{
  "task_id": "DEV-000125",
  "task_revision": 1,
  "architecture_revision": "ADR-0018",
  "base_repo_revision": "d2338b1",
  "risk_tier": "E",
  "intent": "Add a manually invoked CLI harness for the opt-in deterministic agent canary using an in-memory store.",
  "requirement_ids": ["WP-301", "Manual canary entrypoint", "Dry-run verification"],
  "allowed_change_scope": {"modules": ["work-agent-execution"], "paths": ["cmd/agent-canary/main.go", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000125-agent-canary-cli.json"]},
  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "deploy/**", "runtime/**", "adapters/**", "database/**", ".gitea/**"]},
  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
  "contracts": {"consume": ["DEV-000124 canary gate"], "may_change": ["Manual CLI entrypoint"]},
  "semantic_owner": "work-agent-execution",
  "canonical_state": ["No durable state; in-memory canary evidence only"],
  "state_transitions": ["CLI flags -> canary gate -> deterministic callbacks -> JSON summary"],
  "side_effects_and_privileges": ["No network, database, deployment or production mutation"],
  "persistence_and_migrations": ["Explicitly does not use production repository"],
  "failure_retry_restart": ["Disabled or unauthorized invocation exits nonzero without writes"],
  "assumptions": ["Real WorkRepository wiring requires a separate approved runtime task"],
  "acceptance_scenarios": ["Default invocation is rejected", "Explicit enablement produces JSON summary", "No secrets or external connections are required"],
  "required_tests": ["go test ./...", "go vet ./...", "go run ./cmd/agent-canary", "go run ./cmd/agent-canary -enable-canary", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl/independent", "git diff --check"],
  "terminal_gap_states": ["BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_CONFLICT"]
}