[EPIC] Forge VNext — budget-aware general agent runtime and installable Workforces

[Joncallim]

Execution mode: tracking
Canonical architecture: ADR 0014 + docs/forge-vnext-architecture.md

Issue Type

Epic - VNext programme tracking. Do not dispatch this Epic directly to an implementation agent.

Context

Forge is evolving from a coding-focused control plane into a local-first, budget-aware, deterministic-first runtime for installing, governing and operating AI Workforces.

Software Engineering remains the first compatibility/proof Workforce. Forge Core becomes generic Mission/Execution/Resource/Capability/Grant/Operation/Artifact/Gate/Trigger/Budget infrastructure rather than a permanent coding product.

Forge eventually replaces Hermes/HearthBot orchestration. Hermes is requirements/history only: no source/config/state/runtime compatibility or Forge->Hermes fallback is allowed.

Canonical programme invariants:

1. No always-on LLM parent/orchestrator.
2. Idle/unchanged operation costs zero model tokens.
3. Optimize expected cost to a verified outcome subject to a quality floor.
4. Agents/package prose do not possess authority; Forge lends scoped revocable Grants.
5. Resource and Capability are distinct.
6. Workers/verifiers produce evidence; deterministic Gates decide.
7. Workforce packages are declarative data, not trusted executable plugins.
8. External side effects use idempotency/reconciliation; ambiguous submission is never blindly retried.
9. Version/pin anything that can change run behavior/evidence meaning.
10. Preserve [EPIC] MCP admission, bounded context, and release-readiness trust boundary #172/[FEATURE] Add deterministic operation catalog and typed execution harness #201/[FEATURE] Normalize execution outcomes and stop reasons #185/[FEATURE] Add capability reliability ledger #186 trust foundations unless an explicit migration proves equivalence.
11. No big-bang rewrite or duplicate orchestration truth.
12. No model ensembles/voting/latent bridges in this programme.
13. PostgreSQL is durable orchestration/evidence truth; Redis is reconstructable transport/cache.
14. Agent dispatch must remain dependency/tracking aware through the [BUG][P0] Make agent readiness dependency-aware and prevent tracking issues from direct dispatch #354 control plane.
15. Backup restore/database rollback is a distinct recovery class: restored local truth remains quarantined until current external state/authority is reconciled ([FEATURE][RELIABILITY] Add restore quarantine and external-state reconciliation for backup recovery #366).
16. A Work Package remains the dependency-scoped handoff unit. Routine readiness, sequencing, fan-out/join and handoff are deterministic; downstream Agent Runs receive freshly compiled bounded context rather than supervisor-written transcript summaries ([FEATURE] VNext Phase 1 — deterministic budget, routing, and context economics #335/[FEATURE][ARCH] VNext Phase 1B — deterministic Workflow kernel and artifact-routed dispatch #367).

Desired Outcome

Install a Workforce. Bind the Resources it may use. Grant bounded Capabilities. Give it a Mission. Forge handles deterministic orchestration, budgeting, delegation, execution, verification, evidence, recovery and escalation.

All implementation issues are planned in advance with explicit dependencies and orthogonal checkpoints. Only the current dependency frontier is dispatchable. Tracking Epics remain status/architecture maps, never implementation work orders.

At programme completion, Forge proves Software Engineering, non-repository Deep Research, persistent Trigger-driven operation, safe backup/restore recovery, a bounded Infrastructure Ops side effect and complete HearthBot/Hermes cutover through the same governed runtime.

