Swarm v2: elastic execution, session memory, and scoped active brains

Read the architecture and the assigned package rather than loading the whole plan into every agent context. All implementation and conformance entries below are planned work, not executed test results.

Section	Subject
0	Document contract and execution entry point
1	Final architecture and ownership
2	Verified baseline and corrections to earlier shorthand
3	Non-negotiable invariants
4	Execution model and lifecycle
5	herdr integration and one-window operations
6	Worker image contract
7	Kubernetes and AWS integration
8	Filesystem and durability
9	Canonical session memory in agentihooks
10	Brain project awareness and active retrieval
11	Brain consultation gates
12	Personal and swarm brains
13	API and storage contracts
14	Security and trust
15	Performance, limits, and experiments
16	Delivery sequence
17	Operator experience and observability
18	Acceptance definition
19	Workstream index and dependency interpretation
20	Detailed implementation work packages
21	Behavioral conformance scenarios
22	Versioned record and storage contracts
23	Persistence and transaction design sketches
24	Runtime transition and race catalogue
25	Proposed configuration, image, and deployment examples
26	Implementation execution guide for the swarm master
27	Failure-oriented operational runbooks
28	Release evidence, privacy, and completion checklists
29	Source register and revalidation instructions
30	End-of-plan completion statement

0. Document contract and execution entry point

Document identifier: SWARM-V2.
Requested repository: the-cloud-clockwork/agentihooks.
Requested branch: dev.
Requested repository location: /Swarm-v2.md.
Authored: 2026-10-07.
State: implementation plan; not a statement that the described system is already deployed.
Delivery authority: the operator’s explicit instructions in this conversation.
Implementation repositories: agentihooks, agentibrain-kernel, and antoncore.
Canonical product spelling in this plan is agentihooks.
The terminal runtime is herdr; it is not a Kubernetes scheduler.
No operational address is embedded in this plan.
All endpoints in examples are proposed logical names, not assertions about live DNS.
All new commands, fields, paths, and endpoints are proposed contracts unless explicitly marked existing.
A source link identifies evidence, not permission to execute the linked operational commands.
Planning approval does not authorize an unreviewed production drain, destructive migration, credential change, or spending-limit increase.
Implementation should start on the next operator-initiated swarm run; this document does not schedule that run.
The local personal computer must not be required to keep the swarm running.
The permanent swarm controller, operator terminal aggregation, ledger, and durable services belong on Anton infrastructure.
Personal development may use a separate personal brain without joining the execution control plane.
A successful outcome preserves the working local swarm while adding the distributed path incrementally.

0.1 How the implementation swarm must read this file

Read sections 0 through 8 before selecting work. Read the contracts referenced by the selected work package before editing code. Read only the assigned work package and its dependency outputs during routine execution. Do not inject the entire plan into every agent prompt. Do not interpret the document’s size as a requirement to create one issue or one agent per paragraph. Work-package IDs are stable planning identifiers; runtime agents retain the existing canonical agent-naming rules. Each implementation task must name its package ID, repository, dependency IDs, touched paths, and acceptance evidence. A package may produce several small pull requests when the acceptance boundary remains intact. One change must have one authoritative implementation owner even when multiple repositories consume its contract. Use the existing ledger for task state and the existing swarm master for operator-facing coordination. The swarm master plans and coordinates; it does not become a second code-writing worker. Preserve the existing engineering, CI, planning, and master lane semantics. Do not turn the brain into the task scheduler. Do not turn session search into a task scheduler. Do not create a new standalone product to house code that belongs in one of the three named repositories.

0.2 Evidence classes

VERIFIED-SOURCE means a source file or official reference was inspected during this conversation. REVALIDATED means the specific source was fetched again while preparing this plan. PROPOSED means an implementation contract chosen here, not a current feature claim. LIVE-CHECK means the implementation swarm must verify the deployment before relying on the value. EXPERIMENT means an initial tuning hypothesis that must be measured before promotion. A repository file proves declared configuration, not the state of a running cluster. A branch head recorded below is an audit anchor, not a permanently current deployment version. No test execution against the live swarm or cluster is claimed by this document.

0.3 Source snapshots

agentihooks/dev was resolved to e440d3fb7bdd0491c8896ca528440041a43c36c4 during preparation.
agentibrain-kernel/dev was resolved to 80174260fee601659b94b029b9a5a58ee8e1ef04 during preparation.
antoncore/dev was resolved to 94b2a670daf11eeed02b853b08b3b29c451a6b13 during preparation.
Brain issue 89 was revalidated as open during preparation.
The requested plan path returned not found during preparation; the publisher must still check again before writing.
Re-fetch all three dev heads before implementation and record material drift.
Never reset a moving dev branch to any snapshot listed in this document.

1. Final architecture and ownership

Operator device: optional terminal viewer, never an execution dependency
                       |
                       v
Anton-hosted operator herdr client and agentihooks controller
                       |
             +---------+--------------------+
             |                              |
       Existing local runtime       Kubernetes execution adapter
             |                              |
       Local herdr server            One main agent per worker Pod
                                            |
                                  herdr + agentihooks + CLI tools
                                            |
                           Existing k3s scheduler and node autoscaler
                                            |
                           On-prem workers and permitted AWS pools

All execution targets -> agentihooks session ingestion and catalog
All execution targets -> authenticated ledger and control APIs
All execution targets -> selected brain instance over authenticated HTTP
Session catalog -> brain extraction -> arcs, lessons, decisions, edges
Brain context -> agentihooks delivery and task-transition consultation gates

1.1 Component ownership

Component	Code owner	Deployment owner	Authoritative state
Swarm reconciliation	agentihooks	antoncore	Swarm state and ledger
Local and Kubernetes runtime adapters	agentihooks	antoncore	Execution identity plus observed runtime
Worker image and entrypoint	agentihooks	antoncore	Immutable image and launch specification
Session capture, normalization, catalog, search	agentihooks	antoncore	Durable transcript archive and catalog
Brain context selection and graph retrieval	agentibrain-kernel	antoncore or personal installation	Brain-local knowledge and provenance
Brain routing and consultation gates	agentihooks	antoncore or personal installation	Session binding and verified receipts
Cluster, AMIs, ASGs, taints, GitOps, secrets delivery	antoncore	antoncore	Existing infrastructure configuration
Operator interface	agentihooks	antoncore	Ledger projections and runtime observations

1.2 Simplicity rules

Retain one swarm task model. Retain one authority for task claims. Retain Kubernetes as the host-placement scheduler. Retain the existing node autoscaler as the EC2 capacity controller. Do not introduce KEDA for the baseline design. Do not introduce a second work-stealing queue for coding tasks. A bounded ingestion backlog is permitted for transcripts; it is not an execution queue. A bounded embedding backlog is permitted for changed content; it does not launch coding agents. The session service may run as a process supplied by the agentihooks package beside the controller. It must not run a complete database stack inside every worker image. Use the existing Postgres/pgvector infrastructure where its capacity and isolation have been verified. Keep separate logical storage domains for transcript evidence and brain synthesis even when they share a database server. Preserve Redis coordination where it already exists; do not use Redis as the only durable transcript archive. Do not require a graph database in the initial release. A relational edge table and bounded graph traversal are sufficient for the proposed graph contract. Avoid bespoke per-node worker daemons in the baseline. One Pod hosts one main swarm agent; that agent may have scoped child processes within its resource limits. A Pod is an execution attempt, not the permanent identity of an agent seat.

2. Verified baseline and corrections to earlier shorthand

2.1 agentihooks baseline

The existing swarm stores configuration, task claims, leases, agents, names, seats, and handoffs in Redis. SRC-AH-STORE The current herdr runtime launches through init-agent and assumes local process discovery in important paths. SRC-AH-RUNTIME Process termination and account-session counting inspect local process state; these cannot be treated as fleet-global observations. SRC-AH-TERMINATE The ledger client uses HTTP, but current request construction still reads an authentication token from a local ledger HTML file. SRC-AH-LEDGER Project identity and project-memory delivery already exist on the client side, including worktree-aware resolution. SRC-BRAIN-89 A unified transcript reader already understands Claude, Codex, and Copilot record families. SRC-AH-READER That reader is currently a whole-file parser; reusing its normalization does not provide an incremental collector automatically. SRC-AH-READER The snapshot saves coordination state, a ledger copy, and worktree path mappings. SRC-AH-SNAPSHOT A saved path is not a saved checkout, conversation store, untracked file, or running process. Do not claim that the current snapshot can move an arbitrary dead worker’s conversation to another machine without additional artifacts. The existing local path remains a supported compatibility mode throughout rollout.

2.2 antoncore baseline

The inspected dev configuration defines on-demand, general Spot, and research Spot ASGs. SRC-ANTON-ASG The revalidated defaults are on-demand maximum 20, general Spot maximum 20, and research maximum 10. SRC-ANTON-VARS Those are individual declared ceilings, not proof of a live fleet or permission to consume all ceilings simultaneously. The on-demand ceiling is documented as a temporary burst value; do not make it permanent implicitly. The general pools use equal-shape general-purpose instance alternatives; the research pool uses equal-shape compute alternatives. SRC-ANTON-VARS A dedicated memory-optimized pool was not established by the inspected defaults. A memory execution class initially means a request profile, not proof that a memory-optimized ASG exists. The existing priority expander ranks research above on-demand above general Spot. SRC-ANTON-CA A soft Pod preference for Spot does not override the autoscaler’s pool-expansion priority. The EC2 nodes join the existing k3s cluster through the established private network path. SRC-ANTON-JOIN Keep EC2 node bootstrap separate from the worker container image. The on-demand warm-pool lifecycle, provider identity, scale-from-zero tags, and desired-capacity ownership are existing integration contracts. SRC-ANTON-ASG The existing research placement boundary is intentional; swarm agents must not silently invade that pool. Existing StatefulSet conventions require an explicit documented exception for controller-owned execution Pods. That exception concerns ephemeral execution attempts only; it does not replace conventions for long-lived services.

2.3 Brain baseline

Issue 89 identifies the remaining project-scoping work in the kernel. SRC-BRAIN-89 Client-side filtering is not equivalent to ranking all memory inside the requested project. The current arc-search tool performs vector retrieval and returns individual arc results, not graph-expanded task context. SRC-BRAIN-ARCS The current arc detail path can return an indexed preview or a truncated vault result; it is not a guaranteed full-document API. SRC-BRAIN-ARCS The current compose lifecycle deliberately assumes one local stack and fixed container names. SRC-BRAIN-CLI Running a personal brain on a personal computer and a swarm brain on Anton does not inherently require two stacks on one host. Running two brains on the same host requires instance-safe naming and lifecycle changes. Kubernetes namespaces alone do not isolate shared external databases, shared credentials, or a common vault path. The extraction path must consume normalized session evidence rather than add another provider-specific parser. SRC-BRAIN-EXTRACT

2.4 herdr and Kubernetes boundary

herdr can present remote servers in one client, but its server, pane, workspace, and agent identifiers are server-scoped. SRC-HERDR-MACHINES The documented remote path is SSH; Kubernetes Pod discovery is an integration we must implement, not an existing herdr feature. SRC-HERDR-CLI A headless herdr server can own terminal processes without an attached TUI. SRC-HERDR-CLI A destroyed Pod or node still destroys its processes; persistence requires explicit recovery, not a terminal reconnect. SRC-K8S-LIFECYCLE Pending unschedulable Pods can drive node scaling only when a permitted node template can satisfy their constraints. SRC-K8S-AUTOSCALING The controller must create bounded pending execution attempts rather than wait indefinitely for already-existing free nodes.

3. Non-negotiable invariants

3.1 Runtime invariants

INV-R01: an operator-client disconnect must not terminate an execution attempt. INV-R02: a terminal transport failure is not sufficient evidence that an agent has died. INV-R03: a PID is meaningful only within its observed process namespace and execution incarnation. INV-R04: all remote pane operations must include an execution target; no failure may fall back to Local. INV-R05: one task generation has at most one admitted write owner. INV-R06: retries after an ambiguous spawn reconcile by immutable execution ID before creating anything else. INV-R07: a stale attempt cannot complete, release, checkpoint over, or merge on behalf of a newer generation. INV-R08: a worker must stop starting mutations when it cannot renew its execution authority. INV-R09: a worker must not receive cluster-admin credentials or all provider accounts. INV-R10: a Pod may be deleted only after identity and ownership are revalidated. INV-R11: a local swarm stays functional when distributed mode is disabled. INV-R12: scale-down protection is removed when work is safely drained; it must not pin idle capacity indefinitely.

3.2 Memory invariants

INV-M01: canonical transcript storage must not be a truncated Redis preview. INV-M02: normalized record identity must survive replay, provider duplication, and interrupted uploads. INV-M03: source offsets advance only past complete accepted records. INV-M04: successful archive acknowledgement means the acknowledged bytes are durably retrievable. INV-M05: semantic search returns stable references that can retrieve the supporting record range. INV-M06: embedding changes do not change the immutable identity of source evidence. INV-M07: deleting or restricting evidence must also invalidate searchable projections and cached context. INV-M08: original archive content and synthesized memory have visibly different trust classes. INV-M09: private personal sessions do not enter the swarm corpus merely because the same human owns both. INV-M10: re-reading injected memory is not new independent evidence for that memory.

3.3 Brain invariants

INV-B01: enforce brain and project authorization before retrieval and before graph expansion. INV-B02: unknown project attribution remains unknown; a basename guess is not a permission grant. INV-B03: every lesson, decision, signal, and arc retains provenance and an explicit scope. INV-B04: current task instructions outrank inferred operator intent. INV-B05: a context receipt proves retrieval and delivery, not comprehension by the model. INV-B06: an expired, mismatched, or forged receipt cannot satisfy a consultation gate. INV-B07: graph relationships have direction and meaning; do not collapse contradictory relations by an arbitrary numeric order. INV-B08: a superseded lesson remains inspectable as history but is not presented as current guidance without qualification. INV-B09: one brain’s lifecycle command must not stop or delete another brain. INV-B10: fleet warnings are delivered only to the fleet that the caller is authorized to read. INV-B11: a context pack is bounded and identifies omissions and stale evidence. INV-B12: agents can explicitly report that no useful new lesson was learned.

4. Execution model and lifecycle

4.1 Unit of execution

Use a controller-owned Pod with restartPolicy: Never as the default distributed execution attempt. Do not use a fixed worker pool as the initial scaling mechanism. Do not require a StatefulSet per coding agent. The controller is responsible for recreation after a classified failure. An automatic container restart must not accidentally create a second unrecorded conversation. Use one main process supervisor to own the headless herdr server, session exporter, and main agent lifecycle. Sub-agents remain child execution activity within the admitted attempt unless explicitly scheduled as separate swarm tasks. CPU, memory, ephemeral-storage, and process budgets apply to all child processes, not only the top-level CLI. An idle interactive CLI is not necessarily a completed swarm task. The task reaches terminal state through the ledger outcome protocol, not by parsing an idle terminal prompt alone. A completed attempt can retain a short operator-inspection window before cleanup. The inspection window must have a configured maximum and a visible cost consequence.

4.2 State machine

planned -> reserving -> pending -> starting -> working
working -> waiting_input -> working
working -> waiting_quota -> working
working -> draining -> checkpointing -> stopped
working -> completed -> cleanup_pending -> removed
working -> suspect -> recovered_observation -> working
suspect -> lost -> recovery_pending -> restoring -> working
any nonterminal state -> failed or cancelled, subject to ownership checks

planned has no externally running agent. reserving owns a bounded task/account reservation but has not yet submitted the runtime object. pending names a concrete execution object or an idempotent create intent awaiting reconciliation. starting means a Pod has started but its main CLI has not completed the runtime handshake. working means the worker has a valid lease and a confirmed main-agent identity. waiting_input must preserve the lease and expose the operator question through the ledger. waiting_quota must not consume another account silently; account migration remains explicit policy. suspect is an observation state and does not authorize another writer immediately. lost requires the configured failure proof, fencing of the old generation, and an audit record. restoring names a new execution generation and the checkpoint it is consuming. completed records durable task outcome and evidence before transient Pod cleanup. removed means runtime resources are absent, not that task history was deleted.

4.3 Claims and fencing

Keep the existing task identity and augment it with a monotonic execution generation. Store the holder, generation, lease expiry, controller epoch, and execution ID together. Use atomic server-side compare-and-update for claim renewals, releases, and terminal outcomes. A generation increments when ownership changes, not on every heartbeat. Use server time for lease comparisons; do not trust worker clock agreement. The registry must distinguish controller leadership from task ownership. A leadership lock alone does not fence an old worker with a cached command. Commands carry expected generation and expiry and are rejected outside that authority. A short network outage moves observations to degraded or suspect, not automatically to replacement. The selected partition policy is fail-closed for new mutations, while local read-only inspection remains possible. Long-running external commands may already be in flight when authority expires; document this residual risk explicitly. Final shared-branch mutation and PR merge must occur through the controller’s validated outcome path. Worker Git credentials should not have permission to bypass protected integration-branch controls. Do not claim exactly-once execution of arbitrary external side effects. Use idempotency keys, provider-native operation IDs, protected-branch checks, and compensation where available.

4.4 Controller shape

One active controller on non-Spot Anton infrastructure is the baseline. A standby is optional after the single-controller recovery path has been proven. The controller may run inside a long-lived StatefulSet with durable state, using established antoncore conventions. A leader uses a renewable lease and records a controller epoch for each accepted command. Separate reconcile polling from long-running spawn operations so one slow CLI does not stall every swarm. Bound simultaneous pending Pods globally and per swarm. Bound accepted spawn intents so API timeouts cannot cause unbounded queue growth. Persist intent before dispatch and reconcile observed Pods by label plus immutable identity. A Kubernetes watch is an optimization; relist after watch expiry and reconcile from authoritative state. No worker runs the fleet-wide timer or elects itself as the swarm master. The existing master agent remains a logical seat with a separate agent lifecycle.

5. herdr integration and one-window operations

5.1 Required experience

The operator opens one herdr client on Anton. The client can view the local execution server and the active remote worker servers. Closing the operator terminal must not send a fleet stop command. A command run in one pane must not accidentally act on another server’s identical pane ID. The ledger must expose runtime target, execution state, and attach action for every agent. Cached remote state must be marked stale rather than displayed as verified liveness. The worker image includes a pinned, capability-tested herdr build. Normal reconnects must not install software, replace a server, or terminate running panes.

5.2 Baseline transport decision

Use herdr’s documented SSH remote-machine integration for terminal aggregation. Provide an authenticated private SSH endpoint in each worker Pod, or a tightly scoped relay to that endpoint. The preferred baseline is a dedicated private service per active execution plus controller-maintained machine registration. The service selector must include the immutable execution ID, not only the swarm or agent display name. Run the operator client in a network location that can resolve the intended service names. If the Anton host cannot reach cluster DNS directly, use an explicit relay; do not invent routability. Do not publish worker SSH using a public LoadBalancer. Do not use the host’s root SSH daemon to grant a Pod access to the whole node. Use a dedicated operator-attach identity with host verification and tightly scoped keys or certificates. Generate per-execution host identity or sign it with a trusted short-lived host CA. Do not put a single permanent private SSH key into every copy of the image. Do not use StrictHostKeyChecking=no as the fleet solution. No SSH agent forwarding is required for worker Git access; workers receive their own scoped Git credentials. The implementation must prove noninteractive machine add against an already-running compatible server. If the pinned herdr build requires interactive setup, report the compatibility gap instead of editing its private catalog format blindly. A Kubernetes exec-based transport may be investigated as an alternative, but it is not the assumed supported herdr transport.

5.3 Command routing

Represent a runtime target as {backend, execution_id, generation, machine_profile_id, remote_session, pane_id}. Never use a bare pane ID as a fleet-unique key. The machine profile ID is an opaque value returned by herdr, not derived from its human label. Absolute worker paths are materialized inside the worker before a remote launch uses them. Local prompt-file paths cannot be passed to a remote server without transfer. Capture capability negotiation once per server incarnation and invalidate it after restart. Treat a command timeout as ambiguous until state reconciliation establishes its effect. Do not blindly repeat a remote pane creation, prompt delivery, or close command. Deletion removes the controller-owned herdr machine registration after the execution has ended. Removing a registration must not be mistaken for stopping the worker server. A terminal control action and a task cancellation remain separate auditable operations.

6. Worker image contract

6.1 Image responsibility

The worker image makes a Pod an execution environment; it does not join the host to k3s. Build the image from the agentihooks repository and deploy it from antoncore. Use a non-root runtime user and a fixed documented numeric UID/GID. Use an init process such as tini and an explicit supervisor with signal forwarding and child reaping. Install herdr, agentihooks, Claude CLI, and Codex CLI at build time. Retain Copilot parser compatibility without making Copilot installation mandatory for the first distributed milestone. Install Git, GitHub CLI, an SSH client/server as selected by the transport decision, curl, jq, ripgrep, procps, and archive tools. Install Python and uv, plus Node/npm where target CLIs or project toolchains require them. Add the minimum agreed test tools, such as pytest, ruff, and shellcheck. Use pinned versions or verified artifact digests and retain the build manifest. Do not resolve floating CLI versions on every worker startup. Do not install the brain’s database, tick stack, or model server in each worker. Build a base image plus optional derived toolchain images only when measured workloads require them. Keep a single default worker image for the normal engineering path. An image update applies to new attempts; do not restart all active agents merely because a new digest exists.

6.2 Configuration materialization

Install profile templates into an immutable image directory outside runtime $HOME. At startup, render the selected profile into the private execution home. Avoid a volume mount that hides preinstalled CLI configuration before materialization runs. Render hook paths to the container’s actual Python executable, not the developer workstation venv. Reuse target adapters for Claude and Codex native configuration formats. Do not hand-translate all settings through a Claude-only schema. Read secrets from mounted files or narrowly selected environment variables. Never bake OAuth tokens, GitHub installation tokens, provider account secrets, or personal dotfiles into image layers. A worker receives exactly the provider account selected for its launch plus the services it is authorized to use. The launch manifest records a nonsecret account identifier, never its token value. Network-facing brain and ledger endpoints are resolved from deployment configuration. The bootstrap validates required inputs before creating a terminal pane. A startup failure must appear as a classified worker error, not as an apparently healthy idle shell.

6.3 Process supervision

The supervisor owns the main herdr process and monitors the agent handshake. The exporter must flush periodically, not only on final shutdown. A readiness probe reports bootstrap and local protocol readiness. A liveness probe detects a stuck supervisor without killing healthy agents because the external brain is temporarily unavailable. Do not use an external dependency outage as a liveness restart trigger for every worker. Use startup probes to accommodate cold image/config initialization without disabling liveness permanently. Handle SIGTERM by entering drain mode, refusing new work, quiescing mutations, and capturing a bounded checkpoint. After the grace period, report incomplete recovery material rather than declaring a complete checkpoint. The supervisor must reap grandchildren and terminate the execution’s own process tree without touching unrelated processes. Avoid privileged Pods and host PID namespaces. Do not mount the host Docker socket. Use the existing remote BuildKit path, with scoped mutual TLS, when a task needs image builds. Browser tests receive their own memory and shared-memory budget within the attempt.

7. Kubernetes and AWS integration

7.1 Preserve the existing infrastructure

Keep the current k3s control plane and private networking model. Keep the EC2 golden AMI as the host bootstrap artifact. Preserve the special warm-pool boot/join state machine. Preserve the AWS provider identity format on EC2 nodes and existing on-prem identities. Preserve the autoscaler’s ownership of desired capacity. Preserve equal-shape instance overrides inside each ASG. Preserve the existing node-termination handling until a tested replacement is approved. Do not turn on capacity rebalance or change ASG lifecycle behavior as an incidental swarm change. Do not hardcode the current burst ceilings into the agentihooks package. Read deployment bounds and operator budgets through configuration. The controller must be able to admit fewer agents than cluster capacity permits.

7.2 Admission and resource classes

Separate an execution resource profile from the capacity policy that determines eligible pools. Resource profiles define CPU, memory, ephemeral storage, child-process limits, and optional browser/build characteristics. Capacity policies define allowed on-prem nodes, on-demand nodes, Spot nodes, and excluded workloads. The initial general profile is an experiment, not a measurement of real agent consumption. Benchmark CLI overhead together with tests, compilers, browsers, and child processes. Use requests that fit measured expected occupancy and limits that bound bursts. Do not equate a memory request with guaranteed safe peak use when many colocated agents burst simultaneously. A memory profile must fail admission when no allowed node template can satisfy it. Do not leave impossible Pods Pending forever to manufacture a false scale-up signal. A CPU-heavy profile may use the research pool only after an explicit antoncore policy change and capacity review. The default swarm must not tolerate every workload taint with Exists. Use exact tolerations for the admitted capacity class. Exclude control-plane nodes with required affinity for execution Pods. Avoid preempting live trading or other critical workloads; use conservative priority and namespace quotas.

7.3 Illustrative resource experiments

Proposed profile	CPU request	Memory request	Initial purpose	Promotion condition
general	1	2Gi	Normal CLI plus moderate tests	Measured p95 fits with headroom
heavy	2	6Gi	Larger test and browser tasks	No sustained pressure in coexistence test
cpu	6	8Gi	Explicit compute-bound work	Eligible template and operator pool grant exist
memory	Configured	Configured	Work that does not fit general memory	A fitting approved pool is proven

These numbers are starting experiments, not capacity guarantees or production defaults. Memory and CPU limits must be selected from measurements rather than copied mechanically from requests. Use explicit ephemeral-storage requests for clone, cache, artifact, and image-build usage. Account for DaemonSet overhead and kube-reserved capacity before computing expected packing. A task whose request exceeds all node templates receives an actionable admission error.

7.4 Autoscaling mechanics

The controller creates a bounded number of concrete pending attempts for eligible work. Kubernetes determines whether those attempts can be scheduled. The existing autoscaler adds an eligible node only when its simulated template can satisfy pending constraints. Do not wait for available node slots before creating every pending Pod; that prevents scale-from-zero. Do not create unlimited pending Pods simply because the task ledger is large. Set per-swarm, global, account, and budget caps before dispatch. A request for Spot preference does not imply that the next new node will be Spot. For a Spot-only experiment, require the Spot capacity label and the exact approved tolerations. For on-demand fallback, define an explicit operator policy and budget rather than silently altering global expander priorities. Scaling agents and scaling nodes are different measurements and require different dashboards.

7.5 Drain and interruption

Use the existing termination notice handler as the node-level trigger. A voluntary drain should request worker quiescence before Pod deletion. A Spot notice has a bounded interruption window and may be absent in abrupt failure. Do not promise that a configured long Pod grace period extends an EC2 interruption deadline. Checkpoint periodically so recovery does not depend solely on the final notice. Set a short explicit emergency checkpoint budget that leaves time for durable acknowledgement. Remove idle workers rather than relying on a permanently false safe-to-evict annotation. An active task may be protected from ordinary autoscaler eviction while its safe checkpoint protocol matures. That protection does not protect against Spot interruption, node failure, administrator force deletion, or hardware loss. Drained attempts release their account reservation only after ownership and terminal state are reconciled.

8. Filesystem and durability

8.1 Shared configuration is not a shared writable home

Each attempt has a private $HOME and private runtime directories for CLI databases, locks, sockets, and histories. Do not share a single writable .codex, .claude, or herdr state directory across independent Pods. A shared read-only configuration seed is acceptable. A shared artifact or checkpoint backend is acceptable. Per-execution durable subdirectories on a tested shared filesystem are acceptable where locality and failure requirements allow them. The prohibition is shared mutable runtime identity, not all use of NFS. On-prem storage remains useful for artifact archives, checkpoint repositories, repository mirrors, and backups. The WAN path to that storage must be measured before placing cloud workers’ active Git I/O on it. Keep active checkouts and worktrees on worker-local storage by default. Use Git to exchange committed source and an artifact backend to preserve uncommitted recovery material. Git is not a backup for unstaged or untracked changes.

8.2 Recovery materials

A recovery manifest names the project identity, agent seat, execution generation, harness, conversation identifier, and image/tool versions. It identifies the Git base commit, working branch, latest pushed commit, staged diff, unstaged diff, and retained untracked files. It identifies the conversation artifacts required by the specific CLI resume contract. It includes the normalized transcript archive watermark separately from native resume artifacts. It includes content hashes, byte sizes, artifact backend keys, schema versions, and capture timestamps. It records exclusions such as dependency caches and generated build directories. It never includes authentication tokens or SSH private keys. Read a native database through a supported backup mechanism or after a controlled quiesce; do not copy an actively changing database blindly. Do not present a live file-copy race as a consistent process checkpoint. A normalized transcript is evidence for context reconstruction, not automatically a provider-native resumable session. A restore result must distinguish native resume, context-based continuation, and fresh restart. The controller must preserve the existing operator/master decision point when native resume is unavailable.

8.3 Atomic publication

Upload checkpoint objects under a new immutable checkpoint ID. Verify checksums before publishing the committed manifest. Use a final manifest publication as the checkpoint’s commit point. Do not update the latest-checkpoint pointer until that manifest is readable. A pointer update uses the expected task generation and prior pointer revision. A stale worker cannot replace a newer checkpoint pointer. Retention does not delete objects referenced by an active restore. A restore acquires a short read lease on its checkpoint manifest and releases it after validation. An incomplete checkpoint may remain for diagnostics but cannot satisfy the recoverable condition. Encrypt stored artifacts and control access by execution/project scope.

9. Canonical session memory in agentihooks

9.1 Scope

The session memory bank answers what happened in earlier work. The brain answers which supported knowledge is useful now and how it is connected. The memory bank must remain usable when brain inference is disabled. The brain must be able to consume normalized evidence without importing agentihooks’ operational controller modules. Use a versioned transport schema and a small normalization library boundary. Avoid an import cycle between the two repositories. Do not put synchronous embedding calls in every hook invocation. The hook records a small durable event or signals the exporter; expensive indexing happens outside the tool-execution critical path. One exporter per worker attempt is sufficient for the initial one-agent-per-Pod model. A local exporter can cover local sessions through the same ingestion contract.

9.2 Reuse boundary

agentibridge is fully deprecated as a deployed product; it may be inspected only to extract useful transcript turn-chunking, pgvector schema, and semantic-search logic. Do not retain its dispatcher, agent registry, daemon installer, OAuth server, or separate fleet lifecycle. Before extraction, inventory consumers and retain compatibility aliases only inside the replacement agentihooks surface. Time-limit any compatibility aliases and test that they use the replacement storage rather than the retired service. Preserve attribution and license notices for extracted code. Do not copy its truncated preview store as the canonical corpus. Do not copy a tailing algorithm that discards the first complete appended line after seeking to an already complete checkpoint offset. Do not copy a pipeline that re-embeds every earlier turn whenever a session grows. Do not copy project filtering implemented solely as a substring match. Do not retain session-only result deduplication as the only search mode; callers need relevant chunks and surrounding ranges.

9.3 Canonical record contract

Use a namespaced session key that includes corpus or brain scope, source installation, harness, and native session identifier. Use an execution ID when a native session is resumed into a different worker incarnation. Store human-visible agent names as attributes, never as the sole uniqueness key. Every accepted event has a stable source event ID or a deterministic identity derived from source generation and byte range. Preserve original event time, ingestion time, record kind, and source ordering. Separate user instructions, assistant narrative, tool calls, tool results, summaries, and injected context. Mark injected memory as derived context so it is not repeatedly promoted as new user intent. Record parent-session relationships for sub-agents when available. Retain provenance for material imported from older machines. Normalize metadata changes over time; a session can change working directory or task without rewriting its entire past. Historical queries need the project and task context that applied to the event, not only the session’s latest metadata.

9.4 Incremental ingestion

Tail files using a byte-safe boundary and carry incomplete trailing bytes to the next read. Checkpoint only complete records accepted by durable ingestion. Handle file rotation, truncation, replacement, Unicode boundaries, and duplicate reads explicitly. An inode alone is not a portable source identity. An offset alone is not valid after a source file is replaced. Record source generation and file fingerprint with the offset. Deduplicate retries server-side using a unique event key. Acknowledgement returns a durable watermark and accepted event IDs or a contiguous range. An unavailable destination leaves events in a bounded local spool. A full spool triggers an explicit degraded state and configured backpressure; do not silently drop records. Ephemeral workers cannot promise zero loss during an abrupt death before upload; report the actual durable watermark. At-least-once delivery with deduplication is the selected model.

9.5 Search and evidence retrieval

Store full normalized content in a durable archive or document table with an independently verifiable source reference. Store search previews as separate projections. Chunk at conversational or tool-result boundaries, with bounded token sizes and overlap where necessary. Assign chunk IDs from source ranges and versioned chunking policy, not their current list position. Embed only new or changed chunks. Keep embedding model identity, dimension, and index generation with vectors. Changing models requires an explicit index generation and controlled reindex, not silent vector mixing. Support exact scope, project, harness, task, swarm, time, and provenance filters. Support semantic retrieval and lexical/exact retrieval; code symbols and error strings must not depend solely on semantic similarity. Return score components as ranking signals, not calibrated truth probabilities. Return stable event ranges and a tool to expand surrounding context. Use authorization constraints inside the query, not only after top-N retrieval. Document approximate-search recall limits under restrictive filters and test scoped retrieval quality. A deleted session must disappear from search and direct retrieval according to the same retention contract.

10. Brain project awareness and active retrieval

10.1 Complete issue 89 end to end

Normalize project identity at the source before extraction groups sessions. Carry project, canonical remote identity, working directory, worktree, branch, source session, and harness into arc provenance. Use a stable canonical project ID that does not collide for equal basenames in different owners or forges. Keep alias mappings for renamed repositories without merging unrelated projects. A non-Git project may use an explicitly registered project ID. Do not infer a private project permission from a directory name. Persist marker scope and provenance on lessons, decisions, milestones, and signals. Represent multi-project arcs explicitly rather than overwriting one source project’s identity on merge. Index individual lessons with their own identities rather than only indexing the first portion of a daily log. Provide exact project filtering in embeddings, knowledge search, and arc search. Implement project feeds by ranking within a project, not filtering the fleet’s hot set afterward. Infer project intent independently for active projects and retain an unscoped fallback only for authorized unscoped sessions. Explicit ledger task and operator instructions remain more authoritative than inferred intent. Consume Claude and Codex normalized sessions through the same extraction interface. Keep current client-side ProjectMemorySource integration compatible until the new kernel-backed source is proven.

10.2 Graph retrieval

Treat arcs, lessons, decisions, and source sessions as addressable entities with stable IDs. Store edges with source, target, relation, provenance, status, and revision. Validate both endpoints before accepting an edge. Disallow self-links where the relation makes them meaningless. Represent inverse relations consistently rather than persisting contradictory parent and child assertions. Do not treat supersedes as a symmetric similarity boost. A supersession edge affects which guidance is current; the direction must be explicit. Allow multiple legitimate relation types between a pair when the schema permits them. Reject or quarantine semantic contradictions instead of resolving them by a universal priority list. Keep AI-suggested edges distinguishable from verified or operator-approved relationships. Require supporting evidence for a causal relation such as unblocks. Use bounded breadth and depth with a visited set to prevent cycles and high-degree explosions. Begin with semantic or lexical seed retrieval inside the authorized project scope. Expand one hop by default; permit a second hop within a strict node and token budget. Cross-project expansion requires an explicit allowed-project set and an eligible shared relation. Personal-brain material is never a fallback for swarm retrieval without an explicit grant. Return why each neighbor was included, including its relation and source evidence. Read attached lessons and decisions as first-class items rather than hoping their prose appears in an arc preview.

10.3 Full-detail retrieval

Add a full arc document endpoint with pagination or section selection. Return a document revision and content hash with every full-detail response. Keep previews clearly labelled previews. Allow a caller to retrieve the exact lessons, decision history, edges, and source ranges supporting a context item. Do not infer missing edge metadata from a 2,000-character preview. Update mutable ranking metadata without generating a new semantic embedding when content has not changed. Treat heat as a recency/activation feature, not a requirement for historical relevance. A cold but highly relevant incident lesson must remain retrievable.

10.4 Targeted context packs

Add a proposed POST /v2/context endpoint; retain the existing feed as a compatibility surface. Accept task revision, project, role/lane, brain binding, intent, recent relevant errors, and a bounded query. Derive trusted identity from credentials and launch state, not arbitrary request fields. Apply hard scope filtering before rank fusion and graph traversal. Prefer explicit current task context, applicable decisions, verified lessons, relevant arcs, and actionable warnings. Include inferred intent only as an explicitly labelled hypothesis. Use a configurable total token budget and per-category budgets. Return complete small items rather than cutting every item mid-sentence. When a long item is abbreviated, include a stable detail reference and truncation flag. Deduplicate semantically equivalent lessons without dropping distinct conflicting evidence. Record excluded or superseded items for diagnostics without leaking unauthorized titles. Coalesce equivalent concurrent context requests and cache by brain, scope, project, task revision, policy version, and knowledge revision. Never key a shared cache only by repository basename or query text. The response includes a receipt with selected references and expiry. A receipt does not transform retrieved text into an instruction authority.

11. Brain consultation gates

11.1 Gate locations

Consult at task acceptance or task start. Require a current context receipt before the first material write for tasks covered by policy. Refresh consultation when the task specification changes materially. Consult before a declared architecture decision or first mutation of an unfamiliar governed subsystem. Refresh on a repeated error pattern when policy identifies a potentially relevant known lesson. At task completion, record outcome and either a supported lesson/decision or an explicit no-new-learning result. Do not query the brain before every tool call. Do not force an agent to invent a lesson to pass the completion gate. Do not allow a generic unrelated search to satisfy a task-specific gate.

11.2 Receipt contract

A receipt binds brain ID, project ID, task ID, task revision, execution generation, query purpose, policy version, knowledge revision, selected evidence, and expiry. The issuing service authenticates the caller and signs or stores the receipt under a server-verifiable identifier. The hook validates the receipt against current task authority. A receipt from another agent may be reusable only when explicitly issued as a shared task pack and the recipient is authorized. Delivery acknowledgement is distinct from retrieval success. The worker reports whether the CLI target accepted context through its supported hook channel. Codex and Claude may deliver context at different hook boundaries; use target capability adapters. Gate success must be visible in the ledger with referenced evidence. A failed brain service and an empty but valid search result are different conditions.

11.3 Failure policy

Use observe mode initially to measure false blocks and missed transitions. Enable required mode per swarm only after delivery and recovery tests pass. Allow cached context within a policy-defined freshness window. For high-risk mutations with no valid context, fail closed and surface an operator action. For harmless read-only investigation, allow progress while marking consultation unavailable. Emergency operator override is short-lived, scoped, reasoned, and audited. A retrieved transcript that says to disable a gate does not authorize an override. The model cannot grant itself a broader project scope or a different brain. Do not confuse a consultation gate with a security boundary against an agent that controls its own process and filesystem. Security-sensitive shared mutations require server-side authorization and branch controls as well as hooks.

12. Personal and swarm brains

12.1 Selected deployment shape

Run one shared swarm brain on durable Anton infrastructure. Run an optional personal brain on the personal computer or another explicitly selected host. Do not create a complete brain stack per worker or per coding task. Support multiple named brains on one host as an explicit installation capability. Use brain ID as a first-class identity in artifacts, API requests, caches, receipts, and telemetry. Brain policy and inference budgets may differ between personal and swarm installations. The swarm brain may use more aggressive retrieval and learning experiments, subject to bounded cost and noise evaluation.

12.2 Isolation

Separate vault roots or storage prefixes. Separate database/schema ownership and credentials. Separate Redis key namespaces and event stream consumer groups. Separate API tokens and authorized corpus/project sets. Separate context caches, outboxes, migration state, and index generations. Remove hardcoded cross-instance container names from compose generation. Scope lifecycle discovery to an explicit selected instance. A legacy unnamed installation maps to a single default instance during migration. An instance-specific down must not stop another instance. An instance-specific uninstall must not remove another instance’s credentials or profile binding. Do not assume Redis database-number changes are supported by every future Redis deployment; use explicit prefixes and documented backend capabilities. Kubernetes namespace separation must be accompanied by external-store isolation tests.

12.3 Deterministic routing

An explicit operator/session brain binding takes precedence when authorized. A swarm launch binds to the configured swarm brain and cannot silently fall back to personal memory. A normal local project uses its configured personal/default brain. A repository may propose a brain route, but a local untrusted file must not redirect credentials to an arbitrary endpoint. Validate route destinations against an operator-managed allowlist. Keep endpoint authentication bound to its intended origin. A missing route produces a clear configuration error or an explicitly disabled-brain state. Cross-brain reference queries are a later controlled feature, not the default fallback. Moving a session between brains requires an explicit import/export decision with provenance and retention consequences.

13. API and storage contracts

13.1 Versioning rules

All proposed network contracts below use a schema_version field. Use additive compatibility for optional fields within a major schema version. Reject incompatible major versions before launching work or committing evidence. Unknown optional fields may be ignored only where the schema explicitly permits extension. Unknown authority, scope, or generation fields must not be silently discarded. Write compatibility tests for one supported preceding version. Persist the version used to serialize checkpoints and session manifests. A migration runs in dry-run mode before it writes any historical data. Maintain a manifest of supported image, controller, hook, and brain protocol combinations.

13.2 Proposed controller endpoints

Endpoint	Purpose	Authority
`POST /v2/executions/register`	Confirm launched worker identity	One-time launch grant
`PUT /v2/executions/{id}/heartbeat`	Renew observed liveness and lease	Bound execution credential
`POST /v2/executions/{id}/credential`	Renew worker execution credential	Bound execution credential
`POST /v2/executions/{id}/outcomes`	Propose task outcome	Current generation only
`POST /v2/executions/{id}/checkpoints`	Commit checkpoint manifest	Current generation only
`GET /v2/executions/{id}/commands`	Receive bounded runtime commands	Bound execution credential
`POST /v2/executions/{id}/commands/{command}/ack`	Record command result	Bound execution credential
`POST /v2/sessions/ingest`	Append durable normalized records	Corpus/project grant
`POST /v2/sessions/search`	Retrieve authorized evidence	Read grant
`GET /v2/sessions/{id}/records`	Expand a record range	Read grant
`GET /v2/sessions/changes`	Incremental brain extraction cursor	Authorized extraction principal

The controller and session APIs may be served by separate processes from the same package. Do not make transcript ingestion wait for a Kubernetes API call. Do not let worker endpoints change global caps, image policy, brain routing, or secret definitions. Command IDs provide deduplication; acknowledgements contain both acceptance and completion state. A polling transport is acceptable initially; adding streaming must preserve replay and acknowledgement semantics.

13.3 Proposed brain endpoints

Endpoint	Purpose	Compatibility
`GET /feed?project=...`	Complete issue 89 project feed	Existing feed remains supported
`POST /v2/context`	Task-specific bounded context pack	New explicit contract
`POST /v2/context/{receipt}/delivery`	Report accepted delivery	New explicit contract
`POST /v2/markers`	Persist scoped idempotent knowledge events	Adapt legacy marker writes
`POST /v2/arcs/search`	Filtered seed and graph retrieval	Adapt existing MCP tools
`GET /v2/arcs/{id}`	Full or section-based arc retrieval	Previews remain labelled
`GET /v2/knowledge/{id}/provenance`	Retrieve supporting evidence references	New explicit contract
`GET /v2/instances/self`	Verify brain identity and policy revision	New explicit contract

13.4 Error classes

invalid_request means schema or field validation failed before state mutation. unauthenticated means the principal could not be established. forbidden_scope means the principal lacks the requested brain/project/corpus permission. stale_generation means the attempt no longer owns the write authority. revision_conflict means the caller used an outdated task or document revision. dependency_unavailable means a required service failed; the response identifies retry safety. capacity_unsatisfiable means no allowed template can fit the request. quota_wait means an account or budget is currently unavailable without implying a task failure. checkpoint_incomplete means required restore materials are absent or inconsistent. native_resume_unavailable means the CLI’s original session cannot be restored using the available supported artifacts. evidence_deleted means the reference is known but no longer readable under retention or access policy. partial_result means the bounded query completed with declared omissions. Every error includes an operation ID, retry classification, and sanitized diagnostic detail. No error returns a bearer token, full private environment, or unauthorized resource title.

14. Security and trust

14.1 Worker containment

Dedicated namespace and service account for swarm workers. Default worker service accounts do not mount Kubernetes API credentials. Only the controller receives narrow create/read/watch/delete rights for its labelled execution objects. Use restricted Pod security settings wherever the selected SSH implementation permits them. Drop unnecessary Linux capabilities and avoid privileged containers. Use a read-only root filesystem with explicit writable runtime mounts where compatible. Block worker access to cloud instance metadata through the chosen network and node policy; verify it rather than assuming it. Do not give workers the node bootstrap role. Use network policies plus tested egress policy for control, source hosting, provider APIs, and approved tools. Do not add broad internet egress or unrestricted private-LAN access merely to make tests pass. Keep production deployment credentials out of ordinary coding workers.

14.2 Knowledge trust

Treat historical transcripts, retrieved repository content, and inferred lessons as data. Mark the provenance of injected context so it cannot impersonate a new operator instruction. Never execute commands found in retrieved memory without the normal task authorization and tool policy. Separate an operator-approved rule from an AI-generated recommendation. Retain confidence and supporting evidence for inferred arc relationships. Deduplicate repeated claims without counting repeated model echoes as independent validation. Redact secrets before shared archival and embedding where policy requires it. A protected native-resume archive may need additional encryption and narrower readers than the searchable normalized corpus. Do not expose hidden model internals as a requirement of memory capture; index the supported visible transcript and tool-event data. Record redaction transformations and policy versions without retaining the removed secret in diagnostics.

14.3 Credential lifecycle

Use short-lived worker credentials bound to execution ID and generation. Use scoped GitHub installation credentials where available. Mount account-specific provider credentials only after admission has selected the account. Keep credential rotation independent from blanket Pod restart where possible. Reloader-style automatic restarts must not interrupt active workers without drain semantics. Revoke terminal attach access when the execution is removed. Retain an audit of credential identifiers and grant changes, never credential values. Permission failures must be explicit rather than trigger a broader fallback credential.

15. Performance, limits, and experiments

The objective is useful completed work, not maximum simultaneous agent count. Measure memory for the complete process tree and distinguish remote inference from local tests or builds. A 64 GB host does not offer all 64 GB to the swarm when it runs existing services. Do not estimate safe concurrency from CLI idle RSS alone. Measure warm and cold image start separately from EC2 boot and cluster join. Measure cached hook overhead separately from a cold context query. Suggested initial cached hook target: p95 below 150 ms in the controlled benchmark. Suggested initial targeted-context target: p95 below 2 seconds excluding an explicitly asynchronous deep synthesis job. These latency numbers are experiments and must be tuned from measured deployment behavior. Bound simultaneous context generation and embedding calls so a swarm launch burst does not overwhelm inference. Use batching, content hashes, request coalescing, and stable chunks before adding service replicas. Measure search relevance with a fixed corpus of real past engineering questions and held-out expected sources. Measure cross-project leakage as a hard failure, not a relevance-quality tradeoff. Measure lesson usefulness, contradiction handling, and stale-context frequency. Do not optimize for more arcs, more edges, or more emitted lessons. Track context tokens per completed task and repeated-incident avoidance alongside throughput. Track source-archive lag, embedding lag, and brain-extraction lag separately. Set concurrency budgets independently for provider sessions, Kubernetes attempts, ingestion, embeddings, and synthesis.

16. Delivery sequence

16.1 Phase gates

Gate	Required result	Forbidden shortcut
G0	Refreshed baseline, contracts, isolated test fixtures	Editing production config while guessing
G1	Local runtime compatibility and global identity groundwork	Replacing the working swarm wholesale
G2	Worker image runs one local/container agent headlessly	Claiming portability from a Docker build alone
G3	One Kubernetes worker on approved non-Spot capacity	Scaling before authentication and fencing work
G4	Two-project Claude/Codex transcript archive and search	Treating previews as complete evidence
G5	Brain issue 89 complete with kernel-backed project feed	Filtering only the fleet’s top arcs
G6	Task context, graph retrieval, and consultation in observe mode	Enforcing untested gates
G7	Personal/swarm brain isolation and safe lifecycle	Shared database keys behind separate labels
G8	Checkpoint, native-resume qualification, and failure recovery	Assuming a saved conversation ID is sufficient
G9	Small Spot canary with measured durable watermarks	Promising process continuity after node death
G10	Bounded autoscaling and coexistence under real load	Using all declared ASG capacity automatically
G11	Replacement search cutover and old-service retirement	Removing the only copy of history
G12	Operator acceptance, rollback rehearsal, and published runbooks	Declaring done from unit tests only

16.2 Parallel work rules

Contracts and identity precede independent consumers. Image build and source-archive implementation may proceed in parallel after the relevant contract freezes. Brain graph work may proceed behind fixtures before live transcript ingestion is cut over. antoncore deployment wiring can be prepared early but must not deploy an incompatible image or protocol. The same agent must not edit shared contract files while another package assumes they are frozen. Use territory declarations and existing worktree conventions to prevent overlapping edits. Cross-repository changes carry a compatibility matrix and deployment order. A feature flag defaults off until its gate is satisfied. Do not merge an implementation that requires an unreleased peer schema without a compatible fallback or coordinated rollout.

16.3 Migration posture

Use additive schemas and a shadow read path first. Backfill from the best surviving source with a manifest of known losses. Verify hashes, counts, source ranges, and scope attribution before cutover. Never silently reconstruct missing original transcript content from a summary. Keep old archives read-only during the agreed validation interval. Do not keep a retired service alive merely to avoid adapting a small API client. Do not delete the old corpus until the operator has an independently verified backup and accepts the retention decision. Reversal must restore the previous routing/configuration without discarding newly captured evidence. Maintain an import/export path for the new corpus so rollback is not tied to a running old process.

17. Operator experience and observability

The ledger remains the primary operator-facing work surface. Show swarm, agent seat, lane, task, execution generation, runtime backend, node/pool class, and state. Show whether a terminal view is connected, stale, or unavailable separately from task state. Show provider quota wait separately from Kubernetes scheduling wait. Show latest durable transcript watermark and latest complete checkpoint. Show selected brain identity, context freshness, consultation receipt status, and evidence links. Show recovery type: same live process, native conversation resume, context continuation, or fresh start. Expose pause, drain, stop-now, attach, retry-restore, and approve-fresh as distinct controls. Do not label a restarted agent as resumed until the target harness confirms the expected session identity. Record controller decisions with sanitized structured logs and stable operation IDs. Use low-cardinality metrics for aggregate health; put individual session IDs in traces or logs rather than metric labels. Redact credentials and private transcript content from ordinary operational logs. Alert on lack of expected output as well as process health. Examples include growing ingestion lag, repeated stale-generation rejections, stalled checkpoints, and pending Pods with no eligible pool. Dashboard values must distinguish measured current capacity from configured maximum capacity. The operator should be able to inspect the reason for a brain context item without rereading an entire session.

18. Acceptance definition

The operator can close the personal computer and the swarm continues on Anton and approved remote capacity. The operator can close the Anton herdr client while worker processes continue under supervision. The operator can reconnect to active worker terminals from the same Anton client experience. A remote command never falls back to the local machine after a target failure. The local-only swarm still runs with distributed features disabled. Kubernetes pending work drives the existing autoscaler within configured bounds. No unrelated workload gains new tolerations or loses its existing capacity protection implicitly. A Spot loss produces a visible recovery decision with verified durable artifacts and no duplicate task writer. Claude and Codex sessions are searchable by exact project and retrievable by supporting record range. Project context differs between two unrelated repositories while approved shared warnings still reach both. Graph-expanded retrieval can recover a relevant prior lesson through an authorized arc connection. A superseded decision is shown as historical rather than current instruction. Brain consultation gates prove scoped retrieval/delivery and do not require fabricated learning. Personal and swarm brains do not leak data, share state accidentally, or stop one another during lifecycle operations. The retired transcript service is absent from the deployed target architecture. All three repository changes have tests, migration notes, operational evidence, and rollback instructions. The implementation issue is closed only after the master links the acceptance evidence, not merely after the plan is committed.

19. Workstream index and dependency interpretation

The work packages below are implementation contracts, not commands to run in the current chat. All paths marked (new) are proposed locations; verify the repository layout before choosing the final filename. A path that already exists should be extended behind its current compatibility seam rather than duplicated under a new implementation. Dependencies mean the named package’s interface and relevant evidence must be available before the consumer is integrated. Mocked consumer development can proceed before a dependency is live, but production enablement cannot. The workstream gate column is its integration target, not permission to skip earlier gates. A late integration task may require a later live qualification than the workstream’s first code-only task. The master must distinguish contract completion, code completion, and live rollout completion in the ledger. Do not create dependency cycles by requiring a producer’s final live rollout before its contract can be consumed in an isolated test. Any deviations from this dependency graph require a recorded architectural decision and updated affected tests.

Workstream	Repository	Integration target	Dependency workstreams	Purpose
FND	agentihooks	G0	None	Baseline, contracts, and implementation governance
IDN	agentihooks	G1	FND	Canonical project, session, and execution identity
RUN	agentihooks	G1	IDN	Runtime interface and local compatibility
CTL	agentihooks	G3	RUN	Controller reconciliation, task authority, and fencing
LDG	agentihooks	G3	CTL	Remote-safe ledger and worker control APIs
IMG	agentihooks	G2	RUN	Reproducible swarm worker image and bootstrap
KUB	agentihooks	G3	CTL, IMG, LDG	Kubernetes execution adapter and object lifecycle
HDR	agentihooks	G3	KUB	herdr remote aggregation and terminal identity
CAP	antoncore	G10	KUB	Capacity policy, ASG reuse, and coexistence
SEC	antoncore	G3	KUB, IDN	Scoped credentials and execution containment
FSY	agentihooks	G3	IMG, IDN	Private runtime homes, worktrees, and artifact locality
CKP	agentihooks	G8	FSY, CTL	Durable checkpoints and truthful recovery
ACC	agentihooks	G3	CTL, IDN	Fleet-wide sessions, quota reservations, and broadcasts
SES	agentihooks	G4	IDN, FSY	Provider-neutral incremental transcript capture
IDX	agentihooks	G4	SES	Durable session catalog, embeddings, and evidence search
MIG	agentihooks	G11	IDX	Extract useful search logic and retire the old transcript service
BRP	agentibrain-kernel	G5	IDN, SES	Kernel project scoping and issue 89 completion
GRF	agentibrain-kernel	G6	BRP	Typed knowledge graph and bounded associative retrieval
CTX	agentibrain-kernel	G6	GRF, IDX	Task-specific brain context selection and cache correctness
GAT	agentihooks	G6	CTX, LDG	Brain routing, delivery, and consultation gates
MUL	agentibrain-kernel	G7	BRP, IDN	Independent personal and swarm brain instances
ING	agentibrain-kernel	G6	BRP, IDX	Brain extraction from normalized evidence and safe learning
OBS	agentihooks	G10	KUB, CKP, IDX, GAT	Operational telemetry and trustworthy health
UX	agentihooks	G10	HDR, OBS	Ledger controls, evidence navigation, and operator continuity
VAL	agentihooks	G12	KUB, CKP, IDX, GAT, MUL	Cross-repository tests, chaos, and regression protection
GIT	antoncore	G12	SEC, IMG, KUB, GAT, MUL	antoncore GitOps deployment and staged integration
RET	agentihooks	G12	IDX, CKP, GRF	Retention, migrations, backups, and reversible state
OPS	antoncore	G12	GIT, OBS, RET	Operational runbooks and failure-response procedures
PRF	agentihooks	G10	OBS, IDX, GAT	Performance qualification and useful-memory evaluation
REL	agentihooks	G12	VAL, GIT, RET, OPS, PRF, MIG, CAP, ACC, ING, UX	Cross-repository release, acceptance, and final closure

20. Detailed implementation work packages

Workstream FND: Baseline, contracts, and implementation governance

Implementation owner: agentihooks. Integration target: G0. Mutation boundary: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation. Baseline references: SRC-AH-GUIDE SRC-ANTON-CA

SV2-FND-01: Capture implementation source and deployment baselines

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: Source refresh and isolated fixture preparation.
Integration gate: G0, subject to all earlier applicable acceptance gates.
Owned path candidates: docs/swarm-v2/baseline.md (new); tests/fixtures/swarm_v2/baseline/ (new).
Required fixture: Three repository refs plus one deliberately unavailable deployment endpoint.
Intended change: Establish which interfaces are source-proven and which deployment values still need read-only verification.

Implementation sequence

Resolve each dev head and record its commit independently.
Read active deployment image digests and resource names through authorized read-only commands.
Compare the actual deployment with the declared branch without treating either as interchangeable.
Sanitize addresses and credentials before committing the baseline report.

Boundary and interface obligations

Input preparation: construct the package fixture from three repository refs plus one deliberately unavailable deployment endpoint.
Output contract: A report separates source version, deployed version, and unknown live values for all three repositories.
Rejection contract: A missing cluster connection is recorded as unverified, never as an empty cluster or zero running agents.
Recovery contract: Re-running the baseline after one repository advances adds a drift entry without resetting any branch.
Mutation scope: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-FND-01-A.
Negative case: T-SV2-FND-01-B.
Recovery case: T-SV2-FND-01-C.
Package-specific measurements: baseline_unverified_items and baseline_drift_items.
Evidence record: evidence/SV2-FND-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Revert only the baseline document if attribution is wrong; retain original read-only evidence outside the source tree.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-FND-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-FND-02: Freeze package boundaries and architecture decisions

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-FND-01.
Integration gate: G0, subject to all earlier applicable acceptance gates.
Owned path candidates: docs/swarm-v2/decisions.md (new); docs/swarm-v2/architecture.json (new); scripts/swarm_v2/architecture.py (new); tests/test_swarm_v2_architecture.py (new); tests/fixtures/swarm_v2/architecture/ (new); evidence/SV2-FND-02/ (new); Swarm-v2.md.
Required fixture: A design inventory containing one duplicate task dispatcher and one legitimate embedding backlog.
Intended change: Prevent the implementation from recreating overlapping schedulers or embedding the entire brain stack in workers.

Implementation sequence

Record ownership of orchestration, source evidence, cognition, and infrastructure.
Approve controller-owned execution Pods as a targeted convention exception.
Specify the one-main-agent-per-Pod baseline and local compatibility path.
Record that deployment and source-archive services may be separate processes from the same package.

Boundary and interface obligations

Input preparation: construct the package fixture from a design inventory containing one duplicate task dispatcher and one legitimate embedding backlog.
Output contract: Every target component has one code owner, one state owner, and one deployment owner.
Rejection contract: A proposal that inserts another coding-task queue is rejected unless the operator explicitly changes the architecture.
Recovery contract: Conflicting design proposals are recorded as unresolved decisions while unrelated implementation continues.
Mutation scope: Documentation, fixtures, compatibility metadata, and the offline review command that reads and writes only the architecture record; no live infrastructure mutation.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-FND-02-A.
Negative case: T-SV2-FND-02-B.
Recovery case: T-SV2-FND-02-C.
Package-specific measurements: architecture_unowned_components.
Evidence record: evidence/SV2-FND-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore the last accepted architecture revision; do not erase the alternative and its rejection reason.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-FND-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-FND-03: Publish versioned transport contracts

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-FND-02.
Integration gate: G0, subject to all earlier applicable acceptance gates.
Owned path candidates: docs/swarm-v2/schemas/ (new; under docs so the mutation workspace copies it); tests/contracts/swarm_v2/ (new); scripts/swarm_v2/contracts.py (new, the in-repo admission check).
Required fixture: Current, previous-minor, future-major, and missing-authority fixture families.
Intended change: Define authority, compatibility, and error envelopes before producers and consumers diverge.

Implementation sequence

Create JSON schemas for launch, heartbeat, command, checkpoint, session event, context pack, and receipt.
Classify required authority fields separately from optional extension metadata.
Publish valid and invalid fixtures for the current and previous supported minor version.
Assign schema owners and forbid accidental import cycles between repositories.

Boundary and interface obligations

Input preparation: construct the package fixture from current, previous-minor, future-major, and missing-authority fixture families.
Output contract: A consumer validates all shared fixtures without importing the producer’s runtime package.
Rejection contract: An unknown major version or absent execution generation is refused before a state write.
Recovery contract: A compatible optional field added by a newer producer survives round-trip without breaking an older reader.
Mutation scope: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-FND-03-A.
Negative case: T-SV2-FND-03-B.
Recovery case: T-SV2-FND-03-C.
Package-specific measurements: contract_validation_failures_total.
Evidence record: evidence/SV2-FND-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep the previous schema version available and disable the new writer until all required consumers support it.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-FND-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-FND-04: Build the requirement-to-evidence registry

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-FND-03.
Integration gate: G0, subject to all earlier applicable acceptance gates.
Owned path candidates: docs/swarm-v2/evidence-index.md (new); scripts/swarm_v2/validate_plan.py (new).
Required fixture: One fully evidenced package and one package with only a deployment screenshot.
Intended change: Make completion auditable across repositories without using generated prose as proof.

Implementation sequence

Map invariants and acceptance gates to stable work-package IDs.
Require links to tests, pull requests, migrations, and live-canary evidence.
Validate that no completed package has missing dependency evidence.
Record failed experiments as evidence rather than deleting them.

Boundary and interface obligations

Input preparation: construct the package fixture from one fully evidenced package and one package with only a deployment screenshot.
Output contract: The validator identifies a claimed completed package lacking its required recovery proof.
Rejection contract: A screenshot of a healthy Pod alone cannot satisfy transcript durability or scope isolation acceptance.
Recovery contract: Restoring the evidence registry from a backup preserves stable IDs and links to existing pull requests.
Mutation scope: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-FND-04-A.
Negative case: T-SV2-FND-04-B.
Recovery case: T-SV2-FND-04-C.
Package-specific measurements: packages_missing_evidence.
Evidence record: evidence/SV2-FND-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Revert status projections without changing underlying test artifacts or accepted source commits.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-FND-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-FND-05: Prepare isolated development and test environments

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-FND-04.
Integration gate: G0, subject to all earlier applicable acceptance gates.
Owned path candidates: tests/conftest.py; tests/fixtures/swarm_v2/ (new); docs/swarm-v2/development.md (new).
Required fixture: Temporary Claude, Codex, brain, archive, Redis, and Kubernetes identities with deliberate path traps.
Intended change: Ensure swarm development cannot write the operator’s live homes, Redis keys, vault, or deployment.

Implementation sequence

Extend existing home isolation fixtures to new session and brain directories.
Prefix test Redis keys and give fixtures dedicated database/schema credentials.
Replace real Kubernetes and herdr mutations with deterministic fakes by default.
Document the repository’s canonical Python and independent lint/format checks.

Boundary and interface obligations

Input preparation: construct the package fixture from temporary Claude, Codex, brain, archive, Redis, and Kubernetes identities with deliberate path traps.
Output contract: Running unit and contract suites creates no files under a real configured agent home or vault.
Rejection contract: A test whose resolved root escapes the temporary fixture directory aborts immediately.
Recovery contract: An interrupted test run can be rerun without consuming stale production-named locks.
Mutation scope: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-FND-05-A.
Negative case: T-SV2-FND-05-B.
Recovery case: T-SV2-FND-05-C.
Package-specific measurements: test_live_path_rejections_total.
Evidence record: evidence/SV2-FND-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Remove only fixture-owned resources after validating their test-run identity.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-FND-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream IDN: Canonical project, session, and execution identity

Implementation owner: agentihooks. Integration target: G1. Mutation boundary: Identity resolution and metadata only; a computed label never grants authorization. Baseline references: SRC-AH-IDENTITY

SV2-IDN-01: Create canonical cross-machine project IDs

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-FND-05.
Integration gate: G1, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/context/project_identity.py; docs/swarm-v2/schemas/project.json (new).
Required fixture: Two owners with repository name common, one worktree, one nested directory, and one renamed remote.
Intended change: Extend the existing resolver without regressing checkout and worktree equivalence.

Implementation sequence

Normalize forge host, repository owner, and repository name from verified Git remotes.
Preserve explicit registered IDs for non-Git projects.
Treat local paths and basenames as provenance rather than globally unique identity.
Keep a versioned alias map for repository renames.

Boundary and interface obligations

Input preparation: construct the package fixture from two owners with repository name common, one worktree, one nested directory, and one renamed remote.
Output contract: A checkout, a linked worktree, and a nested directory resolve to one canonical project while equal basenames under different owners remain separate.
Rejection contract: A remote containing credentials or an unsupported ambiguous URL is sanitized or refused rather than stored verbatim.
Recovery contract: A project rename preserves historical evidence through an explicit alias without merging unrelated repositories.
Mutation scope: Identity resolution and metadata only; a computed label never grants authorization.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-IDN-01-A.
Negative case: T-SV2-IDN-01-B.
Recovery case: T-SV2-IDN-01-C.
Package-specific measurements: project_identity_ambiguities_total.
Evidence record: evidence/SV2-IDN-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Continue reading the prior identity fields while new canonical IDs remain additive.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-IDN-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-IDN-02: Separate logical agents from execution attempts

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-IDN-01.
Integration gate: G1, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm/store.py; docs/swarm-v2/schemas/execution.json (new).
Required fixture: One seat with three sequential attempts and two Pods sharing a human display label.
Intended change: Keep seat continuity while giving every replacement process an immutable execution incarnation.

Implementation sequence

Add execution_id, generation, runtime backend, and runtime target to agent records.
Retain the canonical agent name and seat memory independently of Pod UID.
Persist old attempt history instead of overwriting it on restart.
Resolve names only through the existing naming module.

Boundary and interface obligations

Input preparation: construct the package fixture from one seat with three sequential attempts and two Pods sharing a human display label.
Output contract: Replacing a lost Pod creates a new execution ID and generation while preserving the intended seat and task lineage.
Rejection contract: Reusing a stale Pod UID or treating the display name as unique attempt identity is refused.
Recovery contract: A controller restart reconstructs logical seat occupancy from persisted attempt history.
Mutation scope: Identity resolution and metadata only; a computed label never grants authorization.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-IDN-02-A.
Negative case: T-SV2-IDN-02-B.
Recovery case: T-SV2-IDN-02-C.
Package-specific measurements: execution_identity_conflicts_total.
Evidence record: evidence/SV2-IDN-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep old record readers compatible and stop distributed launches before rolling the writer back.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-IDN-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-IDN-03: Capture event-time task and repository context

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-IDN-02.
Integration gate: G1, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/context/project_sessions.py; hooks/targets/normalizer.py; docs/swarm-v2/schemas/session-event.json (new).
Required fixture: A transcript with two task changes, one worktree switch, and an explicitly shared warning.
Intended change: Preserve what a session was doing at each point rather than attributing all history to its latest working directory.

Implementation sequence

Record scope changes as ordered metadata events.
Include task revision, swarm, lane, branch, worktree, and canonical project where known.
Preserve explicit marker identity when it is valid under the session grant.
Differentiate unknown attribution from intentionally fleet-wide material.

Boundary and interface obligations

Input preparation: construct the package fixture from a transcript with two task changes, one worktree switch, and an explicitly shared warning.
Output contract: A session that changes task halfway through has correctly scoped historical events on both sides of the transition.
Rejection contract: A worker-supplied project outside its signed launch grant is rejected even when the folder exists locally.
Recovery contract: Replay of metadata transitions reconstructs the same event-time attribution without duplicate session entries.
Mutation scope: Identity resolution and metadata only; a computed label never grants authorization.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-IDN-03-A.
Negative case: T-SV2-IDN-03-B.
Recovery case: T-SV2-IDN-03-C.
Package-specific measurements: unattributed_session_events_total.
Evidence record: evidence/SV2-IDN-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Retain original raw metadata and disable new projections rather than rewriting history to a default project.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-IDN-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-IDN-04: Bind identity to authenticated launch authority

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-IDN-03.
Integration gate: G1, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/auth_context.py (new); docs/swarm-v2/schemas/launch-grant.json (new).
Required fixture: Valid grant, expired grant, wrong audience, mismatched generation, and altered project body.
Intended change: Prevent an agent from impersonating another project, task, account, or brain through request parameters.

Implementation sequence

Issue a short-lived launch grant from admitted controller state.
Bind grant subject to execution ID, generation, allowed project set, and selected brain.
Validate the grant on registration before trusting worker metadata.
Record nonsecret issuer and audience identifiers for audit.

Boundary and interface obligations

Input preparation: construct the package fixture from valid grant, expired grant, wrong audience, mismatched generation, and altered project body.
Output contract: A correctly launched worker registers only its own execution and authorized corpus.
Rejection contract: Changing a body field to another task or brain fails authorization before any registry write.
Recovery contract: A retried registration with the same valid grant returns the original identity without creating another worker.
Mutation scope: Identity resolution and metadata only; a computed label never grants authorization.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-IDN-04-A.
Negative case: T-SV2-IDN-04-B.
Recovery case: T-SV2-IDN-04-C.
Package-specific measurements: launch_grant_rejections_total.
Evidence record: evidence/SV2-IDN-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Revoke outstanding grants for the disabled protocol and keep historical execution records read-only.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-IDN-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-IDN-05: Namespace every cache and deduplication key

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-IDN-04.
Integration gate: G1, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/context/project_cache.py; hooks/context/brain_adapter.py; scripts/swarm_v2/keyspace.py (new).
Required fixture: Paired personal and swarm installations deliberately sharing every display label.
Intended change: Eliminate cross-brain and cross-installation collisions hidden by equal local paths.

Implementation sequence

Include brain or corpus ID, canonical project, policy version, and relevant generation in keys.
Hash secret-free normalized identities rather than full credential-bearing URLs.
Version the key format and define bounded migration from legacy keys.
Test identical session IDs and identical paths from separate installations.

Boundary and interface obligations

Input preparation: construct the package fixture from paired personal and swarm installations deliberately sharing every display label.
Output contract: Two installations with the same native session ID and path produce independent cache and archive identities.
Rejection contract: A cache entry from a different brain cannot satisfy a targeted context request.
Recovery contract: Old and new cache namespaces can coexist during rollout without reading stale data as current authority.
Mutation scope: Identity resolution and metadata only; a computed label never grants authorization.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-IDN-05-A.
Negative case: T-SV2-IDN-05-B.
Recovery case: T-SV2-IDN-05-C.
Package-specific measurements: cache_scope_mismatch_total.
Evidence record: evidence/SV2-IDN-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Delete only rebuildable new caches; never delete durable records during a cache-format rollback.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-IDN-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream RUN: Runtime interface and local compatibility

Implementation owner: agentihooks. Integration target: G1. Mutation boundary: Only the selected execution backend may act on its own runtime object. Baseline references: SRC-AH-RUNTIME

SV2-RUN-01: Extract a capability-based runtime protocol

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-IDN-05.
Integration gate: G1, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm/runtime.py; scripts/swarm_v2/runtime/base.py (new).
Required fixture: Local fake runtime and remote fake runtime with deliberately different capabilities.
Intended change: Separate task orchestration from local process and terminal implementation details.

Implementation sequence

Define spawn, observe, command, drain, terminate, and recover operations.
Return typed outcomes including ambiguous, unavailable, and unsupported capability states.
Keep local herdr behavior behind a compatibility adapter.
Avoid backend-name checks when a capability flag is sufficient.

Boundary and interface obligations

Input preparation: construct the package fixture from local fake runtime and remote fake runtime with deliberately different capabilities.
Output contract: The existing local swarm completes its original spawn, observe, and retire tests through the new interface.
Rejection contract: A backend lacking native resume reports unsupported capability rather than silently starting fresh.
Recovery contract: An adapter upgrade can be disabled without rewriting existing task records.
Mutation scope: Only the selected execution backend may act on its own runtime object.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-RUN-01-A.
Negative case: T-SV2-RUN-01-B.
Recovery case: T-SV2-RUN-01-C.
Package-specific measurements: runtime_capability_failures_total.
Evidence record: evidence/SV2-RUN-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Route new tasks back to the local adapter while preserving distributed attempt history.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-RUN-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-RUN-02: Remove global local-process assumptions

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-RUN-01.
Integration gate: G1, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/terminate_agent.py; scripts/swarm/runtime.py; hooks/context/account_sessions.py.
Required fixture: Colliding PIDs, reused process start times, and an unreachable remote process namespace.
Intended change: Restrict process inspection to the worker that owns the observed PID namespace.

Implementation sequence

Replace fleet liveness calls with backend observations keyed by execution ID.
Retain PID and process-start identity for local validation only.
Send remote terminate commands to the owner rather than using Anton’s process table.
Preserve current caller and process-group safety checks for local execution.

Boundary and interface obligations

Input preparation: construct the package fixture from colliding PIDs, reused process start times, and an unreachable remote process namespace.
Output contract: An AWS worker and Anton may both have PID 4321 without either being mistaken for the other’s agent.
Rejection contract: A terminate request lacking execution identity fails even when a local PID happens to match.
Recovery contract: Lost remote observation produces suspect status and cannot cause an unrelated local process kill.
Mutation scope: Only the selected execution backend may act on its own runtime object.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-RUN-02-A.
Negative case: T-SV2-RUN-02-B.
Recovery case: T-SV2-RUN-02-C.
Package-specific measurements: unqualified_process_actions_rejected_total.
Evidence record: evidence/SV2-RUN-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep local process discovery intact behind the adapter while disabling unqualified fleet selectors.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-RUN-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-RUN-03: Implement idempotent runtime operations

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-RUN-02.
Integration gate: G1, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/runtime/operations.py (new); scripts/swarm/store.py.
Required fixture: A transport that applies creation but loses the acknowledgement.
Intended change: Make retries safe across ambiguous transport failures.

Implementation sequence

Assign operation IDs before creating external runtime objects.
Store expected task generation and payload digest with each operation.
Reconcile the observed target before retrying a mutation.
Reject reuse of one operation ID with a different payload.

Boundary and interface obligations

Input preparation: construct the package fixture from a transport that applies creation but loses the acknowledgement.
Output contract: A timed-out create followed by retry resolves to the single already-created attempt.
Rejection contract: A repeated command ID with changed prompt content is rejected as a conflict.
Recovery contract: Controller recovery loads unresolved operations and classifies their actual outcome by observation.
Mutation scope: Only the selected execution backend may act on its own runtime object.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-RUN-03-A.
Negative case: T-SV2-RUN-03-B.
Recovery case: T-SV2-RUN-03-C.
Package-specific measurements: runtime_ambiguous_operations.
Evidence record: evidence/SV2-RUN-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Preserve the operation journal; disable dispatch while resolving operations from the newer protocol.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-RUN-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-RUN-04: Define observation confidence and failure classification

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-RUN-03.
Integration gate: G1, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/runtime/observe.py (new); scripts/swarm/status.py.
Required fixture: Fresh heartbeat with SSH failure, stale heartbeat with running Pod, and API authorization failure.
Intended change: Distinguish terminal loss, worker loss, Pod scheduling, and provider wait.

Implementation sequence

Combine heartbeat freshness, Kubernetes observation, supervisor handshake, and terminal reachability without conflating them.
Attach observed_at and source to every status projection.
Use suspect and lost transitions with explicit thresholds.
Surface permission failures separately from not-found responses.

Boundary and interface obligations

Input preparation: construct the package fixture from fresh heartbeat with SSH failure, stale heartbeat with running Pod, and API authorization failure.
Output contract: A terminal disconnect with fresh worker heartbeats leaves the task working and the terminal degraded.
Rejection contract: A forbidden Kubernetes read is not classified as a deleted Pod.
Recovery contract: A successful relist after watch failure removes stale uncertainty without starting another agent.
Mutation scope: Only the selected execution backend may act on its own runtime object.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-RUN-04-A.
Negative case: T-SV2-RUN-04-B.
Recovery case: T-SV2-RUN-04-C.
Package-specific measurements: execution_observation_age_seconds.
Evidence record: evidence/SV2-RUN-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore conservative observation mode and require operator classification for unresolved attempts.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-RUN-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-RUN-05: Keep lifecycle and terminal actions distinct

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-RUN-04.
Integration gate: G1, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm/cli.py; scripts/swarm_v2/runtime/commands.py (new); scripts/swarm_ledger/ledger_server.py.
Required fixture: A stale browser tab, a replaced Pod, and a disconnected terminal profile.
Intended change: Prevent UI navigation and terminal registration changes from becoming task cancellation.

