address is intentionally not the production candidate target;
+	// its digest is recomputed locally only for this bounded test binding.
+	digest, err := capabilitydomain.CandidateTargetDigest(binding)
+	if err != nil {
+		t.Fatal(err)
+	}
+	binding.Context.TargetDigest = digest
+	executor, err := NewShadow(binding, "shadow-secret", server.Client())
+	if err != nil {
+		t.Fatal(err)
+	}
+	result := executor.Execute(action)
+	if !result.Known || !result.Succeeded || result.Receipt == nil || result.Receipt.DeliveryMode != "SHADOW" || result.Receipt.ExternalDeliveryAttempted {
+		t.Fatalf("shadow result=%+v", result)
+	}
+}
+
 func TestExecutorAmbiguousAndIntegrityOutcomes(t *testing.T) {
 	action := testAction(t)
 	for name, handler := range map[string]http.HandlerFunc{

adapters/postgres/authority_repository.go

@@ -31,7 +31,7 @@ func (r *AuthorityRepository) LoadGrant(ctx context.Context, id authority.GrantI
 
 func (r *AuthorityRepository) LoadDelegatedControlPlaneGrant(ctx context.Context, id authority.GrantID) (authority.DelegatedControlPlaneGrant, error) {
 	var grant authority.DelegatedControlPlaneGrant
-	err := r.pool.QueryRow(ctx, `SELECT grant_id,service_actor_id,service_principal_id,issuer_principal_id,task_id,task_revision,operations,binding_id,provider_instance_id,model_descriptor_id,issued_at_unix_millis,expires_at_unix_millis,architecture_revision,nonce,revision,status FROM authority.delegated_control_plane_grants WHERE grant_id=$1`, id).Scan(&grant.ID, &grant.ServiceActorID, &grant.ServicePrincipalID, &grant.IssuerPrincipalID, &grant.TaskID, &grant.TaskRevision, &grant.Operations, &grant.Resource.BindingID, &grant.Resource.ProviderInstanceID, &grant.Resource.ModelDescriptorID, &grant.IssuedAtUnixMillis, &grant.ExpiresAtUnixMillis, &grant.ArchitectureRevision, &grant.Nonce, &grant.Revision, &grant.Status)
+	err := r.pool.QueryRow(ctx, `SELECT grant_id,service_actor_id,service_principal_id,issuer_principal_id,task_id,task_revision,operations,COALESCE(binding_id,''),COALESCE(provider_instance_id,''),COALESCE(model_descriptor_id,''),candidate_release_set_id,candidate_slot,candidate_capability_id,candidate_resource_scope,candidate_mode,candidate_target_kind,candidate_target_ref,candidate_target_digest,issued_at_unix_millis,expires_at_unix_millis,architecture_revision,nonce,revision,status FROM authority.delegated_control_plane_grants WHERE grant_id=$1`, id).Scan(&grant.ID, &grant.ServiceActorID, &grant.ServicePrincipalID, &grant.IssuerPrincipalID, &grant.TaskID, &grant.TaskRevision, &grant.Operations, &grant.Resource.BindingID, &grant.Resource.ProviderInstanceID, &grant.Resource.ModelDescriptorID, &grant.CandidateResource.ReleaseSetID, &grant.CandidateResource.Slot, &grant.CandidateResource.CapabilityID, &grant.CandidateResource.ResourceScope, &grant.CandidateResource.Mode, &grant.CandidateResource.TargetKind, &grant.CandidateResource.TargetRef, &grant.CandidateResource.TargetDigest, &grant.IssuedAtUnixMillis, &grant.ExpiresAtUnixMillis, &grant.ArchitectureRevision, &grant.Nonce, &grant.Revision, &grant.Status)
 	if err != nil {
 		return authority.DelegatedControlPlaneGrant{}, fmt.Errorf("load delegated control-plane grant: %w", err)
 	}
@@ -39,7 +39,7 @@ func (r *AuthorityRepository) LoadDelegatedControlPlaneGrant(ctx context.Context
 }
 
 func (r *AuthorityRepository) RecordDelegatedControlPlaneAudit(ctx context.Context, audit authority.DelegatedControlPlaneAudit) error {
-	_, err := r.pool.Exec(ctx, `INSERT INTO authority.delegated_control_plane_audit (audit_id,grant_id,service_actor_id,service_principal_id,task_id,task_revision,operation,binding_id,provider_instance_id,model_descriptor_id,decision,outcome,recorded_at_unix_millis) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13)`, audit.AuditID, audit.GrantID, audit.ServiceActorID, audit.ServicePrincipalID, audit.TaskID, audit.TaskRevision, audit.Operation, audit.Resource.BindingID, audit.Resource.ProviderInstanceID, audit.Resource.ModelDescriptorID, audit.Decision, audit.Outcome, audit.RecordedAtUnixMillis)
+	_, err := r.pool.Exec(ctx, `INSERT INTO authority.delegated_control_plane_audit (audit_id,grant_id,service_actor_id,service_principal_id,task_id,task_revision,operation,binding_id,provider_instance_id,model_descriptor_id,candidate_release_set_id,candidate_slot,candidate_capability_id,candidate_resource_scope,candidate_mode,candidate_target_kind,candidate_target_ref,candidate_target_digest,decision,outcome,recorded_at_unix_millis) VALUES ($1,$2,$3,$4,$5,$6,$7,NULLIF($8,''),NULLIF($9,''),NULLIF($10,''),$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21)`, audit.AuditID, audit.GrantID, audit.ServiceActorID, audit.ServicePrincipalID, audit.TaskID, audit.TaskRevision, audit.Operation, audit.Resource.BindingID, audit.Resource.ProviderInstanceID, audit.Resource.ModelDescriptorID, audit.CandidateResource.ReleaseSetID, audit.CandidateResource.Slot, audit.CandidateResource.CapabilityID, audit.CandidateResource.ResourceScope, audit.CandidateResource.Mode, audit.CandidateResource.TargetKind, audit.CandidateResource.TargetRef, audit.CandidateResource.TargetDigest, audit.Decision, audit.Outcome, audit.RecordedAtUnixMillis)
 	if err != nil {
 		return fmt.Errorf("record delegated control-plane audit: %w", err)
 	}

adapters/postgres/capability_repository.go

@@ -8,6 +8,7 @@ import (
 
 	"git.cin.su/m/Assistant/contracts/capability"
 	"git.cin.su/m/Assistant/contracts/identity"
+	capabilitydomain "git.cin.su/m/Assistant/modules/capability/domain"
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
 )
@@ -442,6 +443,93 @@ func (r *CapabilityRepository) LoadActiveBinding(ctx context.Context, capability
 	return binding, nil
 }
 
+func (r *CapabilityRepository) SaveCandidateBinding(ctx context.Context, binding capability.CandidateBinding) error {
+	tx, err := r.pool.Begin(ctx)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	result, err := tx.Exec(ctx, `INSERT INTO capability.release_candidate_bindings (
+		binding_id,revision,base_active_binding_id,base_active_binding_revision,release_set_id,slot,task_id,task_revision,principal_id,capability_id,resource_scope,mode,target_kind,target_ref,target_digest,authority_grant_id,
+		target_origin,delivery_path,receipt_path,protocol,created_at_unix_millis,expires_at_unix_millis,status)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23) ON CONFLICT DO NOTHING`,
+		binding.ID, binding.Revision, binding.BaseActiveBindingID, binding.BaseActiveBindingRevision, binding.Context.ReleaseSetID, binding.Context.Slot, binding.Context.TaskID,
+		binding.Context.TaskRevision, binding.Context.PrincipalID, binding.Context.CapabilityID, binding.Context.ResourceScope, binding.Context.Mode, binding.Context.TargetKind, binding.Context.TargetRef, binding.Context.TargetDigest, binding.Context.AuthorityGrantID,
+		binding.TargetOrigin, binding.DeliveryPath, binding.ReceiptPath, binding.Protocol, binding.CreatedAtUnixMillis, binding.ExpiresAtUnixMillis, binding.Status)
+	if err != nil {
+		return err
+	}
+	if result.RowsAffected() == 0 {
+		return ErrCapabilityBindingConflict
+	}
+	if binding.Status == capability.CandidateBindingActive {
+		result, err = tx.Exec(ctx, `INSERT INTO capability.release_candidate_binding_heads (
+			release_set_id,slot,task_id,principal_id,capability_id,resource_scope,mode,binding_id,revision)
+			VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
+			ON CONFLICT (release_set_id,slot,task_id,principal_id,capability_id,resource_scope,mode) DO UPDATE SET binding_id=EXCLUDED.binding_id,revision=EXCLUDED.revision
+			WHERE capability.release_candidate_binding_heads.revision < EXCLUDED.revision`, binding.Context.ReleaseSetID, binding.Context.Slot, binding.Context.TaskID,
+			binding.Context.PrincipalID, binding.Context.CapabilityID, binding.Context.ResourceScope, binding.Context.Mode, binding.ID, binding.Revision)
+		if err != nil || result.RowsAffected() != 1 {
+			if err != nil {
+				return err
+			}
+			return ErrCapabilityBindingConflict
+		}
+	}
+	_, err = tx.Exec(ctx, `INSERT INTO capability.release_candidate_binding_audit (binding_id,revision,release_set_id,task_id,capability_id,resource_scope,mode,decision,reason,recorded_at_unix_millis)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,'CREATED','CAPABILITY_OWNED_CANDIDATE_BINDING',$8)`, binding.ID, binding.Revision, binding.Context.ReleaseSetID, binding.Context.TaskID, binding.Context.CapabilityID, binding.Context.ResourceScope, binding.Context.Mode, binding.CreatedAtUnixMillis)
+	if err != nil {
+		return err
+	}
+	return tx.Commit(ctx)
+}
+
+func (r *CapabilityRepository) ResolveCandidateBinding(ctx context.Context, request capability.CandidateReleaseContext, nowUnixMillis int64) (capability.CandidateBindingResolution, error) {
+	var binding capability.CandidateBinding
+	err := r.pool.QueryRow(ctx, `SELECT b.binding_id,b.revision,b.base_active_binding_id,b.base_active_binding_revision,b.release_set_id,b.slot,b.task_id,b.task_revision,b.principal_id,b.capability_id,b.resource_scope,b.mode,b.target_kind,b.target_ref,b.target_digest,b.authority_grant_id,b.target_origin,b.delivery_path,b.receipt_path,b.protocol,b.created_at_unix_millis,b.expires_at_unix_millis,b.status
+		FROM capability.release_candidate_binding_heads h JOIN capability.release_candidate_bindings b ON b.binding_id=h.binding_id AND b.revision=h.revision
+		WHERE h.release_set_id=$1 AND h.slot=$2 AND h.task_id=$3 AND h.principal_id=$4 AND h.capability_id=$5 AND h.resource_scope=$6 AND h.mode=$7`,
+		request.ReleaseSetID, request.Slot, request.TaskID, request.PrincipalID, request.CapabilityID, request.ResourceScope, request.Mode).
+		Scan(&binding.ID, &binding.Revision, &binding.BaseActiveBindingID, &binding.BaseActiveBindingRevision, &binding.Context.ReleaseSetID, &binding.Context.Slot, &binding.Context.TaskID, &binding.Context.TaskRevision, &binding.Context.PrincipalID, &binding.Context.CapabilityID, &binding.Context.ResourceScope, &binding.Context.Mode, &binding.Context.TargetKind, &binding.Context.TargetRef, &binding.Context.TargetDigest, &binding.Context.AuthorityGrantID, &binding.TargetOrigin, &binding.DeliveryPath, &binding.ReceiptPath, &binding.Protocol, &binding.CreatedAtUnixMillis, &binding.ExpiresAtUnixMillis, &binding.Status)
+	if err != nil {
+		return capability.CandidateBindingResolution{}, fmt.Errorf("candidate binding required: %w", err)
+	}
+	if capabilitydomain.CandidateBindingInvocable(binding, request, nowUnixMillis) != nil {
+		return capability.CandidateBindingResolution{}, ErrCapabilityBindingNotFound
+	}
+	_, _ = r.pool.Exec(ctx, `INSERT INTO capability.release_candidate_binding_audit (binding_id,revision,release_set_id,task_id,capability_id,resource_scope,mode,decision,reason,recorded_at_unix_millis)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,'RESOLVED','EXACT_CONTEXT',$8)`, binding.ID, binding.Revision, request.ReleaseSetID, request.TaskID, request.CapabilityID, request.ResourceScope, request.Mode, nowUnixMillis)
+	return capability.CandidateBindingResolution{Binding: binding, Mode: binding.Context.Mode, Reason: "EXACT_CONTEXT"}, nil
+}
+
+func (r *CapabilityRepository) RevokeCandidateBinding(ctx context.Context, id capability.CapabilityBindingID, revision int64, nowUnixMillis int64) (bool, error) {
+	tx, err := r.pool.Begin(ctx)
+	if err != nil {
+		return false, err
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	var binding capability.CandidateBinding
+	err = tx.QueryRow(ctx, `UPDATE capability.release_candidate_bindings SET status='REVOKED' WHERE binding_id=$1 AND revision=$2 AND status='ACTIVE'
+		RETURNING binding_id,revision,base_active_binding_id,base_active_binding_revision,release_set_id,slot,task_id,task_revision,principal_id,capability_id,resource_scope,mode,target_kind,target_ref,target_digest,authority_grant_id,target_origin,delivery_path,receipt_path,protocol,created_at_unix_millis,expires_at_unix_millis,status`, id, revision).
+		Scan(&binding.ID, &binding.Revision, &binding.BaseActiveBindingID, &binding.BaseActiveBindingRevision, &binding.Context.ReleaseSetID, &binding.Context.Slot, &binding.Context.TaskID, &binding.Context.TaskRevision, &binding.Context.PrincipalID, &binding.Context.CapabilityID, &binding.Context.ResourceScope, &binding.Context.Mode, &binding.Context.TargetKind, &binding.Context.TargetRef, &binding.Context.TargetDigest, &binding.Context.AuthorityGrantID, &binding.TargetOrigin, &binding.DeliveryPath, &binding.ReceiptPath, &binding.Protocol, &binding.CreatedAtUnixMillis, &binding.ExpiresAtUnixMillis, &binding.Status)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return false, nil
+		}
+		return false, err
+	}
+	_, err = tx.Exec(ctx, `DELETE FROM capability.release_candidate_binding_heads WHERE release_set_id=$1 AND slot=$2 AND task_id=$3 AND principal_id=$4 AND capability_id=$5 AND resource_scope=$6 AND mode=$7 AND binding_id=$8 AND revision=$9`, binding.Context.ReleaseSetID, binding.Context.Slot, binding.Context.TaskID, binding.Context.PrincipalID, binding.Context.CapabilityID, binding.Context.ResourceScope, binding.Context.Mode, binding.ID, binding.Revision)
+	if err != nil {
+		return false, err
+	}
+	_, err = tx.Exec(ctx, `INSERT INTO capability.release_candidate_binding_audit (binding_id,revision,release_set_id,task_id,capability_id,resource_scope,mode,decision,reason,recorded_at_unix_millis)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,'REVOKED','EXPLICIT_REVOKE',$8)`, binding.ID, binding.Revision, binding.Context.ReleaseSetID, binding.Context.TaskID, binding.Context.CapabilityID, binding.Context.ResourceScope, binding.Context.Mode, nowUnixMillis)
+	if err != nil {
+		return false, err
+	}
+	return true, tx.Commit(ctx)
+}
+
 func (r *CapabilityRepository) SaveProviderInstance(ctx context.Context, value capability.ProviderInstance) error {
 	_, err := r.pool.Exec(ctx, `INSERT INTO capability.cognitive_provider_instances
 		(provider_instance_id,revision,provider_kind,endpoint_ref,credential_ref,enabled,qualification,health,observed_at_unix_millis,billing_mode,auth_mode,input_cost_micros,output_cost_micros,request_cost_micros)

adapters/postgres/commit_repository.go

@@ -111,6 +111,29 @@ func (r *CommitRepository) FinishAttempt(ctx context.Context, a commitcontract.A
 	return nil
 }
 
+func (r *CommitRepository) SaveExecutionReceipt(ctx context.Context, receipt commitcontract.ExecutionReceipt) error {
+	if !receipt.Valid() {
+		return ErrActionAttemptConflict
+	}
+	completed := int64(0)
+	if receipt.CompletedAtUnixMillis != nil {
+		completed = *receipt.CompletedAtUnixMillis
+	}
+	result, err := r.pool.Exec(ctx, `INSERT INTO commit.execution_receipts (
+		receipt_id,action_attempt_id,executor_implementation_ref,external_operation_ref,external_request_id,request_digest,response_digest,dispatch_at_unix_millis,completed_at_unix_millis,
+		executor_result,reconciliation_key,raw_artifact_ref,delivery_mode,external_delivery_attempted,release_set_id,task_id,task_revision,capability_binding_id,capability_binding_revision,target_reference)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20) ON CONFLICT (receipt_id) DO NOTHING`,
+		receipt.ID, receipt.ActionAttemptRef, receipt.ExecutorImplementationRef, receipt.ExternalOperationRef, receipt.ExternalRequestID, receipt.RequestDigest, receipt.ResponseDigest, receipt.DispatchAtUnixMillis, completed,
+		receipt.ExecutorResult, receipt.ReconciliationKey, receipt.RawArtifactRef, receipt.DeliveryMode, receipt.ExternalDeliveryAttempted, receipt.ReleaseSetID, receipt.TaskID, receipt.TaskRevision, receipt.CapabilityBindingID, receipt.CapabilityBindingRevision, receipt.TargetReference)
+	if err != nil {
+		return err
+	}
+	if result.RowsAffected() != 1 {
+		return ErrActionAttemptConflict
+	}
+	return nil
+}
+
 func (r *CommitRepository) LoadAuthorized(ctx context.Context, id commitcontract.AuthorizedActionID) (commitcontract.AuthorizedAction, error) {
 	return loadAuthorized(ctx, r.pool, id)
 }

adapters/postgres/identity_repository.go

@@ -62,3 +62,13 @@ func (r *IdentityRepository) UpdateCreatorPassword(ctx context.Context, actor id
 	}
 	return nil
 }
+
+func (r *IdentityRepository) LoadServicePrincipal(ctx context.Context, principal identity.PrincipalID) (identity.ServicePrincipal, error) {
+	var value identity.ServicePrincipal
+	err := r.pool.QueryRow(ctx, `SELECT actor_id, principal_id, kind, purpose, synthetic_scope, active, revision FROM identity.service_principals WHERE principal_id=$1`, principal).
+		Scan(&value.ActorID, &value.PrincipalID, &value.Kind, &value.Purpose, &value.SyntheticScope, &value.Active, &value.Revision)
+	if err != nil {
+		return identity.ServicePrincipal{}, fmt.Errorf("load service principal: %w", err)
+	}
+	return value, nil
+}

adapters/postgres/self_repository.go

@@ -13,6 +13,13 @@ import (
 // evidence. It never evaluates, promotes or changes Capability state.
 type SelfRepository struct{ pool *pgxpool.Pool }
 