Tasks

Bootstrap / current-beta hardening

• [BUG][P0] Make agent readiness dependency-aware and prevent tracking issues from direct dispatch #354 — dependency/tracking-aware agent readiness. Closeout complete.
• PR docs: align repository agent instructions with VNext runtime truth #351 — repository-agent instruction alignment; still open as of 1 October 2026. Recheck exact-head CI and independent review before any merge recommendation; merge requires explicit operator authorization.
• [BUG][P0] Eliminate periodic generative provider-health pings and enforce zero-token idle #346 — zero-token passive provider health.
• [SECURITY][P0] Provision isolated base-gate GitHub App and protected credential lane #371 — isolated base gate-publisher App provisioning/verification under operator authority.
• [BUG][P0][SECURITY] Establish unique, source-bound GitHub gate contexts before main protection #370 — trusted base gate publication after [SECURITY][P0] Provision isolated base-gate GitHub App and protected credential lane #371.
• [BUG][P0][SECURITY] Enforce Forge release gates with GitHub main-branch protection/ruleset #348 — effective base main repository rules/checks after trusted publication.
• [BUG][P1][SECURITY] Pin GitHub Actions dependencies to immutable commit SHAs #352 — immutable GitHub Action dependency pins and workflow permissions; depends on [BUG][P0][SECURITY] Enforce Forge release gates with GitHub main-branch protection/ruleset #348.
• [BUG][P1][SECURITY] Pin trusted external container images to immutable OCI digests #363 — OCI image pins and policy guard; owns image implementation alongside [BUG][P1][SECURITY] Pin GitHub Actions dependencies to immutable commit SHAs #352.
• [BUG][P2] Make required Web CI dependency installation lockfile-exact #364 — lockfile-exact Web CI after [BUG][P1][SECURITY] Pin GitHub Actions dependencies to immutable commit SHAs #352.
• [BUG][P1] Managed-migration proof can false-green when ripgrep is unavailable #362 — fail-closed managed-migration proof search/error handling.
• [BUG][P0][PRIVACY] Stop default task-title egress to DuckDuckGo; make web research explicit and policy-bound #353 — disable default public task-title/web-search egress.
• [OTHER] Retire superseded remote branches after VNext backlog canonicalization #358 — closed with accepted exact-ref cleanup evidence on 11 September 2026; deliberately retained refs are recorded in that issue. Do not rerun the old deletion wave.
• [OTHER][RELEASE] Complete S6 external-controller trust binding and live release evidence #357 — S6 external-controller/live trust closeout; depends on [BUG][P0][SECURITY] Enforce Forge release gates with GitHub main-branch protection/ruleset #348/[BUG][P1][SECURITY] Pin GitHub Actions dependencies to immutable commit SHAs #352 and is tracked by [EPIC] MCP S6 release proof and external-controller finalization #181.

Readiness is now derived by the #354 dependency/tracking control plane. Treat managed readiness labels as projections/cache, not authority; always re-check current Depends on:/tracking state at dispatch time.

