Define exact governed execution priority and retain canonical report/estimate authority

docs/agent-architecture.md

@@ -394,7 +394,7 @@ Among eligible nodes:
 
 1. select the project furthest below its weighted share of actual admitted seconds;
 2. within it, select the agent class furthest below its weighted share;
-3. within that class, select graph priority then oldest readiness using stable ties; and
+3. within that class, select canonical integer node priority projected unchanged from the governed Proposal work item (higher first, omission means zero), then oldest readiness using stable ties; and
 4. select the eligible provider with available concurrency and the least recent fair usage.
 
 Unused weighted share flows automatically to other ready work. Add a strict cap only for a verified external limit.
@@ -431,7 +431,7 @@ Acceptance:
 - [x] Implement the single AgentKernel entry point and build-time handler registry.
 - [x] Route the existing isolated provider transport through AgentKernel.
 - [x] Compile exact grants within the activity ceiling and team/project policy; block admission when required authority is unavailable.
-- [x] Enforce immutable assignment grants at runtime-service calls and validate the one result contract.
+- [ ] Enforce immutable assignment grants at runtime-service calls and validate the one result contract. BLOCKED: Agent312's native Kernel regressions permit handler-side source-write grant/path widening and deadline mutation before real Git publication.
 - [x] Implement deterministic `ReporterHandler` with no model dependency.
 - [x] Commit the report through TreeDX and return its ordinary exact reference.
 - [ ] Remove Reporter-specific scheduling/provider behavior.
@@ -550,6 +550,41 @@ Stop and record a blocker if exact authority, isolation, project access, provide
 