Implementation sequence

Expose attach, detach, answer, drain, cancel, and force-stop as separate typed commands.
Validate current execution generation on every mutating command.
Return clear unsupported results for unavailable terminal capabilities.
Audit the requesting operator or master identity.

Boundary and interface obligations

Input preparation: construct the package fixture from a stale browser tab, a replaced Pod, and a disconnected terminal profile.
Output contract: Removing a saved terminal profile leaves the remote task running, while explicit cancel follows the task-stop protocol.
Rejection contract: A stale ledger page cannot force-stop a replacement execution using an old command payload.
Recovery contract: Reopening the UI reconstructs controls from current registry state without replaying old button actions.
Mutation scope: Only the selected execution backend may act on its own runtime object.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-RUN-05-A.
Negative case: T-SV2-RUN-05-B.
Recovery case: T-SV2-RUN-05-C.
Package-specific measurements: runtime_commands_by_outcome.
Evidence record: evidence/SV2-RUN-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Hide unsupported new controls while retaining read-only attempt status and existing local controls.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-RUN-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream CTL: Controller reconciliation, task authority, and fencing

Implementation owner: agentihooks. Integration target: G3. Mutation boundary: The controller coordinates existing tasks; it does not independently choose EC2 instances. Baseline references: SRC-AH-STORE

SV2-CTL-01: Implement a renewable controller lease and epoch

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-RUN-05.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm/timer.py; scripts/swarm/tick.py; scripts/swarm_v2/controller.py (new).
Required fixture: Two independent controllers, delayed renewals, and a paused former leader.
Intended change: Ensure only one controller admits new attempts while allowing restart recovery.

Implementation sequence

Acquire a bounded Redis leadership lease using server time.
Record an epoch on admitted intents and command journal entries.
Stop new mutations immediately when lease renewal fails.
Reconcile before reacquiring execution work after leadership changes.

Boundary and interface obligations

Input preparation: construct the package fixture from two independent controllers, delayed renewals, and a paused former leader.
Output contract: Two controller processes race and only one admits a new task generation.
Rejection contract: A controller that lost its lease cannot create another execution using a cached leader flag.
Recovery contract: A replacement controller resumes reconciliation after lease expiry without recreating confirmed attempts.
Mutation scope: The controller coordinates existing tasks; it does not independently choose EC2 instances.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CTL-01-A.
Negative case: T-SV2-CTL-01-B.
Recovery case: T-SV2-CTL-01-C.
Package-specific measurements: controller_leader_changes_total.
Evidence record: evidence/SV2-CTL-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Run one controller with admission disabled until leadership state is understood; retain journals.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CTL-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-CTL-02: Add task-generation fencing to claims

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CTL-01.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm/store.py; scripts/swarm/tick.py; scripts/swarm_v2/authority.py (new).
Required fixture: One partitioned worker that reconnects after a successor has started.
Intended change: Extend exclusive task leases into an explicit distributed ownership contract.

Implementation sequence

Atomically persist holder, generation, lease deadline, and execution ID.
Require compare-and-update for renew, release, and completion.
Fence a lost attempt before assigning its successor.
Prevent an old heartbeat from reviving a retired generation.

Boundary and interface obligations

Input preparation: construct the package fixture from one partitioned worker that reconnects after a successor has started.
Output contract: A recovered old worker receives stale_generation after its task has moved to a newer attempt.
Rejection contract: A release from the former holder cannot remove the successor’s valid claim.
Recovery contract: Replaying the claim journal reconstructs the same highest admitted generation.
Mutation scope: The controller coordinates existing tasks; it does not independently choose EC2 instances.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CTL-02-A.
Negative case: T-SV2-CTL-02-B.
Recovery case: T-SV2-CTL-02-C.
Package-specific measurements: stale_generation_rejections_total.
Evidence record: evidence/SV2-CTL-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Stop new distributed claims and keep old generation records while restoring the prior compatible reader.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CTL-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-CTL-03: Bound pending execution admission

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CTL-02.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm/tick.py; scripts/swarm_v2/admission.py (new).
Required fixture: Empty cluster, ten runnable tasks, cap of three, and one impossible memory request.
Intended change: Create enough pending Pods to trigger scaling without exhausting budgets or provider reservations.

Implementation sequence

Apply global and per-swarm pending caps before dispatch.
Separate pending resource reservations from active provider-session reservations.
Reject impossible resource profiles with an actionable reason.
Preserve task ordering, dependencies, territory rules, and lane caps.

Boundary and interface obligations

Input preparation: construct the package fixture from empty cluster, ten runnable tasks, cap of three, and one impossible memory request.
Output contract: Eligible work can create pending Pods from zero remote capacity up to the configured bound.
Rejection contract: Tasks requiring more memory than every approved template do not remain indefinitely in an expanding pending queue.
Recovery contract: A quota outage releases unused pending reservations after their expiry and permits later retry.
Mutation scope: The controller coordinates existing tasks; it does not independently choose EC2 instances.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CTL-03-A.
Negative case: T-SV2-CTL-03-B.
Recovery case: T-SV2-CTL-03-C.
Package-specific measurements: pending_execution_admission_total.
Evidence record: evidence/SV2-CTL-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Set distributed admission to zero while allowing current attempts to drain.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CTL-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-CTL-04: Reconcile watches, restarts, and orphan objects

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CTL-03.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/kubernetes/watch.py (new); scripts/swarm_v2/controller.py (new).
Required fixture: Managed orphan, foreign lookalike, expired watch cursor, and delayed deletion event.
Intended change: Make the control loop converge from authoritative records and observed Kubernetes objects.

Implementation sequence

Label every managed object with plan-independent ownership and immutable execution identity.
Relist after expired watch resource versions or network interruptions.
Detect labelled Pods with missing journals and journals with missing Pods.
Quarantine foreign or ambiguous objects instead of deleting by name pattern.

Boundary and interface obligations

Input preparation: construct the package fixture from managed orphan, foreign lookalike, expired watch cursor, and delayed deletion event.
Output contract: Controller restart converges to the existing managed Pod set without duplicate launches.
Rejection contract: A similarly named Pod without the controller ownership label is never deleted.
Recovery contract: A lost watch acknowledgement is recovered by relist and stable execution matching.
Mutation scope: The controller coordinates existing tasks; it does not independently choose EC2 instances.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CTL-04-A.
Negative case: T-SV2-CTL-04-B.
Recovery case: T-SV2-CTL-04-C.
Package-specific measurements: controller_orphans_by_class.
Evidence record: evidence/SV2-CTL-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable orphan cleanup independently from status reconciliation.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CTL-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-CTL-05: Centralize final shared mutations and outcome commit

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CTL-04.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm/done_gate.py; scripts/swarm_ledger/ledger_tasks.py; scripts/swarm_v2/outcomes.py (new).
Required fixture: Two attempts propose outcomes for one task and one merge response is lost.
Intended change: Reduce duplicate external side effects by validating current ownership at the final integration boundary.

Implementation sequence

Have workers propose evidence-backed outcomes under their task generation.
Validate proof, task revision, PR identity, and current owner before marking done.
Execute or authorize final protected-branch integration through a controlled current-generation path.
Record provider operation identifiers and ambiguous outcomes for reconciliation.

Boundary and interface obligations

Input preparation: construct the package fixture from two attempts propose outcomes for one task and one merge response is lost.
Output contract: An old worker may retain a private branch but cannot mark the task done or merge its stale result after replacement.
Rejection contract: A successful test message without required proof artifacts cannot complete the task.
Recovery contract: An interrupted merge response is reconciled against the actual PR and commit state before retry.
Mutation scope: The controller coordinates existing tasks; it does not independently choose EC2 instances.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CTL-05-A.
Negative case: T-SV2-CTL-05-B.
Recovery case: T-SV2-CTL-05-C.
Package-specific measurements: outcome_conflicts_total.
Evidence record: evidence/SV2-CTL-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Pause final integration and retain proposed outcomes for operator review.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CTL-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream LDG: Remote-safe ledger and worker control APIs

Implementation owner: agentihooks. Integration target: G3. Mutation boundary: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files. Baseline references: SRC-AH-LEDGER

SV2-LDG-01: Remove the local HTML token dependency

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CTL-05.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_ledger/ledger.py; scripts/swarm/ledger_client.py; scripts/swarm_ledger/ledger_link.py.
Required fixture: Read-only worker home with no development-ledger directory.
Intended change: Permit workers to use the ledger without mounting Anton’s ledger filesystem.

Implementation sequence

Resolve endpoint and scoped credential through the launch configuration.
Keep local legacy token lookup only in explicit local compatibility mode.
Prevent remote clients from automatically starting a local ledger server on HTTP failure.
Add bounded connection and request timeouts.

Boundary and interface obligations

Input preparation: construct the package fixture from read-only worker home with no development-ledger directory.
Output contract: A worker with no ledger HTML files can read its task and post an authorized update.
Rejection contract: A missing remote token produces unauthenticated rather than silently using another local credential.
Recovery contract: A transient ledger outage retries read-only operations without spawning a second server.
Mutation scope: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-LDG-01-A.
Negative case: T-SV2-LDG-01-B.
Recovery case: T-SV2-LDG-01-C.
Package-specific measurements: ledger_remote_auth_failures_total.
Evidence record: evidence/SV2-LDG-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore local token resolution for local mode while retaining remote configuration as inactive.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-LDG-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-LDG-02: Define authenticated worker registration and heartbeat

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-LDG-01.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/api/executions.py (new); docs/swarm-v2/schemas/heartbeat.json (new).
Required fixture: Bound worker credential, out-of-order sequence, stale generation, and forged URL subject.
Intended change: Expose the minimum remote lifecycle surface needed by the runtime adapter.

Implementation sequence

Validate launch grants on registration.
Bind heartbeat subjects to execution identity and generation.
Accept resource observations as telemetry rather than scheduling authority.
Return server-side lease deadlines and command watermarks.

Boundary and interface obligations

Input preparation: construct the package fixture from bound worker credential, out-of-order sequence, stale generation, and forged URL subject.
Output contract: A registered worker renews only its own execution authority and reports its current durable archive watermark.
Rejection contract: A worker cannot update another agent’s state by changing the URL ID.
Recovery contract: A replayed heartbeat does not move counters or lease state backward.
Mutation scope: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-LDG-02-A.
Negative case: T-SV2-LDG-02-B.
Recovery case: T-SV2-LDG-02-C.
Package-specific measurements: heartbeat_rejections_total.
Evidence record: evidence/SV2-LDG-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable new registration while existing leases drain under the previous supported protocol.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-LDG-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-LDG-03: Add revision-aware task mutation endpoints

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-LDG-02.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_ledger/ledger_server.py; scripts/swarm_ledger/ledger_tasks.py; scripts/swarm_v2/api/tasks.py (new).
Required fixture: Edited task specification while an agent is still working from the preceding revision.
Intended change: Preserve current task updates while preventing stale workers from overwriting new specifications.

Implementation sequence

Require expected task revision on writes that alter execution-relevant state.
Separate operator control operations from worker progress operations.
Use idempotency IDs for comments and outcome proposals.
Return current revision and conflict details without leaking other tasks.

Boundary and interface obligations

Input preparation: construct the package fixture from edited task specification while an agent is still working from the preceding revision.
Output contract: A worker update based on an old task specification is refused and can refresh before retry.
Rejection contract: Worker credentials cannot increase global caps or change operator-only gates.
Recovery contract: A duplicate progress post is acknowledged once without appending duplicate ledger entries.
Mutation scope: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-LDG-03-A.
Negative case: T-SV2-LDG-03-B.
Recovery case: T-SV2-LDG-03-C.
Package-specific measurements: ledger_revision_conflicts_total.
Evidence record: evidence/SV2-LDG-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep additive revision metadata and route unsupported writes through read-only conflict responses.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-LDG-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-LDG-04: Enforce the single-writer ledger deployment

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-LDG-03.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_ledger/ledger_core.py; docs/swarm-v2/ledger-durability.md (new).
Required fixture: Two server processes sharing one test ledger directory.
Intended change: Keep SQLite ledger persistence correct with a lease excluding a second ledger server and serialized database transactions for command line clients.

Implementation sequence

Document one active writer and its durable volume.
Hold a process-safe writer lease for the ledger server; command line tools remain database clients whose BEGIN IMMEDIATE transactions serialize with the server’s writes.
Publish atomic snapshots and verified backups through the SQLite backup API.
Reject unsupported multi-replica write configuration at startup.

Boundary and interface obligations

Input preparation: construct the package fixture from two server processes sharing one test ledger directory.
Output contract: The writer lease refuses a second ledger server on the same ledger root; command line clients remain serialized database writers.
Rejection contract: A chart setting requesting multiple ledger server replicas fails validation, and a second server is refused at startup by the lease.
Recovery contract: A writer restart loads the last complete revision and replays idempotent accepted operations.
Mutation scope: SQLite remains authoritative for operator work state; server and command line mutations are serialized database transactions.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-LDG-04-A.
Negative case: T-SV2-LDG-04-B.
Recovery case: T-SV2-LDG-04-C.
Package-specific measurements: ledger_writer_conflicts_total.
Evidence record: evidence/SV2-LDG-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Stop the ledger server, restore a verified database backup with the current image’s ledger_writer restore tool while holding the writer lease, then deploy and start the preceding compatible image through GitOps.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-LDG-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-LDG-05: Add command acknowledgement and drain control

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-LDG-04.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/api/commands.py (new); scripts/swarm_v2/worker/control.py (new).
Required fixture: Delayed command delivery, duplicate poll response, and a drain interrupted by network loss.
Intended change: Give the controller explicit accepted and completed command states instead of relying on terminal text.

Implementation sequence

Assign immutable command IDs and payload digests.
Limit worker command polling and acknowledge receipt separately from completion.
Bind drain and cancel commands to execution generation and expiry.
Retain unacknowledged commands across short control-plane outages.

Boundary and interface obligations

Input preparation: construct the package fixture from delayed command delivery, duplicate poll response, and a drain interrupted by network loss.
Output contract: A drain command moves the worker into no-new-mutations mode and reports checkpoint completion separately.
Rejection contract: An expired answer or stop command is not replayed into a new conversation.
Recovery contract: Reconnecting after acknowledgement loss returns the stored command outcome without rerunning it.
Mutation scope: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-LDG-05-A.
Negative case: T-SV2-LDG-05-B.
Recovery case: T-SV2-LDG-05-C.
Package-specific measurements: worker_command_ack_lag_seconds.
Evidence record: evidence/SV2-LDG-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Stop issuing new command types while old ones finish or expire.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-LDG-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream IMG: Reproducible swarm worker image and bootstrap

Implementation owner: agentihooks. Integration target: G2. Mutation boundary: Image build and isolated container execution; production rollout belongs to antoncore. Baseline references: SRC-AH-GUIDE

SV2-IMG-01: Create the minimal reproducible worker image

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-RUN-05.
Integration gate: G2, subject to all earlier applicable acceptance gates.
Owned path candidates: docker/swarm-node/Dockerfile (new); docker/swarm-node/versions.lock (new).
Required fixture: Clean build context with network access blocked during container startup.
Intended change: Build the shared execution environment without installing a separate orchestration product.

Implementation sequence

Pin the base, herdr, Python environment, Claude CLI, Codex CLI, and required shell tools.
Record artifact checksums and supported architectures.
Install immutable profile templates outside the writable runtime home.
Add a build manifest and software inventory to the image.

Boundary and interface obligations

Input preparation: construct the package fixture from clean build context with network access blocked during container startup.
Output contract: A clean build reports the pinned tools and can start without fetching application packages at runtime.
Rejection contract: A missing checksum, unsupported architecture, or mismatched binary fails the build.
Recovery contract: Rebuilding from the same lock produces the same declared tool inventory even when upstream latest changes.
Mutation scope: Image build and isolated container execution; production rollout belongs to antoncore.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-IMG-01-A.
Negative case: T-SV2-IMG-01-B.
Recovery case: T-SV2-IMG-01-C.
Package-specific measurements: worker_image_build_validation_failures.
Evidence record: evidence/SV2-IMG-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Retain the previous image digest and update only new-attempt selection during rollback.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-IMG-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-IMG-02: Render target-native profiles into private homes

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-IMG-01.
Integration gate: G2, subject to all earlier applicable acceptance gates.
Owned path candidates: docker/swarm-node/bootstrap.py (new); scripts/targets/; profiles/swarm-node/ (new).
Required fixture: Two target profiles, empty home volume, and a deliberately invalid host-specific interpreter path.
Intended change: Reuse existing target adapters for a portable per-execution setup.

Implementation sequence

Create the fixed UID/GID-owned private home and runtime subdirectories.
Render Claude and Codex configuration through their native adapters.
Substitute the actual container interpreter and service endpoints.
Copy only the selected profile and account references into the execution scope.

Boundary and interface obligations

Input preparation: construct the package fixture from two target profiles, empty home volume, and a deliberately invalid host-specific interpreter path.
Output contract: Both target CLIs load their expected hooks and MCP configuration in separate execution homes.
Rejection contract: A profile that points to a workstation venv or escapes the execution root fails bootstrap.
Recovery contract: Restarting bootstrap for the same unstarted attempt is idempotent and does not duplicate plugin entries.
Mutation scope: Image build and isolated container execution; production rollout belongs to antoncore.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-IMG-02-A.
Negative case: T-SV2-IMG-02-B.
Recovery case: T-SV2-IMG-02-C.
Package-specific measurements: worker_profile_materialization_seconds.
Evidence record: evidence/SV2-IMG-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Select the prior profile bundle digest for new attempts while preserving existing homes for recovery.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-IMG-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-IMG-03: Implement supervision and signal handling

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-IMG-02.
Integration gate: G2, subject to all earlier applicable acceptance gates.
Owned path candidates: docker/swarm-node/supervisor.py (new); docker/swarm-node/entrypoint.sh (new).
Required fixture: A synthetic long-running tool, two grandchildren, and an exporter that acknowledges late.
Intended change: Keep processes running independently of viewers while making shutdown observable and bounded.

Implementation sequence

Start herdr under an init process that reaps children.
Supervise exporter and main-agent handshake without a hidden second swarm timer.
Forward termination into the execution drain protocol.
Capture exit reasons and distinguish agent completion from supervisor failure.

Boundary and interface obligations

Input preparation: construct the package fixture from a synthetic long-running tool, two grandchildren, and an exporter that acknowledges late.
Output contract: Detaching every terminal leaves the main agent and exporter alive under the supervisor.
Rejection contract: Killing the supervisor cannot leave an untracked main-agent process tree in the test container.
Recovery contract: A SIGTERM during a tool operation triggers bounded quiescence and a truthful complete or incomplete checkpoint outcome.
Mutation scope: Image build and isolated container execution; production rollout belongs to antoncore.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-IMG-03-A.
Negative case: T-SV2-IMG-03-B.
Recovery case: T-SV2-IMG-03-C.
Package-specific measurements: supervisor_child_exit_total.
Evidence record: evidence/SV2-IMG-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Use the prior supervisor image for new attempts and never hot-replace running process ownership.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-IMG-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-IMG-04: Add probes and startup self-tests

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-IMG-03.
Integration gate: G2, subject to all earlier applicable acceptance gates.
Owned path candidates: docker/swarm-node/health.py (new); tests/integration/swarm_node/ (new).
Required fixture: Missing binary, read-only home, healthy server, and unavailable external brain fixtures.
Intended change: Expose local execution readiness without making external outages restart the fleet.

Implementation sequence

Test writable runtime paths and target executable presence.
Verify herdr local protocol capability and the expected hook callback.
Separate startup readiness, supervisor liveness, and dependency degradation.
Include a credential-free diagnostic report for failed bootstrap.

Boundary and interface obligations

Input preparation: construct the package fixture from missing binary, read-only home, healthy server, and unavailable external brain fixtures.
Output contract: A healthy local runtime remains live during a simulated brain outage while readiness or degraded detail reports the dependency issue.
Rejection contract: A missing target binary or unreadable private home never reports ready.
Recovery contract: Recovered network connectivity clears dependency degradation without replacing the running agent.
Mutation scope: Image build and isolated container execution; production rollout belongs to antoncore.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-IMG-04-A.
Negative case: T-SV2-IMG-04-B.
Recovery case: T-SV2-IMG-04-C.
Package-specific measurements: worker_startup_failure_reason.
Evidence record: evidence/SV2-IMG-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Revert probe configuration independently from the image when thresholds are wrong.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-IMG-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-IMG-05: Publish image CI and compatibility attestations

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-IMG-04.
Integration gate: G2, subject to all earlier applicable acceptance gates.
Owned path candidates: .github/workflows/swarm-node-image.yml (new); tests/contracts/image_manifest/ (new).
Required fixture: One valid image and one image with incompatible herdr server capabilities.
Intended change: Make image promotion deliberate and independent of the swarm being repaired.

Implementation sequence

Build on an independent runner path rather than requiring a healthy swarm worker image.
Test headless launch and hook delivery for pinned target versions.
Publish commit and digest tags plus the protocol compatibility manifest.
Keep credentials out of layers, logs, and build arguments.

Boundary and interface obligations

Input preparation: construct the package fixture from one valid image and one image with incompatible herdr server capabilities.
Output contract: The release artifact contains a digest, version manifest, test report, and provenance pointing at the exact agentihooks commit.
Rejection contract: A worker image failing one target’s smoke test cannot become the promoted deployment digest.
Recovery contract: A broken production swarm can still build and publish its repair image through the independent CI path.
Mutation scope: Image build and isolated container execution; production rollout belongs to antoncore.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-IMG-05-A.
Negative case: T-SV2-IMG-05-B.
Recovery case: T-SV2-IMG-05-C.
Package-specific measurements: worker_image_qualified_targets.
Evidence record: evidence/SV2-IMG-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Point deployment at the last accepted digest without rebuilding or retagging it.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-IMG-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream KUB: Kubernetes execution adapter and object lifecycle

Implementation owner: agentihooks. Integration target: G3. Mutation boundary: Create and mutate only labelled execution objects in the configured swarm namespace. Baseline references: SRC-K8S-LIFECYCLE

SV2-KUB-01: Build a validated execution Pod template

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CTL-05, SV2-IMG-05, SV2-LDG-05.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/kubernetes/spec.py (new); docs/swarm-v2/schemas/pod-policy.json (new).
Required fixture: Malicious task payload containing YAML fragments and an otherwise valid general resource profile.
Intended change: Translate an admitted launch into a bounded one-main-agent Pod.

Implementation sequence

Render restartPolicy Never and immutable execution labels.
Apply approved requests, limits, node constraints, and secret references.
Disable automatic service-account token mounting in workers.
Include startup, readiness, and local liveness probes from the image contract.

Boundary and interface obligations

Input preparation: construct the package fixture from malicious task payload containing YAML fragments and an otherwise valid general resource profile.
Output contract: A rendered Pod validates against Kubernetes schema and matches its launch identity and resource profile.
Rejection contract: User prompt text cannot inject arbitrary Pod fields, privileged settings, host mounts, or extra secret references.
Recovery contract: Rendering the same admitted launch twice produces the same semantically canonical specification digest.
Mutation scope: Create and mutate only labelled execution objects in the configured swarm namespace.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-KUB-01-A.
Negative case: T-SV2-KUB-01-B.
Recovery case: T-SV2-KUB-01-C.
Package-specific measurements: pod_spec_validation_failures_total.
Evidence record: evidence/SV2-KUB-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore the previous template version for new launches and retain existing Pod version annotations.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-KUB-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-KUB-02: Create and observe Pods idempotently

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-KUB-01.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/kubernetes/client.py (new); scripts/swarm_v2/kubernetes/runtime.py (new).
Required fixture: API server applies a create, drops the response, and then returns AlreadyExists.
Intended change: Join Kubernetes object creation to the runtime operation journal.

Implementation sequence

Submit a deterministic execution name and record returned UID.
Reconcile AlreadyExists only when ownership and spec digest match.
Track Pending, Running, Succeeded, Failed, and termination reasons separately from agent task state.
Do not assume a succeeded container means the ledger outcome is committed.

Boundary and interface obligations

Input preparation: construct the package fixture from aPI server applies a create, drops the response, and then returns AlreadyExists.
Output contract: A lost create response followed by observation discovers the original matching Pod and does not launch a second one.
Rejection contract: An AlreadyExists object with the wrong execution label is quarantined rather than adopted.
Recovery contract: A controller restart recovers Pod UID and admission state through a label-qualified relist.
Mutation scope: Create and mutate only labelled execution objects in the configured swarm namespace.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-KUB-02-A.
Negative case: T-SV2-KUB-02-B.
Recovery case: T-SV2-KUB-02-C.
Package-specific measurements: kubernetes_create_reconciliation_total.
Evidence record: evidence/SV2-KUB-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable new Pod creation while continuing observation and controlled cleanup of existing attempts.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-KUB-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-KUB-03: Transport bounded worker commands

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-KUB-02.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/kubernetes/commands.py (new); scripts/swarm_v2/worker/control.py (new).
Required fixture: Prompts containing quotes, newlines, command substitutions, and Unicode text.
Intended change: Keep execution control independent from arbitrary kubectl shell injection.

Implementation sequence

Use the authenticated worker control endpoint for normal command delivery.
Restrict any fallback exec path to a fixed helper and structured payload.
Carry execution generation, command ID, and expiry through every transport.
Sanitize stdout/stderr reports before persistence.

Boundary and interface obligations

Input preparation: construct the package fixture from prompts containing quotes, newlines, command substitutions, and Unicode text.
Output contract: A normal answer or drain reaches the intended worker helper with its original structured payload intact.
Rejection contract: Shell metacharacters in an operator message remain message content rather than transport commands.
Recovery contract: A command with an uncertain acknowledgement is reconciled by its ID before another delivery.
Mutation scope: Create and mutate only labelled execution objects in the configured swarm namespace.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-KUB-03-A.
Negative case: T-SV2-KUB-03-B.
Recovery case: T-SV2-KUB-03-C.
Package-specific measurements: worker_transport_ambiguous_total.
Evidence record: evidence/SV2-KUB-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable the fallback exec transport while keeping HTTP command delivery operational.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-KUB-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-KUB-04: Clean up completed attempts safely

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-KUB-03.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/kubernetes/cleanup.py (new); scripts/swarm_v2/retention.py (new).
Required fixture: Old and replacement Pods with related labels plus an archive upload still pending.
Intended change: Remove transient resources without deleting recovery evidence or a replacement attempt.

Implementation sequence

Require completed or explicitly cancelled state plus required durable acknowledgements.
Delete Pods and Services using UID preconditions and ownership labels.
Release attach registrations and attempt-scoped secret references in order.
Keep historical metadata and archive references after runtime deletion.

Boundary and interface obligations

Input preparation: construct the package fixture from old and replacement Pods with related labels plus an archive upload still pending.
Output contract: Cleanup removes only the old attempt’s runtime objects after its transcript watermark and outcome are durable.
Rejection contract: A stale cleanup job cannot delete a new Pod that reused a human-readable name.
Recovery contract: Interrupted cleanup resumes from its journal and tolerates already-absent owned resources.
Mutation scope: Create and mutate only labelled execution objects in the configured swarm namespace.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-KUB-04-A.
Negative case: T-SV2-KUB-04-B.
Recovery case: T-SV2-KUB-04-C.
Package-specific measurements: execution_cleanup_backlog.
Evidence record: evidence/SV2-KUB-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Suspend cleanup and retain objects temporarily while correcting a policy error.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-KUB-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-KUB-05: Reconcile abrupt Pod and node failure

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-KUB-04.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/kubernetes/failures.py (new); scripts/swarm_v2/controller.py (new).
Required fixture: OOMKilled, node-unreachable, image-pull failure, and late old-Pod events.
Intended change: Convert infrastructure failures into explicit fenced recovery decisions.

Implementation sequence

Classify OOM, eviction, node loss, image pull, and application exit independently.
Fence the old attempt before scheduling a replacement.
Select the latest complete compatible checkpoint or request an explicit fresh decision.
Preserve last observed native session and archive watermark for diagnosis.

Boundary and interface obligations

Input preparation: construct the package fixture from oOMKilled, node-unreachable, image-pull failure, and late old-Pod events.
Output contract: Deleting a worker node eventually yields one fenced recovery attempt and a recorded explanation of any unarchived tail loss.
Rejection contract: ImagePullBackOff does not consume an active provider-session slot indefinitely.
Recovery contract: Reappearing old Pod observations cannot return the retired generation to working.
Mutation scope: Create and mutate only labelled execution objects in the configured swarm namespace.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-KUB-05-A.
Negative case: T-SV2-KUB-05-B.
Recovery case: T-SV2-KUB-05-C.
Package-specific measurements: execution_failures_by_reason.
Evidence record: evidence/SV2-KUB-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Pause automatic replacement and leave affected tasks recovery_pending for operator review.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-KUB-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream HDR: herdr remote aggregation and terminal identity

Implementation owner: agentihooks. Integration target: G3. Mutation boundary: Terminal operations affect one confirmed server incarnation; detachment never cancels work. Baseline references: SRC-HERDR-MACHINES

SV2-HDR-01: Qualify the pinned herdr protocol

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-KUB-05.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/herdr_host.py; scripts/swarm_v2/herdr/capabilities.py (new).
Required fixture: Compatible client/server pair and a server missing machine-forwarding capability.
Intended change: Verify the exact remote operations needed before promising the one-window experience.

Implementation sequence

Capture bundled API schema and server capability responses from the pinned image.
Exercise workspace creation, pane launch, observation, prompting, and close.
Test noninteractive registration against an already-running server.
Record unsupported operations explicitly in the compatibility matrix.

Boundary and interface obligations

Input preparation: construct the package fixture from compatible client/server pair and a server missing machine-forwarding capability.
Output contract: The accepted image demonstrates remote commands without an open TUI and without installation or server replacement.
Rejection contract: A missing remote capability cannot trigger an unrequested update or local fallback.
Recovery contract: A server restart invalidates the cached capability result and rechecks the new incarnation.
Mutation scope: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-HDR-01-A.
Negative case: T-SV2-HDR-01-B.
Recovery case: T-SV2-HDR-01-C.
Package-specific measurements: herdr_capability_mismatch_total.
Evidence record: evidence/SV2-HDR-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep the previous qualified herdr image digest available and refuse incompatible new attempts.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-HDR-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-HDR-02: Implement private worker terminal endpoints

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-HDR-01.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: docker/swarm-node/ssh/ (new); scripts/swarm_v2/herdr/endpoints.py (new).
Required fixture: Private service, unauthorized client, changed host key, and missing cluster DNS route.
Intended change: Provide a supported herdr SSH path without exposing the host or public network.

Implementation sequence

Prototype an unprivileged or minimally privileged SSH implementation on a private high port.
Bind endpoint access to operator/controller credentials and one execution.
Use service selectors containing immutable execution identity.
Prove required routing and DNS from the Anton client location.

Boundary and interface obligations

Input preparation: construct the package fixture from private service, unauthorized client, changed host key, and missing cluster DNS route.
Output contract: The Anton client attaches to the intended worker while a different namespace principal cannot use the endpoint.
Rejection contract: No public LoadBalancer, host root SSH account, or shared permanent image private key is required.
Recovery contract: Replacing the Pod creates a new verified endpoint without accepting an old unauthenticated host identity.
Mutation scope: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-HDR-02-A.
Negative case: T-SV2-HDR-02-B.
Recovery case: T-SV2-HDR-02-C.
Package-specific measurements: terminal_endpoint_auth_failures.
Evidence record: evidence/SV2-HDR-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable worker terminal exposure while keeping task execution and ledger control operational.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-HDR-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-HDR-03: Maintain saved machine registrations

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-HDR-02.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/herdr/catalog.py (new); scripts/swarm_v2/herdr/reconcile.py (new).
Required fixture: Two managed endpoints and one unrelated manually named machine.
Intended change: Keep one Anton herdr client synchronized with currently attachable attempts.

Implementation sequence

Register only ready compatible endpoints using explicit remote session selection.
Record opaque profile IDs returned by herdr.
Reconcile labels and remove only controller-owned retired registrations.
Avoid manual writes to undocumented catalog file formats.

Boundary and interface obligations

Input preparation: construct the package fixture from two managed endpoints and one unrelated manually named machine.
Output contract: Two worker servers appear beside Local and each registration maps to its own execution ID.
Rejection contract: A label collision does not adopt or overwrite a manually configured unrelated machine.
Recovery contract: Reconciliation after client restart restores missing managed registrations without duplicating existing ones.
Mutation scope: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-HDR-03-A.
Negative case: T-SV2-HDR-03-B.
Recovery case: T-SV2-HDR-03-C.
Package-specific measurements: herdr_registration_drift.
Evidence record: evidence/SV2-HDR-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Stop automated registration and leave existing profiles intact until ownership is audited.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-HDR-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-HDR-04: Enforce server-qualified pane routing

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-HDR-03.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm/runtime.py; scripts/swarm_v2/herdr/target.py (new).
Required fixture: Identical pane IDs and agent labels on Local and two remote servers.
Intended change: Make all terminal IDs unambiguous across many worker servers.

Implementation sequence

Require machine profile, remote session, server incarnation, and pane ID for remote actions.
Resolve display names through the registry before sending commands.
Validate expected conversation identity where the herdr API exposes it.
Do not inherit local HERDR_PANE_ID into remote operations.

Boundary and interface obligations

Input preparation: construct the package fixture from identical pane IDs and agent labels on Local and two remote servers.
Output contract: Two servers both using pane w1:p1 receive only their explicitly targeted messages.
Rejection contract: A bare remote pane ID or stale server incarnation is rejected before any pane mutation.
Recovery contract: A reconnect refreshes the qualified target without replaying a previous prompt.
Mutation scope: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-HDR-04-A.
Negative case: T-SV2-HDR-04-B.
Recovery case: T-SV2-HDR-04-C.
Package-specific measurements: herdr_target_mismatch_total.
Evidence record: evidence/SV2-HDR-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Revert UI actions to explicit read-only inspection until qualified routing is repaired.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-HDR-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-HDR-05: Test detach, reconnect, and operator visibility

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-HDR-04.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: tests/e2e/swarm_v2/test_terminal_reconnect.py (new); scripts/swarm_ledger/ledger_server.py.
Required fixture: Two remote agents, one lost SSH path, and one fully closed operator TUI.
Intended change: Prove the user-facing persistence promise independently of checkpoint recovery.

Implementation sequence

Launch long-running agents and close all operator viewers.
Break one SSH connection while keeping worker control heartbeats alive.
Reattach from the Anton client and verify the same native conversation.
Display cached versus live terminal status in the ledger.

Boundary and interface obligations

Input preparation: construct the package fixture from two remote agents, one lost SSH path, and one fully closed operator TUI.
Output contract: Both agents continue when the client closes and the disconnected server does not disrupt other machine views.
Rejection contract: Cached terminal data cannot be shown as fresh liveness or accept input while the target is unverified.
Recovery contract: Reconnecting attaches to the original live process when it still exists rather than launching a replacement.
Mutation scope: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-HDR-05-A.
Negative case: T-SV2-HDR-05-B.
Recovery case: T-SV2-HDR-05-C.
Package-specific measurements: terminal_reconnect_latency_seconds.
Evidence record: evidence/SV2-HDR-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Turn off aggregation refresh while preserving direct explicit attach and task execution.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-HDR-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream CAP: Capacity policy, ASG reuse, and coexistence

Implementation owner: antoncore. Integration target: G10. Mutation boundary: No increase in spending ceilings or access to reserved workload pools without explicit operator approval. Baseline references: SRC-ANTON-ASG SRC-ANTON-CA

SV2-CAP-01: Define approved swarm capacity overlays

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-KUB-05.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: k8s/charts/swarm-node/values.yaml (new); k8s/values-overlays/swarm/ (new).
Required fixture: Current pool labels plus a reserved research pool and a control-plane node.
Intended change: Map resource profiles to permitted infrastructure without pretending all existing pools are interchangeable.

Implementation sequence

Inventory live labels, taints, allocatable resources, and current consumers.
Define explicit on-prem and general-pool eligibility.
Keep research excluded until its owner approves shared use or a separate pool change.
Record a memory profile as unsatisfied when no approved template fits.

Boundary and interface obligations

Input preparation: construct the package fixture from current pool labels plus a reserved research pool and a control-plane node.
Output contract: General workers land only on the approved nodes and unrelated research/live workloads retain their current isolation.
Rejection contract: A broad Exists toleration for every workload taint fails chart policy validation.
Recovery contract: Removing an eligible pool yields an actionable admission result without silently broadening placement.
Mutation scope: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CAP-01-A.
Negative case: T-SV2-CAP-01-B.
Recovery case: T-SV2-CAP-01-C.
Package-specific measurements: swarm_capacity_policy_rejections.
Evidence record: evidence/SV2-CAP-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore the preceding swarm-only overlay and drain affected attempts before removing their eligibility.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CAP-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-CAP-02: Verify scale-from-zero with existing autoscaler

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CAP-01.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: k8s/charts/cluster-autoscaler/values.yaml; automation/verify-swarm-scaling.sh (new).
Required fixture: Empty eligible pool, one pending Pod, and one deliberately mismatched taint.
Intended change: Reuse the installed ASG integration without adding another execution scaler.

Implementation sequence

Verify node-template resource and taint tags for every admitted class.
Submit a bounded pending canary from zero eligible cloud workers.
Observe autoscaler simulation, selected group, instance join, and Pod scheduling.
Record each stage separately and clean up the canary.

Boundary and interface obligations

Input preparation: construct the package fixture from empty eligible pool, one pending Pod, and one deliberately mismatched taint.
Output contract: One eligible pending worker causes a permitted ASG to scale and the Pod eventually starts on the resulting node.
Rejection contract: An impossible request reports no fitting template instead of repeatedly increasing desired capacity.
Recovery contract: A failed node launch is classified and retried within configured autoscaler and admission bounds.
Mutation scope: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CAP-02-A.
Negative case: T-SV2-CAP-02-B.
Recovery case: T-SV2-CAP-02-C.
Package-specific measurements: swarm_scale_up_stage_seconds.
Evidence record: evidence/SV2-CAP-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Remove canary workload and restore only explicitly changed swarm annotations or overlays.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CAP-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-CAP-03: Make Spot policy explicit without changing global priority

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CAP-02.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: k8s/values-overlays/swarm/spot.yaml (new); docs/swarm-v2-capacity.md (new).
Required fixture: No Spot capacity, available on-demand capacity, and fallback both disabled and enabled.
Intended change: Prevent a soft scheduling preference from being mistaken for a Spot-first scaling guarantee.

Implementation sequence

Document the currently declared expander priority order.
Provide separate policies for on-demand, Spot-only, and explicitly budgeted fallback.
Use required capacity constraints for the Spot-only experiment.
Keep existing runner priority behavior unchanged.

Boundary and interface obligations

Input preparation: construct the package fixture from no Spot capacity, available on-demand capacity, and fallback both disabled and enabled.
Output contract: Spot-only canary admission either uses the approved Spot pool or reports unavailability without selecting on-demand.
Rejection contract: A soft Pod preference is not accepted as proof that scale-up will select Spot.
Recovery contract: A shortage follows the configured wait or approved fallback decision with its budget recorded.
Mutation scope: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CAP-03-A.
Negative case: T-SV2-CAP-03-B.
Recovery case: T-SV2-CAP-03-C.
Package-specific measurements: capacity_fallback_decisions_total.
Evidence record: evidence/SV2-CAP-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Select the previous capacity policy for new attempts and allow existing attempts to finish or drain.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CAP-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-CAP-04: Implement measured resource budgets and namespace quotas

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CAP-03.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: k8s/charts/swarm-node/values.yaml (new); k8s/manifests/swarm/quota.yaml (new).
Required fixture: Browser-heavy, compiler-heavy, idle-CLI, and high-process-count workload samples.
Intended change: Bound aggregate swarm pressure while allowing real workloads to burst safely.

Implementation sequence

Measure whole-process CPU, memory, storage, and child-worker behavior.
Set initial requests and limits from representative traces.
Apply namespace ResourceQuota, LimitRange, and admission caps consistently.
Verify critical production and trading workloads remain protected.

Boundary and interface obligations

Input preparation: construct the package fixture from browser-heavy, compiler-heavy, idle-CLI, and high-process-count workload samples.
Output contract: A bounded swarm burst runs representative tests without node memory pressure or unexpected critical-workload preemption.
Rejection contract: A worker without the required resource specification cannot bypass the namespace limits.
Recovery contract: After an OOM, the task is classified and resized or stopped by policy rather than retried forever unchanged.
Mutation scope: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CAP-04-A.
Negative case: T-SV2-CAP-04-B.
Recovery case: T-SV2-CAP-04-C.
Package-specific measurements: swarm_resource_pressure_events_total.
Evidence record: evidence/SV2-CAP-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Reduce swarm admission and restore previous resource overlays before increasing capacity.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CAP-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-CAP-05: Integrate drain protection and cost-aware scale-down

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CAP-04.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: k8s/charts/aws-node-termination-handler/values.yaml; k8s/charts/swarm-node/values.yaml (new).
Required fixture: Active task, completed task with stale annotation, real notice simulation, and abrupt node loss.
Intended change: Preserve active work while ensuring idle swarm capacity can disappear.

Implementation sequence

Connect voluntary drain to worker quiescence and checkpoint acknowledgement.
Bound any safe-to-evict protection by active attempt state.
Remove completed Pods and their reservations promptly.
Rehearse Spot notice and abrupt loss separately without assuming equal grace.

Boundary and interface obligations

Input preparation: construct the package fixture from active task, completed task with stale annotation, real notice simulation, and abrupt node loss.
Output contract: Completed swarm work releases Pods and permits idle eligible nodes to scale down.
Rejection contract: A permanently protected idle Pod is detected as a defect rather than accepted as persistence.
Recovery contract: An interruption shorter than the configured Pod grace reports the last durable checkpoint honestly.
Mutation scope: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CAP-05-A.
Negative case: T-SV2-CAP-05-B.
Recovery case: T-SV2-CAP-05-C.
Package-specific measurements: protected_idle_execution_seconds.
Evidence record: evidence/SV2-CAP-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable the canary capacity policy and retain on-demand execution while drain handling is repaired.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CAP-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream SEC: Scoped credentials and execution containment

Implementation owner: antoncore. Integration target: G3. Mutation boundary: Grant only the authority needed by each actor; worker self-report never widens that grant. Baseline references: SRC-K8S-RBAC SRC-ANTON-JOIN

SV2-SEC-01: Create minimal controller and worker RBAC

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-KUB-05, SV2-IDN-05.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: k8s/manifests/swarm/rbac.yaml (new); k8s/charts/swarm-control/values.yaml (new).
Required fixture: Controller, worker, operator-viewer, and unrelated service-account credentials.
Intended change: Separate control-plane object management from coding-worker permissions.

Implementation sequence

Grant controller access only to managed namespace resources and required verbs.
Disable worker service-account automount by default.
Deny ordinary workers permission to read Secrets or create Pods.
Test all operator and worker actions against the exact service accounts.

Boundary and interface obligations

Input preparation: construct the package fixture from controller, worker, operator-viewer, and unrelated service-account credentials.
Output contract: The controller can manage its execution Pods while the worker cannot enumerate unrelated Secrets or mutate deployments.
Rejection contract: A coding task that runs kubectl with an inherited token finds no unintended cluster authority.
Recovery contract: Credential rotation preserves controller discovery without broadening its Role.
Mutation scope: Grant only the authority needed by each actor; worker self-report never widens that grant.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-SEC-01-A.
Negative case: T-SV2-SEC-01-B.
Recovery case: T-SV2-SEC-01-C.
Package-specific measurements: rbac_denied_operations_total.
Evidence record: evidence/SV2-SEC-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore the previous role binding from a reviewed manifest and pause new launches during access repair.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-SEC-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-SEC-02: Deliver one selected provider account per attempt

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-SEC-01.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: k8s/manifests/swarm/external-secret.yaml (new); scripts/worker-secret-policy.md (new).
Required fixture: Two provider accounts, one admitted worker, and a forbidden secret-reference override.
Intended change: Prevent all-account secret bundles from reaching every coding agent.

Implementation sequence

Reuse the existing secret delivery mechanism with per-account key selection.
Bind the selected secret reference to admitted execution metadata.
Keep account labels visible but token values absent from logs and Pod annotations.
Verify the image does not contain residual build credentials.

Boundary and interface obligations

Input preparation: construct the package fixture from two provider accounts, one admitted worker, and a forbidden secret-reference override.
Output contract: A worker can authenticate only the selected account and its narrowly scoped service integrations.
Rejection contract: A task cannot request another account by altering environment fields in its launch body.
Recovery contract: Rotated credentials are picked up through the approved refresh or drain policy rather than an uncontrolled fleet restart.
Mutation scope: Grant only the authority needed by each actor; worker self-report never widens that grant.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-SEC-02-A.
Negative case: T-SV2-SEC-02-B.
Recovery case: T-SV2-SEC-02-C.
Package-specific measurements: worker_secret_scope_violations.
Evidence record: evidence/SV2-SEC-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Revoke the attempted grant and retain prior valid account bindings for unaffected executions.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-SEC-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-SEC-03: Constrain network reachability

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-SEC-02.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: k8s/manifests/swarm/network-policy.yaml (new); docs/swarm-v2-network.md (new).
Required fixture: Allowed service set, denied metadata route, denied production endpoint, and rotated DNS target.
Intended change: Permit required services without granting workers unrestricted private infrastructure access.

Implementation sequence

Enumerate control, ledger, archive, brain, source hosting, provider, and build endpoints logically.
Apply namespace and egress policy supported by the actual network implementation.
Test metadata access and restricted production endpoints from a real canary.
Record unsupported enforcement gaps rather than assuming policies are enforced.

Boundary and interface obligations

Input preparation: construct the package fixture from allowed service set, denied metadata route, denied production endpoint, and rotated DNS target.
Output contract: The canary reaches required endpoints and cannot reach denied metadata or unrelated private services.
Rejection contract: A NetworkPolicy object existing without effective enforcement does not pass acceptance.
Recovery contract: A DNS or endpoint rotation can be applied without replacing data-scope authorization.
Mutation scope: Grant only the authority needed by each actor; worker self-report never widens that grant.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-SEC-03-A.
Negative case: T-SV2-SEC-03-B.
Recovery case: T-SV2-SEC-03-C.
Package-specific measurements: worker_denied_network_attempts.
Evidence record: evidence/SV2-SEC-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore the preceding policy and reduce admission while reachability defects are corrected.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-SEC-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-SEC-04: Secure operator terminal attachment

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-SEC-03.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: k8s/manifests/swarm/terminal-auth.yaml (new); docs/swarm-v2-terminal-auth.md (new).
Required fixture: Valid operator certificate, expired certificate, untrusted server, and replaced execution endpoint.
Intended change: Give the operator interactive visibility without sharing cluster or host administration credentials.

Implementation sequence

Issue dedicated attach credentials or short-lived certificates.
Verify server identity through a trusted host mechanism.
Restrict attachment to authorized execution endpoints and record audit IDs.
Revoke access when the attempt retires.

Boundary and interface obligations

Input preparation: construct the package fixture from valid operator certificate, expired certificate, untrusted server, and replaced execution endpoint.
Output contract: An authorized operator attaches to the correct execution while a stale credential cannot attach to a replacement.
Rejection contract: Unknown or changed server identity is not silently accepted to restore convenience.
Recovery contract: Certificate renewal preserves a live agent and reconnects without reinstalling herdr.
Mutation scope: Grant only the authority needed by each actor; worker self-report never widens that grant.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-SEC-04-A.
Negative case: T-SV2-SEC-04-B.
Recovery case: T-SV2-SEC-04-C.
Package-specific measurements: terminal_attach_authorization_total.
Evidence record: evidence/SV2-SEC-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable attachment or restore prior trusted issuance configuration without terminating task processes.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-SEC-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-SEC-05: Protect archives and brain data by scope

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-SEC-04.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: k8s/manifests/swarm/data-grants.yaml (new); k8s/values-overlays/brain-swarm/ (new).
Required fixture: Separate personal and swarm archives with overlapping display names and session identifiers.
Intended change: Make personal versus swarm isolation enforceable beyond names and namespaces.

Implementation sequence

Use separate storage prefixes and database principals for each data boundary.
Grant exporters append-only access to their admitted corpus scope.
Grant brain extraction read access only to authorized projects.
Encrypt native-resume material separately when its sensitivity exceeds searchable evidence.

Boundary and interface obligations

Input preparation: construct the package fixture from separate personal and swarm archives with overlapping display names and session identifiers.
Output contract: A swarm worker cannot read personal sessions even when it guesses a known native session ID.
Rejection contract: Changing a request brain_id or archive key does not bypass backend authorization.
Recovery contract: Revoking a project grant invalidates subsequent reads and cached context derived from that grant.
Mutation scope: Grant only the authority needed by each actor; worker self-report never widens that grant.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-SEC-05-A.
Negative case: T-SV2-SEC-05-B.
Recovery case: T-SV2-SEC-05-C.
Package-specific measurements: cross_scope_access_rejections_total.
Evidence record: evidence/SV2-SEC-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore only the reviewed previous grants and keep denied data private during recovery.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-SEC-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream FSY: Private runtime homes, worktrees, and artifact locality

Implementation owner: agentihooks. Integration target: G3. Mutation boundary: Local working files remain attempt-private; durable shared data has explicit scope and ownership. Baseline references: SRC-AH-SNAPSHOT

SV2-FSY-01: Define the execution filesystem layout

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-IMG-05, SV2-IDN-05.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: docker/swarm-node/layout.json (new); scripts/swarm_v2/filesystem.py (new).
Required fixture: Two isolated execution roots plus symlink and relative-path escape fixtures.
Intended change: Give every process a stable private path contract that does not rely on the personal machine.

Implementation sequence

Allocate private home, runtime, checkout, worktree, spool, and scratch roots.
Separate immutable profile seeds from writable CLI state.
Validate containment after symlink resolution.
Include path mappings in launch and recovery metadata.

Boundary and interface obligations

Input preparation: construct the package fixture from two isolated execution roots plus symlink and relative-path escape fixtures.
Output contract: Two Pods can use the same internal path names without sharing mutable CLI files or Unix sockets.
Rejection contract: A profile or archive extraction that resolves outside its execution root is rejected.
Recovery contract: Recreating an attempt restores documented paths from metadata rather than from an old node’s absolute path.
Mutation scope: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-FSY-01-A.
Negative case: T-SV2-FSY-01-B.
Recovery case: T-SV2-FSY-01-C.
Package-specific measurements: execution_path_validation_failures.
Evidence record: evidence/SV2-FSY-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Retain old layout readers and stop new launches when a layout version cannot be restored.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-FSY-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-FSY-02: Prepare local repository mirrors and worktrees

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-FSY-01.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/workspaces.py (new); profiles/package/skills/worktree/.
Required fixture: Correct mirror, wrong-origin mirror, stale base, and concurrent worktree preparation.
Intended change: Reuse existing development-cycle branch rules while keeping cloud Git I/O local.

Implementation sequence

Clone or fetch a verified repository into the worker-local cache.
Create the task worktree from the intended fresh base commit.
Preserve canonical branch naming through the existing naming helper.
Record the base commit and origin identity before the first edit.

Boundary and interface obligations

Input preparation: construct the package fixture from correct mirror, wrong-origin mirror, stale base, and concurrent worktree preparation.
Output contract: An agent begins in an isolated worktree tied to the correct project and task generation.
Rejection contract: A cached repository with a mismatched origin cannot be reused based on its folder name alone.
Recovery contract: A fetch failure leaves the prior cache untouched and does not start work from an unverified stale base.
Mutation scope: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-FSY-02-A.
Negative case: T-SV2-FSY-02-B.
Recovery case: T-SV2-FSY-02-C.
Package-specific measurements: workspace_prepare_seconds.
Evidence record: evidence/SV2-FSY-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable cache reuse and use a fresh local clone while keeping archive references valid.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-FSY-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-FSY-03: Control caches and build storage

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-FSY-02.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: docker/swarm-node/cache-policy.json (new); scripts/swarm_v2/cache.py (new).
Required fixture: Trusted cache, poisoned executable entry, full disk, and mismatched dependency lock.
Intended change: Reduce repeated downloads without turning caches into shared authoritative state.

Implementation sequence

Define cache keys by toolchain, dependency lock, platform, and trust scope.
Keep writable per-attempt cache layers distinct from reusable read-only seeds.
Bound disk consumption and garbage collection.
Never include credential files or mutable session databases in general caches.

Boundary and interface obligations

Input preparation: construct the package fixture from trusted cache, poisoned executable entry, full disk, and mismatched dependency lock.
Output contract: Two compatible tasks reuse a dependency cache while keeping native conversations and credentials separate.
Rejection contract: A cache from an untrusted project cannot replace executable toolchain content in another scope.
Recovery contract: Corrupt cache content is discarded and rebuilt without deleting the task’s source changes.
Mutation scope: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-FSY-03-A.
Negative case: T-SV2-FSY-03-B.
Recovery case: T-SV2-FSY-03-C.
Package-specific measurements: cache_hit_rate and cache_corruption_total.
Evidence record: evidence/SV2-FSY-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Turn cache reuse off and preserve all authoritative workspace and archive material.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-FSY-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-FSY-04: Implement a backend-neutral artifact adapter

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-FSY-03.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/artifacts/base.py (new); scripts/swarm_v2/artifacts/local.py (new); scripts/swarm_v2/artifacts/object_store.py (new).
Required fixture: Local durable directory and object-store fake with injected truncated uploads.
Intended change: Support existing durable storage without forcing every worker to share a writable home.

Implementation sequence

Define put, stat, get-range, commit-manifest, and delete-if-unreferenced operations.
Verify checksums and sizes independently of transport success.
Support local filesystem and configured object storage under one contract.
Keep operational endpoints external to the package.

Boundary and interface obligations

Input preparation: construct the package fixture from local durable directory and object-store fake with injected truncated uploads.
Output contract: An uploaded artifact can be verified and retrieved by its immutable content reference through either supported backend.
Rejection contract: A transport acknowledgement with mismatched content hash is not accepted as durability proof.
Recovery contract: Retrying a completed upload with the same artifact ID returns the committed object without duplication.
Mutation scope: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-FSY-04-A.
Negative case: T-SV2-FSY-04-B.
Recovery case: T-SV2-FSY-04-C.
Package-specific measurements: artifact_upload_verification_failures.
Evidence record: evidence/SV2-FSY-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep existing backend objects immutable and switch only future manifest publication to the previous adapter.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-FSY-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-FSY-05: Prevent unsafe shared filesystem assumptions

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-FSY-04.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: docs/swarm-v2/storage-policy.md (new); tests/contracts/storage_layout/ (new).
Required fixture: Safe read-only seed, safe scoped artifact mount, and unsafe shared mutable native home.
Intended change: Permit useful shared storage while excluding cross-process identity corruption.

Implementation sequence

Validate that native CLI runtime roots are attempt-private.
Permit read-only configuration and explicitly owned checkpoint/artifact mounts.
Benchmark cloud-to-on-prem artifact throughput and failure behavior.
Document per-execution persistent subdirectory alternatives without declaring all NFS unsafe.

Boundary and interface obligations

Input preparation: construct the package fixture from safe read-only seed, safe scoped artifact mount, and unsafe shared mutable native home.
Output contract: A deployment with shared artifact storage and private runtime homes passes while a shared writable Codex home fails policy validation.
Rejection contract: Mounting the entire operator home into all workers is refused by the template checker.
Recovery contract: Loss of shared artifact storage degrades checkpoint publication without corrupting local worktrees.
Mutation scope: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-FSY-05-A.
Negative case: T-SV2-FSY-05-B.
Recovery case: T-SV2-FSY-05-C.
Package-specific measurements: shared_runtime_mount_rejections_total.
Evidence record: evidence/SV2-FSY-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Return to private local execution with artifact publishing paused until the backend is healthy.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-FSY-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream CKP: Durable checkpoints and truthful recovery

Implementation owner: agentihooks. Integration target: G8. Mutation boundary: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified. Baseline references: SRC-AH-SNAPSHOT

SV2-CKP-01: Define checkpoint manifests and completeness rules

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-FSY-05, SV2-CTL-05.
Integration gate: G8, subject to all earlier applicable acceptance gates.
Owned path candidates: docs/swarm-v2/schemas/checkpoint.json (new); scripts/swarm_v2/checkpoints/model.py (new).
Required fixture: Complete native-resume bundle, context-only bundle, and path-only legacy snapshot.
Intended change: Replace path-only recovery assumptions with a portable verified artifact contract.

Implementation sequence

List source base, branch state, native resume material, normalized watermark, and exclusions.
Record harness, image, schema, task revision, and execution generation.
Distinguish complete, incomplete, and diagnostic-only manifests.
Define required object hashes and manifest commit semantics.

Boundary and interface obligations

Input preparation: construct the package fixture from complete native-resume bundle, context-only bundle, and path-only legacy snapshot.
Output contract: A manifest validator can determine whether native resume or only context continuation is supported without reading a dead worker filesystem.
Rejection contract: A conversation ID and old worktree path alone cannot produce a complete checkpoint.
Recovery contract: Loading an older supported manifest preserves known limitations instead of guessing missing materials.
Mutation scope: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CKP-01-A.
Negative case: T-SV2-CKP-01-B.
Recovery case: T-SV2-CKP-01-C.
Package-specific measurements: checkpoint_completeness_by_reason.
Evidence record: evidence/SV2-CKP-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep earlier manifest readers and disable new checkpoint promotion if the version is unsupported.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CKP-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-CKP-02: Capture committed and uncommitted source state

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CKP-01.
Integration gate: G8, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/checkpoints/git_capture.py (new); scripts/swarm/snapshot.py.
Required fixture: Worktree with both index and working-tree changes plus one allowed and one prohibited untracked file.
Intended change: Preserve useful work not yet present in the remote repository.

Implementation sequence

Record the exact Git base and head.
Capture staged and unstaged patches separately.
Archive allowed untracked files with containment and size limits.
Exclude caches and secrets while recording the exclusion policy.

Boundary and interface obligations

Input preparation: construct the package fixture from worktree with both index and working-tree changes plus one allowed and one prohibited untracked file.
Output contract: A restored worktree reproduces committed, staged, unstaged, and permitted untracked changes from a stopped attempt.
Rejection contract: An untracked credential file or archive path escape is excluded or rejected with a sanitized reason.
Recovery contract: Interrupted capture publishes no complete manifest and leaves the previous checkpoint current.
Mutation scope: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CKP-02-A.
Negative case: T-SV2-CKP-02-B.
Recovery case: T-SV2-CKP-02-C.
Package-specific measurements: checkpoint_source_bytes.
Evidence record: evidence/SV2-CKP-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Retain the previous complete source checkpoint and preserve incomplete capture for diagnostics.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CKP-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-CKP-03: Capture provider-native resume artifacts safely

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CKP-02.
Integration gate: G8, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/checkpoints/native.py (new); tests/integration/native_resume/ (new).
Required fixture: Claude and Codex test sessions, changed native format, and active-database capture attempts.
Intended change: Qualify real conversation resumption separately for each installed CLI.

Implementation sequence

Discover the supported native conversation artifacts for the pinned target version.
Read a mutable database in one read-only transaction that never waits on a writer’s lock; a held lock reports database_busy, and the database itself is not carried because the CLI rebuilds it from its conversation files.
Exclude account authentication state from the portable bundle.
Run a fresh-container native-resume proof with the intended account and project.

Boundary and interface obligations

Input preparation: construct the package fixture from claude and Codex test sessions, changed native format, and active-database capture attempts.
Output contract: A supported harness reopens the expected native conversation from a validated checkpoint and reports its identity.
Rejection contract: A normalized summary or arbitrary database copy is not labelled a successful native resume.
Recovery contract: An unsupported version yields native_resume_unavailable and preserves the operator’s continue-or-fresh decision.
Mutation scope: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CKP-03-A.
Negative case: T-SV2-CKP-03-B.
Recovery case: T-SV2-CKP-03-C.
Package-specific measurements: native_resume_success_by_target.
Evidence record: evidence/SV2-CKP-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep context-based continuation available while native resume qualification is disabled.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CKP-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-CKP-04: Publish checkpoints atomically and periodically

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CKP-03.
Integration gate: G8, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/checkpoints/publisher.py (new); scripts/swarm_v2/worker/supervisor.py (new).
Required fixture: Lost acknowledgements at each upload and manifest commit boundary.
Intended change: Reduce interruption loss while preventing partially uploaded state from replacing valid recovery material.

Implementation sequence

Upload objects under immutable checkpoint IDs.
Verify object hashes before committing the manifest.
Compare-and-update the latest pointer under task generation, refusing a checkpoint_sequence at or below the pointer’s within the same attempt (field published by SV2-FND-03).
Run periodic capture with bounded overhead and a separate emergency drain budget.

Boundary and interface obligations

Input preparation: construct the package fixture from lost acknowledgements at each upload and manifest commit boundary.
Output contract: A complete checkpoint pointer never references a missing or unverified required object.
Rejection contract: A stale worker cannot promote a checkpoint over the current generation’s pointer.
Recovery contract: Failure after object upload but before manifest commit leaves safely reclaimable orphan objects and the old checkpoint intact.
Mutation scope: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CKP-04-A.
Negative case: T-SV2-CKP-04-B.
Recovery case: T-SV2-CKP-04-C.
Package-specific measurements: checkpoint_age_seconds and checkpoint_publish_failures.
Evidence record: evidence/SV2-CKP-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Stop periodic promotion and retain the last complete manifest until the publisher is repaired.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CKP-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-CKP-05: Implement fenced restore decisions and validation

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CKP-04.
Integration gate: G8, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm/resume.py; scripts/swarm_v2/checkpoints/restore.py (new); scripts/swarm_ledger/ledger_server.py.
Required fixture: Valid checkpoint, corrupt object, unsupported harness version, and duplicated restore request.
Intended change: Recover elsewhere without hiding whether continuity was native, reconstructed, or fresh.

Implementation sequence

Fence the old generation and reserve a replacement execution.
Validate manifest compatibility and materialize source plus native state.
Verify the expected conversation identity before declaring resume.
Require explicit master/operator choice when only context continuation or fresh start is available.

Boundary and interface obligations

Input preparation: construct the package fixture from valid checkpoint, corrupt object, unsupported harness version, and duplicated restore request.
Output contract: A lost worker recovers exactly one new attempt and the ledger identifies its recovery type and durable watermark.
Rejection contract: Failed native resume cannot silently clear the prior task claim and mark a fresh conversation as resumed.
Recovery contract: A second restore attempt reuses the accepted decision and checkpoint without spawning duplicate replacements.
Mutation scope: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CKP-05-A.
Negative case: T-SV2-CKP-05-B.
Recovery case: T-SV2-CKP-05-C.
Package-specific measurements: restore_outcomes_by_type.
Evidence record: evidence/SV2-CKP-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Pause restore automation while keeping checkpoint artifacts and awaiting-decision task states intact.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CKP-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream ACC: Fleet-wide sessions, quota reservations, and broadcasts

Implementation owner: agentihooks. Integration target: G3. Mutation boundary: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence. Baseline references: SRC-AH-STORE SRC-AH-GUIDE

SV2-ACC-01: Replace fleet liveness with scoped registry records

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CTL-05, SV2-IDN-05.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/terminate_agent.py; hooks/context/broadcast.py; scripts/swarm_v2/registry.py (new).
Required fixture: Two machines with PID collisions and one legitimate renamed agent alias.
Intended change: Stop treating Anton’s local process table as proof of all remote agents.

Implementation sequence

Register execution-scoped sessions with heartbeat and native conversation metadata.
Keep terminal and process observations attached to the owning backend.
Mark stale records suspect rather than deleting them lazily on another host’s PID lookup.
Preserve aliases from the existing naming system.

Boundary and interface obligations

Input preparation: construct the package fixture from two machines with PID collisions and one legitimate renamed agent alias.
Output contract: Local and remote sessions coexist in one registry without removing each other because their PIDs are not locally visible.
Rejection contract: A remote session cannot register as the swarm master solely through its chosen name.
Recovery contract: Registry recovery from persisted state preserves old aliases and current ownership generations.
Mutation scope: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-ACC-01-A.
Negative case: T-SV2-ACC-01-B.
Recovery case: T-SV2-ACC-01-C.
Package-specific measurements: fleet_registry_stale_records.
Evidence record: evidence/SV2-ACC-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Continue local-only registry reads while distributed launches are disabled.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-ACC-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-ACC-02: Reserve provider-account capacity atomically

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-ACC-01.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/context/account_sessions.py; scripts/swarm_v2/accounts.py (new).
Required fixture: One account with one remaining slot and two simultaneous launch requests.
Intended change: Make authorized session caps meaningful across the entire fleet.

Implementation sequence

Separate launch reservations from active session occupancy.
Atomically reserve an account slot with an expiry before launch.
Convert reservation to occupancy after confirmed target registration.
Release only matching holder/generation on completion or classified failure.

Boundary and interface obligations

Input preparation: construct the package fixture from one account with one remaining slot and two simultaneous launch requests.
Output contract: Two concurrent controllers cannot both allocate the last available account slot.
Rejection contract: A stale attempt cannot free a slot currently held by its replacement.
Recovery contract: A worker that never starts releases its bounded reservation without being counted as a live account session forever.
Mutation scope: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-ACC-02-A.
Negative case: T-SV2-ACC-02-B.
Recovery case: T-SV2-ACC-02-C.
Package-specific measurements: account_reservation_conflicts_total.
Evidence record: evidence/SV2-ACC-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Freeze new distributed reservations and reconstruct occupancy from current confirmed execution records.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-ACC-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-ACC-03: Aggregate quota observations without credential leakage

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-ACC-02.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/context/quota_policy.py; scripts/swarm_v2/quota.py (new).
Required fixture: Stale full-quota report arriving after a newer exhausted-quota observation.
Intended change: Preserve existing routing policy while collecting quota evidence from the correct account across machines.

Implementation sequence

Publish quota observations with account ID, harness, source execution, and observed time.
Ignore stale observations after a newer supported measurement.
Keep provider quotas distinct from infrastructure and operator budgets.
Apply only authorized account routing and never infer unlimited use from more nodes.

Boundary and interface obligations

Input preparation: construct the package fixture from stale full-quota report arriving after a newer exhausted-quota observation.
Output contract: The fleet routes new work using the newest valid observation for the selected account.
Rejection contract: Missing quota data is labelled unknown rather than converted to full available capacity.
Recovery contract: A provider outage leads to bounded wait or configured handoff without repeated unbounded agent starts.
Mutation scope: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-ACC-03-A.
Negative case: T-SV2-ACC-03-B.
Recovery case: T-SV2-ACC-03-C.
Package-specific measurements: quota_observation_age_seconds.
Evidence record: evidence/SV2-ACC-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Return to conservative account admission while keeping previously recorded quota history.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-ACC-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-ACC-04: Move broadcast coordination off shared mutable JSON

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-ACC-03.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/context/broadcast.py; hooks/mcp/channels.py; scripts/swarm_v2/broadcasts.py (new).
Required fixture: Local and remote subscribers, expired warning, personal message, and duplicate delivery acknowledgement.
Intended change: Deliver cluster-wide messages while preserving per-session targeting and deduplication.

Implementation sequence

Store canonical broadcasts and delivery state under scoped Redis keys.
Keep local files as an explicit local compatibility cache rather than global authority.
Include fleet, project, target role, content revision, and expiry in routing.
Preserve severity and authorized shared-warning semantics.

Boundary and interface obligations

Input preparation: construct the package fixture from local and remote subscribers, expired warning, personal message, and duplicate delivery acknowledgement.
Output contract: A critical authorized swarm warning reaches local and remote subscribed agents once per configured delivery policy.
Rejection contract: A personal-brain message or another fleet’s warning is not delivered by matching only the channel name.
Recovery contract: Reconnecting workers replay unexpired undelivered messages without duplicating acknowledged content.
Mutation scope: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-ACC-04-A.
Negative case: T-SV2-ACC-04-B.
Recovery case: T-SV2-ACC-04-C.
Package-specific measurements: broadcast_delivery_lag_seconds.
Evidence record: evidence/SV2-ACC-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable distributed publication and preserve the canonical event history for later reconciliation.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-ACC-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-ACC-05: Reconcile reservations, sessions, and process exits

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-ACC-04.
Integration gate: G3, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/reconciliation/accounts.py (new); scripts/swarm/status.py.
Required fixture: Half-completed handoff, orphan reservation, live worker with lost terminal, and delayed exit event.
Intended change: Prevent leaked slots or optimistic accounting after crashes and handoffs.

Implementation sequence

Compare admitted reservations with confirmed execution and conversation records.
Keep waiting-quota agents distinct from terminated sessions.
Detect orphan occupancy and require classified evidence before release.
Expose discrepancies in status rather than silently correcting risky cases.

Boundary and interface obligations

Input preparation: construct the package fixture from half-completed handoff, orphan reservation, live worker with lost terminal, and delayed exit event.
Output contract: A completed handoff releases the old slot only after the successor route is confirmed.
Rejection contract: An SSH failure alone does not free an account slot and admit a duplicate worker.
Recovery contract: A controller restart reconciles expired reservations and live occupancy without reading remote process environments centrally.
Mutation scope: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-ACC-05-A.
Negative case: T-SV2-ACC-05-B.
Recovery case: T-SV2-ACC-05-C.
Package-specific measurements: account_occupancy_discrepancies.
Evidence record: evidence/SV2-ACC-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Run discrepancy reporting in observe-only mode while preserving conservative caps.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-ACC-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream SES: Provider-neutral incremental transcript capture

Implementation owner: agentihooks. Integration target: G4. Mutation boundary: Source evidence is normalized once and acknowledged only after durable acceptance. Baseline references: SRC-AH-READER

SV2-SES-01: Extract reusable record normalization without whole-file coupling

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-IDN-05, SV2-FSY-05.
Integration gate: G4, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/memory/transcript_reader.py; hooks/targets/normalizer.py; hooks/memory/records.py (new).
Required fixture: Claude, Codex, and Copilot examples containing text, tools, completion markers, and injected context.
Intended change: Reuse existing Claude/Codex/Copilot understanding without repeatedly loading entire growing files.

Implementation sequence

Separate record normalization from file discovery and whole-file reading.
Preserve existing consumers through a compatibility iterator.
Expose state needed to avoid duplicate assistant completion events.
Keep provider-specific decoding in adapters rather than in the shared collector.

Boundary and interface obligations

Input preparation: construct the package fixture from claude, Codex, and Copilot examples containing text, tools, completion markers, and injected context.
Output contract: Existing marker and memory consumers produce equivalent normalized records while a new stream consumer can process incrementally.
Rejection contract: A system-injected context record cannot become a new human instruction through normalization.
Recovery contract: Restarting an incremental consumer with saved turn state avoids counting the same completion twice.
Mutation scope: Source evidence is normalized once and acknowledged only after durable acceptance.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-SES-01-A.
Negative case: T-SV2-SES-01-B.
Recovery case: T-SV2-SES-01-C.
Package-specific measurements: normalized_record_mismatch_total.
Evidence record: evidence/SV2-SES-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep the prior whole-file public API available while disabling only the new streaming path.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-SES-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-SES-02: Implement byte-safe tailing and durable cursors

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-SES-01.
Integration gate: G4, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/memory/collector.py (new); hooks/memory/cursors.py (new).
Required fixture: UTF-8 boundary split, partial final line, rotated file, truncated file, and appended first line.
Intended change: Avoid missing complete appended lines and avoid consuming incomplete trailing JSON.

Implementation sequence

Read bytes and decode only complete newline-terminated records.
Persist source generation and accepted offset separately from speculative read position.
Handle file truncation, replacement, and rotation.
Keep an incomplete trailing record for the next poll.

Boundary and interface obligations

Input preparation: construct the package fixture from uTF-8 boundary split, partial final line, rotated file, truncated file, and appended first line.
Output contract: Appending one complete JSONL line after a saved newline boundary ingests that exact line once.
Rejection contract: A partial Unicode or JSON record does not advance the committed cursor.
Recovery contract: Restart during a partial write resumes from the last durable offset and later ingests the completed record.
Mutation scope: Source evidence is normalized once and acknowledged only after durable acceptance.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-SES-02-A.
Negative case: T-SV2-SES-02-B.
Recovery case: T-SV2-SES-02-C.
Package-specific measurements: transcript_cursor_replays_total.
Evidence record: evidence/SV2-SES-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Stop the new collector and retain cursor/version metadata so a controlled replay can rebuild projections.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-SES-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-SES-03: Implement an execution-local durable spool

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-SES-02.
Integration gate: G4, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/memory/spool.py (new); docker/swarm-node/supervisor.py (new).
Required fixture: Destination unavailable until spool reaches its warning threshold, then recovers.
Intended change: Buffer upload outages without blocking every tool call or pretending ephemeral bytes are durable remotely.

Implementation sequence

Write records to an append-only local spool with checksummed batches.
Bound spool size and define backpressure thresholds.
Separate locally buffered and centrally acknowledged watermarks.
Flush periodically and during controlled shutdown.

Boundary and interface obligations

Input preparation: construct the package fixture from destination unavailable until spool reaches its warning threshold, then recovers.
Output contract: A temporary ingestion outage preserves locally buffered records and later uploads them without duplication.
Rejection contract: A full spool cannot silently discard the oldest unacknowledged evidence.
Recovery contract: Abrupt worker loss reports the last central watermark rather than claiming the entire local tail survived.
Mutation scope: Source evidence is normalized once and acknowledged only after durable acceptance.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-SES-03-A.
Negative case: T-SV2-SES-03-B.
Recovery case: T-SV2-SES-03-C.
Package-specific measurements: transcript_spool_bytes and archive_lag_seconds.
Evidence record: evidence/SV2-SES-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep unacknowledged spool files and disable expensive indexing while transport recovers.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-SES-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-SES-04: Create idempotent central ingestion

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-SES-03.
Integration gate: G4, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/memory/api/ingest.py (new); hooks/memory/catalog.py (new).
Required fixture: Valid batch, duplicate batch, mixed-scope batch, and crash-after-commit injection.
Intended change: Commit normalized events into the durable corpus with stable cross-worker identities.

Implementation sequence

Validate corpus/project grants before accepting a batch.
Deduplicate by source generation and stable event identity.
Persist event content and cursor transactionally before acknowledging.
Return accepted range and durable watermark with explicit partial-batch errors.

Boundary and interface obligations

Input preparation: construct the package fixture from valid batch, duplicate batch, mixed-scope batch, and crash-after-commit injection.
Output contract: Retrying the same batch from a replacement connection creates one canonical copy of each event.
Rejection contract: A batch mixing unauthorized project events is rejected according to the documented atomicity rule.
Recovery contract: A crash between database commit and response returns the committed watermark on retry.
Mutation scope: Source evidence is normalized once and acknowledged only after durable acceptance.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-SES-04-A.
Negative case: T-SV2-SES-04-B.
Recovery case: T-SV2-SES-04-C.
Package-specific measurements: ingest_duplicate_events_total.
Evidence record: evidence/SV2-SES-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable the new producer while keeping committed events and replay-safe cursors available.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-SES-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-SES-05: Backfill historical provider sessions with provenance

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-SES-04.
Integration gate: G4, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/memory/importer.py (new); scripts/swarm_v2/import_sessions.py (new).
Required fixture: Old Claude transcript, Codex rollout, missing source file, and ambiguous duplicate repository basename.
Intended change: Recover useful past evidence without assigning unknown history to an invented project.

