Assistant/cmd/core-runtime/main.go

package main

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"git.cin.su/m/Assistant/adapters/developmentexecutor"
	"git.cin.su/m/Assistant/adapters/postgres"
	"git.cin.su/m/Assistant/contracts/authority"
	"git.cin.su/m/Assistant/contracts/capability"
	"git.cin.su/m/Assistant/contracts/cognitive"
	"git.cin.su/m/Assistant/contracts/continuity"
	"git.cin.su/m/Assistant/contracts/epistemics"
	"git.cin.su/m/Assistant/contracts/identity"
	"git.cin.su/m/Assistant/contracts/interaction"
	secretcontracts "git.cin.su/m/Assistant/contracts/secrets"
	"git.cin.su/m/Assistant/contracts/situation"
	"git.cin.su/m/Assistant/contracts/work"
	capabilitydomain "git.cin.su/m/Assistant/modules/capability/domain"
	identitydomain "git.cin.su/m/Assistant/modules/identity/domain"
	interactiondomain "git.cin.su/m/Assistant/modules/interaction/domain"
	situationdomain "git.cin.su/m/Assistant/modules/situation/domain"
	workdomain "git.cin.su/m/Assistant/modules/work/domain"
	"git.cin.su/m/Assistant/platform/ids"
	platformsecrets "git.cin.su/m/Assistant/platform/secrets"
	"git.cin.su/m/Assistant/runtime/health"
	"github.com/jackc/pgx/v5"
	"io"
	"log"
	"net/http"
	"os"
	"regexp"
	"sort"
	"strconv"
	"strings"
	"time"
)

