dev/ACTIVE_TASK.json

@@ -1,5 +1,5 @@
 {
-  "task_file": "dev/tasks/DEV-000043-production-notification-delivery.json",
-  "task_id": "DEV-000043",
-  "task_revision": 1
+  "task_file": "dev/tasks/DEV-000044-post-notification-production-audit.json",
+  "task_id": "DEV-000044",
+  "task_revision": 3
 }

dev/tasks/DEV-000044-post-notification-production-audit.json

@@ -0,0 +1,32 @@
+{
+  "task_id": "DEV-000044",
+  "task_revision": 3,
+  "architecture_revision": "ADR-0005",
+  "base_repo_revision": "759328972a7ae583f27eec5b97a7a8dea9df2ce7",
+  "risk_tier": "E",
+  "intent": "Re-audit the exact merged Assistant artifact after the first production notification operation, update repository status evidence, and identify remaining work without inventing unapproved product or architecture scope; docker-test remains prohibited.",
+  "requirement_ids": ["ADR-0005", "INV-AUTH-001", "INV-OWN-001", "INV-CONT-001", "INV-TOPO-001", "USER-DOCKER-PROD-ONLY"],
+  "allowed_change_scope": {
+    "modules": [],
+    "paths": [
+      "docs/FOUNDATION_EXIT_AUDIT.md",
+      "docs/PROJECT_STATUS.md",
+      "tests/creator_commit/verify-remote.ps1",
+      "dev/ACTIVE_TASK.json",
+      "dev/tasks/DEV-000044-post-notification-production-audit.json"
+    ]
+  },
+  "forbidden_change_scope": {"paths": ["architecture/**", "ci/**", ".gitea/**", "contracts/**", "modules/**", "adapters/**", "cmd/**", "database/**", "deploy/**", "security/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0},
+  "contracts": {"consume": ["ADR-0005", "DEV-000041", "DEV-000042", "DEV-000043", "existing production verification scripts"], "may_change": []},
+  "semantic_owner": "none-verification",
+  "canonical_state": [],
+  "state_transitions": [],
+  "side_effects_and_privileges": ["read-only production verification", "authenticated smoke may create only its documented disposable test evidence through the existing Commit path"],
+  "persistence_and_migrations": [],
+  "failure_retry_restart": ["audit records failures as gaps and does not weaken checks", "no production mutation outside existing verification harness semantics"],
+  "assumptions": ["origin/main is the deployed exact artifact", "docker.cin.su SSH alias docker remains the production host", "docker-test remains prohibited"],
+  "acceptance_scenarios": ["local deterministic tests and architecture checks pass", "production stack and Windows tasks are healthy", "notification HTTPS authorization and durable receipt path pass", "Creator remote smoke passes through a Windows/Docker CLI-safe command invocation", "production artifact provenance is either proven or recorded as an explicit gap", "repository documents completed post-foundation work and remaining product decisions"],
+  "required_tests": ["task schema", "architecture preflight", "exact diff scope", "go test", "go vet", "production health", "authenticated Creator notification smoke", "docker-test absence"],
+  "terminal_gap_states": ["BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_CONFLICT", "BLOCKED_BY_MISSING_CAPABILITY"]
+}

docs/FOUNDATION_EXIT_AUDIT.md

@@ -21,8 +21,10 @@ Status is based on executed repository tests and Docker-stack verification on 20
 
 Foundation V1 is eligible for freeze. Creator session authentication was also completed as DEV-000019 and does not carry Authority.
 
-Post-foundation product work is intentionally separate:
+The three original post-foundation gates are complete:
 
-1. Choose and specify the first real external operation before adding a production Executor credential.
-2. Build Creator API/UI only through validated Identity, Authority and Commit boundaries.
-3. Add exact diff-to-task scope comparison to promotion CI when the first Git baseline exists.
+1. `ADR-0005` specifies the first real external operation, prospective notification delivery.
+2. DEV-000024 through DEV-000032 and DEV-000040 through DEV-000043 provide the authenticated Creator API/UI and external operation only through the validated Identity, Authority, Continuity, Capability and Commit boundaries.
+3. `ADR-0004` and ARCH-000004 implement exact diff-to-task scope comparison.
+
+DEV-000044 re-ran local architecture/unit checks and the production Creator-to-receiver smoke on 2026-08-16. The deployed stack and Windows operational tasks were healthy. Current product status and explicitly uncommitted future scope are recorded in `docs/PROJECT_STATUS.md`.