 ### Current active blocker
 
+- Human-approved priority clarification (October 4): the governed Proposal work item owns optional safe integer priority, projected unchanged onto its Actor and Reviewer nodes; higher values rank first only after eligibility and project/class fairness, and omission means zero. SDK validation/selection, native API producer/persistence/admission, and managed historical selection replay tests are authored in [API #490](https://github.com/treeseed-ai/api/issues/490), but remain unexecuted. This target clarification is not an implementation or passing acceptance claim.
+
+- Architecture-first test correction (October 2): [Agent312](https://github.com/treeseed-ai/agent/issues/312) now tests profile-owned instructions, class-rename invariance, exact-grant output selection, explicit integration, ordinary deterministic-handler admission/closure, immutable grants/paths/deadlines, and identity-neutral observed verification through native Node/Kernel/Git/runner boundaries. Focused regressions reproduce violations; component scene bindings are declared, not executed acceptance. Per the direct user instruction, unrelated testing and Agent319 delivery are held while these architectural gates are corrected. Full architecture/assignment acceptance remains open; the older observations below are historical, not the current frontier.
+
+- The same test-first audit now reproduces API name-dependent reporting and wrongly scoped lifecycle edges through actual SQL persistence. Seven existing graph guarantee contracts were corrected to the desired architecture, but remain planned without complete executable CLI/managed proof. API strict checking still fails on existing source/dependency declarations; no check was disabled. All three test layers must be aligned before product repair or unrelated testing resumes; implementation failures must not change the test oracle.
+
+- SDK schema regressions now reject the implementation-generated five-model subset as complete target verification. Native Git-backed repository verification currently accepts incomplete declarations and unchecked assignment definitions; union/exclusion constraints are also ignored. The previously excluded schema test is now in the active suite. Whole-target equivalence and CLI/managed semantic acceptance remain unproven; local component bindings do not close the Phase 1 gate ([Agent312](https://github.com/treeseed-ai/agent/issues/312)).
+
+- The SDK tests now consume the exact tracked canonical document through declared development-workspace authority, without copying its model registry. The unchanged canonical input passes, while target-derived definition, field, required-field, closure, reference and conditional mutations expose ignored contracts; real Git commits reproduce undetected stored/runtime definition changes. These are focused failing tests, not whole-system equivalence or executed managed acceptance. Missing canonical input blocks coverage, and standalone CI input wiring remains open. Product work stays held under the pure test-first gate.
+
+- Calibration tests now prove exact eligible sample selection, hard-ceiling arithmetic, independent public SDK execution, and original-DDL SQL selection without changing persisted graph or reservation authority. The managed read-back verifier rejects absent or malformed allocation receipts and immutable-limit drift after three genuine verifier regressions. These component and verifier-unit passes do not prove live sample custody, atomic admission, concurrent fairness, or complete managed acceptance; the all-three-layer architectural test gate remains open (Agent312).
+
+- Proposal-readiness tests now reject estimate-only scope, malformed review bounds, coerced estimates, and non-local or cyclic dependency graphs. Native Git/SQL/official-client tests preserve exact source bytes through repeated and concurrent reads, and expose the SDK's rejection of a canonical optional-capability omission. The existing managed graph verifier now requires exact typed Proposal and Decision authorities after a genuine verifier regression. These focused diagnostics and declared component bindings do not prove profile-grant admission, independent content joins, or complete managed acceptance; product repair stays held (Agent312). Package-owned test branches now reside in durable Git worktrees outside `/tmp`; diagnostic reports remain separate.
+
+- Decision-authority tests now reproduce acceptance of an operational SQL substitute without governed Decision content, unassigned review makers, conflicting dispositions, and out-of-window review evidence through unit and original-DDL/native content-reader boundaries. The existing managed verifier independently reads proposal and final review Decisions and checks exact source/candidate/identity/time after genuine verifier-unit failures. Its synthetic unit passes and component bindings are not live acceptance, full decision-policy/evidence retrieval, or complete three-layer alignment. Preserve the REDs and keep product repair held (Agent312).
+
+- Admission-replay tests now reproduce acceptance of changed grants, profiles, source/decision authority, runtime builds, deadlines, graph context, estimates and unrelated principals through unit and original-DDL/owning SQL repository boundaries. Exact replay remains read-only. The managed verifier now checks typed grants against frozen ceilings, context and one mutable workspace after six genuine verifier regressions. These checks do not prove independent policy retrieval, initial atomic admission, authenticated transport, provider isolation or full managed acceptance; the all-three-layer test-first gate remains open (Agent312).
+
+- Planning tests now require exact cycle membership, unchanged source context, all eight predecessor result identities and exact published contribution read-back. Native configured-Writer/content-serialization/Git tests reproduce publication with omitted, ID-only or foreign contribution evidence. The actual managed verifier and campaign monitor were strengthened after failing verifier regressions; later and terminal collaboration must be rechecked. Controlled transport responses are not live model/clock/usage proof, structural citations do not establish material correctness, and full per-event monitoring and three-layer alignment remain open. Product repair stays held (Agent312).
+- Workday-observation tests now reproduce missing/unavailable/malformed scheduling and incomplete/moving event evidence being accepted, including failure counts hidden by a completed run. The actual campaign assertions fail closed after verifier REDs. Original-DDL SQL/API reads prove a failed event can reside beyond the first 50-event page, while SDK and independent native CLI regressions still fail because the existing paginated event operation has no command binding. No product repair, live campaign or full transition-snapshot/semantic-join proof; architecture test completion remains open (Agent312).
+- Assignment-collection regressions now require explicit terminal page authority, exact cursor/row binding, ordered unique records and original workday clocks. The actual managed read-back gate was strengthened after verifier REDs; original-DDL SQL/service and independent native CLI tests read a failed assignment beyond page 50. These scoped diagnostics do not prove hidden-tail producer completeness, all-attempt usage pagination, independently expected assignment semantics or full managed acceptance. Product repair remains held while three-layer architecture test alignment is open (Agent312).