Generic runtime phases

• [FEATURE][ARCH] VNext Phase 0 — generic runtime contracts and compatibility seam #334 — Phase 0: generic contracts + compatibility seam; depends on [BUG][P0] Make agent readiness dependency-aware and prevent tracking issues from direct dispatch #354.
• [BUG][P0] Make Postgres-to-Redis wakeups durable, idempotent, and recoverable #347 — durable PostgreSQL->Redis continuation/outbox; depends on [FEATURE][ARCH] VNext Phase 0 — generic runtime contracts and compatibility seam #334 and becomes the reusable wakeup primitive.
• [FEATURE] VNext Phase 1 — deterministic budget, routing, and context economics #335 — Phase 1: budgets/routing/context/egress/common model broker, including first-class ContextManifest/ContextCompiler; depends on [FEATURE][ARCH] VNext Phase 0 — generic runtime contracts and compatibility seam #334/[BUG][P0] Eliminate periodic generative provider-health pings and enforce zero-token idle #346/[BUG][P0][PRIVACY] Stop default task-title egress to DuckDuckGo; make web research explicit and policy-bound #353.
• [FEATURE][ARCH] VNext Phase 1B — deterministic Workflow kernel and artifact-routed dispatch #367 — Phase 1B: deterministic Workflow kernel + artifact-routed dispatch; depends on [FEATURE] VNext Phase 1 — deterministic budget, routing, and context economics #335, runs in parallel with [FEATURE] VNext Phase 2 — secure generic execution envelope and side-effect recovery #336, and is consumed by [FEATURE] VNext Phase 3 — complete Software Engineering as the first generic Workforce #337.
• [FEATURE] VNext Phase 2 — secure generic execution envelope and side-effect recovery #336 — Phase 2: confined execution/side-effect recovery; depends on [FEATURE][ARCH] VNext Phase 0 — generic runtime contracts and compatibility seam #334/[FEATURE] VNext Phase 1 — deterministic budget, routing, and context economics #335 and may proceed in parallel with [FEATURE][ARCH] VNext Phase 1B — deterministic Workflow kernel and artifact-routed dispatch #367.
• [FEATURE] Complete verification-goal on-demand proof execution through VNext #355 — on-demand verification-goal proof execution; depends on [FEATURE] VNext Phase 2 — secure generic execution envelope and side-effect recovery #336.
• [FEATURE] Add independent Verification Workforce execution #188 — independent Verification Workforce/Gate contract; depends on [FEATURE] VNext Phase 2 — secure generic execution envelope and side-effect recovery #336 and can proceed alongside [FEATURE] Complete verification-goal on-demand proof execution through VNext #355 without importing it.
• [FEATURE] VNext Phase 3 — complete Software Engineering as the first generic Workforce #337 — Phase 3: complete Software Engineering through VNext; depends on [FEATURE] Add independent Verification Workforce execution #188/[FEATURE] Complete verification-goal on-demand proof execution through VNext #355/[FEATURE][ARCH] VNext Phase 1B — deterministic Workflow kernel and artifact-routed dispatch #367 and is the first production convergence of the Workflow kernel with confined execution.
• [FEATURE] Add evidence-based earned autonomy policy engine #189 — evidence-based earned-autonomy policy; depends on [FEATURE] Add capability reliability ledger #186/[FEATURE] Add independent Verification Workforce execution #188/[FEATURE] VNext Phase 3 — complete Software Engineering as the first generic Workforce #337.
• [FEATURE] VNext Phase 4 — declarative Workforce packages and Software Engineering extraction #338 — Phase 4: declarative Workforce package system + Software Engineering extraction; depends on [FEATURE] VNext Phase 3 — complete Software Engineering as the first generic Workforce #337.
• [FEATURE] VNext Phase 5 — Deep Research Workforce and non-repository resource proof #339 — Phase 5: Deep Research non-repository Workforce; depends on [FEATURE] VNext Phase 4 — declarative Workforce packages and Software Engineering extraction #338; implements only minimal generic read Resources and hands their proven contract to Phase 8.
• [FEATURE] VNext Phase 6 — persistent Missions, checkpoints, leases, and bounded autonomy #340 — Phase 6: persistent Missions/checkpoints/leases; depends on [FEATURE] VNext Phase 5 — Deep Research Workforce and non-repository resource proof #339/[FEATURE] Add evidence-based earned autonomy policy engine #189.
• [FEATURE] VNext Phase 7 — Trigger/Event runtime with dedupe, causality, and zero-token idle #341 — Phase 7: Trigger/Event runtime; depends on [FEATURE] VNext Phase 6 — persistent Missions, checkpoints, leases, and bounded autonomy #340/[BUG][P0] Make Postgres-to-Redis wakeups durable, idempotent, and recoverable #347.
• [FEATURE] Schedule verification-goal proof runs through generic Triggers #356 — verification-goal scheduling through Triggers; depends on [FEATURE] VNext Phase 7 — Trigger/Event runtime with dedupe, causality, and zero-token idle #341/[FEATURE] Complete verification-goal on-demand proof execution through VNext #355.
• [FEATURE] VNext Phase 8 — general Resource/Capability adapter ecosystem #342 — Phase 8: generic Resource/Capability adapters; depends on [FEATURE] VNext Phase 7 — Trigger/Event runtime with dedupe, causality, and zero-token idle #341, generalizes/migrates Phase-5 readers, and may proceed alongside [FEATURE] Schedule verification-goal proof runs through generic Triggers #356 where contracts do not conflict.
• [FEATURE][RELIABILITY] Add restore quarantine and external-state reconciliation for backup recovery #366 — Restore/DR gate: backup restore quarantine + external-state reconciliation; depends on [FEATURE] VNext Phase 8 — general Resource/Capability adapter ecosystem #342 and must close before the first persistent autonomous external-side-effect proof.
• [FEATURE] Add Project Sentinel detection and escalation flow #190 — Sentinel deterministic detection/escalation; depends on [FEATURE] Add evidence-based earned autonomy policy engine #189/[FEATURE] VNext Phase 7 — Trigger/Event runtime with dedupe, causality, and zero-token idle #341/[FEATURE] VNext Phase 8 — general Resource/Capability adapter ecosystem #342/[FEATURE] Schedule verification-goal proof runs through generic Triggers #356 so it uses generic Trigger + adapter side-effect paths rather than bespoke connectors.
• [FEATURE] VNext Phase 9 — Infrastructure Ops Workforce and persistent side-effect proof #343 — Phase 9: Infrastructure Ops persistent side-effect proof; depends on [FEATURE] VNext Phase 8 — general Resource/Capability adapter ecosystem #342/[FEATURE] Add Project Sentinel detection and escalation flow #190/[FEATURE][RELIABILITY] Add restore quarantine and external-state reconciliation for backup recovery #366.
• [FEATURE] Add reliability, autonomy, and regression reporting #191 — evidence/reliability/autonomy reporting; depends on [FEATURE] Add capability reliability ledger #186/[FEATURE] Add independent Verification Workforce execution #188/[FEATURE] Add evidence-based earned autonomy policy engine #189/[FEATURE] Add Project Sentinel detection and escalation flow #190/[FEATURE] Schedule verification-goal proof runs through generic Triggers #356.
• [FEATURE] VNext Phase 10 — HearthBot cutover and complete Hermes retirement #344 — Phase 10: HearthBot cutover/Hermes retirement; depends on [FEATURE] VNext Phase 9 — Infrastructure Ops Workforce and persistent side-effect proof #343/[FEATURE] Add reliability, autonomy, and regression reporting #191.