+type AcceptanceSummary struct {
+	LearningSignals    int    `json:"learning_signals"`
+	ImprovementNeeds   int    `json:"improvement_needs"`
+	LearningLedger     int    `json:"learning_ledger"`
+	SyntheticPrincipal string `json:"synthetic_principal"`
+}
+
 func OpenSelf(ctx context.Context, config ContinuityConfig) (*SelfRepository, error) {
 	pool, err := openPool(ctx, config)
 	if err != nil {
@@ -23,6 +30,21 @@ func OpenSelf(ctx context.Context, config ContinuityConfig) (*SelfRepository, er
 
 func (r *SelfRepository) Close() { r.pool.Close() }
 
+func (r *SelfRepository) AcceptanceSummary(ctx context.Context, principalID string) (AcceptanceSummary, error) {
+	var value AcceptanceSummary
+	value.SyntheticPrincipal = principalID
+	if err := r.pool.QueryRow(ctx, `SELECT COUNT(*) FROM self.learning_signals WHERE principal_id=$1`, principalID).Scan(&value.LearningSignals); err != nil {
+		return AcceptanceSummary{}, err
+	}
+	if err := r.pool.QueryRow(ctx, `SELECT COUNT(*) FROM self.improvement_needs WHERE principal_id=$1`, principalID).Scan(&value.ImprovementNeeds); err != nil {
+		return AcceptanceSummary{}, err
+	}
+	if err := r.pool.QueryRow(ctx, `SELECT COUNT(*) FROM self.learning_ledger WHERE principal_id=$1`, principalID).Scan(&value.LearningLedger); err != nil {
+		return AcceptanceSummary{}, err
+	}
+	return value, nil
+}
+
 func (r *SelfRepository) SaveImprovementNeed(ctx context.Context, value selfcontract.ImprovementNeed) error {
 	subject, err := json.Marshal(value.SubjectRef)
 	if err != nil {

cmd/auth-acceptance-harness/main.go

@@ -0,0 +1,108 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"git.cin.su/m/Assistant/contracts/identity"
+	"git.cin.su/m/Assistant/contracts/interaction"
+)
+
+const tokenPath = "/run/secrets/acceptance_harness_service_token"
+
+type client struct {
+	base  string
+	token string
+	http  *http.Client
+}
+
+func main() {
+	base := strings.TrimRight(os.Getenv("CORE_RUNTIME_URL"), "/")
+	if base == "" {
+		base = "http://core-runtime-candidate:8080"
+	}
+	token, err := os.ReadFile(tokenPath)
+	if err != nil {
+		fail("acceptance credential unavailable")
+	}
+	c := client{base: base, token: strings.TrimSpace(string(token)), http: &http.Client{Timeout: 90 * time.Second}}
+	if strings.TrimSpace(c.token) == "" {
+		fail("acceptance credential unavailable")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer cancel()
+	var issued struct {
+		Token   string
+		Session identity.CreatorSession
+	}
+	if err := c.post(ctx, "/v1/acceptance/sessions", nil, &issued); err != nil {
+		fail("acceptance authentication failed: " + err.Error())
+	}
+	if issued.Token == "" || issued.Session.PrincipalKind != identity.PrincipalKindService {
+		fail("acceptance principal was not authenticated as service")
+	}
+	c.token = issued.Token
+	var first interaction.ChatMessageResponse
+	if err := c.post(ctx, "/v1/creator/chat/messages", interaction.ChatMessageRequest{Message: "synthetic acceptance statement", CorrelationID: "acceptance-harness", SyntheticAcceptance: true, SyntheticScopeID: "synthetic-acceptance-scope"}, &first); err != nil {
+		fail("synthetic interaction failed: " + err.Error())
+	}
+	var corrected interaction.ChatMessageResponse
+	if err := c.post(ctx, "/v1/creator/chat/messages", interaction.ChatMessageRequest{ConversationID: first.ConversationID, Message: "synthetic acceptance correction", CorrelationID: "acceptance-harness-correction", CorrectsUtteranceID: first.UtteranceID, SyntheticAcceptance: true, SyntheticScopeID: "synthetic-acceptance-scope"}, &corrected); err != nil {
+		fail("synthetic correction failed: " + err.Error())
+	}
+	var summary struct {
+		LearningSignals  int `json:"learning_signals"`
+		ImprovementNeeds int `json:"improvement_needs"`
+		LearningLedger   int `json:"learning_ledger"`
+	}
+	if err := c.get(ctx, "/v1/acceptance/self/summary", &summary); err != nil {
+		fail("acceptance SELF summary unavailable: " + err.Error())
+	}
+	fmt.Printf("acceptance_pass learning_signals=%d improvement_needs=%d learning_ledger=%d\n", summary.LearningSignals, summary.ImprovementNeeds, summary.LearningLedger)
+}
+
+func (c client) post(ctx context.Context, path string, body any, out any) error {
+	return c.request(ctx, http.MethodPost, path, body, out)
+}
+func (c client) get(ctx context.Context, path string, out any) error {
+	return c.request(ctx, http.MethodGet, path, nil, out)
+}
+func (c client) request(ctx context.Context, method, path string, body any, out any) error {
+	var reader io.Reader
+	if body != nil {
+		data, err := json.Marshal(body)
+		if err != nil {
+			return err
+		}
+		reader = bytes.NewReader(data)
+	}
+	req, err := http.NewRequestWithContext(ctx, method, c.base+path, reader)
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Authorization", "Bearer "+c.token)
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("acceptance request denied with status %d", resp.StatusCode)
+	}
+	if out != nil && json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(out) != nil {
+		return errors.New("invalid acceptance response")
+	}
+	return nil
+}
+func fail(message string) { fmt.Fprintln(os.Stderr, message); os.Exit(1) }

cmd/cognitive-worker/model_qualification.go

@@ -4,8 +4,11 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"log"
 	"net/http"
 	"slices"
+	"sort"
+	"strings"
 	"sync"
 	"time"
 
@@ -53,8 +56,83 @@ type modelQualificationResponse struct {
 	Results              []modelQualificationResult    `json:"results"`
 }
 
+const qualificationControlPlaneTimeout = 45 * time.Second
+
+// qualificationCoordinator bounds duplicate control-plane probes within one
+// cognitive-worker process. It is deliberately not canonical state: the
+// Capability owner remains the sole owner of qualification evidence and
+// activation. A restart may repeat an incomplete probe, but cannot create a
+// second semantic writer or bypass independent evaluation.
+type qualificationCoordinator struct {
+	mu      sync.Mutex
+	flights map[string]*qualificationFlight
+}
+
+type qualificationFlight struct {
+	done     chan struct{}
+	response modelQualificationResponse
+	err      error
+	waiters  int
+}
+
+func (c *qualificationCoordinator) do(ctx context.Context, key string, operation func() (modelQualificationResponse, error)) (modelQualificationResponse, bool, error) {
+	c.mu.Lock()
+	if c.flights == nil {
+		c.flights = make(map[string]*qualificationFlight)
+	}
+	if current, exists := c.flights[key]; exists {
+		current.waiters++
+		c.mu.Unlock()
+		select {
+		case <-current.done:
+			return current.response, false, current.err
+		case <-ctx.Done():
+			return modelQualificationResponse{}, false, ctx.Err()
+		}
+	}
+	current := &qualificationFlight{done: make(chan struct{})}
+	c.flights[key] = current
+	c.mu.Unlock()
+
+	current.response, current.err = operation()
+	close(current.done)
+	c.mu.Lock()
+	delete(c.flights, key)
+	c.mu.Unlock()
+	return current.response, true, current.err
+}
+
+type qualificationPhaseTrace struct {
+	correlationID string
+	started       time.Time
+}
+
+func newQualificationPhaseTrace() qualificationPhaseTrace {
+	correlationID, err := ids.New()
+	if err != nil {
+		correlationID = ids.ID(fmt.Sprintf("qualification-%d", time.Now().UnixNano()))
+	}
+	return qualificationPhaseTrace{correlationID: string(correlationID), started: time.Now()}
+}
+
+func (t qualificationPhaseTrace) phase(name string, fields ...string) {
+	log.Printf("qualification_phase correlation_id=%s phase=%s elapsed_ms=%d %s", t.correlationID, name, time.Since(t.started).Milliseconds(), strings.Join(fields, " "))
+}
+
+func qualificationFlightKey(provider string, modelIDs []capability.ProviderModelID) string {
+	ids := make([]string, 0, len(modelIDs))
+	for _, modelID := range modelIDs {
+		ids = append(ids, string(modelID))
+	}
+	sort.Strings(ids)
+	return provider + "|" + strings.Join(ids, ",")
+}
+
 func modelQualificationHandler(providers map[string]providerRegistration, owner string, observers ...qualificationObserver) http.Handler {
+	coordinator := &qualificationCoordinator{}
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		trace := newQualificationPhaseTrace()
+		trace.phase("Q0", "event=request_accepted")
 		name := r.PathValue("provider")
 		registration, ok := providers[name]
 		if !ok || registration.Discovery == nil || registration.Provider == nil {
@@ -72,32 +150,65 @@ func modelQualificationHandler(providers map[string]providerRegistration, owner
 			http.Error(w, "max_output_bytes exceeds qualification bound", http.StatusBadRequest)
 			return
 		}
-		modelsFound, probe := registration.Discovery.Discover(r.Context())
-		if probe.Health != capability.HealthAvailable || len(modelsFound) == 0 {
-			http.Error(w, "provider unavailable for qualification", http.StatusServiceUnavailable)
-			return
+		controlCtx, cancel := context.WithTimeout(r.Context(), qualificationControlPlaneTimeout)
+		defer cancel()
+		response, leader, err := coordinator.do(controlCtx, qualificationFlightKey(name, request.ModelIDs), func() (modelQualificationResponse, error) {
+			trace.phase("Q1", "event=binding_candidate_loaded")
+			modelsFound, probe := registration.Discovery.Discover(controlCtx)
+			if probe.Health != capability.HealthAvailable || len(modelsFound) == 0 {
+				return modelQualificationResponse{}, fmt.Errorf("provider unavailable for qualification")
+			}
+			if len(request.ModelIDs) > 0 {
+				modelsFound = slices.DeleteFunc(modelsFound, func(model models.DiscoveredModel) bool {
+					return !slices.Contains(request.ModelIDs, model.ProviderModelID)
+				})
+			}
+			if len(modelsFound) == 0 {
+				return modelQualificationResponse{}, fmt.Errorf("requested model not discovered")
+			}
+			if len(modelsFound) > 16 {
+				modelsFound = modelsFound[:16]
+			}
+			trace.phase("Q2", fmt.Sprintf("event=provider_model_resolved model_count=%d", len(modelsFound)))
+			trace.phase("Q3", "event=bounded_invocation_started")
+			results := qualifyModels(controlCtx, registration, owner, request.Prompt, request.MaxOutputBytes, modelsFound)
+			trace.phase("Q4", "event=bounded_invocation_completed")
+			trace.phase("Q5", fmt.Sprintf("event=invocation_evidence_built result_count=%d", len(results)))
+			if len(observers) > 0 && observers[0] != nil {
+				trace.phase("Q6", "event=observation_persistence_started")
+				if err := persistQualificationResults(controlCtx, observers[0], registration, results); err != nil {
+					return modelQualificationResponse{}, fmt.Errorf("persist model qualification observation: %w", err)
+				}
+				trace.phase("Q7", "event=observation_persistence_completed")
+			}
+			// Q8-Q17 are intentionally outside this worker's authority. Capability
+			// owns independent evaluation and governed promotion; this trace makes
+			// that hand-off explicit instead of disguising it as activation.
+			trace.phase("Q8", "event=independent_evaluation_not_started owner=capability")
+			return modelQualificationResponse{Provider: registration.ProviderInstanceID, ObservedAtUnixMillis: time.Now().UnixMilli(), Results: results}, nil
+		})
+		if !leader {
+			trace.phase("Q0", "event=joined_in_progress_qualification")
 		}
-		if len(request.ModelIDs) > 0 {
-			modelsFound = slices.DeleteFunc(modelsFound, func(model models.DiscoveredModel) bool {
-				return !slices.Contains(request.ModelIDs, model.ProviderModelID)
-			})
-		}
-		if len(modelsFound) == 0 {
-			http.Error(w, "requested model not discovered", http.StatusNotFound)
-			return
-		}
-		if len(modelsFound) > 16 {
-			modelsFound = modelsFound[:16]
-		}
-		results := qualifyModels(r.Context(), registration, owner, request.Prompt, request.MaxOutputBytes, modelsFound)
-		if len(observers) > 0 && observers[0] != nil {
-			if err := persistQualificationResults(r.Context(), observers[0], registration, results); err != nil {
-				http.Error(w, "persist model qualification observation", http.StatusBadGateway)
+		if err != nil {
+			if controlCtx.Err() != nil {
+				http.Error(w, "qualification timeout", http.StatusGatewayTimeout)
 				return
 			}
+			if strings.Contains(err.Error(), "requested model not discovered") {
+				http.Error(w, "requested model not discovered", http.StatusNotFound)
+				return
+			}
+			if strings.Contains(err.Error(), "provider unavailable") {
+				http.Error(w, "provider unavailable for qualification", http.StatusServiceUnavailable)
+				return
+			}
+			http.Error(w, "persist model qualification observation", http.StatusBadGateway)
+			return
 		}
+		trace.phase("Q17", "event=qualification_response_returned activation=not_attempted")
 		w.Header().Set("Content-Type", "application/json")
-		_ = jsonEncode(w, modelQualificationResponse{Provider: registration.ProviderInstanceID, ObservedAtUnixMillis: time.Now().UnixMilli(), Results: results})
+		_ = jsonEncode(w, response)
 	})
 }
 

cmd/cognitive-worker/model_qualification_test.go

@@ -6,6 +6,7 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 
 	"git.cin.su/m/Assistant/adapters/models"
 	"git.cin.su/m/Assistant/contracts/capability"
@@ -17,6 +18,7 @@ type qualificationProvider struct{}
 func (qualificationProvider) Probe(context.Context) models.ProviderProbe {
 	return models.ProviderProbe{Health: capability.HealthAvailable}
 }
+
 func (qualificationProvider) Discover(context.Context) ([]models.DiscoveredModel, models.ProviderProbe) {
 	return []models.DiscoveredModel{{ProviderModelID: "model-a"}, {ProviderModelID: "model-b"}}, models.ProviderProbe{Health: capability.HealthAvailable}
 }
@@ -83,3 +85,63 @@ func TestModelQualificationPersistsReachabilityWithoutQuality(t *testing.T) {
 		t.Fatalf("invalid qualification observation: %+v err=%v", observer.observations[0], err)
 	}
 }
+
+func TestModelQualificationDeduplicatesSameProviderModelFlight(t *testing.T) {
+	coordinator := &qualificationCoordinator{}
+	started := make(chan struct{})
+	release := make(chan struct{})
+	firstDone := make(chan struct{})
+	secondDone := make(chan struct{})
+	result := modelQualificationResponse{Provider: "medium"}
+	go func() {
+		_, _, err := coordinator.do(context.Background(), "medium|model-a", func() (modelQualificationResponse, error) {
+			close(started)
+			<-release
+			return result, nil
+		})
+		if err != nil {
+			t.Errorf("leader qualification failed: %v", err)
+		}
+		close(firstDone)
+	}()
+	select {
+	case <-started:
+	case <-time.After(time.Second):
+		t.Fatal("qualification invocation did not start")
+	}
+	go func() {
+		actual, leader, err := coordinator.do(context.Background(), "medium|model-a", func() (modelQualificationResponse, error) {
+			t.Error("duplicate qualification operation ran")
+			return modelQualificationResponse{}, nil
+		})
+		if err != nil || leader || actual.Provider != result.Provider {
+			t.Errorf("joined qualification response=%+v leader=%t err=%v", actual, leader, err)
+		}
+		close(secondDone)
+	}()
+	deadline := time.Now().Add(time.Second)
+	for {
+		coordinator.mu.Lock()
+		flight := coordinator.flights["medium|model-a"]
+		waiters := 0
+		if flight != nil {
+			waiters = flight.waiters
+		}
+		coordinator.mu.Unlock()
+		if waiters == 1 {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("second qualification did not join the in-progress flight")
+		}
+		time.Sleep(time.Millisecond)
+	}
+	close(release)
+	for _, done := range []chan struct{}{firstDone, secondDone} {
+		select {
+		case <-done:
+		case <-time.After(time.Second):
+			t.Fatal("qualification flight did not complete")
+		}
+	}
+}

cmd/commit-runtime/candidate_release_context.go

@@ -0,0 +1,41 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/identity"
+)
+
+// candidateReleaseContextFromRuntime accepts only deployment-owned metadata.
+// It never derives a candidate slot from an HTTP request or notification body.
+func candidateReleaseContextFromRuntime() (*capability.CandidateReleaseContext, error) {
+	const prefix = "CANDIDATE_"
+	release := os.Getenv(prefix + "RELEASE_SET_ID")
+	if release == "" {
+		return nil, nil
+	}
+	context := &capability.CandidateReleaseContext{
+		ReleaseSetID:     release,
+		Slot:             os.Getenv(prefix + "SLOT"),
+		TaskID:           os.Getenv(prefix + "TASK_ID"),
+		PrincipalID:      identity.PrincipalID(os.Getenv(prefix + "PRINCIPAL_ID")),
+		CapabilityID:     capability.CapabilityID(os.Getenv(prefix + "CAPABILITY_ID")),
+		ResourceScope:    os.Getenv(prefix + "RESOURCE_SCOPE"),
+		Mode:             capability.CandidateBindingMode(os.Getenv(prefix + "BINDING_MODE")),
+		TargetKind:       os.Getenv(prefix + "TARGET_KIND"),
+		TargetRef:        os.Getenv(prefix + "TARGET_REF"),
+		TargetDigest:     os.Getenv(prefix + "TARGET_DIGEST"),
+		AuthorityGrantID: os.Getenv(prefix + "AUTHORITY_GRANT_ID"),
+	}
+	var revision int64
+	if _, err := fmt.Sscan(os.Getenv(prefix+"TASK_REVISION"), &revision); err != nil {
+		return nil, fmt.Errorf("candidate task revision: %w", err)
+	}
+	context.TaskRevision = revision
+	if context.Slot == "" || context.TaskID == "" || context.TaskRevision < 1 || context.PrincipalID == "" || context.CapabilityID == "" || context.ResourceScope == "" || context.Mode == "" || context.TargetKind == "" || context.TargetRef == "" || context.TargetDigest == "" || context.AuthorityGrantID == "" {
+		return nil, fmt.Errorf("incomplete candidate release metadata")
+	}
+	return context, nil
+}

cmd/commit-runtime/candidate_release_context_test.go

@@ -0,0 +1,25 @@
+package main
+
+import "testing"
+
+func TestCandidateReleaseContextRequiresDeploymentMetadata(t *testing.T) {
+	t.Setenv("CANDIDATE_RELEASE_SET_ID", "assistant-slot-b")
+	if _, err := candidateReleaseContextFromRuntime(); err == nil {
+		t.Fatal("partial candidate metadata was accepted")
+	}
+	t.Setenv("CANDIDATE_SLOT", "b")
+	t.Setenv("CANDIDATE_TASK_ID", "GEN2-CAPABILITY-001")
+	t.Setenv("CANDIDATE_TASK_REVISION", "7")
+	t.Setenv("CANDIDATE_PRINCIPAL_ID", "domovoy-creator-principal")
+	t.Setenv("CANDIDATE_CAPABILITY_ID", "prospective-notification-delivery")
+	t.Setenv("CANDIDATE_RESOURCE_SCOPE", "synthetic-shadow-notification-v1")
+	t.Setenv("CANDIDATE_BINDING_MODE", "SHADOW")
+	t.Setenv("CANDIDATE_TARGET_KIND", "NOTIFICATION_SHADOW_RECEIVER")
+	t.Setenv("CANDIDATE_TARGET_REF", "notification-receiver-candidate")
+	t.Setenv("CANDIDATE_TARGET_DIGEST", "f9f9fa49a0727444c280c092d5bb340f3a8f33cf325c5396f5ae177a6666da35")
+	t.Setenv("CANDIDATE_AUTHORITY_GRANT_ID", "grant")
+	context, err := candidateReleaseContextFromRuntime()
+	if err != nil || context.ReleaseSetID != "assistant-slot-b" || context.TaskRevision != 7 {
+		t.Fatalf("context=%+v err=%v", context, err)
+	}
+}

cmd/commit-runtime/control_plane_authority_test.go

@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"git.cin.su/m/Assistant/contracts/authority"
+	"git.cin.su/m/Assistant/contracts/capability"
 	"git.cin.su/m/Assistant/contracts/identity"
 	"git.cin.su/m/Assistant/platform/ids"
 )
@@ -22,6 +23,25 @@ type delegatedAuthorityFake struct {
 	revoked bool
 }
 
+func TestCandidateBindingResolutionUsesServiceCredential(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1/internal/capability-bindings/candidate/resolve" || r.Header.Get("Authorization") != "Bearer service-token" {
+			t.Fatalf("unexpected candidate resolution request: %s %q", r.URL.Path, r.Header.Get("Authorization"))
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"reason":"EXACT_CONTEXT"}`))
+	}))
+	defer server.Close()
+	client, err := newCreatorCoreClient(server.URL, server.Client())
+	if err != nil {
+		t.Fatal(err)
+	}
+	client.serviceCredential = func() (string, error) { return "service-token", nil }
+	if _, err := client.ResolveCandidateCapabilityBinding(context.Background(), capability.CandidateReleaseContext{}); err != nil {
+		t.Fatalf("resolve candidate binding: %v", err)
+	}
+}
+
 func TestDelegatedAuthorityCredentialRotationRejectsOldToken(t *testing.T) {
 	root := t.TempDir()
 	tokenPath := filepath.Join(root, "control_plane_service_token")

cmd/commit-runtime/creator_clients.go

@@ -25,8 +25,9 @@ var (
 )
 
 type creatorCoreClient struct {
-	baseURL *url.URL
-	client  *http.Client
+	baseURL           *url.URL
+	client            *http.Client
+	serviceCredential func() (string, error)
 }
 
 type creatorContinuityClient struct {
@@ -121,6 +122,58 @@ func (c creatorCoreClient) CapabilityBinding(ctx context.Context, id capability.
 	return binding, nil
 }
 