const maxCreatorCredentialsBytes = 4 << 10

func main() {
	addr := os.Getenv("LISTEN_ADDR")
	if addr == "" {
		addr = ":8080"
	}
	bootstrapToken, err := readRequiredSecret("CREATOR_BOOTSTRAP_TOKEN")
	if err != nil {
		log.Fatal(err)
	}
	sessionKeyValue, err := readRequiredSecret("CREATOR_SESSION_SIGNING_KEY")
	if err != nil {
		log.Fatal(err)
	}
	creatorPassword, err := readRequiredSecret("CREATOR_PASSWORD")
	if err != nil {
		log.Fatal(err)
	}
	sessionKey := []byte(sessionKeyValue)
	creatorUsername := os.Getenv("CREATOR_USERNAME")
	repository, err := postgres.OpenSituation(context.Background(), postgres.ContinuityConfig{Host: os.Getenv("POSTGRES_HOST"), Port: os.Getenv("POSTGRES_PORT"), Database: os.Getenv("POSTGRES_DATABASE"), User: os.Getenv("POSTGRES_USER"), Password: os.Getenv("POSTGRES_PASSWORD")})
	if err != nil {
		log.Fatal(err)
	}
	defer repository.Close()
	workRepository, err := postgres.OpenWork(context.Background(), postgres.ContinuityConfig{Host: os.Getenv("POSTGRES_HOST"), Port: os.Getenv("POSTGRES_PORT"), Database: os.Getenv("POSTGRES_DATABASE"), User: os.Getenv("WORK_POSTGRES_USER"), Password: os.Getenv("WORK_POSTGRES_PASSWORD")})
	if err != nil {
		log.Fatal(err)
	}
	defer workRepository.Close()
	capabilityRepository, err := postgres.OpenCapability(context.Background(), postgres.ContinuityConfig{Host: os.Getenv("POSTGRES_HOST"), Port: os.Getenv("POSTGRES_PORT"), Database: os.Getenv("POSTGRES_DATABASE"), User: os.Getenv("CAPABILITY_POSTGRES_USER"), Password: os.Getenv("CAPABILITY_POSTGRES_PASSWORD")})
	if err != nil {
		log.Fatal(err)
	}
	defer capabilityRepository.Close()
	epistemicsPassword, err := readCredentialRefSecret("EPISTEMICS_POSTGRES_PASSWORD", "EPISTEMICS_POSTGRES_CREDENTIAL_REF")
	if err != nil {
		log.Fatal(err)
	}
	epistemicsUser := os.Getenv("EPISTEMICS_POSTGRES_USER")
	if epistemicsUser == "" {
		epistemicsUser = "epistemics_role"
	}
	epistemicsRepository, err := postgres.OpenEpistemics(context.Background(), postgres.ContinuityConfig{Host: os.Getenv("POSTGRES_HOST"), Port: os.Getenv("POSTGRES_PORT"), Database: os.Getenv("POSTGRES_DATABASE"), User: epistemicsUser, Password: epistemicsPassword})
	if err != nil {
		log.Fatal(err)
	}
	defer epistemicsRepository.Close()
	identityRepository, err := postgres.OpenIdentity(context.Background(), postgres.ContinuityConfig{Host: os.Getenv("POSTGRES_HOST"), Port: os.Getenv("POSTGRES_PORT"), Database: os.Getenv("POSTGRES_DATABASE"), User: os.Getenv("IDENTITY_POSTGRES_USER"), Password: os.Getenv("IDENTITY_POSTGRES_PASSWORD")})
	if err != nil {
		log.Fatal(err)
	}
	defer identityRepository.Close()
	interactionPassword, err := readCredentialRefSecret("INTERACTION_POSTGRES_PASSWORD", "INTERACTION_POSTGRES_CREDENTIAL_REF")
	if err != nil {
		log.Fatal(err)
	}
	interactionUser := os.Getenv("INTERACTION_POSTGRES_USER")
	if interactionUser == "" {
		interactionUser = "interaction_role"
	}
	interactionRepository, err := postgres.OpenInteraction(context.Background(), postgres.ContinuityConfig{Host: os.Getenv("POSTGRES_HOST"), Port: os.Getenv("POSTGRES_PORT"), Database: os.Getenv("POSTGRES_DATABASE"), User: interactionUser, Password: interactionPassword})
	if err != nil {
		log.Fatal(err)
	}
	defer interactionRepository.Close()
	reminderClient, err := newContinuityReminderClient(envOr("CONTINUITY_RUNTIME_URL", "http://continuity-runtime:8081"), &http.Client{Timeout: 5 * time.Second})
	if err != nil {
		log.Fatal(err)
	}
	responseClient, err := newContinuityResponseClient(envOr("CONTINUITY_RUNTIME_URL", "http://continuity-runtime:8081"), &http.Client{Timeout: 5 * time.Second})
	if err != nil {
		log.Fatal(err)
	}
	attentionClient, err := newContinuityAttentionClient(envOr("CONTINUITY_RUNTIME_URL", "http://continuity-runtime:8081"), &http.Client{Timeout: 5 * time.Second})
	if err != nil {
		log.Fatal(err)
	}
	cognitiveClient, err := newCognitiveInterpretationClient(envOr("COGNITIVE_RUNTIME_URL", "http://cognitive-worker:8083"), &http.Client{Timeout: 90 * time.Second})
	if err != nil {
		log.Fatal(err)
	}
	researchClient, err := newResearchRuntimeClient(envOr("RESEARCH_RUNTIME_URL", "http://research-runtime:8087"), &http.Client{Timeout: 12 * time.Second})
	if err != nil {
		log.Fatal(err)
	}
	learning := learningRecorder{epistemics: epistemicsRepository, capability: capabilityRepository}
	mux := http.NewServeMux()
	authenticateCreator := func(w http.ResponseWriter, r *http.Request) (identity.CreatorSession, bool) {
		session, err := identitydomain.ValidateCreatorSession(sessionKey, bearerToken(r), time.Now())
		if err != nil {
			http.Error(w, "creator session denied", http.StatusUnauthorized)
			return identity.CreatorSession{}, false
		}
		return session, true
	}
	resolveFocus := func(r *http.Request) (situation.FocusBinding, error) {
		runtime := situation.RuntimeBinding{SessionID: situation.SessionID(r.URL.Query().Get("session_id")), Workspace: situation.WorkspaceID(r.URL.Query().Get("workspace_id"))}
		bindings, err := repository.ByRuntime(r.Context(), runtime)
		if err != nil {
			return situation.FocusBinding{}, err
		}
		return situationdomain.NewResolver(bindings).Resolve(runtime)
	}
	mux.Handle("/healthz", health.Handler{Runtime: "core-runtime", SemanticGeneration: 1, ArchitectureGeneration: 1})
	readinessClient := &http.Client{Timeout: 2 * time.Second}
	mux.Handle("/readyz", health.ReadinessHandler{Runtime: "core-runtime", Probes: []health.Probe{
		health.TCPProbe("postgres", envOr("POSTGRES_HOST", "postgres"), envOr("POSTGRES_PORT", "5432")),
		health.HTTPProbe(readinessClient, strings.TrimRight(envOr("CONTINUITY_RUNTIME_URL", "http://continuity-runtime:8081"), "/")+"/healthz"),
		health.HTTPProbe(readinessClient, strings.TrimRight(envOr("COGNITIVE_RUNTIME_URL", "http://cognitive-worker:8083"), "/")+"/healthz"),
	}})
	admissionPolicy := capability.AdmissionPolicy{ID: envOr("COGNITIVE_ADMISSION_POLICY_ID", "creator-advisory-local-v1"), MaxConcurrent: envInt("COGNITIVE_ADMISSION_MAX_CONCURRENT", 1), MaxAcceptedPerHour: envInt("COGNITIVE_ADMISSION_MAX_ACCEPTED_PER_HOUR", 60), MaxInputBytes: envInt("COGNITIVE_ADMISSION_MAX_INPUT_BYTES", 80<<10), MaxOutputBytes: envInt("COGNITIVE_ADMISSION_MAX_OUTPUT_BYTES", 16<<10)}
	mux.HandleFunc("POST /v1/internal/cognitive/admission", func(w http.ResponseWriter, r *http.Request) {
		var request struct {
			LeaseID string                      `json:"lease_id"`
			Request capability.AdmissionRequest `json:"request"`
		}
		if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 16<<10)).Decode(&request); err != nil || request.LeaseID == "" {
			http.Error(w, "invalid admission request", http.StatusBadRequest)
			return
		}
		decision, lease, err := capabilityRepository.AdmitCognitive(r.Context(), request.LeaseID, admissionPolicy, request.Request, time.Now().UnixMilli())
		if err != nil {
			http.Error(w, "admission unavailable", http.StatusServiceUnavailable)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(struct {
			Decision capability.AdmissionDecision `json:"decision"`
			Lease    capability.AdmissionLease    `json:"lease"`
		}{decision, lease})
	})
	mux.HandleFunc("POST /v1/internal/cognitive/admission/{lease}/release", func(w http.ResponseWriter, r *http.Request) {
		if err := capabilityRepository.ReleaseCognitiveAdmission(r.Context(), capability.AdmissionLease{ID: r.PathValue("lease")}, time.Now().UnixMilli()); err != nil {
			http.Error(w, "admission release unavailable", http.StatusServiceUnavailable)
			return
		}
		w.WriteHeader(http.StatusNoContent)
	})
	mux.HandleFunc("POST /v1/creator/sessions", creatorSessionHandler(bootstrapToken, creatorUsername, creatorPassword, sessionKey, time.Now))
	mux.HandleFunc("GET /v1/creator/sessions/current", func(w http.ResponseWriter, r *http.Request) {
		session, ok := authenticateCreator(w, r)
		if !ok {
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(session)
	})
	mux.HandleFunc("POST /v1/creator/research/web", func(w http.ResponseWriter, r *http.Request) {
		if _, ok := authenticateCreator(w, r); !ok {
			return
		}
		var request epistemics.WebResearchRequest
		decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 128<<10))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&request); err != nil {
			http.Error(w, "invalid web research request", http.StatusBadRequest)
			return
		}
		result, err := researchClient.EvaluateWeb(r.Context(), request)
		if err != nil {
			http.Error(w, "web research unavailable", http.StatusBadGateway)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(result)
	})
	mux.HandleFunc("POST /v1/creator/development/proposals", func(w http.ResponseWriter, r *http.Request) {
		session, ok := authenticateCreator(w, r)
		if !ok {
			return
		}
		var request struct {
			Evidence []work.ExtensionEvidence      `json:"evidence"`
			Proposal work.ExtensionProposalRequest `json:"proposal"`
		}
		decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&request); err != nil {
			http.Error(w, "invalid development proposal", http.StatusBadRequest)
			return
		}
		proposal, err := workdomain.BuildExtensionProposal(request.Evidence, request.Proposal)
		if err != nil {
			http.Error(w, "development proposal rejected", http.StatusUnprocessableEntity)
			return
		}
		proposal.RequestedByPrincipalID = string(session.PrincipalID)
		if err := workRepository.SaveExtensionProposal(r.Context(), proposal); err != nil {
			http.Error(w, "development proposal conflict", http.StatusConflict)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusCreated)
		_ = json.NewEncoder(w).Encode(proposal)
	})
	mux.HandleFunc("POST /v1/creator/development/scaffolds", func(w http.ResponseWriter, r *http.Request) {
		session, ok := authenticateCreator(w, r)
		if !ok {
			return
		}
		var request work.DevelopmentScaffoldRequest
		decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&request); err != nil {
			http.Error(w, "invalid development scaffold", http.StatusBadRequest)
			return
		}
		scaffold, err := workdomain.BuildDevelopmentScaffold(request)
		if err != nil {
			http.Error(w, "development scaffold rejected", http.StatusUnprocessableEntity)
			return
		}
		scaffold.RequestedByPrincipalID = string(session.PrincipalID)
		if err := workRepository.SaveDevelopmentScaffold(r.Context(), scaffold); err != nil {
			http.Error(w, "development scaffold conflict", http.StatusConflict)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusCreated)
		_ = json.NewEncoder(w).Encode(scaffold)
	})
	mux.HandleFunc("POST /v1/creator/development/gates", func(w http.ResponseWriter, r *http.Request) {
		if _, ok := authenticateCreator(w, r); !ok {
			return
		}
		var gate work.DevelopmentGate
		decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&gate); err != nil {
			http.Error(w, "invalid development gate", http.StatusBadRequest)
			return
		}
		gate, err := prepareDevelopmentGate(gate, time.Now())
		if err != nil {
			http.Error(w, "development gate rejected", http.StatusUnprocessableEntity)
			return
		}
		if err := workRepository.SaveDevelopmentGate(r.Context(), gate, 0); err != nil {
			http.Error(w, "development gate conflict", http.StatusConflict)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusCreated)
		_ = json.NewEncoder(w).Encode(gate)
	})
	mux.HandleFunc("POST /v1/creator/development/gates/{id}/advance", func(w http.ResponseWriter, r *http.Request) {
		if _, ok := authenticateCreator(w, r); !ok {
			return
		}
		var request struct {
			ExpectedRevision int64                 `json:"expected_revision"`
			NextStage        work.DevelopmentStage `json:"next_stage"`
		}
		decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 16<<10))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&request); err != nil || request.ExpectedRevision < 1 || request.NextStage == "" {
			http.Error(w, "invalid development gate transition", http.StatusBadRequest)
			return
		}
		gate, err := workRepository.LoadDevelopmentGate(r.Context(), r.PathValue("id"))
		if err != nil || gate.Revision != request.ExpectedRevision {
			http.Error(w, "development gate revision conflict", http.StatusConflict)
			return
		}
		gate, err = advanceDevelopmentGate(gate, request.NextStage, time.Now())
		if err != nil {
			http.Error(w, "development gate transition rejected", http.StatusUnprocessableEntity)
			return
		}
		if err := workRepository.SaveDevelopmentGate(r.Context(), gate, request.ExpectedRevision); err != nil {
			http.Error(w, "development gate conflict", http.StatusConflict)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(gate)
	})
	mux.HandleFunc("POST /v1/creator/development/gates/{id}/verify", func(w http.ResponseWriter, r *http.Request) {
		if _, ok := authenticateCreator(w, r); !ok {
			return
		}
		var request struct {
			ExpectedRevision int64                    `json:"expected_revision"`
			VerifierRunID    work.AgentRunID          `json:"verifier_run_id"`
			Plan             developmentexecutor.Plan `json:"plan"`
		}
		decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&request); err != nil || request.ExpectedRevision < 1 || request.VerifierRunID == "" {
			http.Error(w, "invalid development verification request", http.StatusBadRequest)
			return
		}
		gate, result, err := verifyDevelopmentGate(r.Context(), workRepository, developmentGateVerificationRequest{GateID: r.PathValue("id"), ExpectedRevision: request.ExpectedRevision, VerifierRunID: request.VerifierRunID, Plan: request.Plan}, time.Now(), developmentexecutor.OSCommandRunner{})
		if err != nil {
			http.Error(w, err.Error(), http.StatusUnprocessableEntity)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(map[string]any{"gate": gate, "verification": result})
	})
	registerDevelopmentGateEvidenceRoute := func(path string, next work.DevelopmentStage, fieldName string) {
		mux.HandleFunc("POST /v1/creator/development/gates/{id}/"+path, func(w http.ResponseWriter, r *http.Request) {
			if _, ok := authenticateCreator(w, r); !ok {
				return
			}
			var request struct {
				ExpectedRevision int64  `json:"expected_revision"`
				EvidenceRef      string `json:"evidence_ref"`
			}
			decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 16<<10))
			decoder.DisallowUnknownFields()
			if err := decoder.Decode(&request); err != nil || request.ExpectedRevision < 1 || request.EvidenceRef == "" {
				http.Error(w, "invalid development transition evidence", http.StatusBadRequest)
				return
			}
			gate, err := recordDevelopmentGateEvidence(r.Context(), workRepository, developmentGateEvidenceRequest{GateID: r.PathValue("id"), ExpectedRevision: request.ExpectedRevision, NextStage: next, EvidenceRef: request.EvidenceRef}, time.Now())
			if err != nil {
				http.Error(w, "development "+fieldName+" transition rejected", http.StatusUnprocessableEntity)
				return
			}
			w.Header().Set("Content-Type", "application/json")
			_ = json.NewEncoder(w).Encode(gate)
		})
	}
	registerDevelopmentGateEvidenceRoute("canary", work.DevelopmentCanary, "canary")
	registerDevelopmentGateEvidenceRoute("promote", work.DevelopmentPromoted, "promotion")
	registerDevelopmentGateEvidenceRoute("rollback", work.DevelopmentRolledBack, "rollback")
	mux.HandleFunc("GET /v1/creator/focus", func(w http.ResponseWriter, r *http.Request) {
		session, ok := authenticateCreator(w, r)
		if !ok {
			return
		}
		focus, err := resolveFocus(r)
		if err != nil {
			http.Error(w, "creator focus unavailable", http.StatusConflict)
			return
		}
		if focus.ActorID != session.ActorID {
			http.Error(w, "creator focus denied", http.StatusForbidden)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(focus)
	})
	mux.HandleFunc("GET /v1/creator/tasks/{id}", func(w http.ResponseWriter, r *http.Request) {
		session, ok := authenticateCreator(w, r)
		if !ok {
			return
		}
		focus, err := resolveFocus(r)
		if err != nil || focus.ActorID != session.ActorID {
			http.Error(w, "creator focus denied", http.StatusForbidden)
			return
		}
		target, err := workRepository.Load(r.Context(), work.TaskID(r.PathValue("id")))
		if err != nil {
			http.Error(w, "task not found", http.StatusNotFound)
			return
		}
		if err := situationdomain.ValidateTaskTarget(focus, target); err != nil {
			http.Error(w, "task outside creator focus", http.StatusForbidden)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(target)
	})
	mux.HandleFunc("GET /v1/creator/capabilities/{id}/health", func(w http.ResponseWriter, r *http.Request) {
		if _, ok := authenticateCreator(w, r); !ok {
			return
		}
		status, err := capabilityRepository.LoadHealth(r.Context(), capability.CapabilityID(r.PathValue("id")))
		if err != nil {
			http.Error(w, "capability health not found", http.StatusNotFound)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(status)
	})
	mux.HandleFunc("GET /v1/creator/learning/recent", func(w http.ResponseWriter, r *http.Request) {
		if _, ok := authenticateCreator(w, r); !ok {
			return
		}
		limit := 10
		if raw := r.URL.Query().Get("limit"); raw != "" {
			parsed, err := strconv.Atoi(raw)
			if err != nil || parsed < 1 || parsed > 50 {
				http.Error(w, "invalid learning limit", http.StatusBadRequest)
				return
			}
			limit = parsed
		}
		experiences, err := epistemicsRepository.RecentExperienceRecords(r.Context(), limit)