Implementation sequence

Discover approved Claude and Codex source roots explicitly.
Record source installation, importer version, source hash, and known metadata.
Resolve project aliases only where evidence supports them.
Produce a report of missing raw sources and irrecoverable truncated history.

Boundary and interface obligations

Input preparation: construct the package fixture from old Claude transcript, Codex rollout, missing source file, and ambiguous duplicate repository basename.
Output contract: Imported history is searchable with its original source attribution and unknown fields remain explicit.
Rejection contract: A project basename alone cannot grant access to a historical personal transcript.
Recovery contract: Re-running an import resumes by source hash and does not duplicate previously committed sessions.
Mutation scope: Source evidence is normalized once and acknowledged only after durable acceptance.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-SES-05-A.
Negative case: T-SV2-SES-05-B.
Recovery case: T-SV2-SES-05-C.
Package-specific measurements: historical_import_unknown_attribution.
Evidence record: evidence/SV2-SES-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Remove only import-owned projections after preserving a full export and manifest.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-SES-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream IDX: Durable session catalog, embeddings, and evidence search

Implementation owner: agentihooks. Integration target: G4. Mutation boundary: Search projections never replace the durable supporting records and must obey the same authorization. Baseline references: SRC-AH-READER

SV2-IDX-01: Create durable session and record storage

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-SES-05.
Integration gate: G4, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/memory/catalog.py (new); migrations/session_memory/ (new).
Required fixture: Long transcript exceeding preview limits and a deliberately missing archived object.
Intended change: Separate complete evidence from bounded caches and search previews.

Implementation sequence

Add session, event, source, and archive-manifest tables with stable keys.
Store full normalized payload or a verified immutable object reference.
Define retention, revision, and deletion state explicitly.
Keep Redis as coordination/cache rather than the only source corpus.

Boundary and interface obligations

Input preparation: construct the package fixture from long transcript exceeding preview limits and a deliberately missing archived object.
Output contract: A session with more than the legacy preview cap remains fully retrievable after worker deletion.
Rejection contract: A missing archive object causes an evidence-integrity error rather than returning a preview labelled complete.
Recovery contract: Database restart preserves acknowledged records and their exact source ranges.
Mutation scope: Search projections never replace the durable supporting records and must obey the same authorization.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-IDX-01-A.
Negative case: T-SV2-IDX-01-B.
Recovery case: T-SV2-IDX-01-C.
Package-specific measurements: archive_integrity_failures_total.
Evidence record: evidence/SV2-IDX-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep additive tables and switch consumers back without deleting new captured evidence.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-IDX-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-IDX-02: Implement stable turn and tool-evidence chunking

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-IDX-01.
Integration gate: G4, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/memory/chunking.py (new); docs/swarm-v2/schemas/chunk.json (new).
Required fixture: Long tool result, multi-tool turn, appended session, and chunker-version transition.
Intended change: Build search units that preserve supporting context without renumbering the past whenever a session grows.

Implementation sequence

Chunk by semantic turn and bounded tool evidence boundaries.
Derive IDs from source event ranges plus chunker version.
Preserve tool call/result linkage and parent session metadata.
Separate preview text from the full evidence locator.

Boundary and interface obligations

Input preparation: construct the package fixture from long tool result, multi-tool turn, appended session, and chunker-version transition.
Output contract: Appending a new turn does not change IDs or embeddings for unchanged earlier chunks.
Rejection contract: Oversized tool output is bounded for embedding while remaining retrievable under archive policy.
Recovery contract: Rechunking with a new version creates a separate generation that can be validated before cutover.
Mutation scope: Search projections never replace the durable supporting records and must obey the same authorization.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-IDX-02-A.
Negative case: T-SV2-IDX-02-B.
Recovery case: T-SV2-IDX-02-C.
Package-specific measurements: chunks_rebuilt_without_content_change.
Evidence record: evidence/SV2-IDX-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore the prior active chunk generation without changing source record IDs.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-IDX-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-IDX-03: Build a bounded incremental embedding worker

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-IDX-02.
Integration gate: G4, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/memory/embeddings.py (new); hooks/memory/index_worker.py (new).
Required fixture: Append-only growth, dimension mismatch, transient rate limit, and failed middle chunk.
Intended change: Embed only changed content and preserve progress through provider outages.

Implementation sequence

Queue changed chunk references with content hash and embedding model identity.
Batch within configured rate and memory limits.
Commit vectors with model dimension and index generation.
Retry transient failures without marking incomplete sessions fully indexed.

Boundary and interface obligations

Input preparation: construct the package fixture from append-only growth, dimension mismatch, transient rate limit, and failed middle chunk.
Output contract: A newly appended turn generates embeddings only for newly changed chunks.
Rejection contract: Mixed vector dimensions or model families cannot be inserted into one active generation silently.
Recovery contract: After provider recovery, failed chunks resume from durable work state without re-embedding the whole corpus.
Mutation scope: Search projections never replace the durable supporting records and must obey the same authorization.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-IDX-03-A.
Negative case: T-SV2-IDX-03-B.
Recovery case: T-SV2-IDX-03-C.
Package-specific measurements: embedding_backlog_age_seconds.
Evidence record: evidence/SV2-IDX-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep the preceding active index generation and pause the new worker.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-IDX-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-IDX-04: Expose exact and semantic evidence search

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-IDX-03.
Integration gate: G4, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/memory/api/search.py (new); hooks/memory/search.py (new).
Required fixture: Two projects sharing an error phrase, one exact code symbol, and vector outage.
Intended change: Support natural-language recall and exact engineering identifiers within strict scope.

Implementation sequence

Apply authorized corpus and project filters inside retrieval.
Combine lexical and vector candidate sources with explainable rank fusion.
Offer chunk results and optional session grouping separately.
Return stable evidence locators and bounded surrounding-context expansion.

Boundary and interface obligations

Input preparation: construct the package fixture from two projects sharing an error phrase, one exact code symbol, and vector outage.
Output contract: A query finds the expected error string and semantically related prior fix while excluding another project’s similar text.
Rejection contract: An unauthorized project name supplied by the caller does not reveal even result titles or counts.
Recovery contract: Vector service unavailability can produce a labelled lexical-only response rather than a silent empty result.
Mutation scope: Search projections never replace the durable supporting records and must obey the same authorization.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-IDX-04-A.
Negative case: T-SV2-IDX-04-B.
Recovery case: T-SV2-IDX-04-C.
Package-specific measurements: session_search_relevance and session_search_scope_rejections.
Evidence record: evidence/SV2-IDX-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Route search to the prior accepted index generation while keeping capture uninterrupted.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-IDX-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-IDX-05: Integrate session tools and citation-ready expansion

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-IDX-04.
Integration gate: G4, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/memory/server.py; hooks/mcp/; hooks/memory/api/records.py (new).
Required fixture: Search hit, valid range expansion, expired cursor, and revoked source reference.
Intended change: Make the memory bank usable by the swarm without a separate legacy service.

Implementation sequence

Add proposed session_list, session_search, session_get, and record-range expansion surfaces.
Preserve compatible old tool aliases inside agentihooks only where consumers still need them.
Return source timestamps, harness, project, task, and truncation metadata.
Keep search results distinct from provider-native resume commands.

Boundary and interface obligations

Input preparation: construct the package fixture from search hit, valid range expansion, expired cursor, and revoked source reference.
Output contract: A swarm agent retrieves a search hit and then expands the exact supporting record range through the same authorized interface.
Rejection contract: A deleted or revoked evidence reference cannot remain readable through an old compatibility alias.
Recovery contract: Tool-server restart preserves pagination cursors or explicitly expires them without returning a mismatched range.
Mutation scope: Search projections never replace the durable supporting records and must obey the same authorization.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-IDX-05-A.
Negative case: T-SV2-IDX-05-B.
Recovery case: T-SV2-IDX-05-C.
Package-specific measurements: evidence_reference_resolution_failures.
Evidence record: evidence/SV2-IDX-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Hide new tools and keep the underlying archive and accepted compatibility surface read-only.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-IDX-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream MIG: Extract useful search logic and retire the old transcript service

Implementation owner: agentihooks. Integration target: G11. Mutation boundary: Read and migrate historical data; do not recreate the retired service under a new name. Baseline references: SRC-AH-READER SRC-LEGACY-SEARCH

SV2-MIG-01: Inventory search consumers and reusable logic

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-IDX-05.
Integration gate: G11, subject to all earlier applicable acceptance gates.
Owned path candidates: docs/swarm-v2/search-migration.md (new); hooks/memory/compatibility.py (new).
Required fixture: Consumer inventory containing one search caller, one obsolete dispatcher, and one dashboard metric reader.
Intended change: Identify the small useful search components and all callers that would otherwise break at cutover.

Implementation sequence

Review turn chunking, vector storage, and search behavior only as extraction candidates.
Inventory tools, CLIs, dashboards, ingestion jobs, and brain extraction consumers.
Classify each consumer as replace, remove, or temporary alias.
Preserve applicable source attribution for copied code.

Boundary and interface obligations

Input preparation: construct the package fixture from consumer inventory containing one search caller, one obsolete dispatcher, and one dashboard metric reader.
Output contract: Every known caller has a target agentihooks interface or an explicit removal decision.
Rejection contract: Dispatch, registry, and standalone daemon features are not copied just because they share a source module.
Recovery contract: Discovering a late consumer adds a migration item without restoring the retired architecture.
Mutation scope: Read and migrate historical data; do not recreate the retired service under a new name.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-MIG-01-A.
Negative case: T-SV2-MIG-01-B.
Recovery case: T-SV2-MIG-01-C.
Package-specific measurements: migration_unmapped_consumers.
Evidence record: evidence/SV2-MIG-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep replacement aliases disabled until their mapping has been validated.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-MIG-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-MIG-02: Audit source fidelity before migration

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-MIG-01.
Integration gate: G11, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/memory/migrations/audit_sources.py (new); docs/swarm-v2/source-fidelity.md (new).
Required fixture: One complete JSONL, one capped Redis preview, one vector-only record, and one missing source.
Intended change: Establish which historical records are full sources and which are irreversibly truncated projections.

Implementation sequence

Compare surviving raw files with cached previews and vector rows.
Measure missing ranges and capped entries without inventing absent text.
Identify incremental-offset and chunk-renumbering defects through fixtures.
Produce a per-source import confidence and loss report.

Boundary and interface obligations

Input preparation: construct the package fixture from one complete JSONL, one capped Redis preview, one vector-only record, and one missing source.
Output contract: The report identifies full raw history, preview-only history, and missing history separately.
Rejection contract: A preview-only session is never labelled a lossless imported transcript.
Recovery contract: Re-running the audit after additional raw files appear upgrades only the affected source classifications.
Mutation scope: Read and migrate historical data; do not recreate the retired service under a new name.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-MIG-02-A.
Negative case: T-SV2-MIG-02-B.
Recovery case: T-SV2-MIG-02-C.
Package-specific measurements: source_fidelity_classes.
Evidence record: evidence/SV2-MIG-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Revert classification projections while retaining original source hashes and audit evidence.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-MIG-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-MIG-03: Run idempotent backfill into the new corpus

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-MIG-02.
Integration gate: G11, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/memory/migrations/import_legacy.py (new); migrations/session_memory/.
Required fixture: Duplicate source directories, mid-batch interruption, and equal native IDs from different machines.
Intended change: Populate the replacement catalog with stable provenance and replay-safe identities.

Implementation sequence

Import from the highest-fidelity surviving source per session.
Preserve native IDs while adding installation and corpus namespaces.
Record the importer version and source digest.
Separate unknown project attribution from verified aliases.

Boundary and interface obligations

Input preparation: construct the package fixture from duplicate source directories, mid-batch interruption, and equal native IDs from different machines.
Output contract: A second import pass creates no duplicate events and preserves original timestamps and source references.
Rejection contract: Conflicting source content under the same source digest or event identity is quarantined.
Recovery contract: An interrupted import resumes at its durable batch checkpoint and reports remaining work.
Mutation scope: Read and migrate historical data; do not recreate the retired service under a new name.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-MIG-03-A.
Negative case: T-SV2-MIG-03-B.
Recovery case: T-SV2-MIG-03-C.
Package-specific measurements: legacy_import_remaining_records.
Evidence record: evidence/SV2-MIG-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep imported objects tagged by migration run so projections can be deactivated without deleting source backups.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-MIG-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-MIG-04: Run shadow search and consumer cutover

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-MIG-03.
Integration gate: G11, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/memory/compatibility.py (new); docs/swarm-v2/cutover-report.md (new).
Required fixture: Historical engineering questions with manually verified expected sessions and source ranges.
Intended change: Demonstrate useful equivalence before replacing the old search endpoint.

Implementation sequence

Replay a fixed set of operator memory-bank questions against the replacement.
Compare relevant source ranges rather than demanding identical ranking numbers.
Switch consumers through versioned endpoint configuration.
Keep aliases inside agentihooks with an explicit removal deadline.

Boundary and interface obligations

Input preparation: construct the package fixture from historical engineering questions with manually verified expected sessions and source ranges.
Output contract: The replacement answers the agreed queries with resolvable evidence and no unauthorized results.
Rejection contract: A consumer that can search but cannot expand the cited source range does not pass cutover.
Recovery contract: Endpoint rollback keeps new capture running and does not discard evidence collected during shadow mode.
Mutation scope: Read and migrate historical data; do not recreate the retired service under a new name.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-MIG-04-A.
Negative case: T-SV2-MIG-04-B.
Recovery case: T-SV2-MIG-04-C.
Package-specific measurements: shadow_search_source_recall.
Evidence record: evidence/SV2-MIG-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore the last accepted consumer route while repairing the replacement read path.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-MIG-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-MIG-05: Prove retirement completion and archive ownership

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-MIG-04.
Integration gate: G11, subject to all earlier applicable acceptance gates.
Owned path candidates: docs/swarm-v2/retirement-checklist.md (new); tests/contracts/no_retired_runtime.py (new).
Required fixture: Replacement-only deployment with every retired endpoint deliberately unreachable.
Intended change: End with no deployed dependence on the old transcript service.

Implementation sequence

Remove retired service references from active replacement manifests and tool configuration.
Verify no background collector or dispatcher remains scheduled.
Transfer archive retention and backup ownership explicitly.
Preserve a read-only historical backup until the operator accepts its disposal.

Boundary and interface obligations

Input preparation: construct the package fixture from replacement-only deployment with every retired endpoint deliberately unreachable.
Output contract: Active execution, memory search, and brain extraction run with the retired service unavailable and absent from target manifests.
Rejection contract: A hidden fallback to the retired endpoint fails the retirement integration test.
Recovery contract: Restoring the replacement system from backup does not require starting the retired service.
Mutation scope: Read and migrate historical data; do not recreate the retired service under a new name.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-MIG-05-A.
Negative case: T-SV2-MIG-05-B.
Recovery case: T-SV2-MIG-05-C.
Package-specific measurements: retired_endpoint_requests_total.
Evidence record: evidence/SV2-MIG-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Retain historical data and compatibility documentation without reintroducing the old deployed runtime.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-MIG-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream BRP: Kernel project scoping and issue 89 completion

Implementation owner: agentibrain-kernel. Integration target: G5. Mutation boundary: All knowledge attribution and retrieval must preserve scope from source to final response. Baseline references: SRC-BRAIN-89 SRC-BRAIN-EXTRACT

SV2-BRP-01: Normalize project attribution before arc grouping

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-IDN-05, SV2-SES-05.
Integration gate: G5, subject to all earlier applicable acceptance gates.
Owned path candidates: services/brain-ops/extract.py; services/brain-ops/cluster.py.
Required fixture: Same-project simultaneous unrelated tasks, linked attempts, and a legacy session with no canonical project.
Intended change: Replace basename grouping with canonical project and explicit task provenance.

Implementation sequence

Consume normalized session identity from the versioned session interface.
Prefer explicit task or work-thread IDs when grouping concurrent swarm work.
Use time gaps only as a secondary heuristic when stronger provenance is unavailable.
Preserve branch, worktree, harness, installation, and source sessions.

Boundary and interface obligations

Input preparation: construct the package fixture from same-project simultaneous unrelated tasks, linked attempts, and a legacy session with no canonical project.
Output contract: Concurrent agents in the same repository but on unrelated ledger tasks do not collapse into one arc solely because they ran within two hours.
Rejection contract: Unknown project history remains unattributed rather than being assigned to the current hottest project.
Recovery contract: Replaying a source window produces stable arc membership or a versioned superseding grouping decision.
Mutation scope: All knowledge attribution and retrieval must preserve scope from source to final response.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-BRP-01-A.
Negative case: T-SV2-BRP-01-B.
Recovery case: T-SV2-BRP-01-C.
Package-specific measurements: arc_grouping_ambiguities.
Evidence record: evidence/SV2-BRP-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Retain original source-to-arc mappings and disable the new grouping generation pending review.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-BRP-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-BRP-02: Persist scope on every marker type

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-BRP-01.
Integration gate: G5, subject to all earlier applicable acceptance gates.
Owned path candidates: services/brain-api/app/markers.py; services/brain-ops/outbox_drain.py; services/brain-ops/markers.py.
Required fixture: Four marker types delivered directly and via replay with explicit project/worktree attributes.
Intended change: Keep the project and evidence fields currently supplied by clients instead of dropping them at persistence.

Implementation sequence

Add marker IDs, brain scope, project set, source session, execution, and task references.
Route milestones by project rather than agent display name.
Preserve explicit source timestamps on outbox replay.
Use idempotent process-safe writes for concurrent marker producers.

Boundary and interface obligations

Input preparation: construct the package fixture from four marker types delivered directly and via replay with explicit project/worktree attributes.
Output contract: Lesson, decision, milestone, and signal identity survives direct write, buffered replay, storage, and readback.
Rejection contract: A marker claiming another project is rejected by the authenticated scope even when it contains that project’s name.
Recovery contract: Concurrent duplicate writes produce one canonical marker and a replay acknowledgement.
Mutation scope: All knowledge attribution and retrieval must preserve scope from source to final response.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-BRP-02-A.
Negative case: T-SV2-BRP-02-B.
Recovery case: T-SV2-BRP-02-C.
Package-specific measurements: marker_provenance_loss_total.
Evidence record: evidence/SV2-BRP-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep old marker readers supported while retaining new provenance fields in durable metadata.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-BRP-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-BRP-03: Index individual scoped lessons and decisions

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-BRP-02.
Integration gate: G5, subject to all earlier applicable acceptance gates.
Owned path candidates: services/brain-ops/embed_arcs.py; services/embeddings/src/db.py; migrations/knowledge_scope/ (new).
Required fixture: Long multi-project daily log, late lesson, superseded decision, and an unattributed historical entry.
Intended change: Make every relevant knowledge item searchable without daily-log truncation or metadata loss.

Implementation sequence

Assign a stable ID to each lesson and decision entry.
Store canonical project, scope, arc links, provenance, and current revision in the index.
Update mutable metadata independently from content embeddings.
Add exact filter indexes and migration reports for unknown historical entries.

Boundary and interface obligations

Input preparation: construct the package fixture from long multi-project daily log, late lesson, superseded decision, and an unattributed historical entry.
Output contract: A lesson near the end of a long daily log is retrievable under its correct project with its own source reference.
Rejection contract: A substring match for another repository cannot pass the exact project filter.
Recovery contract: Reindexing resumes after failure without dropping the previously active index generation.
Mutation scope: All knowledge attribution and retrieval must preserve scope from source to final response.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-BRP-03-A.
Negative case: T-SV2-BRP-03-B.
Recovery case: T-SV2-BRP-03-C.
Package-specific measurements: knowledge_items_unindexed.
Evidence record: evidence/SV2-BRP-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep the last accepted index active and preserve all original vault entries.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-BRP-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-BRP-04: Serve per-project feeds and intent

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-BRP-03.
Integration gate: G5, subject to all earlier applicable acceptance gates.
Owned path candidates: services/brain-api/app/feed.py; services/brain-api/app/main.py; services/brain-ops/brain_tick_prompt.py; services/brain-ops/brain_apply.py.
Required fixture: Dominant project with many hot arcs and a quieter project with one cold but active task.
Intended change: Complete the server-side feed contract instead of filtering a global hot set after selection.

Implementation sequence

Rank arcs, lessons, decisions, and project signals within the authorized project.
Include only explicitly shared authorized fleet warnings.
Infer intent per active project while labelling it as inferred.
Return feed revision, freshness, and stable item references.

Boundary and interface obligations

Input preparation: construct the package fixture from dominant project with many hot arcs and a quieter project with one cold but active task.
Output contract: Opening two repositories returns different relevant feeds even when one repository has no arc in the fleet-wide top ten.
Rejection contract: Missing project data returns a scoped empty result rather than unrelated global memory.
Recovery contract: A failed project-intent inference preserves the last labelled stale intent without fabricating a fresh one.
Mutation scope: All knowledge attribution and retrieval must preserve scope from source to final response.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-BRP-04-A.
Negative case: T-SV2-BRP-04-B.
Recovery case: T-SV2-BRP-04-C.
Package-specific measurements: project_feed_cross_scope_failures.
Evidence record: evidence/SV2-BRP-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep the unscoped legacy feed for authorized legacy clients and disable new scoped consumers selectively.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-BRP-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-BRP-05: Close issue 89 through cross-repository acceptance

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-BRP-04.
Integration gate: G5, subject to all earlier applicable acceptance gates.
Owned path candidates: tests/integration/project_scope/ (new); docs/operations/project-scope-migration.md (new).
Required fixture: Two repositories, one linked worktree each, Claude and Codex sessions, and shared fleet warnings.
Intended change: Prove the full source-to-delivery path including both required harnesses.

Implementation sequence

Run checkout and linked-worktree identity scenarios through actual client requests.
Verify direct and replayed markers retain attribution after indexing.
Validate Claude and Codex evidence under the same project contract.
Attach proof to the existing issue rather than creating a duplicate implementation tracker.

Boundary and interface obligations

Input preparation: construct the package fixture from two repositories, one linked worktree each, Claude and Codex sessions, and shared fleet warnings.
Output contract: The issue acceptance suite demonstrates scoped feeds, intent, markers, search, and Codex extraction with no unrelated memory leakage.
Rejection contract: Passing only client-side filtering tests cannot close the kernel issue.
Recovery contract: Rollback to a compatible client preserves newly stored kernel provenance and can reactivate the scoped source later.
Mutation scope: All knowledge attribution and retrieval must preserve scope from source to final response.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-BRP-05-A.
Negative case: T-SV2-BRP-05-B.
Recovery case: T-SV2-BRP-05-C.
Package-specific measurements: issue89_acceptance_cases_passed.
Evidence record: evidence/SV2-BRP-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Reopen the integration gate while keeping additive kernel metadata and source evidence intact.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-BRP-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream GRF: Typed knowledge graph and bounded associative retrieval

Implementation owner: agentibrain-kernel. Integration target: G6. Mutation boundary: Graph expansion may widen relevance only inside the authorized scope of the caller. Baseline references: SRC-BRAIN-ARCS SRC-BRAIN-EMBED

SV2-GRF-01: Create canonical graph entities and relation schema

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-BRP-05.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: services/brain-api/app/graph.py (new); migrations/knowledge_graph/ (new).
Required fixture: Valid arc-lesson link, missing target, inverse pair, and incompatible relation type.
Intended change: Make arcs, lessons, decisions, and evidence addressable without relying on truncated prose.

Implementation sequence

Define stable entity IDs and revisioned provenance links.
Store directed relation type, status, confidence class, and evidence.
Define inverse relation semantics and valid source/target types.
Preserve vault references as a human-readable representation.

Boundary and interface obligations

Input preparation: construct the package fixture from valid arc-lesson link, missing target, inverse pair, and incompatible relation type.
Output contract: An arc can link to its source sessions, attached lessons, and applicable decisions through typed inspectable relations.
Rejection contract: A relation with an unknown endpoint or incompatible entity type is rejected or quarantined.
Recovery contract: Rebuilding graph projections from canonical metadata yields the same valid entity and edge set.
Mutation scope: Graph expansion may widen relevance only inside the authorized scope of the caller.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-GRF-01-A.
Negative case: T-SV2-GRF-01-B.
Recovery case: T-SV2-GRF-01-C.
Package-specific measurements: graph_invalid_relations_total.
Evidence record: evidence/SV2-GRF-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Retain the old read path while keeping new graph tables inactive and source metadata untouched.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-GRF-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-GRF-02: Normalize and migrate existing edge markers

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-GRF-01.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: services/brain-ops/brain_apply.py; services/brain-ops/markers.py; services/brain-ops/scripts/graph_migrate.py (new).
Required fixture: Duplicate markers, contradictory directions, valid multirelation pair, and self-loop.
Intended change: Replace arbitrary pairwise type collapse with evidence-aware relation normalization.

Implementation sequence

Parse existing frontmatter and inline edges into one canonical representation.
Preserve legitimate multiple relations when permitted.
Detect self-links, contradictory direction, duplicate assertions, and unsupported types.
Keep an audit record for every migration decision.

Boundary and interface obligations

Input preparation: construct the package fixture from duplicate markers, contradictory directions, valid multirelation pair, and self-loop.
Output contract: Existing valid parent/child and related links survive migration without losing their meaning or evidence.
Rejection contract: A pair with conflicting causal assertions is not silently resolved by selecting whichever type ranks first.
Recovery contract: Re-running the migrator is idempotent and leaves previously reviewed quarantine decisions intact.
Mutation scope: Graph expansion may widen relevance only inside the authorized scope of the caller.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-GRF-02-A.
Negative case: T-SV2-GRF-02-B.
Recovery case: T-SV2-GRF-02-C.
Package-specific measurements: graph_migration_quarantined_edges.
Evidence record: evidence/SV2-GRF-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore the pre-migration graph projection from its manifest without deleting original vault markers.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-GRF-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-GRF-03: Implement bounded authorized graph expansion

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-GRF-02.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: services/brain-api/app/retrieval/graph.py (new); services/mcp/app/tools/arcs.py.
Required fixture: Cycle, high-degree hub, authorized two-hop lesson, and cross-project forbidden neighbor.
Intended change: Retrieve useful connected history beyond individually ranked vector seeds.

Implementation sequence

Select scoped semantic or lexical seed entities.
Traverse allowed relation types with visited sets, depth cap, node cap, and time budget.
Enforce authorization on every traversed endpoint.
Return an inclusion explanation and evidence path for each neighbor.

Boundary and interface obligations

Input preparation: construct the package fixture from cycle, high-degree hub, authorized two-hop lesson, and cross-project forbidden neighbor.
Output contract: A relevant lesson two permitted edges from a seed is found within the configured budget and its path is shown.
Rejection contract: A high-degree node cannot expose unauthorized neighbor titles or exhaust the entire request budget unchecked.
Recovery contract: A timeout returns a labelled partial result with valid collected evidence and a bounded continuation option.
Mutation scope: Graph expansion may widen relevance only inside the authorized scope of the caller.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-GRF-03-A.
Negative case: T-SV2-GRF-03-B.
Recovery case: T-SV2-GRF-03-C.
Package-specific measurements: graph_nodes_expanded_per_request.
Evidence record: evidence/SV2-GRF-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable expansion and retain scoped seed retrieval while graph defects are repaired.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-GRF-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-GRF-04: Apply supersession and conflict semantics

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-GRF-03.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: services/brain-api/app/retrieval/current_knowledge.py (new); services/brain-ops/brain_apply.py.
Required fixture: Two conflicting lessons, one approved replacement decision, and a cyclic supersession fixture.
Intended change: Prevent old decisions and contradicted lessons from being injected as current rules.

Implementation sequence

Interpret supersedes direction explicitly and detect cycles.
Keep historical versions retrievable with status labels.
Surface unresolved contradictions instead of averaging them into one invented conclusion.
Prioritize current approved decisions over older inferred recommendations.

Boundary and interface obligations

Input preparation: construct the package fixture from two conflicting lessons, one approved replacement decision, and a cyclic supersession fixture.
Output contract: A current decision is selected for guidance while the superseded one remains available as cited history.
Rejection contract: A supersession cycle does not produce arbitrary current knowledge.
Recovery contract: Removing an invalid supersession assertion restores prior visibility through a new reviewed revision.
Mutation scope: Graph expansion may widen relevance only inside the authorized scope of the caller.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-GRF-04-A.
Negative case: T-SV2-GRF-04-B.
Recovery case: T-SV2-GRF-04-C.
Package-specific measurements: unresolved_knowledge_conflicts.
Evidence record: evidence/SV2-GRF-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Return to explicit conflict display and disable automatic current-version selection.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-GRF-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-GRF-05: Expose full detail and provenance retrieval

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-GRF-04.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: services/mcp/app/tools/arcs.py; services/brain-api/app/arcs.py (new); services/brain-api/app/provenance.py (new).
Required fixture: Long arc, later revision, missing source range, and section pagination boundary.
Intended change: Replace preview-as-detail behavior with a verifiable full or section-based read contract.

Implementation sequence

Return complete selected sections with revision and content hash.
Paginate large bodies and graph neighborhoods explicitly.
Link attached lessons and source record ranges.
Preserve preview endpoints while labelling them accurately.

Boundary and interface obligations

Input preparation: construct the package fixture from long arc, later revision, missing source range, and section pagination boundary.
Output contract: A caller can expand a context-pack reference to the exact full lesson or arc section that supported it.
Rejection contract: A truncated indexed preview cannot be reported as the full source document.
Recovery contract: Reading a historical revision remains stable while a newer arc revision is written.
Mutation scope: Graph expansion may widen relevance only inside the authorized scope of the caller.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-GRF-05-A.
Negative case: T-SV2-GRF-05-B.
Recovery case: T-SV2-GRF-05-C.
Package-specific measurements: knowledge_reference_resolution_failures.
Evidence record: evidence/SV2-GRF-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep the prior preview tool available under its truthful description while full-detail rollout is paused.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-GRF-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream CTX: Task-specific brain context selection and cache correctness

Implementation owner: agentibrain-kernel. Integration target: G6. Mutation boundary: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task. Baseline references: SRC-BRAIN-FEED SRC-AH-PROJECT-CACHE

SV2-CTX-01: Implement authenticated task-context requests

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-GRF-05, SV2-IDX-05.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: services/brain-api/app/context.py (new); schemas/context-v2.json (new).
Required fixture: Authorized engineer request, CI request, wrong brain audience, and oversized prompt.
Intended change: Let the brain answer what this authorized agent needs for its current task.

Implementation sequence

Validate brain identity, project grant, task revision, role, and purpose.
Accept bounded query, relevant error signals, and explicit current intent.
Derive trusted scope from the credential and launch binding.
Reject unsupported request versions before retrieval.

Boundary and interface obligations

Input preparation: construct the package fixture from authorized engineer request, CI request, wrong brain audience, and oversized prompt.
Output contract: An engineer and a CI agent on the same project receive task-relevant requests with their distinct purposes preserved.
Rejection contract: A user-controlled query cannot redirect the request to a different brain or broaden the allowed project set.
Recovery contract: Retrying an identical task-context request reuses its idempotent operation identity.
Mutation scope: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CTX-01-A.
Negative case: T-SV2-CTX-01-B.
Recovery case: T-SV2-CTX-01-C.
Package-specific measurements: context_request_validation_failures.
Evidence record: evidence/SV2-CTX-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep the existing scoped feed usable while disabling new targeted-context requests.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CTX-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-CTX-02: Build explainable retrieval and ranking

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CTX-01.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: services/brain-api/app/retrieval/rank.py (new); services/brain-api/app/context.py (new).
Required fixture: Cold relevant incident, hot unrelated arc, current decision, and uncertain inferred edge.
Intended change: Combine task relevance, current decisions, lessons, arcs, and graph neighbors without relying on heat alone.

Implementation sequence

Apply hard scope filters before candidate selection.
Fuse lexical, semantic, explicit task, and graph evidence with versioned scoring policy.
Treat confidence and approval as explicit attributes rather than fabricated probabilities.
Record why each included item was relevant.

Boundary and interface obligations

Input preparation: construct the package fixture from cold relevant incident, hot unrelated arc, current decision, and uncertain inferred edge.
Output contract: A cold historical incident lesson outranks an unrelated hot arc for a matching task.
Rejection contract: A heat score alone cannot justify injecting unrelated project memory.
Recovery contract: A failed optional candidate source produces a labelled reduced result instead of an invented composite score.
Mutation scope: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CTX-02-A.
Negative case: T-SV2-CTX-02-B.
Recovery case: T-SV2-CTX-02-C.
Package-specific measurements: context_relevance_at_k.
Evidence record: evidence/SV2-CTX-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore the previous ranking policy revision without rebuilding immutable source archives.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CTX-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-CTX-03: Pack context within explicit budgets

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CTX-02.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: services/brain-api/app/retrieval/packing.py (new); schemas/context-pack-v2.json (new).
Required fixture: Oversized arc, duplicate lesson texts, conflicting decisions, and a very small token budget.
Intended change: Deliver enough useful evidence without overwhelming every agent’s context window.

Implementation sequence

Set total and per-category token budgets.
Preserve complete small lessons and evidence references.
Deduplicate repeated claims while keeping unresolved conflicts visible.
Return omissions, truncation flags, freshness, and supporting source IDs.

Boundary and interface obligations

Input preparation: construct the package fixture from oversized arc, duplicate lesson texts, conflicting decisions, and a very small token budget.
Output contract: The output fits its budget and contains complete actionable items with expandable references.
Rejection contract: A long item cannot be silently cut mid-meaning and presented as a complete instruction.
Recovery contract: A smaller retry budget produces a deterministic reduced pack tied to the same knowledge revision.
Mutation scope: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CTX-03-A.
Negative case: T-SV2-CTX-03-B.
Recovery case: T-SV2-CTX-03-C.
Package-specific measurements: context_pack_tokens and omitted_items.
Evidence record: evidence/SV2-CTX-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Fall back to a conservative scoped feed pack with explicit degraded metadata.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CTX-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-CTX-04: Coalesce requests and invalidate scoped caches

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CTX-03.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: services/brain-api/app/context_cache.py (new); services/brain-ops/brain_tick.py.
Required fixture: Launch burst, equal query across two brains, revoked grant, and updated decision revision.
Intended change: Keep swarm bursts efficient without returning another brain’s context or stale decisions.

Implementation sequence

Key by brain, project, task revision, role/purpose, policy revision, grant version, and knowledge revision.
Coalesce equivalent concurrent requests.
Invalidate on relevant knowledge change, scope revocation, and policy update.
Keep negative-result caching short and explicit.

Boundary and interface obligations

Input preparation: construct the package fixture from launch burst, equal query across two brains, revoked grant, and updated decision revision.
Output contract: Fifty equivalent authorized requests share bounded retrieval work while another project’s query remains independent.
Rejection contract: A cache keyed only by query text or repository basename fails the isolation tests.
Recovery contract: A revoked project grant invalidates cached reads before another response is served.
Mutation scope: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CTX-04-A.
Negative case: T-SV2-CTX-04-B.
Recovery case: T-SV2-CTX-04-C.
Package-specific measurements: context_cache_hit_ratio and context_coalesced_requests.
Evidence record: evidence/SV2-CTX-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable shared context caching and retain bounded per-request retrieval.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CTX-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-CTX-05: Issue verifiable context receipts and diagnostics

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CTX-04.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: services/brain-api/app/receipts.py (new); services/brain-api/app/context.py (new).
Required fixture: Valid receipt, altered payload, expired receipt, lost signing key version, and wrong task revision.
Intended change: Give agentihooks an auditable proof of scoped retrieval without claiming model comprehension.

Implementation sequence

Bind receipt to execution generation, task revision, scope, policy, references, and expiry.
Sign the receipt or store it behind an authenticated opaque ID.
Accept separate delivery acknowledgements from the target adapter.
Return a redacted explanation of exclusions and stale material.

Boundary and interface obligations

Input preparation: construct the package fixture from valid receipt, altered payload, expired receipt, lost signing key version, and wrong task revision.
Output contract: A receipt can be verified for the current task and resolves every supporting item visible to the authorized caller.
Rejection contract: A modified receipt, wrong generation, or cross-brain replay cannot satisfy verification.
Recovery contract: Receipt lookup after service restart remains valid until expiry when its issuing state is durable.
Mutation scope: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-CTX-05-A.
Negative case: T-SV2-CTX-05-B.
Recovery case: T-SV2-CTX-05-C.
Package-specific measurements: context_receipt_validation_failures.
Evidence record: evidence/SV2-CTX-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable receipt-required gates before changing signing or storage protocol incompatibly.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-CTX-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream GAT: Brain routing, delivery, and consultation gates

Implementation owner: agentihooks. Integration target: G6. Mutation boundary: Hooks guide agent behavior; server-side authority still protects shared mutations. Baseline references: SRC-AH-PROJECT-CACHE SRC-AH-GUIDE

SV2-GAT-01: Add deterministic per-session brain routing

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-CTX-05, SV2-LDG-05.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/context/brain_routes.py (new); hooks/config.py; scripts/swarm_v2/launch.py (new).
Required fixture: Explicit route, swarm route, personal default, and malicious repository endpoint override.
Intended change: Select personal or swarm brain from explicit authorized configuration rather than global accidental state.

Implementation sequence

Resolve operator binding before swarm binding before local default.
Validate destination against an operator-managed allowlist.
Bind credential audience to the selected origin.
Persist route identity with the session and task context.

Boundary and interface obligations

Input preparation: construct the package fixture from explicit route, swarm route, personal default, and malicious repository endpoint override.
Output contract: A swarm session always uses its authorized swarm brain while an unrelated local session uses its personal default.
Rejection contract: A repository file cannot redirect a bearer credential to an arbitrary HTTP endpoint.
Recovery contract: Changing an authorized route invalidates caches and requires a fresh receipt without replaying old context.
Mutation scope: Hooks guide agent behavior; server-side authority still protects shared mutations.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-GAT-01-A.
Negative case: T-SV2-GAT-01-B.
Recovery case: T-SV2-GAT-01-C.
Package-specific measurements: brain_route_resolution_failures.
Evidence record: evidence/SV2-GAT-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore the previous route revision and keep both corpora isolated.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-GAT-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-GAT-02: Integrate kernel-backed scoped feeds

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-GAT-01.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/context/project_memory.py; hooks/context/project_cache.py; hooks/context/brain_adapter.py.
Required fixture: New scoped endpoint, legacy endpoint, empty project feed, and network outage.
Intended change: Replace reconstruction from the fleet feed with the kernel’s completed project-scoping interface.

Implementation sequence

Add a kernel-backed source behind the existing project-memory seam.
Preserve fallback behavior only for explicitly compatible legacy endpoints.
Cache by canonical brain/project identity and feed revision.
Maintain approved shared-warning delivery outside unrelated project memory.

Boundary and interface obligations

Input preparation: construct the package fixture from new scoped endpoint, legacy endpoint, empty project feed, and network outage.
Output contract: A quiet repository receives its own kernel-selected arcs even when absent from the global top set.
Rejection contract: A scoped empty result does not trigger unrelated fleet memory fallback.
Recovery contract: Kernel outage serves an explicitly stale allowed cache within policy rather than changing brain scope.
Mutation scope: Hooks guide agent behavior; server-side authority still protects shared mutations.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-GAT-02-A.
Negative case: T-SV2-GAT-02-B.
Recovery case: T-SV2-GAT-02-C.
Package-specific measurements: scoped_feed_fallback_total.
Evidence record: evidence/SV2-GAT-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Switch the source adapter back while retaining new marker provenance and strict client filtering.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-GAT-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-GAT-03: Deliver task context through target capabilities

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-GAT-02.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/hook_manager.py; hooks/targets/; hooks/context/task_context.py (new).
Required fixture: Claude and Codex hook fixtures plus a live smoke session for each pinned target.
Intended change: Confirm context reaches both target CLIs through their actual supported hook envelopes.

Implementation sequence

Use capability adapters for accepted injection boundaries.
Keep payload framing as recalled evidence rather than operator instruction.
Report delivery acknowledgement separately from retrieval.
Deduplicate unchanged packs across repeated tool callbacks.

Boundary and interface obligations

Input preparation: construct the package fixture from claude and Codex hook fixtures plus a live smoke session for each pinned target.
Output contract: Claude and Codex each receive the expected scoped context with a recorded delivery receipt in live target smoke tests.
Rejection contract: An unsupported pre-tool injection path cannot be counted as successful delivery merely because retrieval succeeded.
Recovery contract: A compacted or restarted target receives the current pack without duplicate stale instructions.
Mutation scope: Hooks guide agent behavior; server-side authority still protects shared mutations.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-GAT-03-A.
Negative case: T-SV2-GAT-03-B.
Recovery case: T-SV2-GAT-03-C.
Package-specific measurements: context_delivery_outcomes_by_target.
Evidence record: evidence/SV2-GAT-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable task-context delivery for the affected target while preserving existing compatible brain feed behavior.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-GAT-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-GAT-04: Implement revision-bound consultation gates

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-GAT-03.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/gates/brain.py (new); hooks/context/task_context.py (new); scripts/swarm/store.py.
Required fixture: First write, unchanged repeated tool calls, changed task spec, unrelated receipt, and valid empty result.
Intended change: Require relevant consultation at task transitions without querying on every tool action.

Implementation sequence

Add observe and required policy modes.
Validate receipt purpose, task revision, generation, brain, and expiry before covered mutations.
Refresh after material task changes or governed subsystem transitions.
Allow a valid empty result as consultation while distinguishing service failure.

Boundary and interface obligations

Input preparation: construct the package fixture from first write, unchanged repeated tool calls, changed task spec, unrelated receipt, and valid empty result.
Output contract: A first covered write requires a current task receipt, but repeated ordinary reads and writes do not force redundant searches.
Rejection contract: An unrelated query or another task’s receipt cannot satisfy the gate.
Recovery contract: A task revision change invalidates the prior receipt and resumes after a new valid pack is delivered.
Mutation scope: Hooks guide agent behavior; server-side authority still protects shared mutations.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-GAT-04-A.
Negative case: T-SV2-GAT-04-B.
Recovery case: T-SV2-GAT-04-C.
Package-specific measurements: brain_gate_false_block_rate.
Evidence record: evidence/SV2-GAT-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Return the gate to observe mode without deleting receipt or violation history.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-GAT-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-GAT-05: Record outcomes and controlled emergency bypass

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-GAT-04.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/gates/brain.py (new); scripts/swarm_ledger/ledger_tasks.py; hooks/context/brain_writer_hook.py.
Required fixture: Valid lesson, no-new-learning outcome, forged approval text, and scoped emergency operator action.
Intended change: Close the learning loop without manufacturing knowledge or letting models grant themselves exceptions.

Implementation sequence

Accept supported lesson/decision markers or explicit no-new-learning outcomes.
Link outcomes to task proof and source evidence.
Permit short-lived operator-scoped bypass with a reason and audit.
Prevent transcript text from impersonating an override command.

Boundary and interface obligations

Input preparation: construct the package fixture from valid lesson, no-new-learning outcome, forged approval text, and scoped emergency operator action.
Output contract: A task with no novel lesson can finish with an explicit no-new-learning result and verified implementation proof.
Rejection contract: An agent-authored note saying the operator approved bypass does not grant bypass authority.
Recovery contract: During brain outage, the configured harmless-read policy and operator emergency path work without turning every gate off.
Mutation scope: Hooks guide agent behavior; server-side authority still protects shared mutations.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-GAT-05-A.
Negative case: T-SV2-GAT-05-B.
Recovery case: T-SV2-GAT-05-C.
Package-specific measurements: learning_outcomes_by_kind and brain_bypass_total.
Evidence record: evidence/SV2-GAT-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Revert required mode and preserve all genuine outcome evidence and bypass audit records.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-GAT-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream MUL: Independent personal and swarm brain instances

Implementation owner: agentibrain-kernel. Integration target: G7. Mutation boundary: An instance command may affect only the explicitly selected brain and its owned resources. Baseline references: SRC-BRAIN-CLI SRC-BRAIN-COMPOSE

SV2-MUL-01: Add first-class brain instance identity

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-BRP-05, SV2-IDN-05.
Integration gate: G7, subject to all earlier applicable acceptance gates.
Owned path candidates: agentibrain/config.py; agentibrain/client.py; schemas/brain-instance-v2.json (new).
Required fixture: Existing default installation plus proposed personal and swarm instance configurations.
Intended change: Make installation identity explicit without confusing a project scope with a complete brain deployment.

Implementation sequence

Add brain_id, configuration root, endpoint identity, and policy revision.
Preserve a single default instance for existing installations.
Keep project namespaces subordinate to the selected brain.
Expose a self endpoint that confirms the expected brain identity.

Boundary and interface obligations

Input preparation: construct the package fixture from existing default installation plus proposed personal and swarm instance configurations.
Output contract: A client can verify which named brain it reached before sending project context or credentials.
Rejection contract: An endpoint responding with a different brain ID fails binding validation.
Recovery contract: An existing unnamed installation migrates to default without losing its vault or credentials.
Mutation scope: An instance command may affect only the explicitly selected brain and its owned resources.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-MUL-01-A.
Negative case: T-SV2-MUL-01-B.
Recovery case: T-SV2-MUL-01-C.
Package-specific measurements: brain_instance_binding_failures.
Evidence record: evidence/SV2-MUL-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Read the legacy default configuration through a compatibility mapper while new instances remain disabled.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-MUL-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-MUL-02: Remove global compose-name collisions

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-MUL-01.
Integration gate: G7, subject to all earlier applicable acceptance gates.
Owned path candidates: agentibrain/templates/compose/compose.yml.j2; agentibrain/bootstrap.py; compose.yml.
Required fixture: Two generated compose projects with intentionally conflicting and then distinct ports.
Intended change: Allow two local stacks without container-name collision or global stop behavior.

Implementation sequence

Scope compose project names and resources to the selected instance.
Remove fixed container names where compose service discovery suffices.
Allocate configurable published ports and independent volume names.
Verify service URLs remain internal to the intended project network.

Boundary and interface obligations

Input preparation: construct the package fixture from two generated compose projects with intentionally conflicting and then distinct ports.
Output contract: Starting personal and swarm on the same host creates independent running stacks and storage.
Rejection contract: Port or volume conflicts fail clearly rather than stopping another stack to make room.
Recovery contract: Restarting one instance leaves the other instance serving requests throughout.
Mutation scope: An instance command may affect only the explicitly selected brain and its owned resources.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-MUL-02-A.
Negative case: T-SV2-MUL-02-B.
Recovery case: T-SV2-MUL-02-C.
Package-specific measurements: brain_instance_resource_conflicts.
Evidence record: evidence/SV2-MUL-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore the single-default compose path only after explicitly selecting it and preserving other-instance data.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-MUL-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-MUL-03: Scope CLI lifecycle operations

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-MUL-02.
Integration gate: G7, subject to all earlier applicable acceptance gates.
Owned path candidates: agentibrain/cli.py; agentibrain/bootstrap.py; tests/unit/test_cli_instances.py (new).
Required fixture: Two instances, one unowned lookalike container, and an interrupted installation.
Intended change: Replace whole-machine discovery with safe explicit instance ownership.

Implementation sequence

Add instance selection to install, up, down, build, logs, check, sync, and uninstall.
Require clear ownership evidence before stopping resources.
Limit profile unlinking and environment changes to the selected instance.
Provide a dry-run inventory for every destructive lifecycle command.

Boundary and interface obligations

Input preparation: construct the package fixture from two instances, one unowned lookalike container, and an interrupted installation.
Output contract: Running down for personal leaves swarm containers, volumes, credentials, and client bindings untouched.
Rejection contract: An ambiguous legacy stack selection refuses instead of stopping every detected brain project.
Recovery contract: A partially completed install can be resumed idempotently for that instance only.
Mutation scope: An instance command may affect only the explicitly selected brain and its owned resources.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-MUL-03-A.
Negative case: T-SV2-MUL-03-B.
Recovery case: T-SV2-MUL-03-C.
Package-specific measurements: brain_cross_instance_mutation_rejections.
Evidence record: evidence/SV2-MUL-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Use dry-run and explicit default selection while the new lifecycle implementation is disabled.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-MUL-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-MUL-04: Isolate database, Redis, vault, and event state

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-MUL-03.
Integration gate: G7, subject to all earlier applicable acceptance gates.
Owned path candidates: helm/brain-api/values.yaml; helm/brain-ops/values.yaml; helm/embeddings/values.yaml; agentibrain/config.py.
Required fixture: Shared database server with distinct principals, distinct vaults, and deliberate misbinding fixtures.
Intended change: Prevent apparently separate deployments from sharing hidden external state.

Implementation sequence

Bind each brain to its own vault root and database/schema credentials.
Namespace Redis keys, tick records, outboxes, consumer groups, and cache generations.
Validate conflicting external backend configuration before startup.
Include instance identity in backups and migrations.

Boundary and interface obligations

Input preparation: construct the package fixture from shared database server with distinct principals, distinct vaults, and deliberate misbinding fixtures.
Output contract: Two brains with overlapping arc IDs and identical project names cannot read or modify each other’s knowledge.
Rejection contract: Separate Kubernetes namespaces pointing at the same unrestricted vault/database are not accepted as isolation proof.
Recovery contract: Restoring one instance backup leaves the other instance’s revision and corpus unchanged.
Mutation scope: An instance command may affect only the explicitly selected brain and its owned resources.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-MUL-04-A.
Negative case: T-SV2-MUL-04-B.
Recovery case: T-SV2-MUL-04-C.
Package-specific measurements: brain_backend_scope_conflicts.
Evidence record: evidence/SV2-MUL-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Stop only the misconfigured instance and restore its prior backend bindings.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-MUL-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-MUL-05: Support distinct policy and inference budgets

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-MUL-04.
Integration gate: G7, subject to all earlier applicable acceptance gates.
Owned path candidates: agentibrain/config.py; services/brain-api/app/context.py; helm/brain-ops/values.yaml.
Required fixture: Personal conservative policy and swarm experimental policy using a shared limited inference backend.
Intended change: Tune the swarm brain more aggressively without affecting personal behavior or cost.

Implementation sequence

Version retrieval, graph, synthesis, and injection policies per brain.
Configure concurrency and token budgets separately.
Keep shared physical inference services behind scoped keys and limits.
Expose policy revision in context packs and diagnostics.

Boundary and interface obligations

Input preparation: construct the package fixture from personal conservative policy and swarm experimental policy using a shared limited inference backend.
Output contract: A swarm policy change affects only swarm packs while the personal brain keeps its previous ranking and cadence.
Rejection contract: Increasing one brain’s budget cannot change global infrastructure ceilings implicitly.
Recovery contract: Reverting a policy revision invalidates only that instance’s affected caches.
Mutation scope: An instance command may affect only the explicitly selected brain and its owned resources.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-MUL-05-A.
Negative case: T-SV2-MUL-05-B.
Recovery case: T-SV2-MUL-05-C.
Package-specific measurements: brain_inference_budget_usage.
Evidence record: evidence/SV2-MUL-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore the previous policy revision without migrating its evidence corpus.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-MUL-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream ING: Brain extraction from normalized evidence and safe learning

Implementation owner: agentibrain-kernel. Integration target: G6. Mutation boundary: Synthesis consumes authorized evidence; model repetition is not new independent confirmation. Baseline references: SRC-BRAIN-EXTRACT SRC-BRAIN-TICK

SV2-ING-01: Consume the session change feed

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-BRP-05, SV2-IDX-05.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: services/brain-ops/extract.py; services/brain-ops/session_source.py (new).
Required fixture: Two harnesses, changed attribution, deleted source, and an interrupted extraction batch.
Intended change: Stop coupling kernel extraction to one CLI filesystem layout.

Implementation sequence

Read the versioned authorized session change cursor.
Fetch exact needed record ranges and event-time project metadata.
Preserve cursor progress only after accepted extraction output.
Support source deletions and attribution corrections as explicit changes.

Boundary and interface obligations

Input preparation: construct the package fixture from two harnesses, changed attribution, deleted source, and an interrupted extraction batch.
Output contract: Claude and Codex work becomes extractable through the same source API without mounting their native homes into the brain.
Rejection contract: A kernel extractor cannot read a corpus outside its principal’s allowed project set.
Recovery contract: Interrupted extraction resumes from the last committed source cursor without duplicating arcs.
Mutation scope: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-ING-01-A.
Negative case: T-SV2-ING-01-B.
Recovery case: T-SV2-ING-01-C.
Package-specific measurements: brain_source_cursor_lag.
Evidence record: evidence/SV2-ING-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Re-enable the explicit legacy local source only for its authorized scope while preserving new cursors.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-ING-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-ING-02: Group work by task lineage rather than swarm volume

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-ING-01.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: services/brain-ops/cluster.py; services/brain-ops/extract_workflow.py.
Required fixture: Ten concurrent tasks, one resumed attempt, one planner thread, and one tool-heavy single-prompt session.
Intended change: Preserve meaningful engineering arcs when many autonomous agents run concurrently.

Implementation sequence

Use project, task, phase, and attempt lineage before time-window heuristics.
Link replacements and handoffs to the same work thread.
Keep unrelated simultaneous tasks distinct.
Admit meaningful autonomous work even when it has few human prompts.

Boundary and interface obligations

Input preparation: construct the package fixture from ten concurrent tasks, one resumed attempt, one planner thread, and one tool-heavy single-prompt session.
Output contract: Twenty agents on ten tasks produce task-relevant arc candidates rather than one giant repository-time bucket.
Rejection contract: Tool-call volume alone cannot force unrelated work into a high-confidence merged arc.
Recovery contract: Reprocessing a task with another attempt updates its lineage without destroying earlier source references.
Mutation scope: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-ING-02-A.
Negative case: T-SV2-ING-02-B.
Recovery case: T-SV2-ING-02-C.
Package-specific measurements: arc_task_lineage_conflicts.
Evidence record: evidence/SV2-ING-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep the previous grouping generation readable and quarantine new ambiguous merges.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-ING-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-ING-03: Prevent self-reinforcing injected-memory loops

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-ING-02.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: services/brain-ops/extract.py; services/brain-ops/brain_tick_prompt.py; services/brain-ops/lesson_reconcile.py.
Required fixture: One injected lesson repeated across many transcripts plus one genuine new successful application.
Intended change: Keep repeated recalled text from becoming falsely corroborated new memory.

Implementation sequence

Preserve origin_kind for user, assistant, tool evidence, and injected context.
Exclude pure recalled-context echoes from independent evidence counts.
Require new supporting outcome evidence for promotion.
Keep synthetic summaries linked to their original sources.

Boundary and interface obligations

Input preparation: construct the package fixture from one injected lesson repeated across many transcripts plus one genuine new successful application.
Output contract: Reinjecting one lesson into fifty workers does not create fifty independent confirmations or fifty duplicate lessons.
Rejection contract: A quoted old operator instruction is not treated as a fresh current directive.
Recovery contract: A genuinely new verified outcome can add evidence to an existing lesson without replacing its provenance.
Mutation scope: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-ING-03-A.
Negative case: T-SV2-ING-03-B.
Recovery case: T-SV2-ING-03-C.
Package-specific measurements: memory_echo_suppression_total.
Evidence record: evidence/SV2-ING-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable automatic promotion and retain candidate lessons with their evidence classification.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-ING-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-ING-04: Bound synthesis and serialize knowledge mutations

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-ING-03.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: services/brain-ops/brain_tick.py; services/brain-ops/brain_apply.py; services/brain-api/app/markers.py.
Required fixture: Simultaneous marker writes, scheduled tick, manual tick, and malformed synthesis output.
Intended change: Handle swarm write bursts without corrupting files or launching unbounded inference work.

Implementation sequence

Serialize mutations by canonical knowledge ownership or a tested single-writer path.
Coalesce equivalent tick requests by scope and policy.
Bound prompts and synthesis queues without dropping high-priority evidence silently.
Validate model output before applying edge, merge, signal, or summary changes.

Boundary and interface obligations

Input preparation: construct the package fixture from simultaneous marker writes, scheduled tick, manual tick, and malformed synthesis output.
Output contract: Concurrent marker writes and scheduled ticks preserve complete canonical knowledge with no interleaved file corruption.
Rejection contract: An invalid model response cannot partially mutate unrelated arcs before validation fails.
Recovery contract: A failed synthesis batch retries from its durable work state and leaves the previous accepted revision current.
Mutation scope: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-ING-04-A.
Negative case: T-SV2-ING-04-B.
Recovery case: T-SV2-ING-04-C.
Package-specific measurements: brain_mutation_conflicts_total.
Evidence record: evidence/SV2-ING-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Run deterministic maintenance only while AI mutation application is paused.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-ING-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-ING-05: Record learning quality and promotion evidence

Repository: agentibrain-kernel.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-ING-04.
Integration gate: G6, subject to all earlier applicable acceptance gates.
Owned path candidates: services/brain-ops/learning_quality.py (new); services/brain-api/app/provenance.py (new).
Required fixture: Unsupported confident claim, independently verified lesson, repeated echo, and later contradiction.
Intended change: Reward useful evidence-backed knowledge rather than larger numbers of lessons or edges.

Implementation sequence

Track source diversity, verification state, contradictions, and observed reuse.
Distinguish candidate, supported, approved, and retired knowledge states.
Keep explicit operator decisions authoritative.
Build a review report for recurrent noisy or unhelpful lessons.

Boundary and interface obligations

Input preparation: construct the package fixture from unsupported confident claim, independently verified lesson, repeated echo, and later contradiction.
Output contract: A supported lesson links to real outcome evidence and can be retired or corrected without losing its history.
Rejection contract: Repeated agent confidence claims without independent evidence cannot promote a lesson to approved guidance.
Recovery contract: A contradicted lesson is marked for review and removed from default guidance until resolved.
Mutation scope: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-ING-05-A.
Negative case: T-SV2-ING-05-B.
Recovery case: T-SV2-ING-05-C.
Package-specific measurements: learning_usefulness_review_results.
Evidence record: evidence/SV2-ING-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentibrain-kernel pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable automatic promotion while retaining all candidate and historical evidence.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-ING-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream OBS: Operational telemetry and trustworthy health

Implementation owner: agentihooks. Integration target: G10. Mutation boundary: Operational logs identify behavior without exposing secret values or entire private transcripts. Baseline references: SRC-AH-GUIDE

SV2-OBS-01: Instrument controller and execution transitions

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-KUB-05, SV2-CKP-05, SV2-IDX-05, SV2-GAT-05.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/telemetry.py (new); scripts/swarm_v2/controller.py (new); scripts/swarm/status.py.
Required fixture: Normal execution, fenced replacement, telemetry outage, and exception containing a fake secret.
Intended change: Make distributed decisions reconstructable from stable operation and execution identifiers.

Implementation sequence

Emit structured transition events with expected and observed generation.
Record admission, command, heartbeat, and outcome timings.
Keep high-cardinality identities in logs/traces instead of unbounded metric labels.
Sanitize exception details before export.

Boundary and interface obligations

Input preparation: construct the package fixture from normal execution, fenced replacement, telemetry outage, and exception containing a fake secret.
Output contract: An operator can reconstruct why one task was admitted, delayed, fenced, and restored from its correlated events.
Rejection contract: A token or full process environment never appears in the default transition log.
Recovery contract: Telemetry backend outage does not block task authority updates and is reported as degraded observability.
Mutation scope: Operational logs identify behavior without exposing secret values or entire private transcripts.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-OBS-01-A.
Negative case: T-SV2-OBS-01-B.
Recovery case: T-SV2-OBS-01-C.
Package-specific measurements: execution_transition_latency_seconds.
Evidence record: evidence/SV2-OBS-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable optional exporters while keeping local sanitized audit events and core counters.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-OBS-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-OBS-02: Measure archive, embedding, and extraction lag separately

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-OBS-01.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/memory/metrics.py (new); scripts/swarm_ledger/ledger_server.py.
Required fixture: Healthy capture with failed embedding, failed archive transport, and delayed brain extraction.
Intended change: Prevent a fast search response from hiding missing or unprocessed history.

Implementation sequence

Expose local spool, durable archive, indexed chunk, and brain-consumed watermarks.
Measure age and backlog for each stage.
Label partial coverage in query responses and UI.
Alert on stale output rather than only process readiness.

Boundary and interface obligations

Input preparation: construct the package fixture from healthy capture with failed embedding, failed archive transport, and delayed brain extraction.
Output contract: A delayed embedding worker shows current archive data but an explicit indexing lag without claiming full search coverage.
Rejection contract: One aggregate healthy flag cannot conceal an unacknowledged transcript tail.
Recovery contract: After a backlog drains, stage-specific metrics converge independently and alerts clear.
Mutation scope: Operational logs identify behavior without exposing secret values or entire private transcripts.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-OBS-02-A.
Negative case: T-SV2-OBS-02-B.
Recovery case: T-SV2-OBS-02-C.
Package-specific measurements: archive_lag_seconds embedding_lag_seconds extraction_lag_seconds.
Evidence record: evidence/SV2-OBS-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep stage watermarks persisted even if a dashboard or exporter is rolled back.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-OBS-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-OBS-03: Instrument context and gate effectiveness

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-OBS-02.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/context/task_context.py (new); scripts/gates/brain.py (new); hooks/memory/metrics.py (new).
Required fixture: Useful consultation, irrelevant consultation, missing delivery, and operator override.
Intended change: Measure whether consultation helps without equating tool-call count with useful memory usage.

Implementation sequence

Track retrieval purpose, pack size, receipt age, delivery outcome, and gate result.
Record operator-reviewed false blocks and missed opportunities.
Correlate repeated incidents with retrieved lessons using anonymized IDs.
Avoid storing full sensitive prompts in routine metrics.

Boundary and interface obligations

Input preparation: construct the package fixture from useful consultation, irrelevant consultation, missing delivery, and operator override.
Output contract: The report separates context delivered, context referenced, and operator-reviewed usefulness.
Rejection contract: A successful HTTP response alone cannot be counted as verified target delivery.
Recovery contract: A failed context service produces visible degraded metrics without triggering fleet-wide liveness restarts.
Mutation scope: Operational logs identify behavior without exposing secret values or entire private transcripts.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-OBS-03-A.
Negative case: T-SV2-OBS-03-B.
Recovery case: T-SV2-OBS-03-C.
Package-specific measurements: brain_gate_false_block_rate and context_delivery_failures.
Evidence record: evidence/SV2-OBS-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Return gates to observe mode while retaining outcome metrics for comparison.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-OBS-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-OBS-04: Publish actionable diagnostics and health endpoints

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-OBS-03.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/api/health.py (new); hooks/memory/api/health.py (new).
Required fixture: Live-but-stuck exporter, unavailable Redis, failed brain auth, and healthy local supervisor.
Intended change: Distinguish local process health, dependency availability, and end-to-end pipeline progress.

Implementation sequence

Add shallow liveness and explicit deep diagnostics.
Report dependency state with last successful operation timestamps.
Include classified remediation hints that do not execute automatically.
Make health checks scope-safe and credential-free in output.

Boundary and interface obligations

Input preparation: construct the package fixture from live-but-stuck exporter, unavailable Redis, failed brain auth, and healthy local supervisor.
Output contract: A stuck exporter with a live process is reported as pipeline degradation with its last durable watermark.
Rejection contract: A shallow healthy response cannot satisfy the acceptance gate for backup or native resume.
Recovery contract: Restored dependencies clear the relevant diagnostic stage without resetting unrelated execution state.
Mutation scope: Operational logs identify behavior without exposing secret values or entire private transcripts.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-OBS-04-A.
Negative case: T-SV2-OBS-04-B.
Recovery case: T-SV2-OBS-04-C.
Package-specific measurements: pipeline_stage_health.
Evidence record: evidence/SV2-OBS-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep shallow probes stable and disable expensive deep checks if their load is excessive.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-OBS-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-OBS-05: Produce fleet dashboards and bounded alerts

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-OBS-04.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: docs/swarm-v2/metrics-contract.md (new); observability/swarm-v2.json (new).
Required fixture: Recorded scaling canary, stale checkpoint, quota wait, and denied cross-brain query.
Intended change: Give the operator a compact view of state, cost pressure, recovery, and knowledge freshness.

Implementation sequence

Define panels for active/pending attempts, pool capacity, quota wait, archive lag, and checkpoint age.
Show terminal connectivity separately from worker authority.
Add alerts for protected idle Pods, impossible pending requests, and cross-scope denials.
Test alert thresholds against recorded canary traces.

Boundary and interface obligations

Input preparation: construct the package fixture from recorded scaling canary, stale checkpoint, quota wait, and denied cross-brain query.
Output contract: Dashboard labels distinguish configured maxima from actual nodes and active tasks.
Rejection contract: An alert cannot expose a private personal session title to a swarm-only viewer.
Recovery contract: Alert backend recovery does not duplicate incident state or trigger repeated destructive actions.
Mutation scope: Operational logs identify behavior without exposing secret values or entire private transcripts.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-OBS-05-A.
Negative case: T-SV2-OBS-05-B.
Recovery case: T-SV2-OBS-05-C.
Package-specific measurements: alert_actionability_review.
Evidence record: evidence/SV2-OBS-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore the previous dashboard and disable new alerts independently from worker execution.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-OBS-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Implementation owner: agentihooks. Integration target: G10. Mutation boundary: The UI is a projection of authoritative state; cached pages cannot grant current execution authority. Baseline references: SRC-AH-LEDGER

SV2-UX-01: Add distributed execution identity to ledger cards

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-HDR-05, SV2-OBS-05.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_ledger/template.html; scripts/swarm_ledger/ledger_server.py; scripts/swarm/status.py.
Required fixture: Mixed local/remote swarm and deliberately out-of-order state updates.
Intended change: Keep the familiar ledger while making remote execution visible and unambiguous.

Implementation sequence

Display backend, execution generation, pool class, and observed state.
Preserve current lane and master presentation.
Distinguish scheduling wait, quota wait, input wait, and stale terminal data.
Include last observed times without implying current connectivity.

Boundary and interface obligations

Input preparation: construct the package fixture from mixed local/remote swarm and deliberately out-of-order state updates.
Output contract: A local and a remote agent can be understood from the same ledger without changing the user’s task workflow.
Rejection contract: A stale terminal observation cannot overwrite a fresher heartbeat-derived state.
Recovery contract: Reloading the page restores the latest state from the API without replaying client-side mutations.
Mutation scope: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-UX-01-A.
Negative case: T-SV2-UX-01-B.
Recovery case: T-SV2-UX-01-C.
Package-specific measurements: ledger_state_projection_errors.
Evidence record: evidence/SV2-UX-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Hide new fields behind compatible response handling while keeping existing cards functional.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-UX-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-UX-02: Add explicit safe lifecycle controls

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-UX-01.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_ledger/template.html; scripts/swarm_ledger/ledger_server.py.
Required fixture: Stale browser tab, duplicated click, partial drain, and unsupported attach target.
Intended change: Provide attach, pause, drain, cancel, and force-stop with different consequences.

Implementation sequence

Send expected task revision and execution generation with actions.
Explain whether a control affects one agent, one swarm, or only a terminal view.
Require existing operator authorization for destructive commands.
Disable controls when the target is stale or unsupported.

Boundary and interface obligations

Input preparation: construct the package fixture from stale browser tab, duplicated click, partial drain, and unsupported attach target.
Output contract: Draining one worker leaves other agents active and reports its checkpoint result.
Rejection contract: Clicking an old force-stop button after replacement fails as stale rather than stopping the successor.
Recovery contract: A lost HTTP acknowledgement can be reconciled by operation ID before another click is accepted.
Mutation scope: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-UX-02-A.
Negative case: T-SV2-UX-02-B.
Recovery case: T-SV2-UX-02-C.
Package-specific measurements: ledger_control_conflicts_total.
Evidence record: evidence/SV2-UX-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable new destructive controls while retaining existing server-validated operations.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-UX-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-UX-03: Expose recovery material and decision choices

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-UX-02.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_ledger/template.html; scripts/swarm_ledger/ledger_server.py; scripts/swarm/resume.py.
Required fixture: Valid native checkpoint, context-only checkpoint, and corrupted required object.
Intended change: Make recovery honest and actionable when a process or native session is lost.

Implementation sequence

Show latest complete checkpoint and archive watermark.
Present native resume, context continuation, and fresh start as distinct choices.
Retain failure reason and compatibility diagnosis.
Do not release awaiting-decision ownership accidentally.

Boundary and interface obligations

Input preparation: construct the package fixture from valid native checkpoint, context-only checkpoint, and corrupted required object.
Output contract: The operator sees why native resume failed and can select a documented continuation mode.
Rejection contract: A path-only snapshot cannot produce a green recoverable badge.
Recovery contract: A page refresh retains the accepted recovery decision and does not create a second replacement.
Mutation scope: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-UX-03-A.
Negative case: T-SV2-UX-03-B.
Recovery case: T-SV2-UX-03-C.
Package-specific measurements: recovery_decision_wait_seconds.
Evidence record: evidence/SV2-UX-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Leave affected tasks awaiting decision and hide unsupported recovery actions.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-UX-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-UX-04: Add brain context and evidence inspection

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-UX-03.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_ledger/template.html; scripts/swarm_ledger/ledger_server.py; hooks/memory/server.py.
Required fixture: Current pack, inferred intent, superseded decision, and revoked source reference.
Intended change: Let the operator inspect what memory influenced a task without opening another application.

Implementation sequence

Show selected brain, task-context purpose, receipt freshness, and delivery result.
Link pack items to full authorized arc or session evidence.
Display inferred intent and superseded knowledge with explicit labels.
Keep private fields protected by the viewer’s scope.

Boundary and interface obligations

Input preparation: construct the package fixture from current pack, inferred intent, superseded decision, and revoked source reference.
Output contract: A context item can be expanded to its supporting record range or lesson revision from the ledger.
Rejection contract: A swarm viewer cannot follow a copied personal-brain evidence link without authorization.
Recovery contract: A revoked source appears as unavailable with an explanation rather than stale cached private content.
Mutation scope: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-UX-04-A.
Negative case: T-SV2-UX-04-B.
Recovery case: T-SV2-UX-04-C.
Package-specific measurements: ledger_evidence_expand_failures.
Evidence record: evidence/SV2-UX-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Hide context inspection panels while preserving core task controls and evidence IDs.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-UX-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-UX-05: Test responsive terminal and ledger workflows

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-UX-04.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: tests/e2e/swarm_v2/test_operator_workflow.py (new); docs/swarm-v2/operator-guide.md (new).
Required fixture: Desktop and mobile-sized browser views, closed viewers, and one reconnecting remote terminal.
Intended change: Prove the intended workflow from browser and terminal without making the personal computer a dependency.

Implementation sequence

Exercise launching from the ledger and inspecting through Anton herdr.
Close the personal device and every viewer during execution.
Reopen the UI and inspect an agent, its task, and its evidence.
Validate keyboard and mobile-sized page controls with real rendered checks.

Boundary and interface obligations

Input preparation: construct the package fixture from desktop and mobile-sized browser views, closed viewers, and one reconnecting remote terminal.
Output contract: The operator can return to the same running swarm and inspect current remote work after all viewers were closed.
Rejection contract: A mobile layout must not hide or mislabel destructive-action scope.
Recovery contract: A reconnecting worker presents cached state as stale until a fresh observation arrives.
Mutation scope: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-UX-05-A.
Negative case: T-SV2-UX-05-B.
Recovery case: T-SV2-UX-05-C.
Package-specific measurements: operator_workflow_acceptance.
Evidence record: evidence/SV2-UX-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore the previous UI build without restarting worker Pods.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-UX-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream VAL: Cross-repository tests, chaos, and regression protection

Implementation owner: agentihooks. Integration target: G12. Mutation boundary: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary. Baseline references: SRC-AH-GUIDE

SV2-VAL-01: Build the shared contract conformance suite

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-KUB-05, SV2-CKP-05, SV2-IDX-05, SV2-GAT-05, SV2-MUL-05.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: tests/contracts/swarm_v2/ (new); docs/swarm-v2/schemas/.
Required fixture: Complete schema matrix with valid, invalid, extension, and version-conflict examples.
Intended change: Ensure independently released producers and consumers agree on authority and data shapes.

Implementation sequence

Test valid, invalid, and previous-version examples for every shared schema.
Validate error classes and retry semantics.
Exercise unknown optional fields separately from missing authority fields.
Publish machine-readable compatibility results per repository commit.

Boundary and interface obligations

Input preparation: construct the package fixture from complete schema matrix with valid, invalid, extension, and version-conflict examples.
Output contract: The three repositories’ implementations pass the same transport fixtures for their owned endpoints.
Rejection contract: A consumer that ignores task generation or project scope fails conformance even if it returns HTTP success.
Recovery contract: A backward-compatible optional extension passes older readers without stripping durable provenance.
Mutation scope: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-VAL-01-A.
Negative case: T-SV2-VAL-01-B.
Recovery case: T-SV2-VAL-01-C.
Package-specific measurements: contract_cases_passed.
Evidence record: evidence/SV2-VAL-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep the previous compatible schema active until all required consumers qualify.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-VAL-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-VAL-02: Build runtime model and race tests

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-VAL-01.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: tests/property/swarm_v2/ (new); tests/integration/swarm_v2/runtime/ (new).
Required fixture: Seeded race traces with two controllers and two successive worker generations.
Intended change: Validate state-machine safety under ordering and transport failures rather than only happy-path mocks.

Implementation sequence

Generate heartbeat, command, lease, and outcome interleavings.
Check one-current-writer and no-stale-release invariants.
Inject lost create/merge acknowledgements.
Verify foreign runtime objects are never adopted or deleted.

Boundary and interface obligations

Input preparation: construct the package fixture from seeded race traces with two controllers and two successive worker generations.
Output contract: Randomized event sequences preserve one admitted generation and converge after observation resumes.
Rejection contract: A stale-generation outcome that succeeds marks the implementation incorrect regardless of final task appearance.
Recovery contract: Saving and replaying a failing random seed reproduces the same invariant violation deterministically.
Mutation scope: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-VAL-02-A.
Negative case: T-SV2-VAL-02-B.
Recovery case: T-SV2-VAL-02-C.
Package-specific measurements: state_machine_invariant_violations.
Evidence record: evidence/SV2-VAL-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable automatic recovery or cleanup for the affected backend while the failing seed is fixed.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-VAL-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-VAL-03: Build source-fidelity and scope isolation tests

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-VAL-02.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: tests/integration/session_memory/ (new); tests/integration/brain_scope/ (new).
Required fixture: Two brains, equal session IDs, long transcripts, overlapping errors, and deleted evidence.
Intended change: Prove memory completeness, citations, and data boundaries across providers and brains.

Implementation sequence

Test appended-line, partial-record, replay, rotation, and deletion behavior.
Import long transcripts exceeding every preview cap.
Query overlapping content across two projects and two brains.
Expand each accepted result to its exact supporting range.

Boundary and interface obligations

Input preparation: construct the package fixture from two brains, equal session IDs, long transcripts, overlapping errors, and deleted evidence.
Output contract: Searchable sources remain complete and isolated after worker loss and corpus reindex.
Rejection contract: Any cross-scope title, snippet, count, or cached context leakage is a hard failure.
Recovery contract: Restoring the catalog and rebuilding vectors preserves original evidence locators.
Mutation scope: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-VAL-03-A.
Negative case: T-SV2-VAL-03-B.
Recovery case: T-SV2-VAL-03-C.
Package-specific measurements: memory_scope_leakage_cases.
Evidence record: evidence/SV2-VAL-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable shared search and context caching while keeping source capture isolated.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-VAL-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-VAL-04: Rehearse planned and abrupt infrastructure failures

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-VAL-03.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: tests/chaos/swarm_v2/ (new); docs/swarm-v2/chaos-runbook.md (new).
Required fixture: Dedicated disposable tasks and canary nodes with no production credentials.
Intended change: Validate different failure semantics without promising uniform recovery.

