dev/ACTIVE_TASK.json

@@ -1,5 +1,5 @@
 {
-  "task_file": "dev/tasks/DEV-000256-model-rating-reachability-evidence.json",
-  "task_id": "DEV-000256",
+  "task_file": "dev/tasks/DEV-000257-operations-acceptance-fast-smoke.json",
+  "task_id": "DEV-000257",
   "task_revision": 1
 }

dev/tasks/DEV-000257-operations-acceptance-fast-smoke.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000257",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "8868258afd4e58edfa9c71e3fbf79793cd32397b",
+  "risk_tier": "E",
+  "intent": "Record a bounded operations acceptance smoke for authenticated fleet and agent-worker status surfaces and unauthenticated protection.",
+  "requirement_ids": ["UI/operations acceptance", "truthful degraded state", "authenticated read-only status"],
+  "allowed_change_scope": {"modules": ["governance-documentation"], "paths": ["docs/evidence/operations-acceptance-2026-08-23-v1.json", "docs/PROJECT_STATUS.md", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000257-operations-acceptance-fast-smoke.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "cmd/**", "modules/**", "adapters/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["authenticated Creator UI", "fleet readiness read API", "agent-worker status read API"], "may_change": ["evidence projection only"]},
+  "semantic_owner": "Governance evidence projection",
+  "canonical_state": ["none"],
+  "state_transitions": ["none"],
+  "side_effects_and_privileges": ["read-only API/UI checks; no mutation"],
+  "persistence_and_migrations": ["none"],
+  "failure_retry_restart": ["failed checks remain explicit and do not alter runtime state"],
+  "assumptions": ["deep UI, long-running delegation and mobile viewport acceptance remain separate tests"],
+  "acceptance_scenarios": ["unauthenticated fleet status returns 401", "unauthenticated agent status returns 401", "authenticated fleet refresh displays selected tier and degraded reason", "authenticated agent refresh displays local fallback and bridge-unavailable reason"],
+  "required_tests": ["go test ./cmd/creator-web", "go vet ./cmd/creator-web", "independent evidence review", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "CI", "production health smoke", "authenticated operations smoke"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
+}

docs/PROJECT_STATUS.md

@@ -2,7 +2,7 @@
 
 ## Current audit delta — 2026-08-23
 
-- `LAST_COMPLETED = DEV-000254`; the governed self-development path now has a local bounded verifier plus durable authenticated CAS transitions for `CANARY`, `PROMOTED` and `ROLLED_BACK`. Production is deployed from merge `12ab124`; mobile UI remains explicitly unverified because the current browser control surface cannot emulate a 390x844 viewport.
+- `LAST_COMPLETED = DEV-000257`; the governed self-development path, provider-neutral reachability rating, and bounded authenticated operations smoke are live. Production is deployed from merge `8868258`; mobile UI remains explicitly unverified because the current browser control surface cannot emulate a 390x844 viewport.
 
 - `CURRENT_PRODUCTION_STATUS = LIVE_HEALTHY`; public `/healthz` is healthy. The exact deployed revision is authoritative in the deployment log and merge record, not duplicated in this mutable status projection. Evidence: `docs/evidence/audit-runtime-status-2026-08-23-v1.json`.
 - `FAST_PROVIDER_STATUS = LIVE_SMOKE_SUPPORTED`: local CPU gateway authentication is configured through a protected file reference; four bounded local-only advisory cases completed through cognitive-worker. Evidence: `docs/evidence/wp-601-fast-gateway-live-smoke-2026-08-22-v1.json`.
@@ -18,7 +18,7 @@
 - `CURRENT_UI_SESSION_STATUS = NO_CURRENT_AUTHENTICATED_SESSION`; the historical quick-smoke evidence above is retained, but the current acceptance run has no signed-in browser session, so no new authenticated visual result is claimed. Public cabinet shell and unauthenticated protection were checked separately.
 - `AGENT_WORKER_STATUS_CORRECTION = LIVE_TRUTHFUL_LOCAL_EXECUTOR`; absence of the protected bridge is reported as `executor_configured=false`, `mode=local-executor`, `ready=false`, with `task-evaluation` as the only advertised local capability; unsupported work remains durably waiting and is not represented as external agent execution. Evidence: `docs/evidence/audit-runtime-status-2026-08-23-v2.json` (pre-DEV-000227 field shape remains historical).
 - `FLEET_READINESS_LIVE = MEDIUM_SELECTED_BY_AVAILABILITY`; the live cognitive worker observed FAST unavailable, MEDIUM available, HEAVY available and LIFEBOAT available; it selected MEDIUM while the configured preference remained FAST. This is routing evidence only, not a quality or promotion claim. Evidence: `docs/evidence/fleet-readiness-live-2026-08-23-v2.json`.
-- `UI_AUTHENTICATED_ACCEPTANCE = CURRENT_DESKTOP_LIVE_PASS`; current signed-in browser evidence covers admin diagnostics 7/7, operations with FAST selected and 3/4 model tiers ready, truthful local-fallback agent status, action history and learning/reflection sections. Mobile viewport acceptance is not claimed in the current run. Evidence: `docs/evidence/authenticated-ui-acceptance-2026-08-23-v3.json`.
+- `UI_AUTHENTICATED_ACCEPTANCE = CURRENT_DESKTOP_OPERATIONS_FAST_SMOKE_PASS`; current signed-in browser evidence covers admin diagnostics 7/7, fleet refresh with FAST selected and 3/4 tiers ready, truthful local-fallback agent status, action history and learning/reflection sections; unauthenticated fleet and agent status requests return 401. Mobile viewport acceptance is not claimed. Evidence: `docs/evidence/authenticated-ui-acceptance-2026-08-23-v3.json` and `docs/evidence/operations-acceptance-2026-08-23-v1.json`.
 
 ## Current governance checkpoint
 

docs/evidence/operations-acceptance-2026-08-23-v1.json

@@ -0,0 +1,10 @@
+{
+  "evidence_id": "operations-acceptance-2026-08-23-v1",
+  "captured_at": "2026-08-23T18:55:00Z",
+  "production_revision": "8868258afd4e58edfa9c71e3fbf79793cd32397b",
+  "unauthenticated": {"/api/fleet/readiness": 401, "/api/agent-worker/status": 401},
+  "authenticated_ui": {"fleet_refresh": "PASS", "fleet_summary": "3/4 ГОТОВЫ", "selected_tier": "FAST", "heavy_state": "DEGRADED", "agent_refresh": "PASS", "agent_mode": "local-fallback", "bridge_reason_visible": true},
+  "mutations_performed": false,
+  "secrets_exposed": false,
+  "limitations": ["mobile viewport not verified", "no delegation-specific mutation", "no deep/long-running acceptance"]
+}