		if err != nil {
			log.Printf("learning recent experiences unavailable: %v", err)
			http.Error(w, "learning experience unavailable", http.StatusServiceUnavailable)
			return
		}
		reflections, err := epistemicsRepository.RecentReflectionCandidates(r.Context(), limit)
		if err != nil {
			log.Printf("learning recent reflections unavailable: %v", err)
			http.Error(w, "learning reflection unavailable", http.StatusServiceUnavailable)
			return
		}
		skills, err := capabilityRepository.RecentSkillProfiles(r.Context(), limit)
		if err != nil {
			log.Printf("learning recent skills unavailable: %v", err)
			http.Error(w, "learning skills unavailable", http.StatusServiceUnavailable)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		w.Header().Set("Cache-Control", "no-store")
		_ = json.NewEncoder(w).Encode(struct {
			Experiences []epistemics.ExperienceRecord
			Reflections []epistemics.ReflectionCandidate
			Skills      []capability.SkillProfile
		}{Experiences: experiences, Reflections: reflections, Skills: skills})
	})
	mux.HandleFunc("POST /v1/creator/chat/messages", func(w http.ResponseWriter, r *http.Request) {
		session, ok := authenticateCreator(w, r)
		if !ok {
			return
		}
		var request interaction.ChatMessageRequest
		decoder := json.NewDecoder(io.LimitReader(r.Body, interactiondomain.MaxHumanUtteranceBytes+1024))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&request); err != nil || decoder.Decode(&struct{}{}) != io.EOF {
			http.Error(w, "invalid chat message", http.StatusBadRequest)
			return
		}
		now := time.Now()
		var conversation interaction.Conversation
		if request.ConversationID == "" {
			conversation, err = interactiondomain.NewConversation(session.ActorID, session.PrincipalID, now)
			if err != nil {
				http.Error(w, "conversation unavailable", http.StatusServiceUnavailable)
				return
			}
		} else {
			conversation, err = interactionRepository.Conversation(r.Context(), request.ConversationID)
			if errors.Is(err, pgx.ErrNoRows) {
				http.Error(w, "conversation not found", http.StatusNotFound)
				return
			}
			if err != nil {
				http.Error(w, "conversation unavailable", http.StatusServiceUnavailable)
				return
			}
			if conversation.ActorID != session.ActorID || conversation.PrincipalID != session.PrincipalID {
				http.Error(w, "conversation denied", http.StatusForbidden)
				return
			}
			conversation.UpdatedAtUnixMillis = now.UnixMilli()
		}
		utterance, intent, relations, err := interactiondomain.NewHumanUtterance(conversation, request, now)
		if err != nil {
			http.Error(w, "invalid chat message", http.StatusBadRequest)
			return
		}
		projects, err := repository.ListProjects(r.Context())
		if err != nil {
			http.Error(w, "project registry unavailable", http.StatusServiceUnavailable)
			return
		}
		var previousFocus *situation.ActiveProjectFocus
		storedFocus, err := repository.ActiveProjectFocus(r.Context(), session.ActorID, session.PrincipalID)
		if err == nil {
			previousFocus = &storedFocus
		} else if !errors.Is(err, pgx.ErrNoRows) {
			http.Error(w, "project focus unavailable", http.StatusServiceUnavailable)
			return
		}
		var effectiveTaskMessage = interactiondomain.StripAssistantVocative(utterance.Content)
		continuationMessage := ""
		travelContinuation := false
		var previousTask *interaction.HumanUtterance
		var conversationHistory []interaction.HumanUtterance
		if request.ConversationID != "" {
			var historyErr error
			conversationHistory, historyErr = interactionRepository.Utterances(r.Context(), conversation.ID)
			if historyErr != nil {
				log.Printf("interaction conversation history unavailable: %v", historyErr)
			}
		}
		// Keep durable user context available even when the web client carries a
		// conversation ID; a new or rotated conversation must not erase learned
		// preferences.
		recentUserHistory, historyErr := interactionRepository.RecentUtterancesForPrincipal(r.Context(), session.PrincipalID, 64)
		if historyErr != nil {
			log.Printf("interaction principal history unavailable: %v", historyErr)
		} else {
			log.Printf("interaction principal history loaded: %d utterances", len(recentUserHistory))
		}
		conversationHistory = append(conversationHistory, recentUserHistory...)
		if continuation := interactiondomain.ContinueLocalSearch(effectiveTaskMessage, conversationHistory); continuation != "" {
			continuationMessage = continuation
			effectiveTaskMessage = continuation
		} else if continuation := interactiondomain.ContinueTravelOrigin(effectiveTaskMessage, conversationHistory); continuation != "" {
			continuationMessage = continuation
			travelContinuation = true
			effectiveTaskMessage = continuation
		}
		if request.ConversationID != "" && interactiondomain.IsRetryRequest(utterance.Content) {
			if len(conversationHistory) > 0 {
				for index := len(conversationHistory) - 1; index >= 0; index-- {
					if interactiondomain.IsRetryRequest(conversationHistory[index].Content) {
						continue
					}
					candidate := conversationHistory[index]
					previousTask = &candidate
					effectiveTaskMessage = interactiondomain.StripAssistantVocative(candidate.Content)
					break
				}
			}
		}
		semantic, err := interactiondomain.InterpretUtterance(utterance, projects, previousFocus, now)
		if err != nil {
			http.Error(w, "interpret chat message", http.StatusServiceUnavailable)
			return
		}
		if continuationMessage != "" {
			continuedUtterance := utterance
			continuedUtterance.Content = continuationMessage
			continuedSemantic, continuedErr := interactiondomain.InterpretUtterance(continuedUtterance, projects, previousFocus, now)
			if continuedErr == nil {
				continuedSemantic.Interpretation.Source = "CONVERSATION_CONTINUATION"
				continuedSemantic.Interpretation.SelectionReason = "location follow-up completed the previous local-search task"
				semantic = continuedSemantic
			}
		}
		if travelContinuation && interactiondomain.TravelSearchClarification(effectiveTaskMessage, conversationHistory) == "" {
			semantic.CapabilityHints = append(semantic.CapabilityHints, string(capability.CapabilityKindWebResearch))
			semantic.NeedsCognition = false
			semantic.Interpretation.NeedsCognition = false
		}
		locationReply := interactiondomain.LocationContextReply(utterance.Content)
		if locationReply != "" {
			semantic.Reply = locationReply
			semantic.NeedsCognition = false
			semantic.Interpretation.NeedsCognition = false
		}
		if previousTask != nil {
			previousSemantic, previousErr := interactiondomain.InterpretUtterance(*previousTask, projects, previousFocus, now)
			if previousErr == nil {
				semantic = interactiondomain.CarryForwardPreviousTask(semantic, previousSemantic)
			}
		}
		assistantName := interactiondomain.PreferredAssistantName(utterance.Content)
		if assistantName == "" {
			assistantName = latestAssistantName(conversationHistory)
		}
		identityReply := ""
		log.Printf("interaction identity context: name=%q history=%d", assistantName, len(conversationHistory))
		if interactiondomain.IsIdentityInquiry(utterance.Content) && assistantName != "" {
			identityReply = "Меня зовут " + assistantName + ". Я Домовой, ваш помощник."
			semantic.Reply = identityReply
			semantic.NeedsCognition = false
			semantic.CapabilityHints = nil
			semantic.Interpretation.Applicability = interaction.SemanticApplicable
			semantic.Interpretation.Clarification = interaction.ClarificationNotRequired
		}
		deterministicSpeechAct := semantic.Interpretation.SpeechAct
		deterministicReply := semantic.Reply
		routePlan := buildChatRoutePlan(semantic)
		cognitiveAttempted := false
		cognitiveAvailable := true
		semanticInterpretationRequested := shouldRequestSemanticInterpretation(semantic)
		semanticReflexAudit := shouldAuditDeterministicReflex(semantic, string(utterance.ID), now)
		if identityReply != "" {
			semanticReflexAudit = false
		}
		if semanticInterpretationRequested || semanticReflexAudit {
			cognitiveAttempted = true
			projectNames := make([]string, 0, len(semantic.Projects))
			for _, ref := range semantic.Projects {
				if ref.ProjectDisplayName != "" {
					projectNames = append(projectNames, ref.ProjectDisplayName)
				}
			}
			cognitiveUtterance := utterance
			cognitiveUtterance.Content = effectiveTaskMessage
			if response, interpretationErr := cognitiveClient.Interpret(r.Context(), buildGatewayInterpretationRequest(session, cognitiveUtterance, semantic, projectNames)); interpretationErr == nil && response.FinishReason == cognitive.FinishCompleted {
				if candidate, candidateErr := interactionCandidateFromGateway(utterance.ID, response.Candidate, now); candidateErr == nil {
					semantic = interactiondomain.ApplyCognitiveCandidate(semantic, effectiveTaskMessage, candidate, previousFocus)
				} else {
					cognitiveAvailable = false
				}
			} else {
				cognitiveAvailable = false
			}
		}
		if travelReply := interactiondomain.TravelSearchClarification(effectiveTaskMessage, conversationHistory); travelReply != "" {
			semantic.Interpretation.Clarification = interaction.ClarificationRequired
			semantic.Interpretation.Applicability = interaction.SemanticCandidateClarify
			semantic.Reply = travelReply
			deterministicReply = travelReply
			semantic.NeedsCognition = false
			semantic.Interpretation.NeedsCognition = false
		}
		if err := interactionRepository.AppendUtterance(r.Context(), conversation, utterance, intent, relations); err != nil {
			http.Error(w, "save chat message", http.StatusInternalServerError)
			return
		}
		if err := interactionRepository.SaveSemanticResult(r.Context(), semantic.Interpretation, semantic.Candidates, semantic.Projects, semantic.Relations); err != nil {
			http.Error(w, "save chat semantics", http.StatusInternalServerError)
			return
		}
		responseResult, responseErr := responseClient.Respond(r.Context(), r.Header.Get("Authorization"), continuity.HumanResponseRequest{
			SourceUtteranceID:     string(utterance.ID),
			SourceIntentID:        string(intent.ID),
			Message:               effectiveTaskMessage,
			RequestedAtUnixMillis: now.UnixMilli(),
		})
		if semantic.Interpretation.SpeechAct == interaction.SpeechActCorrection {
			learning.recordCorrection(r.Context(), correctionLearningInput{Utterance: utterance, Intent: intent, At: now})
		}
		activeFocusName := ""
		activeFocusProvenance := situation.ProjectResolutionProvenance("")
		if semantic.ActiveFocus != nil {
			if err := repository.SaveActiveProjectFocus(r.Context(), *semantic.ActiveFocus); err != nil {
				http.Error(w, "save project focus", http.StatusInternalServerError)
				return
			}
			activeFocusName = semantic.ActiveFocus.ProjectDisplayName
			activeFocusProvenance = semantic.ActiveFocus.Provenance
		} else if len(semantic.Projects) > 0 && semantic.Projects[0].Provenance == situation.ProjectResolutionInheritedFocus && previousFocus != nil {
			activeFocusName = previousFocus.ProjectDisplayName
			activeFocusProvenance = previousFocus.Provenance
		}
		planningReply := deterministicReply
		workPlanned := false
		needsCognition := semantic.NeedsCognition
		projectID := ""
		if semantic.ActiveFocus != nil {
			projectID = string(semantic.ActiveFocus.ProjectID)
		} else if len(semantic.Projects) > 0 && semantic.Projects[0].Provenance == situation.ProjectResolutionInheritedFocus {
			projectID = string(previousFocus.ProjectID)
		}
		if responseErr == nil && responseResult.Handled {
			planningReply = responseResult.Reply
			needsCognition = false
			learning.recordReminderResponse(r.Context(), reminderResponseLearningInput{Utterance: utterance, Intent: intent, Result: responseResult, At: now})
			if resumed, err := continueDelegationFromHumanResponse(r.Context(), workRepository, responseResult.Response, now); err == nil && resumed {
				planningReply = "Принял. Продолжаю ту же задачу coding-agent без потери контекста."
			}
		} else if responseErr == nil && looksLikeUnsupportedContinuation(utterance.Content, responseResult) {
			learning.recordFastPathDecline(r.Context(), fastPathDeclineLearningInput{Utterance: utterance, Intent: intent, Result: responseResult, Reason: declineReasonForResponse(responseResult), At: now})
		}
		planningInput := work.PlanningInput{
			ConversationID:        work.ConversationRef(conversation.ID),
			UtteranceID:           work.SourceUtteranceRef(utterance.ID),
			IntentID:              work.SourceIntentRef(intent.ID),
			ActorID:               session.ActorID,
			PrincipalID:           session.PrincipalID,
			ScopeID:               authority.ScopeID("domovoy-global-scope"),
			ProjectID:             work.ProjectRef(projectID),
			ProjectDisplayName:    activeFocusName,
			ProjectProvenance:     work.ProjectProvenanceRef(activeFocusProvenance),
			Message:               effectiveTaskMessage,
			SpeechAct:             work.SpeechActRef(semantic.Interpretation.SpeechAct),
			SecondarySpeechAct:    work.SpeechActRef(semantic.Interpretation.SecondarySpeechAct),
			AssertionVerification: epistemics.VerificationState(semantic.Interpretation.AssertionVerification),
			CapabilityHints:       toCapabilityKinds(semantic.CapabilityHints),
			NeedsCognition:        semantic.NeedsCognition,
			RequiresClarification: semantic.Interpretation.Clarification == interaction.ClarificationRequired,
			ReceivedAtUnixMillis:  utterance.ReceivedAtUnixMillis,
		}
		helpPath := workdomain.DetermineHelpPath(planningInput)
		if responseErr == nil && responseResult.Handled {
			helpPath = work.HelpPath{}
		}
		switch semantic.InformationRequestKind {
		case interaction.InformationRequestMemoryInventory:
			planningReply = humanMemoryInventory(conversationHistory, assistantName)
			needsCognition = false
		case interaction.InformationRequestTimeDifference:
			planningReply = humanTimeDifferenceReply(effectiveTaskMessage)
			needsCognition = false
		case interaction.InformationRequestCapabilityInventory:
			kinds, err := capabilityRepository.AvailableCapabilityKinds(r.Context(), session.PrincipalID)
			if err == nil && len(kinds) > 0 {
				planningReply = "Я умею общаться, искать проверяемую информацию, работать с подключёнными моделями и " + humanCapabilityList(kinds) + "."
			} else {
				planningReply = "Я умею общаться, сохранять контекст, искать проверяемую информацию и работать с подключёнными моделями. Дополнительные действия подключаются отдельно."
			}
			needsCognition = false
		case interaction.InformationRequestCognitiveModelInventory:
			candidates, inventoryErr := capabilityRepository.LoadCognitiveCandidates(r.Context(), capability.CapabilityID("creator-advisory"), session.PrincipalID)
			planningReply = humanCognitiveModelInventory(candidates, inventoryErr)
			needsCognition = false
		case interaction.InformationRequestCognitiveChannelStatus, interaction.InformationRequestCognitiveRecovery:
			health, healthErr := capabilityRepository.LoadHealth(r.Context(), capability.CapabilityID("cognitive-proposal"))
			planningReply = humanCognitiveChannelReply(semantic.InformationRequestKind, semantic.Interpretation.SpeechAct, health, healthErr)
			needsCognition = false
		}
		researchBacked := false
		if hasChatRoute(routePlan, chatRouteResearch) && semantic.Interpretation.Clarification != interaction.ClarificationRequired {
			if planID, idErr := ids.New(); idErr == nil {
				parts := interactiondomain.IndependentRequestParts(effectiveTaskMessage)
				replies := make([]string, 0, len(parts))
				for index, part := range parts {
					if clarification := interactiondomain.LocalSearchClarification(part); clarification != "" {
						replies = append(replies, "По запросу «"+part+"»: "+clarification)
						continue
					}
					researchCtx, cancelResearch := context.WithTimeout(r.Context(), 8*time.Second)
					result, researchErr := researchClient.SearchWeb(researchCtx, epistemics.WebSearchRequest{
						Plan:           epistemics.ResearchPlan{ID: epistemics.ResearchPlanID(fmt.Sprintf("plan:%s:%d", planID, index)), Question: part, SourceClasses: []string{"web-search"}, FreshnessPolicy: "current"},
						PropositionKey: fmt.Sprintf("question:%s:%d", utterance.ID, index), Query: part,
					})
					cancelResearch()
					reply, backed := renderResearchReply(part, result, researchErr)
					if backed {
						researchBacked = true
					}
					if len(parts) > 1 {
						reply = "По запросу «" + part + "»: " + reply
					}
					replies = append(replies, reply)
				}
				planningReply = strings.Join(replies, "\n\n")
				if researchBacked {
					semantic.Reply = planningReply
				}
				// A failed source must not turn the complete conversation into a
				// runtime failure or invite an unsupported local guess for a fact.
				needsCognition = false
			}
		}
		if helpPath.Reply != "" {
			planningReply = helpPath.Reply
			needsCognition = false
		}
		if travelReply := interactiondomain.TravelSearchClarification(effectiveTaskMessage, conversationHistory); travelReply != "" {
			planningReply = travelReply
			needsCognition = false
		}
		if planningReply == "" && needsCognition && cognitiveAttempted && !cognitiveAvailable {
			planningReply = humanCognitiveDegradedReply(utterance.Content)
			needsCognition = false
		}
		var capabilityStatus capability.CapabilityResolutionStatus