Implementation sequence

Test viewer detach, SSH loss, controller restart, Pod deletion, OOM, and node loss separately.
Verify periodic checkpoint and archive watermarks before each experiment.
Record actual loss and recovery type.
Use a designated canary and restore infrastructure policy afterward.

Boundary and interface obligations

Input preparation: construct the package fixture from dedicated disposable tasks and canary nodes with no production credentials.
Output contract: Each failure yields the documented state transition and no duplicate shared-task writer.
Rejection contract: A graceful drain test alone cannot qualify abrupt Spot or node-failure recovery.
Recovery contract: Repeated experiments leave no orphan Pods, attach profiles, reservations, or pending restore claims.
Mutation scope: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-VAL-04-A.
Negative case: T-SV2-VAL-04-B.
Recovery case: T-SV2-VAL-04-C.
Package-specific measurements: chaos_recovery_outcomes.
Evidence record: evidence/SV2-VAL-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Stop the experiment cohort and route new work to the previously qualified execution policy.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-VAL-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-VAL-05: Run end-to-end acceptance with operator evidence

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-VAL-04.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: tests/e2e/swarm_v2/ (new); docs/swarm-v2/acceptance-report.md (new).
Required fixture: Mixed-harness two-project swarm with personal-brain isolation and one controlled recovery.
Intended change: Demonstrate the whole workflow rather than isolated components.

Implementation sequence

Run Claude and Codex tasks in two projects across local and permitted remote capacity.
Demonstrate targeted brain memory and session recall.
Close viewers, recover a canary attempt, and inspect evidence.
Attach actual test outputs and operator-approved findings to the implementation tracker.

Boundary and interface obligations

Input preparation: construct the package fixture from mixed-harness two-project swarm with personal-brain isolation and one controlled recovery.
Output contract: The complete acceptance definition in section 18 is satisfied with linked evidence from all three repositories.
Rejection contract: A green unit suite without live target delivery and qualified recovery cannot mark Swarm v2 complete.
Recovery contract: A failed acceptance case returns only the relevant rollout gate to blocked while preserving completed evidence.
Mutation scope: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-VAL-05-A.
Negative case: T-SV2-VAL-05-B.
Recovery case: T-SV2-VAL-05-C.
Package-specific measurements: end_to_end_acceptance_passed.
Evidence record: evidence/SV2-VAL-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep the working local swarm and the last qualified distributed cohort available.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-VAL-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream GIT: antoncore GitOps deployment and staged integration

Implementation owner: antoncore. Integration target: G12. Mutation boundary: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass. Baseline references: SRC-ANTON-CA SRC-K8S-STATEFULSET

SV2-GIT-01: Create the permanent swarm control deployment

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-SEC-05, SV2-IMG-05, SV2-KUB-05, SV2-GAT-05, SV2-MUL-05.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: k8s/charts/swarm-control/ (new); k8s/argocd/apps/swarm-control.yaml (new).
Required fixture: Non-Spot placement fixture and a controller restart with two active remote attempts.
Intended change: Host the controller and operator-facing services on durable non-Spot Anton infrastructure.

Implementation sequence

Follow existing long-lived service chart conventions.
Pin image digest and required protocol versions.
Bind durable ledger/configuration state and scoped service credentials.
Ensure node placement does not depend on capacity the controller may remove.

Boundary and interface obligations

Input preparation: construct the package fixture from non-Spot placement fixture and a controller restart with two active remote attempts.
Output contract: The control deployment survives viewer disconnect and can restart without losing current task authority or ledger history.
Rejection contract: The controller cannot schedule onto reclaimable capacity merely because it has free CPU.
Recovery contract: Restarting the controller recovers active attempts through its persisted journal and observations.
Mutation scope: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-GIT-01-A.
Negative case: T-SV2-GIT-01-B.
Recovery case: T-SV2-GIT-01-C.
Package-specific measurements: swarm_control_restart_recovery_seconds.
Evidence record: evidence/SV2-GIT-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Revert the GitOps image/configuration revision with distributed admission paused.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-GIT-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-GIT-02: Create worker policy and namespace resources

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-GIT-01.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: k8s/charts/swarm-node/ (new); k8s/manifests/swarm/ (new); k8s/argocd/apps/swarm-policy.yaml (new).
Required fixture: Static policy release plus dynamic controller-owned Pods and an unrelated namespace workload.
Intended change: Deploy reusable policy and credentials without a fixed competing worker scheduler.

Implementation sequence

Package approved Pod template defaults, quotas, network policy, and scoped grants.
Document controller-owned ephemeral Pod exception to StatefulSet service conventions.
Keep runtime-created Pods outside destructive GitOps pruning assumptions.
Prevent GitOps from resetting dynamic execution counts.

Boundary and interface obligations

Input preparation: construct the package fixture from static policy release plus dynamic controller-owned Pods and an unrelated namespace workload.
Output contract: GitOps reconciles policy while the controller creates and removes its labelled execution Pods safely.
Rejection contract: A reconciliation must not prune live attempts merely because they are not static chart replicas.
Recovery contract: Restoring policy manifests does not adopt or delete unrelated runtime objects.
Mutation scope: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-GIT-02-A.
Negative case: T-SV2-GIT-02-B.
Recovery case: T-SV2-GIT-02-C.
Package-specific measurements: gitops_runtime_ownership_conflicts.
Evidence record: evidence/SV2-GIT-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Revert only the policy release and stop new admissions that depend on newer fields.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-GIT-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-GIT-03: Deploy durable session-memory services

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-GIT-02.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: k8s/charts/swarm-memory/ (new); k8s/argocd/apps/swarm-memory.yaml (new).
Required fixture: Separate archive, catalog, and embedding failure injections.
Intended change: Host the replacement corpus and search process with explicit storage and backup ownership.

Implementation sequence

Select verified Postgres/pgvector and archive backends.
Configure independent process resources and inference budgets.
Deliver scoped ingestion and read credentials.
Configure stage-specific readiness and pipeline alerts.

Boundary and interface obligations

Input preparation: construct the package fixture from separate archive, catalog, and embedding failure injections.
Output contract: Workers archive and search sessions through the agentihooks service without mounting a shared native home.
Rejection contract: Loss of the vector worker cannot make acknowledged source evidence disappear.
Recovery contract: A session-service restart resumes durable cursors and index work without replay corruption.
Mutation scope: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-GIT-03-A.
Negative case: T-SV2-GIT-03-B.
Recovery case: T-SV2-GIT-03-C.
Package-specific measurements: swarm_memory_pipeline_health.
Evidence record: evidence/SV2-GIT-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Revert the service image while preserving additive tables and immutable archives.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-GIT-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-GIT-04: Deploy the shared swarm brain with isolation

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-GIT-03.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: k8s/values-overlays/brain-swarm/ (new); k8s/argocd/apps/brain-swarm.yaml (new).
Required fixture: Shared infrastructure with deliberately separate personal/swarm principals and vault roots.
Intended change: Provide one shared active brain for the swarm without binding personal knowledge into its stores.

Implementation sequence

Configure the selected brain ID, vault, credentials, database namespace, and event keys.
Wire the authorized normalized session source.
Set scoped feed and targeted-context compatibility versions.
Disable accidental automatic restarts of active workers when brain configuration changes.

Boundary and interface obligations

Input preparation: construct the package fixture from shared infrastructure with deliberately separate personal/swarm principals and vault roots.
Output contract: Swarm workers read their brain and project context while the personal brain remains independently configured and inaccessible.
Rejection contract: Shared physical backend configuration without logical authorization separation fails deployment acceptance.
Recovery contract: Replacing the brain service leaves worker execution alive and context temporarily degraded according to policy.
Mutation scope: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-GIT-04-A.
Negative case: T-SV2-GIT-04-B.
Recovery case: T-SV2-GIT-04-C.
Package-specific measurements: swarm_brain_scope_isolation.
Evidence record: evidence/SV2-GIT-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Revert the brain deployment revision and preserve the evidence corpus and prior compatible feed.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-GIT-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-GIT-05: Execute staged local, cloud, and Spot rollout

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-GIT-04.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: automation/swarm-v2-canary.sh (new); docs/swarm-v2-rollout.md (new).
Required fixture: Local-only baseline, one non-Spot worker, mixed small cohort, and explicit Spot canary.
Intended change: Promote only combinations proven by the acceptance gates and operator resource policy.

Implementation sequence

Start with local compatibility and one isolated container.
Add one approved Kubernetes worker before a small mixed cohort.
Qualify source durability and recovery before Spot.
Record measured capacity, quota, and coexistence evidence before raising concurrency.

Boundary and interface obligations

Input preparation: construct the package fixture from local-only baseline, one non-Spot worker, mixed small cohort, and explicit Spot canary.
Output contract: Every promoted cohort has a compatible image/controller/brain tuple and linked gate evidence.
Rejection contract: Failure in checkpoint or scope isolation blocks Spot and larger cohorts even if basic task execution works.
Recovery contract: Rollback drains the new cohort while preserving local execution and all durable transcripts.
Mutation scope: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-GIT-05-A.
Negative case: T-SV2-GIT-05-B.
Recovery case: T-SV2-GIT-05-C.
Package-specific measurements: rollout_gate_status.
Evidence record: evidence/SV2-GIT-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore the last accepted deployment tuple and admission cap, never reset repositories to old commits.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-GIT-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream RET: Retention, migrations, backups, and reversible state

Implementation owner: agentihooks. Integration target: G12. Mutation boundary: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence. Baseline references: SRC-AH-SNAPSHOT

SV2-RET-01: Define corpus and checkpoint retention policies

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-IDX-05, SV2-CKP-05, SV2-GRF-05.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/memory/retention.py (new); scripts/swarm_v2/checkpoints/retention.py (new); docs/swarm-v2/retention.md (new).
Required fixture: Expired unreferenced checkpoint, active restore, held task evidence, and personal retention policy.
Intended change: Make storage growth bounded without deleting active recovery or required task evidence.

Implementation sequence

Define separate retention for raw evidence, native resume bundles, previews, vectors, and operational logs.
Protect objects referenced by active restore or accepted evidence holds.
Record deletion eligibility and dry-run results.
Require explicit policy for personal versus swarm corpora.

Boundary and interface obligations

Input preparation: construct the package fixture from expired unreferenced checkpoint, active restore, held task evidence, and personal retention policy.
Output contract: Retention removes only eligible unreferenced objects and retains the latest required complete checkpoint for active tasks.
Rejection contract: An active restore’s manifest or required object cannot be collected mid-read.
Recovery contract: Interrupted retention resumes from a deletion journal without deleting a newly protected object.
Mutation scope: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-RET-01-A.
Negative case: T-SV2-RET-01-B.
Recovery case: T-SV2-RET-01-C.
Package-specific measurements: retention_protected_objects.
Evidence record: evidence/SV2-RET-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable destructive collection while preserving the eligibility report and object references.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-RET-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-RET-02: Propagate deletion and access revocation

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-RET-01.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: hooks/memory/catalog.py (new); hooks/memory/api/search.py (new); docs/swarm-v2/revocation-contract.md (new).
Required fixture: One source referenced by search results, a cached pack, and an inferred lesson.
Intended change: Keep direct retrieval, search, context caches, and derived knowledge consistent after a scope change.

Implementation sequence

Emit deletion/revocation tombstones from the source catalog.
Remove or suppress matching search projections before returning new results.
Notify brain consumers of affected evidence references.
Revalidate or redact derived material whose support is no longer permitted.

Boundary and interface obligations

Input preparation: construct the package fixture from one source referenced by search results, a cached pack, and an inferred lesson.
Output contract: Revoked evidence cannot be read through search, range expansion, compatibility aliases, or cached context.
Rejection contract: Deleting only the vector row while retaining a public cached preview fails the contract.
Recovery contract: Consumers replay tombstones after downtime and converge to the current authorization state.
Mutation scope: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-RET-02-A.
Negative case: T-SV2-RET-02-B.
Recovery case: T-SV2-RET-02-C.
Package-specific measurements: revocation_propagation_lag_seconds.
Evidence record: evidence/SV2-RET-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep data inaccessible while rebuilding projections; do not restore revoked access as a rollback shortcut.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-RET-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-RET-03: Create compatible database migrations

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-RET-02.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: migrations/session_memory/; scripts/swarm_v2/migrations.py (new).
Required fixture: Previous schema, new optional fields, interrupted backfill, and mismatched vector dimension.
Intended change: Support staged rollout without destructive surprise or a requirement to stop all local work.

Implementation sequence

Add schemas and columns before switching writers.
Backfill with durable cursors and explicit unknown values.
Verify row counts, uniqueness, and reference resolution before activating consumers.
Retain a documented compatibility window and rollback path.

Boundary and interface obligations

Input preparation: construct the package fixture from previous schema, new optional fields, interrupted backfill, and mismatched vector dimension.
Output contract: Old supported readers and new writers coexist during the stated migration window.
Rejection contract: A destructive vector-dimension change cannot run automatically during ordinary startup.
Recovery contract: A failed backfill resumes without reassigning stable event or chunk identities.
Mutation scope: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-RET-03-A.
Negative case: T-SV2-RET-03-B.
Recovery case: T-SV2-RET-03-C.
Package-specific measurements: migration_rows_remaining.
Evidence record: evidence/SV2-RET-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Deactivate new projections and retain additive schema until a reviewed rollback migration is safe.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-RET-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-RET-04: Implement backup manifests and restore drills

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-RET-03.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/backup.py (new); docs/swarm-v2/backup-restore.md (new).
Required fixture: Catalog backup, immutable objects, brain backup, and one deliberately missing source object.
Intended change: Prove durable state can be recovered independently of currently running Pods.

Implementation sequence

Capture coordinated catalog, ledger, coordination snapshot, archive inventory, and brain backup references.
Record version compatibility and encryption-key identifiers.
Restore into an isolated environment and verify hashes and evidence locators.
Measure observed recovery point and time without inventing guarantees.

Boundary and interface obligations

Input preparation: construct the package fixture from catalog backup, immutable objects, brain backup, and one deliberately missing source object.
Output contract: An isolated restore can answer the agreed historical query and recover a designated task checkpoint from backups alone.
Rejection contract: A successful backup upload without a restore verification does not satisfy acceptance.
Recovery contract: Missing optional indexes are rebuilt from sources while missing source objects are reported as irrecoverable.
Mutation scope: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-RET-04-A.
Negative case: T-SV2-RET-04-B.
Recovery case: T-SV2-RET-04-C.
Package-specific measurements: backup_restore_verification_status.
Evidence record: evidence/SV2-RET-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Preserve the last independently verified backup set and stop destructive retention until coverage is restored.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-RET-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-RET-05: Collect runtime and index garbage safely

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-RET-04.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/garbage_collection.py (new); hooks/memory/index_worker.py (new).
Required fixture: Uncommitted upload, active index, foreign lookalike object, and newly referenced checkpoint.
Intended change: Clean abandoned temporary data without racing new attempts or active generations.

Implementation sequence

Identify orphan uploads, uncommitted manifests, expired reservations, and retired index generations.
Require ownership and grace checks before deletion.
Separate rebuildable caches from authoritative evidence.
Report reclaimed bytes and skipped protected objects.

Boundary and interface obligations

Input preparation: construct the package fixture from uncommitted upload, active index, foreign lookalike object, and newly referenced checkpoint.
Output contract: Cleanup reclaims failed-upload debris while preserving committed artifacts and the active search generation.
Rejection contract: An object name resembling a managed prefix is not sufficient ownership proof.
Recovery contract: A crash midway through garbage collection can be rerun without deleting already-rebound references.
Mutation scope: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-RET-05-A.
Negative case: T-SV2-RET-05-B.
Recovery case: T-SV2-RET-05-C.
Package-specific measurements: garbage_collection_bytes and unsafe_delete_rejections.
Evidence record: evidence/SV2-RET-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable destructive phases and continue read-only inventory until the ownership bug is fixed.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-RET-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream OPS: Operational runbooks and failure-response procedures

Implementation owner: antoncore. Integration target: G12. Mutation boundary: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification. Baseline references: SRC-ANTON-CA SRC-K8S-LIFECYCLE

SV2-OPS-01: Write the controller and dependency outage runbook

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-GIT-05, SV2-OBS-05, SV2-RET-05.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: docs/swarm-v2/runbooks/control-outage.md (new); automation/swarm-readiness.sh (new).
Required fixture: Separate failure scenarios for ledger, Redis, brain, SSH, and controller process.
Intended change: Restore coordination without mistaking viewer or dependency failure for worker death.

Implementation sequence

Document how to distinguish controller, ledger, Redis, brain, and terminal outages.
Pause admission before uncertain recovery.
Inspect current generations and durable watermarks.
Recover dependencies in an order that preserves existing worker ownership.

Boundary and interface obligations

Input preparation: construct the package fixture from separate failure scenarios for ledger, Redis, brain, SSH, and controller process.
Output contract: An operator following the runbook can classify a brain-only outage without restarting all active agents.
Rejection contract: The runbook never starts a second uncontrolled controller as its first diagnostic step.
Recovery contract: Restoring control connectivity reconciles existing workers before any replacement is admitted.
Mutation scope: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-OPS-01-A.
Negative case: T-SV2-OPS-01-B.
Recovery case: T-SV2-OPS-01-C.
Package-specific measurements: control_outage_classification_time.
Evidence record: evidence/SV2-OPS-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Return to read-only diagnosis and keep admission paused when authoritative state is uncertain.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-OPS-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-OPS-02: Write pending-Pod and ASG diagnosis procedures

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-OPS-01.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: docs/swarm-v2/runbooks/capacity.md (new); automation/verify-swarm-scaling.sh (new).
Required fixture: No-fit memory request, missing toleration, failed node join, and provider shortage.
Intended change: Locate capacity failures without changing protected pool policy accidentally.

Implementation sequence

Inspect request fit, taints, required affinity, quota, and autoscaler decisions.
Verify scale-from-zero template metadata and launch progression.
Separate instance launch, private join, provider identity, and Pod scheduling problems.
Preserve existing ASG warm-pool and desired-capacity contracts.

Boundary and interface obligations

Input preparation: construct the package fixture from no-fit memory request, missing toleration, failed node join, and provider shortage.
Output contract: The report identifies whether a canary is blocked by policy, unsatisfiable resources, cloud capacity, or node bootstrap.
Rejection contract: Increasing ASG maxima or adding universal tolerations is not an automatic troubleshooting action.
Recovery contract: A failed instance launch can recover under existing bounds without manual desired-capacity resets.
Mutation scope: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-OPS-02-A.
Negative case: T-SV2-OPS-02-B.
Recovery case: T-SV2-OPS-02-C.
Package-specific measurements: pending_pod_reason_age_seconds.
Evidence record: evidence/SV2-OPS-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Remove only the canary workload and restore any explicitly approved diagnostic configuration.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-OPS-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-OPS-03: Write lost-worker and checkpoint recovery procedures

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-OPS-02.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: docs/swarm-v2/runbooks/lost-worker.md (new); docs/swarm-v2/runbooks/restore.md (new).
Required fixture: Reappearing partitioned worker, corrupt checkpoint, valid older checkpoint, and unsupported native resume.
Intended change: Guide recovery choices using actual durable evidence and fencing state.

Implementation sequence

Confirm old execution status and fence its authority.
Inspect checkpoint completeness and native compatibility.
Choose native resume, context continuation, or explicit fresh start.
Verify restored project, source state, and conversation before releasing work.

Boundary and interface obligations

Input preparation: construct the package fixture from reappearing partitioned worker, corrupt checkpoint, valid older checkpoint, and unsupported native resume.
Output contract: The operator sees a truthful recovery result and can identify exactly what source tail was not durable.
Rejection contract: A stale old worker cannot resume mutations merely because its terminal reappears.
Recovery contract: A failed restore remains awaiting decision and can be retried with another complete checkpoint safely.
Mutation scope: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-OPS-03-A.
Negative case: T-SV2-OPS-03-B.
Recovery case: T-SV2-OPS-03-C.
Package-specific measurements: recovery_manual_decisions_total.
Evidence record: evidence/SV2-OPS-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep both old diagnostic artifacts and the accepted latest checkpoint while automatic recovery is paused.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-OPS-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-OPS-04: Write brain-isolation and search-quality runbooks

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-OPS-03.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: docs/swarm-v2/runbooks/brain-memory.md (new); automation/swarm-memory-check.sh (new).
Required fixture: Wrong route, empty scoped corpus, delayed embedding, stale receipt, and contradictory lesson.
Intended change: Diagnose missing or inappropriate memory without broadening access or poisoning knowledge.

Implementation sequence

Check route identity, project attribution, archive lag, index generation, and feed revision.
Separate no matching evidence from unavailable service and unauthorized scope.
Inspect graph inclusion paths and supersession state.
Quarantine bad inferred knowledge with supporting diagnostics.

Boundary and interface obligations

Input preparation: construct the package fixture from wrong route, empty scoped corpus, delayed embedding, stale receipt, and contradictory lesson.
Output contract: An irrelevant context report can be traced to attribution, ranking, stale cache, or bad graph evidence.
Rejection contract: Fixing an empty result by dropping the project authorization filter is forbidden.
Recovery contract: Rebuilding a bad index preserves immutable evidence and restores source references after cutover.
Mutation scope: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-OPS-04-A.
Negative case: T-SV2-OPS-04-B.
Recovery case: T-SV2-OPS-04-C.
Package-specific measurements: memory_incident_resolution_status.
Evidence record: evidence/SV2-OPS-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable graph expansion or shared caching before disabling source capture.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-OPS-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-OPS-05: Write rollback and emergency-stop procedures

Repository: antoncore.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-OPS-04.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: docs/swarm-v2/runbooks/rollback.md (new); automation/swarm-v2-stop.sh (new).
Required fixture: Two swarms plus unrelated workloads and one execution with an in-flight checkpoint.
Intended change: Make large-scale containment possible without deleting knowledge or unrelated infrastructure.

Implementation sequence

Separate pause-new, graceful-drain, stop-now, and revoke-credentials operations.
Scope every action by namespace, swarm, execution generation, and owned labels.
Preserve checkpoint and source archives before destructive runtime cleanup when possible.
Record accepted data-loss risk for emergency stop.

Boundary and interface obligations

Input preparation: construct the package fixture from two swarms plus unrelated workloads and one execution with an in-flight checkpoint.
Output contract: A single swarm can be stopped while the local compatibility swarm and unrelated cluster services remain untouched.
Rejection contract: A broad namespace deletion or wildcard process kill is not an approved default step.
Recovery contract: Reopening after emergency stop restores tasks through explicit recovery decisions and current credentials.
Mutation scope: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-OPS-05-A.
Negative case: T-SV2-OPS-05-B.
Recovery case: T-SV2-OPS-05-C.
Package-specific measurements: emergency_stop_scope_verification.
Evidence record: evidence/SV2-OPS-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the antoncore pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Retain the prior deployment tuple and restore admission only after the incident acceptance checks pass.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-OPS-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream PRF: Performance qualification and useful-memory evaluation

Implementation owner: agentihooks. Integration target: G10. Mutation boundary: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement. Baseline references: SRC-K8S-RESOURCES

SV2-PRF-01: Benchmark complete worker resource usage

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-OBS-05, SV2-IDX-05, SV2-GAT-05.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: tests/performance/swarm_v2/workloads/ (new); docs/swarm-v2/resource-results.md (new).
Required fixture: Representative task suites with controlled child-worker counts.
Intended change: Size workers from realistic test/build/browser activity rather than idle CLI processes.

Implementation sequence

Measure parent and child CPU, RSS, storage, and process count.
Include general, browser-heavy, compiler-heavy, and memory-heavy tasks.
Record node allocatable capacity and colocated workload pressure.
Derive conservative resource profiles and explicit uncertainty.

Boundary and interface obligations

Input preparation: construct the package fixture from representative task suites with controlled child-worker counts.
Output contract: The report supports each admitted profile with measured distributions and a coexistence result.
Rejection contract: An idle CLI RSS sample cannot justify a large fleet concurrency claim.
Recovery contract: Re-running after a target CLI or toolchain update detects material resource changes before promotion.
Mutation scope: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-PRF-01-A.
Negative case: T-SV2-PRF-01-B.
Recovery case: T-SV2-PRF-01-C.
Package-specific measurements: worker_process_tree_peak_memory.
Evidence record: evidence/SV2-PRF-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore previous profile limits and lower admission while new measurements are gathered.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-PRF-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-PRF-02: Benchmark cold launch and scaling stages

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-PRF-01.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: tests/performance/swarm_v2/startup.py (new); docs/swarm-v2/startup-results.md (new).
Required fixture: Warm node, cold node, uncached image, and registry interruption.
Intended change: Attribute startup delays to image, Pod, instance, and join phases separately.

Implementation sequence

Measure warm Pod launch and cold image pull.
Measure ASG request to node readiness independently.
Capture worker bootstrap and native handshake timing.
Record failure samples and avoid reporting only successful medians.

Boundary and interface obligations

Input preparation: construct the package fixture from warm node, cold node, uncached image, and registry interruption.
Output contract: The report distinguishes node-provision delay from worker-image initialization delay.
Rejection contract: A warm-cache test cannot be advertised as cold scale-from-zero performance.
Recovery contract: Repeating with an unavailable image registry shows bounded classified failures and no leaked account reservations.
Mutation scope: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-PRF-02-A.
Negative case: T-SV2-PRF-02-B.
Recovery case: T-SV2-PRF-02-C.
Package-specific measurements: startup_stage_p50_p95.
Evidence record: evidence/SV2-PRF-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Use the previous qualified image and reduce launch concurrency.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-PRF-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-PRF-03: Benchmark capture and retrieval under swarm load

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-PRF-02.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: tests/performance/session_memory/ (new); docs/swarm-v2/memory-throughput.md (new).
Required fixture: Concurrent growing transcripts with duplicate delivery and restricted project queries.
Intended change: Ensure source durability and search remain usable during concurrent session growth.

Implementation sequence

Replay synthetic provider logs at a controlled rate without paying for unnecessary live inference.
Measure ingestion acknowledgement, spool backlog, embedding lag, and search latency.
Verify event counts and source hashes after load.
Exercise restrictive project filters and high-cardinality session IDs.

Boundary and interface obligations

Input preparation: construct the package fixture from concurrent growing transcripts with duplicate delivery and restricted project queries.
Output contract: The pipeline keeps acknowledged evidence complete under the accepted workload and reports any lag explicitly.
Rejection contract: Dropping records to meet latency targets is a correctness failure.
Recovery contract: After overload ends, backlogs drain without re-embedding unchanged history.
Mutation scope: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-PRF-03-A.
Negative case: T-SV2-PRF-03-B.
Recovery case: T-SV2-PRF-03-C.
Package-specific measurements: ingest_ack_latency_seconds and search_latency_seconds.
Evidence record: evidence/SV2-PRF-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Lower ingest concurrency or pause optional embeddings while retaining durable capture.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-PRF-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-PRF-04: Evaluate brain context usefulness on held-out tasks

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-PRF-03.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: tests/evaluation/brain_context/ (new); docs/swarm-v2/context-quality.md (new).
Required fixture: Held-out incident, prior design decision, unrelated hot arc, and superseded guidance cases.
Intended change: Measure relevance and avoided repeated mistakes rather than the number of brain tool calls.

Implementation sequence

Build a held-out set of real engineering questions with expected supporting sources.
Compare feed-only, scoped retrieval, and graph-expanded packs.
Review contradiction handling and stale guidance with human-labelled cases.
Track context tokens and usefulness together.

Boundary and interface obligations

Input preparation: construct the package fixture from held-out incident, prior design decision, unrelated hot arc, and superseded guidance cases.
Output contract: Graph expansion improves retrieval of the expected connected lesson without increasing scope leakage or irrelevant injection.
Rejection contract: More retrieved arcs or more tokens alone cannot qualify the new policy.
Recovery contract: Reverting a ranking policy produces reproducible comparisons against the same corpus revision.
Mutation scope: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-PRF-04-A.
Negative case: T-SV2-PRF-04-B.
Recovery case: T-SV2-PRF-04-C.
Package-specific measurements: context_source_recall and reviewed_usefulness.
Evidence record: evidence/SV2-PRF-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore the last accepted ranking and packing policy.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-PRF-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-PRF-05: Qualify gate overhead and rollout concurrency

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-PRF-04.
Integration gate: G10, subject to all earlier applicable acceptance gates.
Owned path candidates: tests/performance/swarm_v2/hooks.py (new); docs/swarm-v2/concurrency-envelope.md (new).
Required fixture: Small staged cohorts with an intentionally slowed brain and archive backend.
Intended change: Define a safe measured operating envelope for the first distributed release.

Implementation sequence

Measure cached hook overhead and cold context latency separately.
Test request coalescing during small controlled launch bursts.
Validate account, pending-Pod, inference, and storage budgets together.
Require operator approval before expanding beyond the qualified cohort.

Boundary and interface obligations

Input preparation: construct the package fixture from small staged cohorts with an intentionally slowed brain and archive backend.
Output contract: The accepted cohort has measured overhead, resource headroom, and no hard correctness failures.
Rejection contract: Passing a synthetic hundred-session ingestion test does not authorize a hundred live provider agents.
Recovery contract: A dependency slowdown causes bounded waiting instead of multiplying retries and reservations.
Mutation scope: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-PRF-05-A.
Negative case: T-SV2-PRF-05-B.
Recovery case: T-SV2-PRF-05-C.
Package-specific measurements: qualified_concurrency and hook_latency_p95.
Evidence record: evidence/SV2-PRF-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Return to the preceding qualified cohort size and observe mode for consultation gates.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-PRF-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

Workstream REL: Cross-repository release, acceptance, and final closure

Implementation owner: agentihooks. Integration target: G12. Mutation boundary: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone. Baseline references: SRC-AH-GUIDE

SV2-REL-01: Publish the cross-repository compatibility matrix

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-VAL-05, SV2-GIT-05, SV2-RET-05, SV2-OPS-05, SV2-PRF-05, SV2-MIG-05, SV2-CAP-05, SV2-ACC-05, SV2-ING-05, SV2-UX-05.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: docs/swarm-v2/compatibility.md (new); docs/swarm-v2/schemas/compatibility.json (new).
Required fixture: One accepted tuple, one unsupported brain schema, and one changed image digest under the same tag.
Intended change: Tie controller, image, hook, brain, and deployment versions into accepted tuples.

Implementation sequence

Record the exact tested commit and image digest for each component.
State supported schema major/minor combinations.
Define safe deployment ordering and downgrade limits.
Validate the matrix in release CI.

Boundary and interface obligations

Input preparation: construct the package fixture from one accepted tuple, one unsupported brain schema, and one changed image digest under the same tag.
Output contract: An operator can identify a fully tested deployment tuple and its rollback tuple without inferring compatibility from matching tag names.
Rejection contract: A floating dev tag alone is not sufficient release evidence.
Recovery contract: A patch release requalifies affected interfaces without resetting unrelated acceptance history.
Mutation scope: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-REL-01-A.
Negative case: T-SV2-REL-01-B.
Recovery case: T-SV2-REL-01-C.
Package-specific measurements: incompatible_deployment_tuples.
Evidence record: evidence/SV2-REL-01/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Select the last accepted tuple with current data compatibility explicitly checked.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-REL-01 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-REL-02: Complete migration and policy documentation

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-REL-01.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: docs/swarm-v2/; Swarm-v2.md.
Required fixture: Fresh-reader walkthrough using only the repository and published compatibility artifacts.
Intended change: Make the implementation maintainable by agents and humans after the original conversation is gone.

Implementation sequence

Replace proposed status with implemented references only where evidence exists.
Document configuration, endpoints, source schema, and recovery limits.
Record deviations from the plan as explicit accepted decisions.
Keep the operator guide focused on actual supported commands.

Boundary and interface obligations

Input preparation: construct the package fixture from fresh-reader walkthrough using only the repository and published compatibility artifacts.
Output contract: A fresh implementation agent can run the supported test and diagnostic paths without relying on hidden chat context.
Rejection contract: Unimplemented example commands are not silently presented as available features.
Recovery contract: Documentation updates preserve stable package and evidence IDs for existing issue links.
Mutation scope: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-REL-02-A.
Negative case: T-SV2-REL-02-B.
Recovery case: T-SV2-REL-02-C.
Package-specific measurements: documentation_contract_drift.
Evidence record: evidence/SV2-REL-02/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Restore the last correct guide while retaining a visible erratum for any unsafe instruction.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-REL-02 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-REL-03: Perform final target-architecture dependency audit

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-REL-02.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: scripts/swarm_v2/dependency_audit.py (new); docs/swarm-v2/final-audit.md (new).
Required fixture: Accepted deployment inventory plus injected hidden fallback and duplicated scheduler examples.
Intended change: Verify the three-repository design has not accumulated hidden runtime dependencies during implementation.

Implementation sequence

Inventory active packages, services, queues, databases, charts, and endpoint callers.
Verify one coding-task authority and one infrastructure scaler.
Confirm retired transcript-service runtime paths are absent.
Check workers do not contain whole brain or database stacks.

Boundary and interface obligations

Input preparation: construct the package fixture from accepted deployment inventory plus injected hidden fallback and duplicated scheduler examples.
Output contract: The target deployment runs with only the accepted components and the documented optional infrastructure integrations.
Rejection contract: A second hidden coding-task queue or legacy endpoint fallback blocks final acceptance.
Recovery contract: Restoring from the release backup reproduces the same dependency inventory.
Mutation scope: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-REL-03-A.
Negative case: T-SV2-REL-03-B.
Recovery case: T-SV2-REL-03-C.
Package-specific measurements: unapproved_runtime_dependencies.
Evidence record: evidence/SV2-REL-03/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Disable the unapproved component path and keep the last qualified architecture tuple.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-REL-03 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-REL-04: Collect operator acceptance and recovery proof

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-REL-03.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: docs/swarm-v2/acceptance-report.md (new); implementation issue checklist.
Required fixture: Recorded operator walkthrough with two projects, two harnesses, and one recovery scenario.
Intended change: Connect implementation results to every operator requirement from this plan.

Implementation sequence

Demonstrate one-window remote inspection and client-independent execution.
Demonstrate bounded scaling, mixed-harness memory recall, and scoped brain context.
Demonstrate private/swarm brain separation and a truthful lost-worker recovery.
Link repository pull requests and test artifacts to each requirement.

Boundary and interface obligations

Input preparation: construct the package fixture from recorded operator walkthrough with two projects, two harnesses, and one recovery scenario.
Output contract: The operator can verify each section-18 outcome from concrete evidence and explicit limitations.
Rejection contract: A partially implemented graph or unqualified native resume path must remain marked incomplete.
Recovery contract: Failed acceptance leaves the working local swarm and last qualified remote path available.
Mutation scope: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-REL-04-A.
Negative case: T-SV2-REL-04-B.
Recovery case: T-SV2-REL-04-C.
Package-specific measurements: operator_acceptance_requirements_passed.
Evidence record: evidence/SV2-REL-04/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Keep rollout at the last accepted gate rather than declaring a broader release.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-REL-04 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

SV2-REL-05: Close the plan implementation and hand over maintenance

Repository: agentihooks.
Implementation status: planned; not executed by publication of this document.
Dependencies: SV2-REL-04.
Integration gate: G12, subject to all earlier applicable acceptance gates.
Owned path candidates: docs/swarm-v2/maintenance.md (new); implementation issue.
Required fixture: Completed evidence registry plus deliberately unresolved mandatory native-recovery and scope tests.
Intended change: Finish with explicit owners, budgets, support boundaries, and future work separated from mandatory scope.

Implementation sequence

Confirm all required work packages have evidence or an operator-approved replacement decision.
Record ongoing backup, credential, image, and policy maintenance owners.
Separate optional future cross-brain federation and new hardware pools from baseline delivery.
Close the umbrella issue only when the acceptance checklist is complete.

Boundary and interface obligations

Input preparation: construct the package fixture from completed evidence registry plus deliberately unresolved mandatory native-recovery and scope tests.
Output contract: The implementation tracker links the accepted plan revision, release tuple, known limitations, and maintenance runbooks.
Rejection contract: Merely committing Swarm-v2.md or creating the issue cannot mark implementation complete.
Recovery contract: A later regression reopens the affected acceptance gate and references the original stable requirement IDs.
Mutation scope: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
Compatibility obligation: compare the affected public behavior with the preceding accepted protocol or explicitly local compatibility path.
Authority obligation: derive actor and scope from the fixture grant or operator role; never infer permission from a display label.
State obligation: distinguish observed, accepted, committed, and externally verified outcomes in the implementation report.

Acceptance and proof

Positive case: T-SV2-REL-05-A.
Negative case: T-SV2-REL-05-B.
Recovery case: T-SV2-REL-05-C.
Package-specific measurements: release_acceptance_state.
Evidence record: evidence/SV2-REL-05/result.json, plus sanitized logs or reports named by the test cases.
Code evidence: link the agentihooks pull request and exact tested commit in this package record.
Live evidence: required only at the applicable rollout gate; a mocked result must be labelled mocked.
Failure evidence: keep the smallest reproducible fixture or random seed when the stated rejection or recovery contract fails.

Rollback and completion

Rollback action: Reopen the tracker and restore the prior accepted deployment tuple without deleting accumulated evidence.
Data safety: identify authoritative objects before rollback; do not delete them as if they were caches.
Rollout safety: disable only the affected new path when possible and retain the last qualified local execution behavior.
Completion evidence: record implemented interfaces, supported versions, test outputs, remaining limitations, and the rollback rehearsal.
Ledger linkage: use SV2-REL-05 in the implementation task description and preserve its dependent package references.
Not done: do not mark the package complete from a plan, schema stub, healthy process, or unverified success message alone.

21. Behavioral conformance scenarios

Each package has a positive, negative, and recovery scenario. These are test specifications to implement; they are not claims that tests ran during plan preparation. The fixture descriptions are package-specific and must be converted into deterministic data or an explicitly approved live canary. For networking and external-provider cases, start with protocol fakes and add live qualification only at the stated gate. Check both the returned result and the absence of unauthorized side effects. Do not count a rejected request as safe if it already changed the protected state before returning an error. For operation retries, distinguish replay-safe reads from ambiguous external mutations. For archive tests, compare original and retrieved content hashes rather than only row counts. For scope tests, check snippets, titles, counts, caches, and direct references as well as search results. For recovery tests, preserve a pre-failure state snapshot and compare the authoritative post-recovery state.

Conformance group FND: Baseline, contracts, and implementation governance

T-SV2-FND-01-A: Capture implementation source and deployment baselines / successful behavior

Requirement: SV2-FND-01.
Responsible implementation: agentihooks.
Fixture inputs: Three repository refs plus one deliberately unavailable deployment endpoint.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-FND-01.
When: execute the owned behavior described as: Establish which interfaces are source-proven and which deployment values still need read-only verification.
Then: A report separates source version, deployed version, and unknown live values for all three repositories.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect baseline_unverified_items and baseline_drift_items with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FND-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
On failure: apply the package containment/rollback rule: Revert only the baseline document if attribution is wrong; retain original read-only evidence outside the source tree.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FND-01-B: Capture implementation source and deployment baselines / rejection and containment

Requirement: SV2-FND-01.
Responsible implementation: agentihooks.
Fixture inputs: Three repository refs plus one deliberately unavailable deployment endpoint.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-FND-01 without broadening its grant or replacing the bad input silently.
Then: A missing cluster connection is recorded as unverified, never as an empty cluster or zero running agents.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect baseline_unverified_items and baseline_drift_items with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FND-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
On failure: apply the package containment/rollback rule: Revert only the baseline document if attribution is wrong; retain original read-only evidence outside the source tree.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FND-01-C: Capture implementation source and deployment baselines / recovery and replay

Requirement: SV2-FND-01.
Responsible implementation: agentihooks.
Fixture inputs: Three repository refs plus one deliberately unavailable deployment endpoint.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Re-running the baseline after one repository advances adds a drift entry without resetting any branch.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect baseline_unverified_items and baseline_drift_items with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FND-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
On failure: apply the package containment/rollback rule: Revert only the baseline document if attribution is wrong; retain original read-only evidence outside the source tree.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FND-02-A: Freeze package boundaries and architecture decisions / successful behavior

Requirement: SV2-FND-02.
Responsible implementation: agentihooks.
Fixture inputs: A design inventory containing one duplicate task dispatcher and one legitimate embedding backlog.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-FND-02.
When: execute the owned behavior described as: Prevent the implementation from recreating overlapping schedulers or embedding the entire brain stack in workers.
Then: Every target component has one code owner, one state owner, and one deployment owner.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect architecture_unowned_components with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FND-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
On failure: apply the package containment/rollback rule: Restore the last accepted architecture revision; do not erase the alternative and its rejection reason.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FND-02-B: Freeze package boundaries and architecture decisions / rejection and containment

Requirement: SV2-FND-02.
Responsible implementation: agentihooks.
Fixture inputs: A design inventory containing one duplicate task dispatcher and one legitimate embedding backlog.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-FND-02 without broadening its grant or replacing the bad input silently.
Then: A proposal that inserts another coding-task queue is rejected unless the operator explicitly changes the architecture.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect architecture_unowned_components with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FND-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
On failure: apply the package containment/rollback rule: Restore the last accepted architecture revision; do not erase the alternative and its rejection reason.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FND-02-C: Freeze package boundaries and architecture decisions / recovery and replay

Requirement: SV2-FND-02.
Responsible implementation: agentihooks.
Fixture inputs: A design inventory containing one duplicate task dispatcher and one legitimate embedding backlog.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Conflicting design proposals are recorded as unresolved decisions while unrelated implementation continues.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect architecture_unowned_components with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FND-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
On failure: apply the package containment/rollback rule: Restore the last accepted architecture revision; do not erase the alternative and its rejection reason.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FND-03-A: Publish versioned transport contracts / successful behavior

Requirement: SV2-FND-03.
Responsible implementation: agentihooks.
Fixture inputs: Current, previous-minor, future-major, and missing-authority fixture families.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-FND-03.
When: execute the owned behavior described as: Define authority, compatibility, and error envelopes before producers and consumers diverge.
Then: A consumer validates all shared fixtures without importing the producer’s runtime package.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect contract_validation_failures_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FND-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
On failure: apply the package containment/rollback rule: Keep the previous schema version available and disable the new writer until all required consumers support it.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FND-03-B: Publish versioned transport contracts / rejection and containment

Requirement: SV2-FND-03.
Responsible implementation: agentihooks.
Fixture inputs: Current, previous-minor, future-major, and missing-authority fixture families.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-FND-03 without broadening its grant or replacing the bad input silently.
Then: An unknown major version or absent execution generation is refused before a state write.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect contract_validation_failures_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FND-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
On failure: apply the package containment/rollback rule: Keep the previous schema version available and disable the new writer until all required consumers support it.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FND-03-C: Publish versioned transport contracts / recovery and replay

Requirement: SV2-FND-03.
Responsible implementation: agentihooks.
Fixture inputs: Current, previous-minor, future-major, and missing-authority fixture families.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A compatible optional field added by a newer producer survives round-trip without breaking an older reader.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect contract_validation_failures_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FND-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
On failure: apply the package containment/rollback rule: Keep the previous schema version available and disable the new writer until all required consumers support it.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FND-04-A: Build the requirement-to-evidence registry / successful behavior

Requirement: SV2-FND-04.
Responsible implementation: agentihooks.
Fixture inputs: One fully evidenced package and one package with only a deployment screenshot.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-FND-04.
When: execute the owned behavior described as: Make completion auditable across repositories without using generated prose as proof.
Then: The validator identifies a claimed completed package lacking its required recovery proof.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect packages_missing_evidence with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FND-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
On failure: apply the package containment/rollback rule: Revert status projections without changing underlying test artifacts or accepted source commits.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FND-04-B: Build the requirement-to-evidence registry / rejection and containment

Requirement: SV2-FND-04.
Responsible implementation: agentihooks.
Fixture inputs: One fully evidenced package and one package with only a deployment screenshot.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-FND-04 without broadening its grant or replacing the bad input silently.
Then: A screenshot of a healthy Pod alone cannot satisfy transcript durability or scope isolation acceptance.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect packages_missing_evidence with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FND-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
On failure: apply the package containment/rollback rule: Revert status projections without changing underlying test artifacts or accepted source commits.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FND-04-C: Build the requirement-to-evidence registry / recovery and replay

Requirement: SV2-FND-04.
Responsible implementation: agentihooks.
Fixture inputs: One fully evidenced package and one package with only a deployment screenshot.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Restoring the evidence registry from a backup preserves stable IDs and links to existing pull requests.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect packages_missing_evidence with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FND-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
On failure: apply the package containment/rollback rule: Revert status projections without changing underlying test artifacts or accepted source commits.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FND-05-A: Prepare isolated development and test environments / successful behavior

Requirement: SV2-FND-05.
Responsible implementation: agentihooks.
Fixture inputs: Temporary Claude, Codex, brain, archive, Redis, and Kubernetes identities with deliberate path traps.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-FND-05.
When: execute the owned behavior described as: Ensure swarm development cannot write the operator’s live homes, Redis keys, vault, or deployment.
Then: Running unit and contract suites creates no files under a real configured agent home or vault.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect test_live_path_rejections_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FND-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
On failure: apply the package containment/rollback rule: Remove only fixture-owned resources after validating their test-run identity.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FND-05-B: Prepare isolated development and test environments / rejection and containment

Requirement: SV2-FND-05.
Responsible implementation: agentihooks.
Fixture inputs: Temporary Claude, Codex, brain, archive, Redis, and Kubernetes identities with deliberate path traps.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-FND-05 without broadening its grant or replacing the bad input silently.
Then: A test whose resolved root escapes the temporary fixture directory aborts immediately.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect test_live_path_rejections_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FND-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
On failure: apply the package containment/rollback rule: Remove only fixture-owned resources after validating their test-run identity.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FND-05-C: Prepare isolated development and test environments / recovery and replay

Requirement: SV2-FND-05.
Responsible implementation: agentihooks.
Fixture inputs: Temporary Claude, Codex, brain, archive, Redis, and Kubernetes identities with deliberate path traps.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: An interrupted test run can be rerun without consuming stale production-named locks.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect test_live_path_rejections_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FND-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Documentation, fixtures, and compatibility metadata only; no live infrastructure mutation.
On failure: apply the package containment/rollback rule: Remove only fixture-owned resources after validating their test-run identity.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group IDN: Canonical project, session, and execution identity

T-SV2-IDN-01-A: Create canonical cross-machine project IDs / successful behavior

Requirement: SV2-IDN-01.
Responsible implementation: agentihooks.
Fixture inputs: Two owners with repository name common, one worktree, one nested directory, and one renamed remote.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-IDN-01.
When: execute the owned behavior described as: Extend the existing resolver without regressing checkout and worktree equivalence.
Then: A checkout, a linked worktree, and a nested directory resolve to one canonical project while equal basenames under different owners remain separate.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Identity resolution and metadata only; a computed label never grants authorization.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect project_identity_ambiguities_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDN-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Identity resolution and metadata only; a computed label never grants authorization.
On failure: apply the package containment/rollback rule: Continue reading the prior identity fields while new canonical IDs remain additive.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDN-01-B: Create canonical cross-machine project IDs / rejection and containment

Requirement: SV2-IDN-01.
Responsible implementation: agentihooks.
Fixture inputs: Two owners with repository name common, one worktree, one nested directory, and one renamed remote.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-IDN-01 without broadening its grant or replacing the bad input silently.
Then: A remote containing credentials or an unsupported ambiguous URL is sanitized or refused rather than stored verbatim.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect project_identity_ambiguities_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDN-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Identity resolution and metadata only; a computed label never grants authorization.
On failure: apply the package containment/rollback rule: Continue reading the prior identity fields while new canonical IDs remain additive.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDN-01-C: Create canonical cross-machine project IDs / recovery and replay

Requirement: SV2-IDN-01.
Responsible implementation: agentihooks.
Fixture inputs: Two owners with repository name common, one worktree, one nested directory, and one renamed remote.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A project rename preserves historical evidence through an explicit alias without merging unrelated repositories.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect project_identity_ambiguities_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDN-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Identity resolution and metadata only; a computed label never grants authorization.
On failure: apply the package containment/rollback rule: Continue reading the prior identity fields while new canonical IDs remain additive.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDN-02-A: Separate logical agents from execution attempts / successful behavior

Requirement: SV2-IDN-02.
Responsible implementation: agentihooks.
Fixture inputs: One seat with three sequential attempts and two Pods sharing a human display label.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-IDN-02.
When: execute the owned behavior described as: Keep seat continuity while giving every replacement process an immutable execution incarnation.
Then: Replacing a lost Pod creates a new execution ID and generation while preserving the intended seat and task lineage.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Identity resolution and metadata only; a computed label never grants authorization.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect execution_identity_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDN-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Identity resolution and metadata only; a computed label never grants authorization.
On failure: apply the package containment/rollback rule: Keep old record readers compatible and stop distributed launches before rolling the writer back.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDN-02-B: Separate logical agents from execution attempts / rejection and containment

Requirement: SV2-IDN-02.
Responsible implementation: agentihooks.
Fixture inputs: One seat with three sequential attempts and two Pods sharing a human display label.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-IDN-02 without broadening its grant or replacing the bad input silently.
Then: Reusing a stale Pod UID or treating the display name as unique attempt identity is refused.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect execution_identity_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDN-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Identity resolution and metadata only; a computed label never grants authorization.
On failure: apply the package containment/rollback rule: Keep old record readers compatible and stop distributed launches before rolling the writer back.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDN-02-C: Separate logical agents from execution attempts / recovery and replay

Requirement: SV2-IDN-02.
Responsible implementation: agentihooks.
Fixture inputs: One seat with three sequential attempts and two Pods sharing a human display label.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A controller restart reconstructs logical seat occupancy from persisted attempt history.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect execution_identity_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDN-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Identity resolution and metadata only; a computed label never grants authorization.
On failure: apply the package containment/rollback rule: Keep old record readers compatible and stop distributed launches before rolling the writer back.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDN-03-A: Capture event-time task and repository context / successful behavior

Requirement: SV2-IDN-03.
Responsible implementation: agentihooks.
Fixture inputs: A transcript with two task changes, one worktree switch, and an explicitly shared warning.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-IDN-03.
When: execute the owned behavior described as: Preserve what a session was doing at each point rather than attributing all history to its latest working directory.
Then: A session that changes task halfway through has correctly scoped historical events on both sides of the transition.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Identity resolution and metadata only; a computed label never grants authorization.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect unattributed_session_events_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDN-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Identity resolution and metadata only; a computed label never grants authorization.
On failure: apply the package containment/rollback rule: Retain original raw metadata and disable new projections rather than rewriting history to a default project.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDN-03-B: Capture event-time task and repository context / rejection and containment

Requirement: SV2-IDN-03.
Responsible implementation: agentihooks.
Fixture inputs: A transcript with two task changes, one worktree switch, and an explicitly shared warning.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-IDN-03 without broadening its grant or replacing the bad input silently.
Then: A worker-supplied project outside its signed launch grant is rejected even when the folder exists locally.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect unattributed_session_events_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDN-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Identity resolution and metadata only; a computed label never grants authorization.
On failure: apply the package containment/rollback rule: Retain original raw metadata and disable new projections rather than rewriting history to a default project.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDN-03-C: Capture event-time task and repository context / recovery and replay

Requirement: SV2-IDN-03.
Responsible implementation: agentihooks.
Fixture inputs: A transcript with two task changes, one worktree switch, and an explicitly shared warning.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Replay of metadata transitions reconstructs the same event-time attribution without duplicate session entries.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect unattributed_session_events_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDN-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Identity resolution and metadata only; a computed label never grants authorization.
On failure: apply the package containment/rollback rule: Retain original raw metadata and disable new projections rather than rewriting history to a default project.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDN-04-A: Bind identity to authenticated launch authority / successful behavior

Requirement: SV2-IDN-04.
Responsible implementation: agentihooks.
Fixture inputs: Valid grant, expired grant, wrong audience, mismatched generation, and altered project body.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-IDN-04.
When: execute the owned behavior described as: Prevent an agent from impersonating another project, task, account, or brain through request parameters.
Then: A correctly launched worker registers only its own execution and authorized corpus.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Identity resolution and metadata only; a computed label never grants authorization.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect launch_grant_rejections_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDN-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Identity resolution and metadata only; a computed label never grants authorization.
On failure: apply the package containment/rollback rule: Revoke outstanding grants for the disabled protocol and keep historical execution records read-only.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDN-04-B: Bind identity to authenticated launch authority / rejection and containment

Requirement: SV2-IDN-04.
Responsible implementation: agentihooks.
Fixture inputs: Valid grant, expired grant, wrong audience, mismatched generation, and altered project body.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-IDN-04 without broadening its grant or replacing the bad input silently.
Then: Changing a body field to another task or brain fails authorization before any registry write.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect launch_grant_rejections_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDN-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Identity resolution and metadata only; a computed label never grants authorization.
On failure: apply the package containment/rollback rule: Revoke outstanding grants for the disabled protocol and keep historical execution records read-only.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDN-04-C: Bind identity to authenticated launch authority / recovery and replay

Requirement: SV2-IDN-04.
Responsible implementation: agentihooks.
Fixture inputs: Valid grant, expired grant, wrong audience, mismatched generation, and altered project body.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A retried registration with the same valid grant returns the original identity without creating another worker.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect launch_grant_rejections_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDN-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Identity resolution and metadata only; a computed label never grants authorization.
On failure: apply the package containment/rollback rule: Revoke outstanding grants for the disabled protocol and keep historical execution records read-only.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDN-05-A: Namespace every cache and deduplication key / successful behavior

Requirement: SV2-IDN-05.
Responsible implementation: agentihooks.
Fixture inputs: Paired personal and swarm installations deliberately sharing every display label.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-IDN-05.
When: execute the owned behavior described as: Eliminate cross-brain and cross-installation collisions hidden by equal local paths.
Then: Two installations with the same native session ID and path produce independent cache and archive identities.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Identity resolution and metadata only; a computed label never grants authorization.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect cache_scope_mismatch_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDN-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Identity resolution and metadata only; a computed label never grants authorization.
On failure: apply the package containment/rollback rule: Delete only rebuildable new caches; never delete durable records during a cache-format rollback.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDN-05-B: Namespace every cache and deduplication key / rejection and containment

Requirement: SV2-IDN-05.
Responsible implementation: agentihooks.
Fixture inputs: Paired personal and swarm installations deliberately sharing every display label.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-IDN-05 without broadening its grant or replacing the bad input silently.
Then: A cache entry from a different brain cannot satisfy a targeted context request.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect cache_scope_mismatch_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDN-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Identity resolution and metadata only; a computed label never grants authorization.
On failure: apply the package containment/rollback rule: Delete only rebuildable new caches; never delete durable records during a cache-format rollback.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDN-05-C: Namespace every cache and deduplication key / recovery and replay

Requirement: SV2-IDN-05.
Responsible implementation: agentihooks.
Fixture inputs: Paired personal and swarm installations deliberately sharing every display label.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Old and new cache namespaces can coexist during rollout without reading stale data as current authority.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect cache_scope_mismatch_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDN-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Identity resolution and metadata only; a computed label never grants authorization.
On failure: apply the package containment/rollback rule: Delete only rebuildable new caches; never delete durable records during a cache-format rollback.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group RUN: Runtime interface and local compatibility

T-SV2-RUN-01-A: Extract a capability-based runtime protocol / successful behavior

Requirement: SV2-RUN-01.
Responsible implementation: agentihooks.
Fixture inputs: Local fake runtime and remote fake runtime with deliberately different capabilities.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-RUN-01.
When: execute the owned behavior described as: Separate task orchestration from local process and terminal implementation details.
Then: The existing local swarm completes its original spawn, observe, and retire tests through the new interface.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Only the selected execution backend may act on its own runtime object.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect runtime_capability_failures_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RUN-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Only the selected execution backend may act on its own runtime object.
On failure: apply the package containment/rollback rule: Route new tasks back to the local adapter while preserving distributed attempt history.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RUN-01-B: Extract a capability-based runtime protocol / rejection and containment

Requirement: SV2-RUN-01.
Responsible implementation: agentihooks.
Fixture inputs: Local fake runtime and remote fake runtime with deliberately different capabilities.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-RUN-01 without broadening its grant or replacing the bad input silently.
Then: A backend lacking native resume reports unsupported capability rather than silently starting fresh.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect runtime_capability_failures_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RUN-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Only the selected execution backend may act on its own runtime object.
On failure: apply the package containment/rollback rule: Route new tasks back to the local adapter while preserving distributed attempt history.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RUN-01-C: Extract a capability-based runtime protocol / recovery and replay

Requirement: SV2-RUN-01.
Responsible implementation: agentihooks.
Fixture inputs: Local fake runtime and remote fake runtime with deliberately different capabilities.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: An adapter upgrade can be disabled without rewriting existing task records.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect runtime_capability_failures_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RUN-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Only the selected execution backend may act on its own runtime object.
On failure: apply the package containment/rollback rule: Route new tasks back to the local adapter while preserving distributed attempt history.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RUN-02-A: Remove global local-process assumptions / successful behavior

Requirement: SV2-RUN-02.
Responsible implementation: agentihooks.
Fixture inputs: Colliding PIDs, reused process start times, and an unreachable remote process namespace.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-RUN-02.
When: execute the owned behavior described as: Restrict process inspection to the worker that owns the observed PID namespace.
Then: An AWS worker and Anton may both have PID 4321 without either being mistaken for the other’s agent.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Only the selected execution backend may act on its own runtime object.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect unqualified_process_actions_rejected_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RUN-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Only the selected execution backend may act on its own runtime object.
On failure: apply the package containment/rollback rule: Keep local process discovery intact behind the adapter while disabling unqualified fleet selectors.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RUN-02-B: Remove global local-process assumptions / rejection and containment

Requirement: SV2-RUN-02.
Responsible implementation: agentihooks.
Fixture inputs: Colliding PIDs, reused process start times, and an unreachable remote process namespace.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-RUN-02 without broadening its grant or replacing the bad input silently.
Then: A terminate request lacking execution identity fails even when a local PID happens to match.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect unqualified_process_actions_rejected_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RUN-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Only the selected execution backend may act on its own runtime object.
On failure: apply the package containment/rollback rule: Keep local process discovery intact behind the adapter while disabling unqualified fleet selectors.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RUN-02-C: Remove global local-process assumptions / recovery and replay

Requirement: SV2-RUN-02.
Responsible implementation: agentihooks.
Fixture inputs: Colliding PIDs, reused process start times, and an unreachable remote process namespace.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Lost remote observation produces suspect status and cannot cause an unrelated local process kill.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect unqualified_process_actions_rejected_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RUN-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Only the selected execution backend may act on its own runtime object.
On failure: apply the package containment/rollback rule: Keep local process discovery intact behind the adapter while disabling unqualified fleet selectors.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RUN-03-A: Implement idempotent runtime operations / successful behavior

Requirement: SV2-RUN-03.
Responsible implementation: agentihooks.
Fixture inputs: A transport that applies creation but loses the acknowledgement.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-RUN-03.
When: execute the owned behavior described as: Make retries safe across ambiguous transport failures.
Then: A timed-out create followed by retry resolves to the single already-created attempt.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Only the selected execution backend may act on its own runtime object.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect runtime_ambiguous_operations with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RUN-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Only the selected execution backend may act on its own runtime object.
On failure: apply the package containment/rollback rule: Preserve the operation journal; disable dispatch while resolving operations from the newer protocol.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RUN-03-B: Implement idempotent runtime operations / rejection and containment

Requirement: SV2-RUN-03.
Responsible implementation: agentihooks.
Fixture inputs: A transport that applies creation but loses the acknowledgement.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-RUN-03 without broadening its grant or replacing the bad input silently.
Then: A repeated command ID with changed prompt content is rejected as a conflict.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect runtime_ambiguous_operations with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RUN-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Only the selected execution backend may act on its own runtime object.
On failure: apply the package containment/rollback rule: Preserve the operation journal; disable dispatch while resolving operations from the newer protocol.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RUN-03-C: Implement idempotent runtime operations / recovery and replay

Requirement: SV2-RUN-03.
Responsible implementation: agentihooks.
Fixture inputs: A transport that applies creation but loses the acknowledgement.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Controller recovery loads unresolved operations and classifies their actual outcome by observation.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect runtime_ambiguous_operations with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RUN-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Only the selected execution backend may act on its own runtime object.
On failure: apply the package containment/rollback rule: Preserve the operation journal; disable dispatch while resolving operations from the newer protocol.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RUN-04-A: Define observation confidence and failure classification / successful behavior

Requirement: SV2-RUN-04.
Responsible implementation: agentihooks.
Fixture inputs: Fresh heartbeat with SSH failure, stale heartbeat with running Pod, and API authorization failure.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-RUN-04.
When: execute the owned behavior described as: Distinguish terminal loss, worker loss, Pod scheduling, and provider wait.
Then: A terminal disconnect with fresh worker heartbeats leaves the task working and the terminal degraded.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Only the selected execution backend may act on its own runtime object.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect execution_observation_age_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RUN-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Only the selected execution backend may act on its own runtime object.
On failure: apply the package containment/rollback rule: Restore conservative observation mode and require operator classification for unresolved attempts.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RUN-04-B: Define observation confidence and failure classification / rejection and containment

Requirement: SV2-RUN-04.
Responsible implementation: agentihooks.
Fixture inputs: Fresh heartbeat with SSH failure, stale heartbeat with running Pod, and API authorization failure.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-RUN-04 without broadening its grant or replacing the bad input silently.
Then: A forbidden Kubernetes read is not classified as a deleted Pod.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect execution_observation_age_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RUN-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Only the selected execution backend may act on its own runtime object.
On failure: apply the package containment/rollback rule: Restore conservative observation mode and require operator classification for unresolved attempts.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RUN-04-C: Define observation confidence and failure classification / recovery and replay

Requirement: SV2-RUN-04.
Responsible implementation: agentihooks.
Fixture inputs: Fresh heartbeat with SSH failure, stale heartbeat with running Pod, and API authorization failure.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A successful relist after watch failure removes stale uncertainty without starting another agent.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect execution_observation_age_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RUN-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Only the selected execution backend may act on its own runtime object.
On failure: apply the package containment/rollback rule: Restore conservative observation mode and require operator classification for unresolved attempts.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RUN-05-A: Keep lifecycle and terminal actions distinct / successful behavior

Requirement: SV2-RUN-05.
Responsible implementation: agentihooks.
Fixture inputs: A stale browser tab, a replaced Pod, and a disconnected terminal profile.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-RUN-05.
When: execute the owned behavior described as: Prevent UI navigation and terminal registration changes from becoming task cancellation.
Then: Removing a saved terminal profile leaves the remote task running, while explicit cancel follows the task-stop protocol.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Only the selected execution backend may act on its own runtime object.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect runtime_commands_by_outcome with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RUN-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Only the selected execution backend may act on its own runtime object.
On failure: apply the package containment/rollback rule: Hide unsupported new controls while retaining read-only attempt status and existing local controls.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RUN-05-B: Keep lifecycle and terminal actions distinct / rejection and containment

Requirement: SV2-RUN-05.
Responsible implementation: agentihooks.
Fixture inputs: A stale browser tab, a replaced Pod, and a disconnected terminal profile.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-RUN-05 without broadening its grant or replacing the bad input silently.
Then: A stale ledger page cannot force-stop a replacement execution using an old command payload.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect runtime_commands_by_outcome with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RUN-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Only the selected execution backend may act on its own runtime object.
On failure: apply the package containment/rollback rule: Hide unsupported new controls while retaining read-only attempt status and existing local controls.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RUN-05-C: Keep lifecycle and terminal actions distinct / recovery and replay

Requirement: SV2-RUN-05.
Responsible implementation: agentihooks.
Fixture inputs: A stale browser tab, a replaced Pod, and a disconnected terminal profile.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Reopening the UI reconstructs controls from current registry state without replaying old button actions.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect runtime_commands_by_outcome with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RUN-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Only the selected execution backend may act on its own runtime object.
On failure: apply the package containment/rollback rule: Hide unsupported new controls while retaining read-only attempt status and existing local controls.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group CTL: Controller reconciliation, task authority, and fencing

T-SV2-CTL-01-A: Implement a renewable controller lease and epoch / successful behavior

Requirement: SV2-CTL-01.
Responsible implementation: agentihooks.
Fixture inputs: Two independent controllers, delayed renewals, and a paused former leader.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CTL-01.
When: execute the owned behavior described as: Ensure only one controller admits new attempts while allowing restart recovery.
Then: Two controller processes race and only one admits a new task generation.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: The controller coordinates existing tasks; it does not independently choose EC2 instances.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect controller_leader_changes_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTL-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The controller coordinates existing tasks; it does not independently choose EC2 instances.
On failure: apply the package containment/rollback rule: Run one controller with admission disabled until leadership state is understood; retain journals.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTL-01-B: Implement a renewable controller lease and epoch / rejection and containment

Requirement: SV2-CTL-01.
Responsible implementation: agentihooks.
Fixture inputs: Two independent controllers, delayed renewals, and a paused former leader.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CTL-01 without broadening its grant or replacing the bad input silently.
Then: A controller that lost its lease cannot create another execution using a cached leader flag.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect controller_leader_changes_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTL-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The controller coordinates existing tasks; it does not independently choose EC2 instances.
On failure: apply the package containment/rollback rule: Run one controller with admission disabled until leadership state is understood; retain journals.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTL-01-C: Implement a renewable controller lease and epoch / recovery and replay

Requirement: SV2-CTL-01.
Responsible implementation: agentihooks.
Fixture inputs: Two independent controllers, delayed renewals, and a paused former leader.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A replacement controller resumes reconciliation after lease expiry without recreating confirmed attempts.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect controller_leader_changes_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTL-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The controller coordinates existing tasks; it does not independently choose EC2 instances.
On failure: apply the package containment/rollback rule: Run one controller with admission disabled until leadership state is understood; retain journals.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTL-02-A: Add task-generation fencing to claims / successful behavior

Requirement: SV2-CTL-02.
Responsible implementation: agentihooks.
Fixture inputs: One partitioned worker that reconnects after a successor has started.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CTL-02.
When: execute the owned behavior described as: Extend exclusive task leases into an explicit distributed ownership contract.
Then: A recovered old worker receives stale_generation after its task has moved to a newer attempt.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: The controller coordinates existing tasks; it does not independently choose EC2 instances.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect stale_generation_rejections_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTL-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The controller coordinates existing tasks; it does not independently choose EC2 instances.
On failure: apply the package containment/rollback rule: Stop new distributed claims and keep old generation records while restoring the prior compatible reader.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTL-02-B: Add task-generation fencing to claims / rejection and containment

Requirement: SV2-CTL-02.
Responsible implementation: agentihooks.
Fixture inputs: One partitioned worker that reconnects after a successor has started.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CTL-02 without broadening its grant or replacing the bad input silently.
Then: A release from the former holder cannot remove the successor’s valid claim.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect stale_generation_rejections_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTL-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The controller coordinates existing tasks; it does not independently choose EC2 instances.
On failure: apply the package containment/rollback rule: Stop new distributed claims and keep old generation records while restoring the prior compatible reader.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTL-02-C: Add task-generation fencing to claims / recovery and replay

Requirement: SV2-CTL-02.
Responsible implementation: agentihooks.
Fixture inputs: One partitioned worker that reconnects after a successor has started.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Replaying the claim journal reconstructs the same highest admitted generation.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect stale_generation_rejections_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTL-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The controller coordinates existing tasks; it does not independently choose EC2 instances.
On failure: apply the package containment/rollback rule: Stop new distributed claims and keep old generation records while restoring the prior compatible reader.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTL-03-A: Bound pending execution admission / successful behavior

Requirement: SV2-CTL-03.
Responsible implementation: agentihooks.
Fixture inputs: Empty cluster, ten runnable tasks, cap of three, and one impossible memory request.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CTL-03.
When: execute the owned behavior described as: Create enough pending Pods to trigger scaling without exhausting budgets or provider reservations.
Then: Eligible work can create pending Pods from zero remote capacity up to the configured bound.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: The controller coordinates existing tasks; it does not independently choose EC2 instances.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect pending_execution_admission_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTL-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The controller coordinates existing tasks; it does not independently choose EC2 instances.
On failure: apply the package containment/rollback rule: Set distributed admission to zero while allowing current attempts to drain.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTL-03-B: Bound pending execution admission / rejection and containment

Requirement: SV2-CTL-03.
Responsible implementation: agentihooks.
Fixture inputs: Empty cluster, ten runnable tasks, cap of three, and one impossible memory request.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CTL-03 without broadening its grant or replacing the bad input silently.
Then: Tasks requiring more memory than every approved template do not remain indefinitely in an expanding pending queue.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect pending_execution_admission_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTL-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The controller coordinates existing tasks; it does not independently choose EC2 instances.
On failure: apply the package containment/rollback rule: Set distributed admission to zero while allowing current attempts to drain.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTL-03-C: Bound pending execution admission / recovery and replay

Requirement: SV2-CTL-03.
Responsible implementation: agentihooks.
Fixture inputs: Empty cluster, ten runnable tasks, cap of three, and one impossible memory request.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A quota outage releases unused pending reservations after their expiry and permits later retry.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect pending_execution_admission_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTL-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The controller coordinates existing tasks; it does not independently choose EC2 instances.
On failure: apply the package containment/rollback rule: Set distributed admission to zero while allowing current attempts to drain.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTL-04-A: Reconcile watches, restarts, and orphan objects / successful behavior

Requirement: SV2-CTL-04.
Responsible implementation: agentihooks.
Fixture inputs: Managed orphan, foreign lookalike, expired watch cursor, and delayed deletion event.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CTL-04.
When: execute the owned behavior described as: Make the control loop converge from authoritative records and observed Kubernetes objects.
Then: Controller restart converges to the existing managed Pod set without duplicate launches.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: The controller coordinates existing tasks; it does not independently choose EC2 instances.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect controller_orphans_by_class with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTL-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The controller coordinates existing tasks; it does not independently choose EC2 instances.
On failure: apply the package containment/rollback rule: Disable orphan cleanup independently from status reconciliation.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTL-04-B: Reconcile watches, restarts, and orphan objects / rejection and containment

Requirement: SV2-CTL-04.
Responsible implementation: agentihooks.
Fixture inputs: Managed orphan, foreign lookalike, expired watch cursor, and delayed deletion event.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CTL-04 without broadening its grant or replacing the bad input silently.
Then: A similarly named Pod without the controller ownership label is never deleted.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect controller_orphans_by_class with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTL-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The controller coordinates existing tasks; it does not independently choose EC2 instances.
On failure: apply the package containment/rollback rule: Disable orphan cleanup independently from status reconciliation.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTL-04-C: Reconcile watches, restarts, and orphan objects / recovery and replay

Requirement: SV2-CTL-04.
Responsible implementation: agentihooks.
Fixture inputs: Managed orphan, foreign lookalike, expired watch cursor, and delayed deletion event.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A lost watch acknowledgement is recovered by relist and stable execution matching.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect controller_orphans_by_class with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTL-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The controller coordinates existing tasks; it does not independently choose EC2 instances.
On failure: apply the package containment/rollback rule: Disable orphan cleanup independently from status reconciliation.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTL-05-A: Centralize final shared mutations and outcome commit / successful behavior

Requirement: SV2-CTL-05.
Responsible implementation: agentihooks.
Fixture inputs: Two attempts propose outcomes for one task and one merge response is lost.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CTL-05.
When: execute the owned behavior described as: Reduce duplicate external side effects by validating current ownership at the final integration boundary.
Then: An old worker may retain a private branch but cannot mark the task done or merge its stale result after replacement.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: The controller coordinates existing tasks; it does not independently choose EC2 instances.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect outcome_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTL-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The controller coordinates existing tasks; it does not independently choose EC2 instances.
On failure: apply the package containment/rollback rule: Pause final integration and retain proposed outcomes for operator review.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTL-05-B: Centralize final shared mutations and outcome commit / rejection and containment

Requirement: SV2-CTL-05.
Responsible implementation: agentihooks.
Fixture inputs: Two attempts propose outcomes for one task and one merge response is lost.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CTL-05 without broadening its grant or replacing the bad input silently.
Then: A successful test message without required proof artifacts cannot complete the task.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect outcome_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTL-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The controller coordinates existing tasks; it does not independently choose EC2 instances.
On failure: apply the package containment/rollback rule: Pause final integration and retain proposed outcomes for operator review.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTL-05-C: Centralize final shared mutations and outcome commit / recovery and replay

Requirement: SV2-CTL-05.
Responsible implementation: agentihooks.
Fixture inputs: Two attempts propose outcomes for one task and one merge response is lost.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: An interrupted merge response is reconciled against the actual PR and commit state before retry.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect outcome_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTL-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The controller coordinates existing tasks; it does not independently choose EC2 instances.
On failure: apply the package containment/rollback rule: Pause final integration and retain proposed outcomes for operator review.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group LDG: Remote-safe ledger and worker control APIs

T-SV2-LDG-01-A: Remove the local HTML token dependency / successful behavior

Requirement: SV2-LDG-01.
Responsible implementation: agentihooks.
Fixture inputs: Read-only worker home with no development-ledger directory.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-LDG-01.
When: execute the owned behavior described as: Permit workers to use the ledger without mounting Anton’s ledger filesystem.
Then: A worker with no ledger HTML files can read its task and post an authorized update.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect ledger_remote_auth_failures_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-LDG-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
On failure: apply the package containment/rollback rule: Restore local token resolution for local mode while retaining remote configuration as inactive.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-LDG-01-B: Remove the local HTML token dependency / rejection and containment

Requirement: SV2-LDG-01.
Responsible implementation: agentihooks.
Fixture inputs: Read-only worker home with no development-ledger directory.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-LDG-01 without broadening its grant or replacing the bad input silently.
Then: A missing remote token produces unauthenticated rather than silently using another local credential.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect ledger_remote_auth_failures_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-LDG-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
On failure: apply the package containment/rollback rule: Restore local token resolution for local mode while retaining remote configuration as inactive.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-LDG-01-C: Remove the local HTML token dependency / recovery and replay

Requirement: SV2-LDG-01.
Responsible implementation: agentihooks.
Fixture inputs: Read-only worker home with no development-ledger directory.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A transient ledger outage retries read-only operations without spawning a second server.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect ledger_remote_auth_failures_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-LDG-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
On failure: apply the package containment/rollback rule: Restore local token resolution for local mode while retaining remote configuration as inactive.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-LDG-02-A: Define authenticated worker registration and heartbeat / successful behavior

Requirement: SV2-LDG-02.
Responsible implementation: agentihooks.
Fixture inputs: Bound worker credential, out-of-order sequence, stale generation, and forged URL subject.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-LDG-02.
When: execute the owned behavior described as: Expose the minimum remote lifecycle surface needed by the runtime adapter.
Then: A registered worker renews only its own execution authority and reports its current durable archive watermark.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect heartbeat_rejections_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-LDG-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
On failure: apply the package containment/rollback rule: Disable new registration while existing leases drain under the previous supported protocol.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-LDG-02-B: Define authenticated worker registration and heartbeat / rejection and containment