+func (c creatorCoreClient) ResolveCandidateCapabilityBinding(ctx context.Context, context capability.CandidateReleaseContext) (capability.CandidateBindingResolution, error) {
+	var resolved capability.CandidateBindingResolution
+	status, err := c.postServiceAuthenticated(ctx, "/v1/internal/capability-bindings/candidate/resolve", context, &resolved)
+	if err != nil || status != http.StatusOK {
+		return capability.CandidateBindingResolution{}, errCreatorQueryUnavailable
+	}
+	return resolved, nil
+}
+
+func (c creatorCoreClient) postServiceAuthenticated(ctx context.Context, path string, value any, destination any) (int, error) {
+	if c.serviceCredential == nil {
+		return 0, errCreatorQueryUnavailable
+	}
+	credential, err := c.serviceCredential()
+	if err != nil || credential == "" {
+		return 0, errCreatorQueryUnavailable
+	}
+	return c.postWithAuthorization(ctx, path, value, destination, "Bearer "+credential)
+}
+
+func (c creatorCoreClient) post(ctx context.Context, path string, value any, destination any) (int, error) {
+	return c.postWithAuthorization(ctx, path, value, destination, "")
+}
+
+func (c creatorCoreClient) postWithAuthorization(ctx context.Context, path string, value any, destination any, authorization string) (int, error) {
+	target := *c.baseURL
+	target.Path, target.RawQuery = path, ""
+	body, err := json.Marshal(value)
+	if err != nil {
+		return 0, err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, target.String(), strings.NewReader(string(body)))
+	if err != nil {
+		return 0, err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	if authorization != "" {
+		request.Header.Set("Authorization", authorization)
+	}
+	response, err := c.client.Do(request)
+	if err != nil {
+		return 0, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode == http.StatusOK && destination != nil {
+		if err := json.NewDecoder(io.LimitReader(response.Body, 32<<10)).Decode(destination); err != nil {
+			return 0, err
+		}
+	}
+	return response.StatusCode, nil
+}
+
 func (c creatorCoreClient) get(ctx context.Context, path, authorization string, destination any) (int, error) {
 	target := *c.baseURL
 	target.Path = path

cmd/commit-runtime/execution.go

@@ -24,6 +24,7 @@ type executionRepository interface {
 	LoadLatestAttempt(context.Context, commitcontract.AuthorizedActionID) (commitcontract.ActionAttempt, error)
 	BeginAttempt(context.Context, commitcontract.ActionAttempt) error
 	FinishAttempt(context.Context, commitcontract.ActionAttempt) error
+	SaveExecutionReceipt(context.Context, commitcontract.ExecutionReceipt) error
 }
 
 type attemptRequest struct {
@@ -94,10 +95,17 @@ func executeAuthorized(ctx context.Context, repository executionRepository, exec
 	if err := repository.BeginAttempt(ctx, begun); err != nil {
 		return commitcontract.ActionAttempt{}, err
 	}
-	attempt, operationErr := commitdomain.Execute(action, attemptID, executor)
+	attempt, result, operationErr := commitdomain.ExecuteWithResult(action, attemptID, executor)
 	if err := repository.FinishAttempt(ctx, attempt); err != nil {
 		return commitcontract.ActionAttempt{}, err
 	}
+	if result.Receipt != nil {
+		receipt := *result.Receipt
+		receipt.ActionAttemptRef = attempt.ID
+		if err := repository.SaveExecutionReceipt(ctx, receipt); err != nil {
+			return commitcontract.ActionAttempt{}, err
+		}
+	}
 	return attempt, operationErr
 }
 

cmd/commit-runtime/execution_test.go

@@ -16,6 +16,12 @@ import (
 type fakeExecutionRepository struct {
 	action   commitcontract.AuthorizedAction
 	attempts []commitcontract.ActionAttempt
+	receipt  commitcontract.ExecutionReceipt
+}
+
+func (f *fakeExecutionRepository) SaveExecutionReceipt(_ context.Context, receipt commitcontract.ExecutionReceipt) error {
+	f.receipt = receipt
+	return nil
 }
 
 func (f *fakeExecutionRepository) LoadAuthorized(context.Context, commitcontract.AuthorizedActionID) (commitcontract.AuthorizedAction, error) {
@@ -47,7 +53,8 @@ type knownExecutor struct{ calls int }
 
 func (e *knownExecutor) Execute(commitcontract.AuthorizedAction) ports.ExecutionResult {
 	e.calls++
-	return ports.ExecutionResult{Known: true, Succeeded: true}
+	completed := int64(1)
+	return ports.ExecutionResult{Known: true, Succeeded: true, Receipt: &commitcontract.ExecutionReceipt{ID: "receipt-1", ExecutorImplementationRef: "test-executor", ExternalOperationRef: "SHADOW_CAPTURED", RequestDigest: "request", ExecutorResult: commitcontract.ExecutorReportedSuccess, ReconciliationKey: "receipt-1", DispatchAtUnixMillis: 1, CompletedAtUnixMillis: &completed}}
 }
 func (e *knownExecutor) Reconcile(commitcontract.AuthorizedAction) ports.ExecutionResult {
 	return ports.ExecutionResult{Known: true, Succeeded: true}
@@ -66,6 +73,9 @@ func TestExecutionIsDurablyBegunAndCannotBeBlindlyRepeated(t *testing.T) {
 	if result.Code != http.StatusOK || executor.calls != 1 || repository.attempts[0].State != commitcontract.ActionSucceeded {
 		t.Fatalf("status=%d calls=%d attempts=%#v", result.Code, executor.calls, repository.attempts)
 	}
+	if repository.receipt.ActionAttemptRef != repository.attempts[0].ID {
+		t.Fatalf("receipt attempt reference=%q want %q", repository.receipt.ActionAttemptRef, repository.attempts[0].ID)
+	}
 
 	repeated := httptest.NewRequest(http.MethodPost, "/v1/internal/authorized-actions/authorized-1/execute", strings.NewReader(`{"AttemptID":"attempt-2"}`))
 	repeated.Header.Set("Authorization", "Bearer secret")

cmd/commit-runtime/main.go

@@ -73,15 +73,18 @@ func main() {
 	if err != nil {
 		log.Fatal(err)
 	}
-	notificationSecret, err := readCommitSecretFile("NOTIFICATION_WRITE_TOKEN_FILE")
+	candidateContext, err := candidateReleaseContextFromRuntime()
 	if err != nil {
 		log.Fatal(err)
 	}
-	notificationSecretRef := os.Getenv("NOTIFICATION_WRITE_SECRET_REF")
-	if notificationSecretRef == "" {
-		log.Fatal("NOTIFICATION_WRITE_SECRET_REF is required")
+	notificationSecretRef, notificationSecret, err := notificationCredentialsFromRuntime(candidateContext != nil)
+	if err != nil {
+		log.Fatal(err)
 	}
-	dispatcher := operationDispatcher{continuityExecutor: continuityExecutor, continuityReconciler: continuityExecutor, bindings: creatorCore, secretRef: notificationSecretRef, secret: notificationSecret, client: creatorHTTPClient}
+	if candidateContext != nil {
+		creatorCore.serviceCredential = delegatedControlPlaneCredential
+	}
+	dispatcher := operationDispatcher{continuityExecutor: continuityExecutor, continuityReconciler: continuityExecutor, bindings: creatorCore, secretRef: notificationSecretRef, secret: notificationSecret, client: creatorHTTPClient, candidateContext: candidateContext}
 	mux := http.NewServeMux()
 	mux.Handle("/healthz", health.Handler{Runtime: "commit-runtime", SemanticGeneration: 1, ArchitectureGeneration: 1})
 	readinessClient := &http.Client{Timeout: 2 * time.Second}
@@ -162,6 +165,24 @@ func main() {
 	}
 }
 
+// notificationCredentialsFromRuntime keeps candidate shadow execution
+// physically separate from the production notification credential mount.
+func notificationCredentialsFromRuntime(candidate bool) (string, string, error) {
+	fileName, refName := "NOTIFICATION_WRITE_TOKEN_FILE", "NOTIFICATION_WRITE_SECRET_REF"
+	if candidate {
+		fileName, refName = "CANDIDATE_NOTIFICATION_WRITE_TOKEN_FILE", "CANDIDATE_NOTIFICATION_WRITE_SECRET_REF"
+	}
+	secret, err := readCommitSecretFile(fileName)
+	if err != nil {
+		return "", "", err
+	}
+	ref := os.Getenv(refName)
+	if ref == "" {
+		return "", "", fmt.Errorf("%s is required", refName)
+	}
+	return ref, secret, nil
+}
+
 func readCommitSecretFile(name string) (string, error) {
 	path := os.Getenv(name)
 	if path == "" {

cmd/commit-runtime/notification_executor.go

@@ -14,6 +14,7 @@ import (
 type notificationBindingSource interface {
 	ActiveCapabilityBinding(context.Context, capability.CapabilityID, identity.PrincipalID) (capability.Binding, error)
 	CapabilityBinding(context.Context, capability.CapabilityBindingID, int64) (capability.Binding, error)
+	ResolveCandidateCapabilityBinding(context.Context, capability.CandidateReleaseContext) (capability.CandidateBindingResolution, error)
 }
 
 type operationDispatcher struct {
@@ -23,6 +24,7 @@ type operationDispatcher struct {
 	secretRef            string
 	secret               string
 	client               *http.Client
+	candidateContext     *capability.CandidateReleaseContext
 }
 
 func (d operationDispatcher) Execute(action commitcontract.AuthorizedAction) ports.ExecutionResult {
@@ -30,6 +32,20 @@ func (d operationDispatcher) Execute(action commitcontract.AuthorizedAction) por
 		return d.continuityExecutor.Execute(action)
 	}
 	subject := action.Proposal.NotificationSubject
+	if d.candidateContext != nil {
+		resolved, err := d.bindings.ResolveCandidateCapabilityBinding(context.Background(), *d.candidateContext)
+		if err != nil || resolved.Mode != capability.CandidateBindingModeShadow || resolved.Binding.Context != *d.candidateContext {
+			return ports.ExecutionResult{Known: true}
+		}
+		if subject.BindingID != resolved.Binding.BaseActiveBindingID || subject.BindingRevision != resolved.Binding.BaseActiveBindingRevision {
+			return ports.ExecutionResult{Known: true}
+		}
+		executor, err := notificationexecutor.NewShadow(resolved.Binding, d.secret, d.client)
+		if err != nil {
+			return ports.ExecutionResult{Known: true}
+		}
+		return executor.Execute(action)
+	}
 	exact, err := d.bindings.CapabilityBinding(context.Background(), subject.BindingID, subject.BindingRevision)
 	if err != nil || exact.SecretRef != d.secretRef {
 		return ports.ExecutionResult{Known: true}
@@ -49,6 +65,11 @@ func (d operationDispatcher) Reconcile(action commitcontract.AuthorizedAction) p
 	if action.Proposal.Operation != commitcontract.OperationDeliverProspectiveNotification {
 		return d.continuityReconciler.Reconcile(action)
 	}
+	if d.candidateContext != nil {
+		// A candidate shadow delivery is never reconciled against the ACTIVE
+		// production target. Its typed receipt is the sole candidate evidence.
+		return ports.ExecutionResult{Known: true}
+	}
 	subject := action.Proposal.NotificationSubject
 	exact, err := d.bindings.CapabilityBinding(context.Background(), subject.BindingID, subject.BindingRevision)
 	if err != nil || exact.SecretRef != d.secretRef {

cmd/commit-runtime/notification_executor_test.go

@@ -3,21 +3,43 @@ package main
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"testing"
 
 	"git.cin.su/m/Assistant/adapters/notificationexecutor"
 	"git.cin.su/m/Assistant/contracts/capability"
 	commitcontract "git.cin.su/m/Assistant/contracts/commit"
 	"git.cin.su/m/Assistant/contracts/identity"
+	capabilitydomain "git.cin.su/m/Assistant/modules/capability/domain"
 )
 
+func TestCandidateNotificationCredentialsDoNotFallbackToProductionCredential(t *testing.T) {
+	path := t.TempDir() + "/candidate-token"
+	if err := os.WriteFile(path, []byte("candidate-only-token"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("CANDIDATE_NOTIFICATION_WRITE_TOKEN_FILE", path)
+	t.Setenv("CANDIDATE_NOTIFICATION_WRITE_SECRET_REF", "credential://domovoy/candidate/notification-write/v1")
+	ref, secret, err := notificationCredentialsFromRuntime(true)
+	if err != nil || ref == "" || secret != "candidate-only-token" {
+		t.Fatalf("candidate credential resolution failed: ref=%q err=%v", ref, err)
+	}
+	t.Setenv("CANDIDATE_NOTIFICATION_WRITE_TOKEN_FILE", "")
+	if _, _, err := notificationCredentialsFromRuntime(true); err == nil {
+		t.Fatal("candidate path fell back to production notification credential")
+	}
+}
+
 type fakeNotificationBindings struct {
-	exact     capability.Binding
-	active    capability.Binding
-	exactErr  error
-	activeErr error
+	exact        capability.Binding
+	active       capability.Binding
+	exactErr     error
+	activeErr    error
+	candidate    capability.CandidateBindingResolution
+	candidateErr error
 }
 
 func (f fakeNotificationBindings) CapabilityBinding(context.Context, capability.CapabilityBindingID, int64) (capability.Binding, error) {
@@ -26,6 +48,9 @@ func (f fakeNotificationBindings) CapabilityBinding(context.Context, capability.
 func (f fakeNotificationBindings) ActiveCapabilityBinding(context.Context, capability.CapabilityID, identity.PrincipalID) (capability.Binding, error) {
 	return f.active, f.activeErr
 }
+func (f fakeNotificationBindings) ResolveCandidateCapabilityBinding(context.Context, capability.CandidateReleaseContext) (capability.CandidateBindingResolution, error) {
+	return f.candidate, f.candidateErr
+}
 
 func dispatcherAction(t *testing.T, binding capability.Binding) commitcontract.AuthorizedAction {
 	t.Helper()
@@ -81,3 +106,28 @@ func TestOperationDispatcherReconcilesRetiredHistoricalBinding(t *testing.T) {
 		t.Fatalf("reconcile=%+v", result)
 	}
 }
+
+func TestCandidateDispatcherUsesShadowBindingWithoutActiveFallback(t *testing.T) {
+	var action commitcontract.AuthorizedAction
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("X-Candidate-Release") != "assistant-slot-b" || r.Header.Get("X-Candidate-Task") != "GEN2-CAPABILITY-001" {
+			t.Fatalf("candidate headers missing")
+		}
+		_ = json.NewEncoder(w).Encode(notificationexecutor.Receipt{ReceiptID: "shadow-1", ActionIntentID: action.Proposal.IntentID, RequestDigest: action.Proposal.NotificationSubject.RequestDigest, AcceptedAt: 1, DeliveryMode: "SHADOW"})
+	}))
+	defer server.Close()
+	stable := dispatcherBinding("https://stable.invalid")
+	action = dispatcherAction(t, stable)
+	context := capability.CandidateReleaseContext{ReleaseSetID: "assistant-slot-b", Slot: "b", TaskID: "GEN2-CAPABILITY-001", TaskRevision: 7, PrincipalID: stable.OwnerPrincipalID, CapabilityID: stable.CapabilityID, ResourceScope: "synthetic-shadow-notification-v1", Mode: capability.CandidateBindingModeShadow, TargetKind: "NOTIFICATION_SHADOW_RECEIVER", TargetRef: "notification-receiver-candidate", AuthorityGrantID: "grant"}
+	candidate := capability.CandidateBinding{ID: "candidate-1", Revision: 1, BaseActiveBindingID: stable.ID, BaseActiveBindingRevision: stable.Revision, Context: context, TargetOrigin: server.URL, DeliveryPath: "/delivery/v1/deliveries", ReceiptPath: "/delivery/v1/receipts", Protocol: capability.ProtocolIdempotentReceiptV1, CreatedAtUnixMillis: 1, ExpiresAtUnixMillis: 100, Status: capability.CandidateBindingActive}
+	digest, err := capabilitydomain.CandidateTargetDigest(candidate)
+	if err != nil {
+		t.Fatal(err)
+	}
+	context.TargetDigest, candidate.Context.TargetDigest = digest, digest
+	dispatcher := operationDispatcher{continuityExecutor: &knownExecutor{}, continuityReconciler: &knownExecutor{}, bindings: fakeNotificationBindings{activeErr: errors.New("stable fallback must not run"), candidate: capability.CandidateBindingResolution{Binding: candidate, Mode: capability.CandidateBindingModeShadow}}, secret: "shadow-secret", client: server.Client(), candidateContext: &context}
+	result := dispatcher.Execute(action)
+	if !result.Known || !result.Succeeded || result.Receipt == nil || result.Receipt.DeliveryMode != "SHADOW" {
+		t.Fatalf("candidate result=%+v", result)
+	}
+}

cmd/core-runtime/control_plane_authority_test.go

@@ -37,3 +37,26 @@ func TestControlPlaneCredentialUsesDedicatedSecretRoot(t *testing.T) {
 		t.Fatalf("control-plane credential resolution failed: %v", err)
 	}
 }
+
+func TestCandidateControlPlaneAuthenticationRejectsMissingOrWrongCredential(t *testing.T) {
+	credential := func() (string, error) { return "service-token", nil }
+	for _, authorization := range []string{"", "Bearer other-token", "Basic service-token"} {
+		request := httptest.NewRequest(http.MethodPost, "/v1/internal/capability-bindings/candidate/resolve", nil)
+		request.Header.Set("Authorization", authorization)
+		if candidateControlPlaneAuthenticated(request, credential) {
+			t.Fatalf("authorization %q was accepted", authorization)
+		}
+	}
+	request := httptest.NewRequest(http.MethodPost, "/v1/internal/capability-bindings/candidate/resolve", nil)
+	request.Header.Set("Authorization", "Bearer service-token")
+	if !candidateControlPlaneAuthenticated(request, credential) {
+		t.Fatal("expected service credential to be accepted")
+	}
+}
+
+func TestCandidateReleaseContextRequiresCompleteRuntimeMetadata(t *testing.T) {
+	t.Setenv("CANDIDATE_RELEASE_SET_ID", "assistant-slot-b")
+	if _, err := candidateReleaseContextFromRuntime(); err == nil {
+		t.Fatal("partial candidate runtime metadata was accepted")
+	}
+}

cmd/core-runtime/main.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"crypto/subtle"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -46,9 +47,64 @@ const (
 	epistemicsDBPasswordPath     = "/run/secrets/epistemics_db_password"
 	interactionDBPasswordPath    = "/run/secrets/interaction_db_password"
 	selfDBPasswordPath           = "/run/secrets/self_db_password"
+	acceptanceHarnessTokenPath   = "/run/secrets/acceptance_harness_service_token"
 	controlPlaneServiceTokenFile = "control_plane_service_token"
 )
 
+func candidateAuthorityResource(context capability.CandidateReleaseContext, origin string) authority.CandidateCapabilityBindingResource {
+	digest := context.TargetDigest
+	if origin != "" {
+		calculated, err := capabilitydomain.CandidateTargetDigest(capability.CandidateBinding{Context: context, TargetOrigin: origin, Protocol: capability.ProtocolIdempotentReceiptV1})
+		if err != nil {
+			digest = ""
+		} else {
+			digest = calculated
+		}
+	}
+	return authority.CandidateCapabilityBindingResource{ReleaseSetID: context.ReleaseSetID, Slot: context.Slot, CapabilityID: string(context.CapabilityID), ResourceScope: context.ResourceScope, Mode: string(context.Mode), TargetKind: context.TargetKind, TargetRef: context.TargetRef, TargetDigest: digest}
+}
+
+// candidateReleaseContextFromRuntime accepts only deployment-owned metadata.
+// Candidate HTTP callers cannot choose a release identity for this runtime.
+func candidateReleaseContextFromRuntime() (*capability.CandidateReleaseContext, error) {
+	const prefix = "CANDIDATE_"
+	release := os.Getenv(prefix + "RELEASE_SET_ID")
+	if release == "" {
+		return nil, nil
+	}
+	context := &capability.CandidateReleaseContext{
+		ReleaseSetID:     release,
+		Slot:             os.Getenv(prefix + "SLOT"),
+		TaskID:           os.Getenv(prefix + "TASK_ID"),
+		PrincipalID:      identity.PrincipalID(os.Getenv(prefix + "PRINCIPAL_ID")),
+		CapabilityID:     capability.CapabilityID(os.Getenv(prefix + "CAPABILITY_ID")),
+		ResourceScope:    os.Getenv(prefix + "RESOURCE_SCOPE"),
+		Mode:             capability.CandidateBindingMode(os.Getenv(prefix + "BINDING_MODE")),
+		TargetKind:       os.Getenv(prefix + "TARGET_KIND"),
+		TargetRef:        os.Getenv(prefix + "TARGET_REF"),
+		TargetDigest:     os.Getenv(prefix + "TARGET_DIGEST"),
+		AuthorityGrantID: os.Getenv(prefix + "AUTHORITY_GRANT_ID"),
+	}
+	revision, err := strconv.ParseInt(os.Getenv(prefix+"TASK_REVISION"), 10, 64)
+	if err != nil {
+		return nil, fmt.Errorf("candidate task revision: %w", err)
+	}
+	context.TaskRevision = revision
+	if context.Slot == "" || context.TaskID == "" || context.TaskRevision < 1 || context.PrincipalID == "" || context.CapabilityID == "" || context.ResourceScope == "" || context.Mode == "" || context.TargetKind == "" || context.TargetRef == "" || context.TargetDigest == "" || context.AuthorityGrantID == "" {
+		return nil, errors.New("incomplete candidate release metadata")
+	}
+	return context, nil
+}
+
+func candidateControlPlaneAuthenticated(r *http.Request, credential func() (string, error)) bool {
+	if credential == nil {
+		return false
+	}
+	expected, err := credential()
+	presented := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+	return err == nil && expected != "" && presented != "" && subtle.ConstantTimeCompare([]byte(expected), []byte(presented)) == 1
+}
+
 const maxCreatorCredentialsBytes = 4 << 10
 
