{
  "task_id": "DEV-000252",
  "task_revision": 1,
  "architecture_revision": "ADR-0018",
  "base_repo_revision": "c925089fd2304213758d2721a0592ca73d765047",
  "risk_tier": "E",
  "intent": "Add a local governed verification executor that runs only typed, bounded checks inside an isolated worktree and returns evidence without source, secret, production or promotion authority.",
  "requirement_ids": ["governed self-development", "isolated verification", "independent test evidence"],
  "allowed_change_scope": {"modules": ["governed-development"], "paths": ["adapters/developmentexecutor/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000252-local-governed-verification-executor.json"]},
  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "deploy/**", "contracts/**", "LLM-local/**", "modules/work/**", "cmd/core-runtime/**", "cmd/agent-worker/**"]},
  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
  "contracts": {"consume": ["existing DevelopmentScaffold semantics", "typed local check plan"], "may_change": []},
  "semantic_owner": "governed development verification adapter",
  "canonical_state": ["none; executor returns evidence to a future gate owner"],
  "state_transitions": ["typed plan -> validated sandbox checks -> immutable result summary"],
  "side_effects_and_privileges": ["read-only source/test execution in supplied isolated worktree; no secrets, production, protected main or promotion access"],
  "persistence_and_migrations": ["none"],
  "failure_retry_restart": ["each check has an explicit result; failed or cancelled checks never become verification success; rerun creates a new result"],
  "assumptions": ["worktree isolation and gate persistence are supplied by the surrounding governed control plane"],
  "acceptance_scenarios": ["allowed go test/vet and git diff check plans validate", "shell injection and unsupported commands reject", "protected or production worktree rejects", "failed check returns non-success evidence", "result contains no command output or secret material"],
  "required_tests": ["go test ./adapters/developmentexecutor", "go vet ./adapters/developmentexecutor", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "git diff --check", "independent", "CI"],
  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
}