{
  "task_id": "DEV-000139",
  "task_revision": 2,
  "architecture_revision": "ADR-0018",
  "base_repo_revision": "6f5f7e1",
  "risk_tier": "E",
  "intent": "Run agent and reflection workers as restartable production processes with DB-owned idle wakeups and protected credential refs.",
  "requirement_ids": ["WP-302", "WP-502", "Automatic worker runtime", "Production recovery"],
  "allowed_change_scope": {"modules": ["work-agent-execution", "epistemics", "deployment", "creator-web-acceptance"], "paths": ["contracts/secrets/types.go", "modules/work/application/worker.go", "adapters/postgres/work_repository.go", "cmd/agent-worker/main.go", "adapters/postgres/epistemics_repository.go", "cmd/reflection-worker/main.go", "deploy/docker-compose.prod.yml", "tests/creator_web/verify-remote.ps1", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000139-production-worker-runtime.json"]},
  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "contracts/authority/**", ".gitea/**"]},
  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 2, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
  "contracts": {"consume": ["Existing durable dispatch/reflection tables and file secret resolver"], "may_change": ["Worker process lifecycle and production service wiring"]},
  "semantic_owner": "work-agent-execution and epistemics",
  "canonical_state": ["work.agent_dispatch_queue", "epistemics.reflection_candidates"],
  "state_transitions": ["workers recover stale claims, claim durable work, process one cycle, and repeat after DB-owned wakeup"],
  "side_effects_and_privileges": ["Work and epistemics database roles only; credentials remain CredentialRef/file-backed"],
  "persistence_and_migrations": ["Uses migrations 030 and 032 already in main"],
  "failure_retry_restart": ["restartable containers; stale claims recover after restart; -once remains diagnostic mode"],
  "assumptions": ["Production secret volume contains work and epistemics refs at declared paths"],
  "acceptance_scenarios": ["both workers stay running idle", "worker survives empty queue", "worker uses protected secret files", "stale dispatch/reflection claims recover"],
  "required_tests": ["go test ./...", "go vet ./...", "preflight", "check-diff", "check-architecture", "independent", "git diff --check", "docker compose config"],
  "terminal_gap_states": ["BLOCKED_BY_SECRET_REF_MISMATCH", "BLOCKED_BY_MIGRATION_DECISION", "BLOCKED_BY_CONFLICT"]
}