Requirement: SV2-LDG-02.
Responsible implementation: agentihooks.
Fixture inputs: Bound worker credential, out-of-order sequence, stale generation, and forged URL subject.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-LDG-02 without broadening its grant or replacing the bad input silently.
Then: A worker cannot update another agent’s state by changing the URL ID.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect heartbeat_rejections_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-LDG-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
On failure: apply the package containment/rollback rule: Disable new registration while existing leases drain under the previous supported protocol.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-LDG-02-C: Define authenticated worker registration and heartbeat / recovery and replay

Requirement: SV2-LDG-02.
Responsible implementation: agentihooks.
Fixture inputs: Bound worker credential, out-of-order sequence, stale generation, and forged URL subject.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A replayed heartbeat does not move counters or lease state backward.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect heartbeat_rejections_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-LDG-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
On failure: apply the package containment/rollback rule: Disable new registration while existing leases drain under the previous supported protocol.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-LDG-03-A: Add revision-aware task mutation endpoints / successful behavior

Requirement: SV2-LDG-03.
Responsible implementation: agentihooks.
Fixture inputs: Edited task specification while an agent is still working from the preceding revision.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-LDG-03.
When: execute the owned behavior described as: Preserve current task updates while preventing stale workers from overwriting new specifications.
Then: A worker update based on an old task specification is refused and can refresh before retry.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect ledger_revision_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-LDG-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
On failure: apply the package containment/rollback rule: Keep additive revision metadata and route unsupported writes through read-only conflict responses.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-LDG-03-B: Add revision-aware task mutation endpoints / rejection and containment

Requirement: SV2-LDG-03.
Responsible implementation: agentihooks.
Fixture inputs: Edited task specification while an agent is still working from the preceding revision.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-LDG-03 without broadening its grant or replacing the bad input silently.
Then: Worker credentials cannot increase global caps or change operator-only gates.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect ledger_revision_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-LDG-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
On failure: apply the package containment/rollback rule: Keep additive revision metadata and route unsupported writes through read-only conflict responses.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-LDG-03-C: Add revision-aware task mutation endpoints / recovery and replay

Requirement: SV2-LDG-03.
Responsible implementation: agentihooks.
Fixture inputs: Edited task specification while an agent is still working from the preceding revision.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A duplicate progress post is acknowledged once without appending duplicate ledger entries.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect ledger_revision_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-LDG-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
On failure: apply the package containment/rollback rule: Keep additive revision metadata and route unsupported writes through read-only conflict responses.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-LDG-04-A: Enforce the single-writer ledger deployment / successful behavior

Requirement: SV2-LDG-04.
Responsible implementation: agentihooks.
Fixture inputs: Two server processes sharing one test ledger directory.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-LDG-04.
When: execute the owned behavior described as: Keep file-based ledger persistence correct without pretending an in-process lock coordinates replicas.
Then: Two accidental writer instances cannot concurrently mutate the same ledger root.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect ledger_writer_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-LDG-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
On failure: apply the package containment/rollback rule: Restore the preceding compatible writer binary against a verified backup copy before promotion.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-LDG-04-B: Enforce the single-writer ledger deployment / rejection and containment

Requirement: SV2-LDG-04.
Responsible implementation: agentihooks.
Fixture inputs: Two server processes sharing one test ledger directory.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-LDG-04 without broadening its grant or replacing the bad input silently.
Then: A chart setting requesting multiple active file writers fails validation or keeps extra replicas non-writing.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect ledger_writer_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-LDG-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
On failure: apply the package containment/rollback rule: Restore the preceding compatible writer binary against a verified backup copy before promotion.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-LDG-04-C: Enforce the single-writer ledger deployment / recovery and replay

Requirement: SV2-LDG-04.
Responsible implementation: agentihooks.
Fixture inputs: Two server processes sharing one test ledger directory.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A writer restart loads the last complete revision and replays idempotent accepted operations.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect ledger_writer_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-LDG-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
On failure: apply the package containment/rollback rule: Restore the preceding compatible writer binary against a verified backup copy before promotion.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-LDG-05-A: Add command acknowledgement and drain control / successful behavior

Requirement: SV2-LDG-05.
Responsible implementation: agentihooks.
Fixture inputs: Delayed command delivery, duplicate poll response, and a drain interrupted by network loss.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-LDG-05.
When: execute the owned behavior described as: Give the controller explicit accepted and completed command states instead of relying on terminal text.
Then: A drain command moves the worker into no-new-mutations mode and reports checkpoint completion separately.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect worker_command_ack_lag_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-LDG-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
On failure: apply the package containment/rollback rule: Stop issuing new command types while old ones finish or expire.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-LDG-05-B: Add command acknowledgement and drain control / rejection and containment

Requirement: SV2-LDG-05.
Responsible implementation: agentihooks.
Fixture inputs: Delayed command delivery, duplicate poll response, and a drain interrupted by network loss.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-LDG-05 without broadening its grant or replacing the bad input silently.
Then: An expired answer or stop command is not replayed into a new conversation.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect worker_command_ack_lag_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-LDG-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
On failure: apply the package containment/rollback rule: Stop issuing new command types while old ones finish or expire.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-LDG-05-C: Add command acknowledgement and drain control / recovery and replay

Requirement: SV2-LDG-05.
Responsible implementation: agentihooks.
Fixture inputs: Delayed command delivery, duplicate poll response, and a drain interrupted by network loss.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Reconnecting after acknowledgement loss returns the stored command outcome without rerunning it.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect worker_command_ack_lag_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-LDG-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The existing ledger remains authoritative for operator work state; only one writer mutates its durable files.
On failure: apply the package containment/rollback rule: Stop issuing new command types while old ones finish or expire.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group IMG: Reproducible swarm worker image and bootstrap

T-SV2-IMG-01-A: Create the minimal reproducible worker image / successful behavior

Requirement: SV2-IMG-01.
Responsible implementation: agentihooks.
Fixture inputs: Clean build context with network access blocked during container startup.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-IMG-01.
When: execute the owned behavior described as: Build the shared execution environment without installing a separate orchestration product.
Then: A clean build reports the pinned tools and can start without fetching application packages at runtime.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Image build and isolated container execution; production rollout belongs to antoncore.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect worker_image_build_validation_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IMG-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Image build and isolated container execution; production rollout belongs to antoncore.
On failure: apply the package containment/rollback rule: Retain the previous image digest and update only new-attempt selection during rollback.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IMG-01-B: Create the minimal reproducible worker image / rejection and containment

Requirement: SV2-IMG-01.
Responsible implementation: agentihooks.
Fixture inputs: Clean build context with network access blocked during container startup.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-IMG-01 without broadening its grant or replacing the bad input silently.
Then: A missing checksum, unsupported architecture, or mismatched binary fails the build.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect worker_image_build_validation_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IMG-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Image build and isolated container execution; production rollout belongs to antoncore.
On failure: apply the package containment/rollback rule: Retain the previous image digest and update only new-attempt selection during rollback.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IMG-01-C: Create the minimal reproducible worker image / recovery and replay

Requirement: SV2-IMG-01.
Responsible implementation: agentihooks.
Fixture inputs: Clean build context with network access blocked during container startup.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Rebuilding from the same lock produces the same declared tool inventory even when upstream latest changes.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect worker_image_build_validation_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IMG-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Image build and isolated container execution; production rollout belongs to antoncore.
On failure: apply the package containment/rollback rule: Retain the previous image digest and update only new-attempt selection during rollback.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IMG-02-A: Render target-native profiles into private homes / successful behavior

Requirement: SV2-IMG-02.
Responsible implementation: agentihooks.
Fixture inputs: Two target profiles, empty home volume, and a deliberately invalid host-specific interpreter path.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-IMG-02.
When: execute the owned behavior described as: Reuse existing target adapters for a portable per-execution setup.
Then: Both target CLIs load their expected hooks and MCP configuration in separate execution homes.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Image build and isolated container execution; production rollout belongs to antoncore.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect worker_profile_materialization_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IMG-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Image build and isolated container execution; production rollout belongs to antoncore.
On failure: apply the package containment/rollback rule: Select the prior profile bundle digest for new attempts while preserving existing homes for recovery.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IMG-02-B: Render target-native profiles into private homes / rejection and containment

Requirement: SV2-IMG-02.
Responsible implementation: agentihooks.
Fixture inputs: Two target profiles, empty home volume, and a deliberately invalid host-specific interpreter path.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-IMG-02 without broadening its grant or replacing the bad input silently.
Then: A profile that points to a workstation venv or escapes the execution root fails bootstrap.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect worker_profile_materialization_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IMG-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Image build and isolated container execution; production rollout belongs to antoncore.
On failure: apply the package containment/rollback rule: Select the prior profile bundle digest for new attempts while preserving existing homes for recovery.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IMG-02-C: Render target-native profiles into private homes / recovery and replay

Requirement: SV2-IMG-02.
Responsible implementation: agentihooks.
Fixture inputs: Two target profiles, empty home volume, and a deliberately invalid host-specific interpreter path.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Restarting bootstrap for the same unstarted attempt is idempotent and does not duplicate plugin entries.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect worker_profile_materialization_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IMG-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Image build and isolated container execution; production rollout belongs to antoncore.
On failure: apply the package containment/rollback rule: Select the prior profile bundle digest for new attempts while preserving existing homes for recovery.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IMG-03-A: Implement supervision and signal handling / successful behavior

Requirement: SV2-IMG-03.
Responsible implementation: agentihooks.
Fixture inputs: A synthetic long-running tool, two grandchildren, and an exporter that acknowledges late.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-IMG-03.
When: execute the owned behavior described as: Keep processes running independently of viewers while making shutdown observable and bounded.
Then: Detaching every terminal leaves the main agent and exporter alive under the supervisor.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Image build and isolated container execution; production rollout belongs to antoncore.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect supervisor_child_exit_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IMG-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Image build and isolated container execution; production rollout belongs to antoncore.
On failure: apply the package containment/rollback rule: Use the prior supervisor image for new attempts and never hot-replace running process ownership.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IMG-03-B: Implement supervision and signal handling / rejection and containment

Requirement: SV2-IMG-03.
Responsible implementation: agentihooks.
Fixture inputs: A synthetic long-running tool, two grandchildren, and an exporter that acknowledges late.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-IMG-03 without broadening its grant or replacing the bad input silently.
Then: Killing the supervisor cannot leave an untracked main-agent process tree in the test container.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect supervisor_child_exit_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IMG-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Image build and isolated container execution; production rollout belongs to antoncore.
On failure: apply the package containment/rollback rule: Use the prior supervisor image for new attempts and never hot-replace running process ownership.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IMG-03-C: Implement supervision and signal handling / recovery and replay

Requirement: SV2-IMG-03.
Responsible implementation: agentihooks.
Fixture inputs: A synthetic long-running tool, two grandchildren, and an exporter that acknowledges late.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A SIGTERM during a tool operation triggers bounded quiescence and a truthful complete or incomplete checkpoint outcome.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect supervisor_child_exit_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IMG-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Image build and isolated container execution; production rollout belongs to antoncore.
On failure: apply the package containment/rollback rule: Use the prior supervisor image for new attempts and never hot-replace running process ownership.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IMG-04-A: Add probes and startup self-tests / successful behavior

Requirement: SV2-IMG-04.
Responsible implementation: agentihooks.
Fixture inputs: Missing binary, read-only home, healthy server, and unavailable external brain fixtures.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-IMG-04.
When: execute the owned behavior described as: Expose local execution readiness without making external outages restart the fleet.
Then: A healthy local runtime remains live during a simulated brain outage while readiness or degraded detail reports the dependency issue.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Image build and isolated container execution; production rollout belongs to antoncore.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect worker_startup_failure_reason with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IMG-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Image build and isolated container execution; production rollout belongs to antoncore.
On failure: apply the package containment/rollback rule: Revert probe configuration independently from the image when thresholds are wrong.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IMG-04-B: Add probes and startup self-tests / rejection and containment

Requirement: SV2-IMG-04.
Responsible implementation: agentihooks.
Fixture inputs: Missing binary, read-only home, healthy server, and unavailable external brain fixtures.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-IMG-04 without broadening its grant or replacing the bad input silently.
Then: A missing target binary or unreadable private home never reports ready.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect worker_startup_failure_reason with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IMG-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Image build and isolated container execution; production rollout belongs to antoncore.
On failure: apply the package containment/rollback rule: Revert probe configuration independently from the image when thresholds are wrong.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IMG-04-C: Add probes and startup self-tests / recovery and replay

Requirement: SV2-IMG-04.
Responsible implementation: agentihooks.
Fixture inputs: Missing binary, read-only home, healthy server, and unavailable external brain fixtures.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Recovered network connectivity clears dependency degradation without replacing the running agent.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect worker_startup_failure_reason with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IMG-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Image build and isolated container execution; production rollout belongs to antoncore.
On failure: apply the package containment/rollback rule: Revert probe configuration independently from the image when thresholds are wrong.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IMG-05-A: Publish image CI and compatibility attestations / successful behavior

Requirement: SV2-IMG-05.
Responsible implementation: agentihooks.
Fixture inputs: One valid image and one image with incompatible herdr server capabilities.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-IMG-05.
When: execute the owned behavior described as: Make image promotion deliberate and independent of the swarm being repaired.
Then: The release artifact contains a digest, version manifest, test report, and provenance pointing at the exact agentihooks commit.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Image build and isolated container execution; production rollout belongs to antoncore.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect worker_image_qualified_targets with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IMG-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Image build and isolated container execution; production rollout belongs to antoncore.
On failure: apply the package containment/rollback rule: Point deployment at the last accepted digest without rebuilding or retagging it.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IMG-05-B: Publish image CI and compatibility attestations / rejection and containment

Requirement: SV2-IMG-05.
Responsible implementation: agentihooks.
Fixture inputs: One valid image and one image with incompatible herdr server capabilities.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-IMG-05 without broadening its grant or replacing the bad input silently.
Then: A worker image failing one target’s smoke test cannot become the promoted deployment digest.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect worker_image_qualified_targets with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IMG-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Image build and isolated container execution; production rollout belongs to antoncore.
On failure: apply the package containment/rollback rule: Point deployment at the last accepted digest without rebuilding or retagging it.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IMG-05-C: Publish image CI and compatibility attestations / recovery and replay

Requirement: SV2-IMG-05.
Responsible implementation: agentihooks.
Fixture inputs: One valid image and one image with incompatible herdr server capabilities.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A broken production swarm can still build and publish its repair image through the independent CI path.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect worker_image_qualified_targets with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IMG-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Image build and isolated container execution; production rollout belongs to antoncore.
On failure: apply the package containment/rollback rule: Point deployment at the last accepted digest without rebuilding or retagging it.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group KUB: Kubernetes execution adapter and object lifecycle

T-SV2-KUB-01-A: Build a validated execution Pod template / successful behavior

Requirement: SV2-KUB-01.
Responsible implementation: agentihooks.
Fixture inputs: Malicious task payload containing YAML fragments and an otherwise valid general resource profile.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-KUB-01.
When: execute the owned behavior described as: Translate an admitted launch into a bounded one-main-agent Pod.
Then: A rendered Pod validates against Kubernetes schema and matches its launch identity and resource profile.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Create and mutate only labelled execution objects in the configured swarm namespace.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect pod_spec_validation_failures_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-KUB-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Create and mutate only labelled execution objects in the configured swarm namespace.
On failure: apply the package containment/rollback rule: Restore the previous template version for new launches and retain existing Pod version annotations.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-KUB-01-B: Build a validated execution Pod template / rejection and containment

Requirement: SV2-KUB-01.
Responsible implementation: agentihooks.
Fixture inputs: Malicious task payload containing YAML fragments and an otherwise valid general resource profile.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-KUB-01 without broadening its grant or replacing the bad input silently.
Then: User prompt text cannot inject arbitrary Pod fields, privileged settings, host mounts, or extra secret references.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect pod_spec_validation_failures_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-KUB-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Create and mutate only labelled execution objects in the configured swarm namespace.
On failure: apply the package containment/rollback rule: Restore the previous template version for new launches and retain existing Pod version annotations.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-KUB-01-C: Build a validated execution Pod template / recovery and replay

Requirement: SV2-KUB-01.
Responsible implementation: agentihooks.
Fixture inputs: Malicious task payload containing YAML fragments and an otherwise valid general resource profile.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Rendering the same admitted launch twice produces the same semantically canonical specification digest.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect pod_spec_validation_failures_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-KUB-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Create and mutate only labelled execution objects in the configured swarm namespace.
On failure: apply the package containment/rollback rule: Restore the previous template version for new launches and retain existing Pod version annotations.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-KUB-02-A: Create and observe Pods idempotently / successful behavior

Requirement: SV2-KUB-02.
Responsible implementation: agentihooks.
Fixture inputs: API server applies a create, drops the response, and then returns AlreadyExists.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-KUB-02.
When: execute the owned behavior described as: Join Kubernetes object creation to the runtime operation journal.
Then: A lost create response followed by observation discovers the original matching Pod and does not launch a second one.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Create and mutate only labelled execution objects in the configured swarm namespace.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect kubernetes_create_reconciliation_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-KUB-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Create and mutate only labelled execution objects in the configured swarm namespace.
On failure: apply the package containment/rollback rule: Disable new Pod creation while continuing observation and controlled cleanup of existing attempts.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-KUB-02-B: Create and observe Pods idempotently / rejection and containment

Requirement: SV2-KUB-02.
Responsible implementation: agentihooks.
Fixture inputs: API server applies a create, drops the response, and then returns AlreadyExists.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-KUB-02 without broadening its grant or replacing the bad input silently.
Then: An AlreadyExists object with the wrong execution label is quarantined rather than adopted.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect kubernetes_create_reconciliation_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-KUB-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Create and mutate only labelled execution objects in the configured swarm namespace.
On failure: apply the package containment/rollback rule: Disable new Pod creation while continuing observation and controlled cleanup of existing attempts.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-KUB-02-C: Create and observe Pods idempotently / recovery and replay

Requirement: SV2-KUB-02.
Responsible implementation: agentihooks.
Fixture inputs: API server applies a create, drops the response, and then returns AlreadyExists.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A controller restart recovers Pod UID and admission state through a label-qualified relist.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect kubernetes_create_reconciliation_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-KUB-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Create and mutate only labelled execution objects in the configured swarm namespace.
On failure: apply the package containment/rollback rule: Disable new Pod creation while continuing observation and controlled cleanup of existing attempts.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-KUB-03-A: Transport bounded worker commands / successful behavior

Requirement: SV2-KUB-03.
Responsible implementation: agentihooks.
Fixture inputs: Prompts containing quotes, newlines, command substitutions, and Unicode text.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-KUB-03.
When: execute the owned behavior described as: Keep execution control independent from arbitrary kubectl shell injection.
Then: A normal answer or drain reaches the intended worker helper with its original structured payload intact.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Create and mutate only labelled execution objects in the configured swarm namespace.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect worker_transport_ambiguous_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-KUB-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Create and mutate only labelled execution objects in the configured swarm namespace.
On failure: apply the package containment/rollback rule: Disable the fallback exec transport while keeping HTTP command delivery operational.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-KUB-03-B: Transport bounded worker commands / rejection and containment

Requirement: SV2-KUB-03.
Responsible implementation: agentihooks.
Fixture inputs: Prompts containing quotes, newlines, command substitutions, and Unicode text.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-KUB-03 without broadening its grant or replacing the bad input silently.
Then: Shell metacharacters in an operator message remain message content rather than transport commands.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect worker_transport_ambiguous_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-KUB-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Create and mutate only labelled execution objects in the configured swarm namespace.
On failure: apply the package containment/rollback rule: Disable the fallback exec transport while keeping HTTP command delivery operational.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-KUB-03-C: Transport bounded worker commands / recovery and replay

Requirement: SV2-KUB-03.
Responsible implementation: agentihooks.
Fixture inputs: Prompts containing quotes, newlines, command substitutions, and Unicode text.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A command with an uncertain acknowledgement is reconciled by its ID before another delivery.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect worker_transport_ambiguous_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-KUB-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Create and mutate only labelled execution objects in the configured swarm namespace.
On failure: apply the package containment/rollback rule: Disable the fallback exec transport while keeping HTTP command delivery operational.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-KUB-04-A: Clean up completed attempts safely / successful behavior

Requirement: SV2-KUB-04.
Responsible implementation: agentihooks.
Fixture inputs: Old and replacement Pods with related labels plus an archive upload still pending.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-KUB-04.
When: execute the owned behavior described as: Remove transient resources without deleting recovery evidence or a replacement attempt.
Then: Cleanup removes only the old attempt’s runtime objects after its transcript watermark and outcome are durable.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Create and mutate only labelled execution objects in the configured swarm namespace.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect execution_cleanup_backlog with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-KUB-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Create and mutate only labelled execution objects in the configured swarm namespace.
On failure: apply the package containment/rollback rule: Suspend cleanup and retain objects temporarily while correcting a policy error.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-KUB-04-B: Clean up completed attempts safely / rejection and containment

Requirement: SV2-KUB-04.
Responsible implementation: agentihooks.
Fixture inputs: Old and replacement Pods with related labels plus an archive upload still pending.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-KUB-04 without broadening its grant or replacing the bad input silently.
Then: A stale cleanup job cannot delete a new Pod that reused a human-readable name.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect execution_cleanup_backlog with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-KUB-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Create and mutate only labelled execution objects in the configured swarm namespace.
On failure: apply the package containment/rollback rule: Suspend cleanup and retain objects temporarily while correcting a policy error.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-KUB-04-C: Clean up completed attempts safely / recovery and replay

Requirement: SV2-KUB-04.
Responsible implementation: agentihooks.
Fixture inputs: Old and replacement Pods with related labels plus an archive upload still pending.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Interrupted cleanup resumes from its journal and tolerates already-absent owned resources.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect execution_cleanup_backlog with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-KUB-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Create and mutate only labelled execution objects in the configured swarm namespace.
On failure: apply the package containment/rollback rule: Suspend cleanup and retain objects temporarily while correcting a policy error.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-KUB-05-A: Reconcile abrupt Pod and node failure / successful behavior

Requirement: SV2-KUB-05.
Responsible implementation: agentihooks.
Fixture inputs: OOMKilled, node-unreachable, image-pull failure, and late old-Pod events.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-KUB-05.
When: execute the owned behavior described as: Convert infrastructure failures into explicit fenced recovery decisions.
Then: Deleting a worker node eventually yields one fenced recovery attempt and a recorded explanation of any unarchived tail loss.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Create and mutate only labelled execution objects in the configured swarm namespace.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect execution_failures_by_reason with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-KUB-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Create and mutate only labelled execution objects in the configured swarm namespace.
On failure: apply the package containment/rollback rule: Pause automatic replacement and leave affected tasks recovery_pending for operator review.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-KUB-05-B: Reconcile abrupt Pod and node failure / rejection and containment

Requirement: SV2-KUB-05.
Responsible implementation: agentihooks.
Fixture inputs: OOMKilled, node-unreachable, image-pull failure, and late old-Pod events.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-KUB-05 without broadening its grant or replacing the bad input silently.
Then: ImagePullBackOff does not consume an active provider-session slot indefinitely.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect execution_failures_by_reason with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-KUB-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Create and mutate only labelled execution objects in the configured swarm namespace.
On failure: apply the package containment/rollback rule: Pause automatic replacement and leave affected tasks recovery_pending for operator review.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-KUB-05-C: Reconcile abrupt Pod and node failure / recovery and replay

Requirement: SV2-KUB-05.
Responsible implementation: agentihooks.
Fixture inputs: OOMKilled, node-unreachable, image-pull failure, and late old-Pod events.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Reappearing old Pod observations cannot return the retired generation to working.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect execution_failures_by_reason with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-KUB-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Create and mutate only labelled execution objects in the configured swarm namespace.
On failure: apply the package containment/rollback rule: Pause automatic replacement and leave affected tasks recovery_pending for operator review.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group HDR: herdr remote aggregation and terminal identity

T-SV2-HDR-01-A: Qualify the pinned herdr protocol / successful behavior

Requirement: SV2-HDR-01.
Responsible implementation: agentihooks.
Fixture inputs: Compatible client/server pair and a server missing machine-forwarding capability.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-HDR-01.
When: execute the owned behavior described as: Verify the exact remote operations needed before promising the one-window experience.
Then: The accepted image demonstrates remote commands without an open TUI and without installation or server replacement.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect herdr_capability_mismatch_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-HDR-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
On failure: apply the package containment/rollback rule: Keep the previous qualified herdr image digest available and refuse incompatible new attempts.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-HDR-01-B: Qualify the pinned herdr protocol / rejection and containment

Requirement: SV2-HDR-01.
Responsible implementation: agentihooks.
Fixture inputs: Compatible client/server pair and a server missing machine-forwarding capability.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-HDR-01 without broadening its grant or replacing the bad input silently.
Then: A missing remote capability cannot trigger an unrequested update or local fallback.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect herdr_capability_mismatch_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-HDR-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
On failure: apply the package containment/rollback rule: Keep the previous qualified herdr image digest available and refuse incompatible new attempts.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-HDR-01-C: Qualify the pinned herdr protocol / recovery and replay

Requirement: SV2-HDR-01.
Responsible implementation: agentihooks.
Fixture inputs: Compatible client/server pair and a server missing machine-forwarding capability.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A server restart invalidates the cached capability result and rechecks the new incarnation.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect herdr_capability_mismatch_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-HDR-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
On failure: apply the package containment/rollback rule: Keep the previous qualified herdr image digest available and refuse incompatible new attempts.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-HDR-02-A: Implement private worker terminal endpoints / successful behavior

Requirement: SV2-HDR-02.
Responsible implementation: agentihooks.
Fixture inputs: Private service, unauthorized client, changed host key, and missing cluster DNS route.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-HDR-02.
When: execute the owned behavior described as: Provide a supported herdr SSH path without exposing the host or public network.
Then: The Anton client attaches to the intended worker while a different namespace principal cannot use the endpoint.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect terminal_endpoint_auth_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-HDR-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
On failure: apply the package containment/rollback rule: Disable worker terminal exposure while keeping task execution and ledger control operational.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-HDR-02-B: Implement private worker terminal endpoints / rejection and containment

Requirement: SV2-HDR-02.
Responsible implementation: agentihooks.
Fixture inputs: Private service, unauthorized client, changed host key, and missing cluster DNS route.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-HDR-02 without broadening its grant or replacing the bad input silently.
Then: No public LoadBalancer, host root SSH account, or shared permanent image private key is required.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect terminal_endpoint_auth_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-HDR-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
On failure: apply the package containment/rollback rule: Disable worker terminal exposure while keeping task execution and ledger control operational.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-HDR-02-C: Implement private worker terminal endpoints / recovery and replay

Requirement: SV2-HDR-02.
Responsible implementation: agentihooks.
Fixture inputs: Private service, unauthorized client, changed host key, and missing cluster DNS route.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Replacing the Pod creates a new verified endpoint without accepting an old unauthenticated host identity.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect terminal_endpoint_auth_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-HDR-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
On failure: apply the package containment/rollback rule: Disable worker terminal exposure while keeping task execution and ledger control operational.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-HDR-03-A: Maintain saved machine registrations / successful behavior

Requirement: SV2-HDR-03.
Responsible implementation: agentihooks.
Fixture inputs: Two managed endpoints and one unrelated manually named machine.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-HDR-03.
When: execute the owned behavior described as: Keep one Anton herdr client synchronized with currently attachable attempts.
Then: Two worker servers appear beside Local and each registration maps to its own execution ID.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect herdr_registration_drift with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-HDR-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
On failure: apply the package containment/rollback rule: Stop automated registration and leave existing profiles intact until ownership is audited.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-HDR-03-B: Maintain saved machine registrations / rejection and containment

Requirement: SV2-HDR-03.
Responsible implementation: agentihooks.
Fixture inputs: Two managed endpoints and one unrelated manually named machine.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-HDR-03 without broadening its grant or replacing the bad input silently.
Then: A label collision does not adopt or overwrite a manually configured unrelated machine.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect herdr_registration_drift with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-HDR-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
On failure: apply the package containment/rollback rule: Stop automated registration and leave existing profiles intact until ownership is audited.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-HDR-03-C: Maintain saved machine registrations / recovery and replay

Requirement: SV2-HDR-03.
Responsible implementation: agentihooks.
Fixture inputs: Two managed endpoints and one unrelated manually named machine.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Reconciliation after client restart restores missing managed registrations without duplicating existing ones.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect herdr_registration_drift with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-HDR-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
On failure: apply the package containment/rollback rule: Stop automated registration and leave existing profiles intact until ownership is audited.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-HDR-04-A: Enforce server-qualified pane routing / successful behavior

Requirement: SV2-HDR-04.
Responsible implementation: agentihooks.
Fixture inputs: Identical pane IDs and agent labels on Local and two remote servers.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-HDR-04.
When: execute the owned behavior described as: Make all terminal IDs unambiguous across many worker servers.
Then: Two servers both using pane w1:p1 receive only their explicitly targeted messages.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect herdr_target_mismatch_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-HDR-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
On failure: apply the package containment/rollback rule: Revert UI actions to explicit read-only inspection until qualified routing is repaired.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-HDR-04-B: Enforce server-qualified pane routing / rejection and containment

Requirement: SV2-HDR-04.
Responsible implementation: agentihooks.
Fixture inputs: Identical pane IDs and agent labels on Local and two remote servers.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-HDR-04 without broadening its grant or replacing the bad input silently.
Then: A bare remote pane ID or stale server incarnation is rejected before any pane mutation.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect herdr_target_mismatch_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-HDR-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
On failure: apply the package containment/rollback rule: Revert UI actions to explicit read-only inspection until qualified routing is repaired.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-HDR-04-C: Enforce server-qualified pane routing / recovery and replay

Requirement: SV2-HDR-04.
Responsible implementation: agentihooks.
Fixture inputs: Identical pane IDs and agent labels on Local and two remote servers.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A reconnect refreshes the qualified target without replaying a previous prompt.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect herdr_target_mismatch_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-HDR-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
On failure: apply the package containment/rollback rule: Revert UI actions to explicit read-only inspection until qualified routing is repaired.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-HDR-05-A: Test detach, reconnect, and operator visibility / successful behavior

Requirement: SV2-HDR-05.
Responsible implementation: agentihooks.
Fixture inputs: Two remote agents, one lost SSH path, and one fully closed operator TUI.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-HDR-05.
When: execute the owned behavior described as: Prove the user-facing persistence promise independently of checkpoint recovery.
Then: Both agents continue when the client closes and the disconnected server does not disrupt other machine views.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect terminal_reconnect_latency_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-HDR-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
On failure: apply the package containment/rollback rule: Turn off aggregation refresh while preserving direct explicit attach and task execution.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-HDR-05-B: Test detach, reconnect, and operator visibility / rejection and containment

Requirement: SV2-HDR-05.
Responsible implementation: agentihooks.
Fixture inputs: Two remote agents, one lost SSH path, and one fully closed operator TUI.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-HDR-05 without broadening its grant or replacing the bad input silently.
Then: Cached terminal data cannot be shown as fresh liveness or accept input while the target is unverified.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect terminal_reconnect_latency_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-HDR-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
On failure: apply the package containment/rollback rule: Turn off aggregation refresh while preserving direct explicit attach and task execution.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-HDR-05-C: Test detach, reconnect, and operator visibility / recovery and replay

Requirement: SV2-HDR-05.
Responsible implementation: agentihooks.
Fixture inputs: Two remote agents, one lost SSH path, and one fully closed operator TUI.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Reconnecting attaches to the original live process when it still exists rather than launching a replacement.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect terminal_reconnect_latency_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-HDR-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Terminal operations affect one confirmed server incarnation; detachment never cancels work.
On failure: apply the package containment/rollback rule: Turn off aggregation refresh while preserving direct explicit attach and task execution.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group CAP: Capacity policy, ASG reuse, and coexistence

T-SV2-CAP-01-A: Define approved swarm capacity overlays / successful behavior

Requirement: SV2-CAP-01.
Responsible implementation: antoncore.
Fixture inputs: Current pool labels plus a reserved research pool and a control-plane node.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CAP-01.
When: execute the owned behavior described as: Map resource profiles to permitted infrastructure without pretending all existing pools are interchangeable.
Then: General workers land only on the approved nodes and unrelated research/live workloads retain their current isolation.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect swarm_capacity_policy_rejections with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CAP-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
On failure: apply the package containment/rollback rule: Restore the preceding swarm-only overlay and drain affected attempts before removing their eligibility.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CAP-01-B: Define approved swarm capacity overlays / rejection and containment

Requirement: SV2-CAP-01.
Responsible implementation: antoncore.
Fixture inputs: Current pool labels plus a reserved research pool and a control-plane node.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CAP-01 without broadening its grant or replacing the bad input silently.
Then: A broad Exists toleration for every workload taint fails chart policy validation.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect swarm_capacity_policy_rejections with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CAP-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
On failure: apply the package containment/rollback rule: Restore the preceding swarm-only overlay and drain affected attempts before removing their eligibility.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CAP-01-C: Define approved swarm capacity overlays / recovery and replay

Requirement: SV2-CAP-01.
Responsible implementation: antoncore.
Fixture inputs: Current pool labels plus a reserved research pool and a control-plane node.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Removing an eligible pool yields an actionable admission result without silently broadening placement.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect swarm_capacity_policy_rejections with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CAP-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
On failure: apply the package containment/rollback rule: Restore the preceding swarm-only overlay and drain affected attempts before removing their eligibility.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CAP-02-A: Verify scale-from-zero with existing autoscaler / successful behavior

Requirement: SV2-CAP-02.
Responsible implementation: antoncore.
Fixture inputs: Empty eligible pool, one pending Pod, and one deliberately mismatched taint.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CAP-02.
When: execute the owned behavior described as: Reuse the installed ASG integration without adding another execution scaler.
Then: One eligible pending worker causes a permitted ASG to scale and the Pod eventually starts on the resulting node.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect swarm_scale_up_stage_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CAP-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
On failure: apply the package containment/rollback rule: Remove canary workload and restore only explicitly changed swarm annotations or overlays.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CAP-02-B: Verify scale-from-zero with existing autoscaler / rejection and containment

Requirement: SV2-CAP-02.
Responsible implementation: antoncore.
Fixture inputs: Empty eligible pool, one pending Pod, and one deliberately mismatched taint.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CAP-02 without broadening its grant or replacing the bad input silently.
Then: An impossible request reports no fitting template instead of repeatedly increasing desired capacity.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect swarm_scale_up_stage_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CAP-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
On failure: apply the package containment/rollback rule: Remove canary workload and restore only explicitly changed swarm annotations or overlays.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CAP-02-C: Verify scale-from-zero with existing autoscaler / recovery and replay

Requirement: SV2-CAP-02.
Responsible implementation: antoncore.
Fixture inputs: Empty eligible pool, one pending Pod, and one deliberately mismatched taint.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A failed node launch is classified and retried within configured autoscaler and admission bounds.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect swarm_scale_up_stage_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CAP-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
On failure: apply the package containment/rollback rule: Remove canary workload and restore only explicitly changed swarm annotations or overlays.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CAP-03-A: Make Spot policy explicit without changing global priority / successful behavior

Requirement: SV2-CAP-03.
Responsible implementation: antoncore.
Fixture inputs: No Spot capacity, available on-demand capacity, and fallback both disabled and enabled.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CAP-03.
When: execute the owned behavior described as: Prevent a soft scheduling preference from being mistaken for a Spot-first scaling guarantee.
Then: Spot-only canary admission either uses the approved Spot pool or reports unavailability without selecting on-demand.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect capacity_fallback_decisions_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CAP-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
On failure: apply the package containment/rollback rule: Select the previous capacity policy for new attempts and allow existing attempts to finish or drain.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CAP-03-B: Make Spot policy explicit without changing global priority / rejection and containment

Requirement: SV2-CAP-03.
Responsible implementation: antoncore.
Fixture inputs: No Spot capacity, available on-demand capacity, and fallback both disabled and enabled.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CAP-03 without broadening its grant or replacing the bad input silently.
Then: A soft Pod preference is not accepted as proof that scale-up will select Spot.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect capacity_fallback_decisions_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CAP-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
On failure: apply the package containment/rollback rule: Select the previous capacity policy for new attempts and allow existing attempts to finish or drain.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CAP-03-C: Make Spot policy explicit without changing global priority / recovery and replay

Requirement: SV2-CAP-03.
Responsible implementation: antoncore.
Fixture inputs: No Spot capacity, available on-demand capacity, and fallback both disabled and enabled.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A shortage follows the configured wait or approved fallback decision with its budget recorded.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect capacity_fallback_decisions_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CAP-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
On failure: apply the package containment/rollback rule: Select the previous capacity policy for new attempts and allow existing attempts to finish or drain.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CAP-04-A: Implement measured resource budgets and namespace quotas / successful behavior

Requirement: SV2-CAP-04.
Responsible implementation: antoncore.
Fixture inputs: Browser-heavy, compiler-heavy, idle-CLI, and high-process-count workload samples.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CAP-04.
When: execute the owned behavior described as: Bound aggregate swarm pressure while allowing real workloads to burst safely.
Then: A bounded swarm burst runs representative tests without node memory pressure or unexpected critical-workload preemption.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect swarm_resource_pressure_events_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CAP-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
On failure: apply the package containment/rollback rule: Reduce swarm admission and restore previous resource overlays before increasing capacity.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CAP-04-B: Implement measured resource budgets and namespace quotas / rejection and containment

Requirement: SV2-CAP-04.
Responsible implementation: antoncore.
Fixture inputs: Browser-heavy, compiler-heavy, idle-CLI, and high-process-count workload samples.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CAP-04 without broadening its grant or replacing the bad input silently.
Then: A worker without the required resource specification cannot bypass the namespace limits.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect swarm_resource_pressure_events_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CAP-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
On failure: apply the package containment/rollback rule: Reduce swarm admission and restore previous resource overlays before increasing capacity.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CAP-04-C: Implement measured resource budgets and namespace quotas / recovery and replay

Requirement: SV2-CAP-04.
Responsible implementation: antoncore.
Fixture inputs: Browser-heavy, compiler-heavy, idle-CLI, and high-process-count workload samples.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: After an OOM, the task is classified and resized or stopped by policy rather than retried forever unchanged.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect swarm_resource_pressure_events_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CAP-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
On failure: apply the package containment/rollback rule: Reduce swarm admission and restore previous resource overlays before increasing capacity.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CAP-05-A: Integrate drain protection and cost-aware scale-down / successful behavior

Requirement: SV2-CAP-05.
Responsible implementation: antoncore.
Fixture inputs: Active task, completed task with stale annotation, real notice simulation, and abrupt node loss.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CAP-05.
When: execute the owned behavior described as: Preserve active work while ensuring idle swarm capacity can disappear.
Then: Completed swarm work releases Pods and permits idle eligible nodes to scale down.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect protected_idle_execution_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CAP-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
On failure: apply the package containment/rollback rule: Disable the canary capacity policy and retain on-demand execution while drain handling is repaired.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CAP-05-B: Integrate drain protection and cost-aware scale-down / rejection and containment

Requirement: SV2-CAP-05.
Responsible implementation: antoncore.
Fixture inputs: Active task, completed task with stale annotation, real notice simulation, and abrupt node loss.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CAP-05 without broadening its grant or replacing the bad input silently.
Then: A permanently protected idle Pod is detected as a defect rather than accepted as persistence.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect protected_idle_execution_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CAP-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
On failure: apply the package containment/rollback rule: Disable the canary capacity policy and retain on-demand execution while drain handling is repaired.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CAP-05-C: Integrate drain protection and cost-aware scale-down / recovery and replay

Requirement: SV2-CAP-05.
Responsible implementation: antoncore.
Fixture inputs: Active task, completed task with stale annotation, real notice simulation, and abrupt node loss.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: An interruption shorter than the configured Pod grace reports the last durable checkpoint honestly.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect protected_idle_execution_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CAP-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: No increase in spending ceilings or access to reserved workload pools without explicit operator approval.
On failure: apply the package containment/rollback rule: Disable the canary capacity policy and retain on-demand execution while drain handling is repaired.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group SEC: Scoped credentials and execution containment

T-SV2-SEC-01-A: Create minimal controller and worker RBAC / successful behavior

Requirement: SV2-SEC-01.
Responsible implementation: antoncore.
Fixture inputs: Controller, worker, operator-viewer, and unrelated service-account credentials.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-SEC-01.
When: execute the owned behavior described as: Separate control-plane object management from coding-worker permissions.
Then: The controller can manage its execution Pods while the worker cannot enumerate unrelated Secrets or mutate deployments.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Grant only the authority needed by each actor; worker self-report never widens that grant.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect rbac_denied_operations_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SEC-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Grant only the authority needed by each actor; worker self-report never widens that grant.
On failure: apply the package containment/rollback rule: Restore the previous role binding from a reviewed manifest and pause new launches during access repair.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SEC-01-B: Create minimal controller and worker RBAC / rejection and containment

Requirement: SV2-SEC-01.
Responsible implementation: antoncore.
Fixture inputs: Controller, worker, operator-viewer, and unrelated service-account credentials.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-SEC-01 without broadening its grant or replacing the bad input silently.
Then: A coding task that runs kubectl with an inherited token finds no unintended cluster authority.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect rbac_denied_operations_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SEC-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Grant only the authority needed by each actor; worker self-report never widens that grant.
On failure: apply the package containment/rollback rule: Restore the previous role binding from a reviewed manifest and pause new launches during access repair.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SEC-01-C: Create minimal controller and worker RBAC / recovery and replay

Requirement: SV2-SEC-01.
Responsible implementation: antoncore.
Fixture inputs: Controller, worker, operator-viewer, and unrelated service-account credentials.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Credential rotation preserves controller discovery without broadening its Role.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect rbac_denied_operations_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SEC-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Grant only the authority needed by each actor; worker self-report never widens that grant.
On failure: apply the package containment/rollback rule: Restore the previous role binding from a reviewed manifest and pause new launches during access repair.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SEC-02-A: Deliver one selected provider account per attempt / successful behavior

Requirement: SV2-SEC-02.
Responsible implementation: antoncore.
Fixture inputs: Two provider accounts, one admitted worker, and a forbidden secret-reference override.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-SEC-02.
When: execute the owned behavior described as: Prevent all-account secret bundles from reaching every coding agent.
Then: A worker can authenticate only the selected account and its narrowly scoped service integrations.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Grant only the authority needed by each actor; worker self-report never widens that grant.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect worker_secret_scope_violations with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SEC-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Grant only the authority needed by each actor; worker self-report never widens that grant.
On failure: apply the package containment/rollback rule: Revoke the attempted grant and retain prior valid account bindings for unaffected executions.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SEC-02-B: Deliver one selected provider account per attempt / rejection and containment

Requirement: SV2-SEC-02.
Responsible implementation: antoncore.
Fixture inputs: Two provider accounts, one admitted worker, and a forbidden secret-reference override.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-SEC-02 without broadening its grant or replacing the bad input silently.
Then: A task cannot request another account by altering environment fields in its launch body.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect worker_secret_scope_violations with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SEC-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Grant only the authority needed by each actor; worker self-report never widens that grant.
On failure: apply the package containment/rollback rule: Revoke the attempted grant and retain prior valid account bindings for unaffected executions.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SEC-02-C: Deliver one selected provider account per attempt / recovery and replay

Requirement: SV2-SEC-02.
Responsible implementation: antoncore.
Fixture inputs: Two provider accounts, one admitted worker, and a forbidden secret-reference override.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Rotated credentials are picked up through the approved refresh or drain policy rather than an uncontrolled fleet restart.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect worker_secret_scope_violations with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SEC-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Grant only the authority needed by each actor; worker self-report never widens that grant.
On failure: apply the package containment/rollback rule: Revoke the attempted grant and retain prior valid account bindings for unaffected executions.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SEC-03-A: Constrain network reachability / successful behavior

Requirement: SV2-SEC-03.
Responsible implementation: antoncore.
Fixture inputs: Allowed service set, denied metadata route, denied production endpoint, and rotated DNS target.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-SEC-03.
When: execute the owned behavior described as: Permit required services without granting workers unrestricted private infrastructure access.
Then: The canary reaches required endpoints and cannot reach denied metadata or unrelated private services.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Grant only the authority needed by each actor; worker self-report never widens that grant.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect worker_denied_network_attempts with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SEC-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Grant only the authority needed by each actor; worker self-report never widens that grant.
On failure: apply the package containment/rollback rule: Restore the preceding policy and reduce admission while reachability defects are corrected.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SEC-03-B: Constrain network reachability / rejection and containment

Requirement: SV2-SEC-03.
Responsible implementation: antoncore.
Fixture inputs: Allowed service set, denied metadata route, denied production endpoint, and rotated DNS target.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-SEC-03 without broadening its grant or replacing the bad input silently.
Then: A NetworkPolicy object existing without effective enforcement does not pass acceptance.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect worker_denied_network_attempts with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SEC-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Grant only the authority needed by each actor; worker self-report never widens that grant.
On failure: apply the package containment/rollback rule: Restore the preceding policy and reduce admission while reachability defects are corrected.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SEC-03-C: Constrain network reachability / recovery and replay

Requirement: SV2-SEC-03.
Responsible implementation: antoncore.
Fixture inputs: Allowed service set, denied metadata route, denied production endpoint, and rotated DNS target.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A DNS or endpoint rotation can be applied without replacing data-scope authorization.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect worker_denied_network_attempts with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SEC-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Grant only the authority needed by each actor; worker self-report never widens that grant.
On failure: apply the package containment/rollback rule: Restore the preceding policy and reduce admission while reachability defects are corrected.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SEC-04-A: Secure operator terminal attachment / successful behavior

Requirement: SV2-SEC-04.
Responsible implementation: antoncore.
Fixture inputs: Valid operator certificate, expired certificate, untrusted server, and replaced execution endpoint.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-SEC-04.
When: execute the owned behavior described as: Give the operator interactive visibility without sharing cluster or host administration credentials.
Then: An authorized operator attaches to the correct execution while a stale credential cannot attach to a replacement.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Grant only the authority needed by each actor; worker self-report never widens that grant.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect terminal_attach_authorization_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SEC-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Grant only the authority needed by each actor; worker self-report never widens that grant.
On failure: apply the package containment/rollback rule: Disable attachment or restore prior trusted issuance configuration without terminating task processes.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SEC-04-B: Secure operator terminal attachment / rejection and containment

Requirement: SV2-SEC-04.
Responsible implementation: antoncore.
Fixture inputs: Valid operator certificate, expired certificate, untrusted server, and replaced execution endpoint.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-SEC-04 without broadening its grant or replacing the bad input silently.
Then: Unknown or changed server identity is not silently accepted to restore convenience.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect terminal_attach_authorization_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SEC-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Grant only the authority needed by each actor; worker self-report never widens that grant.
On failure: apply the package containment/rollback rule: Disable attachment or restore prior trusted issuance configuration without terminating task processes.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SEC-04-C: Secure operator terminal attachment / recovery and replay

Requirement: SV2-SEC-04.
Responsible implementation: antoncore.
Fixture inputs: Valid operator certificate, expired certificate, untrusted server, and replaced execution endpoint.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Certificate renewal preserves a live agent and reconnects without reinstalling herdr.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect terminal_attach_authorization_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SEC-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Grant only the authority needed by each actor; worker self-report never widens that grant.
On failure: apply the package containment/rollback rule: Disable attachment or restore prior trusted issuance configuration without terminating task processes.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SEC-05-A: Protect archives and brain data by scope / successful behavior

Requirement: SV2-SEC-05.
Responsible implementation: antoncore.
Fixture inputs: Separate personal and swarm archives with overlapping display names and session identifiers.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-SEC-05.
When: execute the owned behavior described as: Make personal versus swarm isolation enforceable beyond names and namespaces.
Then: A swarm worker cannot read personal sessions even when it guesses a known native session ID.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Grant only the authority needed by each actor; worker self-report never widens that grant.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect cross_scope_access_rejections_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SEC-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Grant only the authority needed by each actor; worker self-report never widens that grant.
On failure: apply the package containment/rollback rule: Restore only the reviewed previous grants and keep denied data private during recovery.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SEC-05-B: Protect archives and brain data by scope / rejection and containment

Requirement: SV2-SEC-05.
Responsible implementation: antoncore.
Fixture inputs: Separate personal and swarm archives with overlapping display names and session identifiers.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-SEC-05 without broadening its grant or replacing the bad input silently.
Then: Changing a request brain_id or archive key does not bypass backend authorization.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect cross_scope_access_rejections_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SEC-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Grant only the authority needed by each actor; worker self-report never widens that grant.
On failure: apply the package containment/rollback rule: Restore only the reviewed previous grants and keep denied data private during recovery.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SEC-05-C: Protect archives and brain data by scope / recovery and replay

Requirement: SV2-SEC-05.
Responsible implementation: antoncore.
Fixture inputs: Separate personal and swarm archives with overlapping display names and session identifiers.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Revoking a project grant invalidates subsequent reads and cached context derived from that grant.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect cross_scope_access_rejections_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SEC-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Grant only the authority needed by each actor; worker self-report never widens that grant.
On failure: apply the package containment/rollback rule: Restore only the reviewed previous grants and keep denied data private during recovery.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group FSY: Private runtime homes, worktrees, and artifact locality

T-SV2-FSY-01-A: Define the execution filesystem layout / successful behavior

Requirement: SV2-FSY-01.
Responsible implementation: agentihooks.
Fixture inputs: Two isolated execution roots plus symlink and relative-path escape fixtures.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-FSY-01.
When: execute the owned behavior described as: Give every process a stable private path contract that does not rely on the personal machine.
Then: Two Pods can use the same internal path names without sharing mutable CLI files or Unix sockets.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect execution_path_validation_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FSY-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
On failure: apply the package containment/rollback rule: Retain old layout readers and stop new launches when a layout version cannot be restored.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FSY-01-B: Define the execution filesystem layout / rejection and containment

Requirement: SV2-FSY-01.
Responsible implementation: agentihooks.
Fixture inputs: Two isolated execution roots plus symlink and relative-path escape fixtures.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-FSY-01 without broadening its grant or replacing the bad input silently.
Then: A profile or archive extraction that resolves outside its execution root is rejected.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect execution_path_validation_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FSY-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
On failure: apply the package containment/rollback rule: Retain old layout readers and stop new launches when a layout version cannot be restored.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FSY-01-C: Define the execution filesystem layout / recovery and replay

Requirement: SV2-FSY-01.
Responsible implementation: agentihooks.
Fixture inputs: Two isolated execution roots plus symlink and relative-path escape fixtures.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Recreating an attempt restores documented paths from metadata rather than from an old node’s absolute path.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect execution_path_validation_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FSY-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
On failure: apply the package containment/rollback rule: Retain old layout readers and stop new launches when a layout version cannot be restored.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FSY-02-A: Prepare local repository mirrors and worktrees / successful behavior

Requirement: SV2-FSY-02.
Responsible implementation: agentihooks.
Fixture inputs: Correct mirror, wrong-origin mirror, stale base, and concurrent worktree preparation.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-FSY-02.
When: execute the owned behavior described as: Reuse existing development-cycle branch rules while keeping cloud Git I/O local.
Then: An agent begins in an isolated worktree tied to the correct project and task generation.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect workspace_prepare_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FSY-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
On failure: apply the package containment/rollback rule: Disable cache reuse and use a fresh local clone while keeping archive references valid.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FSY-02-B: Prepare local repository mirrors and worktrees / rejection and containment

Requirement: SV2-FSY-02.
Responsible implementation: agentihooks.
Fixture inputs: Correct mirror, wrong-origin mirror, stale base, and concurrent worktree preparation.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-FSY-02 without broadening its grant or replacing the bad input silently.
Then: A cached repository with a mismatched origin cannot be reused based on its folder name alone.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect workspace_prepare_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FSY-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
On failure: apply the package containment/rollback rule: Disable cache reuse and use a fresh local clone while keeping archive references valid.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FSY-02-C: Prepare local repository mirrors and worktrees / recovery and replay

Requirement: SV2-FSY-02.
Responsible implementation: agentihooks.
Fixture inputs: Correct mirror, wrong-origin mirror, stale base, and concurrent worktree preparation.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A fetch failure leaves the prior cache untouched and does not start work from an unverified stale base.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect workspace_prepare_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FSY-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
On failure: apply the package containment/rollback rule: Disable cache reuse and use a fresh local clone while keeping archive references valid.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FSY-03-A: Control caches and build storage / successful behavior

Requirement: SV2-FSY-03.
Responsible implementation: agentihooks.
Fixture inputs: Trusted cache, poisoned executable entry, full disk, and mismatched dependency lock.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-FSY-03.
When: execute the owned behavior described as: Reduce repeated downloads without turning caches into shared authoritative state.
Then: Two compatible tasks reuse a dependency cache while keeping native conversations and credentials separate.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect cache_hit_rate and cache_corruption_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FSY-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
On failure: apply the package containment/rollback rule: Turn cache reuse off and preserve all authoritative workspace and archive material.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FSY-03-B: Control caches and build storage / rejection and containment

Requirement: SV2-FSY-03.
Responsible implementation: agentihooks.
Fixture inputs: Trusted cache, poisoned executable entry, full disk, and mismatched dependency lock.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-FSY-03 without broadening its grant or replacing the bad input silently.
Then: A cache from an untrusted project cannot replace executable toolchain content in another scope.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect cache_hit_rate and cache_corruption_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FSY-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
On failure: apply the package containment/rollback rule: Turn cache reuse off and preserve all authoritative workspace and archive material.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FSY-03-C: Control caches and build storage / recovery and replay

Requirement: SV2-FSY-03.
Responsible implementation: agentihooks.
Fixture inputs: Trusted cache, poisoned executable entry, full disk, and mismatched dependency lock.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Corrupt cache content is discarded and rebuilt without deleting the task’s source changes.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect cache_hit_rate and cache_corruption_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FSY-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
On failure: apply the package containment/rollback rule: Turn cache reuse off and preserve all authoritative workspace and archive material.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FSY-04-A: Implement a backend-neutral artifact adapter / successful behavior

Requirement: SV2-FSY-04.
Responsible implementation: agentihooks.
Fixture inputs: Local durable directory and object-store fake with injected truncated uploads.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-FSY-04.
When: execute the owned behavior described as: Support existing durable storage without forcing every worker to share a writable home.
Then: An uploaded artifact can be verified and retrieved by its immutable content reference through either supported backend.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect artifact_upload_verification_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FSY-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
On failure: apply the package containment/rollback rule: Keep existing backend objects immutable and switch only future manifest publication to the previous adapter.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FSY-04-B: Implement a backend-neutral artifact adapter / rejection and containment

Requirement: SV2-FSY-04.
Responsible implementation: agentihooks.
Fixture inputs: Local durable directory and object-store fake with injected truncated uploads.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-FSY-04 without broadening its grant or replacing the bad input silently.
Then: A transport acknowledgement with mismatched content hash is not accepted as durability proof.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect artifact_upload_verification_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FSY-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
On failure: apply the package containment/rollback rule: Keep existing backend objects immutable and switch only future manifest publication to the previous adapter.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FSY-04-C: Implement a backend-neutral artifact adapter / recovery and replay

Requirement: SV2-FSY-04.
Responsible implementation: agentihooks.
Fixture inputs: Local durable directory and object-store fake with injected truncated uploads.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Retrying a completed upload with the same artifact ID returns the committed object without duplication.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect artifact_upload_verification_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FSY-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
On failure: apply the package containment/rollback rule: Keep existing backend objects immutable and switch only future manifest publication to the previous adapter.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FSY-05-A: Prevent unsafe shared filesystem assumptions / successful behavior

Requirement: SV2-FSY-05.
Responsible implementation: agentihooks.
Fixture inputs: Safe read-only seed, safe scoped artifact mount, and unsafe shared mutable native home.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-FSY-05.
When: execute the owned behavior described as: Permit useful shared storage while excluding cross-process identity corruption.
Then: A deployment with shared artifact storage and private runtime homes passes while a shared writable Codex home fails policy validation.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect shared_runtime_mount_rejections_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FSY-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
On failure: apply the package containment/rollback rule: Return to private local execution with artifact publishing paused until the backend is healthy.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FSY-05-B: Prevent unsafe shared filesystem assumptions / rejection and containment

Requirement: SV2-FSY-05.
Responsible implementation: agentihooks.
Fixture inputs: Safe read-only seed, safe scoped artifact mount, and unsafe shared mutable native home.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-FSY-05 without broadening its grant or replacing the bad input silently.
Then: Mounting the entire operator home into all workers is refused by the template checker.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect shared_runtime_mount_rejections_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FSY-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
On failure: apply the package containment/rollback rule: Return to private local execution with artifact publishing paused until the backend is healthy.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-FSY-05-C: Prevent unsafe shared filesystem assumptions / recovery and replay

Requirement: SV2-FSY-05.
Responsible implementation: agentihooks.
Fixture inputs: Safe read-only seed, safe scoped artifact mount, and unsafe shared mutable native home.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Loss of shared artifact storage degrades checkpoint publication without corrupting local worktrees.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect shared_runtime_mount_rejections_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-FSY-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Local working files remain attempt-private; durable shared data has explicit scope and ownership.
On failure: apply the package containment/rollback rule: Return to private local execution with artifact publishing paused until the backend is healthy.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group CKP: Durable checkpoints and truthful recovery

T-SV2-CKP-01-A: Define checkpoint manifests and completeness rules / successful behavior

Requirement: SV2-CKP-01.
Responsible implementation: agentihooks.
Fixture inputs: Complete native-resume bundle, context-only bundle, and path-only legacy snapshot.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CKP-01.
When: execute the owned behavior described as: Replace path-only recovery assumptions with a portable verified artifact contract.
Then: A manifest validator can determine whether native resume or only context continuation is supported without reading a dead worker filesystem.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect checkpoint_completeness_by_reason with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CKP-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
On failure: apply the package containment/rollback rule: Keep earlier manifest readers and disable new checkpoint promotion if the version is unsupported.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CKP-01-B: Define checkpoint manifests and completeness rules / rejection and containment

Requirement: SV2-CKP-01.
Responsible implementation: agentihooks.
Fixture inputs: Complete native-resume bundle, context-only bundle, and path-only legacy snapshot.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CKP-01 without broadening its grant or replacing the bad input silently.
Then: A conversation ID and old worktree path alone cannot produce a complete checkpoint.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect checkpoint_completeness_by_reason with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CKP-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
On failure: apply the package containment/rollback rule: Keep earlier manifest readers and disable new checkpoint promotion if the version is unsupported.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CKP-01-C: Define checkpoint manifests and completeness rules / recovery and replay

Requirement: SV2-CKP-01.
Responsible implementation: agentihooks.
Fixture inputs: Complete native-resume bundle, context-only bundle, and path-only legacy snapshot.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Loading an older supported manifest preserves known limitations instead of guessing missing materials.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect checkpoint_completeness_by_reason with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CKP-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
On failure: apply the package containment/rollback rule: Keep earlier manifest readers and disable new checkpoint promotion if the version is unsupported.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CKP-02-A: Capture committed and uncommitted source state / successful behavior

Requirement: SV2-CKP-02.
Responsible implementation: agentihooks.
Fixture inputs: Worktree with both index and working-tree changes plus one allowed and one prohibited untracked file.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CKP-02.
When: execute the owned behavior described as: Preserve useful work not yet present in the remote repository.
Then: A restored worktree reproduces committed, staged, unstaged, and permitted untracked changes from a stopped attempt.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect checkpoint_source_bytes with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CKP-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
On failure: apply the package containment/rollback rule: Retain the previous complete source checkpoint and preserve incomplete capture for diagnostics.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CKP-02-B: Capture committed and uncommitted source state / rejection and containment

Requirement: SV2-CKP-02.
Responsible implementation: agentihooks.
Fixture inputs: Worktree with both index and working-tree changes plus one allowed and one prohibited untracked file.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CKP-02 without broadening its grant or replacing the bad input silently.
Then: An untracked credential file or archive path escape is excluded or rejected with a sanitized reason.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect checkpoint_source_bytes with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CKP-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
On failure: apply the package containment/rollback rule: Retain the previous complete source checkpoint and preserve incomplete capture for diagnostics.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CKP-02-C: Capture committed and uncommitted source state / recovery and replay

Requirement: SV2-CKP-02.
Responsible implementation: agentihooks.
Fixture inputs: Worktree with both index and working-tree changes plus one allowed and one prohibited untracked file.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Interrupted capture publishes no complete manifest and leaves the previous checkpoint current.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect checkpoint_source_bytes with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CKP-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
On failure: apply the package containment/rollback rule: Retain the previous complete source checkpoint and preserve incomplete capture for diagnostics.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CKP-03-A: Capture provider-native resume artifacts safely / successful behavior

Requirement: SV2-CKP-03.
Responsible implementation: agentihooks.
Fixture inputs: Claude and Codex test sessions, changed native format, and active-database capture attempts.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CKP-03.
When: execute the owned behavior described as: Qualify real conversation resumption separately for each installed CLI.
Then: A supported harness reopens the expected native conversation from a validated checkpoint and reports its identity.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect native_resume_success_by_target with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CKP-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
On failure: apply the package containment/rollback rule: Keep context-based continuation available while native resume qualification is disabled.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CKP-03-B: Capture provider-native resume artifacts safely / rejection and containment

Requirement: SV2-CKP-03.
Responsible implementation: agentihooks.
Fixture inputs: Claude and Codex test sessions, changed native format, and active-database capture attempts.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CKP-03 without broadening its grant or replacing the bad input silently.
Then: A normalized summary or arbitrary database copy is not labelled a successful native resume.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect native_resume_success_by_target with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CKP-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
On failure: apply the package containment/rollback rule: Keep context-based continuation available while native resume qualification is disabled.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CKP-03-C: Capture provider-native resume artifacts safely / recovery and replay

Requirement: SV2-CKP-03.
Responsible implementation: agentihooks.
Fixture inputs: Claude and Codex test sessions, changed native format, and active-database capture attempts.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: An unsupported version yields native_resume_unavailable and preserves the operator’s continue-or-fresh decision.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect native_resume_success_by_target with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CKP-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
On failure: apply the package containment/rollback rule: Keep context-based continuation available while native resume qualification is disabled.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CKP-04-A: Publish checkpoints atomically and periodically / successful behavior

Requirement: SV2-CKP-04.
Responsible implementation: agentihooks.
Fixture inputs: Lost acknowledgements at each upload and manifest commit boundary.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CKP-04.
When: execute the owned behavior described as: Reduce interruption loss while preventing partially uploaded state from replacing valid recovery material.
Then: A complete checkpoint pointer never references a missing or unverified required object.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect checkpoint_age_seconds and checkpoint_publish_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CKP-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
On failure: apply the package containment/rollback rule: Stop periodic promotion and retain the last complete manifest until the publisher is repaired.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CKP-04-B: Publish checkpoints atomically and periodically / rejection and containment

Requirement: SV2-CKP-04.
Responsible implementation: agentihooks.
Fixture inputs: Lost acknowledgements at each upload and manifest commit boundary.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CKP-04 without broadening its grant or replacing the bad input silently.
Then: A stale worker cannot promote a checkpoint over the current generation’s pointer.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect checkpoint_age_seconds and checkpoint_publish_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CKP-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
On failure: apply the package containment/rollback rule: Stop periodic promotion and retain the last complete manifest until the publisher is repaired.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CKP-04-C: Publish checkpoints atomically and periodically / recovery and replay

Requirement: SV2-CKP-04.
Responsible implementation: agentihooks.
Fixture inputs: Lost acknowledgements at each upload and manifest commit boundary.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Failure after object upload but before manifest commit leaves safely reclaimable orphan objects and the old checkpoint intact.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect checkpoint_age_seconds and checkpoint_publish_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CKP-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
On failure: apply the package containment/rollback rule: Stop periodic promotion and retain the last complete manifest until the publisher is repaired.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CKP-05-A: Implement fenced restore decisions and validation / successful behavior

Requirement: SV2-CKP-05.
Responsible implementation: agentihooks.
Fixture inputs: Valid checkpoint, corrupt object, unsupported harness version, and duplicated restore request.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CKP-05.
When: execute the owned behavior described as: Recover elsewhere without hiding whether continuity was native, reconstructed, or fresh.
Then: A lost worker recovers exactly one new attempt and the ledger identifies its recovery type and durable watermark.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect restore_outcomes_by_type with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CKP-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
On failure: apply the package containment/rollback rule: Pause restore automation while keeping checkpoint artifacts and awaiting-decision task states intact.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CKP-05-B: Implement fenced restore decisions and validation / rejection and containment

Requirement: SV2-CKP-05.
Responsible implementation: agentihooks.
Fixture inputs: Valid checkpoint, corrupt object, unsupported harness version, and duplicated restore request.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CKP-05 without broadening its grant or replacing the bad input silently.
Then: Failed native resume cannot silently clear the prior task claim and mark a fresh conversation as resumed.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect restore_outcomes_by_type with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CKP-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
On failure: apply the package containment/rollback rule: Pause restore automation while keeping checkpoint artifacts and awaiting-decision task states intact.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CKP-05-C: Implement fenced restore decisions and validation / recovery and replay

Requirement: SV2-CKP-05.
Responsible implementation: agentihooks.
Fixture inputs: Valid checkpoint, corrupt object, unsupported harness version, and duplicated restore request.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A second restore attempt reuses the accepted decision and checkpoint without spawning duplicate replacements.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect restore_outcomes_by_type with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CKP-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: A checkpoint becomes authoritative only after required artifacts and its manifest are durably verified.
On failure: apply the package containment/rollback rule: Pause restore automation while keeping checkpoint artifacts and awaiting-decision task states intact.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group ACC: Fleet-wide sessions, quota reservations, and broadcasts

T-SV2-ACC-01-A: Replace fleet liveness with scoped registry records / successful behavior

Requirement: SV2-ACC-01.
Responsible implementation: agentihooks.
Fixture inputs: Two machines with PID collisions and one legitimate renamed agent alias.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-ACC-01.
When: execute the owned behavior described as: Stop treating Anton’s local process table as proof of all remote agents.
Then: Local and remote sessions coexist in one registry without removing each other because their PIDs are not locally visible.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect fleet_registry_stale_records with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ACC-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
On failure: apply the package containment/rollback rule: Continue local-only registry reads while distributed launches are disabled.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ACC-01-B: Replace fleet liveness with scoped registry records / rejection and containment

Requirement: SV2-ACC-01.
Responsible implementation: agentihooks.
Fixture inputs: Two machines with PID collisions and one legitimate renamed agent alias.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-ACC-01 without broadening its grant or replacing the bad input silently.
Then: A remote session cannot register as the swarm master solely through its chosen name.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect fleet_registry_stale_records with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ACC-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
On failure: apply the package containment/rollback rule: Continue local-only registry reads while distributed launches are disabled.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ACC-01-C: Replace fleet liveness with scoped registry records / recovery and replay

Requirement: SV2-ACC-01.
Responsible implementation: agentihooks.
Fixture inputs: Two machines with PID collisions and one legitimate renamed agent alias.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Registry recovery from persisted state preserves old aliases and current ownership generations.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect fleet_registry_stale_records with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ACC-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
On failure: apply the package containment/rollback rule: Continue local-only registry reads while distributed launches are disabled.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ACC-02-A: Reserve provider-account capacity atomically / successful behavior

Requirement: SV2-ACC-02.
Responsible implementation: agentihooks.
Fixture inputs: One account with one remaining slot and two simultaneous launch requests.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-ACC-02.
When: execute the owned behavior described as: Make authorized session caps meaningful across the entire fleet.
Then: Two concurrent controllers cannot both allocate the last available account slot.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect account_reservation_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ACC-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
On failure: apply the package containment/rollback rule: Freeze new distributed reservations and reconstruct occupancy from current confirmed execution records.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ACC-02-B: Reserve provider-account capacity atomically / rejection and containment

Requirement: SV2-ACC-02.
Responsible implementation: agentihooks.
Fixture inputs: One account with one remaining slot and two simultaneous launch requests.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-ACC-02 without broadening its grant or replacing the bad input silently.
Then: A stale attempt cannot free a slot currently held by its replacement.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect account_reservation_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ACC-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
On failure: apply the package containment/rollback rule: Freeze new distributed reservations and reconstruct occupancy from current confirmed execution records.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ACC-02-C: Reserve provider-account capacity atomically / recovery and replay

Requirement: SV2-ACC-02.
Responsible implementation: agentihooks.
Fixture inputs: One account with one remaining slot and two simultaneous launch requests.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A worker that never starts releases its bounded reservation without being counted as a live account session forever.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect account_reservation_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ACC-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
On failure: apply the package containment/rollback rule: Freeze new distributed reservations and reconstruct occupancy from current confirmed execution records.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ACC-03-A: Aggregate quota observations without credential leakage / successful behavior

Requirement: SV2-ACC-03.
Responsible implementation: agentihooks.
Fixture inputs: Stale full-quota report arriving after a newer exhausted-quota observation.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-ACC-03.
When: execute the owned behavior described as: Preserve existing routing policy while collecting quota evidence from the correct account across machines.
Then: The fleet routes new work using the newest valid observation for the selected account.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect quota_observation_age_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ACC-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
On failure: apply the package containment/rollback rule: Return to conservative account admission while keeping previously recorded quota history.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ACC-03-B: Aggregate quota observations without credential leakage / rejection and containment

Requirement: SV2-ACC-03.
Responsible implementation: agentihooks.
Fixture inputs: Stale full-quota report arriving after a newer exhausted-quota observation.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-ACC-03 without broadening its grant or replacing the bad input silently.
Then: Missing quota data is labelled unknown rather than converted to full available capacity.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect quota_observation_age_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ACC-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
On failure: apply the package containment/rollback rule: Return to conservative account admission while keeping previously recorded quota history.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ACC-03-C: Aggregate quota observations without credential leakage / recovery and replay

Requirement: SV2-ACC-03.
Responsible implementation: agentihooks.
Fixture inputs: Stale full-quota report arriving after a newer exhausted-quota observation.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A provider outage leads to bounded wait or configured handoff without repeated unbounded agent starts.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect quota_observation_age_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ACC-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
On failure: apply the package containment/rollback rule: Return to conservative account admission while keeping previously recorded quota history.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ACC-04-A: Move broadcast coordination off shared mutable JSON / successful behavior

Requirement: SV2-ACC-04.
Responsible implementation: agentihooks.
Fixture inputs: Local and remote subscribers, expired warning, personal message, and duplicate delivery acknowledgement.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-ACC-04.
When: execute the owned behavior described as: Deliver cluster-wide messages while preserving per-session targeting and deduplication.
Then: A critical authorized swarm warning reaches local and remote subscribed agents once per configured delivery policy.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect broadcast_delivery_lag_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ACC-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
On failure: apply the package containment/rollback rule: Disable distributed publication and preserve the canonical event history for later reconciliation.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ACC-04-B: Move broadcast coordination off shared mutable JSON / rejection and containment

Requirement: SV2-ACC-04.
Responsible implementation: agentihooks.
Fixture inputs: Local and remote subscribers, expired warning, personal message, and duplicate delivery acknowledgement.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-ACC-04 without broadening its grant or replacing the bad input silently.
Then: A personal-brain message or another fleet’s warning is not delivered by matching only the channel name.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect broadcast_delivery_lag_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ACC-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
On failure: apply the package containment/rollback rule: Disable distributed publication and preserve the canonical event history for later reconciliation.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ACC-04-C: Move broadcast coordination off shared mutable JSON / recovery and replay

Requirement: SV2-ACC-04.
Responsible implementation: agentihooks.
Fixture inputs: Local and remote subscribers, expired warning, personal message, and duplicate delivery acknowledgement.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Reconnecting workers replay unexpired undelivered messages without duplicating acknowledged content.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect broadcast_delivery_lag_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ACC-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
On failure: apply the package containment/rollback rule: Disable distributed publication and preserve the canonical event history for later reconciliation.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ACC-05-A: Reconcile reservations, sessions, and process exits / successful behavior

Requirement: SV2-ACC-05.
Responsible implementation: agentihooks.
Fixture inputs: Half-completed handoff, orphan reservation, live worker with lost terminal, and delayed exit event.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-ACC-05.
When: execute the owned behavior described as: Prevent leaked slots or optimistic accounting after crashes and handoffs.
Then: A completed handoff releases the old slot only after the successor route is confirmed.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect account_occupancy_discrepancies with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ACC-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
On failure: apply the package containment/rollback rule: Run discrepancy reporting in observe-only mode while preserving conservative caps.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ACC-05-B: Reconcile reservations, sessions, and process exits / rejection and containment

Requirement: SV2-ACC-05.
Responsible implementation: agentihooks.
Fixture inputs: Half-completed handoff, orphan reservation, live worker with lost terminal, and delayed exit event.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-ACC-05 without broadening its grant or replacing the bad input silently.
Then: An SSH failure alone does not free an account slot and admit a duplicate worker.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect account_occupancy_discrepancies with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ACC-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
On failure: apply the package containment/rollback rule: Run discrepancy reporting in observe-only mode while preserving conservative caps.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ACC-05-C: Reconcile reservations, sessions, and process exits / recovery and replay

Requirement: SV2-ACC-05.
Responsible implementation: agentihooks.
Fixture inputs: Half-completed handoff, orphan reservation, live worker with lost terminal, and delayed exit event.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A controller restart reconciles expired reservations and live occupancy without reading remote process environments centrally.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect account_occupancy_discrepancies with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ACC-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Global fleet accounting is authoritative in the controller; local process observations remain supporting evidence.
On failure: apply the package containment/rollback rule: Run discrepancy reporting in observe-only mode while preserving conservative caps.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group SES: Provider-neutral incremental transcript capture

T-SV2-SES-01-A: Extract reusable record normalization without whole-file coupling / successful behavior

Requirement: SV2-SES-01.
Responsible implementation: agentihooks.
Fixture inputs: Claude, Codex, and Copilot examples containing text, tools, completion markers, and injected context.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-SES-01.
When: execute the owned behavior described as: Reuse existing Claude/Codex/Copilot understanding without repeatedly loading entire growing files.
Then: Existing marker and memory consumers produce equivalent normalized records while a new stream consumer can process incrementally.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Source evidence is normalized once and acknowledged only after durable acceptance.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect normalized_record_mismatch_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SES-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Source evidence is normalized once and acknowledged only after durable acceptance.
On failure: apply the package containment/rollback rule: Keep the prior whole-file public API available while disabling only the new streaming path.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SES-01-B: Extract reusable record normalization without whole-file coupling / rejection and containment

Requirement: SV2-SES-01.
Responsible implementation: agentihooks.
Fixture inputs: Claude, Codex, and Copilot examples containing text, tools, completion markers, and injected context.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-SES-01 without broadening its grant or replacing the bad input silently.
Then: A system-injected context record cannot become a new human instruction through normalization.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect normalized_record_mismatch_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SES-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Source evidence is normalized once and acknowledged only after durable acceptance.
On failure: apply the package containment/rollback rule: Keep the prior whole-file public API available while disabling only the new streaming path.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SES-01-C: Extract reusable record normalization without whole-file coupling / recovery and replay

Requirement: SV2-SES-01.
Responsible implementation: agentihooks.
Fixture inputs: Claude, Codex, and Copilot examples containing text, tools, completion markers, and injected context.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Restarting an incremental consumer with saved turn state avoids counting the same completion twice.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect normalized_record_mismatch_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SES-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Source evidence is normalized once and acknowledged only after durable acceptance.
On failure: apply the package containment/rollback rule: Keep the prior whole-file public API available while disabling only the new streaming path.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SES-02-A: Implement byte-safe tailing and durable cursors / successful behavior