 func main() {
@@ -107,6 +163,18 @@ func main() {
 	if err := bootstrapCreatorAccount(context.Background(), identityRepository, creatorUsername, creatorPasswordPath); err != nil {
 		log.Fatal(err)
 	}
+	acceptanceServiceToken := ""
+	var acceptancePrincipal identity.ServicePrincipal
+	if os.Getenv("ACCEPTANCE_HARNESS_SERVICE_CREDENTIAL_REF") != "" {
+		acceptanceServiceToken, err = readCredentialRefSecretPurpose("ACCEPTANCE_HARNESS_SERVICE_TOKEN", "ACCEPTANCE_HARNESS_SERVICE_CREDENTIAL_REF", acceptanceHarnessTokenPath, secretcontracts.SecretPurposeServiceAuthentication)
+		if err != nil {
+			log.Fatal(err)
+		}
+		acceptancePrincipal, err = identityRepository.LoadServicePrincipal(context.Background(), identity.PrincipalID("domovoy-acceptance-harness-principal"))
+		if err != nil || !acceptancePrincipal.Active {
+			log.Fatal("acceptance service principal is unavailable")
+		}
+	}
 	interactionPassword, err := readCredentialRefSecret("INTERACTION_POSTGRES_PASSWORD", "INTERACTION_POSTGRES_CREDENTIAL_REF", interactionDBPasswordPath)
 	if err != nil {
 		log.Fatal(err)
@@ -147,6 +215,10 @@ func main() {
 	} else {
 		log.Printf("delegated control-plane authority is not configured; existing human control remains available")
 	}
+	candidateContext, err := candidateReleaseContextFromRuntime()
+	if err != nil {
+		log.Fatal(err)
+	}
 	reminderClient, err := newContinuityReminderClient(envOr("CONTINUITY_RUNTIME_URL", "http://continuity-runtime:8081"), &http.Client{Timeout: 5 * time.Second})
 	if err != nil {
 		log.Fatal(err)
@@ -171,12 +243,32 @@ func main() {
 	mux := http.NewServeMux()
 	authenticateCreator := func(w http.ResponseWriter, r *http.Request) (identity.CreatorSession, bool) {
 		session, err := identitydomain.ValidateCreatorSession(sessionKey, bearerToken(r), time.Now())
-		if err != nil {
+		if err != nil || (session.PrincipalKind != "" && session.PrincipalKind != identity.PrincipalKindHuman) {
 			http.Error(w, "creator session denied", http.StatusUnauthorized)
 			return identity.CreatorSession{}, false
 		}
 		return session, true
 	}
+	authenticateAcceptance := func(w http.ResponseWriter, r *http.Request) (identity.CreatorSession, bool) {
+		if acceptanceServiceToken == "" || acceptancePrincipal.Kind != identity.PrincipalKindService || !acceptancePrincipal.Active || !identitydomain.BootstrapMatches(acceptanceServiceToken, bearerToken(r)) {
+			http.Error(w, "acceptance authentication denied", http.StatusUnauthorized)
+			return identity.CreatorSession{}, false
+		}
+		_, session, err := identitydomain.IssueServiceSession(sessionKey, acceptancePrincipal, time.Now(), 30*time.Minute)
+		if err != nil {
+			http.Error(w, "acceptance session unavailable", http.StatusServiceUnavailable)
+			return identity.CreatorSession{}, false
+		}
+		return session, true
+	}
+	authenticateAcceptanceSession := func(w http.ResponseWriter, r *http.Request) (identity.CreatorSession, bool) {
+		session, err := identitydomain.ValidateCreatorSession(sessionKey, bearerToken(r), time.Now())
+		if err != nil || session.PrincipalKind != identity.PrincipalKindService || session.PrincipalID != acceptancePrincipal.PrincipalID || !acceptancePrincipal.Active {
+			http.Error(w, "acceptance session denied", http.StatusUnauthorized)
+			return identity.CreatorSession{}, false
+		}
+		return session, true
+	}
 	resolveFocus := func(r *http.Request) (situation.FocusBinding, error) {
 		runtime := situation.RuntimeBinding{SessionID: situation.SessionID(r.URL.Query().Get("session_id")), Workspace: situation.WorkspaceID(r.URL.Query().Get("workspace_id"))}
 		bindings, err := repository.ByRuntime(r.Context(), runtime)
@@ -227,6 +319,35 @@ func main() {
 		w.WriteHeader(http.StatusNoContent)
 	})
 	mux.HandleFunc("POST /v1/creator/sessions", creatorDatabaseSessionHandler(bootstrapToken, creatorUsername, identityRepository, sessionKey, time.Now))
+	mux.HandleFunc("POST /v1/acceptance/sessions", func(w http.ResponseWriter, r *http.Request) {
+		session, ok := authenticateAcceptance(w, r)
+		if !ok {
+			return
+		}
+		token, issued, err := identitydomain.IssueServiceSession(sessionKey, acceptancePrincipal, time.Now(), 30*time.Minute)
+		if err != nil {
+			http.Error(w, "acceptance session unavailable", http.StatusServiceUnavailable)
+			return
+		}
+		_ = session
+		writeCreatorSession(w, token, issued)
+	})
+	mux.HandleFunc("GET /v1/acceptance/self/summary", func(w http.ResponseWriter, r *http.Request) {
+		if _, ok := authenticateAcceptanceSession(w, r); !ok {
+			return
+		}
+		if selfRepository == nil {
+			http.Error(w, "SELF unavailable", http.StatusServiceUnavailable)
+			return
+		}
+		summary, err := selfRepository.AcceptanceSummary(r.Context(), string(acceptancePrincipal.PrincipalID))
+		if err != nil {
+			http.Error(w, "SELF summary unavailable", http.StatusServiceUnavailable)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(summary)
+	})
 	mux.HandleFunc("POST /v1/creator/account/password", func(w http.ResponseWriter, r *http.Request) {
 		session, ok := authenticateCreator(w, r)
 		if !ok {
@@ -537,15 +658,24 @@ func main() {
 		}{Experiences: experiences, Reflections: reflections, Skills: skills})
 	})
 	mux.HandleFunc("POST /v1/creator/chat/messages", func(w http.ResponseWriter, r *http.Request) {
-		session, ok := authenticateCreator(w, r)
+		var request interaction.ChatMessageRequest
+		body, readErr := io.ReadAll(http.MaxBytesReader(w, r.Body, interactiondomain.MaxHumanUtteranceBytes+1024))
+		if readErr != nil || json.Unmarshal(body, &request) != nil {
+			http.Error(w, "invalid chat message", http.StatusBadRequest)
+			return
+		}
+		var session identity.CreatorSession
+		var ok bool
+		if request.SyntheticAcceptance {
+			session, ok = authenticateAcceptanceSession(w, r)
+		} else {
+			session, ok = authenticateCreator(w, r)
+		}
 		if !ok {
 			return
 		}
-		var request interaction.ChatMessageRequest
-		decoder := json.NewDecoder(io.LimitReader(r.Body, interactiondomain.MaxHumanUtteranceBytes+1024))
-		decoder.DisallowUnknownFields()
-		if err := decoder.Decode(&request); err != nil || decoder.Decode(&struct{}{}) != io.EOF {
-			http.Error(w, "invalid chat message", http.StatusBadRequest)
+		if session.PrincipalKind == identity.PrincipalKindService && (!request.SyntheticAcceptance || request.SyntheticScopeID != acceptancePrincipal.SyntheticScope) {
+			http.Error(w, "synthetic acceptance scope denied", http.StatusForbidden)
 			return
 		}
 		now := time.Now()
@@ -1499,6 +1629,61 @@ func main() {
 		w.Header().Set("Content-Type", "application/json")
 		_ = json.NewEncoder(w).Encode(binding)
 	})
+	mux.HandleFunc("POST /v1/internal/capability-bindings/candidate", func(w http.ResponseWriter, r *http.Request) {
+		if delegatedAuthority == nil || candidateContext == nil {
+			http.Error(w, "delegated authority unavailable", http.StatusServiceUnavailable)
+			return
+		}
+		if !candidateControlPlaneAuthenticated(r, delegatedAuthority.credential) {
+			http.Error(w, "service principal denied", http.StatusUnauthorized)
+			return
+		}
+		var binding capability.CandidateBinding
+		decoder := json.NewDecoder(io.LimitReader(r.Body, 16*1024+1))
+		decoder.DisallowUnknownFields()
+		if err := decoder.Decode(&binding); err != nil || binding.Context != *candidateContext || capabilitydomain.ValidateCandidateBinding(binding) != nil {
+			http.Error(w, "invalid candidate binding", http.StatusBadRequest)
+			return
+		}
+		resource := candidateAuthorityResource(binding.Context, binding.TargetOrigin)
+		request := authority.DelegatedControlPlaneRequest{GrantID: authority.GrantID(binding.Context.AuthorityGrantID), TaskID: binding.Context.TaskID, TaskRevision: binding.Context.TaskRevision, Operation: authority.DelegatedOperationCreateCandidateCapabilityBinding, CandidateResource: resource}
+		if err := delegatedAuthority.authorize(r.Context(), request); err != nil || capabilityRepository.SaveCandidateBinding(r.Context(), binding) != nil {
+			delegatedAuthority.completed(r.Context(), request, false)
+			http.Error(w, "candidate binding denied", http.StatusForbidden)
+			return
+		}
+		delegatedAuthority.completed(r.Context(), request, true)
+		w.WriteHeader(http.StatusCreated)
+	})
+	mux.HandleFunc("POST /v1/internal/capability-bindings/candidate/resolve", func(w http.ResponseWriter, r *http.Request) {
+		if delegatedAuthority == nil || candidateContext == nil {
+			http.Error(w, "delegated authority unavailable", http.StatusServiceUnavailable)
+			return
+		}
+		if !candidateControlPlaneAuthenticated(r, delegatedAuthority.credential) {
+			http.Error(w, "service principal denied", http.StatusUnauthorized)
+			return
+		}
+		var context capability.CandidateReleaseContext
+		if err := json.NewDecoder(io.LimitReader(r.Body, 8*1024+1)).Decode(&context); err != nil || context != *candidateContext {
+			http.Error(w, "invalid candidate context", http.StatusBadRequest)
+			return
+		}
+		resource := candidateAuthorityResource(context, "")
+		request := authority.DelegatedControlPlaneRequest{GrantID: authority.GrantID(context.AuthorityGrantID), TaskID: context.TaskID, TaskRevision: context.TaskRevision, Operation: authority.DelegatedOperationUseCandidateCapabilityBinding, CandidateResource: resource}
+		if err := delegatedAuthority.authorize(r.Context(), request); err != nil {
+			http.Error(w, "candidate binding denied", http.StatusForbidden)
+			return
+		}
+		resolved, err := capabilityRepository.ResolveCandidateBinding(r.Context(), context, time.Now().UnixMilli())
+		delegatedAuthority.completed(r.Context(), request, err == nil)
+		if err != nil {
+			http.Error(w, "candidate binding required", http.StatusConflict)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(resolved)
+	})
 	mux.HandleFunc("GET /v1/cognitive-bindings/{id}/revisions/{revision}/snapshot", func(w http.ResponseWriter, r *http.Request) {
 		revision, err := strconv.ParseInt(r.PathValue("revision"), 10, 64)
 		if err != nil || revision < 1 {

cmd/notification-receiver/main.go

@@ -19,7 +19,12 @@ func main() {
 	if err != nil {
 		log.Fatal(err)
 	}
-	server, err := newReceiverServer(envOr("RECEIPT_DIRECTORY", "/var/lib/notification-receiver"), writeToken, readToken, time.Now)
+	var server *receiverServer
+	if os.Getenv("SHADOW_RECEIVER_MODE") == "1" {
+		server, err = newShadowReceiverServer(envOr("RECEIPT_DIRECTORY", "/var/lib/notification-receiver"), writeToken, readToken, os.Getenv("CANDIDATE_RELEASE_SET_ID"), os.Getenv("CANDIDATE_TASK_ID"), time.Now)
+	} else {
+		server, err = newReceiverServer(envOr("RECEIPT_DIRECTORY", "/var/lib/notification-receiver"), writeToken, readToken, time.Now)
+	}
 	if err != nil {
 		log.Fatal(err)
 	}

cmd/notification-receiver/server.go

@@ -32,8 +32,11 @@ type receiverServer struct {
 	writeToken string
 	readToken  string
 	now        func() time.Time
+	shadow     *shadowReceiverContext
 }
 
+type shadowReceiverContext struct{ releaseSetID, taskID string }
+
 func newReceiverServer(directory, writeToken, readToken string, now func() time.Time) (*receiverServer, error) {
 	if directory == "" || strings.TrimSpace(writeToken) == "" || strings.TrimSpace(readToken) == "" ||
 		writeToken == readToken || now == nil {
@@ -45,6 +48,15 @@ func newReceiverServer(directory, writeToken, readToken string, now func() time.
 	return &receiverServer{directory: directory, writeToken: writeToken, readToken: readToken, now: now}, nil
 }
 
+func newShadowReceiverServer(directory, writeToken, readToken, releaseSetID, taskID string, now func() time.Time) (*receiverServer, error) {
+	server, err := newReceiverServer(directory, writeToken, readToken, now)
+	if err != nil || releaseSetID == "" || taskID == "" {
+		return nil, errors.New("invalid shadow receiver configuration")
+	}
+	server.shadow = &shadowReceiverContext{releaseSetID: releaseSetID, taskID: taskID}
+	return server, nil
+}
+
 func (s *receiverServer) routes() http.Handler {
 	mux := http.NewServeMux()
 	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, _ *http.Request) {
@@ -62,6 +74,10 @@ func (s *receiverServer) put(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "receiver writer denied", http.StatusUnauthorized)
 		return
 	}
+	if s.shadow != nil && (r.Header.Get("X-Candidate-Release") != s.shadow.releaseSetID || r.Header.Get("X-Candidate-Task") != s.shadow.taskID) {
+		http.Error(w, "candidate shadow context denied", http.StatusForbidden)
+		return
+	}
 	intent := r.PathValue("intent")
 	if !safeIntent.MatchString(intent) {
 		http.Error(w, "invalid action intent", http.StatusBadRequest)
@@ -83,7 +99,13 @@ func (s *receiverServer) put(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "delivery digest mismatch", http.StatusConflict)
 		return
 	}
-	receipt := storedReceipt{Receipt: notificationexecutor.Receipt{ReceiptID: "receipt-" + intent, ActionIntentID: request.ActionIntentID, RequestDigest: digest, AcceptedAt: s.now().UnixMilli()}, Payload: request.Payload}
+	receipt := storedReceipt{Receipt: notificationexecutor.Receipt{ReceiptID: "receipt-" + intent, ActionIntentID: request.ActionIntentID, RequestDigest: digest, AcceptedAt: s.now().UnixMilli()}}
+	if s.shadow != nil {
+		receipt.DeliveryMode = "SHADOW"
+		receipt.ExternalDeliveryAttempted = false
+	} else {
+		receipt.Payload = request.Payload
+	}
 	created, existing, err := s.create(receipt)
 	if err != nil {
 		http.Error(w, "receipt unavailable", http.StatusInternalServerError)

cmd/notification-receiver/server_test.go

@@ -120,3 +120,31 @@ func TestConcurrentDuplicateCreatesOneReceipt(t *testing.T) {
 		t.Fatalf("created=%d", created)
 	}
 }
+
+func TestShadowReceiverRequiresContextAndDoesNotPersistPayload(t *testing.T) {
+	server, err := newShadowReceiverServer(t.TempDir(), "shadow-write", "shadow-read", "assistant-slot-b", "GEN2-CAPABILITY-001", func() time.Time { return time.UnixMilli(100) })
+	if err != nil {
+		t.Fatal(err)
+	}
+	value := delivery(t, "shadow-intent", "must not persist")
+	body, err := json.Marshal(value)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req := httptest.NewRequest(http.MethodPut, "/delivery/v1/deliveries/shadow-intent", bytes.NewReader(body))
+	req.Header.Set("Authorization", "Bearer shadow-write")
+	req.Header.Set("X-Candidate-Release", "assistant-slot-b")
+	req.Header.Set("X-Candidate-Task", "GEN2-CAPABILITY-001")
+	response := httptest.NewRecorder()
+	server.routes().ServeHTTP(response, req)
+	if response.Code != http.StatusCreated || !bytes.Contains(response.Body.Bytes(), []byte(`"delivery_mode":"SHADOW"`)) || bytes.Contains(response.Body.Bytes(), []byte("must not persist")) {
+		t.Fatalf("shadow response status=%d body=%s", response.Code, response.Body.String())
+	}
+	req = httptest.NewRequest(http.MethodPut, "/delivery/v1/deliveries/shadow-intent", bytes.NewReader(body))
+	req.Header.Set("Authorization", "Bearer shadow-write")
+	response = httptest.NewRecorder()
+	server.routes().ServeHTTP(response, req)
+	if response.Code != http.StatusForbidden {
+		t.Fatalf("unscoped shadow request status=%d", response.Code)
+	}
+}

cmd/secret-control-plane/main.go

@@ -17,15 +17,23 @@ const (
 
 func main() {
 	reason := flag.String("reason", "", "rotation reason: owner-requested-rotation or exposure-detected")
+	credential := flag.String("credential", "control-plane", "credential purpose: control-plane or acceptance-harness")
 	flag.Parse()
 	if flag.NArg() != 1 {
 		fail("usage: secret-control-plane [ensure|rotate]")
 	}
-	store, err := platformsecrets.NewLocalMachineCredentialStore(defaultRoot, defaultRuntimeUID, defaultRuntimeGID, nil)
+	root := os.Getenv("SECRET_CONTROL_PLANE_ROOT")
+	if root == "" {
+		root = defaultRoot
+	}
+	store, err := platformsecrets.NewLocalMachineCredentialStore(root, defaultRuntimeUID, defaultRuntimeGID, nil)
 	if err != nil {
 		fail("control-plane credential store unavailable")
 	}
 	spec := platformsecrets.ControlPlaneServiceTokenSpec()
+	if strings.TrimSpace(*credential) == "acceptance-harness" {
+		spec = platformsecrets.AcceptanceHarnessServiceTokenSpec()
+	}
 	switch strings.TrimSpace(flag.Arg(0)) {
 	case "ensure":
 		result, err := store.Ensure(spec)

contracts/authority/types.go

@@ -18,11 +18,14 @@ const GrantClassCreator GrantClass = "CREATOR"
 type DelegatedControlPlaneOperation string
 
 const (
-	DelegatedOperationQualifyCognitiveBinding  DelegatedControlPlaneOperation = "QUALIFY_COGNITIVE_BINDING"
-	DelegatedOperationEvaluateCognitiveBinding DelegatedControlPlaneOperation = "EVALUATE_COGNITIVE_BINDING"
-	DelegatedOperationCanaryCognitiveBinding   DelegatedControlPlaneOperation = "CANARY_COGNITIVE_BINDING"
-	DelegatedOperationActivateCognitiveBinding DelegatedControlPlaneOperation = "ACTIVATE_VALIDATED_COGNITIVE_BINDING"
-	DelegatedOperationRevokeControlPlaneGrant  DelegatedControlPlaneOperation = "REVOKE_DELEGATED_CONTROL_PLANE_GRANT"
+	DelegatedOperationQualifyCognitiveBinding          DelegatedControlPlaneOperation = "QUALIFY_COGNITIVE_BINDING"
+	DelegatedOperationEvaluateCognitiveBinding         DelegatedControlPlaneOperation = "EVALUATE_COGNITIVE_BINDING"
+	DelegatedOperationCanaryCognitiveBinding           DelegatedControlPlaneOperation = "CANARY_COGNITIVE_BINDING"
+	DelegatedOperationActivateCognitiveBinding         DelegatedControlPlaneOperation = "ACTIVATE_VALIDATED_COGNITIVE_BINDING"
+	DelegatedOperationCreateCandidateCapabilityBinding DelegatedControlPlaneOperation = "CREATE_CANDIDATE_CAPABILITY_BINDING"
+	DelegatedOperationUseCandidateCapabilityBinding    DelegatedControlPlaneOperation = "USE_CANDIDATE_CAPABILITY_BINDING"
+	DelegatedOperationRevokeCandidateCapabilityBinding DelegatedControlPlaneOperation = "REVOKE_CANDIDATE_CAPABILITY_BINDING"
+	DelegatedOperationRevokeControlPlaneGrant          DelegatedControlPlaneOperation = "REVOKE_DELEGATED_CONTROL_PLANE_GRANT"
 )
 
 type DelegatedGrantStatus string
@@ -41,6 +44,19 @@ type CognitiveBindingResource struct {
 	ModelDescriptorID  string
 }
 