		var capabilityKind capability.CapabilityKind
		var capabilityGapID capability.CapabilityGapID
		var delegationID work.DelegationID
		var delegationState work.DelegationState
		var reminder *continuity.ProspectiveItem
		if helpPath.Kind == work.HelpPathDirectCapability && len(helpPath.SuggestedCapabilityKinds) > 0 {
			capabilityKind = helpPath.SuggestedCapabilityKinds[0]
			started := time.Now()
			resolution, resolveErr := resolveChatCapability(r.Context(), capabilityRepository, capabilityKind, session, intent, utterance, now)
			capabilityStatus = resolution.Status
			if resolveErr == nil && len(resolution.Eligible) > 0 {
				reminderRequest, reminderErr := buildReminderRequest(utterance.Content, session, intent, utterance, now)
				if reminderErr == nil {
					result, scheduleErr := reminderClient.Schedule(r.Context(), r.Header.Get("Authorization"), reminderRequest)
					finished := time.Now()
					if scheduleErr == nil {
						reminder = &result.Item
						planningReply = fmt.Sprintf("Готово. Я создал напоминание: %s.", result.Item.Summary)
						usageID, _ := observeCapabilityUsage(r.Context(), capabilityRepository, resolution.Eligible[0], resolution.Requirement, capability.UsageSucceeded, string(result.Item.ID), started, finished)
						learning.recordCapabilityUse(r.Context(), capabilityLearningInput{Utterance: utterance, Intent: intent, ImplementationID: resolution.Eligible[0].Implementation.ID, UsageObservation: usageID, Outcome: capability.UsageSucceeded, OutcomeRef: "continuity:prospective:" + string(result.Item.ID), At: finished})
					} else {
						planningReply = "Scheduling capability сейчас недоступна: напоминание не создано. Я не буду притворяться, что действие выполнено."
						usageID, _ := observeCapabilityUsage(r.Context(), capabilityRepository, resolution.Eligible[0], resolution.Requirement, capability.UsageFailed, "continuity-reminder-unavailable", started, finished)
						learning.recordCapabilityUse(r.Context(), capabilityLearningInput{Utterance: utterance, Intent: intent, ImplementationID: resolution.Eligible[0].Implementation.ID, UsageObservation: usageID, Outcome: capability.UsageFailed, OutcomeRef: "continuity-reminder-unavailable", At: finished})
					}
				} else {
					planningReply = "Мне нужно уточнить время напоминания. Например: «Напомни завтра в 10 позвонить врачу»."
					capabilityStatus = capability.ResolutionPartiallyAvailable
				}
			} else if resolution.Gap != nil {
				capabilityGapID = resolution.Gap.ID
				planningReply = "Сейчас scheduling capability недоступна, поэтому напоминание не создано. Я зафиксировал capability gap."
				learning.recordCapabilityUse(r.Context(), capabilityLearningInput{Utterance: utterance, Intent: intent, GapID: resolution.Gap.ID, Outcome: capability.UsageSkipped, OutcomeRef: "capability:gap:" + string(resolution.Gap.ID), At: now})
			}
			needsCognition = false
		}
		if helpPath.Kind == work.HelpPathCapabilityGap && len(helpPath.SuggestedCapabilityKinds) > 0 {
			capabilityKind = helpPath.SuggestedCapabilityKinds[0]
			resolution, resolveErr := resolveChatCapability(r.Context(), capabilityRepository, capabilityKind, session, intent, utterance, now)
			capabilityStatus = resolution.Status
			if resolveErr == nil {
				planningReply = "Capability найдена, но в этом шаге она не исполняется без отдельного разрешённого action path."
			} else if resolution.Gap != nil {
				capabilityGapID = resolution.Gap.ID
				planningReply = "Сейчас у меня ещё не подключена возможность отправлять почту. Я зафиксировал capability gap, без ложного выполнения."
				learning.recordCapabilityUse(r.Context(), capabilityLearningInput{Utterance: utterance, Intent: intent, GapID: resolution.Gap.ID, Outcome: capability.UsageSkipped, OutcomeRef: "capability:gap:" + string(resolution.Gap.ID), At: now})
			}
			needsCognition = false
		}
		if helpPath.NeedsDurableWork {
			planning, err := workdomain.BuildPlanningResult(planningInput, now)
			if err != nil {
				http.Error(w, "plan chat work", http.StatusServiceUnavailable)
				return
			}
			if err := workRepository.SavePlanningResult(r.Context(), planning); err != nil {
				http.Error(w, "save work plan", http.StatusInternalServerError)
				return
			}
			planningReply = planning.Reply
			workPlanned = true
			needsCognition = false
			if created, resolution, createErr := maybeCreateAgentDelegation(r.Context(), workRepository, capabilityRepository, session, conversation, intent, utterance, planning, now); createErr == nil && created != nil {
				delegationID = created.Delegation.ID
				delegationState = created.Delegation.State
				capabilityKind = created.Delegation.CapabilityKind
				capabilityStatus = resolution.Status
				planningReply = "Понял задачу. Я собрал work item, выбрал coding-agent в CANARY-режиме и создал delegation. Буду вести её как отдельный run с checkpoint/resume, без потери исходного human intent."
			} else if resolution.Gap != nil {
				capabilityKind = resolution.Requirement.CapabilityKind
				capabilityStatus = resolution.Status
				capabilityGapID = resolution.Gap.ID
				planningReply = planningReply + " Для coding delegation подходящий agent implementation сейчас недоступен, поэтому я сохранил план без ложного запуска."
			}
		}
		if identityReply != "" {
			planningReply = identityReply
			needsCognition = false
		}
		if strings.TrimSpace(planningReply) != "" {
			reviewContext, cancelReview := context.WithTimeout(r.Context(), 12*time.Second)
			reviewedReply, reviewErr := cognitiveClient.ReviewResponse(reviewContext, session, utterance.Content, planningReply, cognitive.TaskMeaning{
				SpeechAct:              string(semantic.Interpretation.SpeechAct),
				CapabilityHints:        toCapabilityKinds(semantic.CapabilityHints),
				RequestedOutcome:       semantic.Interpretation.RequestedOutcome,
				InformationRequestKind: semantic.InformationRequestKind,
				ConfidenceMillis:       semantic.Interpretation.ConfidenceMillis,
			})
			cancelReview()
			stableSemanticReply := identityReply != "" || semantic.InformationRequestKind != "" || locationReply != "" || deterministicSpeechAct == interaction.SpeechActConversational || deterministicSpeechAct == interaction.SpeechActConfirmation || deterministicSpeechAct == interaction.SpeechActRejection
			if reviewErr != nil {
				log.Printf("cognitive response review unavailable: %v", reviewErr)
			} else if !stableSemanticReply && (!researchBacked || reviewPreservesResearchEvidence(reviewedReply, planningReply)) {
				planningReply = reviewedReply
			} else if reviewedReply != planningReply {
				log.Printf("cognitive response review proposed stable semantic rewrite; preserving semantic reply")
			}
		}
		if identityReply == "" {
			stableAct := interactiondomain.ClassifySpeechAct(utterance.Content, utterance.CorrectsUtteranceID)
			travelClarification := interactiondomain.TravelSearchClarification(effectiveTaskMessage, conversationHistory)
			if stableReply, stable := interactiondomain.StableConversationalReply(utterance.Content, stableAct); stable && travelClarification == "" {
				planningReply = stableReply
				needsCognition = false
			}
		}
		if identityReply != "" {
			semantic.Reply = identityReply
			needsCognition = false
			planningReply = identityReply
		}
		if strings.TrimSpace(planningReply) != "" {
			semantic.Reply = planningReply
		}
		log.Printf("chat response final message=%q act=%s deterministic=%s handled=%t fallback=%q planning=%q", utterance.Content, semantic.Interpretation.SpeechAct, deterministicSpeechAct, responseResult.Handled, semantic.Reply, planningReply)
		response := interaction.ChatMessageResponse{
			ConversationID:                 conversation.ID,
			UtteranceID:                    utterance.ID,
			OriginalIntentID:               intent.ID,
			SpeechAct:                      semantic.Interpretation.SpeechAct,
			InterpretationState:            utterance.InterpretationState,
			NeedsCognition:                 needsCognition,
			FallbackText:                   semantic.Reply,
			ActiveProjectName:              activeFocusName,
			ProjectProvenance:              activeFocusProvenance,
			Clarification:                  semantic.Interpretation.Clarification,
			WorkPlanned:                    workPlanned,
			PlanningReply:                  planningReply,
			ResearchBacked:                 researchBacked,
			CapabilityStatus:               capabilityStatus,
			CapabilityKind:                 capabilityKind,
			CapabilityHints:                toCapabilityKinds(semantic.CapabilityHints),
			RequestedOutcome:               semantic.Interpretation.RequestedOutcome,
			InformationRequestKind:         semantic.InformationRequestKind,
			InterpretationConfidenceMillis: semantic.Interpretation.ConfidenceMillis,
			CapabilityGapID:                capabilityGapID,
			DelegationID:                   string(delegationID),
			DelegationState:                string(delegationState),
			Reminder:                       reminder,
		}
		w.Header().Set("Content-Type", "application/json")
		w.Header().Set("Cache-Control", "no-store")
		w.WriteHeader(http.StatusCreated)
		_ = json.NewEncoder(w).Encode(response)
	})
	mux.HandleFunc("GET /v1/creator/delegations/{id}", func(w http.ResponseWriter, r *http.Request) {
		if _, ok := authenticateCreator(w, r); !ok {
			return
		}
		value, err := workRepository.LoadDelegation(r.Context(), work.DelegationID(r.PathValue("id")))
		if err != nil {
			http.Error(w, "delegation not found", http.StatusNotFound)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(value)
	})
	mux.HandleFunc("GET /v1/creator/delegations/{id}/latest-checkpoint", func(w http.ResponseWriter, r *http.Request) {
		if _, ok := authenticateCreator(w, r); !ok {
			return
		}
		value, err := workRepository.LatestAgentCheckpoint(r.Context(), work.DelegationID(r.PathValue("id")))
		if err != nil {
			http.Error(w, "checkpoint not found", http.StatusNotFound)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(value)
	})
	mux.HandleFunc("POST /v1/creator/delegations/{id}/runs/{run}/checkpoints", func(w http.ResponseWriter, r *http.Request) {
		session, ok := authenticateCreator(w, r)
		if !ok {
			return
		}
		var request struct {
			BlockerClass         work.AgentBlockerClass
			CompletedSummary     string
			RemainingSummary     string
			TestSummary          string
			BranchName           string
			CommitHash           string
			NextStep             string
			ArtifactRefs         []work.EvidenceRef
			RecordedAtUnixMillis int64
		}
		decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 32<<10))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&request); err != nil {
			http.Error(w, "invalid checkpoint", http.StatusBadRequest)
			return
		}
		run, err := workRepository.LoadAgentRun(r.Context(), work.AgentRunID(r.PathValue("run")))
		if err != nil || run.DelegationID != work.DelegationID(r.PathValue("id")) {
			http.Error(w, "run not found", http.StatusNotFound)
			return
		}
		updatedRun, checkpoint, err := workdomain.CheckpointRun(run, request.BlockerClass, request.CompletedSummary, request.RemainingSummary, request.TestSummary, request.BranchName, request.CommitHash, request.NextStep, request.ArtifactRefs, time.UnixMilli(request.RecordedAtUnixMillis))
		if err != nil {
			http.Error(w, "invalid checkpoint", http.StatusBadRequest)
			return
		}
		if err := workRepository.SaveAgentCheckpoint(r.Context(), updatedRun, checkpoint); err != nil {
			http.Error(w, "save checkpoint", http.StatusInternalServerError)
			return
		}
		if request.BlockerClass == work.AgentBlockerHumanDecisionRequired {
			delegation, err := workRepository.LoadDelegation(r.Context(), run.DelegationID)
			if err == nil {
				_, _ = attentionClient.Create(r.Context(), r.Header.Get("Authorization"), continuity.CreateAttentionRequest{
					OwnerPrincipalID:    session.PrincipalID,
					ScopeID:             authority.ScopeID("domovoy-global-scope"),
					SourceKind:          continuity.AttentionSourceAgentDelegation,
					SourceExternalRef:   delegationAttentionRef(delegation.ID),
					Level:               continuity.AttentionActionRequired,
					Summary:             "Нужен твой выбор по задаче coding-agent: " + firstNonEmpty(request.RemainingSummary, delegation.DesiredOutcome),
					DueAtUnixMillis:     checkpoint.RecordedAtUnixMillis,
					CreatedAtUnixMillis: checkpoint.RecordedAtUnixMillis,
				})
			}
		}
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusCreated)
		_ = json.NewEncoder(w).Encode(checkpoint)
	})
	mux.HandleFunc("POST /v1/creator/delegations/{id}/runs/{run}/results", func(w http.ResponseWriter, r *http.Request) {
		if _, ok := authenticateCreator(w, r); !ok {
			return
		}
		var request struct {
			Summary              string
			OutcomeRef           string
			VerificationSummary  string
			ArtifactRefs         []work.EvidenceRef
			RecordedAtUnixMillis int64
		}
		decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 32<<10))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&request); err != nil {
			http.Error(w, "invalid result", http.StatusBadRequest)
			return
		}
		run, err := workRepository.LoadAgentRun(r.Context(), work.AgentRunID(r.PathValue("run")))
		if err != nil || run.DelegationID != work.DelegationID(r.PathValue("id")) {
			http.Error(w, "run not found", http.StatusNotFound)
			return
		}
		updatedRun, result, err := workdomain.CompleteRun(run, request.Summary, request.OutcomeRef, request.VerificationSummary, request.ArtifactRefs, time.UnixMilli(request.RecordedAtUnixMillis))
		if err != nil {
			http.Error(w, "invalid result", http.StatusBadRequest)
			return
		}
		if err := workRepository.SaveAgentResult(r.Context(), updatedRun, result); err != nil {
			http.Error(w, "save result", http.StatusInternalServerError)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusCreated)
		_ = json.NewEncoder(w).Encode(result)
	})
	mux.HandleFunc("POST /v1/creator/delegations/{id}/resume", func(w http.ResponseWriter, r *http.Request) {
		if _, ok := authenticateCreator(w, r); !ok {
			return
		}
		delegation, err := workRepository.LoadDelegation(r.Context(), work.DelegationID(r.PathValue("id")))
		if err != nil {
			http.Error(w, "delegation not found", http.StatusNotFound)
			return
		}
		run, err := workRepository.LoadAgentRun(r.Context(), delegation.LatestRunID)
		if err != nil {
			http.Error(w, "run not found", http.StatusNotFound)
			return
		}
		checkpoint, err := workRepository.LatestAgentCheckpoint(r.Context(), delegation.ID)
		if err != nil {
			http.Error(w, "checkpoint not found", http.StatusNotFound)
			return
		}
		updatedDelegation, resumedRun, err := workdomain.ResumeDelegationRun(delegation, run, checkpoint, time.Now())
		if err != nil {
			http.Error(w, "resume not allowed", http.StatusConflict)
			return
		}
		if err := workRepository.SaveResumedRun(r.Context(), updatedDelegation, resumedRun); err != nil {
			http.Error(w, "save resumed run", http.StatusInternalServerError)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusCreated)
		_ = json.NewEncoder(w).Encode(resumedRun)
	})
	mux.HandleFunc("POST /v1/creator/delegations/{id}/verify", func(w http.ResponseWriter, r *http.Request) {
		if _, ok := authenticateCreator(w, r); !ok {
			return
		}
		var request struct {
			Verified             bool
			Summary              string
			EvidenceRefs         []work.EvidenceRef
			RecordedAtUnixMillis int64
		}
		decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 32<<10))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&request); err != nil || request.RecordedAtUnixMillis < 1 {
			http.Error(w, "invalid verification", http.StatusBadRequest)
			return
		}
		delegation, err := workRepository.LoadDelegation(r.Context(), work.DelegationID(r.PathValue("id")))
		if err != nil {
			http.Error(w, "delegation not found", http.StatusNotFound)
			return
		}
		run, err := workRepository.LoadAgentRun(r.Context(), delegation.LatestRunID)
		if err != nil {
			http.Error(w, "run not found", http.StatusNotFound)
			return
		}
		result, err := workRepository.LatestAgentResult(r.Context(), delegation.ID)
		if err != nil {
			http.Error(w, "result not found", http.StatusNotFound)
			return
		}
		updatedDelegation, verification, err := workdomain.VerifyDelegationResult(delegation, run, result, request.Verified, request.Summary, request.EvidenceRefs, time.UnixMilli(request.RecordedAtUnixMillis))
		if err != nil {
			http.Error(w, "invalid verification", http.StatusBadRequest)
			return
		}
		if err := workRepository.SaveDelegationVerification(r.Context(), updatedDelegation, verification); err != nil {
			http.Error(w, "save verification", http.StatusInternalServerError)
			return
		}
		runCount, _ := workRepository.CountAgentRuns(r.Context(), delegation.ID)
		learning.recordDelegationOutcome(r.Context(), delegationLearningInput{
			Intent:           interaction.OriginalHumanIntent{ID: interaction.OriginalHumanIntentID(delegation.SourceIntentID), Text: delegation.DesiredOutcome},
			Utterance:        interaction.HumanUtterance{ID: interaction.HumanUtteranceID(delegation.SourceUtteranceID), Content: delegation.DesiredOutcome},