docs/PROJECT_STATUS.md

@@ -0,0 +1,28 @@
+# Assistant project status
+
+Audit date: 2026-08-16. Active audit: DEV-000044 revision 3.
+
+## Delivered
+
+- Foundation V1 is frozen and all exit criteria pass.
+- The single Creator account authenticates at `https://assistent.cin.su`; authentication does not imply Authority.
+- Creator can inspect the bounded operational view, register and satisfy Continuity prospective items, inspect action history, and explicitly request the accepted notification operation.
+- `deliver-prospective-notification-v1` executes only through Capability binding, current Authority and Commit/Executor validation. Its success evidence is an immutable receiver receipt.
+- Production runs on `docker.cin.su`; the project does not use the shared test Docker host.
+- PostgreSQL backup/restore, encrypted off-host backup, production health monitoring and the current-user Windows notification projection are installed and healthy.
+
+## Evidence from DEV-000044
+
+- `go test ./...`, `go vet ./...`, architecture preflight/checks and PowerShell parsing pass.
+- `Test-DomovoyProductionHealth.ps1` reports `healthy` for the production stack, HTTPS/DNS/TLS, backups and registered Windows tasks.
+- `tests/creator_commit/verify-remote.ps1` passes the authenticated Creator → Commit → notification receiver receipt flow on `docker-prod`.
+- The smoke harness was corrected to preserve HTTP Authorization headers under Windows PowerShell 5.1 native-command argument handling.
+
+## Remaining work requiring a new task decision
+
+1. **Artifact provenance:** running images expose Compose image digests but no OCI Git revision label, and Go build metadata reports the module as `(devel)`. Operational behavior is verified, but the source revision of an already-running image cannot be independently proven from that image alone. A deployment task should stamp the immutable Git revision and record the promoted image digests.
+2. **Cognitive provider:** the cognitive worker intentionally remains the deterministic fake. Selecting a real model/provider, data policy and allowed proposal contract requires a separate capability/architecture decision; it must not gain canonical mutation authority.
+3. **Product breadth:** notification delivery is the only accepted real external operation. Any additional operation needs its own proposal, authority model, idempotency/reconciliation semantics and Capability binding.
+4. **Artifact and Epistemics product behavior:** their ownership boundaries exist, but no product task has yet specified durable user-facing workflows for them.
+
+These are explicit scope decisions, not hidden incomplete steps in DEV-000043. No production secret is stored in the repository.

tests/creator_commit/verify-remote.ps1

@@ -29,7 +29,7 @@ function Creator-Post([string]$url, [object]$body, [string]$token) {
     try {
         [IO.File]::WriteAllText($local, $json, [Text.UTF8Encoding]::new($false))
         docker --context $DockerContext cp $local "${commitContainer}:$remote" | Out-Null
-        $result = docker --context $DockerContext exec --env "CREATOR_TEST_SESSION=$token" $commitContainer sh -c 'wget -qO- --header="Content-Type: application/json" --header="Authorization: Bearer $CREATOR_TEST_SESSION" --post-file "$1" "$2"' sh $remote $url
+        $result = docker --context $DockerContext exec --env "CREATOR_TEST_SESSION=$token" $commitContainer sh -c 'auth=Authorization:\ Bearer\ $CREATOR_TEST_SESSION; IFS=; wget -qO- --header=Content-Type:application/json --header=$auth --post-file=$1 $2' sh $remote $url
         if ($LASTEXITCODE -ne 0) { throw "Creator POST $url failed" }
         return ($result -join "`n")
     } finally {
@@ -39,7 +39,7 @@ function Creator-Post([string]$url, [object]$body, [string]$token) {
 }
 