+// CandidateCapabilityBindingResource is an exact, bounded control-plane
+// resource. Authority does not resolve targets or own Capability state.
+type CandidateCapabilityBindingResource struct {
+	ReleaseSetID  string
+	Slot          string
+	CapabilityID  string
+	ResourceScope string
+	Mode          string
+	TargetKind    string
+	TargetRef     string
+	TargetDigest  string
+}
+
 type DelegatedControlPlaneGrant struct {
 	ID                   GrantID
 	ServiceActorID       identity.ActorID
@@ -50,6 +66,7 @@ type DelegatedControlPlaneGrant struct {
 	TaskRevision         int64
 	Operations           []DelegatedControlPlaneOperation
 	Resource             CognitiveBindingResource
+	CandidateResource    CandidateCapabilityBindingResource
 	IssuedAtUnixMillis   int64
 	ExpiresAtUnixMillis  int64
 	ArchitectureRevision string
@@ -59,11 +76,12 @@ type DelegatedControlPlaneGrant struct {
 }
 
 type DelegatedControlPlaneRequest struct {
-	GrantID      GrantID
-	TaskID       string
-	TaskRevision int64
-	Operation    DelegatedControlPlaneOperation
-	Resource     CognitiveBindingResource
+	GrantID           GrantID
+	TaskID            string
+	TaskRevision      int64
+	Operation         DelegatedControlPlaneOperation
+	Resource          CognitiveBindingResource
+	CandidateResource CandidateCapabilityBindingResource
 }
 
 type DelegatedControlPlaneAudit struct {
@@ -75,6 +93,7 @@ type DelegatedControlPlaneAudit struct {
 	TaskRevision         int64
 	Operation            DelegatedControlPlaneOperation
 	Resource             CognitiveBindingResource
+	CandidateResource    CandidateCapabilityBindingResource
 	Decision             string
 	Outcome              string
 	RecordedAtUnixMillis int64

contracts/capability/types.go

@@ -12,10 +12,21 @@ type CapabilityKind string
 type BindingState string
 type BindingProtocol string
 
+// CandidateBindingMode controls how a release-scoped binding may be used.
+// It is deliberately separate from a production BindingState.
+type CandidateBindingMode string
+type CandidateBindingStatus string
+
 const (
 	BindingActive  BindingState = "ACTIVE"
 	BindingRetired BindingState = "RETIRED"
 
+	CandidateBindingModeCandidate CandidateBindingMode = "CANDIDATE"
+	CandidateBindingModeShadow    CandidateBindingMode = "SHADOW"
+
+	CandidateBindingActive  CandidateBindingStatus = "ACTIVE"
+	CandidateBindingRevoked CandidateBindingStatus = "REVOKED"
+
 	ProtocolIdempotentReceiptV1 BindingProtocol = "IDEMPOTENT_RECEIPT_V1"
 
 	CapabilityKindReadEmail          CapabilityKind = "READ_EMAIL"
@@ -54,6 +65,48 @@ type Binding struct {
 	Health               HealthState
 }
 
+// CandidateReleaseContext is supplied by a candidate runtime, not inferred
+// from a host name or process-local state. It scopes dynamic capability
+// resolution to one release slot and task.
+type CandidateReleaseContext struct {
+	ReleaseSetID     string
+	Slot             string
+	TaskID           string
+	TaskRevision     int64
+	PrincipalID      identity.PrincipalID
+	CapabilityID     CapabilityID
+	ResourceScope    string
+	Mode             CandidateBindingMode
+	TargetKind       string
+	TargetRef        string
+	TargetDigest     string
+	AuthorityGrantID string
+}
+
+// CandidateBinding is Capability-owned release-scoped state. TargetOrigin is
+// intentionally distinct from Binding.HTTPSOrigin: a SHADOW target can be an
+// internal candidate receiver and must never be promoted into the ACTIVE head.
+type CandidateBinding struct {
+	ID                        CapabilityBindingID
+	Revision                  int64
+	BaseActiveBindingID       CapabilityBindingID
+	BaseActiveBindingRevision int64
+	Context                   CandidateReleaseContext
+	TargetOrigin              string
+	DeliveryPath              string
+	ReceiptPath               string
+	Protocol                  BindingProtocol
+	CreatedAtUnixMillis       int64
+	ExpiresAtUnixMillis       int64
+	Status                    CandidateBindingStatus
+}
+
+type CandidateBindingResolution struct {
+	Binding CandidateBinding
+	Mode    CandidateBindingMode
+	Reason  string
+}
+
 type HealthState string
 
 const (

contracts/commit/execution_receipt.go

@@ -25,6 +25,14 @@ type ExecutionReceipt struct {
 	Ambiguity                 AmbiguityState
 	ReconciliationKey         string
 	RawArtifactRef            string
+	DeliveryMode              string
+	ExternalDeliveryAttempted bool
+	ReleaseSetID              string
+	TaskID                    string
+	TaskRevision              int64
+	CapabilityBindingID       string
+	CapabilityBindingRevision int64
+	TargetReference           string
 }
 
 func (r ExecutionReceipt) Valid() bool {

contracts/identity/session.go

@@ -16,5 +16,23 @@ type CreatorAccount struct {
 type CreatorSession struct {
 	ActorID       ActorID
 	PrincipalID   PrincipalID
+	PrincipalKind PrincipalKind
 	ExpiresAtUnix int64
 }
+
+type PrincipalKind string
+
+const (
+	PrincipalKindHuman   PrincipalKind = "HUMAN"
+	PrincipalKindService PrincipalKind = "SERVICE"
+)
+
+type ServicePrincipal struct {
+	ActorID        ActorID
+	PrincipalID    PrincipalID
+	Kind           PrincipalKind
+	Purpose        string
+	SyntheticScope string
+	Active         bool
+	Revision       int64
+}

contracts/interaction/types.go

@@ -215,6 +215,8 @@ type ChatMessageRequest struct {
 	Message             string
 	CorrelationID       string
 	CorrectsUtteranceID HumanUtteranceID
+	SyntheticAcceptance bool
+	SyntheticScopeID    string
 }
 
 type ChatMessageResponse struct {

database/migrations/057_release_scoped_candidate_capability_bindings.sql

@@ -0,0 +1,64 @@
+BEGIN;
+
+SET ROLE authority_role;
+ALTER TABLE authority.delegated_control_plane_grants
+  ALTER COLUMN binding_id DROP NOT NULL,
+  ALTER COLUMN provider_instance_id DROP NOT NULL,
+  ALTER COLUMN model_descriptor_id DROP NOT NULL,
+  ADD COLUMN IF NOT EXISTS candidate_release_set_id TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS candidate_slot TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS candidate_capability_id TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS candidate_resource_scope TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS candidate_mode TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS candidate_target_kind TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS candidate_target_ref TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS candidate_target_digest TEXT NOT NULL DEFAULT '';
+ALTER TABLE authority.delegated_control_plane_audit
+  ALTER COLUMN binding_id DROP NOT NULL,
+  ALTER COLUMN provider_instance_id DROP NOT NULL,
+  ALTER COLUMN model_descriptor_id DROP NOT NULL,
+  ADD COLUMN IF NOT EXISTS candidate_release_set_id TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS candidate_slot TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS candidate_capability_id TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS candidate_resource_scope TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS candidate_mode TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS candidate_target_kind TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS candidate_target_ref TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS candidate_target_digest TEXT NOT NULL DEFAULT '';
+ALTER TABLE authority.delegated_control_plane_grants DROP CONSTRAINT IF EXISTS delegated_control_plane_grants_binding_id_check;
+ALTER TABLE authority.delegated_control_plane_grants DROP CONSTRAINT IF EXISTS delegated_control_plane_grants_operations_check;
+ALTER TABLE authority.delegated_control_plane_grants DROP CONSTRAINT IF EXISTS delegated_control_plane_grants_operations_check1;
+ALTER TABLE authority.delegated_control_plane_audit DROP CONSTRAINT IF EXISTS delegated_control_plane_audit_operation_check;
+ALTER TABLE authority.delegated_control_plane_audit DROP CONSTRAINT IF EXISTS delegated_control_plane_audit_operation_check1;
+ALTER TABLE authority.delegated_control_plane_grants ADD CONSTRAINT delegated_control_plane_grants_operations_nonempty_check CHECK (cardinality(operations) > 0);
+ALTER TABLE authority.delegated_control_plane_grants ADD CONSTRAINT delegated_control_plane_grants_operations_check CHECK (operations <@ ARRAY['QUALIFY_COGNITIVE_BINDING','EVALUATE_COGNITIVE_BINDING','CANARY_COGNITIVE_BINDING','ACTIVATE_VALIDATED_COGNITIVE_BINDING','CREATE_CANDIDATE_CAPABILITY_BINDING','USE_CANDIDATE_CAPABILITY_BINDING','REVOKE_CANDIDATE_CAPABILITY_BINDING']::TEXT[]);
+ALTER TABLE authority.delegated_control_plane_audit ADD CONSTRAINT delegated_control_plane_audit_operation_check CHECK (operation IN ('QUALIFY_COGNITIVE_BINDING','EVALUATE_COGNITIVE_BINDING','CANARY_COGNITIVE_BINDING','ACTIVATE_VALIDATED_COGNITIVE_BINDING','REVOKE_DELEGATED_CONTROL_PLANE_GRANT','CREATE_CANDIDATE_CAPABILITY_BINDING','USE_CANDIDATE_CAPABILITY_BINDING','REVOKE_CANDIDATE_CAPABILITY_BINDING'));
+ALTER TABLE authority.delegated_control_plane_grants ADD CONSTRAINT delegated_control_plane_grants_exact_resource_check CHECK (
+  (binding_id <> '' AND provider_instance_id <> '' AND model_descriptor_id <> '' AND candidate_release_set_id = '' AND candidate_slot = '' AND candidate_capability_id = '' AND candidate_resource_scope = '' AND candidate_mode = '' AND candidate_target_kind = '' AND candidate_target_ref = '') OR
+  (binding_id IS NULL AND provider_instance_id IS NULL AND model_descriptor_id IS NULL AND candidate_release_set_id <> '' AND candidate_slot <> '' AND candidate_capability_id <> '' AND candidate_resource_scope <> '' AND candidate_mode IN ('CANDIDATE','SHADOW') AND candidate_target_kind <> '' AND candidate_target_ref <> '' AND length(candidate_target_digest) = 64)
+);
+INSERT INTO authority.delegated_control_plane_grants (grant_id,service_actor_id,service_principal_id,issuer_principal_id,task_id,task_revision,operations,binding_id,provider_instance_id,model_descriptor_id,candidate_release_set_id,candidate_slot,candidate_capability_id,candidate_resource_scope,candidate_mode,candidate_target_kind,candidate_target_ref,candidate_target_digest,issued_at_unix_millis,expires_at_unix_millis,architecture_revision,nonce,revision,status)
+VALUES ('gen2-capability-001-shadow-notification-grant','domovoy-control-plane-actor','domovoy-control-plane-principal','domovoy-creator-principal','GEN2-CAPABILITY-001',7,ARRAY['CREATE_CANDIDATE_CAPABILITY_BINDING','USE_CANDIDATE_CAPABILITY_BINDING','REVOKE_CANDIDATE_CAPABILITY_BINDING']::TEXT[],NULL,NULL,NULL,'assistant-slot-b','b','prospective-notification-delivery','synthetic-shadow-notification-v1','SHADOW','NOTIFICATION_SHADOW_RECEIVER','notification-receiver-candidate','f9f9fa49a0727444c280c092d5bb340f3a8f33cf325c5396f5ae177a6666da35',(EXTRACT(EPOCH FROM CURRENT_TIMESTAMP) * 1000)::BIGINT,(EXTRACT(EPOCH FROM CURRENT_TIMESTAMP + INTERVAL '14 days') * 1000)::BIGINT,'ADR-0021','gen2-capability-001-shadow-notification-r7',1,'ACTIVE') ON CONFLICT (grant_id) DO NOTHING;
+RESET ROLE;
+
+SET ROLE capability_role;
+CREATE TABLE IF NOT EXISTS capability.release_candidate_bindings (
+  binding_id TEXT NOT NULL, revision BIGINT NOT NULL, base_active_binding_id TEXT NOT NULL, base_active_binding_revision BIGINT NOT NULL,
+  release_set_id TEXT NOT NULL, slot TEXT NOT NULL, task_id TEXT NOT NULL, task_revision BIGINT NOT NULL, principal_id TEXT NOT NULL, capability_id TEXT NOT NULL, resource_scope TEXT NOT NULL, mode TEXT NOT NULL, target_kind TEXT NOT NULL, target_ref TEXT NOT NULL, target_digest TEXT NOT NULL, authority_grant_id TEXT NOT NULL,
+  target_origin TEXT NOT NULL, delivery_path TEXT NOT NULL, receipt_path TEXT NOT NULL, protocol TEXT NOT NULL,
+  created_at_unix_millis BIGINT NOT NULL, expires_at_unix_millis BIGINT NOT NULL, status TEXT NOT NULL,
+  PRIMARY KEY (binding_id, revision),
+  CHECK (revision > 0 AND base_active_binding_revision > 0 AND task_revision > 0), CHECK (mode IN ('CANDIDATE','SHADOW')), CHECK (status IN ('ACTIVE','REVOKED')),
+  CHECK (expires_at_unix_millis > created_at_unix_millis), CHECK (target_origin <> '' AND delivery_path <> '' AND receipt_path <> '' AND target_kind <> '' AND target_ref <> '' AND length(target_digest) = 64 AND authority_grant_id <> '')
+);
+CREATE TABLE IF NOT EXISTS capability.release_candidate_binding_heads (
+  release_set_id TEXT NOT NULL, slot TEXT NOT NULL, task_id TEXT NOT NULL, principal_id TEXT NOT NULL, capability_id TEXT NOT NULL, resource_scope TEXT NOT NULL, mode TEXT NOT NULL,
+  binding_id TEXT NOT NULL, revision BIGINT NOT NULL, PRIMARY KEY (release_set_id,slot,task_id,principal_id,capability_id,resource_scope,mode)
+);
+CREATE TABLE IF NOT EXISTS capability.release_candidate_binding_audit (
+  audit_id BIGSERIAL PRIMARY KEY, binding_id TEXT NOT NULL, revision BIGINT NOT NULL, release_set_id TEXT NOT NULL, task_id TEXT NOT NULL, capability_id TEXT NOT NULL, resource_scope TEXT NOT NULL, mode TEXT NOT NULL, decision TEXT NOT NULL, reason TEXT NOT NULL, recorded_at_unix_millis BIGINT NOT NULL,
+  CHECK (decision IN ('CREATED','RESOLVED','DENIED','REVOKED','EXPIRED'))
+);
+CREATE INDEX IF NOT EXISTS release_candidate_binding_audit_lookup_idx ON capability.release_candidate_binding_audit (release_set_id, task_id, capability_id, recorded_at_unix_millis DESC);
+RESET ROLE;
+COMMIT;

database/migrations/058_commit_execution_receipts.sql

@@ -0,0 +1,15 @@
+BEGIN;
+SET ROLE commit_role;
+CREATE TABLE IF NOT EXISTS commit.execution_receipts (
+  receipt_id TEXT PRIMARY KEY, action_attempt_id TEXT NOT NULL UNIQUE, executor_implementation_ref TEXT NOT NULL,
+  external_operation_ref TEXT NOT NULL DEFAULT '', external_request_id TEXT NOT NULL DEFAULT '', request_digest TEXT NOT NULL,
+  response_digest TEXT NOT NULL DEFAULT '', dispatch_at_unix_millis BIGINT NOT NULL, completed_at_unix_millis BIGINT NOT NULL DEFAULT 0,
+  executor_result TEXT NOT NULL, reconciliation_key TEXT NOT NULL, raw_artifact_ref TEXT NOT NULL DEFAULT '',
+  delivery_mode TEXT NOT NULL DEFAULT '', external_delivery_attempted BOOLEAN NOT NULL DEFAULT FALSE,
+  release_set_id TEXT NOT NULL DEFAULT '', task_id TEXT NOT NULL DEFAULT '', task_revision BIGINT NOT NULL DEFAULT 0,
+  capability_binding_id TEXT NOT NULL DEFAULT '', capability_binding_revision BIGINT NOT NULL DEFAULT 0, target_reference TEXT NOT NULL DEFAULT '',
+  CHECK (dispatch_at_unix_millis > 0), CHECK (executor_result <> ''), CHECK (delivery_mode IN ('','SHADOW')),
+  CHECK (delivery_mode <> 'SHADOW' OR external_delivery_attempted = FALSE)
+);
+RESET ROLE;
+COMMIT;

database/migrations/059_identity_acceptance_harness.sql

@@ -0,0 +1,24 @@
+BEGIN;
+SET ROLE identity_role;
+CREATE TABLE IF NOT EXISTS identity.service_principals (
+  principal_id TEXT PRIMARY KEY,
+  actor_id TEXT NOT NULL,
+  kind TEXT NOT NULL CHECK (kind = 'SERVICE'),
+  purpose TEXT NOT NULL,
+  synthetic_scope TEXT NOT NULL,
+  active BOOLEAN NOT NULL DEFAULT TRUE,
+  revision BIGINT NOT NULL DEFAULT 1,
+  recorded_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CHECK (principal_id <> '' AND actor_id <> '' AND purpose <> '' AND synthetic_scope <> '' AND revision > 0)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS service_principals_actor_idx ON identity.service_principals(actor_id);
+INSERT INTO identity.service_principals(principal_id, actor_id, kind, purpose, synthetic_scope)
+VALUES ('domovoy-acceptance-harness-principal', 'domovoy-acceptance-harness-actor', 'SERVICE', 'AUTHENTICATE_ACCEPTANCE_HARNESS', 'synthetic-acceptance-scope')
+ON CONFLICT (principal_id) DO NOTHING;
+INSERT INTO identity.actors(actor_id, display_name) VALUES ('domovoy-acceptance-harness-actor', 'Domovoy Acceptance Harness') ON CONFLICT (actor_id) DO NOTHING;
+INSERT INTO identity.principals(principal_id, display_name) VALUES ('domovoy-acceptance-harness-principal', 'Domovoy Acceptance Harness Principal') ON CONFLICT (principal_id) DO NOTHING;
+INSERT INTO identity.principal_bindings(actor_id, principal_id, active) VALUES ('domovoy-acceptance-harness-actor', 'domovoy-acceptance-harness-principal', TRUE) ON CONFLICT (actor_id, principal_id) DO UPDATE SET active=TRUE;
+REVOKE ALL ON identity.service_principals FROM PUBLIC;
+GRANT SELECT ON identity.service_principals TO identity_role;
+RESET ROLE;
+COMMIT;

deploy/docker-compose.candidate-slot.yml

@@ -49,6 +49,7 @@ services:
       IDENTITY_POSTGRES_USER: identity_role
       IDENTITY_POSTGRES_PASSWORD: ${IDENTITY_DB_PASSWORD}
       CREATOR_USERNAME: ${CREATOR_USERNAME}
+      ACCEPTANCE_HARNESS_SERVICE_CREDENTIAL_REF: credential://domovoy/acceptance-harness/service-token/v1
       WORK_POSTGRES_USER: work_role
       WORK_POSTGRES_PASSWORD: ${WORK_DB_PASSWORD}
       CAPABILITY_POSTGRES_USER: capability_role

deploy/docker-compose.prod.yml

@@ -66,6 +66,7 @@ services:
       IDENTITY_POSTGRES_USER: identity_role
       IDENTITY_POSTGRES_PASSWORD: ${IDENTITY_DB_PASSWORD}
       CREATOR_USERNAME: ${CREATOR_USERNAME}
+      ACCEPTANCE_HARNESS_SERVICE_CREDENTIAL_REF: credential://domovoy/acceptance-harness/service-token/v1
       WORK_POSTGRES_USER: work_role
       WORK_POSTGRES_PASSWORD: ${WORK_DB_PASSWORD}
       CAPABILITY_POSTGRES_USER: capability_role
@@ -265,6 +266,7 @@ services:
     command: ["ensure"]
     volumes:
       - assistant_control_plane_service_secrets:/run/control-plane-secrets
+      - assistant_core_secrets:/run/core-secrets
 
   cognitive-worker:
     build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: cognitive-worker, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }

deploy/provision-machine-credential.sh

@@ -9,6 +9,13 @@ ENV_FILE="${ENV_FILE:-$BASE_DIR/production-compose.env}"
 COMPOSE_FILE="$REPO_DIR/deploy/docker-compose.prod.yml"
 VOLUME="assistant_control_plane_service_secrets"
 ACTION="${1:-ensure}"
+CREDENTIAL="${MACHINE_CREDENTIAL:-control-plane}"
+SECRET_ROOT="/run/control-plane-secrets"
+VOLUME="assistant_control_plane_service_secrets"
+if [[ "$CREDENTIAL" == "acceptance-harness" ]]; then
+  SECRET_ROOT="/run/core-secrets"
+  VOLUME="assistant_core_secrets"
+fi
 
 case "$ACTION" in
   ensure|rotate) ;;
@@ -32,7 +39,7 @@ if [[ "$ACTION" == "rotate" ]]; then
     owner-requested-rotation|exposure-detected) ;;
     *) echo "invalid rotation reason" >&2; exit 2 ;;
   esac
-  ASSISTANT_SOURCE_REVISION="$revision" compose --profile secret-control-plane run --rm --no-deps secret-control-plane -reason "$reason" rotate
+  ASSISTANT_SOURCE_REVISION="$revision" compose --profile secret-control-plane run --rm --no-deps -e "SECRET_CONTROL_PLANE_ROOT=$SECRET_ROOT" secret-control-plane -credential "$CREDENTIAL" -reason "$reason" rotate
 else
-  ASSISTANT_SOURCE_REVISION="$revision" compose --profile secret-control-plane run --rm --no-deps secret-control-plane ensure
+  ASSISTANT_SOURCE_REVISION="$revision" compose --profile secret-control-plane run --rm --no-deps -e "SECRET_CONTROL_PLANE_ROOT=$SECRET_ROOT" secret-control-plane -credential "$CREDENTIAL" ensure
 fi

dev/ACTIVE_TASK.json

@@ -1 +1 @@
-{"task_file":"dev/tasks/GEN2-DEPLOY-004-candidate-commit-runtime-releaseset.json","task_id":"GEN2-DEPLOY-004","task_revision":2}
+{"task_file":"dev/tasks/GEN2-AUTH-HARNESS-001-first-party-authenticated-service-acceptance.json","task_id":"GEN2-AUTH-HARNESS-001","task_revision":3}

dev/tasks/GEN2-AUTH-HARNESS-001-first-party-authenticated-service-acceptance.json