+- Usage-collection regressions now require complete scoped pages, finite measured time/native usage and accounting-mode authority rather than an ID suffix. The actual managed assertions were strengthened after verifier REDs; original-DDL SQL/service tests still admit a corrupt creation clock and zero recorded active time with positive elapsed time. Native CLI page read-back is scoped transport proof, not actual provider usage, canonical UsageSettlement equivalence, timestamp agreement, transactional exactly-once settlement or full managed acceptance. Those three-layer gaps remain open (Agent312).
+- Settlement authority regressions now reproduce accepted native/provider/model replay changes, coerced attempt identities, incomplete frozen attempts and corrupt native units through the actual owning accounting functions and transactional SQL. Matching retry, real late-write rollback/retry and truthful overrun/no-cap-raise controls pass only at their scoped boundaries. The managed gate now compares aggregate measurements with completed-result usage; provider-generated measurements, independent clock agreement, full canonical settlements, separate-server concurrency and durable teardown remain unproven. Product repairs remain held (Agent312).
+- Provider-facing accounting tests now reproduce coerced values, conflicting provider identity, invalid nonterminal accounting modes and lost incremental token counts through the owning service and original SQL. Matching incremental/terminal replay, cleanup replay and refusal of zero-release with unaccounted seconds pass only at those isolated boundaries. Managed assertions were strengthened after verifier REDs to reject informational productive time and incremental seconds outside the sole attempt or above its aggregate. Authentication, live provider usage, canonical settlement and complete recovery/teardown remain open; API395 preserves continuing evidence because Agent312 is at its body limit. Product repairs stay held.
+- Cancellation/recovery tests now reproduce fabricated zero settlement after a stored execution clock started, unsafe retry classification with unknown productive usage, and a real recovery SQL parameter failure. Active cancellation remains a request and measured cleanup replay stays exactly once at the isolated SQL boundary. The managed stopped gate now rejects zero usage after visible productive time following a verifier RED. Full canonical attempt/settlement joins, provider-generated measurements, authenticated transport, server concurrency and physical durable teardown remain unproven; all-three-layer alignment and product repairs stay held (API395).
+- Workday-level SQL tests also reproduce zero-usage terminalization after productive execution and a false complete-cleanup result with an orphan running node. Scoped lease preservation, measured cleanup replay, actual transition rollback/retry, and continued recovery past a corrupt historical run pass only at their isolated boundaries. The managed stopped verifier now rejects retained lease state, expiry and renewal after a verifier RED; historical runner identity alone is not an open-session receipt. Physical cleanup, independent graph/resource joins and full acceptance remain open. API395 retains the exact failed evidence; product repair remains held.
+
+- Workspace cleanup tests now reproduce an open remote resource being skipped after SQL handle revocation, an interrupted operator close not being retried, unqualified upstream 404 denial being accepted as absence, and success responses being accepted without exact closed-resource agreement. Real owning SQL and the official TreeDX HTTP client exercise a controlled endpoint, not a native TreeDX server or physical sandbox. Managed verifier regressions also exposed issued or malformed handles despite claimed verified teardown; the acceptance-only checks now deny those contradictions. Independent resource/session closure and the all-three-layer test gate remain open; exact failures are preserved in API395.
+- Independent workspace read-back tests now reproduce successful public API replies with a foreign or missing workspace identity despite the correct repository. Exact open/closed reads and scope denials pass through the owning catalog, original SQL and official client against controlled HTTP resources. Five managed-verifier regressions exposed missing independent reads; its terminal gates now require an exact closed resource and project receipt through the existing project-scoped CLI command, failing closed on unavailable or denied reads. Native CLI transport tests preserve both open status and denials; they do not prove native TreeDX, physical workspace/session teardown or complete acceptance. All-three-layer alignment and product repair remain held (API395).
+- Provider terminal-report tests now reproduce synthesized or coerced performance facts, a changed terminal attempt ordinal, and SQL revocation while an independently read workspace remains open. Original transactional SQL preserves matching replay and rolls back an injected late revocation failure; controlled upstream resources and supplied usage are not native provider or physical cleanup proof. Two managed-verifier regressions exposed missing immutable-ordinal joins; the acceptance-only gate now checks the presented assignment and measurement against that ordinal. Retry/recovery races, complete canonical records, generated usage and full scene acceptance remain open; product repair stays held (API395).
+- Provider-return SQL tests now reproduce an unchanged retry node revision with a rewritten historical attempt ordinal, missing measured settlement, and duplicate successful transitions/graph revisions from concurrent matching reports. Wrong-owner/token/expired-return denials and sequential replay remain read-only at the isolated SQL boundary. A managed-verifier regression exposed acceptance of returned history at the completed retry's same node revision; the acceptance-only graph gate now rejects that contradiction. Embedded SQL concurrency and supplied measurements are not independent PostgreSQL connections, actual provider charges or full scene proof. All-three-layer alignment and product repair remain held (API395).
+- Successful-completion tests now reproduce accepted canonical result clocks before the original start or beyond the original productive/reporting interval. The actual provider sequence settles usage before completion; an initial unsupported expectation that completion itself creates that charge is preserved as an oracle error, not a product failure. The managed result gate rejects missing or contradictory clocks after a verifier RED. Exact Git content, independently generated clock/usage evidence, separate-server races, canonical settlements and physical cleanup remain unproven; scoped SQL and component declarations do not complete three-layer acceptance. Product repairs remain held (API395).
+
+- Source-publication receipt tests now reproduce accepted foreign repositories and branches through the owning wrapper and real broker client with isolated Git. The endpoint is a controlled input, not the actual Deployment broker or its authorization/verifier. After a genuine verifier RED, the managed results gate requires a Git candidate in the sole immutable repository and agreement for any presented optional branch; read-only citations remain valid. Native broker publication, base/grant/path verification, sandbox closure, complete canonical content read-back and full scene proof remain open. Product receipt failures are preserved in API395; product repair stays held.
+
 - Native Reporter closure is proven by the passing continuation; SDK #347/#348 calibration and Agent #277/#278 observed-red evidence repairs are integrated. Fresh DR stopped before acting when a chat response lacked its exact invocation binding. API #468/#469 repairs a reproduced denied-admission binding defect with package-owned SQL scenes; checked staging delivery and live proof remain required. DR's missing teardown receipt remains failed evidence, not proof of a physical leak. No full SDK pass (Platform #520).
 
 ### Next acceptance milestone