{
  "task_id":"DEV-000060",
  "task_revision":1,
  "architecture_revision":"ADR-0008",
  "base_repo_revision":"bcb106e0a37a8620c5f06f3c7d32ff682839037e",
  "risk_tier":"E",
  "intent":"Correct the LLM-free production audit so it distinguishes explicitly declared non-secret cognitive provider configuration from prohibited plaintext credentials, without changing runtime routing, binding lifecycle, or secret-isolation policy.",
  "requirement_ids":["INV-EPI-001","ADR-0006","ADR-0008","LLM-FREE-PROVIDER-ENV-AUDIT"],
  "allowed_change_scope":{"modules":[],"paths":["tests/cognitive_advisory/**","docs/PROJECT_STATUS.md","dev/ACTIVE_TASK.json","dev/tasks/DEV-000060-llm-free-provider-env-audit.json"]},
  "forbidden_change_scope":{"paths":["architecture/**","contracts/**","modules/**","adapters/**","database/**","deploy/**","cmd/**","security/**","ci/**",".gitea/**"]},
  "allowed_architecture_delta":{"new_cross_module_dependencies":0,"new_canonical_owners":0,"new_privileges":0,"new_third_party_dependencies":0,"new_provider_adapters":0},
  "contracts":{"consume":["cognitive-worker-runtime-environment","CredentialRef secret-file policy"],"may_change":[]},
  "semantic_owner":"none; production audit guardrail only",
  "canonical_state":[],
  "state_transitions":["none; CANARY and ACTIVE binding states are not modified"],
  "side_effects_and_privileges":["read-only production container inspection and advisory audit only","no credential creation or exposure","no provider invocation except the existing fail-closed audit request"],
  "persistence_and_migrations":["none"],
  "failure_retry_restart":["unknown environment names fail closed","plain credential-like environment names fail closed","only exact CredentialRef file names under /run/secrets are allowed"],
  "assumptions":["LOCAL_CPU_PROVIDER_URL and LOCAL_OLLAMA_PROVIDER_URL are non-secret endpoint configuration","docker-test remains prohibited"],
  "acceptance_scenarios":["LOCAL_CPU_PROVIDER_URL passes","LOCAL_OLLAMA_PROVIDER_URL passes","OPENAI_API_KEY fails","PROVIDER_TOKEN fails","OPENAI_API_KEY_FILE=/run/secrets/... passes","unknown credential-like environment fails closed","production worker exact environment passes"],
  "required_tests":["PowerShell environment-policy regression suite","LLM-free production audit","go test ./...","go vet ./...","architecture sentinel","provider/router tests","exact diff scope"],
  "terminal_gap_states":["BLOCKED_BY_ARCHITECTURE_GAP","BLOCKED_BY_SPEC_GAP","BLOCKED_BY_MISSING_CAPABILITY","BLOCKED_BY_CONFLICT"]
}