			DelegationID:     string(delegation.ID),
			RunID:            string(run.ID),
			ImplementationID: run.ImplementationID,
			OutcomeRef:       result.OutcomeRef,
			VerificationRefs: evidenceRefsToEpistemics(request.EvidenceRefs),
			Verified:         request.Verified,
			ExecutionWindows: runCount,
			HumanBlocked:     false,
			At:               time.UnixMilli(request.RecordedAtUnixMillis),
		})
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusCreated)
		_ = json.NewEncoder(w).Encode(verification)
	})
	mux.HandleFunc("GET /v1/principal-bindings/{actor}/{principal}", func(w http.ResponseWriter, r *http.Request) {
		binding, err := identityRepository.LoadBinding(r.Context(), identity.ActorID(r.PathValue("actor")), identity.PrincipalID(r.PathValue("principal")))
		if err != nil {
			http.Error(w, "principal binding not found", http.StatusNotFound)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(binding)
	})
	mux.HandleFunc("GET /v1/tasks/{id}", func(w http.ResponseWriter, r *http.Request) {
		target, err := workRepository.Load(r.Context(), work.TaskID(r.PathValue("id")))
		if err != nil {
			http.Error(w, "task not found", http.StatusNotFound)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(target)
	})
	mux.HandleFunc("POST /v1/capabilities/health", func(w http.ResponseWriter, r *http.Request) {
		var status capability.Health
		if err := json.NewDecoder(r.Body).Decode(&status); err != nil {
			http.Error(w, "invalid capability health", http.StatusBadRequest)
			return
		}
		if err := capabilitydomain.ValidateHealth(status); err != nil {
			http.Error(w, "invalid capability health", http.StatusBadRequest)
			return
		}
		if err := capabilityRepository.SaveHealth(r.Context(), status); err != nil {
			http.Error(w, "save capability health", http.StatusInternalServerError)
			return
		}
		w.WriteHeader(http.StatusCreated)
	})
	mux.HandleFunc("GET /v1/capabilities/{id}/health", func(w http.ResponseWriter, r *http.Request) {
		status, err := capabilityRepository.LoadHealth(r.Context(), capability.CapabilityID(r.PathValue("id")))
		if err != nil {
			http.Error(w, "capability health not found", http.StatusNotFound)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(status)
	})
	mux.HandleFunc("GET /v1/capability-bindings/{id}/revisions/{revision}", func(w http.ResponseWriter, r *http.Request) {
		revision, err := strconv.ParseInt(r.PathValue("revision"), 10, 64)
		if err != nil || revision < 1 {
			http.Error(w, "invalid binding revision", http.StatusBadRequest)
			return
		}
		binding, err := capabilityRepository.LoadBinding(r.Context(), capability.CapabilityBindingID(r.PathValue("id")), revision)
		if err != nil {
			http.Error(w, "capability binding not found", http.StatusNotFound)
			return
		}
		if err = capabilitydomain.ValidateBinding(binding); err != nil {
			http.Error(w, "capability binding invalid", http.StatusConflict)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(binding)
	})
	mux.HandleFunc("GET /v1/capability-bindings/active", func(w http.ResponseWriter, r *http.Request) {
		capabilityID := capability.CapabilityID(r.URL.Query().Get("capability_id"))
		ownerID := identity.PrincipalID(r.URL.Query().Get("owner_principal_id"))
		if capabilityID == "" || ownerID == "" {
			http.Error(w, "invalid binding query", http.StatusBadRequest)
			return
		}
		binding, err := capabilityRepository.LoadActiveBinding(r.Context(), capabilityID, ownerID)
		if err != nil {
			http.Error(w, "active capability binding not found", http.StatusNotFound)
			return
		}
		if err = capabilitydomain.UsableBinding(binding); err != nil {
			http.Error(w, "active capability binding unavailable", http.StatusConflict)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(binding)
	})
	mux.HandleFunc("GET /v1/cognitive-bindings/{id}/revisions/{revision}/snapshot", func(w http.ResponseWriter, r *http.Request) {
		revision, err := strconv.ParseInt(r.PathValue("revision"), 10, 64)
		if err != nil || revision < 1 {
			http.Error(w, "invalid cognitive binding revision", http.StatusBadRequest)
			return
		}
		snapshot, err := capabilityRepository.LoadCognitiveCandidate(r.Context(), capability.CapabilityBindingID(r.PathValue("id")), revision)
		if err != nil {
			http.Error(w, "cognitive binding snapshot not found", http.StatusNotFound)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(snapshot)
	})
	mux.HandleFunc("POST /v1/cognitive-bindings/resolve", func(w http.ResponseWriter, r *http.Request) {
		var requirement capability.CognitiveRequirement
		decoder := json.NewDecoder(io.LimitReader(r.Body, 16*1024+1))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&requirement); err != nil || requirement.CapabilityID == "" || requirement.OwnerPrincipalID == "" || requirement.InputBytes < 0 || requirement.MaxOutputBytes < 1 {
			http.Error(w, "invalid cognitive requirement", http.StatusBadRequest)
			return
		}
		var candidates []capability.ResolvedCognitiveBinding
		var err error
		if requirement.TaskProfileID != "" {
			candidates, err = capabilityRepository.LoadCognitiveCandidatesForProfile(r.Context(), requirement.CapabilityID, requirement.OwnerPrincipalID, requirement.TaskProfileID)
		} else {
			candidates, err = capabilityRepository.LoadCognitiveCandidates(r.Context(), requirement.CapabilityID, requirement.OwnerPrincipalID)
		}
		if err != nil {
			http.Error(w, "cognitive registry unavailable", http.StatusServiceUnavailable)
			return
		}
		selected, err := capabilitydomain.SelectCognitiveBinding(requirement, candidates)
		if err != nil {
			http.Error(w, "no invocable cognitive binding", http.StatusNotFound)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(selected)
	})
	mux.HandleFunc("POST /v1/cognitive-registry/discoveries", func(w http.ResponseWriter, r *http.Request) {
		var snapshot capability.CognitiveDiscoverySnapshot
		decoder := json.NewDecoder(io.LimitReader(r.Body, 1<<20))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&snapshot); err != nil {
			http.Error(w, "invalid cognitive discovery", http.StatusBadRequest)
			return
		}
		registration, err := capabilitydomain.BuildDiscoveryRegistration(snapshot)
		if err != nil {
			http.Error(w, "invalid cognitive discovery", http.StatusBadRequest)
			return
		}
		if err := capabilityRepository.SaveCognitiveDiscovery(r.Context(), registration); err != nil {
			log.Printf("cognitive discovery persistence failed: %v", err)
			http.Error(w, "save cognitive discovery", http.StatusInternalServerError)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusCreated)
		_ = json.NewEncoder(w).Encode(registration)
	})
	mux.HandleFunc("POST /v1/cognitive-registry/evaluated-capabilities", func(w http.ResponseWriter, r *http.Request) {
		var value capability.EvaluatedCapability
		decoder := json.NewDecoder(io.LimitReader(r.Body, 64<<10))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&value); err != nil || value.ID == "" || value.BindingID == "" || value.BindingRevision < 1 || value.CapabilityID == "" || value.BenchmarkVersion == "" || value.ArtifactID == "" || value.ObservedAtUnixMillis < 1 {
			http.Error(w, "invalid evaluated capability", http.StatusBadRequest)
			return
		}
		if err := capabilityRepository.SaveEvaluatedCapability(r.Context(), value); err != nil {
			http.Error(w, "save evaluated capability", http.StatusInternalServerError)
			return
		}
		w.WriteHeader(http.StatusCreated)
	})
	mux.HandleFunc("POST /v1/cognitive-registry/task-evaluations", func(w http.ResponseWriter, r *http.Request) {
		var value capability.TaskEvaluation
		decoder := json.NewDecoder(io.LimitReader(r.Body, 64<<10))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&value); err != nil || capabilitydomain.ValidateTaskEvaluation(value) != nil {
			http.Error(w, "invalid task evaluation", http.StatusBadRequest)
			return
		}
		if err := capabilityRepository.SaveTaskEvaluation(r.Context(), value); err != nil {
			http.Error(w, "save task evaluation", http.StatusInternalServerError)
			return
		}
		w.WriteHeader(http.StatusCreated)
	})
	mux.HandleFunc("POST /v1/cognitive-registry/model-qualification-observations", func(w http.ResponseWriter, r *http.Request) {
		var value capability.ModelQualificationObservation
		decoder := json.NewDecoder(io.LimitReader(r.Body, 16<<10))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&value); err != nil || value.Validate() != nil {
			http.Error(w, "invalid model qualification observation", http.StatusBadRequest)
			return
		}
		if err := capabilityRepository.SaveModelQualificationObservation(r.Context(), value); err != nil {
			http.Error(w, "save model qualification observation", http.StatusInternalServerError)
			return
		}
		w.WriteHeader(http.StatusCreated)
	})
	mux.HandleFunc("POST /v1/creator/cognitive-canary", func(w http.ResponseWriter, r *http.Request) {
		session, ok := authenticateCreator(w, r)
		if !ok {
			return
		}
		var request capability.CognitiveCanaryPromotionRequest
		decoder := json.NewDecoder(io.LimitReader(r.Body, 16<<10))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&request); err != nil {
			http.Error(w, "invalid canary promotion", http.StatusBadRequest)
			return
		}
		request.RequestedByPrincipalID = session.PrincipalID
		request.CapabilityID = "creator-advisory"
		candidates, err := capabilityRepository.LoadCognitiveCandidates(r.Context(), request.CapabilityID, session.PrincipalID)
		if err != nil {
			http.Error(w, "cognitive registry unavailable", http.StatusServiceUnavailable)
			return
		}
		var current capability.ResolvedCognitiveBinding
		for _, candidate := range candidates {
			if candidate.Binding.ID == request.BindingID && candidate.Binding.Revision == request.ExpectedBindingRevision {
				current = candidate
				break
			}
		}
		promotion, err := capabilitydomain.BuildCanaryPromotion(request, current)
		if err != nil {
			http.Error(w, "canary promotion precondition failed", http.StatusConflict)
			return
		}
		if err = capabilityRepository.SaveCognitiveCanaryPromotion(r.Context(), promotion); err != nil {
			http.Error(w, "canary promotion conflict", http.StatusConflict)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusCreated)
		_ = json.NewEncoder(w).Encode(promotion)
	})
	mux.HandleFunc("POST /v1/creator/cognitive-activate", func(w http.ResponseWriter, r *http.Request) {
		session, ok := authenticateCreator(w, r)
		if !ok {
			return
		}
		var request capability.CognitiveActivationPromotionRequest
		decoder := json.NewDecoder(io.LimitReader(r.Body, 16<<10))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&request); err != nil {
			http.Error(w, "invalid cognitive activation", http.StatusBadRequest)
			return
		}
		request.RequestedByPrincipalID = session.PrincipalID
		request.CapabilityID = "creator-advisory"
		candidates, err := capabilityRepository.LoadCognitiveCandidates(r.Context(), request.CapabilityID, session.PrincipalID)
		if err != nil {
			http.Error(w, "cognitive registry unavailable", http.StatusServiceUnavailable)
			return
		}
		var current capability.ResolvedCognitiveBinding
		for _, candidate := range candidates {
			if candidate.Binding.ID == request.BindingID && candidate.Binding.Revision == request.ExpectedBindingRevision {
				current = candidate
				break
			}
		}
		promotion, err := capabilitydomain.BuildActivationPromotion(request, current)
		if err != nil {
			http.Error(w, "cognitive activation precondition failed", http.StatusConflict)
			return
		}
		if err = capabilityRepository.SaveCognitiveActivationPromotion(r.Context(), promotion); err != nil {
			http.Error(w, "cognitive activation conflict", http.StatusConflict)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusCreated)
		_ = json.NewEncoder(w).Encode(promotion)
	})
	mux.HandleFunc("POST /v1/cognitive-registry/performance-evidence", func(w http.ResponseWriter, r *http.Request) {
		var value capability.PerformanceEvidence
		decoder := json.NewDecoder(io.LimitReader(r.Body, 64<<10))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&value); err != nil || value.ID == "" || value.BindingID == "" || value.BindingRevision < 1 || value.ModelDescriptorID == "" || value.ModelRevision < 1 || value.HardwareProfile == "" || value.Runtime == "" || value.BenchmarkVersion == "" || value.ArtifactID == "" || value.ObservedAtUnixMillis < 1 {
			http.Error(w, "invalid performance evidence", http.StatusBadRequest)
			return
		}
		if err := capabilityRepository.SavePerformanceEvidence(r.Context(), value); err != nil {
			http.Error(w, "save performance evidence", http.StatusInternalServerError)
			return
		}
		w.WriteHeader(http.StatusCreated)
	})
	mux.HandleFunc("POST /v1/cognitive-usage-observations", func(w http.ResponseWriter, r *http.Request) {
		var observation capability.CognitiveUsageObservation
		decoder := json.NewDecoder(io.LimitReader(r.Body, 16*1024+1))
		decoder.DisallowUnknownFields()
		if err := decoder.Decode(&observation); err != nil || observation.ObservationID == "" || observation.RequestID == "" || observation.BindingID == "" || observation.BindingRevision < 1 || observation.ProviderInstanceID == "" || observation.ModelDescriptorID == "" || observation.ObservedAtUnixMillis < 1 || observation.LatencyMillis < 0 || observation.InputUnits < 0 || observation.OutputUnits < 0 || (observation.EstimatedCostMicros != nil && *observation.EstimatedCostMicros < 0) || (observation.ActualCostMicros != nil && *observation.ActualCostMicros < 0) || observation.ResultClass == "" {
			http.Error(w, "invalid cognitive usage observation", http.StatusBadRequest)
			return
		}
		if err := capabilityRepository.SaveCognitiveUsageObservation(r.Context(), observation); err != nil {
			http.Error(w, "save cognitive usage observation", http.StatusInternalServerError)
			return
		}
		w.WriteHeader(http.StatusCreated)
	})
	mux.HandleFunc("POST /v1/capabilities/health-projection/rebuild", func(w http.ResponseWriter, r *http.Request) {
		rebuilt, err := capabilityRepository.RebuildHealthProjection(r.Context())
		if err != nil {
			http.Error(w, "rebuild capability health projection", http.StatusInternalServerError)
			return
		}
		_ = json.NewEncoder(w).Encode(struct{ Rebuilt int64 }{rebuilt})
	})
	mux.HandleFunc("POST /v1/focus-bindings", func(w http.ResponseWriter, r *http.Request) {
		var binding situation.FocusBinding
		if err := json.NewDecoder(r.Body).Decode(&binding); err != nil {
			http.Error(w, "invalid focus binding", http.StatusBadRequest)
			return
		}
		if err := repository.Save(r.Context(), binding); err != nil {
			http.Error(w, "save focus binding", http.StatusInternalServerError)
			return
		}
		w.WriteHeader(http.StatusCreated)
	})
	mux.HandleFunc("GET /v1/focus", func(w http.ResponseWriter, r *http.Request) {
		focus, err := resolveFocus(r)
		if err != nil {
			http.Error(w, err.Error(), http.StatusConflict)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(focus)
	})
	mux.HandleFunc("POST /v1/tasks", func(w http.ResponseWriter, r *http.Request) {
		var target work.TaskTarget
		if err := json.NewDecoder(r.Body).Decode(&target); err != nil {
			http.Error(w, "invalid task", 400)
			return
		}
		if err := workRepository.Create(r.Context(), target); err != nil {
			http.Error(w, "create task", 500)
			return
		}
		w.WriteHeader(http.StatusCreated)
	})
	mux.HandleFunc("POST /v1/tasks/{id}/commit", func(w http.ResponseWriter, r *http.Request) {
		var target work.TaskTarget
		if err := json.NewDecoder(r.Body).Decode(&target); err != nil {
			http.Error(w, "invalid task commit", 400)
			return
		}
		target.TaskID = work.TaskID(r.PathValue("id"))
		revision, err := workRepository.Commit(r.Context(), target)
		if err != nil {
			http.Error(w, "task revision conflict", http.StatusConflict)
			return
		}
		_ = json.NewEncoder(w).Encode(struct{ Revision work.TaskRevision }{revision})
	})
	mux.HandleFunc("POST /v1/focus-task-commits", func(w http.ResponseWriter, r *http.Request) {
		var request struct {
			SessionID situation.SessionID
			Workspace situation.WorkspaceID
			Target    work.TaskTarget
		}
		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
			http.Error(w, "invalid guarded commit", http.StatusBadRequest)
			return
		}
		bindings, err := repository.ByRuntime(r.Context(), situation.RuntimeBinding{SessionID: request.SessionID, Workspace: request.Workspace})
		if err != nil {
			http.Error(w, "load focus", http.StatusInternalServerError)
			return
		}
		focus, err := situationdomain.NewResolver(bindings).Resolve(situation.RuntimeBinding{SessionID: request.SessionID, Workspace: request.Workspace})
		if err != nil {
			http.Error(w, "focus unavailable", http.StatusConflict)
			return
		}
		if err := situationdomain.ValidateTaskTarget(focus, request.Target); err != nil {
			http.Error(w, "target outside resolved focus", http.StatusConflict)
			return
		}
		revision, err := workRepository.Commit(r.Context(), request.Target)
		if err != nil {
			http.Error(w, "task revision conflict", http.StatusConflict)
			return
		}
		_ = json.NewEncoder(w).Encode(struct{ Revision work.TaskRevision }{revision})
	})
	log.Printf("core-runtime listening on %s", addr)
	if err := http.ListenAndServe(addr, mux); err != nil {
		log.Fatal(err)
	}
}