Tracking-only Epics

• [EPIC] MCP admission, bounded context, and release-readiness trust boundary #172 — MCP admission/bounded-context/release trust boundary.
• [EPIC] MCP S6 release proof and external-controller finalization #181 — S6 external-controller release proof.
• [EPIC] Evidence, verification, and earned-autonomy programme #184 — verification/evidence/earned-autonomy programme.
• [EPIC] Verification goals and proof-run lifecycle #187 — verification-goal lifecycle.
• [EPIC] Forge VNext — budget-aware general agent runtime and installable Workforces #333 — this programme map.
• [BUG][P2][RELIABILITY] Prove disaster-recovery restore safety for Forge authority and evidence state #365 — historical DR coverage tracking only; [FEATURE][RELIABILITY] Add restore quarantine and external-state reconciliation for backup recovery #366 is the sole implementation owner.

Branch / stale-plan hygiene

• PR feat: implement project verification goals and proof runs (#187) #331 closed/superseded without merge; valid requirements moved to [FEATURE] Complete verification-goal on-demand proof execution through VNext #355/[FEATURE] Schedule verification-goal proof runs through generic Triggers #356.
• Legacy mega-issues [FEATURE] Add adversarial agent mode with default rules and project override editor #40/Build an AI-native issue tracker with GitHub sync and automatic Epic/Milestone grouping #42/[FEATURE] Create pull requests and merge/rework gates from approved workforce output #69/P1: Technical hardening for DB-backed configuration, coding standards, and modularity #121/[P0] Unify Forge agent/workforce model for Claude, Codex, editable prompts, and Workspace roadmap #124 and duplicate [FEATURE][ARCH] Route every model invocation through one budget/routing/receipt boundary #349 closed with successor mappings.
• [OTHER] Retire superseded remote branches after VNext backlog canonicalization #358 cleanup wave closed; later cleanup needs fresh scope/evidence.
• Keep audit/vnext-instruction-boundary while PR docs: align repository agent instructions with VNext runtime truth #351 remains open.

Acceptance Criteria

• Every remaining implementation issue contains Execution mode: implementation, explicit Depends on: metadata, objective acceptance criteria, primary code seams, a PR-sized implementation sequence, out-of-scope boundaries and deep orthogonal checkpoints.
• Tracking Epics [EPIC] MCP admission, bounded context, and release-readiness trust boundary #172/[EPIC] MCP S6 release proof and external-controller finalization #181/[EPIC] Evidence, verification, and earned-autonomy programme #184/[EPIC] Verification goals and proof-run lifecycle #187/[EPIC] Forge VNext — budget-aware general agent runtime and installable Workforces #333 are never direct implementation dispatch targets.
• ready-for-agent remains a truthful projection of the dependency frontier rather than template validity.
• Idle persistent operation makes zero LLM calls when unchanged.
• Hard Mission budgets block before over-budget provider invocation; every production model call has routing/budget/context/egress evidence.
• Routine Workflow readiness, sequencing, fan-out/join and handoff consume zero model calls; Work Packages and Artifacts remain the durable handoff/state primitives.
• Restart/replay does not duplicate confirmed side effects; ambiguous writes reconcile rather than blind retry.
• Backup restore enters durable quarantine, fences stale runtime state and reconciles current external effects/Triggers/credentials/autonomy/budgets before consequential autonomy resumes.
• Workers cannot self-verify into authority and child work cannot widen parent Grant/Resource/budget scope.
• Hostile Resource/package/prompt content cannot widen authority or provider/network egress.
• Operator cancellation/revocation prevents new side effects/model calls.
• Running Missions remain pinned across Workforce/package updates.
• Software Engineering passes two clean generic-runtime release runs including bounded rework/restart.
• Deep Research completes a non-repository evidence workflow through the same Core.
• Persistent Missions remain quiescent with zero-token idle and survive restart.
• Trigger duplicate/replay/self-loop/signature/catch-up cases are bounded and reconstructable.
• Infrastructure Ops proves ongoing deterministic monitoring plus one explicitly approved bounded recoverable side effect under earned autonomy after the restore/DR gate is proven.
• Operator reporting exposes evidence/freshness/critical findings without opaque trust scores.
• HearthBot is only a thin Forge interface and Hermes can be fully stopped/removed without losing retained responsibilities.
• New implementation branches start from current main only after declared dependencies close; stale pre-VNext branches are not used as implementation bases.