Requirement: SV2-SES-02.
Responsible implementation: agentihooks.
Fixture inputs: UTF-8 boundary split, partial final line, rotated file, truncated file, and appended first line.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-SES-02.
When: execute the owned behavior described as: Avoid missing complete appended lines and avoid consuming incomplete trailing JSON.
Then: Appending one complete JSONL line after a saved newline boundary ingests that exact line once.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Source evidence is normalized once and acknowledged only after durable acceptance.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect transcript_cursor_replays_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SES-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Source evidence is normalized once and acknowledged only after durable acceptance.
On failure: apply the package containment/rollback rule: Stop the new collector and retain cursor/version metadata so a controlled replay can rebuild projections.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SES-02-B: Implement byte-safe tailing and durable cursors / rejection and containment

Requirement: SV2-SES-02.
Responsible implementation: agentihooks.
Fixture inputs: UTF-8 boundary split, partial final line, rotated file, truncated file, and appended first line.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-SES-02 without broadening its grant or replacing the bad input silently.
Then: A partial Unicode or JSON record does not advance the committed cursor.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect transcript_cursor_replays_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SES-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Source evidence is normalized once and acknowledged only after durable acceptance.
On failure: apply the package containment/rollback rule: Stop the new collector and retain cursor/version metadata so a controlled replay can rebuild projections.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SES-02-C: Implement byte-safe tailing and durable cursors / recovery and replay

Requirement: SV2-SES-02.
Responsible implementation: agentihooks.
Fixture inputs: UTF-8 boundary split, partial final line, rotated file, truncated file, and appended first line.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Restart during a partial write resumes from the last durable offset and later ingests the completed record.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect transcript_cursor_replays_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SES-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Source evidence is normalized once and acknowledged only after durable acceptance.
On failure: apply the package containment/rollback rule: Stop the new collector and retain cursor/version metadata so a controlled replay can rebuild projections.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SES-03-A: Implement an execution-local durable spool / successful behavior

Requirement: SV2-SES-03.
Responsible implementation: agentihooks.
Fixture inputs: Destination unavailable until spool reaches its warning threshold, then recovers.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-SES-03.
When: execute the owned behavior described as: Buffer upload outages without blocking every tool call or pretending ephemeral bytes are durable remotely.
Then: A temporary ingestion outage preserves locally buffered records and later uploads them without duplication.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Source evidence is normalized once and acknowledged only after durable acceptance.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect transcript_spool_bytes and archive_lag_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SES-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Source evidence is normalized once and acknowledged only after durable acceptance.
On failure: apply the package containment/rollback rule: Keep unacknowledged spool files and disable expensive indexing while transport recovers.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SES-03-B: Implement an execution-local durable spool / rejection and containment

Requirement: SV2-SES-03.
Responsible implementation: agentihooks.
Fixture inputs: Destination unavailable until spool reaches its warning threshold, then recovers.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-SES-03 without broadening its grant or replacing the bad input silently.
Then: A full spool cannot silently discard the oldest unacknowledged evidence.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect transcript_spool_bytes and archive_lag_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SES-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Source evidence is normalized once and acknowledged only after durable acceptance.
On failure: apply the package containment/rollback rule: Keep unacknowledged spool files and disable expensive indexing while transport recovers.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SES-03-C: Implement an execution-local durable spool / recovery and replay

Requirement: SV2-SES-03.
Responsible implementation: agentihooks.
Fixture inputs: Destination unavailable until spool reaches its warning threshold, then recovers.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Abrupt worker loss reports the last central watermark rather than claiming the entire local tail survived.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect transcript_spool_bytes and archive_lag_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SES-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Source evidence is normalized once and acknowledged only after durable acceptance.
On failure: apply the package containment/rollback rule: Keep unacknowledged spool files and disable expensive indexing while transport recovers.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SES-04-A: Create idempotent central ingestion / successful behavior

Requirement: SV2-SES-04.
Responsible implementation: agentihooks.
Fixture inputs: Valid batch, duplicate batch, mixed-scope batch, and crash-after-commit injection.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-SES-04.
When: execute the owned behavior described as: Commit normalized events into the durable corpus with stable cross-worker identities.
Then: Retrying the same batch from a replacement connection creates one canonical copy of each event.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Source evidence is normalized once and acknowledged only after durable acceptance.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect ingest_duplicate_events_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SES-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Source evidence is normalized once and acknowledged only after durable acceptance.
On failure: apply the package containment/rollback rule: Disable the new producer while keeping committed events and replay-safe cursors available.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SES-04-B: Create idempotent central ingestion / rejection and containment

Requirement: SV2-SES-04.
Responsible implementation: agentihooks.
Fixture inputs: Valid batch, duplicate batch, mixed-scope batch, and crash-after-commit injection.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-SES-04 without broadening its grant or replacing the bad input silently.
Then: A batch mixing unauthorized project events is rejected according to the documented atomicity rule.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect ingest_duplicate_events_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SES-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Source evidence is normalized once and acknowledged only after durable acceptance.
On failure: apply the package containment/rollback rule: Disable the new producer while keeping committed events and replay-safe cursors available.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SES-04-C: Create idempotent central ingestion / recovery and replay

Requirement: SV2-SES-04.
Responsible implementation: agentihooks.
Fixture inputs: Valid batch, duplicate batch, mixed-scope batch, and crash-after-commit injection.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A crash between database commit and response returns the committed watermark on retry.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect ingest_duplicate_events_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SES-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Source evidence is normalized once and acknowledged only after durable acceptance.
On failure: apply the package containment/rollback rule: Disable the new producer while keeping committed events and replay-safe cursors available.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SES-05-A: Backfill historical provider sessions with provenance / successful behavior

Requirement: SV2-SES-05.
Responsible implementation: agentihooks.
Fixture inputs: Old Claude transcript, Codex rollout, missing source file, and ambiguous duplicate repository basename.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-SES-05.
When: execute the owned behavior described as: Recover useful past evidence without assigning unknown history to an invented project.
Then: Imported history is searchable with its original source attribution and unknown fields remain explicit.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Source evidence is normalized once and acknowledged only after durable acceptance.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect historical_import_unknown_attribution with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SES-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Source evidence is normalized once and acknowledged only after durable acceptance.
On failure: apply the package containment/rollback rule: Remove only import-owned projections after preserving a full export and manifest.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SES-05-B: Backfill historical provider sessions with provenance / rejection and containment

Requirement: SV2-SES-05.
Responsible implementation: agentihooks.
Fixture inputs: Old Claude transcript, Codex rollout, missing source file, and ambiguous duplicate repository basename.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-SES-05 without broadening its grant or replacing the bad input silently.
Then: A project basename alone cannot grant access to a historical personal transcript.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect historical_import_unknown_attribution with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SES-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Source evidence is normalized once and acknowledged only after durable acceptance.
On failure: apply the package containment/rollback rule: Remove only import-owned projections after preserving a full export and manifest.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-SES-05-C: Backfill historical provider sessions with provenance / recovery and replay

Requirement: SV2-SES-05.
Responsible implementation: agentihooks.
Fixture inputs: Old Claude transcript, Codex rollout, missing source file, and ambiguous duplicate repository basename.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Re-running an import resumes by source hash and does not duplicate previously committed sessions.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect historical_import_unknown_attribution with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-SES-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Source evidence is normalized once and acknowledged only after durable acceptance.
On failure: apply the package containment/rollback rule: Remove only import-owned projections after preserving a full export and manifest.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group IDX: Durable session catalog, embeddings, and evidence search

T-SV2-IDX-01-A: Create durable session and record storage / successful behavior

Requirement: SV2-IDX-01.
Responsible implementation: agentihooks.
Fixture inputs: Long transcript exceeding preview limits and a deliberately missing archived object.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-IDX-01.
When: execute the owned behavior described as: Separate complete evidence from bounded caches and search previews.
Then: A session with more than the legacy preview cap remains fully retrievable after worker deletion.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Search projections never replace the durable supporting records and must obey the same authorization.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect archive_integrity_failures_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDX-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Search projections never replace the durable supporting records and must obey the same authorization.
On failure: apply the package containment/rollback rule: Keep additive tables and switch consumers back without deleting new captured evidence.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDX-01-B: Create durable session and record storage / rejection and containment

Requirement: SV2-IDX-01.
Responsible implementation: agentihooks.
Fixture inputs: Long transcript exceeding preview limits and a deliberately missing archived object.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-IDX-01 without broadening its grant or replacing the bad input silently.
Then: A missing archive object causes an evidence-integrity error rather than returning a preview labelled complete.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect archive_integrity_failures_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDX-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Search projections never replace the durable supporting records and must obey the same authorization.
On failure: apply the package containment/rollback rule: Keep additive tables and switch consumers back without deleting new captured evidence.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDX-01-C: Create durable session and record storage / recovery and replay

Requirement: SV2-IDX-01.
Responsible implementation: agentihooks.
Fixture inputs: Long transcript exceeding preview limits and a deliberately missing archived object.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Database restart preserves acknowledged records and their exact source ranges.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect archive_integrity_failures_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDX-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Search projections never replace the durable supporting records and must obey the same authorization.
On failure: apply the package containment/rollback rule: Keep additive tables and switch consumers back without deleting new captured evidence.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDX-02-A: Implement stable turn and tool-evidence chunking / successful behavior

Requirement: SV2-IDX-02.
Responsible implementation: agentihooks.
Fixture inputs: Long tool result, multi-tool turn, appended session, and chunker-version transition.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-IDX-02.
When: execute the owned behavior described as: Build search units that preserve supporting context without renumbering the past whenever a session grows.
Then: Appending a new turn does not change IDs or embeddings for unchanged earlier chunks.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Search projections never replace the durable supporting records and must obey the same authorization.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect chunks_rebuilt_without_content_change with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDX-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Search projections never replace the durable supporting records and must obey the same authorization.
On failure: apply the package containment/rollback rule: Restore the prior active chunk generation without changing source record IDs.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDX-02-B: Implement stable turn and tool-evidence chunking / rejection and containment

Requirement: SV2-IDX-02.
Responsible implementation: agentihooks.
Fixture inputs: Long tool result, multi-tool turn, appended session, and chunker-version transition.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-IDX-02 without broadening its grant or replacing the bad input silently.
Then: Oversized tool output is bounded for embedding while remaining retrievable under archive policy.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect chunks_rebuilt_without_content_change with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDX-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Search projections never replace the durable supporting records and must obey the same authorization.
On failure: apply the package containment/rollback rule: Restore the prior active chunk generation without changing source record IDs.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDX-02-C: Implement stable turn and tool-evidence chunking / recovery and replay

Requirement: SV2-IDX-02.
Responsible implementation: agentihooks.
Fixture inputs: Long tool result, multi-tool turn, appended session, and chunker-version transition.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Rechunking with a new version creates a separate generation that can be validated before cutover.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect chunks_rebuilt_without_content_change with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDX-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Search projections never replace the durable supporting records and must obey the same authorization.
On failure: apply the package containment/rollback rule: Restore the prior active chunk generation without changing source record IDs.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDX-03-A: Build a bounded incremental embedding worker / successful behavior

Requirement: SV2-IDX-03.
Responsible implementation: agentihooks.
Fixture inputs: Append-only growth, dimension mismatch, transient rate limit, and failed middle chunk.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-IDX-03.
When: execute the owned behavior described as: Embed only changed content and preserve progress through provider outages.
Then: A newly appended turn generates embeddings only for newly changed chunks.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Search projections never replace the durable supporting records and must obey the same authorization.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect embedding_backlog_age_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDX-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Search projections never replace the durable supporting records and must obey the same authorization.
On failure: apply the package containment/rollback rule: Keep the preceding active index generation and pause the new worker.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDX-03-B: Build a bounded incremental embedding worker / rejection and containment

Requirement: SV2-IDX-03.
Responsible implementation: agentihooks.
Fixture inputs: Append-only growth, dimension mismatch, transient rate limit, and failed middle chunk.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-IDX-03 without broadening its grant or replacing the bad input silently.
Then: Mixed vector dimensions or model families cannot be inserted into one active generation silently.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect embedding_backlog_age_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDX-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Search projections never replace the durable supporting records and must obey the same authorization.
On failure: apply the package containment/rollback rule: Keep the preceding active index generation and pause the new worker.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDX-03-C: Build a bounded incremental embedding worker / recovery and replay

Requirement: SV2-IDX-03.
Responsible implementation: agentihooks.
Fixture inputs: Append-only growth, dimension mismatch, transient rate limit, and failed middle chunk.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: After provider recovery, failed chunks resume from durable work state without re-embedding the whole corpus.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect embedding_backlog_age_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDX-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Search projections never replace the durable supporting records and must obey the same authorization.
On failure: apply the package containment/rollback rule: Keep the preceding active index generation and pause the new worker.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDX-04-A: Expose exact and semantic evidence search / successful behavior

Requirement: SV2-IDX-04.
Responsible implementation: agentihooks.
Fixture inputs: Two projects sharing an error phrase, one exact code symbol, and vector outage.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-IDX-04.
When: execute the owned behavior described as: Support natural-language recall and exact engineering identifiers within strict scope.
Then: A query finds the expected error string and semantically related prior fix while excluding another project’s similar text.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Search projections never replace the durable supporting records and must obey the same authorization.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect session_search_relevance and session_search_scope_rejections with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDX-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Search projections never replace the durable supporting records and must obey the same authorization.
On failure: apply the package containment/rollback rule: Route search to the prior accepted index generation while keeping capture uninterrupted.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDX-04-B: Expose exact and semantic evidence search / rejection and containment

Requirement: SV2-IDX-04.
Responsible implementation: agentihooks.
Fixture inputs: Two projects sharing an error phrase, one exact code symbol, and vector outage.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-IDX-04 without broadening its grant or replacing the bad input silently.
Then: An unauthorized project name supplied by the caller does not reveal even result titles or counts.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect session_search_relevance and session_search_scope_rejections with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDX-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Search projections never replace the durable supporting records and must obey the same authorization.
On failure: apply the package containment/rollback rule: Route search to the prior accepted index generation while keeping capture uninterrupted.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDX-04-C: Expose exact and semantic evidence search / recovery and replay

Requirement: SV2-IDX-04.
Responsible implementation: agentihooks.
Fixture inputs: Two projects sharing an error phrase, one exact code symbol, and vector outage.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Vector service unavailability can produce a labelled lexical-only response rather than a silent empty result.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect session_search_relevance and session_search_scope_rejections with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDX-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Search projections never replace the durable supporting records and must obey the same authorization.
On failure: apply the package containment/rollback rule: Route search to the prior accepted index generation while keeping capture uninterrupted.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDX-05-A: Integrate session tools and citation-ready expansion / successful behavior

Requirement: SV2-IDX-05.
Responsible implementation: agentihooks.
Fixture inputs: Search hit, valid range expansion, expired cursor, and revoked source reference.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-IDX-05.
When: execute the owned behavior described as: Make the memory bank usable by the swarm without a separate legacy service.
Then: A swarm agent retrieves a search hit and then expands the exact supporting record range through the same authorized interface.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Search projections never replace the durable supporting records and must obey the same authorization.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect evidence_reference_resolution_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDX-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Search projections never replace the durable supporting records and must obey the same authorization.
On failure: apply the package containment/rollback rule: Hide new tools and keep the underlying archive and accepted compatibility surface read-only.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDX-05-B: Integrate session tools and citation-ready expansion / rejection and containment

Requirement: SV2-IDX-05.
Responsible implementation: agentihooks.
Fixture inputs: Search hit, valid range expansion, expired cursor, and revoked source reference.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-IDX-05 without broadening its grant or replacing the bad input silently.
Then: A deleted or revoked evidence reference cannot remain readable through an old compatibility alias.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect evidence_reference_resolution_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDX-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Search projections never replace the durable supporting records and must obey the same authorization.
On failure: apply the package containment/rollback rule: Hide new tools and keep the underlying archive and accepted compatibility surface read-only.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-IDX-05-C: Integrate session tools and citation-ready expansion / recovery and replay

Requirement: SV2-IDX-05.
Responsible implementation: agentihooks.
Fixture inputs: Search hit, valid range expansion, expired cursor, and revoked source reference.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Tool-server restart preserves pagination cursors or explicitly expires them without returning a mismatched range.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect evidence_reference_resolution_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-IDX-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Search projections never replace the durable supporting records and must obey the same authorization.
On failure: apply the package containment/rollback rule: Hide new tools and keep the underlying archive and accepted compatibility surface read-only.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group MIG: Extract useful search logic and retire the old transcript service

T-SV2-MIG-01-A: Inventory search consumers and reusable logic / successful behavior

Requirement: SV2-MIG-01.
Responsible implementation: agentihooks.
Fixture inputs: Consumer inventory containing one search caller, one obsolete dispatcher, and one dashboard metric reader.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-MIG-01.
When: execute the owned behavior described as: Identify the small useful search components and all callers that would otherwise break at cutover.
Then: Every known caller has a target agentihooks interface or an explicit removal decision.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Read and migrate historical data; do not recreate the retired service under a new name.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect migration_unmapped_consumers with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MIG-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Read and migrate historical data; do not recreate the retired service under a new name.
On failure: apply the package containment/rollback rule: Keep replacement aliases disabled until their mapping has been validated.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MIG-01-B: Inventory search consumers and reusable logic / rejection and containment

Requirement: SV2-MIG-01.
Responsible implementation: agentihooks.
Fixture inputs: Consumer inventory containing one search caller, one obsolete dispatcher, and one dashboard metric reader.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-MIG-01 without broadening its grant or replacing the bad input silently.
Then: Dispatch, registry, and standalone daemon features are not copied just because they share a source module.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect migration_unmapped_consumers with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MIG-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Read and migrate historical data; do not recreate the retired service under a new name.
On failure: apply the package containment/rollback rule: Keep replacement aliases disabled until their mapping has been validated.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MIG-01-C: Inventory search consumers and reusable logic / recovery and replay

Requirement: SV2-MIG-01.
Responsible implementation: agentihooks.
Fixture inputs: Consumer inventory containing one search caller, one obsolete dispatcher, and one dashboard metric reader.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Discovering a late consumer adds a migration item without restoring the retired architecture.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect migration_unmapped_consumers with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MIG-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Read and migrate historical data; do not recreate the retired service under a new name.
On failure: apply the package containment/rollback rule: Keep replacement aliases disabled until their mapping has been validated.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MIG-02-A: Audit source fidelity before migration / successful behavior

Requirement: SV2-MIG-02.
Responsible implementation: agentihooks.
Fixture inputs: One complete JSONL, one capped Redis preview, one vector-only record, and one missing source.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-MIG-02.
When: execute the owned behavior described as: Establish which historical records are full sources and which are irreversibly truncated projections.
Then: The report identifies full raw history, preview-only history, and missing history separately.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Read and migrate historical data; do not recreate the retired service under a new name.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect source_fidelity_classes with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MIG-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Read and migrate historical data; do not recreate the retired service under a new name.
On failure: apply the package containment/rollback rule: Revert classification projections while retaining original source hashes and audit evidence.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MIG-02-B: Audit source fidelity before migration / rejection and containment

Requirement: SV2-MIG-02.
Responsible implementation: agentihooks.
Fixture inputs: One complete JSONL, one capped Redis preview, one vector-only record, and one missing source.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-MIG-02 without broadening its grant or replacing the bad input silently.
Then: A preview-only session is never labelled a lossless imported transcript.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect source_fidelity_classes with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MIG-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Read and migrate historical data; do not recreate the retired service under a new name.
On failure: apply the package containment/rollback rule: Revert classification projections while retaining original source hashes and audit evidence.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MIG-02-C: Audit source fidelity before migration / recovery and replay

Requirement: SV2-MIG-02.
Responsible implementation: agentihooks.
Fixture inputs: One complete JSONL, one capped Redis preview, one vector-only record, and one missing source.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Re-running the audit after additional raw files appear upgrades only the affected source classifications.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect source_fidelity_classes with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MIG-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Read and migrate historical data; do not recreate the retired service under a new name.
On failure: apply the package containment/rollback rule: Revert classification projections while retaining original source hashes and audit evidence.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MIG-03-A: Run idempotent backfill into the new corpus / successful behavior

Requirement: SV2-MIG-03.
Responsible implementation: agentihooks.
Fixture inputs: Duplicate source directories, mid-batch interruption, and equal native IDs from different machines.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-MIG-03.
When: execute the owned behavior described as: Populate the replacement catalog with stable provenance and replay-safe identities.
Then: A second import pass creates no duplicate events and preserves original timestamps and source references.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Read and migrate historical data; do not recreate the retired service under a new name.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect legacy_import_remaining_records with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MIG-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Read and migrate historical data; do not recreate the retired service under a new name.
On failure: apply the package containment/rollback rule: Keep imported objects tagged by migration run so projections can be deactivated without deleting source backups.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MIG-03-B: Run idempotent backfill into the new corpus / rejection and containment

Requirement: SV2-MIG-03.
Responsible implementation: agentihooks.
Fixture inputs: Duplicate source directories, mid-batch interruption, and equal native IDs from different machines.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-MIG-03 without broadening its grant or replacing the bad input silently.
Then: Conflicting source content under the same source digest or event identity is quarantined.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect legacy_import_remaining_records with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MIG-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Read and migrate historical data; do not recreate the retired service under a new name.
On failure: apply the package containment/rollback rule: Keep imported objects tagged by migration run so projections can be deactivated without deleting source backups.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MIG-03-C: Run idempotent backfill into the new corpus / recovery and replay

Requirement: SV2-MIG-03.
Responsible implementation: agentihooks.
Fixture inputs: Duplicate source directories, mid-batch interruption, and equal native IDs from different machines.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: An interrupted import resumes at its durable batch checkpoint and reports remaining work.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect legacy_import_remaining_records with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MIG-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Read and migrate historical data; do not recreate the retired service under a new name.
On failure: apply the package containment/rollback rule: Keep imported objects tagged by migration run so projections can be deactivated without deleting source backups.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MIG-04-A: Run shadow search and consumer cutover / successful behavior

Requirement: SV2-MIG-04.
Responsible implementation: agentihooks.
Fixture inputs: Historical engineering questions with manually verified expected sessions and source ranges.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-MIG-04.
When: execute the owned behavior described as: Demonstrate useful equivalence before replacing the old search endpoint.
Then: The replacement answers the agreed queries with resolvable evidence and no unauthorized results.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Read and migrate historical data; do not recreate the retired service under a new name.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect shadow_search_source_recall with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MIG-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Read and migrate historical data; do not recreate the retired service under a new name.
On failure: apply the package containment/rollback rule: Restore the last accepted consumer route while repairing the replacement read path.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MIG-04-B: Run shadow search and consumer cutover / rejection and containment

Requirement: SV2-MIG-04.
Responsible implementation: agentihooks.
Fixture inputs: Historical engineering questions with manually verified expected sessions and source ranges.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-MIG-04 without broadening its grant or replacing the bad input silently.
Then: A consumer that can search but cannot expand the cited source range does not pass cutover.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect shadow_search_source_recall with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MIG-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Read and migrate historical data; do not recreate the retired service under a new name.
On failure: apply the package containment/rollback rule: Restore the last accepted consumer route while repairing the replacement read path.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MIG-04-C: Run shadow search and consumer cutover / recovery and replay

Requirement: SV2-MIG-04.
Responsible implementation: agentihooks.
Fixture inputs: Historical engineering questions with manually verified expected sessions and source ranges.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Endpoint rollback keeps new capture running and does not discard evidence collected during shadow mode.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect shadow_search_source_recall with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MIG-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Read and migrate historical data; do not recreate the retired service under a new name.
On failure: apply the package containment/rollback rule: Restore the last accepted consumer route while repairing the replacement read path.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MIG-05-A: Prove retirement completion and archive ownership / successful behavior

Requirement: SV2-MIG-05.
Responsible implementation: agentihooks.
Fixture inputs: Replacement-only deployment with every retired endpoint deliberately unreachable.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-MIG-05.
When: execute the owned behavior described as: End with no deployed dependence on the old transcript service.
Then: Active execution, memory search, and brain extraction run with the retired service unavailable and absent from target manifests.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Read and migrate historical data; do not recreate the retired service under a new name.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect retired_endpoint_requests_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MIG-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Read and migrate historical data; do not recreate the retired service under a new name.
On failure: apply the package containment/rollback rule: Retain historical data and compatibility documentation without reintroducing the old deployed runtime.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MIG-05-B: Prove retirement completion and archive ownership / rejection and containment

Requirement: SV2-MIG-05.
Responsible implementation: agentihooks.
Fixture inputs: Replacement-only deployment with every retired endpoint deliberately unreachable.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-MIG-05 without broadening its grant or replacing the bad input silently.
Then: A hidden fallback to the retired endpoint fails the retirement integration test.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect retired_endpoint_requests_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MIG-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Read and migrate historical data; do not recreate the retired service under a new name.
On failure: apply the package containment/rollback rule: Retain historical data and compatibility documentation without reintroducing the old deployed runtime.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MIG-05-C: Prove retirement completion and archive ownership / recovery and replay

Requirement: SV2-MIG-05.
Responsible implementation: agentihooks.
Fixture inputs: Replacement-only deployment with every retired endpoint deliberately unreachable.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Restoring the replacement system from backup does not require starting the retired service.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect retired_endpoint_requests_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MIG-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Read and migrate historical data; do not recreate the retired service under a new name.
On failure: apply the package containment/rollback rule: Retain historical data and compatibility documentation without reintroducing the old deployed runtime.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group BRP: Kernel project scoping and issue 89 completion

T-SV2-BRP-01-A: Normalize project attribution before arc grouping / successful behavior

Requirement: SV2-BRP-01.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Same-project simultaneous unrelated tasks, linked attempts, and a legacy session with no canonical project.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-BRP-01.
When: execute the owned behavior described as: Replace basename grouping with canonical project and explicit task provenance.
Then: Concurrent agents in the same repository but on unrelated ledger tasks do not collapse into one arc solely because they ran within two hours.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: All knowledge attribution and retrieval must preserve scope from source to final response.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect arc_grouping_ambiguities with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-BRP-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: All knowledge attribution and retrieval must preserve scope from source to final response.
On failure: apply the package containment/rollback rule: Retain original source-to-arc mappings and disable the new grouping generation pending review.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-BRP-01-B: Normalize project attribution before arc grouping / rejection and containment

Requirement: SV2-BRP-01.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Same-project simultaneous unrelated tasks, linked attempts, and a legacy session with no canonical project.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-BRP-01 without broadening its grant or replacing the bad input silently.
Then: Unknown project history remains unattributed rather than being assigned to the current hottest project.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect arc_grouping_ambiguities with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-BRP-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: All knowledge attribution and retrieval must preserve scope from source to final response.
On failure: apply the package containment/rollback rule: Retain original source-to-arc mappings and disable the new grouping generation pending review.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-BRP-01-C: Normalize project attribution before arc grouping / recovery and replay

Requirement: SV2-BRP-01.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Same-project simultaneous unrelated tasks, linked attempts, and a legacy session with no canonical project.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Replaying a source window produces stable arc membership or a versioned superseding grouping decision.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect arc_grouping_ambiguities with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-BRP-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: All knowledge attribution and retrieval must preserve scope from source to final response.
On failure: apply the package containment/rollback rule: Retain original source-to-arc mappings and disable the new grouping generation pending review.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-BRP-02-A: Persist scope on every marker type / successful behavior

Requirement: SV2-BRP-02.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Four marker types delivered directly and via replay with explicit project/worktree attributes.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-BRP-02.
When: execute the owned behavior described as: Keep the project and evidence fields currently supplied by clients instead of dropping them at persistence.
Then: Lesson, decision, milestone, and signal identity survives direct write, buffered replay, storage, and readback.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: All knowledge attribution and retrieval must preserve scope from source to final response.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect marker_provenance_loss_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-BRP-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: All knowledge attribution and retrieval must preserve scope from source to final response.
On failure: apply the package containment/rollback rule: Keep old marker readers supported while retaining new provenance fields in durable metadata.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-BRP-02-B: Persist scope on every marker type / rejection and containment

Requirement: SV2-BRP-02.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Four marker types delivered directly and via replay with explicit project/worktree attributes.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-BRP-02 without broadening its grant or replacing the bad input silently.
Then: A marker claiming another project is rejected by the authenticated scope even when it contains that project’s name.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect marker_provenance_loss_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-BRP-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: All knowledge attribution and retrieval must preserve scope from source to final response.
On failure: apply the package containment/rollback rule: Keep old marker readers supported while retaining new provenance fields in durable metadata.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-BRP-02-C: Persist scope on every marker type / recovery and replay

Requirement: SV2-BRP-02.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Four marker types delivered directly and via replay with explicit project/worktree attributes.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Concurrent duplicate writes produce one canonical marker and a replay acknowledgement.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect marker_provenance_loss_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-BRP-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: All knowledge attribution and retrieval must preserve scope from source to final response.
On failure: apply the package containment/rollback rule: Keep old marker readers supported while retaining new provenance fields in durable metadata.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-BRP-03-A: Index individual scoped lessons and decisions / successful behavior

Requirement: SV2-BRP-03.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Long multi-project daily log, late lesson, superseded decision, and an unattributed historical entry.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-BRP-03.
When: execute the owned behavior described as: Make every relevant knowledge item searchable without daily-log truncation or metadata loss.
Then: A lesson near the end of a long daily log is retrievable under its correct project with its own source reference.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: All knowledge attribution and retrieval must preserve scope from source to final response.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect knowledge_items_unindexed with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-BRP-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: All knowledge attribution and retrieval must preserve scope from source to final response.
On failure: apply the package containment/rollback rule: Keep the last accepted index active and preserve all original vault entries.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-BRP-03-B: Index individual scoped lessons and decisions / rejection and containment

Requirement: SV2-BRP-03.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Long multi-project daily log, late lesson, superseded decision, and an unattributed historical entry.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-BRP-03 without broadening its grant or replacing the bad input silently.
Then: A substring match for another repository cannot pass the exact project filter.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect knowledge_items_unindexed with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-BRP-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: All knowledge attribution and retrieval must preserve scope from source to final response.
On failure: apply the package containment/rollback rule: Keep the last accepted index active and preserve all original vault entries.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-BRP-03-C: Index individual scoped lessons and decisions / recovery and replay

Requirement: SV2-BRP-03.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Long multi-project daily log, late lesson, superseded decision, and an unattributed historical entry.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Reindexing resumes after failure without dropping the previously active index generation.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect knowledge_items_unindexed with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-BRP-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: All knowledge attribution and retrieval must preserve scope from source to final response.
On failure: apply the package containment/rollback rule: Keep the last accepted index active and preserve all original vault entries.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-BRP-04-A: Serve per-project feeds and intent / successful behavior

Requirement: SV2-BRP-04.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Dominant project with many hot arcs and a quieter project with one cold but active task.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-BRP-04.
When: execute the owned behavior described as: Complete the server-side feed contract instead of filtering a global hot set after selection.
Then: Opening two repositories returns different relevant feeds even when one repository has no arc in the fleet-wide top ten.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: All knowledge attribution and retrieval must preserve scope from source to final response.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect project_feed_cross_scope_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-BRP-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: All knowledge attribution and retrieval must preserve scope from source to final response.
On failure: apply the package containment/rollback rule: Keep the unscoped legacy feed for authorized legacy clients and disable new scoped consumers selectively.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-BRP-04-B: Serve per-project feeds and intent / rejection and containment

Requirement: SV2-BRP-04.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Dominant project with many hot arcs and a quieter project with one cold but active task.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-BRP-04 without broadening its grant or replacing the bad input silently.
Then: Missing project data returns a scoped empty result rather than unrelated global memory.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect project_feed_cross_scope_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-BRP-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: All knowledge attribution and retrieval must preserve scope from source to final response.
On failure: apply the package containment/rollback rule: Keep the unscoped legacy feed for authorized legacy clients and disable new scoped consumers selectively.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-BRP-04-C: Serve per-project feeds and intent / recovery and replay

Requirement: SV2-BRP-04.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Dominant project with many hot arcs and a quieter project with one cold but active task.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A failed project-intent inference preserves the last labelled stale intent without fabricating a fresh one.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect project_feed_cross_scope_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-BRP-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: All knowledge attribution and retrieval must preserve scope from source to final response.
On failure: apply the package containment/rollback rule: Keep the unscoped legacy feed for authorized legacy clients and disable new scoped consumers selectively.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-BRP-05-A: Close issue 89 through cross-repository acceptance / successful behavior

Requirement: SV2-BRP-05.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Two repositories, one linked worktree each, Claude and Codex sessions, and shared fleet warnings.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-BRP-05.
When: execute the owned behavior described as: Prove the full source-to-delivery path including both required harnesses.
Then: The issue acceptance suite demonstrates scoped feeds, intent, markers, search, and Codex extraction with no unrelated memory leakage.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: All knowledge attribution and retrieval must preserve scope from source to final response.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect issue89_acceptance_cases_passed with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-BRP-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: All knowledge attribution and retrieval must preserve scope from source to final response.
On failure: apply the package containment/rollback rule: Reopen the integration gate while keeping additive kernel metadata and source evidence intact.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-BRP-05-B: Close issue 89 through cross-repository acceptance / rejection and containment

Requirement: SV2-BRP-05.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Two repositories, one linked worktree each, Claude and Codex sessions, and shared fleet warnings.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-BRP-05 without broadening its grant or replacing the bad input silently.
Then: Passing only client-side filtering tests cannot close the kernel issue.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect issue89_acceptance_cases_passed with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-BRP-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: All knowledge attribution and retrieval must preserve scope from source to final response.
On failure: apply the package containment/rollback rule: Reopen the integration gate while keeping additive kernel metadata and source evidence intact.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-BRP-05-C: Close issue 89 through cross-repository acceptance / recovery and replay

Requirement: SV2-BRP-05.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Two repositories, one linked worktree each, Claude and Codex sessions, and shared fleet warnings.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Rollback to a compatible client preserves newly stored kernel provenance and can reactivate the scoped source later.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect issue89_acceptance_cases_passed with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-BRP-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: All knowledge attribution and retrieval must preserve scope from source to final response.
On failure: apply the package containment/rollback rule: Reopen the integration gate while keeping additive kernel metadata and source evidence intact.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group GRF: Typed knowledge graph and bounded associative retrieval

T-SV2-GRF-01-A: Create canonical graph entities and relation schema / successful behavior

Requirement: SV2-GRF-01.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Valid arc-lesson link, missing target, inverse pair, and incompatible relation type.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-GRF-01.
When: execute the owned behavior described as: Make arcs, lessons, decisions, and evidence addressable without relying on truncated prose.
Then: An arc can link to its source sessions, attached lessons, and applicable decisions through typed inspectable relations.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Graph expansion may widen relevance only inside the authorized scope of the caller.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect graph_invalid_relations_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GRF-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Graph expansion may widen relevance only inside the authorized scope of the caller.
On failure: apply the package containment/rollback rule: Retain the old read path while keeping new graph tables inactive and source metadata untouched.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GRF-01-B: Create canonical graph entities and relation schema / rejection and containment

Requirement: SV2-GRF-01.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Valid arc-lesson link, missing target, inverse pair, and incompatible relation type.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-GRF-01 without broadening its grant or replacing the bad input silently.
Then: A relation with an unknown endpoint or incompatible entity type is rejected or quarantined.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect graph_invalid_relations_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GRF-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Graph expansion may widen relevance only inside the authorized scope of the caller.
On failure: apply the package containment/rollback rule: Retain the old read path while keeping new graph tables inactive and source metadata untouched.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GRF-01-C: Create canonical graph entities and relation schema / recovery and replay

Requirement: SV2-GRF-01.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Valid arc-lesson link, missing target, inverse pair, and incompatible relation type.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Rebuilding graph projections from canonical metadata yields the same valid entity and edge set.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect graph_invalid_relations_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GRF-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Graph expansion may widen relevance only inside the authorized scope of the caller.
On failure: apply the package containment/rollback rule: Retain the old read path while keeping new graph tables inactive and source metadata untouched.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GRF-02-A: Normalize and migrate existing edge markers / successful behavior

Requirement: SV2-GRF-02.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Duplicate markers, contradictory directions, valid multirelation pair, and self-loop.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-GRF-02.
When: execute the owned behavior described as: Replace arbitrary pairwise type collapse with evidence-aware relation normalization.
Then: Existing valid parent/child and related links survive migration without losing their meaning or evidence.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Graph expansion may widen relevance only inside the authorized scope of the caller.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect graph_migration_quarantined_edges with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GRF-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Graph expansion may widen relevance only inside the authorized scope of the caller.
On failure: apply the package containment/rollback rule: Restore the pre-migration graph projection from its manifest without deleting original vault markers.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GRF-02-B: Normalize and migrate existing edge markers / rejection and containment

Requirement: SV2-GRF-02.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Duplicate markers, contradictory directions, valid multirelation pair, and self-loop.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-GRF-02 without broadening its grant or replacing the bad input silently.
Then: A pair with conflicting causal assertions is not silently resolved by selecting whichever type ranks first.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect graph_migration_quarantined_edges with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GRF-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Graph expansion may widen relevance only inside the authorized scope of the caller.
On failure: apply the package containment/rollback rule: Restore the pre-migration graph projection from its manifest without deleting original vault markers.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GRF-02-C: Normalize and migrate existing edge markers / recovery and replay

Requirement: SV2-GRF-02.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Duplicate markers, contradictory directions, valid multirelation pair, and self-loop.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Re-running the migrator is idempotent and leaves previously reviewed quarantine decisions intact.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect graph_migration_quarantined_edges with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GRF-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Graph expansion may widen relevance only inside the authorized scope of the caller.
On failure: apply the package containment/rollback rule: Restore the pre-migration graph projection from its manifest without deleting original vault markers.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GRF-03-A: Implement bounded authorized graph expansion / successful behavior

Requirement: SV2-GRF-03.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Cycle, high-degree hub, authorized two-hop lesson, and cross-project forbidden neighbor.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-GRF-03.
When: execute the owned behavior described as: Retrieve useful connected history beyond individually ranked vector seeds.
Then: A relevant lesson two permitted edges from a seed is found within the configured budget and its path is shown.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Graph expansion may widen relevance only inside the authorized scope of the caller.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect graph_nodes_expanded_per_request with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GRF-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Graph expansion may widen relevance only inside the authorized scope of the caller.
On failure: apply the package containment/rollback rule: Disable expansion and retain scoped seed retrieval while graph defects are repaired.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GRF-03-B: Implement bounded authorized graph expansion / rejection and containment

Requirement: SV2-GRF-03.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Cycle, high-degree hub, authorized two-hop lesson, and cross-project forbidden neighbor.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-GRF-03 without broadening its grant or replacing the bad input silently.
Then: A high-degree node cannot expose unauthorized neighbor titles or exhaust the entire request budget unchecked.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect graph_nodes_expanded_per_request with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GRF-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Graph expansion may widen relevance only inside the authorized scope of the caller.
On failure: apply the package containment/rollback rule: Disable expansion and retain scoped seed retrieval while graph defects are repaired.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GRF-03-C: Implement bounded authorized graph expansion / recovery and replay

Requirement: SV2-GRF-03.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Cycle, high-degree hub, authorized two-hop lesson, and cross-project forbidden neighbor.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A timeout returns a labelled partial result with valid collected evidence and a bounded continuation option.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect graph_nodes_expanded_per_request with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GRF-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Graph expansion may widen relevance only inside the authorized scope of the caller.
On failure: apply the package containment/rollback rule: Disable expansion and retain scoped seed retrieval while graph defects are repaired.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GRF-04-A: Apply supersession and conflict semantics / successful behavior

Requirement: SV2-GRF-04.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Two conflicting lessons, one approved replacement decision, and a cyclic supersession fixture.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-GRF-04.
When: execute the owned behavior described as: Prevent old decisions and contradicted lessons from being injected as current rules.
Then: A current decision is selected for guidance while the superseded one remains available as cited history.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Graph expansion may widen relevance only inside the authorized scope of the caller.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect unresolved_knowledge_conflicts with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GRF-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Graph expansion may widen relevance only inside the authorized scope of the caller.
On failure: apply the package containment/rollback rule: Return to explicit conflict display and disable automatic current-version selection.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GRF-04-B: Apply supersession and conflict semantics / rejection and containment

Requirement: SV2-GRF-04.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Two conflicting lessons, one approved replacement decision, and a cyclic supersession fixture.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-GRF-04 without broadening its grant or replacing the bad input silently.
Then: A supersession cycle does not produce arbitrary current knowledge.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect unresolved_knowledge_conflicts with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GRF-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Graph expansion may widen relevance only inside the authorized scope of the caller.
On failure: apply the package containment/rollback rule: Return to explicit conflict display and disable automatic current-version selection.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GRF-04-C: Apply supersession and conflict semantics / recovery and replay

Requirement: SV2-GRF-04.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Two conflicting lessons, one approved replacement decision, and a cyclic supersession fixture.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Removing an invalid supersession assertion restores prior visibility through a new reviewed revision.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect unresolved_knowledge_conflicts with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GRF-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Graph expansion may widen relevance only inside the authorized scope of the caller.
On failure: apply the package containment/rollback rule: Return to explicit conflict display and disable automatic current-version selection.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GRF-05-A: Expose full detail and provenance retrieval / successful behavior

Requirement: SV2-GRF-05.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Long arc, later revision, missing source range, and section pagination boundary.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-GRF-05.
When: execute the owned behavior described as: Replace preview-as-detail behavior with a verifiable full or section-based read contract.
Then: A caller can expand a context-pack reference to the exact full lesson or arc section that supported it.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Graph expansion may widen relevance only inside the authorized scope of the caller.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect knowledge_reference_resolution_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GRF-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Graph expansion may widen relevance only inside the authorized scope of the caller.
On failure: apply the package containment/rollback rule: Keep the prior preview tool available under its truthful description while full-detail rollout is paused.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GRF-05-B: Expose full detail and provenance retrieval / rejection and containment

Requirement: SV2-GRF-05.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Long arc, later revision, missing source range, and section pagination boundary.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-GRF-05 without broadening its grant or replacing the bad input silently.
Then: A truncated indexed preview cannot be reported as the full source document.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect knowledge_reference_resolution_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GRF-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Graph expansion may widen relevance only inside the authorized scope of the caller.
On failure: apply the package containment/rollback rule: Keep the prior preview tool available under its truthful description while full-detail rollout is paused.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GRF-05-C: Expose full detail and provenance retrieval / recovery and replay

Requirement: SV2-GRF-05.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Long arc, later revision, missing source range, and section pagination boundary.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Reading a historical revision remains stable while a newer arc revision is written.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect knowledge_reference_resolution_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GRF-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Graph expansion may widen relevance only inside the authorized scope of the caller.
On failure: apply the package containment/rollback rule: Keep the prior preview tool available under its truthful description while full-detail rollout is paused.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group CTX: Task-specific brain context selection and cache correctness

T-SV2-CTX-01-A: Implement authenticated task-context requests / successful behavior

Requirement: SV2-CTX-01.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Authorized engineer request, CI request, wrong brain audience, and oversized prompt.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CTX-01.
When: execute the owned behavior described as: Let the brain answer what this authorized agent needs for its current task.
Then: An engineer and a CI agent on the same project receive task-relevant requests with their distinct purposes preserved.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect context_request_validation_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTX-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
On failure: apply the package containment/rollback rule: Keep the existing scoped feed usable while disabling new targeted-context requests.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTX-01-B: Implement authenticated task-context requests / rejection and containment

Requirement: SV2-CTX-01.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Authorized engineer request, CI request, wrong brain audience, and oversized prompt.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CTX-01 without broadening its grant or replacing the bad input silently.
Then: A user-controlled query cannot redirect the request to a different brain or broaden the allowed project set.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect context_request_validation_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTX-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
On failure: apply the package containment/rollback rule: Keep the existing scoped feed usable while disabling new targeted-context requests.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTX-01-C: Implement authenticated task-context requests / recovery and replay

Requirement: SV2-CTX-01.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Authorized engineer request, CI request, wrong brain audience, and oversized prompt.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Retrying an identical task-context request reuses its idempotent operation identity.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect context_request_validation_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTX-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
On failure: apply the package containment/rollback rule: Keep the existing scoped feed usable while disabling new targeted-context requests.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTX-02-A: Build explainable retrieval and ranking / successful behavior

Requirement: SV2-CTX-02.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Cold relevant incident, hot unrelated arc, current decision, and uncertain inferred edge.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CTX-02.
When: execute the owned behavior described as: Combine task relevance, current decisions, lessons, arcs, and graph neighbors without relying on heat alone.
Then: A cold historical incident lesson outranks an unrelated hot arc for a matching task.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect context_relevance_at_k with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTX-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
On failure: apply the package containment/rollback rule: Restore the previous ranking policy revision without rebuilding immutable source archives.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTX-02-B: Build explainable retrieval and ranking / rejection and containment

Requirement: SV2-CTX-02.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Cold relevant incident, hot unrelated arc, current decision, and uncertain inferred edge.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CTX-02 without broadening its grant or replacing the bad input silently.
Then: A heat score alone cannot justify injecting unrelated project memory.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect context_relevance_at_k with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTX-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
On failure: apply the package containment/rollback rule: Restore the previous ranking policy revision without rebuilding immutable source archives.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTX-02-C: Build explainable retrieval and ranking / recovery and replay

Requirement: SV2-CTX-02.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Cold relevant incident, hot unrelated arc, current decision, and uncertain inferred edge.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A failed optional candidate source produces a labelled reduced result instead of an invented composite score.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect context_relevance_at_k with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTX-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
On failure: apply the package containment/rollback rule: Restore the previous ranking policy revision without rebuilding immutable source archives.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTX-03-A: Pack context within explicit budgets / successful behavior

Requirement: SV2-CTX-03.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Oversized arc, duplicate lesson texts, conflicting decisions, and a very small token budget.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CTX-03.
When: execute the owned behavior described as: Deliver enough useful evidence without overwhelming every agent’s context window.
Then: The output fits its budget and contains complete actionable items with expandable references.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect context_pack_tokens and omitted_items with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTX-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
On failure: apply the package containment/rollback rule: Fall back to a conservative scoped feed pack with explicit degraded metadata.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTX-03-B: Pack context within explicit budgets / rejection and containment

Requirement: SV2-CTX-03.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Oversized arc, duplicate lesson texts, conflicting decisions, and a very small token budget.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CTX-03 without broadening its grant or replacing the bad input silently.
Then: A long item cannot be silently cut mid-meaning and presented as a complete instruction.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect context_pack_tokens and omitted_items with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTX-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
On failure: apply the package containment/rollback rule: Fall back to a conservative scoped feed pack with explicit degraded metadata.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTX-03-C: Pack context within explicit budgets / recovery and replay

Requirement: SV2-CTX-03.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Oversized arc, duplicate lesson texts, conflicting decisions, and a very small token budget.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A smaller retry budget produces a deterministic reduced pack tied to the same knowledge revision.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect context_pack_tokens and omitted_items with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTX-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
On failure: apply the package containment/rollback rule: Fall back to a conservative scoped feed pack with explicit degraded metadata.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTX-04-A: Coalesce requests and invalidate scoped caches / successful behavior

Requirement: SV2-CTX-04.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Launch burst, equal query across two brains, revoked grant, and updated decision revision.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CTX-04.
When: execute the owned behavior described as: Keep swarm bursts efficient without returning another brain’s context or stale decisions.
Then: Fifty equivalent authorized requests share bounded retrieval work while another project’s query remains independent.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect context_cache_hit_ratio and context_coalesced_requests with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTX-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
On failure: apply the package containment/rollback rule: Disable shared context caching and retain bounded per-request retrieval.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTX-04-B: Coalesce requests and invalidate scoped caches / rejection and containment

Requirement: SV2-CTX-04.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Launch burst, equal query across two brains, revoked grant, and updated decision revision.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CTX-04 without broadening its grant or replacing the bad input silently.
Then: A cache keyed only by query text or repository basename fails the isolation tests.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect context_cache_hit_ratio and context_coalesced_requests with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTX-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
On failure: apply the package containment/rollback rule: Disable shared context caching and retain bounded per-request retrieval.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTX-04-C: Coalesce requests and invalidate scoped caches / recovery and replay

Requirement: SV2-CTX-04.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Launch burst, equal query across two brains, revoked grant, and updated decision revision.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A revoked project grant invalidates cached reads before another response is served.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect context_cache_hit_ratio and context_coalesced_requests with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTX-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
On failure: apply the package containment/rollback rule: Disable shared context caching and retain bounded per-request retrieval.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTX-05-A: Issue verifiable context receipts and diagnostics / successful behavior

Requirement: SV2-CTX-05.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Valid receipt, altered payload, expired receipt, lost signing key version, and wrong task revision.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-CTX-05.
When: execute the owned behavior described as: Give agentihooks an auditable proof of scoped retrieval without claiming model comprehension.
Then: A receipt can be verified for the current task and resolves every supporting item visible to the authorized caller.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect context_receipt_validation_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTX-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
On failure: apply the package containment/rollback rule: Disable receipt-required gates before changing signing or storage protocol incompatibly.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTX-05-B: Issue verifiable context receipts and diagnostics / rejection and containment

Requirement: SV2-CTX-05.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Valid receipt, altered payload, expired receipt, lost signing key version, and wrong task revision.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-CTX-05 without broadening its grant or replacing the bad input silently.
Then: A modified receipt, wrong generation, or cross-brain replay cannot satisfy verification.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect context_receipt_validation_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTX-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
On failure: apply the package containment/rollback rule: Disable receipt-required gates before changing signing or storage protocol incompatibly.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-CTX-05-C: Issue verifiable context receipts and diagnostics / recovery and replay

Requirement: SV2-CTX-05.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Valid receipt, altered payload, expired receipt, lost signing key version, and wrong task revision.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Receipt lookup after service restart remains valid until expiry when its issuing state is durable.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect context_receipt_validation_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-CTX-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Context is recalled evidence with bounded authority, not an instruction source that overrides the current task.
On failure: apply the package containment/rollback rule: Disable receipt-required gates before changing signing or storage protocol incompatibly.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group GAT: Brain routing, delivery, and consultation gates

T-SV2-GAT-01-A: Add deterministic per-session brain routing / successful behavior

Requirement: SV2-GAT-01.
Responsible implementation: agentihooks.
Fixture inputs: Explicit route, swarm route, personal default, and malicious repository endpoint override.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-GAT-01.
When: execute the owned behavior described as: Select personal or swarm brain from explicit authorized configuration rather than global accidental state.
Then: A swarm session always uses its authorized swarm brain while an unrelated local session uses its personal default.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Hooks guide agent behavior; server-side authority still protects shared mutations.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect brain_route_resolution_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GAT-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Hooks guide agent behavior; server-side authority still protects shared mutations.
On failure: apply the package containment/rollback rule: Restore the previous route revision and keep both corpora isolated.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GAT-01-B: Add deterministic per-session brain routing / rejection and containment

Requirement: SV2-GAT-01.
Responsible implementation: agentihooks.
Fixture inputs: Explicit route, swarm route, personal default, and malicious repository endpoint override.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-GAT-01 without broadening its grant or replacing the bad input silently.
Then: A repository file cannot redirect a bearer credential to an arbitrary HTTP endpoint.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect brain_route_resolution_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GAT-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Hooks guide agent behavior; server-side authority still protects shared mutations.
On failure: apply the package containment/rollback rule: Restore the previous route revision and keep both corpora isolated.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GAT-01-C: Add deterministic per-session brain routing / recovery and replay

Requirement: SV2-GAT-01.
Responsible implementation: agentihooks.
Fixture inputs: Explicit route, swarm route, personal default, and malicious repository endpoint override.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Changing an authorized route invalidates caches and requires a fresh receipt without replaying old context.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect brain_route_resolution_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GAT-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Hooks guide agent behavior; server-side authority still protects shared mutations.
On failure: apply the package containment/rollback rule: Restore the previous route revision and keep both corpora isolated.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GAT-02-A: Integrate kernel-backed scoped feeds / successful behavior

Requirement: SV2-GAT-02.
Responsible implementation: agentihooks.
Fixture inputs: New scoped endpoint, legacy endpoint, empty project feed, and network outage.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-GAT-02.
When: execute the owned behavior described as: Replace reconstruction from the fleet feed with the kernel’s completed project-scoping interface.
Then: A quiet repository receives its own kernel-selected arcs even when absent from the global top set.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Hooks guide agent behavior; server-side authority still protects shared mutations.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect scoped_feed_fallback_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GAT-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Hooks guide agent behavior; server-side authority still protects shared mutations.
On failure: apply the package containment/rollback rule: Switch the source adapter back while retaining new marker provenance and strict client filtering.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GAT-02-B: Integrate kernel-backed scoped feeds / rejection and containment

Requirement: SV2-GAT-02.
Responsible implementation: agentihooks.
Fixture inputs: New scoped endpoint, legacy endpoint, empty project feed, and network outage.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-GAT-02 without broadening its grant or replacing the bad input silently.
Then: A scoped empty result does not trigger unrelated fleet memory fallback.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect scoped_feed_fallback_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GAT-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Hooks guide agent behavior; server-side authority still protects shared mutations.
On failure: apply the package containment/rollback rule: Switch the source adapter back while retaining new marker provenance and strict client filtering.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GAT-02-C: Integrate kernel-backed scoped feeds / recovery and replay

Requirement: SV2-GAT-02.
Responsible implementation: agentihooks.
Fixture inputs: New scoped endpoint, legacy endpoint, empty project feed, and network outage.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Kernel outage serves an explicitly stale allowed cache within policy rather than changing brain scope.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect scoped_feed_fallback_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GAT-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Hooks guide agent behavior; server-side authority still protects shared mutations.
On failure: apply the package containment/rollback rule: Switch the source adapter back while retaining new marker provenance and strict client filtering.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GAT-03-A: Deliver task context through target capabilities / successful behavior

Requirement: SV2-GAT-03.
Responsible implementation: agentihooks.
Fixture inputs: Claude and Codex hook fixtures plus a live smoke session for each pinned target.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-GAT-03.
When: execute the owned behavior described as: Confirm context reaches both target CLIs through their actual supported hook envelopes.
Then: Claude and Codex each receive the expected scoped context with a recorded delivery receipt in live target smoke tests.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Hooks guide agent behavior; server-side authority still protects shared mutations.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect context_delivery_outcomes_by_target with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GAT-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Hooks guide agent behavior; server-side authority still protects shared mutations.
On failure: apply the package containment/rollback rule: Disable task-context delivery for the affected target while preserving existing compatible brain feed behavior.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GAT-03-B: Deliver task context through target capabilities / rejection and containment

Requirement: SV2-GAT-03.
Responsible implementation: agentihooks.
Fixture inputs: Claude and Codex hook fixtures plus a live smoke session for each pinned target.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-GAT-03 without broadening its grant or replacing the bad input silently.
Then: An unsupported pre-tool injection path cannot be counted as successful delivery merely because retrieval succeeded.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect context_delivery_outcomes_by_target with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GAT-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Hooks guide agent behavior; server-side authority still protects shared mutations.
On failure: apply the package containment/rollback rule: Disable task-context delivery for the affected target while preserving existing compatible brain feed behavior.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GAT-03-C: Deliver task context through target capabilities / recovery and replay

Requirement: SV2-GAT-03.
Responsible implementation: agentihooks.
Fixture inputs: Claude and Codex hook fixtures plus a live smoke session for each pinned target.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A compacted or restarted target receives the current pack without duplicate stale instructions.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect context_delivery_outcomes_by_target with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GAT-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Hooks guide agent behavior; server-side authority still protects shared mutations.
On failure: apply the package containment/rollback rule: Disable task-context delivery for the affected target while preserving existing compatible brain feed behavior.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GAT-04-A: Implement revision-bound consultation gates / successful behavior

Requirement: SV2-GAT-04.
Responsible implementation: agentihooks.
Fixture inputs: First write, unchanged repeated tool calls, changed task spec, unrelated receipt, and valid empty result.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-GAT-04.
When: execute the owned behavior described as: Require relevant consultation at task transitions without querying on every tool action.
Then: A first covered write requires a current task receipt, but repeated ordinary reads and writes do not force redundant searches.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Hooks guide agent behavior; server-side authority still protects shared mutations.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect brain_gate_false_block_rate with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GAT-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Hooks guide agent behavior; server-side authority still protects shared mutations.
On failure: apply the package containment/rollback rule: Return the gate to observe mode without deleting receipt or violation history.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GAT-04-B: Implement revision-bound consultation gates / rejection and containment

Requirement: SV2-GAT-04.
Responsible implementation: agentihooks.
Fixture inputs: First write, unchanged repeated tool calls, changed task spec, unrelated receipt, and valid empty result.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-GAT-04 without broadening its grant or replacing the bad input silently.
Then: An unrelated query or another task’s receipt cannot satisfy the gate.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect brain_gate_false_block_rate with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GAT-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Hooks guide agent behavior; server-side authority still protects shared mutations.
On failure: apply the package containment/rollback rule: Return the gate to observe mode without deleting receipt or violation history.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GAT-04-C: Implement revision-bound consultation gates / recovery and replay

Requirement: SV2-GAT-04.
Responsible implementation: agentihooks.
Fixture inputs: First write, unchanged repeated tool calls, changed task spec, unrelated receipt, and valid empty result.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A task revision change invalidates the prior receipt and resumes after a new valid pack is delivered.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect brain_gate_false_block_rate with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GAT-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Hooks guide agent behavior; server-side authority still protects shared mutations.
On failure: apply the package containment/rollback rule: Return the gate to observe mode without deleting receipt or violation history.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GAT-05-A: Record outcomes and controlled emergency bypass / successful behavior

Requirement: SV2-GAT-05.
Responsible implementation: agentihooks.
Fixture inputs: Valid lesson, no-new-learning outcome, forged approval text, and scoped emergency operator action.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-GAT-05.
When: execute the owned behavior described as: Close the learning loop without manufacturing knowledge or letting models grant themselves exceptions.
Then: A task with no novel lesson can finish with an explicit no-new-learning result and verified implementation proof.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Hooks guide agent behavior; server-side authority still protects shared mutations.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect learning_outcomes_by_kind and brain_bypass_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GAT-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Hooks guide agent behavior; server-side authority still protects shared mutations.
On failure: apply the package containment/rollback rule: Revert required mode and preserve all genuine outcome evidence and bypass audit records.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GAT-05-B: Record outcomes and controlled emergency bypass / rejection and containment

Requirement: SV2-GAT-05.
Responsible implementation: agentihooks.
Fixture inputs: Valid lesson, no-new-learning outcome, forged approval text, and scoped emergency operator action.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-GAT-05 without broadening its grant or replacing the bad input silently.
Then: An agent-authored note saying the operator approved bypass does not grant bypass authority.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect learning_outcomes_by_kind and brain_bypass_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GAT-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Hooks guide agent behavior; server-side authority still protects shared mutations.
On failure: apply the package containment/rollback rule: Revert required mode and preserve all genuine outcome evidence and bypass audit records.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GAT-05-C: Record outcomes and controlled emergency bypass / recovery and replay

Requirement: SV2-GAT-05.
Responsible implementation: agentihooks.
Fixture inputs: Valid lesson, no-new-learning outcome, forged approval text, and scoped emergency operator action.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: During brain outage, the configured harmless-read policy and operator emergency path work without turning every gate off.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect learning_outcomes_by_kind and brain_bypass_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GAT-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Hooks guide agent behavior; server-side authority still protects shared mutations.
On failure: apply the package containment/rollback rule: Revert required mode and preserve all genuine outcome evidence and bypass audit records.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group MUL: Independent personal and swarm brain instances

T-SV2-MUL-01-A: Add first-class brain instance identity / successful behavior

Requirement: SV2-MUL-01.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Existing default installation plus proposed personal and swarm instance configurations.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-MUL-01.
When: execute the owned behavior described as: Make installation identity explicit without confusing a project scope with a complete brain deployment.
Then: A client can verify which named brain it reached before sending project context or credentials.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: An instance command may affect only the explicitly selected brain and its owned resources.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect brain_instance_binding_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MUL-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: An instance command may affect only the explicitly selected brain and its owned resources.
On failure: apply the package containment/rollback rule: Read the legacy default configuration through a compatibility mapper while new instances remain disabled.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MUL-01-B: Add first-class brain instance identity / rejection and containment

Requirement: SV2-MUL-01.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Existing default installation plus proposed personal and swarm instance configurations.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-MUL-01 without broadening its grant or replacing the bad input silently.
Then: An endpoint responding with a different brain ID fails binding validation.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect brain_instance_binding_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MUL-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: An instance command may affect only the explicitly selected brain and its owned resources.
On failure: apply the package containment/rollback rule: Read the legacy default configuration through a compatibility mapper while new instances remain disabled.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MUL-01-C: Add first-class brain instance identity / recovery and replay

Requirement: SV2-MUL-01.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Existing default installation plus proposed personal and swarm instance configurations.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: An existing unnamed installation migrates to default without losing its vault or credentials.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect brain_instance_binding_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MUL-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: An instance command may affect only the explicitly selected brain and its owned resources.
On failure: apply the package containment/rollback rule: Read the legacy default configuration through a compatibility mapper while new instances remain disabled.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MUL-02-A: Remove global compose-name collisions / successful behavior

Requirement: SV2-MUL-02.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Two generated compose projects with intentionally conflicting and then distinct ports.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-MUL-02.
When: execute the owned behavior described as: Allow two local stacks without container-name collision or global stop behavior.
Then: Starting personal and swarm on the same host creates independent running stacks and storage.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: An instance command may affect only the explicitly selected brain and its owned resources.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect brain_instance_resource_conflicts with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MUL-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: An instance command may affect only the explicitly selected brain and its owned resources.
On failure: apply the package containment/rollback rule: Restore the single-default compose path only after explicitly selecting it and preserving other-instance data.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MUL-02-B: Remove global compose-name collisions / rejection and containment

Requirement: SV2-MUL-02.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Two generated compose projects with intentionally conflicting and then distinct ports.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-MUL-02 without broadening its grant or replacing the bad input silently.
Then: Port or volume conflicts fail clearly rather than stopping another stack to make room.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect brain_instance_resource_conflicts with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MUL-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: An instance command may affect only the explicitly selected brain and its owned resources.
On failure: apply the package containment/rollback rule: Restore the single-default compose path only after explicitly selecting it and preserving other-instance data.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MUL-02-C: Remove global compose-name collisions / recovery and replay

Requirement: SV2-MUL-02.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Two generated compose projects with intentionally conflicting and then distinct ports.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Restarting one instance leaves the other instance serving requests throughout.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect brain_instance_resource_conflicts with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MUL-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: An instance command may affect only the explicitly selected brain and its owned resources.
On failure: apply the package containment/rollback rule: Restore the single-default compose path only after explicitly selecting it and preserving other-instance data.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MUL-03-A: Scope CLI lifecycle operations / successful behavior

Requirement: SV2-MUL-03.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Two instances, one unowned lookalike container, and an interrupted installation.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-MUL-03.
When: execute the owned behavior described as: Replace whole-machine discovery with safe explicit instance ownership.
Then: Running down for personal leaves swarm containers, volumes, credentials, and client bindings untouched.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: An instance command may affect only the explicitly selected brain and its owned resources.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect brain_cross_instance_mutation_rejections with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MUL-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: An instance command may affect only the explicitly selected brain and its owned resources.
On failure: apply the package containment/rollback rule: Use dry-run and explicit default selection while the new lifecycle implementation is disabled.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MUL-03-B: Scope CLI lifecycle operations / rejection and containment

Requirement: SV2-MUL-03.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Two instances, one unowned lookalike container, and an interrupted installation.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-MUL-03 without broadening its grant or replacing the bad input silently.
Then: An ambiguous legacy stack selection refuses instead of stopping every detected brain project.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect brain_cross_instance_mutation_rejections with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MUL-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: An instance command may affect only the explicitly selected brain and its owned resources.
On failure: apply the package containment/rollback rule: Use dry-run and explicit default selection while the new lifecycle implementation is disabled.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MUL-03-C: Scope CLI lifecycle operations / recovery and replay

Requirement: SV2-MUL-03.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Two instances, one unowned lookalike container, and an interrupted installation.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A partially completed install can be resumed idempotently for that instance only.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect brain_cross_instance_mutation_rejections with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MUL-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: An instance command may affect only the explicitly selected brain and its owned resources.
On failure: apply the package containment/rollback rule: Use dry-run and explicit default selection while the new lifecycle implementation is disabled.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MUL-04-A: Isolate database, Redis, vault, and event state / successful behavior

Requirement: SV2-MUL-04.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Shared database server with distinct principals, distinct vaults, and deliberate misbinding fixtures.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-MUL-04.
When: execute the owned behavior described as: Prevent apparently separate deployments from sharing hidden external state.
Then: Two brains with overlapping arc IDs and identical project names cannot read or modify each other’s knowledge.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: An instance command may affect only the explicitly selected brain and its owned resources.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect brain_backend_scope_conflicts with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MUL-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: An instance command may affect only the explicitly selected brain and its owned resources.
On failure: apply the package containment/rollback rule: Stop only the misconfigured instance and restore its prior backend bindings.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MUL-04-B: Isolate database, Redis, vault, and event state / rejection and containment

Requirement: SV2-MUL-04.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Shared database server with distinct principals, distinct vaults, and deliberate misbinding fixtures.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-MUL-04 without broadening its grant or replacing the bad input silently.
Then: Separate Kubernetes namespaces pointing at the same unrestricted vault/database are not accepted as isolation proof.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect brain_backend_scope_conflicts with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MUL-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: An instance command may affect only the explicitly selected brain and its owned resources.
On failure: apply the package containment/rollback rule: Stop only the misconfigured instance and restore its prior backend bindings.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MUL-04-C: Isolate database, Redis, vault, and event state / recovery and replay

Requirement: SV2-MUL-04.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Shared database server with distinct principals, distinct vaults, and deliberate misbinding fixtures.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Restoring one instance backup leaves the other instance’s revision and corpus unchanged.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect brain_backend_scope_conflicts with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MUL-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: An instance command may affect only the explicitly selected brain and its owned resources.
On failure: apply the package containment/rollback rule: Stop only the misconfigured instance and restore its prior backend bindings.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MUL-05-A: Support distinct policy and inference budgets / successful behavior

Requirement: SV2-MUL-05.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Personal conservative policy and swarm experimental policy using a shared limited inference backend.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-MUL-05.
When: execute the owned behavior described as: Tune the swarm brain more aggressively without affecting personal behavior or cost.
Then: A swarm policy change affects only swarm packs while the personal brain keeps its previous ranking and cadence.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: An instance command may affect only the explicitly selected brain and its owned resources.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect brain_inference_budget_usage with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MUL-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: An instance command may affect only the explicitly selected brain and its owned resources.
On failure: apply the package containment/rollback rule: Restore the previous policy revision without migrating its evidence corpus.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MUL-05-B: Support distinct policy and inference budgets / rejection and containment

Requirement: SV2-MUL-05.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Personal conservative policy and swarm experimental policy using a shared limited inference backend.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-MUL-05 without broadening its grant or replacing the bad input silently.
Then: Increasing one brain’s budget cannot change global infrastructure ceilings implicitly.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect brain_inference_budget_usage with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MUL-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: An instance command may affect only the explicitly selected brain and its owned resources.
On failure: apply the package containment/rollback rule: Restore the previous policy revision without migrating its evidence corpus.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-MUL-05-C: Support distinct policy and inference budgets / recovery and replay

Requirement: SV2-MUL-05.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Personal conservative policy and swarm experimental policy using a shared limited inference backend.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Reverting a policy revision invalidates only that instance’s affected caches.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect brain_inference_budget_usage with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-MUL-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: An instance command may affect only the explicitly selected brain and its owned resources.
On failure: apply the package containment/rollback rule: Restore the previous policy revision without migrating its evidence corpus.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group ING: Brain extraction from normalized evidence and safe learning

T-SV2-ING-01-A: Consume the session change feed / successful behavior

Requirement: SV2-ING-01.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Two harnesses, changed attribution, deleted source, and an interrupted extraction batch.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-ING-01.
When: execute the owned behavior described as: Stop coupling kernel extraction to one CLI filesystem layout.
Then: Claude and Codex work becomes extractable through the same source API without mounting their native homes into the brain.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect brain_source_cursor_lag with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ING-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
On failure: apply the package containment/rollback rule: Re-enable the explicit legacy local source only for its authorized scope while preserving new cursors.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ING-01-B: Consume the session change feed / rejection and containment

Requirement: SV2-ING-01.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Two harnesses, changed attribution, deleted source, and an interrupted extraction batch.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-ING-01 without broadening its grant or replacing the bad input silently.
Then: A kernel extractor cannot read a corpus outside its principal’s allowed project set.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect brain_source_cursor_lag with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ING-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
On failure: apply the package containment/rollback rule: Re-enable the explicit legacy local source only for its authorized scope while preserving new cursors.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ING-01-C: Consume the session change feed / recovery and replay

Requirement: SV2-ING-01.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Two harnesses, changed attribution, deleted source, and an interrupted extraction batch.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Interrupted extraction resumes from the last committed source cursor without duplicating arcs.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect brain_source_cursor_lag with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ING-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
On failure: apply the package containment/rollback rule: Re-enable the explicit legacy local source only for its authorized scope while preserving new cursors.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ING-02-A: Group work by task lineage rather than swarm volume / successful behavior

Requirement: SV2-ING-02.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Ten concurrent tasks, one resumed attempt, one planner thread, and one tool-heavy single-prompt session.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-ING-02.
When: execute the owned behavior described as: Preserve meaningful engineering arcs when many autonomous agents run concurrently.
Then: Twenty agents on ten tasks produce task-relevant arc candidates rather than one giant repository-time bucket.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect arc_task_lineage_conflicts with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ING-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
On failure: apply the package containment/rollback rule: Keep the previous grouping generation readable and quarantine new ambiguous merges.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ING-02-B: Group work by task lineage rather than swarm volume / rejection and containment

Requirement: SV2-ING-02.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Ten concurrent tasks, one resumed attempt, one planner thread, and one tool-heavy single-prompt session.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-ING-02 without broadening its grant or replacing the bad input silently.
Then: Tool-call volume alone cannot force unrelated work into a high-confidence merged arc.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect arc_task_lineage_conflicts with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ING-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
On failure: apply the package containment/rollback rule: Keep the previous grouping generation readable and quarantine new ambiguous merges.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ING-02-C: Group work by task lineage rather than swarm volume / recovery and replay

Requirement: SV2-ING-02.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Ten concurrent tasks, one resumed attempt, one planner thread, and one tool-heavy single-prompt session.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Reprocessing a task with another attempt updates its lineage without destroying earlier source references.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect arc_task_lineage_conflicts with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ING-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
On failure: apply the package containment/rollback rule: Keep the previous grouping generation readable and quarantine new ambiguous merges.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ING-03-A: Prevent self-reinforcing injected-memory loops / successful behavior

Requirement: SV2-ING-03.
Responsible implementation: agentibrain-kernel.
Fixture inputs: One injected lesson repeated across many transcripts plus one genuine new successful application.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-ING-03.
When: execute the owned behavior described as: Keep repeated recalled text from becoming falsely corroborated new memory.
Then: Reinjecting one lesson into fifty workers does not create fifty independent confirmations or fifty duplicate lessons.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect memory_echo_suppression_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ING-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
On failure: apply the package containment/rollback rule: Disable automatic promotion and retain candidate lessons with their evidence classification.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ING-03-B: Prevent self-reinforcing injected-memory loops / rejection and containment

Requirement: SV2-ING-03.
Responsible implementation: agentibrain-kernel.
Fixture inputs: One injected lesson repeated across many transcripts plus one genuine new successful application.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-ING-03 without broadening its grant or replacing the bad input silently.
Then: A quoted old operator instruction is not treated as a fresh current directive.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect memory_echo_suppression_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ING-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
On failure: apply the package containment/rollback rule: Disable automatic promotion and retain candidate lessons with their evidence classification.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ING-03-C: Prevent self-reinforcing injected-memory loops / recovery and replay

Requirement: SV2-ING-03.
Responsible implementation: agentibrain-kernel.
Fixture inputs: One injected lesson repeated across many transcripts plus one genuine new successful application.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A genuinely new verified outcome can add evidence to an existing lesson without replacing its provenance.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect memory_echo_suppression_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ING-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
On failure: apply the package containment/rollback rule: Disable automatic promotion and retain candidate lessons with their evidence classification.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ING-04-A: Bound synthesis and serialize knowledge mutations / successful behavior

Requirement: SV2-ING-04.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Simultaneous marker writes, scheduled tick, manual tick, and malformed synthesis output.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-ING-04.
When: execute the owned behavior described as: Handle swarm write bursts without corrupting files or launching unbounded inference work.
Then: Concurrent marker writes and scheduled ticks preserve complete canonical knowledge with no interleaved file corruption.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect brain_mutation_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ING-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
On failure: apply the package containment/rollback rule: Run deterministic maintenance only while AI mutation application is paused.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ING-04-B: Bound synthesis and serialize knowledge mutations / rejection and containment

Requirement: SV2-ING-04.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Simultaneous marker writes, scheduled tick, manual tick, and malformed synthesis output.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-ING-04 without broadening its grant or replacing the bad input silently.
Then: An invalid model response cannot partially mutate unrelated arcs before validation fails.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect brain_mutation_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ING-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
On failure: apply the package containment/rollback rule: Run deterministic maintenance only while AI mutation application is paused.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ING-04-C: Bound synthesis and serialize knowledge mutations / recovery and replay

Requirement: SV2-ING-04.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Simultaneous marker writes, scheduled tick, manual tick, and malformed synthesis output.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A failed synthesis batch retries from its durable work state and leaves the previous accepted revision current.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect brain_mutation_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ING-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
On failure: apply the package containment/rollback rule: Run deterministic maintenance only while AI mutation application is paused.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ING-05-A: Record learning quality and promotion evidence / successful behavior

Requirement: SV2-ING-05.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Unsupported confident claim, independently verified lesson, repeated echo, and later contradiction.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-ING-05.
When: execute the owned behavior described as: Reward useful evidence-backed knowledge rather than larger numbers of lessons or edges.
Then: A supported lesson links to real outcome evidence and can be retired or corrected without losing its history.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect learning_usefulness_review_results with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ING-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
On failure: apply the package containment/rollback rule: Disable automatic promotion while retaining all candidate and historical evidence.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ING-05-B: Record learning quality and promotion evidence / rejection and containment

Requirement: SV2-ING-05.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Unsupported confident claim, independently verified lesson, repeated echo, and later contradiction.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-ING-05 without broadening its grant or replacing the bad input silently.
Then: Repeated agent confidence claims without independent evidence cannot promote a lesson to approved guidance.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect learning_usefulness_review_results with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ING-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
On failure: apply the package containment/rollback rule: Disable automatic promotion while retaining all candidate and historical evidence.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-ING-05-C: Record learning quality and promotion evidence / recovery and replay

Requirement: SV2-ING-05.
Responsible implementation: agentibrain-kernel.
Fixture inputs: Unsupported confident claim, independently verified lesson, repeated echo, and later contradiction.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A contradicted lesson is marked for review and removed from default guidance until resolved.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect learning_usefulness_review_results with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-ING-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Synthesis consumes authorized evidence; model repetition is not new independent confirmation.
On failure: apply the package containment/rollback rule: Disable automatic promotion while retaining all candidate and historical evidence.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group OBS: Operational telemetry and trustworthy health