func creatorSessionHandler(bootstrapToken, creatorUsername, creatorPassword string, sessionKey []byte, now func() time.Time) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		authenticated := identitydomain.BootstrapMatches(bootstrapToken, bearerToken(r))
		if !authenticated {
			var credentials identity.CreatorCredentials
			decoder := json.NewDecoder(io.LimitReader(r.Body, maxCreatorCredentialsBytes+1))
			decoder.DisallowUnknownFields()
			if err := decoder.Decode(&credentials); err != nil || decoder.Decode(&struct{}{}) != io.EOF {
				http.Error(w, "creator authentication denied", http.StatusUnauthorized)
				return
			}
			authenticated = identitydomain.CreatorCredentialsMatch(creatorUsername, creatorPassword, credentials)
		}
		if !authenticated {
			http.Error(w, "creator authentication denied", http.StatusUnauthorized)
			return
		}
		token, session, err := identitydomain.IssueCreatorSession(sessionKey, now(), 8*time.Hour)
		if err != nil {
			http.Error(w, "creator session unavailable", http.StatusServiceUnavailable)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(struct {
			Token   string
			Session identity.CreatorSession
		}{token, session})
	}
}

func bearerToken(r *http.Request) string {
	value := r.Header.Get("Authorization")
	if !strings.HasPrefix(value, "Bearer ") {
		return ""
	}
	return strings.TrimPrefix(value, "Bearer ")
}