@@ -0,0 +1,26 @@
+{
+  "task_id": "GEN2-AUTH-HARNESS-001",
+  "task_revision": 3,
+  "architecture_revision": "ARCH-GEN2-000",
+  "base_repo_revision": "gen2-integration",
+  "risk_tier": "E",
+  "intent": "Provide a reusable first-party authenticated service acceptance harness through the existing Identity/Auth boundary for synthetic, non-user interaction scenarios, without owner impersonation, auth bypass, a second Identity owner, or direct database access.",
+  "requirement_ids": ["REQ-GEN2-AUTH-HARNESS-001-SERVICE-AUTH", "REQ-GEN2-EVOLVE-004-RUNTIME-001-DURABLE-LEARNING"],
+  "allowed_change_scope": {
+    "modules": ["Identity service-principal lifecycle", "authenticated service-session validation", "synthetic acceptance scope enforcement", "Core interaction acceptance read/query", "protected machine-credential provisioning", "typed acceptance harness", "targeted evidence"],
+    "paths": ["contracts/identity/**", "contracts/interaction/**", "contracts/self/**", "modules/identity/**", "modules/interaction/**", "modules/self/**", "modules/epistemics/domain/experience.go", "modules/epistemics/domain/experience_test.go", "adapters/postgres/identity_repository.go", "adapters/postgres/interaction_repository.go", "adapters/postgres/self_repository.go", "cmd/core-runtime/**", "cmd/auth-acceptance-harness/**", "platform/secrets/**", "cmd/secret-control-plane/**", "database/migrations/057_release_scoped_candidate_capability_bindings.sql", "database/migrations/059_identity_acceptance_harness.sql", "deploy/docker-compose.prod.yml", "deploy/docker-compose.candidate-slot.yml", "deploy/provision-machine-credential.sh", "deploy/provision-machine-credential_test.sh", "docs/CREDENTIALS_AND_SECRETS.md", "docs/evidence/**", "docs/PROJECT_STATUS.md", "development/GEN2_TASK_INDEX.md", "dev/ACTIVE_TASK.json", "dev/tasks/GEN2-AUTH-HARNESS-001-first-party-authenticated-service-acceptance.json"]
+  },
+  "forbidden_change_scope": {"paths": ["architecture/ARCHITECTURE_CONSTITUTION.md", "architecture/architecture-registry.yaml", "architecture/architecture-registry.json", "cmd/devctl/**", "cmd/cognitive-worker/**", "contracts/authority/**", "modules/authority/**", "cmd/commit-runtime/**", "database/bootstrap/**", "UI", "V1 retirement", "GEN2-EVOLVE-005", "Gen3/**", "go.mod", "go.sum"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 1, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 1},
+  "contracts": {"consume": ["existing Identity Actor/PrincipalBinding", "existing Creator session validation boundary", "existing Interaction and SELF repositories", "existing protected SecretRef/FileResolver"], "may_change": ["typed service-principal authentication metadata", "typed synthetic acceptance operations", "typed canonical SELF acceptance query summary"]},
+  "semantic_owner": "Identity remains the sole owner of service identity and authentication. Interaction remains the owner of synthetic interactions. SELF remains the sole owner of learning evidence. The harness is only a bounded authenticated client.",
+  "canonical_state": ["service principal is distinct from the Creator and cannot access Creator data", "synthetic resources are typed and isolated by principal and scope", "credential value exists only in protected secret artifacts", "authentication does not grant Authority", "SELF evidence retains synthetic provenance and cannot promote production competence automatically"],
+  "state_transitions": ["ABSENT -> ACTIVE service principal via idempotent Identity bootstrap", "credential ABSENT -> ACTIVE via existing protected control plane", "authenticated synthetic request -> bounded Interaction path -> learning evidence", "service credential revoked/expired -> DENY while audit/history remain"],
+  "side_effects_and_privileges": ["only the existing protected secret control plane may provision the dedicated harness credential", "Core resolves only its SecretRef through the protected read-only mount", "synthetic acceptance cannot mutate production Authority, owner memory, or production competence", "no browser cookies, owner password, token value, raw prompt or user memory is read or emitted"],
+  "persistence_and_migrations": ["one additive Identity-owned service-principal/credential metadata migration is permitted only if existing schema cannot represent it", "SELF and Interaction canonical evidence/history are retained", "no direct database write is performed by the harness"],
+  "failure_retry_restart": ["missing, wrong, expired and revoked credentials deny closed", "service principal and synthetic scope are loaded durably, not from process-local state", "SELF write failure is diagnostic and non-fatal to an already prepared response", "bounded scenarios have explicit operation and wall-time limits", "restart must preserve canonical evidence and typed summaries"],
+  "assumptions": ["the existing protected secret control plane can provision a dedicated credential without exposing its value", "the candidate ReleaseSet can mount the protected volume read-only", "the current Identity/Auth boundary can be extended without impersonating the Creator"],
+  "acceptance_scenarios": ["valid harness credential authenticates through normal middleware", "missing/wrong/revoked/expired auth is denied", "harness cannot read owner data", "synthetic interaction reaches the real Core learning path", "correction and verified failure persist through SelfRepository", "canonical SELF summary is readable after restart", "synthetic provenance is preserved and does not auto-promote production competence", "credential rotation remains black-box and old credential is denied", "candidate revision is verified and stable remains untouched"],
+  "required_tests": ["targeted go test", "targeted go vet", "compose/config validation", "auth harness regression", "preflight", "check-diff", "independent", "architecture/governance MILESTONE", "git diff --check"],
+  "terminal_gap_states": ["BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT", "REQUIRES_MIGRATION_DECISION"]
+}

dev/tasks/GEN2-CAPABILITY-001-release-scoped-candidate-shadow-bindings.json

@@ -0,0 +1,37 @@
+{
+  "task_id": "GEN2-CAPABILITY-001",
+  "task_revision": 7,
+  "architecture_revision": "ARCH-GEN2-000",
+  "base_repo_revision": "gen2-integration",
+  "risk_tier": "E",
+  "intent": "Add a Capability-owned, revisioned and time-bounded candidate/shadow binding lifecycle with typed CandidateReleaseContext and delegated task authority, so candidate side-effecting operations cannot fall back to stable ACTIVE bindings.",
+  "requirement_ids": ["REQ-GEN2-CAPABILITY-001-RELEASE-SCOPED-BINDING", "REQ-GEN2-DEPLOY-004-DYNAMIC-CLOSURE", "REQ-GEN2-AUTHORITY-001-TASK-SCOPED-DELEGATION"],
+  "allowed_change_scope": {
+    "modules": ["Capability candidate/shadow binding lifecycle and resolution", "Authority delegated grant validation/audit for candidate binding operations", "Core and Commit runtime typed composition", "candidate deployment/supervisor readiness integration", "notification shadow receiver acceptance"],
+    "paths": [
+      "contracts/capability/**", "contracts/authority/types.go", "contracts/authority/control_plane.go", "contracts/authority/*_test.go", "contracts/commit/execution_receipt.go", "modules/commit/ports/executor.go",
+      "modules/capability/domain/**", "modules/capability/ports/**", "modules/authority/domain/**", "modules/authority/ports/**", "modules/commit/domain/commit.go", "modules/commit/domain/commit_test.go",
+      "adapters/postgres/capability_repository.go", "adapters/postgres/capability_repository_test.go", "adapters/postgres/authority_repository.go", "adapters/postgres/authority_repository_test.go", "adapters/postgres/commit_repository.go", "adapters/postgres/commit_repository_test.go", "adapters/notificationexecutor/**",
+      "cmd/core-runtime/main.go", "cmd/core-runtime/control_plane_authority.go", "cmd/core-runtime/control_plane_authority_test.go",
+      "cmd/commit-runtime/main.go", "cmd/commit-runtime/control_plane_authority.go", "cmd/commit-runtime/control_plane_authority_test.go", "cmd/commit-runtime/creator_clients.go", "cmd/commit-runtime/notification_executor.go", "cmd/commit-runtime/notification_executor_test.go", "cmd/commit-runtime/execution.go", "cmd/commit-runtime/execution_test.go", "cmd/commit-runtime/candidate_release_context.go", "cmd/commit-runtime/candidate_release_context_test.go",
+      "cmd/notification-receiver/**", "database/migrations/057_release_scoped_candidate_capability_bindings.sql", "database/migrations/058_commit_execution_receipts.sql",
+      "deploy/docker-compose.candidate-slot.yml", "deploy/run-production-canary.sh", "runtime/supervisor/**", "cmd/supervisor/**", "tests/deployment/**",
+      "docs/evidence/**", "docs/DEPLOYMENT.md", "docs/PROJECT_STATUS.md", "development/GEN2_TASK_INDEX.md", "dev/ACTIVE_TASK.json", "dev/tasks/GEN2-CAPABILITY-001-release-scoped-candidate-shadow-bindings.json", "dev/tasks/GEN2-DEPLOY-004-candidate-commit-runtime-releaseset.json",
+      "architecture/adrs/ADR-0021-delegated-noninteractive-control-plane-authority.md", "contracts/secrets/types.go", "modules/authority/application/**",
+      "cmd/core-runtime/control_plane_authority.go", "cmd/commit-runtime/control_plane_authority.go", "database/migrations/056_delegated_control_plane_authority.sql", "deploy/docker-compose.prod.yml", "docs/CREDENTIALS_AND_SECRETS.md", "dev/tasks/GEN2-AUTHORITY-001-delegated-noninteractive-control-plane-authority.json"
+    ]
+  },
+  "forbidden_change_scope": {"paths": ["architecture/ARCHITECTURE_CONSTITUTION.md", "architecture/architecture-registry.yaml", "architecture/architecture-registry.json", "cmd/devctl/**", "contracts/identity/**", "modules/identity/**", "adapters/postgres/identity_repository.go", "database/bootstrap/**", "security/**", "go.mod", "go.sum", "UI", "V1 retirement", "GEN2-EVOLVE-005", "Gen3/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 1, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 1},
+  "contracts": {"consume": ["existing Capability Binding and repository owner", "existing Authority delegated service principal/grant/audit", "existing Commit executor and receipt/outcome contracts", "existing Supervisor ReleaseSet control plane"], "may_change": ["typed CandidateReleaseContext and candidate binding resolution contract", "typed delegated Authority operation/resource for create/use/revoke candidate binding", "Capability owner repository ports", "candidate ReleaseSet readiness evidence"]},
+  "semantic_owner": "Capability remains the sole owner of capability binding, revision, resolution, lifecycle and binding promotion/retirement. Authority remains the sole owner of delegated grant validation/revocation/audit. Commit remains the sole owner of external action commit/execution state.",
+  "canonical_state": ["stable ACTIVE binding remains immutable during candidate acceptance", "candidate/shadow binding is a Capability-owned separate release-scoped revision, not a second owner", "candidate side-effecting resolution is fail-closed when the required candidate/shadow binding is absent", "no raw endpoint or secret crosses Core/Commit to bypass Capability", "shadow receipt is never a delivery WorldOutcome"],
+  "state_transitions": ["Authority grant -> Capability candidate/shadow binding create -> candidate typed resolve/use -> audit/receipt -> explicit revoke or expiry", "candidate binding never automatically becomes ACTIVE", "stable resolution without CandidateReleaseContext -> stable ACTIVE only"],
+  "side_effects_and_privileges": ["service authentication remains separate from Authority", "create/use/revoke operations require a task/release/capability/resource/time-scoped delegated grant", "candidate notification uses a synthetic shadow target and no production destination", "candidate binding cannot extend TTL, alter resource/release, grant itself rights, or promote itself"],
+  "persistence_and_migrations": ["additive Capability-owned release-scoped candidate binding and auditable resolution persistence only", "Authority audit stays owner-local", "no secret value is persisted", "rollback revokes/expires candidate binding and retains historical audit/evidence"],
+  "failure_retry_restart": ["missing/wrong-release/wrong-task/expired/revoked candidate binding denies without ACTIVE fallback", "restart reloads durable candidate binding and Authority state subject to TTL", "candidate binding creation is revisioned/idempotent", "shadow receiver failure produces a non-delivery receipt/outcome and does not create a real external action"],
+  "assumptions": ["migration 057 is globally free after existing migration 056", "the existing protected service credential is usable only as authentication and is never read or logged", "the notification receiver can be given a bounded shadow non-delivery mode without modifying production delivery state"],
+  "acceptance_scenarios": ["stable resolution returns only ACTIVE binding even when candidate bindings exist", "valid candidate release context plus grant resolves candidate/shadow binding", "wrong release/task, expired or revoked candidate binding denies", "missing required candidate binding denies with no stable fallback", "candidate binding cannot self-promote or alter its scope", "restart retains valid candidate binding/audit and revoked state", "synthetic candidate notification yields SHADOW_CAPTURED/NOT_DELIVERED_SHADOW with zero external delivery", "candidate dynamic dependency evidence identifies the notification receiver target without endpoint or secret logging"],
+  "required_tests": ["FAST: targeted go test ./modules/capability/... ./modules/authority/... ./adapters/postgres ./cmd/core-runtime ./cmd/commit-runtime ./cmd/notification-receiver ./runtime/supervisor ./cmd/supervisor", "FAST: targeted go vet for changed packages", "FAST: migration and compose config validation", "FAST governance: go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "FAST scope: go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "FAST independent: go run ./cmd/devctl/independent", "FAST whitespace: git diff --check gen2-integration --", "MILESTONE: Capability/Deploy/Authority candidate-shadow lifecycle and rollback evidence"],
+  "terminal_gap_states": ["BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT", "REQUIRES_MIGRATION_DECISION"]
+}

dev/tasks/GEN2-COGNITIVE-003-restore-local-medium-invocation.json

@@ -1,17 +1,18 @@
 {
   "task_id": "GEN2-COGNITIVE-003",
-  "task_revision": 3,
+  "task_revision": 4,
   "architecture_revision": "ARCH-GEN2-000",
   "base_repo_revision": "gen2-integration",
   "risk_tier": "E",
-  "intent": "Restore bounded OpenAI-compatible Local MEDIUM invocation without changing canonical ownership or Core semantics.",
-  "requirement_ids": ["REQ-GEN2-EVOLVE-004-LOCAL-MEDIUM-INVOCATION"],
+  "intent": "Restore and phase-trace bounded Local MEDIUM qualification and invocation without changing Capability ownership, Core household budget, or activation authority.",
+  "requirement_ids": ["REQ-GEN2-EVOLVE-004-LOCAL-MEDIUM-INVOCATION", "REQ-GEN2-COGNITIVE-003-QUALIFICATION-CONTROL-PLANE"],
   "allowed_change_scope": {
     "modules": ["cognitive-worker provider invocation", "existing local OpenAI-compatible adapter", "targeted evidence"],
     "paths": [
       "cmd/cognitive-worker/main.go",
       "cmd/cognitive-worker/advisory.go",
       "cmd/cognitive-worker/gateway_registry.go",
+      "cmd/cognitive-worker/model_qualification.go",
       "cmd/cognitive-worker/*_test.go",
       "adapters/models/openai_compatible_local.go",
       "adapters/models/openai_compatible_local_test.go",
@@ -66,13 +67,13 @@
     "may_change": ["provider request normalization and typed immediate failure mapping only"]
   },
   "semantic_owner": "Cognitive gateway remains the sole owner of provider invocation and route selection.",
-  "canonical_state": ["discovery is not invocation qualification", "optional provider parameters are capability-gated", "immediate provider rejection is not reported as timeout"],
-  "state_transitions": ["binding selection -> normalized request -> provider invocation -> typed result"],
+  "canonical_state": ["discovery is not invocation qualification", "qualification evidence is not activation", "optional provider parameters are capability-gated", "immediate provider rejection is not reported as timeout"],
+  "state_transitions": ["binding selection -> normalized request -> provider invocation -> typed result", "discovery -> bounded qualification evidence -> independent capability evaluation -> governed canary/activation"],
   "side_effects_and_privileges": ["no secrets or authorization headers in evidence", "no direct database access", "no provider calls outside the existing gateway boundary"],
   "persistence_and_migrations": ["no schema change"],
-  "failure_retry_restart": ["bounded invocation; no timeout inflation; no infinite retry; preserve fail-closed/fallback semantics"],
+  "failure_retry_restart": ["household invocation remains bounded by its existing 12-second Core budget", "qualification/revalidation is a separately bounded control-plane operation", "single-flight qualification per provider/model avoids duplicate work", "no timeout inflation; no infinite retry; preserve fail-closed/fallback semantics"],
   "assumptions": ["Local MEDIUM gateway remains the existing provider endpoint", "candidate slot B is available for isolated verification", "cmd/core-runtime/learning_test.go is a preserved carry-forward regression from the preceding runtime task"],
-  "acceptance_scenarios": ["minimal invocation completes", "ordinary and bounded-context invocation complete", "immediate provider 4xx maps to typed rejection without timeout", "qualification requires bounded invocation evidence"],
+  "acceptance_scenarios": ["safe phase trace emits correlation IDs and durations without prompts, answers, credentials, secrets, or user memory", "minimal invocation completes", "ordinary and bounded-context invocation complete", "immediate provider 4xx maps to typed rejection without timeout", "qualification requires bounded invocation evidence", "duplicate qualification is bounded and deduplicated", "fresh validated binding is not synchronously requalified on an ordinary household request"],
   "required_tests": ["targeted go test", "targeted go vet", "preflight", "check-diff", "independent", "architecture checks", "git diff --check"],
   "terminal_gap_states": ["BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_MISSING_CAPABILITY", "REQUIRES_MIGRATION_DECISION", "BLOCKED_BY_DEPLOYMENT_CONTROL"]
 }