 function Creator-Get([string]$url, [string]$token) {
-    $result = docker --context $DockerContext exec --env "CREATOR_TEST_SESSION=$token" $commitContainer sh -c 'wget -qO- --header="Authorization: Bearer $CREATOR_TEST_SESSION" "$1"' sh $url
+    $result = docker --context $DockerContext exec --env "CREATOR_TEST_SESSION=$token" $commitContainer sh -c 'auth=Authorization:\ Bearer\ $CREATOR_TEST_SESSION; IFS=; wget -qO- --header=$auth $1' sh $url
     if ($LASTEXITCODE -ne 0) { throw "Creator GET $url failed" }
     return ($result -join "`n")
 }
@@ -53,7 +53,7 @@ function Expect-CreatorStatus([string]$url, [object]$body, [string]$token, [int]
         docker --context $DockerContext cp $local "${commitContainer}:$remote" | Out-Null
         $previous = $ErrorActionPreference
         $ErrorActionPreference = "Continue"
-        $result = (docker --context $DockerContext exec --env "CREATOR_TEST_SESSION=$token" $commitContainer sh -c 'wget -S -O /dev/null --header="Content-Type: application/json" --header="Authorization: Bearer $CREATOR_TEST_SESSION" --post-file "$1" "$2"' sh $remote $url 2>&1) -join "`n"
+        $result = (docker --context $DockerContext exec --env "CREATOR_TEST_SESSION=$token" $commitContainer sh -c 'auth=Authorization:\ Bearer\ $CREATOR_TEST_SESSION; IFS=; wget -S -O /dev/null --header=Content-Type:application/json --header=$auth --post-file=$1 $2' sh $remote $url 2>&1) -join "`n"
         $ErrorActionPreference = $previous
         if ($result -notmatch "HTTP/1\.[01] $status") { throw "Creator POST $url did not return $status" }
     } finally {
@@ -62,12 +62,7 @@ function Expect-CreatorStatus([string]$url, [object]$body, [string]$token, [int]
     }
 }
 
-$sessionResponse = docker --context $DockerContext exec $coreContainer sh -c '
-token="$CREATOR_BOOTSTRAP_TOKEN"
-if [ -n "$CREATOR_BOOTSTRAP_TOKEN_FILE" ]; then token=$(cat "$CREATOR_BOOTSTRAP_TOKEN_FILE"); fi
-if [ -z "$token" ]; then exit 7; fi
-wget -qO- --header="Authorization: Bearer $token" --post-data="" "$1/v1/creator/sessions"
-' sh http://localhost:8080
+$sessionResponse = docker --context $DockerContext exec $coreContainer sh -c 'token=$CREATOR_BOOTSTRAP_TOKEN; if test x$CREATOR_BOOTSTRAP_TOKEN_FILE != x; then token=$(cat $CREATOR_BOOTSTRAP_TOKEN_FILE); fi; if test x$token = x; then exit 7; fi; header=Authorization:\ Bearer\ $token; IFS=; wget -qO- --header=$header --post-data={} http://localhost:8080/v1/creator/sessions'
 if ($LASTEXITCODE -ne 0) { throw "Creator session issuance failed" }
 $creatorSession = ($sessionResponse | ConvertFrom-Json).Token
 
@@ -120,7 +115,7 @@ $notificationAction = Creator-Post http://localhost:8082/v1/creator/continuity/n
 if ($notificationAction.State -ne 'SUCCEEDED' -or -not $notificationAction.ActionIntentID) { throw 'Creator notification did not produce a successful receipt' }
 $notificationItem = docker --context $DockerContext exec $continuityContainer wget -qO- "http://localhost:8081/v1/prospective-items/$notificationProspective" | ConvertFrom-Json
 if ($notificationItem.State -ne 'DELIVERED' -or $notificationItem.Revision -ne 1) { throw 'Notification changed Continuity canonical state' }
-$receiptRaw = docker --context $DockerContext exec $receiverContainer sh -c 'token=$(tr -d "\r\n" < /run/notification-reader/token); wget -qO- --header="Authorization: Bearer $token" "$1"' sh "http://localhost:8085/delivery/v1/receipts/$($notificationAction.ActionIntentID)"
+$receiptRaw = docker --context $DockerContext exec $receiverContainer sh -c 'token=$(cat /run/notification-reader/token); auth=Authorization:\ Bearer\ $token; IFS=; wget -qO- --header=$auth $1' sh "http://localhost:8085/delivery/v1/receipts/$($notificationAction.ActionIntentID)"
 if ($LASTEXITCODE -ne 0) { throw 'Notification receipt lookup failed' }
 $receipt = ($receiptRaw -join "`n") | ConvertFrom-Json
 if ($receipt.action_intent_id -ne $notificationAction.ActionIntentID -or $receipt.request_digest -notmatch '^[0-9a-f]{64}$') { throw 'Notification receipt evidence mismatch' }