func readRequiredSecret(name string) (string, error) {
	direct, directSet := os.LookupEnv(name)
	fileName, fileSet := os.LookupEnv(name + "_FILE")
	if directSet && fileSet {
		return "", fmt.Errorf("%s and %s_FILE cannot both be configured", name, name)
	}
	if fileSet {
		if fileName == "" {
			return "", fmt.Errorf("%s_FILE is empty", name)
		}
		contents, err := os.ReadFile(fileName)
		if err != nil {
			return "", fmt.Errorf("read %s_FILE: %w", name, err)
		}
		direct = strings.TrimRight(string(contents), "\r\n")
		if strings.ContainsAny(direct, "\r\n") {
			return "", fmt.Errorf("%s_FILE must contain one line", name)
		}
	}
	if direct == "" {
		return "", fmt.Errorf("%s is required", name)
	}
	return direct, nil
}

func readCredentialRefSecret(name, refName string) (string, error) {
	if _, directSet := os.LookupEnv(name); directSet {
		return "", fmt.Errorf("%s direct environment secret is forbidden; use %s_FILE", name, name)
	}
	fileName := os.Getenv(name + "_FILE")
	if fileName == "" {
		return "", fmt.Errorf("%s_FILE is required", name)
	}
	ref := os.Getenv(refName)
	if ref == "" {
		return "", fmt.Errorf("%s is required", refName)
	}
	root := os.Getenv("SECRET_BACKEND_ROOT")
	if root == "" {
		root = "/run/secrets"
	}
	resolver, err := platformsecrets.NewFileResolver(root)
	if err != nil {
		return "", err
	}
	return resolver.ResolveFile(secretcontracts.SecretFileRef{
		CredentialRef: secretcontracts.CredentialRef(ref),
		Purpose:       secretcontracts.SecretPurposeDatabasePassword,
		Consumer:      secretcontracts.RuntimeConsumerCore,
		Path:          fileName,
	})
}

func envOr(name, fallback string) string {
	if value := os.Getenv(name); value != "" {
		return value
	}
	return fallback
}

func envInt(name string, fallback int) int {
	value, err := strconv.Atoi(os.Getenv(name))
	if err != nil || value < 1 {
		return fallback
	}
	return value
}

func hasCapabilityHint(hints []string, wanted string) bool {
	for _, hint := range hints {
		if hint == wanted {
			return true
		}
	}
	return false
}

func renderResearchReply(query string, result epistemics.ResearchResult, researchErr error) (string, bool) {
	if researchErr != nil {
		return "Сейчас не удалось получить данные из подключённого источника. Попробую снова через доступный маршрут.", false
	}
	lines := make([]string, 0, 2)
	for index, finding := range result.Findings {
		if finding.State != epistemics.FindingSupported || strings.TrimSpace(finding.Excerpt.Text) == "" || strings.TrimSpace(finding.Source.Locator) == "" {
			continue
		}
		excerpt := strings.TrimSpace(finding.Excerpt.Text)
		limit := 180
		if index > 0 {
			limit = 100
		}
		if len([]rune(excerpt)) > limit {
			excerpt = string([]rune(excerpt)[:limit]) + "…"
		}
		lines = append(lines, excerpt+"\nИсточник: "+researchSourceLabel(finding))
		if len(lines) == 2 {
			break
		}
	}
	if len(lines) == 0 {
		return "Проверяемых данных пока не найдено. Могу повторить поиск или уточнить, что именно проверить.", false
	}
	reply := strings.Join(lines, "\n")
	lowerQuery := strings.ToLower(query)
	if (strings.Contains(lowerQuery, "цен") || strings.Contains(lowerQuery, "стоим")) && !containsPriceEvidence(reply) {
		reply = "Актуальная цена в найденных фрагментах не указана, поэтому не буду придумывать сумму. Вот страницы, где её можно проверить:\n" + reply
	}
	return reply, true
}