dev/tasks/GEN2-DEPLOY-004-candidate-commit-runtime-releaseset.json

@@ -1,11 +1,11 @@
 {
   "task_id": "GEN2-DEPLOY-004",
-  "task_revision": 2,
+  "task_revision": 3,
   "architecture_revision": "ARCH-GEN2-000",
   "base_repo_revision": "gen2-integration",
   "risk_tier": "E",
-  "intent": "Close the isolated candidate slot over all versioned Assistant runtime dependencies of its candidate components, extend the typed Supervisor ReleaseSet accordingly, and keep stable containers untouched so the delegated Authority path can be accepted without candidate-to-stable runtime shortcuts.",
-  "requirement_ids": ["REQ-GEN2-DEPLOY-004-DEPENDENCY-CLOSURE", "REQ-GEN2-DEPLOY-004-CANDIDATE-COMMIT", "REQ-GEN2-AUTHORITY-001-ISOLATED-COMMIT", "REQ-GEN2-DEPLOY-003-STABLE-ID-GUARD"],
+  "intent": "Close the isolated candidate slot over static and Capability-resolved Assistant runtime dependencies, using GEN2-CAPABILITY-001 candidate/shadow binding resolution, and keep stable containers untouched so candidate side effects cannot fall back to production targets.",
+  "requirement_ids": ["REQ-GEN2-DEPLOY-004-DEPENDENCY-CLOSURE", "REQ-GEN2-DEPLOY-004-DYNAMIC-CAPABILITY-CLOSURE", "REQ-GEN2-CAPABILITY-001-RELEASE-SCOPED-BINDING", "REQ-GEN2-AUTHORITY-001-ISOLATED-COMMIT", "REQ-GEN2-DEPLOY-003-STABLE-ID-GUARD"],
   "allowed_change_scope": {
     "modules": ["deployment control", "runtime supervisor", "candidate Assistant runtime dependency closure", "inherited delegated Authority prerequisite only"],
     "paths": [
@@ -47,17 +47,17 @@
   },
   "allowed_architecture_delta": {"new_cross_module_dependencies": 1, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 1},
   "contracts": {
-    "consume": ["existing typed Supervisor ReleaseSet and ComponentRelease", "existing runtime health/readiness/revision endpoints", "existing delegated Authority service credential and task-scoped grant contracts", "existing shared PostgreSQL and external secret volumes"],
-    "may_change": ["typed Supervisor explicit required ComponentKind set and ReleaseSet evidence", "candidate Compose dependency wiring", "candidate deployment control script"]
+    "consume": ["existing typed Supervisor ReleaseSet and ComponentRelease", "existing runtime health/readiness/revision endpoints", "GEN2-CAPABILITY-001 CandidateReleaseContext and candidate/shadow binding resolution", "existing delegated Authority service credential and task-scoped grant contracts", "existing shared PostgreSQL and external secret volumes"],
+    "may_change": ["typed Supervisor explicit required ComponentKind set and static/dynamic dependency evidence", "candidate Compose dependency wiring", "candidate deployment control script"]
   },
   "semantic_owner": "Operations/Supervisor owns operational ReleaseSet evidence; Commit remains the sole canonical owner of durable Commit state; Authority and Capability ownership do not change.",
   "canonical_state": ["stable and candidate instances of each owner use the same transactional canonical repository and do not form two semantic owners", "no direct stable container recreation", "no new canonical writer, schema, role, credential value, or provider routing owner", "pre-existing GEN2-AUTHORITY-001 paths are inherited only so devctl can validate the committed prerequisite diff against gen2-integration; this packet grants no new write authority for them"],
-  "state_transitions": ["stable dependency-closed ReleaseSet evidence retained -> isolated candidate dependency closure start -> all component health/readiness/revision and dependency-target observation -> Supervisor canary -> promote or whole ReleaseSet rollback", "missing, unhealthy, mixed-revision, or stable-targeted candidate component -> candidate ReleaseSet unhealthy -> traffic stable without stable container recreation"],
+  "state_transitions": ["stable dependency-closed ReleaseSet evidence retained -> isolated candidate static and Capability dependency closure start -> all component health/readiness/revision and dependency-target observation -> Supervisor canary -> promote or whole ReleaseSet rollback", "missing, unhealthy, mixed-revision, stable-targeted, or missing required candidate/shadow binding -> candidate ReleaseSet unhealthy -> traffic stable without stable container recreation"],
   "side_effects_and_privileges": ["production operations are limited to Docker/Compose candidate slot B and Supervisor control endpoints", "candidate Creator, Core, Commit, Continuity, Agent Worker, Agent Execution Bridge, Work Graph and Task Verifier use only candidate Assistant runtime URLs", "PostgreSQL, protected secret volumes, model/gateway services and other explicitly classified non-Assistant infrastructure remain shared", "candidate components receive only required existing SecretRefs through read-only protected mounts", "stable IDs are captured before every candidate operation and any change aborts before canary"],
   "persistence_and_migrations": ["no migration or durable semantic schema change", "shared PostgreSQL and existing protected volumes remain external resources and are never deleted", "Supervisor persists stable/candidate/LKG ReleaseSet evidence across restart"],
   "failure_retry_restart": ["missing, unhealthy, revision-mismatched, or stable-targeted candidate component rejects the whole candidate ReleaseSet", "rollback changes Supervisor traffic only and retains stable containers", "Supervisor restart reloads the complete dependency-closed LKG and candidate state", "candidate and stable owner runtimes rely on existing repository idempotency/revision preconditions for bounded test resources"],
   "assumptions": ["GEN2-AUTHORITY-001 implementation commits through a8be998 remain unmodified prerequisites on this task branch", "the protected control-plane secret artifact exists and can be mounted read-only without displaying it", "existing owner repositories support concurrent stable/candidate instances over bounded test resources", "any runtime target absent from the static configuration graph is classified before it is admitted as shared infrastructure"],
-  "acceptance_scenarios": ["candidate ReleaseSet contains the transitive closure of creator-web, core-runtime, cognitive-worker, research-runtime, commit-runtime, continuity-runtime, agent-worker, agent-execution-bridge, work-graph-runtime, and task-verifier, each at one revision", "every candidate Assistant runtime URL targets a component in the same candidate ReleaseSet; stable Assistant runtime URLs abort before canary", "missing, unhealthy, or revision-mismatched required component prevents release READY", "candidate Core -> Commit -> Continuity and Creator -> Continuity/Agent Worker remain within candidate topology while stable topology is unchanged", "candidate start/update leaves every captured stable Assistant runtime container ID unchanged", "forced candidate Continuity or Commit failure causes whole ReleaseSet rollback to stable traffic without recreating stable", "Supervisor restart preserves the complete component set in LKG and candidate evidence", "Commit readiness proves database and Authority endpoint readiness without emitting a secret"],
+  "acceptance_scenarios": ["candidate ReleaseSet contains the transitive static closure of creator-web, core-runtime, cognitive-worker, research-runtime, commit-runtime, continuity-runtime, agent-worker, agent-execution-bridge, work-graph-runtime, task-verifier, and every classified Capability target ReleaseComponent, each at one revision", "every candidate Assistant runtime URL targets a component in the same candidate ReleaseSet; stable Assistant runtime URLs abort before canary", "candidate side-effect resolution requires a valid same-ReleaseSet candidate/shadow binding and never falls back to ACTIVE production", "missing, unhealthy, revision-mismatched, unknown, or unbound required component prevents release READY", "candidate start/update leaves every captured stable Assistant runtime container ID unchanged", "forced candidate Continuity or Commit failure causes whole ReleaseSet rollback to stable traffic without recreating stable", "Supervisor restart preserves the complete component set, binding context and LKG evidence", "synthetic shadow notification produces no external delivery"],
   "required_tests": ["FAST: targeted go test ./runtime/supervisor ./cmd/supervisor", "FAST: targeted go vet ./runtime/supervisor ./cmd/supervisor", "FAST: compose config candidate slot", "FAST: targeted deployment shell regression for dependency isolation and stable ID invariance", "FAST governance: go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "FAST scope: go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "FAST independent: go run ./cmd/devctl/independent", "FAST whitespace: git diff --check gen2-integration --", "PRODUCTION: isolated dependency-closed ReleaseSet health, revision, candidate Continuity/Commit rollback, Supervisor restart/LKG, and stable-ID drill"],
   "terminal_gap_states": ["BLOCKED_BY_DEPLOYMENT_CONTROL", "BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT", "REQUIRES_MIGRATION_DECISION"]
 }

development/GEN2_TASK_INDEX.md

@@ -58,5 +58,7 @@ Bounded post-M5 remediation. Provides the technical protected-secret control-pla
 |---|---|---|---|
 | `GEN2-AUTHORITY-001` | `MILESTONE` | owner decision, existing Identity/Authority/Capability lifecycle | Bounded non-interactive service principal and task-scoped control-plane delegation; does not retire V1 or change Gen2 canonical ownership. |
 | `GEN2-DEPLOY-004` | `MILESTONE` | GEN2-DEPLOY-003, GEN2-AUTHORITY-001 implementation | Extend the isolated candidate slot and typed Supervisor ReleaseSet with Commit runtime before delegated Authority acceptance; stable containers are never recreated by candidate operations. |
+| `GEN2-CAPABILITY-001` | `MILESTONE` | owner architecture decision, GEN2-AUTHORITY-001 implementation | Capability-owned release-scoped candidate/shadow binding lifecycle for dynamic candidate dependency closure; stable ACTIVE bindings remain immutable. |
+| `GEN2-AUTH-HARNESS-001` | `MILESTONE` | owner decision, GEN2-EVOLVE-004-RUNTIME-001 implementation | First-party authenticated service acceptance through the normal Identity boundary; synthetic scope only, no owner impersonation or auth bypass. |
 
 Между реперными точками выполняется только FAST-профиль конкретного packet-а.

docs/evidence/gen2-auth-harness-001-production-2026-09-02.json

@@ -0,0 +1,66 @@
+{
+  "task_id": "GEN2-AUTH-HARNESS-001",
+  "task_revision": 3,
+  "runtime_remediation": "GEN2-EVOLVE-004-RUNTIME-001",
+  "observed_at": "2026-09-02",
+  "candidate": {
+    "slot": "b",
+    "release_revision": "aa5e337",
+    "components_healthy": [
+      "creator-web",
+      "core-runtime",
+      "cognitive-worker",
+      "research-runtime"
+    ],
+    "stable_release_set_promoted": false
+  },
+  "authenticated_path": {
+    "principal_kind": "SERVICE",
+    "principal_id": "domovoy-acceptance-harness-principal",
+    "authentication_boundary": "Identity service session middleware",
+    "synthetic_scope": "synthetic-acceptance-scope",
+    "credential_value_recorded": false,
+    "owner_credentials_or_cookies_used": false
+  },
+  "learning_scenario": {
+    "path": "authenticated service request -> Core interaction -> learningRecorder -> SelfRepository -> durable SELF evidence",
+    "first_run": {
+      "learning_signals": 3,
+      "improvement_needs": 3,
+      "learning_ledger": 3
+    },
+    "after_candidate_core_restart": {
+      "core_ready": true,
+      "cognitive_worker_ready": true,
+      "learning_signals": 4,
+      "improvement_needs": 4,
+      "learning_ledger": 4
+    },
+    "persistence_verified": true
+  },
+  "failure_isolation": {
+    "self_repository_failure_preserves_user_response": "targeted TestSelfRepositoryFailureDoesNotDiscardUserFacingLearningPath passed",
+    "auth_scope_boundary": "synthetic service session required; Creator human session validation rejects service sessions",
+    "direct_database_write_from_harness": false
+  },
+  "deployment_safety": {
+    "stable_container_ids_checked_before_and_after": true,
+    "stable_container_ids_changed": false,
+    "candidate_dependency_isolation": true,
+    "rollback_available": true
+  },
+  "verification": {
+    "targeted_go_test": "PASS",
+    "targeted_go_vet": "PASS",
+    "preflight": "PASS",
+    "check_diff": "PASS",
+    "independent_governance": "PASS",
+    "architecture_checks": "PASS",
+    "git_diff_check": "PASS"
+  },
+  "notes": [
+    "A startup failure caused by a diagnostic compose invocation without the production env file was corrected by using the existing --env-file wiring.",
+    "The persistence defect was null applicability_conditions passed explicitly to a NOT NULL column; domain normalization now supplies an empty typed slice.",
+    "UI/browser acceptance remains outside this task; V1 retirement and Gen3 were not started."
+  ]
+}

docs/evidence/gen2-capability-001-notification-receiver-classification-2026-08-31.md

@@ -0,0 +1,22 @@
+# GEN2-CAPABILITY-001 notification receiver classification
+
+## Evidence
+
+The notification target is implemented by this repository's
+`cmd/notification-receiver` runtime.  It exposes the bounded delivery and
+receipt protocol used by `adapters/notificationexecutor`; it is therefore an
+Assistant ReleaseComponent, not a shared external service.
+
+The current stable receiver persists idempotent receipts and is configured
+with separate read/write secrets.  Candidate acceptance must not reuse its
+runtime instance, secret mount, or stable Capability ACTIVE binding.
+
+## Candidate decision
+
+The candidate ReleaseSet requires its own `notification-receiver-candidate`
+instance in explicit shadow mode.  That instance accepts only synthetic,
+task-scoped delivery traffic and returns a shadow receipt.  It has no
+production delivery credential or production destination route.
+
+`SHADOW_CAPTURED` proves only receipt capture.  It is not delivery, a sent
+notification, or a verified World outcome.

docs/evidence/gen2-cognitive-003-boundary-2026-08-31.json

@@ -0,0 +1,47 @@
+{
+  "evidence_id": "gen2-cognitive-003-boundary-2026-08-31",
+  "task_id": "GEN2-COGNITIVE-003",
+  "task_revision": 3,
+  "status": "PARTIAL_CORE_VERIFIED / ACTIVATION_REQUIRES_INDEPENDENT_EVALUATION",
+  "owner_amendment": {
+    "browser_authenticated_acceptance": "DEFERRED_BY_OWNER",
+    "ui": "OUT_OF_SCOPE",
+    "v1_retirement": "NOT_AUTHORIZED",
+    "gen3": "NOT_STARTED"
+  },
+  "gateway_runtime": {
+    "revision": "a23c36eb9d0c7c73c643b932c184ec1e0adf57ff",
+    "stable_health": "healthy",
+    "bounded_qwen_smoke": "HTTP 200 in 4.310 seconds",
+    "warm_gateway_trace": {
+      "admission_millis": 13,
+      "upstream_millis": 1011,
+      "end_to_end_millis": 1144
+    }
+  },
+  "candidate_slot_b": {
+    "revision": "cb50b7357b4c37d2add40db6776355b68a074dd0",
+    "components": "creator-web, core-runtime, cognitive-worker, research-runtime healthy",
+    "local_medium_discovery": "AVAILABLE",
+    "bounded_qualification": "HTTP 200 in 1.390 seconds with one-token output budget",
+    "advisory": "HTTP 200 through the candidate cognitive route within the 12-second budget"
+  },
+  "canonical_lifecycle_state": {
+    "provider": "local-medium-primary",
+    "qualification": "DISCOVERED",
+    "activation": "INACTIVE",
+    "health": "AVAILABLE",
+    "interpretation": "Discovery and reachability evidence do not self-activate a cognitive binding."
+  },
+  "boundary": {
+    "required_next_transition": "independent evaluation/canary promotion through the protected Capability/Core owner path",
+    "not_performed": [
+      "direct database update",
+      "manual admission lease reset",
+      "fallback substitution for Local MEDIUM",
+      "automatic activation",
+      "browser or authentication bypass"
+    ],
+    "why_task_cannot_complete": "The active packet permits provider invocation and typed immediate failure mapping, but does not authorize the independent Core/Capability activation decision required to reach VALIDATED/ACTIVE."
+  }
+}

docs/evidence/gen2-cognitive-003-production-invocation-2026-09-01.json

@@ -0,0 +1,44 @@
+{
+  "evidence_id": "gen2-cognitive-003-production-invocation-2026-09-01",
+  "task_id": "GEN2-COGNITIVE-003",
+  "task_revision": 4,
+  "recorded_at": "2026-09-01T00:11:44.8896901Z",
+  "environment": "production isolated candidate slot B",
+  "candidate_revision": "dd9bca3ace51e1c0af50fd67dba20caad17cf391",
+  "candidate_components": {
+    "creator-web": "healthy",
+    "core-runtime": "healthy",
+    "cognitive-worker": "healthy",
+    "research-runtime": "healthy"
+  },
+  "binding": {
+    "provider_instance": "local-medium-primary",
+    "qualification": "VALIDATED",
+    "activation": "ACTIVE",
+    "health": "AVAILABLE",
+    "model": "gemma-4-26B-A4B-it-UD-Q4_K_M"
+  },
+  "invocation": {
+    "path": "candidate core network -> candidate cognitive-worker -> Capability resolver -> local-medium-primary",
+    "before_restart": {
+      "finish_reason": "COMPLETED",
+      "response_observed": true
+    },
+    "after_restart": {
+      "finish_reason": "COMPLETED",
+      "response_observed": true
+    }
+  },
+  "restart": {
+    "components": ["core-runtime", "cognitive-worker"],
+    "readiness": "healthy",
+    "binding_reselected": true,
+    "stable_untouched": true
+  },
+  "security": {
+    "credentials_or_secrets_logged": false,
+    "provider_payload_logged": false,
+    "manual_state_mutation": false
+  },
+  "status": "LOCAL_MEDIUM_INVOCATION_AND_RESTART_RECOVERY_VERIFIED"
+}

docs/evidence/gen2-cognitive-003-qualification-phase-2026-08-31.json

@@ -0,0 +1,47 @@
+{
+  "task_id": "GEN2-COGNITIVE-003",
+  "task_revision": 4,
+  "recorded_at": "2026-08-31T07:28:00Z",
+  "revision": "dd9bca3ace51e1c0af50fd67dba20caad17cf391",
+  "environment": "isolated candidate slot B",
+  "candidate_components": {
+    "creator-web": "healthy",
+    "core-runtime": "healthy",
+    "cognitive-worker": "healthy",
+    "research-runtime": "healthy"
+  },
+  "qualification_phase_trace": {
+    "correlation_id": "92cfec5eca6c57c59cf48da6d1644005",
+    "provider": "local-medium-primary",
+    "model": "Qwen3.6-27B-UD-Q4_K_XL",
+    "result": "REACHABLE",
+    "finish_reason": "COMPLETED",
+    "invocation_latency_millis": 3025,
+    "phases": {
+      "Q0_request_accepted": 0,
+      "Q1_binding_candidate_loaded": 0,
+      "Q2_provider_model_resolved": 342,
+      "Q3_bounded_invocation_started": 342,
+      "Q4_bounded_invocation_completed": 3367,
+      "Q5_invocation_evidence_built": 3368,
+      "Q6_observation_persistence_started": 3368,
+      "Q7_observation_persistence_completed": 3371,
+      "Q8_independent_evaluation_not_started": 3371,
+      "Q17_response_returned": 3371
+    }
+  },
+  "findings": [
+    "The bounded Local MEDIUM provider invocation completed in 3.025 seconds.",
+    "The canonical qualification-observation persistence segment consumed 3 milliseconds and did not approach the 12-second household request budget.",
+    "The worker intentionally stops after operational qualification evidence. It does not create independent evaluation, CANARY, or ACTIVE state.",
+    "The existing governed activation path is Core POST /v1/creator/cognitive-canary followed by POST /v1/creator/cognitive-activate; both require a creator session and Capability-owned evaluation evidence."
+  ],
+  "security": {
+    "prompts_logged": false,
+    "model_answers_logged": false,
+    "credentials_or_secrets_logged": false,
+    "direct_database_state_change": false,
+    "manual_admission_lease_change": false
+  },
+  "status": "QUALIFICATION_EVIDENCE_RECORDED_ACTIVATION_REQUIRES_EXISTING_GOVERNED_AUTHORIZED_PATH"
+}

docs/evidence/gen2-evolve-004-runtime-001-verification-2026-09-01.json

@@ -0,0 +1,32 @@
+{
+  "evidence_id": "gen2-evolve-004-runtime-001-verification-2026-09-01",
+  "task_id": "GEN2-EVOLVE-004-RUNTIME-001",
+  "task_revision": 2,
+  "recorded_at": "2026-09-01T00:15:40.9122835Z",
+  "implementation": {
+    "commit": "75fa8477d8ed6b7cecdfc34ea512c358774fbf84",
+    "composition": "Core learningRecorder receives the existing SELF repository through the composition root",
+    "canonical_writer": "SelfRepository only",
+    "schema": "existing migration 055; no new migration"
+  },
+  "targeted_verification": {
+    "correction_to_self_signal_need_ledger": "PASS in cmd/core-runtime focused test",
+    "self_repository_failure_is_non_fatal": "PASS in cmd/core-runtime focused test",
+    "core_self_domain_contracts": "PASS",
+    "preflight_check_diff_independent_architecture_whitespace": "PASS"
+  },
+  "candidate_runtime": {
+    "slot": "B",
+    "revision": "dd9bca3ace51e1c0af50fd67dba20caad17cf391",
+    "core_health": "healthy",
+    "cognitive_health": "healthy",
+    "core_restart_recovery": "PASS",
+    "self_secret_mount": "READABLE (value not read)",
+    "self_config": "self_role via credential reference"
+  },
+  "production_e2e": {
+    "durable_authenticated_correction_and_reopen": "UNVERIFIED",
+    "reason": "Browser acceptance is owner-deferred and no sanctioned authenticated service/test principal was available without reading a credential or creating an auth bypass."
+  },
+  "status": "IMPLEMENTED_TARGETED_VERIFIED_PRODUCTION_DURABLE_E2E_UNVERIFIED"
+}

modules/authority/domain/delegated_control_plane.go

@@ -24,9 +24,25 @@ func ValidateDelegatedControlPlaneGrant(nowUnixMillis int64, binding identity.Pr
 }
 
 func RequestMatchesDelegatedControlPlaneGrant(grant authority.DelegatedControlPlaneGrant, request authority.DelegatedControlPlaneRequest) bool {
-	return grant.TaskID != "" && grant.TaskID == request.TaskID && grant.TaskRevision > 0 && grant.TaskRevision == request.TaskRevision &&
-		request.GrantID == grant.ID && request.Operation != "" && slices.Contains(grant.Operations, request.Operation) &&
-		grant.Resource.BindingID != "" && grant.Resource.ProviderInstanceID != "" && grant.Resource.ModelDescriptorID != "" && grant.Resource == request.Resource
+	if grant.TaskID == "" || grant.TaskID != request.TaskID || grant.TaskRevision < 1 || grant.TaskRevision != request.TaskRevision ||
+		request.GrantID != grant.ID || request.Operation == "" || !slices.Contains(grant.Operations, request.Operation) {
+		return false
+	}
+	switch request.Operation {
+	case authority.DelegatedOperationCreateCandidateCapabilityBinding, authority.DelegatedOperationUseCandidateCapabilityBinding, authority.DelegatedOperationRevokeCandidateCapabilityBinding:
+		return validCandidateResource(grant.CandidateResource) && grant.CandidateResource == request.CandidateResource && request.Resource == (authority.CognitiveBindingResource{})
+	default:
+		return validCognitiveResource(grant.Resource) && grant.Resource == request.Resource && request.CandidateResource == (authority.CandidateCapabilityBindingResource{})
+	}
+}
+
+func validCognitiveResource(resource authority.CognitiveBindingResource) bool {
+	return resource.BindingID != "" && resource.ProviderInstanceID != "" && resource.ModelDescriptorID != ""
+}
+
+func validCandidateResource(resource authority.CandidateCapabilityBindingResource) bool {
+	return resource.ReleaseSetID != "" && resource.Slot != "" && resource.CapabilityID != "" && resource.ResourceScope != "" &&
+		(resource.Mode == "CANDIDATE" || resource.Mode == "SHADOW") && resource.TargetKind != "" && resource.TargetRef != "" && len(resource.TargetDigest) == 64
 }
 
