{
  "task_id": "DEV-000128",
  "task_revision": 1,
  "architecture_revision": "ADR-0018",
  "base_repo_revision": "790fd7e",
  "risk_tier": "E",
  "intent": "Add an explicitly profiled production compose service for the manual agent canary container.",
  "requirement_ids": ["WP-301", "Canary container profile", "Disabled-by-default runtime"],
  "allowed_change_scope": {"modules": ["work-agent-execution", "production-compose"], "paths": ["deploy/docker-compose.prod.yml", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000128-agent-canary-compose-profile.json"]},
  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "runtime/**", "adapters/**", ".gitea/**"]},
  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
  "contracts": {"consume": ["DEV-000126 agent-canary postgres mode", "DEV-000127 migration 029"], "may_change": ["Production compose canary profile"]},
  "semantic_owner": "work-agent-execution",
  "canonical_state": ["No new state; uses Work schema"],
  "state_transitions": ["profile absent -> explicit profile service available; default stack unchanged"],
  "side_effects_and_privileges": ["Credential environment is injected by deployment system; service is disabled unless profile is explicitly selected"],
  "persistence_and_migrations": ["Requires migration 029 already present; no migration in this task"],
  "failure_retry_restart": ["restart=no; one bounded canary invocation"],
  "assumptions": ["Deployment of this profile is a separate approved canary action", "No normal service depends on agent-canary"],
  "acceptance_scenarios": ["Compose validates", "Default config does not start agent-canary", "Profile builds target cmd/agent-canary", "No secret literal is added"],
  "required_tests": ["go test ./...", "go vet ./...", "docker compose -f deploy/docker-compose.prod.yml config --quiet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check"],
  "terminal_gap_states": ["BLOCKED_BY_DEPLOYMENT_DECISION", "BLOCKED_BY_CONFLICT"]
}