func containsPriceEvidence(value string) bool {
	pricePattern := regexp.MustCompile(`(?i)(\d[\d\s.,]{2,})(?:\s*(?:₽|руб\.?|р\.?|usd|\$|€))`)
	return pricePattern.MatchString(value)
}

func reviewPreservesResearchEvidence(reviewed, draft string) bool {
	if strings.Contains(draft, "http://") || strings.Contains(draft, "https://") {
		return strings.Contains(reviewed, "http://") || strings.Contains(reviewed, "https://")
	}
	if strings.Contains(draft, "Источник:") {
		return strings.Contains(reviewed, "Источник:")
	}
	return true
}

func humanMemoryInventory(history []interaction.HumanUtterance, assistantName string) string {
	rows := make([]string, 0, 4)
	if assistantName != "" {
		rows = append(rows, "| Имя помощника | "+assistantName+" |")
	}
	latestPreferenceAt := int64(-1)
	latestPreference := ""
	for _, utterance := range history {
		message := strings.TrimSpace(utterance.Content)
		lower := strings.ToLower(message)
		if (strings.Contains(lower, "нравится") || strings.Contains(lower, "люблю")) && utterance.ReceivedAtUnixMillis >= latestPreferenceAt {
			latestPreferenceAt = utterance.ReceivedAtUnixMillis
			latestPreference = message
		}
	}
	if latestPreference != "" {
		rows = append(rows, "| Предпочтение пользователя | "+latestPreference+" |")
	}
	if len(rows) == 0 {
		return "| Ячейка памяти | Значение |\n|---|---|\n| — | Сохранённых пользовательских предпочтений пока не найдено. |"
	}
	return "| Ячейка памяти | Значение |\n|---|---|\n" + strings.Join(rows, "\n")
}

func latestAssistantName(history []interaction.HumanUtterance) string {
	latestAt := int64(-1)
	latestName := ""
	for _, utterance := range history {
		if name := interactiondomain.PreferredAssistantName(utterance.Content); name != "" && utterance.ReceivedAtUnixMillis >= latestAt {
			latestAt = utterance.ReceivedAtUnixMillis
			latestName = name
		}
	}
	return latestName
}

func humanTimeDifferenceReply(message string) string {
	lower := strings.ToLower(message)
	if strings.Contains(lower, "моск") && strings.Contains(lower, "шанх") {
		return "Шанхай опережает Москву на 5 часов. Если в Москве 12:00, в Шанхае 17:00."
	}
	return "Уточните два города — я сравню их часовые пояса."
}

func researchSourceLabel(finding epistemics.ResearchFinding) string {
	title := strings.TrimSpace(finding.Source.Title)
	locator := strings.TrimSpace(finding.Source.Locator)
	publisher := strings.TrimSpace(finding.Source.Publisher)
	if strings.Contains(locator, "duckduckgo.com/html") || strings.Contains(locator, "bing.com/search") {
		locator = ""
	}
	if title != "" && publisher != "" {
		if locator != "" {
			return publisher + " (" + locator + ")"
		}
		return publisher
	}
	if title != "" {
		return title
	}
	if publisher != "" {
		return publisher
	}
	if locator != "" {
		return locator
	}
	return "подключённый источник"
}

func humanCognitiveModelInventory(candidates []capability.ResolvedCognitiveBinding, inventoryErr error) string {
	if inventoryErr != nil {
		return "Я не смогла прочитать реестр подключённых моделей. Встроенный канал Домового остаётся доступен; настройки можно проверить повторно после восстановления реестра. Ключи и пароли не выводятся в чат."
	}
	if len(candidates) == 0 {
		return "В реестре пока нет подтверждённых подключённых моделей. Встроенный локальный канал Домового доступен всегда; внешние модели добавляются через настройки подключения. Ключи и пароли в чат не выводятся."
	}
	type inventoryEntry struct {
		name   string
		status string
		rank   int
		seenAt int
	}
	entries := make([]inventoryEntry, 0, len(candidates))
	byName := make(map[string]int, len(candidates))
	for _, candidate := range candidates {
		modelName := string(candidate.Model.ProviderModelID)
		if modelName == "" {
			continue
		}
		status := conciseCognitiveInventoryStatus(candidate)
		rank := cognitiveInventoryRank(candidate)
		if index, exists := byName[modelName]; exists {
			if rank < entries[index].rank {
				entries[index].status = status
				entries[index].rank = rank
			}
			continue
		}
		byName[modelName] = len(entries)
		entries = append(entries, inventoryEntry{name: modelName, status: status, rank: rank, seenAt: len(entries)})
	}
	sort.SliceStable(entries, func(left, right int) bool {
		if entries[left].rank != entries[right].rank {
			return entries[left].rank < entries[right].rank
		}
		return entries[left].seenAt < entries[right].seenAt
	})
	lines := make([]string, 0, len(entries)+2)
	lines = append(lines, "Доступные модели:")
	unconfirmed := 0
	for _, entry := range entries {
		if entry.rank >= 3 {
			unconfirmed++
			continue
		}
		lines = append(lines, "- "+entry.name+" — "+entry.status)
	}
	if len(lines) == 1 {
		return "Подтверждённых доступных моделей сейчас нет."
	}
	if unconfirmed > 0 {
		lines = append(lines, fmt.Sprintf("Ещё %d моделей требуют проверки.", unconfirmed))
	}
	return strings.Join(lines, "\n")
}

func conciseCognitiveInventoryStatus(candidate capability.ResolvedCognitiveBinding) string {
	if candidate.Provider.Health == capability.HealthAvailable && candidate.Model.Health == capability.HealthAvailable {
		if candidate.Binding.Activation == capability.ActivationActive {
			return "активна"
		}
		return "доступна"
	}
	if candidate.Provider.Health == capability.HealthDegraded || candidate.Model.Health == capability.HealthDegraded {
		return "работает с ограничениями"
	}
	return "не подтверждена"
}

func cognitiveInventoryRank(candidate capability.ResolvedCognitiveBinding) int {
	if candidate.Provider.Health == capability.HealthAvailable && candidate.Model.Health == capability.HealthAvailable {
		if candidate.Binding.Activation == capability.ActivationActive {
			return 0
		}
		return 1
	}
	if candidate.Provider.Health == capability.HealthDegraded || candidate.Model.Health == capability.HealthDegraded {
		return 2
	}
	return 3
}

func cognitiveInventoryStatus(candidate capability.ResolvedCognitiveBinding) string {
	if candidate.Provider.Health == capability.HealthAvailable && candidate.Model.Health == capability.HealthAvailable {
		if candidate.Binding.Activation == capability.ActivationActive {
			return "активна"
		}
		return "доступна, не активирована для автоматического выбора"
	}
	if candidate.Provider.Health == capability.HealthDegraded || candidate.Model.Health == capability.HealthDegraded {
		return "работает с ограничениями"
	}
	return "недоступна или не подтверждена"
}

func cognitiveInventoryPricing(provider capability.ProviderInstance) string {
	switch provider.BillingMode {
	case capability.BillingFree:
		return "бесплатная"
	case capability.BillingPerInput:
		return "платная: стоимость входа указана в реестре"
	case capability.BillingPerOutput:
		return "платная: стоимость выхода указана в реестре"
	case capability.BillingPerRequest:
		return "платная: стоимость запроса указана в реестре"
	default:
		return "стоимость не подтверждена"
	}
}

func humanAuthMode(mode capability.AuthMode) string {
	switch mode {
	case capability.AuthKey:
		return "API-ключ"
	case capability.AuthBearer:
		return "Bearer-токен"
	case capability.AuthUsernamePassword:
		return "логин и пароль"
	case capability.AuthOAuth:
		return "OAuth"
	case capability.AuthSecretFile:
		return "защищённый файл секрета"
	default:
		return "защищённый способ"
	}
}

func humanCognitiveChannelReply(kind interaction.InformationRequestKind, act interaction.SpeechAct, health capability.Health, healthErr error) string {
	if healthErr != nil {
		return "Не удалось проверить канал. Домовой остаётся на связи."
	}
	switch health.State {
	case capability.HealthAvailable:
		return "Канал мышления доступен."
	case capability.HealthDegraded:
		return "Канал мышления работает с ограничениями."
	case capability.HealthUnavailable:
		return "Канал мышления недоступен. Домовой остаётся на связи."
	default:
		return "Состояние канала пока не подтверждено. Домовой остаётся на связи."
	}
}

func humanCognitiveDegradedReply(message string) string {
	if strings.TrimSpace(message) == "" {
		return "Сейчас когнитивный канал недоступен; Домовой остаётся на связи."
	}
	return "Сейчас когнитивный канал недоступен. Повторю запрос через доступный маршрут, когда он восстановится."
}

func humanCapabilityList(kinds []capability.CapabilityKind) string {
	labels := make([]string, 0, len(kinds))
	for _, kind := range kinds {
		switch kind {
		case capability.CapabilityKindScheduleReminder:
			labels = append(labels, "создавать напоминания")
		case capability.CapabilityKindCognitiveReasoning:
			labels = append(labels, "отвечать через когнитивный gateway")
		default:
			labels = append(labels, strings.ToLower(strings.ReplaceAll(string(kind), "_", " ")))
		}
	}
	return strings.Join(labels, ", ")
}

func toCapabilityKinds(values []string) []capability.CapabilityKind {
	result := make([]capability.CapabilityKind, 0, len(values))
	for _, value := range values {
		kind := capability.CapabilityKind(strings.TrimSpace(value))
		if kind == "" {
			continue
		}
		result = append(result, kind)
	}
	return result
}

func delegationAttentionRef(id work.DelegationID) string {
	return "work:delegation:" + string(id)
}

func continueDelegationFromHumanResponse(ctx context.Context, repository *postgres.WorkRepository, response continuity.HumanResponse, now time.Time) (bool, error) {
	if response.Operation != continuity.ResponseContinue || !strings.HasPrefix(response.TargetExternalRef, "work:delegation:") {
		return false, nil
	}
	delegationID := work.DelegationID(strings.TrimPrefix(response.TargetExternalRef, "work:delegation:"))
	delegation, err := repository.LoadDelegation(ctx, delegationID)
	if err != nil {
		return false, err
	}
	run, err := repository.LoadAgentRun(ctx, delegation.LatestRunID)
	if err != nil {
		return false, err
	}
	checkpoint, err := repository.LatestAgentCheckpoint(ctx, delegationID)
	if err != nil {
		return false, err
	}
	updatedDelegation, resumedRun, err := workdomain.ResumeDelegationRun(delegation, run, checkpoint, now)
	if err != nil {
		return false, err
	}
	if err := repository.SaveResumedRun(ctx, updatedDelegation, resumedRun); err != nil {
		return false, err
	}
	return true, nil
}

func firstNonEmpty(values ...string) string {
	for _, value := range values {
		if strings.TrimSpace(value) != "" {
			return strings.TrimSpace(value)
		}
	}
	return ""
}

func evidenceRefsToEpistemics(values []work.EvidenceRef) []epistemics.EvidenceRef {
	result := make([]epistemics.EvidenceRef, 0, len(values))
	for _, value := range values {
		if strings.TrimSpace(string(value)) == "" {
			continue
		}
		result = append(result, epistemics.EvidenceRef(value))
	}
	return result
}