T-SV2-OBS-01-A: Instrument controller and execution transitions / successful behavior

Requirement: SV2-OBS-01.
Responsible implementation: agentihooks.
Fixture inputs: Normal execution, fenced replacement, telemetry outage, and exception containing a fake secret.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-OBS-01.
When: execute the owned behavior described as: Make distributed decisions reconstructable from stable operation and execution identifiers.
Then: An operator can reconstruct why one task was admitted, delayed, fenced, and restored from its correlated events.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Operational logs identify behavior without exposing secret values or entire private transcripts.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect execution_transition_latency_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OBS-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Operational logs identify behavior without exposing secret values or entire private transcripts.
On failure: apply the package containment/rollback rule: Disable optional exporters while keeping local sanitized audit events and core counters.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OBS-01-B: Instrument controller and execution transitions / rejection and containment

Requirement: SV2-OBS-01.
Responsible implementation: agentihooks.
Fixture inputs: Normal execution, fenced replacement, telemetry outage, and exception containing a fake secret.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-OBS-01 without broadening its grant or replacing the bad input silently.
Then: A token or full process environment never appears in the default transition log.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect execution_transition_latency_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OBS-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Operational logs identify behavior without exposing secret values or entire private transcripts.
On failure: apply the package containment/rollback rule: Disable optional exporters while keeping local sanitized audit events and core counters.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OBS-01-C: Instrument controller and execution transitions / recovery and replay

Requirement: SV2-OBS-01.
Responsible implementation: agentihooks.
Fixture inputs: Normal execution, fenced replacement, telemetry outage, and exception containing a fake secret.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Telemetry backend outage does not block task authority updates and is reported as degraded observability.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect execution_transition_latency_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OBS-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Operational logs identify behavior without exposing secret values or entire private transcripts.
On failure: apply the package containment/rollback rule: Disable optional exporters while keeping local sanitized audit events and core counters.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OBS-02-A: Measure archive, embedding, and extraction lag separately / successful behavior

Requirement: SV2-OBS-02.
Responsible implementation: agentihooks.
Fixture inputs: Healthy capture with failed embedding, failed archive transport, and delayed brain extraction.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-OBS-02.
When: execute the owned behavior described as: Prevent a fast search response from hiding missing or unprocessed history.
Then: A delayed embedding worker shows current archive data but an explicit indexing lag without claiming full search coverage.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Operational logs identify behavior without exposing secret values or entire private transcripts.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect archive_lag_seconds embedding_lag_seconds extraction_lag_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OBS-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Operational logs identify behavior without exposing secret values or entire private transcripts.
On failure: apply the package containment/rollback rule: Keep stage watermarks persisted even if a dashboard or exporter is rolled back.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OBS-02-B: Measure archive, embedding, and extraction lag separately / rejection and containment

Requirement: SV2-OBS-02.
Responsible implementation: agentihooks.
Fixture inputs: Healthy capture with failed embedding, failed archive transport, and delayed brain extraction.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-OBS-02 without broadening its grant or replacing the bad input silently.
Then: One aggregate healthy flag cannot conceal an unacknowledged transcript tail.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect archive_lag_seconds embedding_lag_seconds extraction_lag_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OBS-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Operational logs identify behavior without exposing secret values or entire private transcripts.
On failure: apply the package containment/rollback rule: Keep stage watermarks persisted even if a dashboard or exporter is rolled back.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OBS-02-C: Measure archive, embedding, and extraction lag separately / recovery and replay

Requirement: SV2-OBS-02.
Responsible implementation: agentihooks.
Fixture inputs: Healthy capture with failed embedding, failed archive transport, and delayed brain extraction.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: After a backlog drains, stage-specific metrics converge independently and alerts clear.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect archive_lag_seconds embedding_lag_seconds extraction_lag_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OBS-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Operational logs identify behavior without exposing secret values or entire private transcripts.
On failure: apply the package containment/rollback rule: Keep stage watermarks persisted even if a dashboard or exporter is rolled back.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OBS-03-A: Instrument context and gate effectiveness / successful behavior

Requirement: SV2-OBS-03.
Responsible implementation: agentihooks.
Fixture inputs: Useful consultation, irrelevant consultation, missing delivery, and operator override.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-OBS-03.
When: execute the owned behavior described as: Measure whether consultation helps without equating tool-call count with useful memory usage.
Then: The report separates context delivered, context referenced, and operator-reviewed usefulness.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Operational logs identify behavior without exposing secret values or entire private transcripts.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect brain_gate_false_block_rate and context_delivery_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OBS-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Operational logs identify behavior without exposing secret values or entire private transcripts.
On failure: apply the package containment/rollback rule: Return gates to observe mode while retaining outcome metrics for comparison.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OBS-03-B: Instrument context and gate effectiveness / rejection and containment

Requirement: SV2-OBS-03.
Responsible implementation: agentihooks.
Fixture inputs: Useful consultation, irrelevant consultation, missing delivery, and operator override.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-OBS-03 without broadening its grant or replacing the bad input silently.
Then: A successful HTTP response alone cannot be counted as verified target delivery.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect brain_gate_false_block_rate and context_delivery_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OBS-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Operational logs identify behavior without exposing secret values or entire private transcripts.
On failure: apply the package containment/rollback rule: Return gates to observe mode while retaining outcome metrics for comparison.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OBS-03-C: Instrument context and gate effectiveness / recovery and replay

Requirement: SV2-OBS-03.
Responsible implementation: agentihooks.
Fixture inputs: Useful consultation, irrelevant consultation, missing delivery, and operator override.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A failed context service produces visible degraded metrics without triggering fleet-wide liveness restarts.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect brain_gate_false_block_rate and context_delivery_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OBS-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Operational logs identify behavior without exposing secret values or entire private transcripts.
On failure: apply the package containment/rollback rule: Return gates to observe mode while retaining outcome metrics for comparison.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OBS-04-A: Publish actionable diagnostics and health endpoints / successful behavior

Requirement: SV2-OBS-04.
Responsible implementation: agentihooks.
Fixture inputs: Live-but-stuck exporter, unavailable Redis, failed brain auth, and healthy local supervisor.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-OBS-04.
When: execute the owned behavior described as: Distinguish local process health, dependency availability, and end-to-end pipeline progress.
Then: A stuck exporter with a live process is reported as pipeline degradation with its last durable watermark.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Operational logs identify behavior without exposing secret values or entire private transcripts.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect pipeline_stage_health with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OBS-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Operational logs identify behavior without exposing secret values or entire private transcripts.
On failure: apply the package containment/rollback rule: Keep shallow probes stable and disable expensive deep checks if their load is excessive.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OBS-04-B: Publish actionable diagnostics and health endpoints / rejection and containment

Requirement: SV2-OBS-04.
Responsible implementation: agentihooks.
Fixture inputs: Live-but-stuck exporter, unavailable Redis, failed brain auth, and healthy local supervisor.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-OBS-04 without broadening its grant or replacing the bad input silently.
Then: A shallow healthy response cannot satisfy the acceptance gate for backup or native resume.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect pipeline_stage_health with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OBS-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Operational logs identify behavior without exposing secret values or entire private transcripts.
On failure: apply the package containment/rollback rule: Keep shallow probes stable and disable expensive deep checks if their load is excessive.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OBS-04-C: Publish actionable diagnostics and health endpoints / recovery and replay

Requirement: SV2-OBS-04.
Responsible implementation: agentihooks.
Fixture inputs: Live-but-stuck exporter, unavailable Redis, failed brain auth, and healthy local supervisor.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Restored dependencies clear the relevant diagnostic stage without resetting unrelated execution state.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect pipeline_stage_health with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OBS-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Operational logs identify behavior without exposing secret values or entire private transcripts.
On failure: apply the package containment/rollback rule: Keep shallow probes stable and disable expensive deep checks if their load is excessive.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OBS-05-A: Produce fleet dashboards and bounded alerts / successful behavior

Requirement: SV2-OBS-05.
Responsible implementation: agentihooks.
Fixture inputs: Recorded scaling canary, stale checkpoint, quota wait, and denied cross-brain query.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-OBS-05.
When: execute the owned behavior described as: Give the operator a compact view of state, cost pressure, recovery, and knowledge freshness.
Then: Dashboard labels distinguish configured maxima from actual nodes and active tasks.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Operational logs identify behavior without exposing secret values or entire private transcripts.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect alert_actionability_review with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OBS-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Operational logs identify behavior without exposing secret values or entire private transcripts.
On failure: apply the package containment/rollback rule: Restore the previous dashboard and disable new alerts independently from worker execution.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OBS-05-B: Produce fleet dashboards and bounded alerts / rejection and containment

Requirement: SV2-OBS-05.
Responsible implementation: agentihooks.
Fixture inputs: Recorded scaling canary, stale checkpoint, quota wait, and denied cross-brain query.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-OBS-05 without broadening its grant or replacing the bad input silently.
Then: An alert cannot expose a private personal session title to a swarm-only viewer.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect alert_actionability_review with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OBS-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Operational logs identify behavior without exposing secret values or entire private transcripts.
On failure: apply the package containment/rollback rule: Restore the previous dashboard and disable new alerts independently from worker execution.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OBS-05-C: Produce fleet dashboards and bounded alerts / recovery and replay

Requirement: SV2-OBS-05.
Responsible implementation: agentihooks.
Fixture inputs: Recorded scaling canary, stale checkpoint, quota wait, and denied cross-brain query.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Alert backend recovery does not duplicate incident state or trigger repeated destructive actions.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect alert_actionability_review with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OBS-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Operational logs identify behavior without exposing secret values or entire private transcripts.
On failure: apply the package containment/rollback rule: Restore the previous dashboard and disable new alerts independently from worker execution.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-UX-01-A: Add distributed execution identity to ledger cards / successful behavior

Requirement: SV2-UX-01.
Responsible implementation: agentihooks.
Fixture inputs: Mixed local/remote swarm and deliberately out-of-order state updates.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-UX-01.
When: execute the owned behavior described as: Keep the familiar ledger while making remote execution visible and unambiguous.
Then: A local and a remote agent can be understood from the same ledger without changing the user’s task workflow.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect ledger_state_projection_errors with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-UX-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
On failure: apply the package containment/rollback rule: Hide new fields behind compatible response handling while keeping existing cards functional.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-UX-01-B: Add distributed execution identity to ledger cards / rejection and containment

Requirement: SV2-UX-01.
Responsible implementation: agentihooks.
Fixture inputs: Mixed local/remote swarm and deliberately out-of-order state updates.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-UX-01 without broadening its grant or replacing the bad input silently.
Then: A stale terminal observation cannot overwrite a fresher heartbeat-derived state.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect ledger_state_projection_errors with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-UX-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
On failure: apply the package containment/rollback rule: Hide new fields behind compatible response handling while keeping existing cards functional.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-UX-01-C: Add distributed execution identity to ledger cards / recovery and replay

Requirement: SV2-UX-01.
Responsible implementation: agentihooks.
Fixture inputs: Mixed local/remote swarm and deliberately out-of-order state updates.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Reloading the page restores the latest state from the API without replaying client-side mutations.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect ledger_state_projection_errors with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-UX-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
On failure: apply the package containment/rollback rule: Hide new fields behind compatible response handling while keeping existing cards functional.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-UX-02-A: Add explicit safe lifecycle controls / successful behavior

Requirement: SV2-UX-02.
Responsible implementation: agentihooks.
Fixture inputs: Stale browser tab, duplicated click, partial drain, and unsupported attach target.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-UX-02.
When: execute the owned behavior described as: Provide attach, pause, drain, cancel, and force-stop with different consequences.
Then: Draining one worker leaves other agents active and reports its checkpoint result.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect ledger_control_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-UX-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
On failure: apply the package containment/rollback rule: Disable new destructive controls while retaining existing server-validated operations.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-UX-02-B: Add explicit safe lifecycle controls / rejection and containment

Requirement: SV2-UX-02.
Responsible implementation: agentihooks.
Fixture inputs: Stale browser tab, duplicated click, partial drain, and unsupported attach target.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-UX-02 without broadening its grant or replacing the bad input silently.
Then: Clicking an old force-stop button after replacement fails as stale rather than stopping the successor.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect ledger_control_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-UX-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
On failure: apply the package containment/rollback rule: Disable new destructive controls while retaining existing server-validated operations.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-UX-02-C: Add explicit safe lifecycle controls / recovery and replay

Requirement: SV2-UX-02.
Responsible implementation: agentihooks.
Fixture inputs: Stale browser tab, duplicated click, partial drain, and unsupported attach target.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A lost HTTP acknowledgement can be reconciled by operation ID before another click is accepted.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect ledger_control_conflicts_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-UX-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
On failure: apply the package containment/rollback rule: Disable new destructive controls while retaining existing server-validated operations.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-UX-03-A: Expose recovery material and decision choices / successful behavior

Requirement: SV2-UX-03.
Responsible implementation: agentihooks.
Fixture inputs: Valid native checkpoint, context-only checkpoint, and corrupted required object.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-UX-03.
When: execute the owned behavior described as: Make recovery honest and actionable when a process or native session is lost.
Then: The operator sees why native resume failed and can select a documented continuation mode.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect recovery_decision_wait_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-UX-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
On failure: apply the package containment/rollback rule: Leave affected tasks awaiting decision and hide unsupported recovery actions.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-UX-03-B: Expose recovery material and decision choices / rejection and containment

Requirement: SV2-UX-03.
Responsible implementation: agentihooks.
Fixture inputs: Valid native checkpoint, context-only checkpoint, and corrupted required object.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-UX-03 without broadening its grant or replacing the bad input silently.
Then: A path-only snapshot cannot produce a green recoverable badge.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect recovery_decision_wait_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-UX-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
On failure: apply the package containment/rollback rule: Leave affected tasks awaiting decision and hide unsupported recovery actions.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-UX-03-C: Expose recovery material and decision choices / recovery and replay

Requirement: SV2-UX-03.
Responsible implementation: agentihooks.
Fixture inputs: Valid native checkpoint, context-only checkpoint, and corrupted required object.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A page refresh retains the accepted recovery decision and does not create a second replacement.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect recovery_decision_wait_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-UX-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
On failure: apply the package containment/rollback rule: Leave affected tasks awaiting decision and hide unsupported recovery actions.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-UX-04-A: Add brain context and evidence inspection / successful behavior

Requirement: SV2-UX-04.
Responsible implementation: agentihooks.
Fixture inputs: Current pack, inferred intent, superseded decision, and revoked source reference.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-UX-04.
When: execute the owned behavior described as: Let the operator inspect what memory influenced a task without opening another application.
Then: A context item can be expanded to its supporting record range or lesson revision from the ledger.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect ledger_evidence_expand_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-UX-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
On failure: apply the package containment/rollback rule: Hide context inspection panels while preserving core task controls and evidence IDs.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-UX-04-B: Add brain context and evidence inspection / rejection and containment

Requirement: SV2-UX-04.
Responsible implementation: agentihooks.
Fixture inputs: Current pack, inferred intent, superseded decision, and revoked source reference.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-UX-04 without broadening its grant or replacing the bad input silently.
Then: A swarm viewer cannot follow a copied personal-brain evidence link without authorization.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect ledger_evidence_expand_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-UX-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
On failure: apply the package containment/rollback rule: Hide context inspection panels while preserving core task controls and evidence IDs.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-UX-04-C: Add brain context and evidence inspection / recovery and replay

Requirement: SV2-UX-04.
Responsible implementation: agentihooks.
Fixture inputs: Current pack, inferred intent, superseded decision, and revoked source reference.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A revoked source appears as unavailable with an explanation rather than stale cached private content.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect ledger_evidence_expand_failures with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-UX-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
On failure: apply the package containment/rollback rule: Hide context inspection panels while preserving core task controls and evidence IDs.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-UX-05-A: Test responsive terminal and ledger workflows / successful behavior

Requirement: SV2-UX-05.
Responsible implementation: agentihooks.
Fixture inputs: Desktop and mobile-sized browser views, closed viewers, and one reconnecting remote terminal.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-UX-05.
When: execute the owned behavior described as: Prove the intended workflow from browser and terminal without making the personal computer a dependency.
Then: The operator can return to the same running swarm and inspect current remote work after all viewers were closed.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect operator_workflow_acceptance with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-UX-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
On failure: apply the package containment/rollback rule: Restore the previous UI build without restarting worker Pods.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-UX-05-B: Test responsive terminal and ledger workflows / rejection and containment

Requirement: SV2-UX-05.
Responsible implementation: agentihooks.
Fixture inputs: Desktop and mobile-sized browser views, closed viewers, and one reconnecting remote terminal.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-UX-05 without broadening its grant or replacing the bad input silently.
Then: A mobile layout must not hide or mislabel destructive-action scope.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect operator_workflow_acceptance with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-UX-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
On failure: apply the package containment/rollback rule: Restore the previous UI build without restarting worker Pods.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-UX-05-C: Test responsive terminal and ledger workflows / recovery and replay

Requirement: SV2-UX-05.
Responsible implementation: agentihooks.
Fixture inputs: Desktop and mobile-sized browser views, closed viewers, and one reconnecting remote terminal.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A reconnecting worker presents cached state as stale until a fresh observation arrives.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect operator_workflow_acceptance with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-UX-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: The UI is a projection of authoritative state; cached pages cannot grant current execution authority.
On failure: apply the package containment/rollback rule: Restore the previous UI build without restarting worker Pods.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group VAL: Cross-repository tests, chaos, and regression protection

T-SV2-VAL-01-A: Build the shared contract conformance suite / successful behavior

Requirement: SV2-VAL-01.
Responsible implementation: agentihooks.
Fixture inputs: Complete schema matrix with valid, invalid, extension, and version-conflict examples.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-VAL-01.
When: execute the owned behavior described as: Ensure independently released producers and consumers agree on authority and data shapes.
Then: The three repositories’ implementations pass the same transport fixtures for their owned endpoints.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect contract_cases_passed with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-VAL-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
On failure: apply the package containment/rollback rule: Keep the previous compatible schema active until all required consumers qualify.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-VAL-01-B: Build the shared contract conformance suite / rejection and containment

Requirement: SV2-VAL-01.
Responsible implementation: agentihooks.
Fixture inputs: Complete schema matrix with valid, invalid, extension, and version-conflict examples.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-VAL-01 without broadening its grant or replacing the bad input silently.
Then: A consumer that ignores task generation or project scope fails conformance even if it returns HTTP success.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect contract_cases_passed with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-VAL-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
On failure: apply the package containment/rollback rule: Keep the previous compatible schema active until all required consumers qualify.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-VAL-01-C: Build the shared contract conformance suite / recovery and replay

Requirement: SV2-VAL-01.
Responsible implementation: agentihooks.
Fixture inputs: Complete schema matrix with valid, invalid, extension, and version-conflict examples.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A backward-compatible optional extension passes older readers without stripping durable provenance.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect contract_cases_passed with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-VAL-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
On failure: apply the package containment/rollback rule: Keep the previous compatible schema active until all required consumers qualify.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-VAL-02-A: Build runtime model and race tests / successful behavior

Requirement: SV2-VAL-02.
Responsible implementation: agentihooks.
Fixture inputs: Seeded race traces with two controllers and two successive worker generations.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-VAL-02.
When: execute the owned behavior described as: Validate state-machine safety under ordering and transport failures rather than only happy-path mocks.
Then: Randomized event sequences preserve one admitted generation and converge after observation resumes.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect state_machine_invariant_violations with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-VAL-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
On failure: apply the package containment/rollback rule: Disable automatic recovery or cleanup for the affected backend while the failing seed is fixed.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-VAL-02-B: Build runtime model and race tests / rejection and containment

Requirement: SV2-VAL-02.
Responsible implementation: agentihooks.
Fixture inputs: Seeded race traces with two controllers and two successive worker generations.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-VAL-02 without broadening its grant or replacing the bad input silently.
Then: A stale-generation outcome that succeeds marks the implementation incorrect regardless of final task appearance.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect state_machine_invariant_violations with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-VAL-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
On failure: apply the package containment/rollback rule: Disable automatic recovery or cleanup for the affected backend while the failing seed is fixed.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-VAL-02-C: Build runtime model and race tests / recovery and replay

Requirement: SV2-VAL-02.
Responsible implementation: agentihooks.
Fixture inputs: Seeded race traces with two controllers and two successive worker generations.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Saving and replaying a failing random seed reproduces the same invariant violation deterministically.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect state_machine_invariant_violations with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-VAL-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
On failure: apply the package containment/rollback rule: Disable automatic recovery or cleanup for the affected backend while the failing seed is fixed.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-VAL-03-A: Build source-fidelity and scope isolation tests / successful behavior

Requirement: SV2-VAL-03.
Responsible implementation: agentihooks.
Fixture inputs: Two brains, equal session IDs, long transcripts, overlapping errors, and deleted evidence.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-VAL-03.
When: execute the owned behavior described as: Prove memory completeness, citations, and data boundaries across providers and brains.
Then: Searchable sources remain complete and isolated after worker loss and corpus reindex.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect memory_scope_leakage_cases with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-VAL-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
On failure: apply the package containment/rollback rule: Disable shared search and context caching while keeping source capture isolated.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-VAL-03-B: Build source-fidelity and scope isolation tests / rejection and containment

Requirement: SV2-VAL-03.
Responsible implementation: agentihooks.
Fixture inputs: Two brains, equal session IDs, long transcripts, overlapping errors, and deleted evidence.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-VAL-03 without broadening its grant or replacing the bad input silently.
Then: Any cross-scope title, snippet, count, or cached context leakage is a hard failure.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect memory_scope_leakage_cases with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-VAL-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
On failure: apply the package containment/rollback rule: Disable shared search and context caching while keeping source capture isolated.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-VAL-03-C: Build source-fidelity and scope isolation tests / recovery and replay

Requirement: SV2-VAL-03.
Responsible implementation: agentihooks.
Fixture inputs: Two brains, equal session IDs, long transcripts, overlapping errors, and deleted evidence.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Restoring the catalog and rebuilding vectors preserves original evidence locators.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect memory_scope_leakage_cases with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-VAL-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
On failure: apply the package containment/rollback rule: Disable shared search and context caching while keeping source capture isolated.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-VAL-04-A: Rehearse planned and abrupt infrastructure failures / successful behavior

Requirement: SV2-VAL-04.
Responsible implementation: agentihooks.
Fixture inputs: Dedicated disposable tasks and canary nodes with no production credentials.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-VAL-04.
When: execute the owned behavior described as: Validate different failure semantics without promising uniform recovery.
Then: Each failure yields the documented state transition and no duplicate shared-task writer.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect chaos_recovery_outcomes with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-VAL-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
On failure: apply the package containment/rollback rule: Stop the experiment cohort and route new work to the previously qualified execution policy.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-VAL-04-B: Rehearse planned and abrupt infrastructure failures / rejection and containment

Requirement: SV2-VAL-04.
Responsible implementation: agentihooks.
Fixture inputs: Dedicated disposable tasks and canary nodes with no production credentials.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-VAL-04 without broadening its grant or replacing the bad input silently.
Then: A graceful drain test alone cannot qualify abrupt Spot or node-failure recovery.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect chaos_recovery_outcomes with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-VAL-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
On failure: apply the package containment/rollback rule: Stop the experiment cohort and route new work to the previously qualified execution policy.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-VAL-04-C: Rehearse planned and abrupt infrastructure failures / recovery and replay

Requirement: SV2-VAL-04.
Responsible implementation: agentihooks.
Fixture inputs: Dedicated disposable tasks and canary nodes with no production credentials.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Repeated experiments leave no orphan Pods, attach profiles, reservations, or pending restore claims.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect chaos_recovery_outcomes with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-VAL-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
On failure: apply the package containment/rollback rule: Stop the experiment cohort and route new work to the previously qualified execution policy.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-VAL-05-A: Run end-to-end acceptance with operator evidence / successful behavior

Requirement: SV2-VAL-05.
Responsible implementation: agentihooks.
Fixture inputs: Mixed-harness two-project swarm with personal-brain isolation and one controlled recovery.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-VAL-05.
When: execute the owned behavior described as: Demonstrate the whole workflow rather than isolated components.
Then: The complete acceptance definition in section 18 is satisfied with linked evidence from all three repositories.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect end_to_end_acceptance_passed with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-VAL-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
On failure: apply the package containment/rollback rule: Keep the working local swarm and the last qualified distributed cohort available.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-VAL-05-B: Run end-to-end acceptance with operator evidence / rejection and containment

Requirement: SV2-VAL-05.
Responsible implementation: agentihooks.
Fixture inputs: Mixed-harness two-project swarm with personal-brain isolation and one controlled recovery.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-VAL-05 without broadening its grant or replacing the bad input silently.
Then: A green unit suite without live target delivery and qualified recovery cannot mark Swarm v2 complete.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect end_to_end_acceptance_passed with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-VAL-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
On failure: apply the package containment/rollback rule: Keep the working local swarm and the last qualified distributed cohort available.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-VAL-05-C: Run end-to-end acceptance with operator evidence / recovery and replay

Requirement: SV2-VAL-05.
Responsible implementation: agentihooks.
Fixture inputs: Mixed-harness two-project swarm with personal-brain isolation and one controlled recovery.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A failed acceptance case returns only the relevant rollout gate to blocked while preserving completed evidence.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect end_to_end_acceptance_passed with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-VAL-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Tests use isolated fixtures by default; live destructive experiments require an explicitly designated canary.
On failure: apply the package containment/rollback rule: Keep the working local swarm and the last qualified distributed cohort available.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group GIT: antoncore GitOps deployment and staged integration

T-SV2-GIT-01-A: Create the permanent swarm control deployment / successful behavior

Requirement: SV2-GIT-01.
Responsible implementation: antoncore.
Fixture inputs: Non-Spot placement fixture and a controller restart with two active remote attempts.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-GIT-01.
When: execute the owned behavior described as: Host the controller and operator-facing services on durable non-Spot Anton infrastructure.
Then: The control deployment survives viewer disconnect and can restart without losing current task authority or ledger history.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect swarm_control_restart_recovery_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GIT-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
On failure: apply the package containment/rollback rule: Revert the GitOps image/configuration revision with distributed admission paused.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GIT-01-B: Create the permanent swarm control deployment / rejection and containment

Requirement: SV2-GIT-01.
Responsible implementation: antoncore.
Fixture inputs: Non-Spot placement fixture and a controller restart with two active remote attempts.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-GIT-01 without broadening its grant or replacing the bad input silently.
Then: The controller cannot schedule onto reclaimable capacity merely because it has free CPU.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect swarm_control_restart_recovery_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GIT-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
On failure: apply the package containment/rollback rule: Revert the GitOps image/configuration revision with distributed admission paused.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GIT-01-C: Create the permanent swarm control deployment / recovery and replay

Requirement: SV2-GIT-01.
Responsible implementation: antoncore.
Fixture inputs: Non-Spot placement fixture and a controller restart with two active remote attempts.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Restarting the controller recovers active attempts through its persisted journal and observations.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect swarm_control_restart_recovery_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GIT-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
On failure: apply the package containment/rollback rule: Revert the GitOps image/configuration revision with distributed admission paused.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GIT-02-A: Create worker policy and namespace resources / successful behavior

Requirement: SV2-GIT-02.
Responsible implementation: antoncore.
Fixture inputs: Static policy release plus dynamic controller-owned Pods and an unrelated namespace workload.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-GIT-02.
When: execute the owned behavior described as: Deploy reusable policy and credentials without a fixed competing worker scheduler.
Then: GitOps reconciles policy while the controller creates and removes its labelled execution Pods safely.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect gitops_runtime_ownership_conflicts with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GIT-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
On failure: apply the package containment/rollback rule: Revert only the policy release and stop new admissions that depend on newer fields.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GIT-02-B: Create worker policy and namespace resources / rejection and containment

Requirement: SV2-GIT-02.
Responsible implementation: antoncore.
Fixture inputs: Static policy release plus dynamic controller-owned Pods and an unrelated namespace workload.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-GIT-02 without broadening its grant or replacing the bad input silently.
Then: A reconciliation must not prune live attempts merely because they are not static chart replicas.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect gitops_runtime_ownership_conflicts with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GIT-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
On failure: apply the package containment/rollback rule: Revert only the policy release and stop new admissions that depend on newer fields.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GIT-02-C: Create worker policy and namespace resources / recovery and replay

Requirement: SV2-GIT-02.
Responsible implementation: antoncore.
Fixture inputs: Static policy release plus dynamic controller-owned Pods and an unrelated namespace workload.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Restoring policy manifests does not adopt or delete unrelated runtime objects.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect gitops_runtime_ownership_conflicts with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GIT-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
On failure: apply the package containment/rollback rule: Revert only the policy release and stop new admissions that depend on newer fields.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GIT-03-A: Deploy durable session-memory services / successful behavior

Requirement: SV2-GIT-03.
Responsible implementation: antoncore.
Fixture inputs: Separate archive, catalog, and embedding failure injections.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-GIT-03.
When: execute the owned behavior described as: Host the replacement corpus and search process with explicit storage and backup ownership.
Then: Workers archive and search sessions through the agentihooks service without mounting a shared native home.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect swarm_memory_pipeline_health with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GIT-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
On failure: apply the package containment/rollback rule: Revert the service image while preserving additive tables and immutable archives.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GIT-03-B: Deploy durable session-memory services / rejection and containment

Requirement: SV2-GIT-03.
Responsible implementation: antoncore.
Fixture inputs: Separate archive, catalog, and embedding failure injections.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-GIT-03 without broadening its grant or replacing the bad input silently.
Then: Loss of the vector worker cannot make acknowledged source evidence disappear.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect swarm_memory_pipeline_health with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GIT-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
On failure: apply the package containment/rollback rule: Revert the service image while preserving additive tables and immutable archives.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GIT-03-C: Deploy durable session-memory services / recovery and replay

Requirement: SV2-GIT-03.
Responsible implementation: antoncore.
Fixture inputs: Separate archive, catalog, and embedding failure injections.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A session-service restart resumes durable cursors and index work without replay corruption.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect swarm_memory_pipeline_health with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GIT-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
On failure: apply the package containment/rollback rule: Revert the service image while preserving additive tables and immutable archives.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GIT-04-A: Deploy the shared swarm brain with isolation / successful behavior

Requirement: SV2-GIT-04.
Responsible implementation: antoncore.
Fixture inputs: Shared infrastructure with deliberately separate personal/swarm principals and vault roots.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-GIT-04.
When: execute the owned behavior described as: Provide one shared active brain for the swarm without binding personal knowledge into its stores.
Then: Swarm workers read their brain and project context while the personal brain remains independently configured and inaccessible.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect swarm_brain_scope_isolation with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GIT-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
On failure: apply the package containment/rollback rule: Revert the brain deployment revision and preserve the evidence corpus and prior compatible feed.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GIT-04-B: Deploy the shared swarm brain with isolation / rejection and containment

Requirement: SV2-GIT-04.
Responsible implementation: antoncore.
Fixture inputs: Shared infrastructure with deliberately separate personal/swarm principals and vault roots.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-GIT-04 without broadening its grant or replacing the bad input silently.
Then: Shared physical backend configuration without logical authorization separation fails deployment acceptance.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect swarm_brain_scope_isolation with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GIT-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
On failure: apply the package containment/rollback rule: Revert the brain deployment revision and preserve the evidence corpus and prior compatible feed.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GIT-04-C: Deploy the shared swarm brain with isolation / recovery and replay

Requirement: SV2-GIT-04.
Responsible implementation: antoncore.
Fixture inputs: Shared infrastructure with deliberately separate personal/swarm principals and vault roots.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Replacing the brain service leaves worker execution alive and context temporarily degraded according to policy.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect swarm_brain_scope_isolation with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GIT-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
On failure: apply the package containment/rollback rule: Revert the brain deployment revision and preserve the evidence corpus and prior compatible feed.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GIT-05-A: Execute staged local, cloud, and Spot rollout / successful behavior

Requirement: SV2-GIT-05.
Responsible implementation: antoncore.
Fixture inputs: Local-only baseline, one non-Spot worker, mixed small cohort, and explicit Spot canary.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-GIT-05.
When: execute the owned behavior described as: Promote only combinations proven by the acceptance gates and operator resource policy.
Then: Every promoted cohort has a compatible image/controller/brain tuple and linked gate evidence.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect rollout_gate_status with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GIT-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
On failure: apply the package containment/rollback rule: Restore the last accepted deployment tuple and admission cap, never reset repositories to old commits.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GIT-05-B: Execute staged local, cloud, and Spot rollout / rejection and containment

Requirement: SV2-GIT-05.
Responsible implementation: antoncore.
Fixture inputs: Local-only baseline, one non-Spot worker, mixed small cohort, and explicit Spot canary.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-GIT-05 without broadening its grant or replacing the bad input silently.
Then: Failure in checkpoint or scope isolation blocks Spot and larger cohorts even if basic task execution works.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect rollout_gate_status with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GIT-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
On failure: apply the package containment/rollback rule: Restore the last accepted deployment tuple and admission cap, never reset repositories to old commits.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-GIT-05-C: Execute staged local, cloud, and Spot rollout / recovery and replay

Requirement: SV2-GIT-05.
Responsible implementation: antoncore.
Fixture inputs: Local-only baseline, one non-Spot worker, mixed small cohort, and explicit Spot canary.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Rollback drains the new cohort while preserving local execution and all durable transcripts.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect rollout_gate_status with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-GIT-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Prepare manifests early, but apply each feature only after its referenced protocol and rollout gates pass.
On failure: apply the package containment/rollback rule: Restore the last accepted deployment tuple and admission cap, never reset repositories to old commits.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group RET: Retention, migrations, backups, and reversible state

T-SV2-RET-01-A: Define corpus and checkpoint retention policies / successful behavior

Requirement: SV2-RET-01.
Responsible implementation: agentihooks.
Fixture inputs: Expired unreferenced checkpoint, active restore, held task evidence, and personal retention policy.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-RET-01.
When: execute the owned behavior described as: Make storage growth bounded without deleting active recovery or required task evidence.
Then: Retention removes only eligible unreferenced objects and retains the latest required complete checkpoint for active tasks.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect retention_protected_objects with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RET-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
On failure: apply the package containment/rollback rule: Disable destructive collection while preserving the eligibility report and object references.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RET-01-B: Define corpus and checkpoint retention policies / rejection and containment

Requirement: SV2-RET-01.
Responsible implementation: agentihooks.
Fixture inputs: Expired unreferenced checkpoint, active restore, held task evidence, and personal retention policy.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-RET-01 without broadening its grant or replacing the bad input silently.
Then: An active restore’s manifest or required object cannot be collected mid-read.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect retention_protected_objects with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RET-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
On failure: apply the package containment/rollback rule: Disable destructive collection while preserving the eligibility report and object references.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RET-01-C: Define corpus and checkpoint retention policies / recovery and replay

Requirement: SV2-RET-01.
Responsible implementation: agentihooks.
Fixture inputs: Expired unreferenced checkpoint, active restore, held task evidence, and personal retention policy.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Interrupted retention resumes from a deletion journal without deleting a newly protected object.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect retention_protected_objects with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RET-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
On failure: apply the package containment/rollback rule: Disable destructive collection while preserving the eligibility report and object references.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RET-02-A: Propagate deletion and access revocation / successful behavior

Requirement: SV2-RET-02.
Responsible implementation: agentihooks.
Fixture inputs: One source referenced by search results, a cached pack, and an inferred lesson.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-RET-02.
When: execute the owned behavior described as: Keep direct retrieval, search, context caches, and derived knowledge consistent after a scope change.
Then: Revoked evidence cannot be read through search, range expansion, compatibility aliases, or cached context.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect revocation_propagation_lag_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RET-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
On failure: apply the package containment/rollback rule: Keep data inaccessible while rebuilding projections; do not restore revoked access as a rollback shortcut.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RET-02-B: Propagate deletion and access revocation / rejection and containment

Requirement: SV2-RET-02.
Responsible implementation: agentihooks.
Fixture inputs: One source referenced by search results, a cached pack, and an inferred lesson.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-RET-02 without broadening its grant or replacing the bad input silently.
Then: Deleting only the vector row while retaining a public cached preview fails the contract.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect revocation_propagation_lag_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RET-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
On failure: apply the package containment/rollback rule: Keep data inaccessible while rebuilding projections; do not restore revoked access as a rollback shortcut.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RET-02-C: Propagate deletion and access revocation / recovery and replay

Requirement: SV2-RET-02.
Responsible implementation: agentihooks.
Fixture inputs: One source referenced by search results, a cached pack, and an inferred lesson.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Consumers replay tombstones after downtime and converge to the current authorization state.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect revocation_propagation_lag_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RET-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
On failure: apply the package containment/rollback rule: Keep data inaccessible while rebuilding projections; do not restore revoked access as a rollback shortcut.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RET-03-A: Create compatible database migrations / successful behavior

Requirement: SV2-RET-03.
Responsible implementation: agentihooks.
Fixture inputs: Previous schema, new optional fields, interrupted backfill, and mismatched vector dimension.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-RET-03.
When: execute the owned behavior described as: Support staged rollout without destructive surprise or a requirement to stop all local work.
Then: Old supported readers and new writers coexist during the stated migration window.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect migration_rows_remaining with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RET-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
On failure: apply the package containment/rollback rule: Deactivate new projections and retain additive schema until a reviewed rollback migration is safe.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RET-03-B: Create compatible database migrations / rejection and containment

Requirement: SV2-RET-03.
Responsible implementation: agentihooks.
Fixture inputs: Previous schema, new optional fields, interrupted backfill, and mismatched vector dimension.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-RET-03 without broadening its grant or replacing the bad input silently.
Then: A destructive vector-dimension change cannot run automatically during ordinary startup.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect migration_rows_remaining with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RET-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
On failure: apply the package containment/rollback rule: Deactivate new projections and retain additive schema until a reviewed rollback migration is safe.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RET-03-C: Create compatible database migrations / recovery and replay

Requirement: SV2-RET-03.
Responsible implementation: agentihooks.
Fixture inputs: Previous schema, new optional fields, interrupted backfill, and mismatched vector dimension.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A failed backfill resumes without reassigning stable event or chunk identities.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect migration_rows_remaining with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RET-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
On failure: apply the package containment/rollback rule: Deactivate new projections and retain additive schema until a reviewed rollback migration is safe.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RET-04-A: Implement backup manifests and restore drills / successful behavior

Requirement: SV2-RET-04.
Responsible implementation: agentihooks.
Fixture inputs: Catalog backup, immutable objects, brain backup, and one deliberately missing source object.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-RET-04.
When: execute the owned behavior described as: Prove durable state can be recovered independently of currently running Pods.
Then: An isolated restore can answer the agreed historical query and recover a designated task checkpoint from backups alone.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect backup_restore_verification_status with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RET-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
On failure: apply the package containment/rollback rule: Preserve the last independently verified backup set and stop destructive retention until coverage is restored.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RET-04-B: Implement backup manifests and restore drills / rejection and containment

Requirement: SV2-RET-04.
Responsible implementation: agentihooks.
Fixture inputs: Catalog backup, immutable objects, brain backup, and one deliberately missing source object.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-RET-04 without broadening its grant or replacing the bad input silently.
Then: A successful backup upload without a restore verification does not satisfy acceptance.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect backup_restore_verification_status with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RET-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
On failure: apply the package containment/rollback rule: Preserve the last independently verified backup set and stop destructive retention until coverage is restored.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RET-04-C: Implement backup manifests and restore drills / recovery and replay

Requirement: SV2-RET-04.
Responsible implementation: agentihooks.
Fixture inputs: Catalog backup, immutable objects, brain backup, and one deliberately missing source object.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Missing optional indexes are rebuilt from sources while missing source objects are reported as irrecoverable.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect backup_restore_verification_status with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RET-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
On failure: apply the package containment/rollback rule: Preserve the last independently verified backup set and stop destructive retention until coverage is restored.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RET-05-A: Collect runtime and index garbage safely / successful behavior

Requirement: SV2-RET-05.
Responsible implementation: agentihooks.
Fixture inputs: Uncommitted upload, active index, foreign lookalike object, and newly referenced checkpoint.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-RET-05.
When: execute the owned behavior described as: Clean abandoned temporary data without racing new attempts or active generations.
Then: Cleanup reclaims failed-upload debris while preserving committed artifacts and the active search generation.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect garbage_collection_bytes and unsafe_delete_rejections with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RET-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
On failure: apply the package containment/rollback rule: Disable destructive phases and continue read-only inventory until the ownership bug is fixed.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RET-05-B: Collect runtime and index garbage safely / rejection and containment

Requirement: SV2-RET-05.
Responsible implementation: agentihooks.
Fixture inputs: Uncommitted upload, active index, foreign lookalike object, and newly referenced checkpoint.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-RET-05 without broadening its grant or replacing the bad input silently.
Then: An object name resembling a managed prefix is not sufficient ownership proof.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect garbage_collection_bytes and unsafe_delete_rejections with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RET-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
On failure: apply the package containment/rollback rule: Disable destructive phases and continue read-only inventory until the ownership bug is fixed.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-RET-05-C: Collect runtime and index garbage safely / recovery and replay

Requirement: SV2-RET-05.
Responsible implementation: agentihooks.
Fixture inputs: Uncommitted upload, active index, foreign lookalike object, and newly referenced checkpoint.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A crash midway through garbage collection can be rerun without deleting already-rebound references.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect garbage_collection_bytes and unsafe_delete_rejections with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-RET-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Data deletion follows explicit retention and reference ownership; migration never fabricates missing evidence.
On failure: apply the package containment/rollback rule: Disable destructive phases and continue read-only inventory until the ownership bug is fixed.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group OPS: Operational runbooks and failure-response procedures

T-SV2-OPS-01-A: Write the controller and dependency outage runbook / successful behavior

Requirement: SV2-OPS-01.
Responsible implementation: antoncore.
Fixture inputs: Separate failure scenarios for ledger, Redis, brain, SSH, and controller process.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-OPS-01.
When: execute the owned behavior described as: Restore coordination without mistaking viewer or dependency failure for worker death.
Then: An operator following the runbook can classify a brain-only outage without restarting all active agents.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect control_outage_classification_time with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OPS-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
On failure: apply the package containment/rollback rule: Return to read-only diagnosis and keep admission paused when authoritative state is uncertain.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OPS-01-B: Write the controller and dependency outage runbook / rejection and containment

Requirement: SV2-OPS-01.
Responsible implementation: antoncore.
Fixture inputs: Separate failure scenarios for ledger, Redis, brain, SSH, and controller process.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-OPS-01 without broadening its grant or replacing the bad input silently.
Then: The runbook never starts a second uncontrolled controller as its first diagnostic step.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect control_outage_classification_time with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OPS-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
On failure: apply the package containment/rollback rule: Return to read-only diagnosis and keep admission paused when authoritative state is uncertain.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OPS-01-C: Write the controller and dependency outage runbook / recovery and replay

Requirement: SV2-OPS-01.
Responsible implementation: antoncore.
Fixture inputs: Separate failure scenarios for ledger, Redis, brain, SSH, and controller process.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Restoring control connectivity reconciles existing workers before any replacement is admitted.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect control_outage_classification_time with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OPS-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
On failure: apply the package containment/rollback rule: Return to read-only diagnosis and keep admission paused when authoritative state is uncertain.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OPS-02-A: Write pending-Pod and ASG diagnosis procedures / successful behavior

Requirement: SV2-OPS-02.
Responsible implementation: antoncore.
Fixture inputs: No-fit memory request, missing toleration, failed node join, and provider shortage.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-OPS-02.
When: execute the owned behavior described as: Locate capacity failures without changing protected pool policy accidentally.
Then: The report identifies whether a canary is blocked by policy, unsatisfiable resources, cloud capacity, or node bootstrap.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect pending_pod_reason_age_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OPS-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
On failure: apply the package containment/rollback rule: Remove only the canary workload and restore any explicitly approved diagnostic configuration.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OPS-02-B: Write pending-Pod and ASG diagnosis procedures / rejection and containment

Requirement: SV2-OPS-02.
Responsible implementation: antoncore.
Fixture inputs: No-fit memory request, missing toleration, failed node join, and provider shortage.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-OPS-02 without broadening its grant or replacing the bad input silently.
Then: Increasing ASG maxima or adding universal tolerations is not an automatic troubleshooting action.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect pending_pod_reason_age_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OPS-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
On failure: apply the package containment/rollback rule: Remove only the canary workload and restore any explicitly approved diagnostic configuration.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OPS-02-C: Write pending-Pod and ASG diagnosis procedures / recovery and replay

Requirement: SV2-OPS-02.
Responsible implementation: antoncore.
Fixture inputs: No-fit memory request, missing toleration, failed node join, and provider shortage.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A failed instance launch can recover under existing bounds without manual desired-capacity resets.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect pending_pod_reason_age_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OPS-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
On failure: apply the package containment/rollback rule: Remove only the canary workload and restore any explicitly approved diagnostic configuration.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OPS-03-A: Write lost-worker and checkpoint recovery procedures / successful behavior

Requirement: SV2-OPS-03.
Responsible implementation: antoncore.
Fixture inputs: Reappearing partitioned worker, corrupt checkpoint, valid older checkpoint, and unsupported native resume.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-OPS-03.
When: execute the owned behavior described as: Guide recovery choices using actual durable evidence and fencing state.
Then: The operator sees a truthful recovery result and can identify exactly what source tail was not durable.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect recovery_manual_decisions_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OPS-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
On failure: apply the package containment/rollback rule: Keep both old diagnostic artifacts and the accepted latest checkpoint while automatic recovery is paused.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OPS-03-B: Write lost-worker and checkpoint recovery procedures / rejection and containment

Requirement: SV2-OPS-03.
Responsible implementation: antoncore.
Fixture inputs: Reappearing partitioned worker, corrupt checkpoint, valid older checkpoint, and unsupported native resume.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-OPS-03 without broadening its grant or replacing the bad input silently.
Then: A stale old worker cannot resume mutations merely because its terminal reappears.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect recovery_manual_decisions_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OPS-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
On failure: apply the package containment/rollback rule: Keep both old diagnostic artifacts and the accepted latest checkpoint while automatic recovery is paused.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OPS-03-C: Write lost-worker and checkpoint recovery procedures / recovery and replay

Requirement: SV2-OPS-03.
Responsible implementation: antoncore.
Fixture inputs: Reappearing partitioned worker, corrupt checkpoint, valid older checkpoint, and unsupported native resume.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A failed restore remains awaiting decision and can be retried with another complete checkpoint safely.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect recovery_manual_decisions_total with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OPS-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
On failure: apply the package containment/rollback rule: Keep both old diagnostic artifacts and the accepted latest checkpoint while automatic recovery is paused.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OPS-04-A: Write brain-isolation and search-quality runbooks / successful behavior

Requirement: SV2-OPS-04.
Responsible implementation: antoncore.
Fixture inputs: Wrong route, empty scoped corpus, delayed embedding, stale receipt, and contradictory lesson.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-OPS-04.
When: execute the owned behavior described as: Diagnose missing or inappropriate memory without broadening access or poisoning knowledge.
Then: An irrelevant context report can be traced to attribution, ranking, stale cache, or bad graph evidence.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect memory_incident_resolution_status with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OPS-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
On failure: apply the package containment/rollback rule: Disable graph expansion or shared caching before disabling source capture.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OPS-04-B: Write brain-isolation and search-quality runbooks / rejection and containment

Requirement: SV2-OPS-04.
Responsible implementation: antoncore.
Fixture inputs: Wrong route, empty scoped corpus, delayed embedding, stale receipt, and contradictory lesson.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-OPS-04 without broadening its grant or replacing the bad input silently.
Then: Fixing an empty result by dropping the project authorization filter is forbidden.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect memory_incident_resolution_status with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OPS-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
On failure: apply the package containment/rollback rule: Disable graph expansion or shared caching before disabling source capture.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OPS-04-C: Write brain-isolation and search-quality runbooks / recovery and replay

Requirement: SV2-OPS-04.
Responsible implementation: antoncore.
Fixture inputs: Wrong route, empty scoped corpus, delayed embedding, stale receipt, and contradictory lesson.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Rebuilding a bad index preserves immutable evidence and restores source references after cutover.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect memory_incident_resolution_status with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OPS-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
On failure: apply the package containment/rollback rule: Disable graph expansion or shared caching before disabling source capture.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OPS-05-A: Write rollback and emergency-stop procedures / successful behavior

Requirement: SV2-OPS-05.
Responsible implementation: antoncore.
Fixture inputs: Two swarms plus unrelated workloads and one execution with an in-flight checkpoint.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-OPS-05.
When: execute the owned behavior described as: Make large-scale containment possible without deleting knowledge or unrelated infrastructure.
Then: A single swarm can be stopped while the local compatibility swarm and unrelated cluster services remain untouched.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect emergency_stop_scope_verification with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OPS-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
On failure: apply the package containment/rollback rule: Retain the prior deployment tuple and restore admission only after the incident acceptance checks pass.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OPS-05-B: Write rollback and emergency-stop procedures / rejection and containment

Requirement: SV2-OPS-05.
Responsible implementation: antoncore.
Fixture inputs: Two swarms plus unrelated workloads and one execution with an in-flight checkpoint.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-OPS-05 without broadening its grant or replacing the bad input silently.
Then: A broad namespace deletion or wildcard process kill is not an approved default step.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect emergency_stop_scope_verification with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OPS-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
On failure: apply the package containment/rollback rule: Retain the prior deployment tuple and restore admission only after the incident acceptance checks pass.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-OPS-05-C: Write rollback and emergency-stop procedures / recovery and replay

Requirement: SV2-OPS-05.
Responsible implementation: antoncore.
Fixture inputs: Two swarms plus unrelated workloads and one execution with an in-flight checkpoint.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Reopening after emergency stop restores tasks through explicit recovery decisions and current credentials.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect emergency_stop_scope_verification with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-OPS-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Runbooks start with diagnosis and scoped containment; destructive actions require explicit target verification.
On failure: apply the package containment/rollback rule: Retain the prior deployment tuple and restore admission only after the incident acceptance checks pass.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group PRF: Performance qualification and useful-memory evaluation

T-SV2-PRF-01-A: Benchmark complete worker resource usage / successful behavior

Requirement: SV2-PRF-01.
Responsible implementation: agentihooks.
Fixture inputs: Representative task suites with controlled child-worker counts.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-PRF-01.
When: execute the owned behavior described as: Size workers from realistic test/build/browser activity rather than idle CLI processes.
Then: The report supports each admitted profile with measured distributions and a coexistence result.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect worker_process_tree_peak_memory with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-PRF-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
On failure: apply the package containment/rollback rule: Restore previous profile limits and lower admission while new measurements are gathered.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-PRF-01-B: Benchmark complete worker resource usage / rejection and containment

Requirement: SV2-PRF-01.
Responsible implementation: agentihooks.
Fixture inputs: Representative task suites with controlled child-worker counts.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-PRF-01 without broadening its grant or replacing the bad input silently.
Then: An idle CLI RSS sample cannot justify a large fleet concurrency claim.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect worker_process_tree_peak_memory with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-PRF-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
On failure: apply the package containment/rollback rule: Restore previous profile limits and lower admission while new measurements are gathered.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-PRF-01-C: Benchmark complete worker resource usage / recovery and replay

Requirement: SV2-PRF-01.
Responsible implementation: agentihooks.
Fixture inputs: Representative task suites with controlled child-worker counts.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Re-running after a target CLI or toolchain update detects material resource changes before promotion.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect worker_process_tree_peak_memory with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-PRF-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
On failure: apply the package containment/rollback rule: Restore previous profile limits and lower admission while new measurements are gathered.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-PRF-02-A: Benchmark cold launch and scaling stages / successful behavior

Requirement: SV2-PRF-02.
Responsible implementation: agentihooks.
Fixture inputs: Warm node, cold node, uncached image, and registry interruption.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-PRF-02.
When: execute the owned behavior described as: Attribute startup delays to image, Pod, instance, and join phases separately.
Then: The report distinguishes node-provision delay from worker-image initialization delay.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect startup_stage_p50_p95 with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-PRF-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
On failure: apply the package containment/rollback rule: Use the previous qualified image and reduce launch concurrency.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-PRF-02-B: Benchmark cold launch and scaling stages / rejection and containment

Requirement: SV2-PRF-02.
Responsible implementation: agentihooks.
Fixture inputs: Warm node, cold node, uncached image, and registry interruption.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-PRF-02 without broadening its grant or replacing the bad input silently.
Then: A warm-cache test cannot be advertised as cold scale-from-zero performance.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect startup_stage_p50_p95 with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-PRF-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
On failure: apply the package containment/rollback rule: Use the previous qualified image and reduce launch concurrency.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-PRF-02-C: Benchmark cold launch and scaling stages / recovery and replay

Requirement: SV2-PRF-02.
Responsible implementation: agentihooks.
Fixture inputs: Warm node, cold node, uncached image, and registry interruption.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Repeating with an unavailable image registry shows bounded classified failures and no leaked account reservations.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect startup_stage_p50_p95 with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-PRF-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
On failure: apply the package containment/rollback rule: Use the previous qualified image and reduce launch concurrency.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-PRF-03-A: Benchmark capture and retrieval under swarm load / successful behavior

Requirement: SV2-PRF-03.
Responsible implementation: agentihooks.
Fixture inputs: Concurrent growing transcripts with duplicate delivery and restricted project queries.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-PRF-03.
When: execute the owned behavior described as: Ensure source durability and search remain usable during concurrent session growth.
Then: The pipeline keeps acknowledged evidence complete under the accepted workload and reports any lag explicitly.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect ingest_ack_latency_seconds and search_latency_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-PRF-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
On failure: apply the package containment/rollback rule: Lower ingest concurrency or pause optional embeddings while retaining durable capture.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-PRF-03-B: Benchmark capture and retrieval under swarm load / rejection and containment

Requirement: SV2-PRF-03.
Responsible implementation: agentihooks.
Fixture inputs: Concurrent growing transcripts with duplicate delivery and restricted project queries.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-PRF-03 without broadening its grant or replacing the bad input silently.
Then: Dropping records to meet latency targets is a correctness failure.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect ingest_ack_latency_seconds and search_latency_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-PRF-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
On failure: apply the package containment/rollback rule: Lower ingest concurrency or pause optional embeddings while retaining durable capture.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-PRF-03-C: Benchmark capture and retrieval under swarm load / recovery and replay

Requirement: SV2-PRF-03.
Responsible implementation: agentihooks.
Fixture inputs: Concurrent growing transcripts with duplicate delivery and restricted project queries.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: After overload ends, backlogs drain without re-embedding unchanged history.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect ingest_ack_latency_seconds and search_latency_seconds with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-PRF-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
On failure: apply the package containment/rollback rule: Lower ingest concurrency or pause optional embeddings while retaining durable capture.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-PRF-04-A: Evaluate brain context usefulness on held-out tasks / successful behavior

Requirement: SV2-PRF-04.
Responsible implementation: agentihooks.
Fixture inputs: Held-out incident, prior design decision, unrelated hot arc, and superseded guidance cases.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-PRF-04.
When: execute the owned behavior described as: Measure relevance and avoided repeated mistakes rather than the number of brain tool calls.
Then: Graph expansion improves retrieval of the expected connected lesson without increasing scope leakage or irrelevant injection.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect context_source_recall and reviewed_usefulness with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-PRF-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
On failure: apply the package containment/rollback rule: Restore the last accepted ranking and packing policy.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-PRF-04-B: Evaluate brain context usefulness on held-out tasks / rejection and containment

Requirement: SV2-PRF-04.
Responsible implementation: agentihooks.
Fixture inputs: Held-out incident, prior design decision, unrelated hot arc, and superseded guidance cases.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-PRF-04 without broadening its grant or replacing the bad input silently.
Then: More retrieved arcs or more tokens alone cannot qualify the new policy.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect context_source_recall and reviewed_usefulness with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-PRF-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
On failure: apply the package containment/rollback rule: Restore the last accepted ranking and packing policy.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-PRF-04-C: Evaluate brain context usefulness on held-out tasks / recovery and replay

Requirement: SV2-PRF-04.
Responsible implementation: agentihooks.
Fixture inputs: Held-out incident, prior design decision, unrelated hot arc, and superseded guidance cases.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Reverting a ranking policy produces reproducible comparisons against the same corpus revision.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect context_source_recall and reviewed_usefulness with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-PRF-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
On failure: apply the package containment/rollback rule: Restore the last accepted ranking and packing policy.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-PRF-05-A: Qualify gate overhead and rollout concurrency / successful behavior

Requirement: SV2-PRF-05.
Responsible implementation: agentihooks.
Fixture inputs: Small staged cohorts with an intentionally slowed brain and archive backend.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-PRF-05.
When: execute the owned behavior described as: Define a safe measured operating envelope for the first distributed release.
Then: The accepted cohort has measured overhead, resource headroom, and no hard correctness failures.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect qualified_concurrency and hook_latency_p95 with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-PRF-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
On failure: apply the package containment/rollback rule: Return to the preceding qualified cohort size and observe mode for consultation gates.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-PRF-05-B: Qualify gate overhead and rollout concurrency / rejection and containment

Requirement: SV2-PRF-05.
Responsible implementation: agentihooks.
Fixture inputs: Small staged cohorts with an intentionally slowed brain and archive backend.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-PRF-05 without broadening its grant or replacing the bad input silently.
Then: Passing a synthetic hundred-session ingestion test does not authorize a hundred live provider agents.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect qualified_concurrency and hook_latency_p95 with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-PRF-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
On failure: apply the package containment/rollback rule: Return to the preceding qualified cohort size and observe mode for consultation gates.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-PRF-05-C: Qualify gate overhead and rollout concurrency / recovery and replay

Requirement: SV2-PRF-05.
Responsible implementation: agentihooks.
Fixture inputs: Small staged cohorts with an intentionally slowed brain and archive backend.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A dependency slowdown causes bounded waiting instead of multiplying retries and reservations.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect qualified_concurrency and hook_latency_p95 with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-PRF-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Performance targets are experiments; no concurrency or latency claim is accepted without a reproducible measurement.
On failure: apply the package containment/rollback rule: Return to the preceding qualified cohort size and observe mode for consultation gates.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

Conformance group REL: Cross-repository release, acceptance, and final closure

T-SV2-REL-01-A: Publish the cross-repository compatibility matrix / successful behavior

Requirement: SV2-REL-01.
Responsible implementation: agentihooks.
Fixture inputs: One accepted tuple, one unsupported brain schema, and one changed image digest under the same tag.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-REL-01.
When: execute the owned behavior described as: Tie controller, image, hook, brain, and deployment versions into accepted tuples.
Then: An operator can identify a fully tested deployment tuple and its rollback tuple without inferring compatibility from matching tag names.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect incompatible_deployment_tuples with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-REL-01/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
On failure: apply the package containment/rollback rule: Select the last accepted tuple with current data compatibility explicitly checked.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-REL-01-B: Publish the cross-repository compatibility matrix / rejection and containment

Requirement: SV2-REL-01.
Responsible implementation: agentihooks.
Fixture inputs: One accepted tuple, one unsupported brain schema, and one changed image digest under the same tag.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-REL-01 without broadening its grant or replacing the bad input silently.
Then: A floating dev tag alone is not sufficient release evidence.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect incompatible_deployment_tuples with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-REL-01/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
On failure: apply the package containment/rollback rule: Select the last accepted tuple with current data compatibility explicitly checked.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-REL-01-C: Publish the cross-repository compatibility matrix / recovery and replay

Requirement: SV2-REL-01.
Responsible implementation: agentihooks.
Fixture inputs: One accepted tuple, one unsupported brain schema, and one changed image digest under the same tag.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A patch release requalifies affected interfaces without resetting unrelated acceptance history.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect incompatible_deployment_tuples with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-REL-01/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
On failure: apply the package containment/rollback rule: Select the last accepted tuple with current data compatibility explicitly checked.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-REL-02-A: Complete migration and policy documentation / successful behavior

Requirement: SV2-REL-02.
Responsible implementation: agentihooks.
Fixture inputs: Fresh-reader walkthrough using only the repository and published compatibility artifacts.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-REL-02.
When: execute the owned behavior described as: Make the implementation maintainable by agents and humans after the original conversation is gone.
Then: A fresh implementation agent can run the supported test and diagnostic paths without relying on hidden chat context.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect documentation_contract_drift with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-REL-02/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
On failure: apply the package containment/rollback rule: Restore the last correct guide while retaining a visible erratum for any unsafe instruction.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-REL-02-B: Complete migration and policy documentation / rejection and containment

Requirement: SV2-REL-02.
Responsible implementation: agentihooks.
Fixture inputs: Fresh-reader walkthrough using only the repository and published compatibility artifacts.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-REL-02 without broadening its grant or replacing the bad input silently.
Then: Unimplemented example commands are not silently presented as available features.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect documentation_contract_drift with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-REL-02/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
On failure: apply the package containment/rollback rule: Restore the last correct guide while retaining a visible erratum for any unsafe instruction.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-REL-02-C: Complete migration and policy documentation / recovery and replay

Requirement: SV2-REL-02.
Responsible implementation: agentihooks.
Fixture inputs: Fresh-reader walkthrough using only the repository and published compatibility artifacts.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Documentation updates preserve stable package and evidence IDs for existing issue links.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect documentation_contract_drift with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-REL-02/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
On failure: apply the package containment/rollback rule: Restore the last correct guide while retaining a visible erratum for any unsafe instruction.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-REL-03-A: Perform final target-architecture dependency audit / successful behavior

Requirement: SV2-REL-03.
Responsible implementation: agentihooks.
Fixture inputs: Accepted deployment inventory plus injected hidden fallback and duplicated scheduler examples.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-REL-03.
When: execute the owned behavior described as: Verify the three-repository design has not accumulated hidden runtime dependencies during implementation.
Then: The target deployment runs with only the accepted components and the documented optional infrastructure integrations.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect unapproved_runtime_dependencies with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-REL-03/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
On failure: apply the package containment/rollback rule: Disable the unapproved component path and keep the last qualified architecture tuple.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-REL-03-B: Perform final target-architecture dependency audit / rejection and containment

Requirement: SV2-REL-03.
Responsible implementation: agentihooks.
Fixture inputs: Accepted deployment inventory plus injected hidden fallback and duplicated scheduler examples.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-REL-03 without broadening its grant or replacing the bad input silently.
Then: A second hidden coding-task queue or legacy endpoint fallback blocks final acceptance.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect unapproved_runtime_dependencies with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-REL-03/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
On failure: apply the package containment/rollback rule: Disable the unapproved component path and keep the last qualified architecture tuple.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-REL-03-C: Perform final target-architecture dependency audit / recovery and replay

Requirement: SV2-REL-03.
Responsible implementation: agentihooks.
Fixture inputs: Accepted deployment inventory plus injected hidden fallback and duplicated scheduler examples.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Restoring from the release backup reproduces the same dependency inventory.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect unapproved_runtime_dependencies with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-REL-03/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
On failure: apply the package containment/rollback rule: Disable the unapproved component path and keep the last qualified architecture tuple.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-REL-04-A: Collect operator acceptance and recovery proof / successful behavior

Requirement: SV2-REL-04.
Responsible implementation: agentihooks.
Fixture inputs: Recorded operator walkthrough with two projects, two harnesses, and one recovery scenario.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-REL-04.
When: execute the owned behavior described as: Connect implementation results to every operator requirement from this plan.
Then: The operator can verify each section-18 outcome from concrete evidence and explicit limitations.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect operator_acceptance_requirements_passed with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-REL-04/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
On failure: apply the package containment/rollback rule: Keep rollout at the last accepted gate rather than declaring a broader release.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-REL-04-B: Collect operator acceptance and recovery proof / rejection and containment

Requirement: SV2-REL-04.
Responsible implementation: agentihooks.
Fixture inputs: Recorded operator walkthrough with two projects, two harnesses, and one recovery scenario.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-REL-04 without broadening its grant or replacing the bad input silently.
Then: A partially implemented graph or unqualified native resume path must remain marked incomplete.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect operator_acceptance_requirements_passed with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-REL-04/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
On failure: apply the package containment/rollback rule: Keep rollout at the last accepted gate rather than declaring a broader release.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-REL-04-C: Collect operator acceptance and recovery proof / recovery and replay

Requirement: SV2-REL-04.
Responsible implementation: agentihooks.
Fixture inputs: Recorded operator walkthrough with two projects, two harnesses, and one recovery scenario.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: Failed acceptance leaves the working local swarm and last qualified remote path available.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect operator_acceptance_requirements_passed with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-REL-04/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
On failure: apply the package containment/rollback rule: Keep rollout at the last accepted gate rather than declaring a broader release.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-REL-05-A: Close the plan implementation and hand over maintenance / successful behavior

Requirement: SV2-REL-05.
Responsible implementation: agentihooks.
Fixture inputs: Completed evidence registry plus deliberately unresolved mandatory native-recovery and scope tests.
Given: the accepted dependency contracts are loaded and the fixture starts without pre-existing successful output for SV2-REL-05.
When: execute the owned behavior described as: Finish with explicit owners, budgets, support boundaries, and future work separated from mandatory scope.
Then: The implementation tracker links the accepted plan revision, release tuple, known limitations, and maintenance runbooks.
State assertion: compare accepted output with the authoritative store or observed runtime, not only the return code.
Boundary assertion: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
Repeat assertion: run a second independent fixture to prove success does not depend on leaked state from the first.
Observation: collect release_acceptance_state with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-REL-05/a-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
On failure: apply the package containment/rollback rule: Reopen the tracker and restore the prior accepted deployment tuple without deleting accumulated evidence.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-REL-05-B: Close the plan implementation and hand over maintenance / rejection and containment

Requirement: SV2-REL-05.
Responsible implementation: agentihooks.
Fixture inputs: Completed evidence registry plus deliberately unresolved mandatory native-recovery and scope tests.
Given: the fixture includes the conflicting, unauthorized, absent, stale, or unsupported condition named by the package rejection contract.
When: request the affected operation at the interface owned by SV2-REL-05 without broadening its grant or replacing the bad input silently.
Then: Merely committing Swarm-v2.md or creating the issue cannot mark implementation complete.
State assertion: snapshot protected state before the request and prove the rejected path did not mutate it.
Disclosure assertion: errors and diagnostics do not reveal secret values or information outside the caller scope.
Recovery isolation: correcting the rejected input must require a new valid request, not an implicit privileged fallback.
Observation: collect release_acceptance_state with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-REL-05/b-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
On failure: apply the package containment/rollback rule: Reopen the tracker and restore the prior accepted deployment tuple without deleting accumulated evidence.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

T-SV2-REL-05-C: Close the plan implementation and hand over maintenance / recovery and replay

Requirement: SV2-REL-05.
Responsible implementation: agentihooks.
Fixture inputs: Completed evidence registry plus deliberately unresolved mandatory native-recovery and scope tests.
Given: one package operation has reached a documented intermediate state and its accepted state is captured.
When: interrupt execution or transport at the stated recovery boundary, then restore the dependency or restart the owning process.
Then: A later regression reopens the affected acceptance gate and references the original stable requirement IDs.
Replay assertion: retry with the same operation identity where defined and verify no duplicate authoritative effect.
Ownership assertion: an earlier attempt, stale cursor, or outdated revision cannot overwrite a newer accepted result.
Durability assertion: record what survived and what did not; missing source material is never replaced by a success label.
Observation: collect release_acceptance_state with fixture-local dimensions and redact high-sensitivity content.
Evidence output: evidence/SV2-REL-05/c-result.json and a fixture manifest containing input hashes and tested commit.
Timing control: use a fake clock for expiry and lease cases; document measured time separately in live canaries.
Cleanup: remove only objects identified by this fixture run; respect the boundary: Close the implementation only after end-to-end evidence, not after code merge or plan publication alone.
On failure: apply the package containment/rollback rule: Reopen the tracker and restore the prior accepted deployment tuple without deleting accumulated evidence.
Acceptance rule: assertions must pass independently; a successful later retry does not erase an earlier scope or data-loss violation.

22. Versioned record and storage contracts

This appendix specifies the proposed v2 interchange contracts in more detail. It is not a claim that these fields or endpoints already exist in the inspected branches. The implementation may relocate modules, but a wire-contract change requires a compatibility decision. JSON examples use synthetic names, identities, and timestamps. No example contains a deployable credential or an operational network address.

22.1 Envelope shared by machine-facing records

Every durable record carries schema_version, identifying a semantic schema version rather than a package version. A schema major version changes only when an old consumer cannot safely interpret the record. A schema minor version may add optional fields with documented defaults. Unknown optional fields must survive a read-modify-write cycle when the consumer acts as a relay. An unknown field must not silently become authorization context. An unknown required capability causes a typed incompatibility response before a worker starts. Each record carries a globally unique record identity within its owning storage domain. The published wire schemas in docs/swarm-v2/schemas/ carry every authority field inside a closed authority object; the field tables and examples in this appendix list field sets, not wire layout. Timestamp fields use UTC with an explicit zone. Lease decisions use server time; clients cannot extend authority by supplying a future timestamp. A display timestamp is not an ordering or concurrency-control primitive. A record may include a trace correlation identifier, but that identifier grants no access. Content hashes identify exact bytes after the documented canonicalization step. A content hash is not sufficient to prove ownership, attribution, or trust. All identifiers are validated before being interpolated into paths, labels, SQL, or URLs. Database statements remain parameterized even after identifier validation. URLs in returned data are validated against the destination policy before a consumer follows them.

22.2 ProjectIdentity

project_id is the stable authorization and retrieval key. For a supported GitHub repository, the preferred canonical form is github.com/<owner>/<repository>. The implementation records the provider and repository identifier separately so repository renames can be tracked. A bare local folder gets an explicitly registered local project identifier, not a guessed remote repository. A short name such as agentihooks is a display value, not the only unique key. Git worktrees resolve to their common repository identity. A fork remains a distinct repository unless an operator-approved relation explicitly connects it to an upstream repository. Repository aliases are a migration aid and never automatically widen access. Unknown historical identity is represented explicitly instead of guessing from semantic similarity.

Field	Type	Required	Validation and meaning
schema_version	string	yes	Accepted ProjectIdentity schema major.
project_id	string	yes for scoped records	Canonical stable key or explicit unknown state.
display_name	string	yes	Human-facing repository or local-project name.
provider	enum	yes	`github`, `git`, `local`, or `unknown`.
repository_uid	string or null	conditional	Provider-issued immutable ID when available.
remote_canonical	string or null	conditional	Credential-free normalized remote.
checkout_root	string or null	capture only	Local provenance, not a remote lookup path.
common_git_dir	string or null	capture only	Local evidence that linked worktrees share a repository.
worktree_id	string or null	optional	Execution-local worktree identity.
cwd	string or null	optional	Source working directory, classified as potentially private metadata.
git_branch	string or null	optional	Branch at the event, not a permanent session-wide truth.
git_commit	string or null	optional	Source revision when observed.
resolver_version	string	yes	Version of the deterministic identity resolver.
resolution_evidence	array	yes	Explicit binding, repository metadata, registered alias, or unresolved reason.
observed_at	timestamp	yes	Capture timestamp, not lease authority.

A project transition inside a running session creates a new observation. It does not rewrite earlier transcript records to the new project. Multi-repository work creates explicit relations between the relevant project identities. A single task may reference several repositories, but each write still has an exact repository target. Historical aliases are retained so earlier evidence stays discoverable after a repository rename. Aliases are not accepted from arbitrary worker text.

22.3 ExecutionAttempt

An execution attempt is the unit that owns a runtime incarnation. A seat can have many attempts over time. A task can have successive generations after a controlled handoff or recovery. The permanent task identifier and the ephemeral attempt identifier must remain separate.

{
  "schema_version": "2.0",
  "execution_id": "exe-synthetic-0007",
  "swarm_id": "swarm-v2-buildout",
  "task_id": "implement-session-ingestion",
  "task_generation": 3,
  "controller_epoch": 12,
  "seat_id": "eng-2",
  "agent_name": "engineer@a1b2c3-0007",
  "runtime_backend": "kubernetes",
  "runtime_profile": "general",
  "harness": "codex",
  "project_id": "github.com/the-cloud-clockwork/agentihooks",
  "state": "admitted",
  "pod_namespace": "swarm-workers",
  "pod_name": "swarm-a1b2c3-0007",
  "pod_uid": null,
  "image_digest": "sha256:<qualified-image-digest>",
  "launch_spec_digest": "sha256:<canonical-launch-spec-digest>",
  "credential_ref": "execution-scoped-reference",
  "brain_id": "swarm",
  "created_at": "2026-10-08T08:00:00Z"
}

The controller writes execution_id before creating the Pod. The Pod carries that identity in controller-owned labels or annotations. A retry first searches for the same execution identity. A discovered Pod must have a matching immutable launch specification before adoption. A Pod with a matching name but different UID or launch digest is not the same attempt. Store the Pod UID immediately after a successful create or reconciliation read. Do not consider an attempt working merely because its Pod is Running. The worker must register, prove its launch binding, and obtain current authority. The controller records the qualified image digest, not only a mutable image tag. An execution record never contains a provider token value. The account identity is an opaque routing identifier with an execution-scoped credential reference. The human agent name remains compatible with current naming and alias rules. The herdr-safe name is a presentation adapter, not a replacement for the canonical agent name.

22.4 ExecutionLease

Field	Type	Required	Rule
execution_id	string	yes	Bound to the registered attempt.
task_id	string	yes	Bound to the admitted task.
generation	positive integer	yes	Monotonically advances for replacement authority.
controller_epoch	positive integer	yes	Identifies the current leadership incarnation.
owner_identity	string	yes	Authenticated worker identity, not an arbitrary agent label.
acquired_at	server timestamp	yes	Set by the authority service.
expires_at	server timestamp	yes	Expiry enforced by the authority service.
renewal_sequence	integer	yes	Reject an older renewal observation.
admission_state	enum	yes	`active`, `draining`, `revoked`, or `expired`.
allowed_operations	set	yes	Allowed operation classes for this attempt.
credential_generation	integer	yes	Allows revocation during replacement.

Use an atomic compare-and-update operation to renew a lease. A client timestamp cannot replace the server expiry calculation. The release operation verifies both owner identity and generation before removing a claim. A former owner must not be able to release a successor’s claim. Leadership replacement and task replacement are separate events with separate counters. An expired controller lease prevents admission of new work until leadership is re-established. An uncertain network state prevents starting a replacement writer unless the old authority is fenced. A stale worker may still consume CPU or call an external service with already-issued credentials. Therefore the implementation must combine cooperative worker shutdown with scoped credential revocation and protected mutation endpoints. Do not advertise exactly-once behavior for arbitrary shell commands or third-party API effects. For protected ledger transitions, enforce generation at the service boundary. For protected repository merge actions, enforce generation in the merge path rather than trusting the agent’s prose. For filesystem edits, keep every attempt in an isolated workspace so an abandoned writer cannot edit a successor’s files.

22.5 SessionManifest

The manifest belongs to the evidence domain, not to a live-process registry. It outlives the worker and can outlive the task. It records where evidence came from and how complete the retained record is.