Planning Standard

Before dispatch, every implementation issue must include source-of-truth/authority boundaries, implementation sequence, primary code seams, objective pass conditions, failure/restart/concurrency/privacy/security tests and logical orthogonal checkpoints using .ai/skills/orthogonal-review.md.

Implementation agents should not redesign programme architecture unless a concrete contradiction is proven. If a required contract is missing, fail/block the issue and open a narrow architecture finding rather than inventing a second system.

Later explicit hostile-review addenda/corrections on an implementation issue refine earlier planning. When planning comments conflict, the later explicit correction wins unless current code or an accepted spec has since changed.

Explicit Non-Goals

• Model ensembles/latent-state bridging.
• Permanent LLM parent agent.
• Arbitrary model-authored shell authority.
• Self-modifying Workforce/runtime code.
• Automatic generation/trust of executable Workforces.
• Public Workforce marketplace before provenance/update safety is proven.
• Distributed Forge clusters / active-active Forge replicas.
• General auto-merge/deployment authority.
• Enterprise multi-user RBAC in the initial programme.
• Importing Hermes code/config/state.
• A2A/direct agent-to-agent orchestration as a second runtime truth.
• LangGraph or another agent framework as Forge Core's authoritative workflow/checkpoint store.

Review / Delivery Rule

Every PR follows the repository full independent orthogonal-review protocol. Findings are classified change-blocking vs adjacent; adjacent pre-existing improvements become separate issues rather than causing infinite rework. A phase closes only with objective test/evidence artifacts and explicit residual uncertainty, not a model saying “done.”

[github-actions]

FORGE issue validation

This issue is not semantically dispatchable.

Reason	Detail

Readiness labels are projections, not authority. Command, dispatch, and handoff always re-resolve current semantic truth.

[Joncallim]

Final hostile-review amendments before freeze (2026-09-03): after the 17 recorded architecture passes, the PR/issue pass found six smaller specification gaps and tightened the child contracts without changing the VNext architecture: (1) atomic concurrent budget reservations + explicit unknown-cost-provider policy in #335; (2) package-defined gates can only add restrictions, never weaken Forge/operator ceilings, plus transitive dependency digest/permission review in #338; (3) authenticated webhook/source identity and replay-window policy in #341; (4) typed output validation before consequential Operations in #336; (5) sensitive Artifact/evidence retention/redaction semantics in #336; and (6) CI whitespace hygiene in PR #345. No further material architecture change emerged after these amendments. Remaining uncertainty is implementation-specific and is explicitly assigned to phase gates/ADRs rather than treated as solved.

[Joncallim]

Architecture freeze merged to main via PR #345 at merge commit ef51411a9e48d3b6a48bfcd6366c0bdda7c83fd5 on 2026-09-03.

Final gate evidence on the frozen head (196a4b376316a854c68f539b792a8b810ef160ed):

• PR Contract Check #960 — success (post-final PR-body edit)
• Web CI #996 — success
• Web CI included migrations/upgrade proofs, lint, TypeScript, full zero-skip unit suite, PostgreSQL/Redis/cross-sink proofs, MCP contract, production build, concurrency proof, operator recovery and fail-closed E2E bridge suite.
• Final PR changed exactly 9 documentation/architecture files; no runtime/code files.