 func CanIssuerRevokeDelegatedGrant(issuer identity.PrincipalID, grant authority.DelegatedControlPlaneGrant) bool {

modules/authority/domain/delegated_control_plane_test.go

@@ -41,3 +41,17 @@ func TestDelegatedGrantCannotSelfRevokeOrBroaden(t *testing.T) {
 		t.Fatal("issuer could not revoke active grant")
 	}
 }
+
+func TestCandidateBindingGrantIsExactAndCannotBroaden(t *testing.T) {
+	resource := authority.CandidateCapabilityBindingResource{ReleaseSetID: "assistant-slot-b", Slot: "b", CapabilityID: "prospective-notification-delivery", ResourceScope: "synthetic-shadow-notification-v1", Mode: "SHADOW", TargetKind: "NOTIFICATION_SHADOW_RECEIVER", TargetRef: "notification-receiver-candidate", TargetDigest: "271c79ca1b1a590f1309461a87ba39bc017dfeb8d99268d1a7bd3a16d1d4b4d3"}
+	grant := authority.DelegatedControlPlaneGrant{ID: "candidate-grant", ServiceActorID: "service-actor", ServicePrincipalID: "service-principal", IssuerPrincipalID: "owner", TaskID: "GEN2-CAPABILITY-001", TaskRevision: 2, Operations: []authority.DelegatedControlPlaneOperation{authority.DelegatedOperationUseCandidateCapabilityBinding}, CandidateResource: resource, IssuedAtUnixMillis: 10, ExpiresAtUnixMillis: 100, ArchitectureRevision: "ADR-0021", Nonce: "nonce", Revision: 1, Status: authority.DelegatedGrantActive}
+	binding := identity.PrincipalBinding{ActorID: "service-actor", PrincipalID: "service-principal", Active: true}
+	request := authority.DelegatedControlPlaneRequest{GrantID: grant.ID, TaskID: grant.TaskID, TaskRevision: grant.TaskRevision, Operation: authority.DelegatedOperationUseCandidateCapabilityBinding, CandidateResource: resource}
+	if err := ValidateDelegatedControlPlaneGrant(20, binding, grant, request); err != nil {
+		t.Fatalf("exact candidate grant denied: %v", err)
+	}
+	request.CandidateResource.ReleaseSetID = "assistant-slot-a"
+	if err := ValidateDelegatedControlPlaneGrant(20, binding, grant, request); err == nil {
+		t.Fatal("different release set was allowed")
+	}
+}

modules/capability/domain/candidate_binding.go

@@ -0,0 +1,85 @@
+package domain
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"net/url"
+	"strings"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+)
+
+var ErrCandidateBindingRequired = errors.New("candidate capability binding required")
+
+type canonicalCandidateTargetDescriptor struct {
+	Version         string `json:"version"`
+	BindingRevision int64  `json:"binding_revision"`
+	TargetKind      string `json:"target_kind"`
+	TargetRef       string `json:"target_ref"`
+	Protocol        string `json:"protocol"`
+	Origin          string `json:"origin"`
+	ReleaseSetID    string `json:"release_set_id"`
+	Slot            string `json:"slot"`
+	TaskID          string `json:"task_id"`
+	TaskRevision    int64  `json:"task_revision"`
+	CapabilityID    string `json:"capability_id"`
+	ResourceScope   string `json:"resource_scope"`
+	Mode            string `json:"mode"`
+}
+
+func CandidateTargetDigest(value capability.CandidateBinding) (string, error) {
+	origin, err := url.Parse(value.TargetOrigin)
+	if err != nil || origin.Host == "" || origin.User != nil || origin.RawQuery != "" || origin.Fragment != "" || (origin.Path != "" && origin.Path != "/") {
+		return "", ErrCandidateBindingRequired
+	}
+	origin.Scheme, origin.Host, origin.Path = strings.ToLower(origin.Scheme), strings.ToLower(origin.Host), ""
+	descriptor := canonicalCandidateTargetDescriptor{Version: "v1", BindingRevision: value.Revision, TargetKind: value.Context.TargetKind, TargetRef: value.Context.TargetRef, Protocol: string(value.Protocol), Origin: origin.String(), ReleaseSetID: value.Context.ReleaseSetID, Slot: value.Context.Slot, TaskID: value.Context.TaskID, TaskRevision: value.Context.TaskRevision, CapabilityID: string(value.Context.CapabilityID), ResourceScope: value.Context.ResourceScope, Mode: string(value.Context.Mode)}
+	encoded, err := json.Marshal(descriptor)
+	if err != nil {
+		return "", err
+	}
+	sum := sha256.Sum256(encoded)
+	return hex.EncodeToString(sum[:]), nil
+}
+
+// ValidateCandidateBinding validates Capability-owned candidate state. Stable
+// Binding validation intentionally remains stricter and HTTPS-only.
+func ValidateCandidateBinding(value capability.CandidateBinding) error {
+	context := value.Context
+	if value.ID == "" || value.Revision < 1 || value.BaseActiveBindingID == "" || value.BaseActiveBindingRevision < 1 ||
+		context.ReleaseSetID == "" || context.Slot == "" || context.TaskID == "" || context.TaskRevision < 1 || context.PrincipalID == "" ||
+		context.CapabilityID == "" || context.ResourceScope == "" || context.TargetKind == "" || context.TargetRef == "" || len(context.TargetDigest) != 64 || context.AuthorityGrantID == "" ||
+		(value.Status != capability.CandidateBindingActive && value.Status != capability.CandidateBindingRevoked) ||
+		(value.Context.Mode != capability.CandidateBindingModeCandidate && value.Context.Mode != capability.CandidateBindingModeShadow) ||
+		value.Protocol != capability.ProtocolIdempotentReceiptV1 || value.CreatedAtUnixMillis < 1 || value.ExpiresAtUnixMillis <= value.CreatedAtUnixMillis ||
+		!fixedPath(value.DeliveryPath) || !fixedPath(value.ReceiptPath) || value.DeliveryPath == value.ReceiptPath {
+		return ErrCandidateBindingRequired
+	}
+	origin, err := url.Parse(value.TargetOrigin)
+	if err != nil || origin.Host == "" || origin.User != nil || origin.RawQuery != "" || origin.Fragment != "" || (origin.Path != "" && origin.Path != "/") {
+		return ErrCandidateBindingRequired
+	}
+	if context.Mode == capability.CandidateBindingModeCandidate && origin.Scheme != "https" {
+		return ErrCandidateBindingRequired
+	}
+	if context.Mode == capability.CandidateBindingModeShadow && origin.Scheme != "http" && origin.Scheme != "https" {
+		return ErrCandidateBindingRequired
+	}
+	if strings.TrimSpace(value.TargetOrigin) != value.TargetOrigin {
+		return ErrCandidateBindingRequired
+	}
+	digest, err := CandidateTargetDigest(value)
+	if err != nil || digest != context.TargetDigest {
+		return ErrCandidateBindingRequired
+	}
+	return nil
+}
+
+func CandidateBindingInvocable(value capability.CandidateBinding, context capability.CandidateReleaseContext, nowUnixMillis int64) error {
+	if ValidateCandidateBinding(value) != nil || value.Status != capability.CandidateBindingActive || nowUnixMillis < value.CreatedAtUnixMillis || nowUnixMillis >= value.ExpiresAtUnixMillis || value.Context != context {
+		return ErrCandidateBindingRequired
+	}
+	return nil
+}

modules/capability/domain/candidate_binding_test.go

@@ -0,0 +1,67 @@
+package domain
+
+import (
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/identity"
+)
+
+func validCandidateBinding() capability.CandidateBinding {
+	context := capability.CandidateReleaseContext{ReleaseSetID: "assistant-slot-b", Slot: "b", TaskID: "GEN2-CAPABILITY-001", TaskRevision: 7, PrincipalID: identity.PrincipalID("owner-1"), CapabilityID: "prospective-notification-delivery", ResourceScope: "synthetic-shadow-notification-v1", Mode: capability.CandidateBindingModeShadow, TargetKind: "NOTIFICATION_SHADOW_RECEIVER", TargetRef: "notification-receiver-candidate", AuthorityGrantID: "grant-1"}
+	binding := capability.CandidateBinding{ID: "candidate-binding-1", Revision: 1, BaseActiveBindingID: "stable-binding-1", BaseActiveBindingRevision: 1, Context: context, TargetOrigin: "http://notification-receiver-candidate:8085", DeliveryPath: "/delivery/v1/deliveries", ReceiptPath: "/delivery/v1/receipts", Protocol: capability.ProtocolIdempotentReceiptV1, CreatedAtUnixMillis: 10, ExpiresAtUnixMillis: 100, Status: capability.CandidateBindingActive}
+	digest, err := CandidateTargetDigest(binding)
+	if err != nil {
+		panic(err)
+	}
+	binding.Context.TargetDigest = digest
+	return binding
+}
+
+func TestCandidateBindingIsExactAndFailsClosed(t *testing.T) {
+	binding := validCandidateBinding()
+	if err := CandidateBindingInvocable(binding, binding.Context, 20); err != nil {
+		t.Fatalf("valid candidate binding denied: %v", err)
+	}
+	for _, mutate := range []func(*capability.CandidateReleaseContext){
+		func(v *capability.CandidateReleaseContext) { v.ReleaseSetID = "assistant-slot-other" },
+		func(v *capability.CandidateReleaseContext) { v.TaskID = "GEN2-OTHER" },
+		func(v *capability.CandidateReleaseContext) { v.AuthorityGrantID = "other-grant" },
+	} {
+		request := binding.Context
+		mutate(&request)
+		if err := CandidateBindingInvocable(binding, request, 20); err == nil {
+			t.Fatal("mismatched candidate context was allowed")
+		}
+	}
+	if err := CandidateBindingInvocable(binding, binding.Context, 100); err == nil {
+		t.Fatal("expired candidate binding was allowed")
+	}
+	binding.Status = capability.CandidateBindingRevoked
+	if err := CandidateBindingInvocable(binding, binding.Context, 20); err == nil {
+		t.Fatal("revoked candidate binding was allowed")
+	}
+}
+
+func TestCandidateTargetDigestBindsSemanticDescriptor(t *testing.T) {
+	binding := validCandidateBinding()
+	digest, err := CandidateTargetDigest(binding)
+	if err != nil || digest != binding.Context.TargetDigest {
+		t.Fatalf("digest=%q err=%v", digest, err)
+	}
+	if digest != "f9f9fa49a0727444c280c092d5bb340f3a8f33cf325c5396f5ae177a6666da35" {
+		t.Fatalf("canonical descriptor digest changed: %q", digest)
+	}
+	changed := binding
+	changed.Context.ResourceScope = "different-resource"
+	other, err := CandidateTargetDigest(changed)
+	if err != nil || other == digest {
+		t.Fatalf("scope did not affect digest: %q %q err=%v", digest, other, err)
+	}
+	changed = binding
+	changed.Revision++
+	other, err = CandidateTargetDigest(changed)
+	if err != nil || other == digest {
+		t.Fatalf("binding revision did not affect digest: %q %q err=%v", digest, other, err)
+	}
+}

modules/capability/ports/repository.go

@@ -14,6 +14,9 @@ type Repository interface {
 	SaveBinding(context.Context, capability.Binding) error
 	LoadBinding(context.Context, capability.CapabilityBindingID, int64) (capability.Binding, error)
 	LoadActiveBinding(context.Context, capability.CapabilityID, identity.PrincipalID) (capability.Binding, error)
+	SaveCandidateBinding(context.Context, capability.CandidateBinding) error
+	ResolveCandidateBinding(context.Context, capability.CandidateReleaseContext, int64) (capability.CandidateBindingResolution, error)
+	RevokeCandidateBinding(context.Context, capability.CapabilityBindingID, int64, int64) (bool, error)
 	SaveProviderInstance(context.Context, capability.ProviderInstance) error
 	SaveModelDescriptor(context.Context, capability.ModelDescriptor) error
 	SaveCognitiveBinding(context.Context, capability.CognitiveBinding) error

modules/commit/domain/commit.go

@@ -98,19 +98,26 @@ func validDigest(value string) bool {
 // Execute records UNKNOWN_OUTCOME rather than silently retrying an ambiguous
 // external mutation.
 func Execute(action commitcontract.AuthorizedAction, attemptID commitcontract.ActionAttemptID, executor ports.Executor) (commitcontract.ActionAttempt, error) {
+	attempt, _, err := ExecuteWithResult(action, attemptID, executor)
+	return attempt, err
+}
+
+// ExecuteWithResult preserves executor evidence for the Commit runtime while
+// keeping the original domain API compatible with existing callers.
+func ExecuteWithResult(action commitcontract.AuthorizedAction, attemptID commitcontract.ActionAttemptID, executor ports.Executor) (commitcontract.ActionAttempt, ports.ExecutionResult, error) {
 	if action.State != commitcontract.ActionAuthorized || attemptID == "" {
-		return commitcontract.ActionAttempt{}, ErrUnknownOutcome
+		return commitcontract.ActionAttempt{}, ports.ExecutionResult{}, ErrUnknownOutcome
 	}
 	attempt := commitcontract.ActionAttempt{ID: attemptID, AuthorizedID: action.ID, IntentID: action.Proposal.IntentID, State: commitcontract.ActionExecuting}
 	result := executor.Execute(action)
 	if !result.Known {
 		attempt.State = commitcontract.ActionUnknownOutcome
-		return attempt, ErrUnknownOutcome
+		return attempt, result, ErrUnknownOutcome
 	}
 	if result.Succeeded {
 		attempt.State = commitcontract.ActionSucceeded
-		return attempt, nil
+		return attempt, result, nil
 	}
 	attempt.State = commitcontract.ActionFailed
-	return attempt, nil
+	return attempt, result, nil
 }

modules/commit/ports/executor.go

@@ -19,6 +19,7 @@ type Reconciler interface {
 type ExecutionResult struct {
 	Succeeded bool
 	Known     bool
+	Receipt   *commit.ExecutionReceipt
 }
 
 // AuthorityValidator is the remote-capable boundary to the Authority owner.

modules/epistemics/domain/experience.go

@@ -50,6 +50,9 @@ func NewExperienceRecord(value epistemics.ExperienceRecord) (epistemics.Experien
 	if value.VerificationEvidence == nil {
 		value.VerificationEvidence = []epistemics.EvidenceRef{}
 	}
+	if value.ApplicabilityConditions == nil {
+		value.ApplicabilityConditions = []string{}
+	}
 	return value, nil
 }
 

modules/epistemics/domain/experience_test.go

@@ -85,3 +85,22 @@ func TestFastPathDeclineReturnsToThinkingInsteadOfGuessing(t *testing.T) {
 		t.Fatalf("decline should preserve reflection/escalation evidence, candidate=%#v ok=%v err=%v", candidate, ok, err)
 	}
 }
+
+func TestExperienceNormalizesApplicabilityConditionsForNonNullPersistence(t *testing.T) {
+	experience, err := NewExperienceRecord(epistemics.ExperienceRecord{
+		SourceKind:           epistemics.ExperienceSourceInteraction,
+		OriginalIntentID:     "intent-1",
+		SourceUtteranceID:    "utterance-4",
+		HelpMethod:           epistemics.HelpMethodClarification,
+		ExpectedOutcome:      epistemics.OutcomeSuccess,
+		ActualOutcome:        epistemics.OutcomeUserCorrected,
+		ConfidenceMillis:     1000,
+		RecordedAtUnixMillis: 1300,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if experience.ApplicabilityConditions == nil {
+		t.Fatal("applicability conditions must be non-nil before repository persistence")
+	}
+}

modules/identity/domain/session.go

@@ -23,7 +23,23 @@ func IssueCreatorSessionForBinding(secret []byte, actorID identity.ActorID, prin
 	if len(secret) < 32 || actorID == "" || principalID == "" || ttl <= 0 {
 		return "", identity.CreatorSession{}, ErrInvalidCreatorSession
 	}
-	session := identity.CreatorSession{ActorID: actorID, PrincipalID: principalID, ExpiresAtUnix: now.Add(ttl).Unix()}
+	session := identity.CreatorSession{ActorID: actorID, PrincipalID: principalID, PrincipalKind: identity.PrincipalKindHuman, ExpiresAtUnix: now.Add(ttl).Unix()}
+	payload, err := json.Marshal(session)
+	if err != nil {
+		return "", identity.CreatorSession{}, err
+	}
+	encoded := base64.RawURLEncoding.EncodeToString(payload)
+	return encoded + "." + signature(secret, encoded), session, nil
+}
+
+func IssueServiceSession(secret []byte, principal identity.ServicePrincipal, now time.Time, ttl time.Duration) (string, identity.CreatorSession, error) {
+	if principal.Kind != identity.PrincipalKindService || !principal.Active || principal.ActorID == "" || principal.PrincipalID == "" || principal.Purpose == "" || ttl <= 0 {
+		return "", identity.CreatorSession{}, ErrInvalidCreatorSession
+	}
+	if len(secret) < 32 {
+		return "", identity.CreatorSession{}, ErrInvalidCreatorSession
+	}
+	session := identity.CreatorSession{ActorID: principal.ActorID, PrincipalID: principal.PrincipalID, PrincipalKind: principal.Kind, ExpiresAtUnix: now.Add(ttl).Unix()}
 	payload, err := json.Marshal(session)
 	if err != nil {
 		return "", identity.CreatorSession{}, err
@@ -45,6 +61,9 @@ func ValidateCreatorSession(secret []byte, token string, now time.Time) (identit
 	if json.Unmarshal(payload, &session) != nil || session.ActorID == "" || session.PrincipalID == "" || now.Unix() >= session.ExpiresAtUnix {
 		return identity.CreatorSession{}, ErrInvalidCreatorSession
 	}
+	if session.PrincipalKind == "" {
+		session.PrincipalKind = identity.PrincipalKindHuman
+	}
 	return session, nil
 }
 

modules/identity/domain/session_test.go

@@ -0,0 +1,36 @@
+package domain
+
+import (
+	"bytes"
+	"testing"
+	"time"
+
+	"git.cin.su/m/Assistant/contracts/identity"
+)
+
+func TestServiceSessionIsDistinctFromHumanCreatorSession(t *testing.T) {
+	secret := bytes.Repeat([]byte{7}, 32)
+	principal := identity.ServicePrincipal{ActorID: "acceptance-actor", PrincipalID: "acceptance-principal", Kind: identity.PrincipalKindService, Purpose: "AUTHENTICATE_ACCEPTANCE_HARNESS", SyntheticScope: "synthetic-acceptance-scope", Active: true, Revision: 1}
+	token, issued, err := IssueServiceSession(secret, principal, time.Unix(100, 0), time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if issued.PrincipalKind != identity.PrincipalKindService {
+		t.Fatalf("kind=%q", issued.PrincipalKind)
+	}
+	validated, err := ValidateCreatorSession(secret, token, time.Unix(101, 0))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if validated.PrincipalKind != identity.PrincipalKindService || validated.PrincipalID != principal.PrincipalID {
+		t.Fatalf("validated=%#v", validated)
+	}
+}
+
+func TestServiceSessionRejectsInactivePrincipal(t *testing.T) {
+	secret := bytes.Repeat([]byte{7}, 32)
+	_, _, err := IssueServiceSession(secret, identity.ServicePrincipal{ActorID: "a", PrincipalID: "p", Kind: identity.PrincipalKindService, Purpose: "test"}, time.Unix(100, 0), time.Minute)
+	if err == nil {
+		t.Fatal("inactive service principal was accepted")
+	}
+}

platform/secrets/machine_credentials.go

@@ -18,6 +18,7 @@ import (
 
 const (
 	ControlPlaneServiceTokenID = "control_plane_service_token"
+	AcceptanceHarnessServiceTokenID = "acceptance_harness_service_token"
 	MachineCredentialOwner     = "platform.secrets.local-control-plane"
 )
 
@@ -127,6 +128,10 @@ func ControlPlaneServiceTokenSpec() MachineCredentialSpec {
 	}
 }
 
+func AcceptanceHarnessServiceTokenSpec() MachineCredentialSpec {
+	return MachineCredentialSpec{ID: AcceptanceHarnessServiceTokenID, Kind: MachineCredentialServiceToken, Purpose: secretcontracts.SecretPurposeServiceAuthentication, Consumers: []secretcontracts.RuntimeConsumer{secretcontracts.RuntimeConsumerCore}, Bytes: 48}
+}
+
 func (s *LocalMachineCredentialStore) Ensure(spec MachineCredentialSpec) (MachineCredentialResult, error) {
 	if err := validateMachineCredentialSpec(spec); err != nil {
 		return MachineCredentialResult{}, err