Field	Type	Required	Rule
session_uid	string	yes	Internal globally unique session identity.
native_session_id	string	yes	Harness-native conversation identity.
harness	enum	yes	Supported provider adapter identifier.
source_host_id	string	yes	Stable collector host identity; no IP required.
source_generation	string	yes	Changes on truncation, replacement, or incompatible source rewrite.
parent_session_uid	string or null	optional	Explicit parent-child session lineage.
resumed_from_session_uid	string or null	optional	Resume lineage, not copied transcript duplication.
execution_id	string or null	conditional	Required for managed swarm execution.
agent_name	string or null	optional	Source actor label at the time.
swarm_id	string or null	optional	Swarm affiliation.
task_id	string or null	optional	Task affiliation.
project_observations	array	yes	Versioned identity observations for this session.
first_event_at	timestamp or null	optional	Earliest retained source event.
last_event_at	timestamp or null	optional	Latest retained source event.
captured_through	cursor	yes	Last source position read successfully.
durable_through	cursor	yes	Last source position acknowledged durably.
indexed_through	cursor	yes	Last source position available in search.
completeness	enum	yes	`complete`, `partial`, `metadata_only`, or `unknown`.
missing_ranges	array	yes	Known gaps, including the evidence for each gap.
retention_class	string	yes	Applied retention policy identifier.
access_scope	object	yes	Enforced read/write policy binding.
raw_archive_ref	object or null	conditional	Durable native-source reference when retained.
normalized_archive_ref	object or null	conditional	Durable normalized record reference.
normalization_version	string	yes	Exact normalizer version.
redaction_policy_version	string	yes	Redaction applied before indexing.

A transcript retained only as a preview is partial or metadata_only. Do not label it complete because a vector exists. A manifest with no retained raw body must not claim native resumability. The source host identifier must not be a mutable hostname alone when cloned worker images can share that name. Assign fresh collector identity at runtime, never bake it into the image.

22.6 NormalizedEvent

The normalized event model preserves the distinction between human input, agent output, tool interactions, and injected context. Tool results may contain untrusted remote content and must retain that provenance. A system-looking string inside a tool result is not a system instruction. The normalized model supports incremental reading without loading the whole source file.

Field	Type	Required	Rule
event_id	string	yes	Stable identity across ingestion retries.
session_uid	string	yes	Parent session manifest.
source_generation	string	yes	Disambiguates replaced or truncated source files.
native_event_id	string or null	optional	Original ID where available.
sequence	integer	yes	Stable normalized sequence inside the source generation.
byte_start	integer	conditional	Original source range start where meaningful.
byte_end	integer	conditional	Original source range end, exclusive.
line_start	integer or null	optional	Human-readable source locator.
line_end	integer or null	optional	Human-readable source locator.
kind	enum	yes	Human, assistant, tool call, tool result, metadata, usage, or control event.
timestamp	timestamp or null	optional	Native timestamp when present.
parent_event_id	string or null	optional	Causal relation for messages or child events.
tool_call_id	string or null	optional	Joins the request and response for one tool invocation.
payload	object	yes	Validated normalized payload.
original_hash	string	yes	Hash of retained original bytes or explicit unavailable state.
normalized_hash	string	yes	Hash after deterministic normalization.
trust_class	enum	yes	Human instruction, agent assertion, tool observation, injected memory, or derived summary.
project_id	string or null	optional	Exact project at the event.
redaction	object	yes	Redaction status and policy, without secret values.

Do not use display text as the only event identity. Identical output appearing twice can be two different real events. Conversely, the same native event replayed after a transport failure must not be stored twice. The Codex completion summary fallback must not duplicate a message already retained for the same turn. A chunk boundary must not turn injected memory into an apparent new operator request. Parent-child references are nullable during out-of-order arrival and reconciled deterministically later. An unresolved parent is observable; it does not justify dropping the child event.

22.7 Transcript ingestion transaction

The ingestion server receives a manifest binding, one or more source segments, and a batch identity. The batch identity is stable across retries of the same segment set. The server validates scope before accepting any archive upload reference. The server verifies segment content hashes before advancing a durable cursor. Acknowledgement happens only after the durable archive and catalog commit meet the configured durability contract. Embedding completion is not required for durable acknowledgement. An ingestion acknowledgement and an indexing acknowledgement are separate values. The client may discard a local spool segment only after receiving a durable acknowledgement for that segment. A lost response causes idempotent retry with the same batch identity. A repeated batch with different bytes is a conflict, not an update. A source generation change starts a new sequence namespace and does not overwrite the preceding archive. A partially written final JSONL line remains buffered until it is complete or explicitly recorded as unrecoverable. An invalid line is quarantined with its source range and reason; following valid lines remain eligible. An oversized event uses an archive reference and bounded metadata rather than silent truncation. The server must expose known gaps to both retrieval and the brain extraction consumer.

{
  "schema_version": "2.0",
  "batch_id": "batch-synthetic-0042",
  "session_uid": "session-synthetic-0007",
  "source_generation": "generation-synthetic-01",
  "cursor_before": {"sequence": 119, "byte_offset": 24000},
  "cursor_after": {"sequence": 125, "byte_offset": 25800},
  "segments": [
    {
      "object_ref": "archive://swarm/session-synthetic-0007/segment-0042",
      "sha256": "<segment-sha256>",
      "record_count": 6,
      "byte_count": 1800
    }
  ]
}

The server derives brain_id, principal, and allowed project scopes from the authenticated execution binding. A caller-supplied scope field may narrow a request but must never broaden the binding. The example object reference is a logical reference, not an instruction to fetch an arbitrary URL.

22.8 TranscriptChunk

Chunk identity is derived from stable event identities, source generation, chunker version, and content digest. It is not derived only from a sliding integer offset in the newest retained Redis window. A chunk references the original retained record ranges. The search index can be rebuilt from archives and catalog data without invoking a coding agent. A chunk’s embedding model and dimension are versioned explicitly. Changing embedding model does not delete the canonical transcript. A dimension migration uses a new index generation and a qualified read cutover. Chunk text can be shorter than the source body, but the source remains retrievable with its completeness status. A summary is a derived document linked to its supporting chunks. Search returns excerpt boundaries and source references rather than inventing an exact quote from a summary.

Field	Type	Required	Rule
chunk_id	string	yes	Stable identity under the declared chunker.
session_uid	string	yes	Parent session.
first_event_id	string	yes	Inclusive first supporting event.
last_event_id	string	yes	Inclusive last supporting event.
source_generation	string	yes	Source generation.
project_id	string or null	yes	Exact scope or explicit unattributed state.
brain_id	string	yes	Evidence-domain scope binding.
event_kinds	set	yes	Types included in this chunk.
text	string or reference	yes	Indexed representation after redaction.
content_digest	string	yes	Digest of indexed representation.
chunker_version	string	yes	Boundary algorithm version.
embedding_model	string	yes when embedded	Model identity, not only provider alias.
embedding_dimension	integer	yes when embedded	Validated dimension.
index_generation	string	yes	Qualified vector-index generation.
first_event_at	timestamp or null	optional	Source interval start.
last_event_at	timestamp or null	optional	Source interval end.
completeness	enum	yes	Inherited and refined completeness status.

22.9 Search response contract

Search applies authorization and exact project filters before ranking and before returning counts or snippets. Semantic similarity is a retrieval score, not factual confidence. Keyword and semantic branches use the same authorization scope. The caller can request a time window, harness, task, swarm, and project without relying on text substring matching. Session diversity is a presentation option; it must not permanently hide multiple distinct useful passages in one session. Every result supplies a stable source locator that can be opened without accessing the original worker filesystem. A result from incomplete evidence explicitly says so. A search with no matches is successful empty retrieval, not a reason to search another brain automatically.

{
  "schema_version": "2.0",
  "query_id": "query-synthetic-0019",
  "scope": {
    "brain_id": "swarm",
    "project_id": "github.com/the-cloud-clockwork/agentihooks"
  },
  "index_generation": "session-index-qualified-01",
  "results": [
    {
      "session_uid": "session-synthetic-0007",
      "chunk_id": "chunk-synthetic-0031",
      "harness": "codex",
      "score": 0.82,
      "score_kind": "cosine_similarity",
      "excerpt": "Synthetic example of a previously verified routing constraint.",
      "record_range": {"first_event_id": "event-120", "last_event_id": "event-125"},
      "completeness": "complete",
      "source_ref": "session://session-synthetic-0007/events/event-120..event-125"
    }
  ],
  "next_cursor": null,
  "warnings": []
}

The numeric score above is illustrative, not a proposed acceptance threshold. Ranking thresholds are qualified on the retrieval evaluation set. The read endpoint rechecks scope even when the reference came from a prior authorized search. A withdrawn grant can invalidate an older result reference.

22.10 CheckpointManifest

A complete checkpoint is a manifest that points to verified artifacts and their restore requirements. A partly uploaded checkpoint never becomes the latest complete checkpoint. Uploading the manifest last is the proposed commit convention. The manifest itself receives a content hash and immutable generation.

Field	Type	Required	Rule
checkpoint_id	string	yes	Immutable checkpoint identity.
execution_id	string	yes	Source attempt.
task_generation	integer	yes	Source write authority generation.
checkpoint_sequence	integer	yes	Monotonic within the source attempt.
created_at	timestamp	yes	Checkpoint capture time.
committed_at	server timestamp or null	yes	Set only when all required objects verify.
status	enum	yes	`preparing`, `uploading`, `complete`, or `rejected`.
quiescence_method	enum	yes	Harness-supported snapshot, stopped process, consistent export, or partial capture.
native_resume_capability	enum	yes	Qualified, unsupported, or unverified.
native_harness_version	string	conditional	Needed for native restore compatibility.
native_session_id	string or null	conditional	Conversation to restore.
project_id	string	yes	Exact source repository.
base_commit	string	yes	Git base required for reconstruction.
head_commit	string	yes	Source branch head.
branch_name	string	yes	Agent branch with validated ownership.
staged_patch_ref	object or null	optional	Staged changes not included in a committed Git object.
unstaged_patch_ref	object or null	optional	Unstaged tracked-file changes.
untracked_archive_ref	object or null	optional	Allowlisted untracked material.
git_bundle_ref	object or null	conditional	Required when commits are not durably reachable elsewhere.
native_session_artifacts	array	conditional	Harness-specific material required for qualified native resume.
transcript_durable_cursor	cursor	yes	Evidence safely retained at capture time.
handoff_ref	object or null	optional	Human-readable task state and next action.
dependencies_manifest	object	yes	Toolchain and lockfile reconstruction information.
artifact_hashes	object	yes	Hashes and sizes of referenced objects.
exclusions	array	yes	Secrets, caches, unsupported state, and explicit gaps.
restore_constraints	array	yes	Version, account, path, and format requirements.

Do not archive environment-variable dumps. Do not include all account authentication stores in a native session archive. Do not assume that copying a live SQLite file produces a consistent database snapshot. Use the supported backup/export method or an explicitly quiesced capture. A restore requiring unavailable credentials must stop at an operator-visible decision. A native session failure must not silently turn into a fresh task execution. The restored agent rereads authoritative task state before performing a write. The controller allocates a new execution identity and generation for replacement execution. Restored conversation identity and new runtime identity are deliberately different concepts.

22.11 Brain record scope and evidence

Every knowledge entry has an exact brain_id. Project-scoped knowledge additionally has a canonical project_id or explicit project set. An entry marked fleet-wide still belongs to one brain instance unless a deliberate sharing rule exports it. An entry’s source actor is not its authorization scope. Every inferred claim retains supporting evidence references and derivation metadata. The provenance distinguishes operator decisions, tool observations, agent conclusions, and model synthesis. A model-generated interpretation never silently overwrites the operator’s explicit decision. Evidence unavailable after a retention event is represented as missing, not substituted with a similar session.

Field	Type	Rule
knowledge_id	string	Stable entry ID.
brain_id	string	Owning brain instance.
project_ids	array	Exact authorized project associations.
visibility	enum	Project, shared-infrastructure, or operator-private policy.
knowledge_kind	enum	Arc, lesson, decision, signal, reference, or synthesis.
status	enum	Kind-specific lifecycle with explicit supersession.
title	string	Display name, not the sole embedding input.
body_ref	object	Full-body durable location.
evidence_refs	array	Exact session ranges, code revisions, artifacts, or operator statements.
derived_from	array	Previous knowledge entries used in synthesis.
derivation_version	string or null	Extraction or synthesis algorithm version.
author_principal	string	Recorded source author.
approved_by	string or null	Approval authority where the lifecycle requires it.
last_verified_at	timestamp or null	Independent verification time.
revision	integer	Concurrency and cache invalidation version.
superseded_by	array	Explicit successor entries.
sensitivity	enum	Data-handling category.

22.12 Edge contract

An edge is a first-class, directional relation with evidence. Do not treat graph topology as a substitute for project authorization. A graph walk checks permission at every visited vertex and every returned relationship. An edge pointing at a hidden node must not reveal the hidden title or identifier in an error. The initial implementation supports the existing relation vocabulary and explicit evidence links. Adding relations such as contradicts requires documented semantics and traversal tests.

Field	Type	Rule
edge_id	string	Stable edge identity.
brain_id	string	Owning brain.
source_id	string	Exact source knowledge entry.
target_id	string	Exact target knowledge entry.
relation	enum	Parent, child, sibling, unblocks, supersedes, related, or approved extension.
direction	enum	Explicit directional semantics; never guessed from list order.
evidence_refs	array	Why this relation is asserted.
confidence_class	enum	Explicit, verified-inferred, or candidate.
status	enum	Candidate, active, rejected, or superseded.
revision	integer	Concurrency control.
created_at	timestamp	Source creation time.
verified_at	timestamp or null	Verification event.

A candidate relation does not automatically become authoritative retrieval guidance. Structural inverse relations can be derived in a projection instead of stored twice. An arc pair may legitimately have more than one distinct semantic relation. Do not discard supersedes merely because the same pair also has a structural relation. Self-links, cycles, and conflicting direction are validated by relation semantics rather than one universal ban. A parent hierarchy should reject a cycle. A loose relatedness graph may contain cycles, but traversal still uses visited sets and bounded budgets. Deduplication keys include the relation when the relation changes meaning. The migration from the earlier strongest-type-per-pair rule needs an explicit compatibility report.

22.13 ContextRequest and ContextPack

A context request asks what the current task needs, not what is globally hottest. The request carries task facts supplied by the controller and recent local observations supplied by hooks. The server derives the allowed scope independently of the request text. Personal and swarm endpoints return their instance identity so the caller can reject a misrouted response.

{
  "schema_version": "2.0",
  "request_id": "context-request-synthetic-0001",
  "brain_id": "swarm",
  "project_id": "github.com/the-cloud-clockwork/agentihooks",
  "execution_id": "exe-synthetic-0007",
  "task_id": "implement-session-ingestion",
  "task_generation": 3,
  "phase": "implementation",
  "lane": "eng",
  "intent": "Implement incremental transcript ingestion with durable acknowledgements.",
  "subsystems": ["session-catalog", "transcript-normalization"],
  "operation_class": "code-change",
  "budget": {"max_tokens": 3000, "max_graph_depth": 2, "max_items": 12},
  "known_context_revision": null
}

budget is a caller request bounded by server policy, not permission to exceed service limits. operation_class is validated against the protected transition being requested. The model cannot self-declare a dangerous operation as harmless to avoid consultation. A cached pack must match brain, project, task generation, role, phase, policy version, and evidence revision. Cache entries never key only on a repository basename.

{
  "schema_version": "2.0",
  "brain_id": "swarm",
  "context_id": "context-synthetic-0001",
  "context_revision": "knowledge-revision-0048",
  "task_generation": 3,
  "policy_version": "consultation-policy-01",
  "retrieved_at": "2026-10-08T08:02:00Z",
  "expires_at": "2026-10-08T08:12:00Z",
  "items": [
    {
      "knowledge_id": "lesson-synthetic-archive-ack",
      "kind": "lesson",
      "reason": "Applies to the task's durable-ingestion boundary.",
      "body": "Synthetic example: advance the durable cursor only after verified archive commit.",
      "evidence_refs": ["session://session-synthetic-0002/events/event-8..event-12"],
      "relationship_path": ["arc-synthetic-ingestion", "lesson-synthetic-archive-ack"],
      "status": "active"
    }
  ],
  "omitted": {"budget": 2, "superseded": 1},
  "warnings": [],
  "receipt": "<opaque-server-issued-receipt>"
}

The omitted counters cannot reveal hidden-scope populations. Only counts from the authorized candidate set may be returned. The context budget must be reconciled with every target adapter’s byte and token limits before qualification. A server budget of several thousand tokens is not satisfied by silently clipping the result to the previous 1536-byte injection cap. The adapter must either deliver the qualified bounded pack or use a supported staged delivery with explicit completeness. The receipt is bound to the context digest, not merely a timestamp saying a tool was called. Delivery acknowledgement records which target hook received the context. The receipt proves retrieval and supported delivery, not understanding or correctness. A malicious or mistaken memory item remains retrieved data and never becomes an unconditional tool directive.

22.14 ConsultationReceipt

Field	Type	Rule
receipt_id	string	Opaque server-issued identity.
principal_id	string	Authenticated requesting principal.
execution_id	string	Bound worker attempt.
task_id	string	Bound task.
task_generation	integer	Reject after task replacement.
brain_id	string	Exact brain.
project_id	string	Exact project.
operation_class	string	Permitted consultation transition class.
policy_version	string	Rules used to decide sufficiency.
context_digest	string	Exact retrieved context.
evidence_revision	string	Underlying knowledge revision.
result_state	enum	Retrieved, empty, unavailable, or rejected.
delivered_at	timestamp or null	Confirmed supported delivery.
expires_at	server timestamp	Short bounded validity.
override_ref	string or null	Explicit operator override when allowed.

A fabricated receipt string must fail verification. A receipt from one agent cannot satisfy another attempt’s requirement. A successful empty result can satisfy a consultation requirement when policy permits it. Service unavailable is not equivalent to empty retrieval. A task phase change can invalidate a previously valid receipt. A forced operator override is recorded with scope, reason, and expiry. A receipt does not independently authorize Git merges, infrastructure changes, or destructive operations.

23. Persistence and transaction design sketches

These sketches describe required semantics rather than database migrations ready to run. Actual migrations must follow the owning repository’s tested migration framework. Database schema ownership is explicit so transcript and brain deployments do not migrate each other’s tables accidentally.

23.1 Canonical versus derived stores

The transcript archive is authoritative for retained source bytes. The session catalog is authoritative for source identity, ordering, visibility, and archive references. The semantic index is rebuildable from those stores. Redis may cache catalog data and coordinate admission but is not the only copy of retained evidence. The brain’s knowledge store is authoritative for approved knowledge records and their revisions. Brain embeddings are derived search projections. The edge store is authoritative for approved relations, with an export format that survives backend replacement. A filesystem vault can remain the human-readable representation, but concurrent writers need one coherent mutation boundary. A read-modify-write append over a shared file is not treated as a distributed transaction.

23.2 Proposed relational key layout

-- Illustrative design only. Review and implement as repository migrations.
CREATE TABLE session_manifest_v2 (
    session_uid text PRIMARY KEY,
    harness text NOT NULL,
    native_session_id text NOT NULL,
    source_host_id text NOT NULL,
    access_domain text NOT NULL,
    completeness text NOT NULL,
    manifest jsonb NOT NULL,
    revision bigint NOT NULL,
    UNIQUE (access_domain, harness, source_host_id, native_session_id)
);

CREATE TABLE session_segment_v2 (
    session_uid text NOT NULL REFERENCES session_manifest_v2(session_uid),
    source_generation text NOT NULL,
    segment_id text NOT NULL,
    first_sequence bigint NOT NULL,
    last_sequence bigint NOT NULL,
    object_key text NOT NULL,
    sha256 text NOT NULL,
    byte_count bigint NOT NULL CHECK (byte_count >= 0),
    committed_at timestamptz NOT NULL,
    PRIMARY KEY (session_uid, source_generation, segment_id)
);

CREATE TABLE session_ingest_batch_v2 (
    access_domain text NOT NULL,
    batch_id text NOT NULL,
    payload_digest text NOT NULL,
    response jsonb NOT NULL,
    committed_at timestamptz NOT NULL,
    PRIMARY KEY (access_domain, batch_id)
);

CREATE TABLE knowledge_edge_v2 (
    brain_id text NOT NULL,
    edge_id text NOT NULL,
    source_id text NOT NULL,
    target_id text NOT NULL,
    relation text NOT NULL,
    status text NOT NULL,
    evidence jsonb NOT NULL,
    revision bigint NOT NULL,
    PRIMARY KEY (brain_id, edge_id),
    UNIQUE (brain_id, source_id, target_id, relation)
);

The unique keys above are starting contracts, not a substitute for row-level authorization. Session IDs alone are not globally safe across imported corpora without an access-domain binding. When a native session is intentionally resumed on another host, preserve internal session lineage rather than duplicating evidence blindly. A source-host uniqueness rule may therefore need an explicit migration/adoption record for qualified cross-host resume. Do not infer that migration from a coincidentally matching native UUID. The implementation must choose and document whether one internal session spans multiple qualified source incarnations or records them as linked sessions. The default proposed choice is one stable internal session with explicit source-incarnation records after authorized native resume. The import path uses a mapping table so older identifiers remain resolvable.

23.3 Archive commit failure cases

An object upload can succeed while catalog commit fails. In that case the object is an unreferenced candidate and the client must not advance the durable cursor. Retrying the same batch can reuse the verified object digest. An eventual orphan reaper deletes only objects that have remained unreferenced beyond a documented grace interval. A catalog row must never reference a body that was not verified or durably committed. If the object store acknowledgement is weaker than the required durability contract, the server must state the weaker guarantee. Restore verification tests download and hash representative bodies rather than trusting storage metadata alone. A database restore to an earlier point must not make newer object evidence disappear silently. Reconciliation can discover orphaned newer objects, but only through validated manifests and provenance. An archive object name must not contain credentials or raw user prompts.

23.4 Index update failure cases

An embedding API timeout does not roll back a durable transcript commit. The segment remains visible through direct source retrieval while semantic indexing is pending. Index state records its last successful input digest and model generation. Unchanged chunks do not require new embeddings. Partial batch success records successful chunk IDs and retries only missing work. A model dimension mismatch rejects the embedding write before corrupting the active index. A new index generation is built alongside the previous qualified generation. Cutover requires retrieval evaluation and completeness checks. Rollback switches the read generation without deleting the canonical archive. A derived-index rebuild must not trigger execution of transcript commands or automatic agent launches.

23.5 Brain mutation concurrency

Two marker writes for one daily log must not overwrite each other. Prefer a transactional record store or a single serialization point with explicit idempotency. Generate decision IDs atomically instead of scanning filenames and picking the next number without a lock. A marker idempotency key is scoped to principal, brain, and payload digest. An identical key with different content is rejected. A knowledge edit includes an expected revision. A failed revision comparison returns the current revision without leaking unauthorized content. Synthesis operates on a snapshot of source revisions. Before applying synthesis, verify that the relevant source revisions have not changed incompatibly. A synthesis candidate based on superseded evidence is retained as a candidate or recomputed, not silently promoted.

24. Runtime transition and race catalogue

24.1 Admission before Pod creation

The controller reads the current task state and eligibility under the existing lane and territory rules. It evaluates global account quota, active execution caps, pending execution caps, and budget policy. It reserves the task generation and account slot atomically or through a documented compensating transaction. It stores the immutable launch intent. Only then does it create the execution Pod. If Pod creation fails definitively, the controller releases the reservation after checking that no matching Pod exists. If creation is ambiguous, the controller reconciles by execution identity. It does not generate a second attempt merely because the create response timed out.

24.2 Registration before running the harness

The worker validates required files, supported harness versions, and the launch manifest. It starts local runtime supervision and readiness checks. It registers with the controller using the execution-scoped identity. It receives or renews current task authority. It prepares the repository and worktree from approved sources. It starts transcript capture before launching the agent conversation. It obtains the task-start context pack or the explicit allowed degraded decision. It launches the harness in the headless herdr runtime. It marks the execution working only after the launch identity and conversation binding are confirmed. If any required stage fails, it reports the exact stage and does not claim useful work began.

24.3 Client and transport disconnect

An operator viewer closing only changes viewer connectivity state. It does not revoke task authority or shut down the worker. The private terminal tunnel may reconnect to the same runtime target. The connection manager resolves the current Pod UID and server identity before sending commands. A stale connection to an old Pod is discarded, not reused because the Pod name was recycled. The controller distinguishes viewer loss, terminal transport loss, worker heartbeat loss, and Pod termination. Only the latter observations participate in the execution failure policy.

24.4 Controller restart during launch

Persisted launch intents remain visible after the controller restarts. The new controller obtains a new leadership epoch. It lists execution Pods under its allowed label selector. It matches each Pod to an intended execution record and immutable launch digest. It adopts only matching current attempts. It quarantines or terminates unowned execution Pods through an explicit policy after audit. It does not adopt unrelated Pods merely because they contain the same image. Worker heartbeats from an older epoch are either reauthorized deliberately or rejected. A replacement controller cannot assume every Running Pod still has valid task authority.

24.5 Worker partition with an otherwise healthy node

The worker tracks the last authority renewal using a monotonic local clock. Before its allowed grace window ends, it stops admitting new protected mutations. It attempts to flush evidence and checkpoint material to permitted durable services. It reports connectivity state if any control channel is still available. The controller does not immediately create a replacement merely because one heartbeat is late. It waits for the documented failure condition and fences the old generation before admitting a replacement. The private worktree prevents the old process from changing the new attempt’s filesystem. Central ledger and merge endpoints reject the old generation. External API effects that cannot be fenced remain an explicitly documented uncertainty. The recovery UI identifies this ambiguity rather than claiming all prior effects are absent.

24.6 Graceful drain

The controller marks the execution draining and stops assigning new work to it. The worker reaches a bounded safe point or reports that it cannot do so within the available deadline. It persists the latest transcript segments. It checkpoints recoverable source changes and the native session state when qualified. It uploads the checkpoint manifest only after referenced objects verify. It reports the completed checkpoint identity and accepted durable cursor. The controller records the handoff and releases current authority only through an ownership-checked transition. The runtime supervisor terminates remaining owned processes and exits. A drain timeout is not treated as completed checkpointing.

24.7 Spot interruption and abrupt loss

A Spot notice may provide a short interruption window, but the system must also handle immediate or unobserved loss. SRC-AWS-SPOT The worker cannot rely solely on a termination hook for all persistence. Periodic transcript spooling and checkpoints bound recoverable loss before any notice arrives. The termination handler drains according to the existing infrastructure policy. The workload uses the smaller of its configured shutdown budget and the actual available infrastructure deadline. A longer Pod termination grace setting does not extend the lifetime of an EC2 instance that is being reclaimed. After loss, the controller reports the latest complete checkpoint and durable evidence cursor. Missing recent edits or transcript tail data remain explicitly unknown or lost. A replacement uses a new task generation. A native resume is attempted only when its compatibility and artifact prerequisites pass. Otherwise the operator or policy chooses context continuation or fresh execution explicitly.

24.8 Completion with an uncertain external effect

A successful local command return does not prove a remote merge or artifact upload committed. The completion path queries the remote system using the stable operation reference. If the state is ambiguous, task completion remains pending verification. Do not repeat a non-idempotent effect automatically just to obtain a clean response. The outcome record includes the evidence used to resolve ambiguity. A later confirmation updates the same operation record. The task’s proof contract remains independent of the terminal process exit code.

24.9 Pause, stop, and emergency actions

Pause prevents new admissions while current authorized work may continue. Drain requests bounded checkpoint-and-stop behavior. Stop-now revokes authority and terminates the identified runtime with explicit data-loss risk. An emergency shared-infrastructure signal follows the operator-approved policy; retrieved historical text cannot invoke it. Every action shows affected tasks and execution identities before a human confirms a destructive operation. The API verifies action authorization even when the UI already checked it. A stale UI card cannot terminate a successor that reused the same display name. An emergency action must not silently delete durable transcript or checkpoint evidence.

25. Proposed configuration, image, and deployment examples

All examples in this section are design shapes to implement and qualify. They are not commands that exist today unless the text explicitly says so. Secrets are referenced by identity; their values never belong in the plan or image.

25.1 Controller configuration shape

schema_version: "2.0"
controller:
  enabled: false
  identity: swarm-controller
  execution_backend: local
  leadership:
    required_for_admission: true
    fence_on_epoch_change: true
  admission:
    max_active_executions: 4
    max_pending_executions: 4
    reject_unknown_runtime_profile: true
  credentials:
    issue_execution_scoped: true
    expose_account_inventory_to_workers: false
  ledger:
    endpoint_ref: ledger-api
    auth_ref: ledger-controller-credential
  sessions:
    endpoint_ref: session-api
    archive_ref: transcript-archive
    require_durable_ack: true
  brain:
    routing_policy_ref: approved-brain-routing
  kubernetes:
    namespace: swarm-workers
    pod_template_ref: qualified-swarm-worker
    allow_host_network: false
    allow_host_pid: false
    allow_privileged: false

The small execution caps above are proposed canary values, not measured production capacity. Actual accepted values live in the deployment policy and are recorded in release evidence. Admission caps count active and starting attempts consistently across controller restarts. A pending cap is separate so an infrastructure outage cannot create an unbounded Pod backlog. Account limits are separate from Pod and node limits.

25.2 Brain routing configuration shape

schema_version: "2.0"
brains:
  personal:
    endpoint_ref: personal-brain-api
    credential_ref: personal-brain-client
    allow_automatic_export: false
  swarm:
    endpoint_ref: swarm-brain-api
    credential_ref: swarm-brain-client
    allow_automatic_export: false
routing:
  explicit_session_binding_first: true
  managed_swarm_default: swarm
  personal_session_default: personal
  missing_binding: reject_scoped_mutation
  cross_brain_fallback: disabled
context:
  task_start: required
  first_write_after_task_change: required
  architecture_transition: required
  refresh_on_evidence_revision: true
  lookup_on_every_tool_call: false
  require_delivery_receipt: true
learning:
  outcome_record: required
  novel_lesson: optional
  accept_no_new_learning: true

An explicit session binding must still be authorized for the caller. It does not let a swarm worker opt into the personal brain by changing its environment. The private default belongs to personal execution environments, not to every machine by name. A client can use a local brain and a remote brain in separate sessions without simultaneously running both stacks on the same host. Same-host multi-instance support requires the lifecycle changes in the MUL workstream.

25.3 Worker environment contract

Variable category	Provisioning	Worker authority
Execution identity	Controller-signed launch manifest	Read its own binding only.
Swarm/task/lane	Launch manifest and compatible existing environment fields	Cannot choose a different task generation.
Project identity	Launch manifest plus deterministic local validation	Can report mismatch, not broaden scope.
Harness account	Scoped secret reference	Exactly the selected account or approved broker credential.
Ledger endpoint	Service discovery/configuration	Authenticated task-scoped operations.
Session ingestion endpoint	Service discovery/configuration	Write its own evidence; scoped reads where granted.
Brain endpoint	Session binding	Read/write the selected brain under policy.
Git identity	Qualified configuration	Commit identity is not repository authorization.
Build service	Optional authenticated remote build configuration	No host Docker socket by default.
Telemetry endpoint	Qualified configuration	Emit sanitized operational data.

Do not bulk-inject the controller’s complete environment into the worker. Do not inject every available Claude or Codex account token into each Pod. Do not copy the operator’s whole SSH directory. Do not expose cluster bootstrap secrets to an execution container. The worker should not need direct credentials to change ASG desired capacity. Where the current launcher expects a named account variable, provide only that selected variable in its supported format. Account-variable compatibility is implemented inside the launcher adapter, not by exposing the entire account inventory.

25.4 Worker image build contract

The image is built from a reviewed minimal supported Linux base. Pin the base image by digest for a qualified release. Pin the qualified herdr, Claude, Codex, Python, Node, and package-manager versions. Record the version matrix in the image labels or a bundled machine-readable manifest. Install the agentihooks code at an immutable revision or released package version. Install the approved profile, hooks, rules, skills, and local MCP dependencies during the build. Secrets, account logins, machine IDs, and session history are not build inputs. Runtime initialization may materialize per-attempt settings from those immutable assets. Runtime initialization must not git pull an unreviewed branch or upgrade the entire toolchain. Use a non-root runtime identity. The image entrypoint supervises the herdr server and one managed main harness process. The exact init/supervisor choice is qualified by signal-forwarding and child-reaping tests. A PID-1 wrapper that waits forever after the managed workload has died is not a healthy execution runtime. Readiness includes execution registration and required local runtime readiness. Liveness does not treat a temporary brain or embedding outage as a reason to kill a productive agent.

Dependency	Baseline inclusion	Qualification
herdr	Required	Headless launch, remote attach, pane identity, shutdown.
agentihooks	Required	Full target-specific hook installation and task lifecycle.
Claude CLI	Required for supported Claude lane	Hook compatibility and native-session artifact handling.
Codex CLI	Required for supported Codex lane	Hook delivery capability and transcript normalization.
Git and gh	Required	Clone, branch, PR, and authenticated operation behavior.
Python and uv	Required	Repository tooling without mutating an unrelated shared environment.
Node and package manager	Required for approved frontend/tooling tasks	Explicit versions and lockfile behavior.
Shell utilities and process inspection	Required	Bootstrap diagnostics, archive operations, local process identity.
Browser automation	Profile-dependent	Headless browser, fonts, libraries, sandbox policy, screenshot artifacts.
Container build client	Profile-dependent	Remote authenticated build service; no privileged nested daemon by default.
AWS CLI	Profile-dependent	Scoped workload credentials only.
Terraform and kubectl	Profile-dependent	Read-only or explicitly delegated infrastructure authority.
Language compilers	Profile-dependent	Added only for declared repository requirements.

A single image can provide these qualified profile-dependent tools without enabling their credentials. Adding a tool does not grant permission to use it against production. Keep the first image broad enough for the existing swarm’s real repositories, but avoid bundling complete database or brain stacks. A later image split needs evidence that size or incompatible dependencies justify the additional maintenance burden.

25.5 Proposed execution Pod shape

apiVersion: v1
kind: Pod
metadata:
  name: swarm-synthetic-attempt
  namespace: swarm-workers
  labels:
    app.kubernetes.io/name: swarm-worker
    app.kubernetes.io/managed-by: agentihooks
    swarm.agentihooks/execution: exe-synthetic-0007
  annotations:
    swarm.agentihooks/launch-digest: "<qualified-launch-digest>"
spec:
  restartPolicy: Never
  automountServiceAccountToken: false
  terminationGracePeriodSeconds: 90
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
  containers:
    - name: worker
      image: ghcr.io/the-cloud-clockwork/swarm-node@sha256:<qualified-image-digest>
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
      resources:
        requests:
          cpu: "1"
          memory: 2Gi
          ephemeral-storage: 8Gi
        limits:
          memory: 6Gi
          ephemeral-storage: 30Gi
      volumeMounts:
        - name: runtime-home
          mountPath: /home/swarm
        - name: workspace
          mountPath: /workspace
        - name: execution-config
          mountPath: /run/swarm-config
          readOnly: true
  volumes:
    - name: runtime-home
      emptyDir: {}
    - name: workspace
      emptyDir: {}
    - name: execution-config
      secret:
        secretName: execution-scoped-config

This template intentionally omits live credentials, addresses, node tolerations, and an invented executable command. The image’s qualified entrypoint supplies the actual supervised command contract. The launch renderer adds the correct admission-approved affinity and tolerations. The example request and limit values are experiments, not production sizing evidence. The emptyDir volumes are explicitly ephemeral; the archive and checkpoint contracts are mandatory before loss-tolerant rollout. The Pod does not receive a Kubernetes API token by default. If a narrowly scoped API call is unavoidable, define a dedicated service account and explicit RBAC rather than reusing controller credentials. An SSH helper requiring elevated startup privileges needs an explicit reviewed exception or a separate restricted transport design. Do not silently weaken the non-root/capability policy just to make a generic sshd configuration start. A private SSH transport can use a qualified non-root server configuration, or a restricted relay into the Pod’s supported runtime path. The chosen transport must be proven in HDR before one-window terminal control is declared complete.

25.6 Node placement contract

The baseline canary uses only explicitly approved existing placement classes. The current CI-related AWS taints remain opt-in. No change to existing runner tolerations is needed merely to add a new swarm Pod template. A swarm that uses existing CI capacity must have an explicit shared-capacity policy and budget. Research capacity remains separate unless the operator approves a policy change with regression evidence. A proposed Spot-specific worker profile can require Spot eligibility when its recovery contract is qualified. An on-demand-only profile must not acquire Spot tolerations through a common template merge accidentally. A prefer-spot profile describes scheduler preference, not a promise about which ASG the autoscaler expands. A pool-expansion preference change belongs to antoncore and needs cluster-wide impact review. The master/controller and durable evidence services remain on stable, explicitly approved capacity. Do not place the controller on a node that its own infrastructure dependency may scale down without a qualified availability design.

25.7 Configuration precedence and restart policy

Controller policy and authenticated launch binding define non-overridable security scope. Operator deployment values define permitted resource classes and endpoints. Repository configuration may choose an allowed profile but cannot grant a broader account or brain scope. Session-local configuration may narrow or request a permitted choice. Provider-specific settings are generated through the existing target adapter. A conflicting configuration returns an explicit error rather than silently selecting the least restrictive value. A versioned configuration hash is recorded on every admitted attempt. Changing global configuration affects future attempts unless an explicit live-update protocol exists. An automatic image or Secret reloader must not restart all active workers without a drain policy. Credential expiry and revocation are handled by the worker/control protocol, not by indiscriminate rolling restarts. A brain endpoint or brain identity change invalidates the affected context caches and receipts. A changed routing file must not silently rebind a live personal session to the swarm brain.

26. Implementation execution guide for the swarm master

26.1 First action when the implementation issue is picked up

Read sections 0 through 4 before assigning work. Read the source baseline and refresh the three dev heads. Record which code revision is actually deployed where authorized read access is available. Do not equate a current repository head with the deployed system. Open the existing brain project-scoping issue and confirm its current status before duplicating work. Create one umbrella ledger for this program and link the implementation issue. Use this plan’s stable package IDs as the external requirement keys. Import the workstream dependency graph rather than inventing a second ordering system. Split each work package into smaller engineering tasks only when necessary for reviewable changes. Keep the original package ID on every split task and its pull request. Do not assign all 150 packages simultaneously. Start with the source baseline, identity contracts, and local compatibility seam. Allow mocked consumer work in parallel only after the producer’s contract is agreed. Do not unblock live rollout from a mock alone. Keep a separate status for contract-ready, implemented, tested, live-qualified, and accepted. A green unit test does not imply live qualification. A successful live demo does not excuse a failing scope or recovery test.

26.2 Repository task ownership

agentihooks owns the worker image source, runtime adapters, controller integration, ledger changes, session catalog, transcript capture, semantic search, brain routing, and execution gates. agentibrain-kernel owns project-aware knowledge, extraction from canonical evidence, graph relations, active context selection, full-detail retrieval, and isolated named brain instances. antoncore owns the deployment manifests, private connectivity, existing ASG integration, capacity policy, service placement, operational secrets delivery, and infrastructure runbooks. Cross-repository packages publish a producer contract before a consumer enables it. The deployment owner records exact image digests and configuration revisions for live tests. The operator-facing ledger links changes in all three repositories without pretending they are one atomic Git commit. A package can be complete in source while its deployment gate remains closed. When one repository is unavailable, work in other repositories may continue against qualified fixtures, but integration remains visibly blocked.

26.3 Suggested initial parallel tracks

Track A establishes baseline and identity contracts in FND and IDN. Track B preserves and tests the local runtime seam in RUN after the relevant IDN contract exists. Track C prepares the immutable worker image in IMG against the agreed runtime launch contract. Track D prepares session-source fixtures for SES without running a second production collector yet. Track E refreshes issue 89 and develops BRP against the canonical identity fixture. Infrastructure discovery in antoncore may run read-only during these tracks. Live infrastructure mutation waits for the explicit capacity and containment gates. After CTL, LDG, and IMG are tested, KUB and HDR can converge on one non-Spot worker. After SES and IDX are qualified, MIG can backfill and compare historical retrieval. After BRP, GRF, and CTX converge, GAT can validate real delivery receipts. MUL can develop independently after its identity and scope contracts exist. CKP must qualify before Spot workloads are treated as recoverable. OBS should be integrated early enough to collect meaningful evidence for every live gate. The final REL acceptance includes CAP, ACC, ING, and UX as well as tests, deployment, retention, operations, and migration.

26.4 How an engineer reads the large plan

Do not inject the entire plan into every agent’s startup context. Provide the assigned package, its direct dependency contracts, relevant core sections, and its three conformance scenarios. Provide source URLs and tested commit identifiers with that context bundle. The full plan remains available for explicit lookup by section or package ID. The master maintains the global dependency view and cross-repository ordering. An engineer does not need every runbook or every unrelated test in its context window. The initial task prompt should identify the exact repository, current worktree, package ID, owned paths, proof contract, and expected artifacts. After a handoff, the successor rereads the current ledger and package evidence, not only the previous agent’s summary. Do not allow an old cached plan excerpt to override a later accepted plan revision. Every evidence record identifies the plan revision used to define the test.

26.5 Worktree and integration discipline

Create an isolated worktree for each engineering cycle using the existing repository-supported workflow. Preserve the current base-branch policy unless the operator explicitly changes it. Do not edit the primary checkout concurrently from multiple agents. Do not reuse one worktree across two execution attempts after a failure. A repository clone on a worker is local to that attempt or an explicitly managed safe cache. GitHub branches and pull requests are source integration mechanisms, not live task-ownership locks. The ledger’s territory and dependency model still governs parallel edits. A cross-repository task records the compatibility order before merging producer and consumer changes. Do not deploy a consumer requiring new authority fields before the producer validates and emits them. Keep additive compatibility until the migration gate has evidence for removing old behavior. Shared infrastructure templates require a focused diff; avoid opportunistic unrelated cleanup during swarm rollout.

26.6 Required package handoff record

{
  "package_id": "SV2-SES-03",
  "plan_revision": "<plan-commit-or-download-sha256>",
  "repository": "the-cloud-clockwork/agentihooks",
  "tested_commit": "<commit>",
  "status": "implemented-not-live-qualified",
  "interfaces_changed": [],
  "migrations": [],
  "tests": {
    "positive": "evidence/SV2-SES-03/a-result.json",
    "negative": "evidence/SV2-SES-03/b-result.json",
    "recovery": "evidence/SV2-SES-03/c-result.json"
  },
  "known_limitations": [],
  "next_action": "<one concrete verified next step>",
  "rollback_reference": "<reviewed rollback procedure>"
}

The example package ID is illustrative; engineers use the package actually assigned to them. Do not copy the example status into a completion record without changing it to the verified state. Evidence artifacts must be stored durably and scoped appropriately. A path printed in a report is not evidence that the file exists.

27. Failure-oriented operational runbooks

The runbooks below are proposed operational procedures for the implemented system. They use logical resource references and existing read-only command shapes where possible. Mutation commands are intentionally described by validated operation and preconditions rather than invented current CLI syntax. Every destructive or spend-affecting action requires the applicable operator policy.

27.1 Viewer closed but agents should continue

Symptom: the operator terminal is closed or detached. Expected behavior: worker processes, control heartbeats, and transcript capture continue. Read the ledger’s execution state and latest heartbeat using the authenticated control surface. Check that viewer connectivity is separate from execution state. Reconnect the Anton-hosted herdr client to the same managed machine registration. Verify the remote session and native conversation identity before sending input. Do not launch a new agent merely because the previous viewer disappeared. If the worker is alive but the machine profile is absent, reconcile the controller-owned registration. Do not remove an unrelated manually configured machine profile. Evidence: same execution identity and conversation before and after viewer reconnection. Failure containment: disable automatic terminal input for unverified targets while leaving authorized execution running.

27.2 One remote terminal cannot connect

Symptom: one worker’s terminal endpoint fails while other workers remain reachable. Check the private transport endpoint, current Pod UID, server incarnation, and SSH trust binding. Check the worker control heartbeat independently of the terminal path. Verify that the machine profile points to the intended execution and remote herdr session. Do not retry an earlier pane mutation automatically after an ambiguous transport response. Read terminal state first where the operation allows reconciliation. Do not fall back to Local on any remote-resolution failure. Keep the affected card marked stale or disconnected until identity is revalidated. A changed host key requires the qualified rotation path, not a blanket host-key-check bypass. Evidence: connection diagnostics without credential values and target-resolution records. Recovery: restore the private route or registration and attach to the same live runtime.

27.3 Pending Pod does not trigger scaling

Symptom: a worker Pod remains Pending and no eligible node appears. Check the scheduler event reason before looking at raw node counts. Check CPU, memory, ephemeral-storage, required affinity, and every taint/toleration. Check whether a scale-from-zero node template can satisfy all required constraints. Check the controller’s pending cap and the ASG’s current configured ceiling. Check autoscaler discovery, provisioning timeout, and launch failures through the existing antoncore runbook. Distinguish an impossible request from temporarily unavailable cloud capacity. Do not remove workload taints or increase ASG ceilings as an automatic remedy. Do not repurpose the reserved research pool to satisfy an unrelated swarm request. Evidence: sanitized scheduler events, autoscaler decision, and the admitted resource specification. Recovery: correct the swarm-only profile or obtain an explicit capacity-policy decision.

27.4 Example read-only Kubernetes diagnosis

The variables below must already point to the explicitly authorized cluster and namespace. They do not choose a cluster automatically.

: "${SWARM_CONTEXT:?Set the authorized Kubernetes context}"
: "${SWARM_NAMESPACE:?Set the swarm execution namespace}"
kubectl --context "$SWARM_CONTEXT" -n "$SWARM_NAMESPACE" get pods \
  -l app.kubernetes.io/managed-by=agentihooks -o wide
kubectl --context "$SWARM_CONTEXT" -n "$SWARM_NAMESPACE" get events \
  --sort-by=.metadata.creationTimestamp

Do not paste unredacted events into a public issue when they contain sensitive resource names or private source references. Do not treat all namespace events as proof about one execution; correlate the Pod UID and execution identifier. A missing namespace or unavailable context is a diagnostic limitation, not evidence that there are zero workers.

27.5 Node launched but never becomes usable

Symptom: an ASG instance exists but its expected execution Pod never schedules. Verify whether the node joined the existing k3s cluster at all. Use the existing authorized node-bootstrap observation path; do not add bootstrap credentials to worker Pods. Check private-network reachability to the control plane. Check the AWS provider identity format and the node’s advertised labels and taints. Check the lifecycle-hook outcome and warm-pool state using the established source-controlled join design. Do not rewrite the on-prem provider identities to AWS identities. Do not reboot or replace unrelated healthy nodes while diagnosing one failed canary. Evidence: join stage, lifecycle state, current node identity, and autoscaler classification. Recovery: repair the reviewed AMI or bootstrap configuration and qualify a fresh canary.

27.6 Worker process alive but authority expired

Symptom: the process is still running but the controller rejects generation-bound writes. Check the worker’s last accepted renewal and the controller’s current task generation. Check whether a leadership epoch changed or a successor was admitted. Stop starting new mutations in the stale worker. Capture its remaining isolated workspace and transcript as quarantined evidence if policy permits. Do not merge its branch automatically after a successor has taken ownership. Do not manually restore its old claim without reconciling the current task owner. Evidence: old and current generations, rejection reason, and surviving artifact references. Recovery: retire the stale attempt or route its work as an explicit reviewable candidate to the current owner. The current owner decides whether any stale work is usable under the proof contract.

27.7 Duplicate Pod or ambiguous spawn

Symptom: the controller sees more than one runtime object associated with an expected launch. Compare execution IDs, Pod UIDs, launch digests, and controller ownership metadata. A repeated API request for the same execution should converge on one intended Pod. An unrelated object with the same name is not adopted. Fence attempts without current task authority before any shared mutation is allowed. Do not terminate an object based only on its display label. Retain the create-request and response evidence for the ambiguous operation. Evidence: object list scoped to the execution and the corresponding persisted launch intent. Recovery: keep the uniquely admitted attempt and retire only verified unowned or stale attempts through the audited policy. If ownership cannot be established, pause admissions rather than guessing.

27.8 Global account capacity appears wrong

Symptom: the swarm admits too many provider sessions or waits despite available capacity. Check distributed reservations separately from observed process counts. Check reservations for starting, active, draining, and handed-off attempts. Check expiry and reconciliation of reservations belonging to lost workers. Verify that account identity does not depend on reading the controller host’s process table. Verify that child sessions and background provider daemons follow the intended accounting policy. Do not print provider token values while identifying the account. Do not create extra cloud nodes to solve a provider-account quota constraint. Evidence: account IDs, reservation states, configured caps, and sanitized quota observations. Recovery: reconcile stale reservations under ownership checks and preserve the provider’s actual limits.

27.9 Transcript archive lag is growing

Symptom: captured cursor advances but durable cursor falls behind. Check local spool size, oldest unacknowledged batch, archive availability, and catalog commit failures. Check whether a source record is too large or a partial final line is blocking a parser incorrectly. Verify that the retry uses the same batch identity and source generation. Do not discard the local spool merely because an object upload was attempted. Do not mark the durable watermark equal to the captured watermark by administrative override. Apply bounded backpressure when storage is near its safety threshold. The policy may pause new tasks before evidence loss becomes unavoidable. Evidence: cursor difference, segment hashes, failed batch stage, and spool capacity. Recovery: restore the dependency, replay idempotently, and verify retrieved bytes before trimming local segments.

27.10 Semantic search misses a known recent session

Symptom: direct transcript retrieval works but semantic search cannot find the session. Compare durable and indexed watermarks. Check that the exact project and brain scope match the caller’s authorized request. Check chunker version, embedding model, vector dimension, and active index generation. Verify that the embedding backlog contains the new segment digest. Check whether text was redacted or excluded under policy. Do not broaden the search into personal or unattributed corpora automatically. Do not regenerate the original session from a summary to make the search test pass. Evidence: source range, chunk identity, embedding state, and the evaluation query. Recovery: replay derived indexing from the canonical archive and re-run both direct and semantic retrieval.

27.11 Search result exists but full transcript is missing

Symptom: an index preview is returned but its supporting source range cannot be opened. Treat the result as incomplete evidence immediately. Check the archive reference, retention tombstones, migration source completeness, and access policy. Distinguish authorization rejection from actual missing storage. Do not show a preview as a full transcript. Do not remove the completeness warning because the search score is high. Reconcile the derived index against retained archive manifests. Evidence: result ID, source reference, catalog state, and the precise missing range. Recovery: restore from an authorized verified backup when available; otherwise retain the gap and repair the index projection. A missing original is not recovered by paraphrasing a surviving summary.

27.12 Spot worker disappears before shutdown finishes

Symptom: Pod or node vanishes while drain or checkpoint upload was in progress. Read the latest complete checkpoint, not the most recently started checkpoint. Read the last durable transcript cursor separately. Determine whether the old generation is fenced and whether external effects remain ambiguous. Do not assume the entire task state survived because the cloud interruption notice was observed. Restore only verified objects from the complete manifest. Choose qualified native resume, explicit context continuation, or explicit fresh execution. The successor rereads the authoritative ledger before acting. Evidence: last complete checkpoint sequence, missing tail interval, and restore decision. Recovery: admit one successor generation and keep the original loss report linked to the task.

27.13 Native resume fails

Symptom: the new harness cannot open the original native conversation. Check harness version compatibility, expected account binding, session artifact completeness, and path requirements. Check whether the checkpoint was consistent or explicitly partial. Do not retry indefinitely against an incompatible format. Do not silently switch accounts to obtain a successful launch. Do not label a new conversation as a native resume. The operator/master sees a bounded decision with the available evidence and remaining workspace state. Evidence: sanitized provider error, version tuple, native session identity, and checkpoint constraints. Recovery: repair a supported compatibility issue or select a separately labelled continuation mode. The task remains assigned through the current generation, not through the old PID.

27.14 Brain injects the wrong project’s context

Symptom: an agent in one repository receives another repository’s arcs, lessons, or inferred intent. Check the source ProjectIdentity, canonical project key, brain binding, and current task generation. Check exact metadata filters in the feed and search paths. Check cache keys and evidence revisions. Check graph traversal scope at every expansion step. Check whether a historical unscoped entry was incorrectly promoted to a project by a text mention. Pause scoped injection for the affected route while preserving approved shared-infrastructure alerts. Do not mask the defect by hiding all brain context forever. Evidence: sanitized request/response IDs, project bindings, selected item IDs, and selection explanations. Recovery: fix attribution or routing, invalidate the affected scope cache, and rerun two-project isolation tests.

27.15 Personal/swarm brain isolation violation

Symptom: a swarm principal can read personal knowledge or one brain lifecycle action affects another. Treat this as an isolation incident, not a relevance-quality issue. Stop the affected cross-scope route and revoke compromised grants according to policy. Check namespaces, vault paths, database/schema credentials, Redis prefixes, container names, and discovery selectors. Check whether a client changed brain selection through mutable local configuration. Preserve audit evidence without copying the leaked private content into a public issue. Do not run a global compose teardown as cleanup. Evidence: instance identities, authorization decision, affected data categories, and lifecycle target resolution. Recovery: restore narrow bindings and qualify negative access/lifecycle tests before reenabling the route. Notify the operator with an explicit description of the affected boundary and evidence limitations.

27.16 Brain graph returns obsolete advice

Symptom: an old decision is returned as current guidance despite a superseding decision. Read the full decision records and directional supersedes relationship. Check graph projection revisions and the active context cache. Check whether an arbitrary edge-type priority discarded the supersession relation. Check whether the relation is candidate or verified. Do not erase historical decisions merely to hide a retrieval problem. Keep historical content available as history with a visible successor link. Evidence: original and successor IDs, revisions, relation evidence, and returned context explanation. Recovery: repair the relation/projection and qualify the supersession evaluation cases. Only the explicitly accepted current decision should guide the present protected transition.

27.17 Brain consultation gate is blocking valid work

Symptom: the agent has retrieved context but the next protected transition is refused. Check receipt authenticity, execution binding, task generation, project, operation class, expiry, and delivery acknowledgement. Check whether the task phase changed after the lookup. Check whether the provider supports the hook event used for delivery. Distinguish a fresh empty result from an unavailable service. Do not satisfy the gate with a fabricated marker or arbitrary tool-call count. An operator override uses the existing approved override path with scope, reason, and expiry. Evidence: receipt ID and validation reason without exposing protected context bodies. Recovery: deliver a valid scoped context pack or apply the explicit degraded-mode policy. A successful override does not weaken unrelated secrets, branch, or infrastructure controls.

27.18 Brain service is unavailable

Symptom: context lookup times out or returns a dependency-unavailable error. Read the selected brain binding and service health without switching instances automatically. Use last-known-good context only within its declared freshness and scope policy. For a protected transition, apply the configured unavailable policy rather than treating it as no matching memory. Keep transcript capture and local task evidence running where safe. Bound retries and prevent a wave of workers from causing a retry storm. Do not terminate all agents merely because a semantic retrieval dependency is briefly down. Evidence: request IDs, failure category, cache age, and gate decision. Recovery: restore the dependency, refresh context, and invalidate temporary overrides when they expire. Record whether work continued in degraded mode and which constraints remained enforced.

27.19 Worker image rollout would restart active tasks

Symptom: GitOps detects a new image or secret and attempts broad worker replacement. Verify ownership: long-lived service rollout differs from controller-owned execution attempts. Existing attempts retain their admitted image digest unless an explicit drain operation is authorized. New attempts use the new qualified image after compatibility checks. Check that automatic reloader annotations are not inherited blindly from long-lived service charts. Do not mutate a running attempt’s toolchain in place to match a moving tag. Evidence: old/new image digests, affected attempts, and controller admission policy. Recovery: stop the unqualified rollout, retain existing attempts, and qualify a new canary. A security emergency may justify forced retirement, but the data-loss risk and authority revocation must be explicit.

27.20 Idle nodes cannot scale down

Symptom: swarm work is complete but eligible cloud capacity remains unnecessarily active. Check completed or orphaned Pods, active reservations, drain state, and eviction-protection annotations. Check whether an unrelated workload legitimately needs the node. Check autoscaler’s configured delay and unneeded classification before declaring a defect. Remove only verified completed execution objects through the controller cleanup path. Do not terminate a node directly to bypass a still-active workload’s protection. Evidence: object ownership, task completion, reservation release, and autoscaler reasoning. Recovery: repair cleanup or annotation lifecycle and verify scale-down with an isolated canary. A cost dashboard must distinguish stopped warm-pool storage from running instance capacity.

27.21 Data restore or index rebuild

Symptom: a durable store needs restoration or a derived index must be rebuilt. Identify whether the missing component is authoritative source, catalog, knowledge, or a derived projection. Restore authoritative data to an isolated target first. Verify hashes, manifest references, scope bindings, and representative retrieval results. Rebuild derived indexes from the restored authoritative stores. Do not start coding agents merely to repopulate a search index. Do not mix a personal database with swarm credentials during a restore. Record the recovery point and any source gaps beyond it. Evidence: backup identifiers, restore target, validation results, and cutover decision. Recovery: switch the selected endpoint or index generation only after qualified read verification. Retain the previous target until the rollback policy permits retirement.

27.22 Retired transcript endpoint still receives traffic

Symptom: callers still attempt to use the retired search endpoint after cutover. Inventory the actual callers through sanitized routing telemetry. Classify each as an active supported integration, stale configuration, or unauthorized use. Migrate supported session-search consumers to the agentihooks session API/MCP contract. Do not restore the old dispatcher, registry, or general-purpose runtime as a compatibility shortcut. A temporary compatibility alias, when explicitly approved, must terminate in the new scoped read-only session implementation. Give any alias an expiry, owner, and usage metric. Evidence: caller inventory, required search method, and migrated configuration. Recovery: remove the remaining obsolete configuration and rerun dependency audits. The final architecture contains no runtime dependency on the retired service.

28. Release evidence, privacy, and completion checklists

28.1 Publication is not implementation completion

Committing this plan creates the specification artifact only. Creating an issue creates the execution tracker only. Neither action satisfies the runtime, memory, brain, or infrastructure acceptance gates. The issue remains open until the required evidence is linked and the operator accepts the verified scope. Every test in section 21 is specified work to implement, not a reported execution result. A structural validation report for this document validates the document, not the distributed system.

28.2 Code and deployment evidence

Record the accepted plan revision or document hash. Record the exact tested agentihooks commit. Record the exact tested agentibrain-kernel commit. Record the exact tested antoncore commit. Record qualified worker and service image digests. Record the configuration revision and selected policy versions. Record the migration versions and their rollback constraints. Record the test environment and whether each proof is mocked, local integration, or live canary. Record every failed canary that affected the final design. Record any deviations as explicit accepted architecture decisions. Do not discard failures merely because a later attempt passed.

28.3 Privacy review before committing reports

Remove operational network addresses from plan-derived public reports. Remove provider token values, refresh tokens, private keys, and secret-store payloads. Remove private transcript bodies unless the operator explicitly permits publication. Use synthetic session examples in tests committed to public repositories. Replace internal object references with sanitized stable placeholders in public evidence summaries. Do not replace the real evidence in its protected store; keep a mapping under appropriate access control. Check that summaries do not leak hidden project names or personal-brain material. Check that screenshots do not expose credentials or unrelated terminal content. Check that dependency source links are permitted for the intended repository audience. A private repository source URL is a pointer, not a copy of its protected content.

28.4 Final operator walkthrough

Start a local-only swarm and prove unchanged supported behavior. Start a single approved Kubernetes worker and inspect it in the Anton-hosted herdr client. Close the viewer and prove the same worker continues. Reconnect and verify execution identity and native conversation identity. Start bounded pending work and observe scaling through the existing autoscaler. Show that a request without the required tolerations does not access reserved capacity. Demonstrate Claude and Codex transcript search against exact project filters. Open a result’s original supporting record range from durable storage after its worker has gone. Open two different projects and show different scoped brain context. Show an applicable shared-infrastructure warning reaching both authorized project sessions. Retrieve a historical lesson through an approved graph relationship. Show that an obsolete decision is identified as superseded. Show the consultation receipt and supported hook delivery for a protected transition. Show that no new lesson is acceptable when the task produced no novel learning. Demonstrate personal/swarm separation for both search and lifecycle actions. Rehearse a worker loss with a visible, truthful restore decision and one current writer. Show archive and checkpoint watermarks separately. Show idle execution cleanup and bounded capacity release. Show the final runtime dependency inventory. Link each demonstrated result to the package and acceptance gate it satisfies.

28.5 Maintenance ownership

The agentihooks maintainer owns runtime adapter compatibility and transcript normalizer versions. The brain maintainer owns attribution, graph semantics, context policy, and knowledge migrations. The antoncore maintainer owns cluster delivery, private networking, secrets integration, and capacity policies. A release owner coordinates version tuples across repositories. An operations owner verifies backups and restore drills. A security owner reviews credential scope and personal/swarm isolation failures. The operator owns spending ceilings and approval of new infrastructure pools. Provider CLI updates require compatibility qualification before entering the default worker image. An embedding-model change requires retrieval evaluation and an index-generation migration. A brain-policy change requires injection and gate regression tests. A new agent harness must implement the normalization and delivery capability contracts instead of changing provider-neutral orchestration.

28.6 Explicitly deferred features

Cross-brain automatic federation is not required for this baseline. Cross-brain export/import can be added later only through explicit authorization and provenance rules. One brain per worker is not a target feature. A dedicated memory-optimized ASG is optional future infrastructure work, not an implied existing dependency. A new compute pool for swarm-only workloads is optional until coexistence evidence requires it. A custom graph database is not required while the bounded relational traversal meets the qualified workload. A second coding-task queue or execution autoscaler is not a deferred default; it would require an architectural change. A web terminal replacement is not required if the Anton-hosted herdr client and ledger satisfy operator needs. Automated production spending increases remain outside the admitted baseline.

28.7 Program closure conditions

All mandatory work packages have evidence or an explicit operator-approved equivalent replacement decision. Every applicable acceptance gate is satisfied in the declared environment. No mandatory failure case is hidden by a generic success label. The local execution fallback is qualified. The durable source archive is independently restorable. The brain project-scoping issue is satisfied or linked to the accepted successor implementation with its tests. The retired transcript service is absent from the deployed target dependency graph. The final issue summary states what is implemented, what is qualified, and what remains deliberately unsupported. The operator can identify the accepted release tuple and its rollback path without reconstructing this conversation.

29. Source register and revalidation instructions

This register links the evidence used to define the baseline and the external contracts. The three primary repository branch heads below were re-resolved during this preparation. Some file-level findings were inspected earlier in the same conversation; immutable source links bind the plan to the recorded baseline. Implementation kickoff must refresh the affected file when its development branch has advanced. No source link implies that the live system was inspected or that a referenced change is deployed. The public documentation references were checked during preparation on 2026-10-07. Proposed v2 interfaces, test cases, policies, and sizing experiments are design requirements rather than claims copied from documentation.

Repository	Recorded dev baseline	Evidence class
`agentihooks`	`e440d3fb7bdd0491c8896ca528440041a43c36c4`	Repository source snapshot; live deployment not asserted.
`agentibrain-kernel`	`80174260fee601659b94b029b9a5a58ee8e1ef04`	Repository source snapshot; live deployment not asserted.
`antoncore`	`94b2a670daf11eeed02b853b08b3b29c451a6b13`	Repository source snapshot; live deployment not asserted.

29.1 Source descriptions

SRC-AH-GUIDE: agentihooks: `CLAUDE.md`

Reference: SRC-AH-GUIDE. Repository entry points, target adapters, testing conventions, existing hook integration, and local-process assumptions. Re-read before editing because the development branch can advance.

SRC-AH-STORE: agentihooks: `scripts/swarm/store.py`

Reference: SRC-AH-STORE. Existing swarm configuration, task claims, leases, agent records, seats, naming, and handoff storage. This is the extension seam, not permission to create another task authority.

SRC-AH-RUNTIME: agentihooks: `scripts/swarm/runtime.py`

Reference: SRC-AH-RUNTIME. Existing local herdr runtime and launch/resume/retire behavior. Distributed target selection is proposed work in this plan.

SRC-AH-TERMINATE: agentihooks: `scripts/terminate_agent.py`

Reference: SRC-AH-TERMINATE. Existing local process-table discovery, process identity validation, termination, and pane closure. Local PID checks must remain local observations.

SRC-AH-LEDGER: agentihooks: `scripts/swarm_ledger/ledger.py`

Reference: SRC-AH-LEDGER. Existing HTTP ledger calls and local HTML token lookup. The v2 credential and remote-worker path must remove the local-file dependency without removing authorization.

SRC-AH-IDENTITY: agentihooks: `hooks/context/project_identity.py`

Reference: SRC-AH-IDENTITY. Current project resolution using Git common-directory information, repository remote, swarm context, and scratch-folder conventions. Preserve the client-side work already shipped.

SRC-AH-READER: agentihooks: `hooks/memory/transcript_reader.py`

Reference: SRC-AH-READER. Unified Claude, Codex, and Copilot record normalization. Reuse normalization while adding an incremental, durable source-capture contract.

SRC-AH-NORMALIZER: agentihooks: `hooks/targets/normalizer.py`

Reference: SRC-AH-NORMALIZER. Provider hook normalization and native transcript discovery. Actual provider capabilities must remain explicit instead of inferred from a common tool name.

SRC-AH-SNAPSHOT: agentihooks: `scripts/swarm/snapshot.py`

Reference: SRC-AH-SNAPSHOT. Existing snapshot contains coordination state, a ledger copy, and worktree path mappings. It does not by itself archive worktree contents or native conversation stores.

SRC-AH-MEMORY: agentihooks: `hooks/memory/store.py`

Reference: SRC-AH-MEMORY. Existing keyword memory store and local fallback. It is not a complete semantic transcript archive and should not be described as one.

SRC-AH-PROJECT-CACHE: agentihooks: `hooks/context/project_cache.py`

Reference: SRC-AH-PROJECT-CACHE. Current client-side project-memory cache, rendering, and deferred refresh. Multi-brain and task-specific cache keys are proposed extensions.

SRC-BRAIN-ARCS: agentibrain-kernel: `services/mcp/app/tools/arcs.py`

Reference: SRC-BRAIN-ARCS. Current semantic arc lookup and limited detail retrieval. Graph expansion and full source-backed detail are separate v2 requirements.

SRC-BRAIN-CLI: agentibrain-kernel: `docs/CLI.md`

Reference: SRC-BRAIN-CLI. Current whole-machine lifecycle and one-stack-per-machine convention. Named-instance isolation changes must avoid tearing down another installed brain.

SRC-BRAIN-CONFIG: agentibrain-kernel: `agentibrain/config.py`

Reference: SRC-BRAIN-CONFIG. Current environment/file configuration and brain home resolution. The v2 instance binding must be explicit and isolated.

SRC-BRAIN-COMPOSE: agentibrain-kernel: `agentibrain/templates/compose/compose.yml.j2`

Reference: SRC-BRAIN-COMPOSE. Current compose services, fixed container names, vault mounts, and pipeline cadence. Same-host multi-instance support must remove collisions deliberately.

SRC-BRAIN-EXTRACT: agentibrain-kernel: `services/brain-ops/extract.py`

Reference: SRC-BRAIN-EXTRACT. Current Claude-oriented extraction and working-folder project derivation. The target consumes normalized session evidence with canonical identity.

SRC-BRAIN-CLUSTER: agentibrain-kernel: `services/brain-ops/cluster.py`

Reference: SRC-BRAIN-CLUSTER. Current project/time grouping, cluster creation, source-session links, and sibling discovery. Task lineage must prevent unrelated simultaneous tasks from collapsing into one arc.

SRC-BRAIN-FEED: agentibrain-kernel: `services/brain-api/app/feed.py`

Reference: SRC-BRAIN-FEED. Current feed file reader and global payload generation. Project-level selection must happen before the top-N truncation.

SRC-BRAIN-EDGES: agentibrain-kernel: `services/brain-ops/brain_apply.py`

Reference: SRC-BRAIN-EDGES. Existing relation application and edge deduplication behavior. Preserve evidence and directional semantics when replacing the strongest-type-per-pair heuristic.

SRC-BRAIN-EMBED: agentibrain-kernel: `services/brain-ops/embed_arcs.py`

Reference: SRC-BRAIN-EMBED. Existing arc and daily-lesson indexing. V2 adds exact scope metadata, full evidence references, and entry-level lesson retrieval.

SRC-BRAIN-TICK: agentibrain-kernel: `services/brain-ops/brain_tick_prompt.py`

Reference: SRC-BRAIN-TICK. Current bounded reasoning prompt, edge suggestions, intent, and arc synthesis. Context consultation does not require running a full global tick per tool call.

SRC-ANTON-ASG: antoncore: `stacks/terraform/modules/ec2-arc-runners/asg.tf`

Reference: SRC-ANTON-ASG. Existing ASG names, launch-template integration, warm-pool policy, node-template tags, and desired-capacity ownership. Refer to the source without copying operational addresses.

SRC-ANTON-VARS: antoncore: `stacks/terraform/modules/ec2-arc-runners/variables.tf`

Reference: SRC-ANTON-VARS. Declared capacity ceilings and equal-shape instance alternatives. These values are source declarations, not measured live capacity or spending approval.

SRC-ANTON-CA: antoncore: `k8s/charts/cluster-autoscaler/values.yaml`

Reference: SRC-ANTON-CA. Existing autoscaler priorities, node discovery, provisioning timeout, and scale-down configuration. A swarm overlay must not alter unrelated workload behavior accidentally.

SRC-ANTON-JOIN: antoncore: `automation/packer/files/anton-k3s-join.sh`

Reference: SRC-ANTON-JOIN. Existing private-network join, lifecycle-state handling, and AWS provider identity. Node bootstrap remains separate from the worker container.

SRC-BRAIN-89: Existing project-scoped memory issue

Reference: SRC-BRAIN-89. Rechecked open during preparation. Defines kernel attribution, marker persistence, exact search filters, project feeds, project intent, and Codex extraction; it also records the shipped client-side work.

SRC-LEGACY-SEARCH: Extraction-only reference: retired transcript semantic-search logic

Reference: SRC-LEGACY-SEARCH. Only a source for the useful turn-chunking and vector-search implementation ideas. No runtime, dispatcher, registry, authentication server, or deployment dependency is retained from this project.

SRC-HERDR-MACHINES: herdr remote machines

Reference: SRC-HERDR-MACHINES. Remote server ownership, machine-scoped identifiers, SSH connectivity, and a shared operator client.

SRC-HERDR-CLI: herdr CLI

Reference: SRC-HERDR-CLI. Headless server operation and machine-qualified command surface. Verify supported command flags against the selected pinned release.

SRC-K8S-LIFECYCLE: Kubernetes Pod lifecycle

Reference: SRC-K8S-LIFECYCLE. Pod identity, termination, and runtime lifetime. Recreating a Pod does not preserve its former processes.

SRC-K8S-AUTOSCALING: Kubernetes node autoscaling

Reference: SRC-K8S-AUTOSCALING. Unschedulable workload requests and eligible node templates drive capacity decisions.

SRC-K8S-RESOURCES: Kubernetes resource management

Reference: SRC-K8S-RESOURCES. Requests, limits, and scheduling/resource-enforcement distinctions. Measure real worker process trees before production sizing.

SRC-K8S-STATEFULSET: Kubernetes StatefulSets

Reference: SRC-K8S-STATEFULSET. Stable service identity is distinct from a controller-owned ephemeral execution attempt.

SRC-K8S-RBAC: Kubernetes RBAC

Reference: SRC-K8S-RBAC. Separate controller permissions from worker permissions and constrain allowed API operations.

SRC-K8S-SECRETS: Kubernetes Secrets

Reference: SRC-K8S-SECRETS. Credential delivery and its security limitations. Merely using a Secret is not the entire isolation design.

SRC-K8S-NETWORK: Kubernetes NetworkPolicies

Reference: SRC-K8S-NETWORK. Network isolation requires a supporting implementation and explicit allowed traffic.

SRC-PGVECTOR: pgvector upstream documentation

Reference: SRC-PGVECTOR. Vector indexing, filtered retrieval, and tuning behavior. Use scoped evaluation rather than assuming an index provides authorization.

SRC-AWS-SPOT: AWS Spot interruption notices

Reference: SRC-AWS-SPOT. Interruption notices and available handling time. Design for loss without a completed shutdown as well.

SRC-REDIS-LOCKS: Redis distributed locking

Reference: SRC-REDIS-LOCKS. Ownership, expiry, and distributed lock assumptions. The plan additionally requires fencing at protected mutation boundaries.

29.2 Source refresh policy

A changed source file does not automatically invalidate the entire plan. Compare the affected implementation seam and update the corresponding packages and contract fixtures. Record source drift before beginning a live canary. Retain the accepted original plan revision so implementation decisions remain auditable. Do not copy confidential source content or operational addresses into this public-facing plan during refresh. The existing project-scoping issue should be cross-linked rather than replaced by a duplicate issue.

29.3 Markdown reference targets

30. End-of-plan completion statement

This document defines the full implementation program across agentihooks, agentibrain-kernel, and antoncore. It preserves the working local swarm while adding qualified elastic execution, durable cross-harness memory, and scoped active brains. The work-package and scenario counts describe specified work, not completed code or executed tests. Production changes require the gate evidence and operator policies identified throughout the plan. The canonical requested repository destination is root Swarm-v2.md on agentihooks/dev. Publication and implementation completion are separate events.

Swarm v2: elastic execution, session memory, and scoped active brains

Plan navigation

0. Document contract and execution entry point

0.1 How the implementation swarm must read this file

0.2 Evidence classes

0.3 Source snapshots

1. Final architecture and ownership

1.1 Component ownership

1.2 Simplicity rules

2. Verified baseline and corrections to earlier shorthand

2.1 agentihooks baseline

2.2 antoncore baseline

2.3 Brain baseline

2.4 herdr and Kubernetes boundary

3. Non-negotiable invariants

3.1 Runtime invariants

3.2 Memory invariants

3.3 Brain invariants

4. Execution model and lifecycle

4.1 Unit of execution

4.2 State machine

4.3 Claims and fencing

4.4 Controller shape

5. herdr integration and one-window operations

5.1 Required experience

5.2 Baseline transport decision

5.3 Command routing

6. Worker image contract

6.1 Image responsibility

6.2 Configuration materialization

6.3 Process supervision

7. Kubernetes and AWS integration

7.1 Preserve the existing infrastructure

7.2 Admission and resource classes

7.3 Illustrative resource experiments

7.4 Autoscaling mechanics

7.5 Drain and interruption

8. Filesystem and durability

8.1 Shared configuration is not a shared writable home

8.2 Recovery materials

8.3 Atomic publication

9. Canonical session memory in agentihooks

9.1 Scope

9.2 Reuse boundary

9.3 Canonical record contract

9.4 Incremental ingestion

9.5 Search and evidence retrieval

10. Brain project awareness and active retrieval

10.1 Complete issue 89 end to end

10.2 Graph retrieval

10.3 Full-detail retrieval

10.4 Targeted context packs

11. Brain consultation gates

11.1 Gate locations

11.2 Receipt contract

11.3 Failure policy

12. Personal and swarm brains

12.1 Selected deployment shape

12.2 Isolation

12.3 Deterministic routing

13. API and storage contracts

13.1 Versioning rules

13.2 Proposed controller endpoints

13.3 Proposed brain endpoints

13.4 Error classes

14. Security and trust

14.1 Worker containment

14.2 Knowledge trust

14.3 Credential lifecycle

15. Performance, limits, and experiments

16. Delivery sequence

16.1 Phase gates

16.2 Parallel work rules

16.3 Migration posture

17. Operator experience and observability

18. Acceptance definition

19. Workstream index and dependency interpretation

20. Detailed implementation work packages

Workstream FND: Baseline, contracts, and implementation governance

SV2-FND-01: Capture implementation source and deployment baselines