Review outcome: no blockers remained in the inspected architecture scope after the iterative revisions. Residual uncertainties are implementation-specific and are deliberately assigned to phase gates/ADRs rather than treated as solved.

The canonical implementation entry point is now #334. Do not skip directly to new Workforces, broad Workspace expansion, or Hermes cutover.

[Joncallim]

Canonical implementation handoff — 2026-09-03

This comment is the execution handoff after the repo-wide aggressive planning/branch/dependency review. It does not replace ADR 0014 or the issue bodies; it defines how agents should consume them.

Baseline

• Start every new implementation branch from the then-current main; planning baseline observed here was ef51411a9e48d3b6a48bfcd6366c0bdda7c83fd5.
• PR docs: align repository agent instructions with VNext runtime truth #351 (audit/vnext-instruction-boundary, head d1325afee81435ce0bcf44b23fd95930a72c40a0) is the only live PR at handoff. Preserve its branch while the PR is open. Do not merge it merely as part of this handoff.
• PR feat: implement project verification goals and proof runs (#187) #331 is superseded historical evidence only. Never use its branch as an implementation base.
• [OTHER] Retire superseded remote branches after VNext backlog canonicalization #358 is the exact reviewed remote-ref deletion manifest. Never delete by wildcard/pattern or delete a ref whose SHA/open-PR state changed after review.

Bootstrap wave

The only pre-#354 dispatchable issues are #346, #348, #353, #354, #358.

1. Treat [BUG][P0] Make agent readiness dependency-aware and prevent tracking issues from direct dispatch #354 as the control-plane bootstrap priority. It must make structural issue validity distinct from dispatch readiness, parse Execution mode / Depends on, reject tracking/open-dependency/cycle/inaccessible states, and re-check at command time rather than trusting labels.
2. [BUG][P0] Eliminate periodic generative provider-health pings and enforce zero-token idle #346, [BUG][P0][SECURITY] Enforce Forge release gates with GitHub main-branch protection/ruleset #348, [BUG][P0][PRIVACY] Stop default task-title egress to DuckDuckGo; make web research explicit and policy-bound #353 and [OTHER] Retire superseded remote branches after VNext backlog canonicalization #358 may proceed independently/in parallel from current main; do not make them wait for [BUG][P0] Make agent readiness dependency-aware and prevent tracking issues from direct dispatch #354 merely because the current label implementation is defective.
3. Until [BUG][P0] Make agent readiness dependency-aware and prevent tracking issues from direct dispatch #354 closes, dispatch by this explicit issue-number frontier rather than trusting ready-for-agent as authority.
4. After [BUG][P0] Make agent readiness dependency-aware and prevent tracking issues from direct dispatch #354 lands, run its full backlog reconciliation and prove tracking Epics are non-dispatchable, open dependencies block, stale/manual ready labels cannot bypass command-time checks, and dependency close/reopen converges correctly.
5. Only after that proof may automatic queue consumption rely on the readiness projection.

Automatic advancement after bootstrap

Once #354 closes, dependency state—not programme prose or model judgment—controls advancement. Important immediate unlocks:

• [BUG][P0] Make agent readiness dependency-aware and prevent tracking issues from direct dispatch #354 -> [FEATURE][ARCH] VNext Phase 0 — generic runtime contracts and compatibility seam #334.
• [BUG][P0][SECURITY] Enforce Forge release gates with GitHub main-branch protection/ruleset #348 -> [BUG][P1][SECURITY] Pin GitHub Actions dependencies to immutable commit SHAs #352; [BUG][P0][SECURITY] Enforce Forge release gates with GitHub main-branch protection/ruleset #348 + [BUG][P1][SECURITY] Pin GitHub Actions dependencies to immutable commit SHAs #352 -> [OTHER][RELEASE] Complete S6 external-controller trust binding and live release evidence #357.
• [FEATURE][ARCH] VNext Phase 0 — generic runtime contracts and compatibility seam #334 -> [BUG][P0] Make Postgres-to-Redis wakeups durable, idempotent, and recoverable #347 and contributes to [FEATURE] VNext Phase 1 — deterministic budget, routing, and context economics #335.
• [FEATURE][ARCH] VNext Phase 0 — generic runtime contracts and compatibility seam #334 + [BUG][P0] Eliminate periodic generative provider-health pings and enforce zero-token idle #346 + [BUG][P0][PRIVACY] Stop default task-title egress to DuckDuckGo; make web research explicit and policy-bound #353 -> [FEATURE] VNext Phase 1 — deterministic budget, routing, and context economics #335.
• [FEATURE][ARCH] VNext Phase 0 — generic runtime contracts and compatibility seam #334 + [FEATURE] VNext Phase 1 — deterministic budget, routing, and context economics #335 -> [FEATURE] VNext Phase 2 — secure generic execution envelope and side-effect recovery #336.
• [FEATURE] VNext Phase 2 — secure generic execution envelope and side-effect recovery #336 -> [FEATURE] Add independent Verification Workforce execution #188 and [FEATURE] Complete verification-goal on-demand proof execution through VNext #355 in parallel.
• [FEATURE] Add independent Verification Workforce execution #188 + [FEATURE] Complete verification-goal on-demand proof execution through VNext #355 -> [FEATURE] VNext Phase 3 — complete Software Engineering as the first generic Workforce #337.

