{
  "task_id": "DEV-000036",
  "task_revision": 1,
  "architecture_revision": "ADR-0004",
  "base_repo_revision": "e9594306e589591b76a15bd6a955f5d74e5f6a10",
  "risk_tier": "E",
  "intent": "Remove Creator authentication secrets from the production container environment by adding fail-closed file-backed secret loading and a read-only external Docker volume.",
  "requirement_ids": ["INV-AUTH-001", "CONSTITUTION-1.3.28", "USER-DOCKER-PROD-ONLY"],
  "allowed_change_scope": {
    "modules": ["identity"],
    "paths": [
      "cmd/core-runtime/main.go",
      "cmd/core-runtime/main_test.go",
      "deploy/docker-compose.prod.yml",
      "docs/CREDENTIALS_AND_SECRETS.md",
      "docs/DEPLOYMENT.md",
      "dev/ACTIVE_TASK.json",
      "dev/tasks/DEV-000036-creator-secret-files.json"
    ]
  },
  "forbidden_change_scope": {
    "paths": [
      "architecture/**",
      "ci/**",
      ".gitea/**",
      "cmd/devctl/**",
      "contracts/**",
      "modules/authority/**",
      "modules/commit/**",
      "database/**",
      "security/**"
    ]
  },
  "allowed_architecture_delta": {
    "new_cross_module_dependencies": 0,
    "new_canonical_owners": 0,
    "new_privileges": 0
  },
  "contracts": {
    "consume": ["Creator credentials and bounded session contract", "Docker read-only volume"],
    "may_change": []
  },
  "semantic_owner": "identity",
  "canonical_state": ["none; Creator identity and sessions are unchanged"],
  "state_transitions": ["valid configured credentials still issue the existing eight-hour bounded Creator session"],
  "side_effects_and_privileges": ["core-runtime reads three existing secrets from files instead of environment values in production", "external Docker volume is mounted read-only only into core-runtime"],
  "persistence_and_migrations": ["no database migration", "existing Creator secrets move to the external assistant_core_secrets Docker volume"],
  "failure_retry_restart": ["missing, empty, multiline, unreadable, or ambiguously configured secrets fail startup", "direct environment values remain supported for development but cannot be combined with a corresponding _FILE setting", "the existing production container remains available for rollback until the replacement is healthy"],
  "assumptions": [
    "The current production secrets are valid and can be migrated without revealing their values",
    "core-runtime continues to run as uid 100 and gid 101",
    "Docker administrators retain necessary recovery access to the external secret volume"
  ],
  "acceptance_scenarios": [
    "direct environment secret loading remains supported for development",
    "file-backed secrets trim line endings and reject empty or multiline content",
    "simultaneous direct and file configuration fails closed",
    "production core-runtime Env contains only _FILE paths for the three Creator secrets",
    "the secret volume is read-only in core-runtime and absent from other application containers",
    "Creator login and current-session checks succeed after deployment",
    "exact diff validation observes only declared paths"
  ],
  "required_tests": [
    "unit",
    "adversarial secret loading",
    "architecture preflight",
    "exact diff scope",
    "go vet",
    "production compose validation",
    "remote Creator login smoke",
    "production environment and mount audit",
    "CI"
  ],
  "terminal_gap_states": [
    "BLOCKED_BY_MISSING_CAPABILITY",
    "BLOCKED_BY_CONFLICT",
    "BLOCKED_BY_ARCHITECTURE_GAP"
  ]
}