Continue thereafter using the exact Depends on: metadata in each issue and the graph in #333. Do not implement a downstream consumer early merely because its contract is mentioned by an upstream issue.

Dependency-isolation corrections that are intentional

• [FEATURE] Add independent Verification Workforce execution #188 and [FEATURE] Complete verification-goal on-demand proof execution through VNext #355 are parallel capabilities; neither depends on the other. [FEATURE] VNext Phase 3 — complete Software Engineering as the first generic Workforce #337 is their integration point.
• [FEATURE] Add evidence-based earned autonomy policy engine #189 can close before [FEATURE] Schedule verification-goal proof runs through generic Triggers #356. It consumes generic verified proof/failure evidence; [FEATURE] Schedule verification-goal proof runs through generic Triggers #356 later emits the same evidence contract when scheduled proofs exist.
• [FEATURE] VNext Phase 2 — secure generic execution envelope and side-effect recovery #336 can close before external S6 closeout [OTHER][RELEASE] Complete S6 external-controller trust binding and live release evidence #357, provided every [OTHER][RELEASE] Complete S6 external-controller trust binding and live release evidence #357-gated Capability remains explicitly unavailable/fail-closed. Generic confinement evidence must never be relabelled as external S6 release evidence.
• [FEATURE] VNext Phase 7 — Trigger/Event runtime with dedupe, causality, and zero-token idle #341 can close before [FEATURE] Schedule verification-goal proof runs through generic Triggers #356/[FEATURE] Add Project Sentinel detection and escalation flow #190. It proves generic Trigger consumer ports with synthetic fixtures only; [FEATURE] Schedule verification-goal proof runs through generic Triggers #356 and [FEATURE] Add Project Sentinel detection and escalation flow #190 own their later product integrations.

Implementation discipline

For every issue:

• implement only after declared dependencies are closed;
• use small reversible PRs/slices in the issue's stated sequence;
• preserve the stated source-of-truth and authority boundaries;
• run deterministic checks before model review where applicable;
• run fresh contract/state, failure/restart/concurrency, security/privacy/authority, regression and evidence-readiness reviews at each logical checkpoint;
• classify findings as change-blocking vs adjacent; adjacent pre-existing improvements become separate issues rather than expanding the active rework loop;
• do not invent a second scheduler, orchestration ledger, Operation authority, evidence truth, provider router or Hermes compatibility path;
• do not use role names, prompt prose, model confidence or labels as authority;
• if a genuine architecture contradiction remains, fail/block narrowly and open a focused finding instead of redesigning the programme opportunistically.

Handoff invariant

At the instant of this handoff, the manually normalized ready-for-agent query is expected to return exactly #346, #348, #353, #354, #358, with zero open needs-clarification issues. The durable implementation of that invariant belongs to #354.

[Joncallim]

PR #359 — Specification Framework Hostile Remediation

Status: Open, pending CI
Branch: docs/vnext-specification-framework
Head SHA: 0f1ad58

What this PR delivers

• All P0/P1 findings from the final hostile remediation tranche applied
• 7 new documents (phase-reference, data-model-reference, 5 hostile review reports)
• 13 GitHub issues updated with spec references and corrected language
• All dependency facts verified preserved

Spec governance

All 15 specs: Proposed (freeze candidate) — pending operator-approved merge to become Accepted.

Next steps after merge

Phase 0 implementation (#334) can begin using the corrected specs.

[Joncallim]

Consolidated execution architecture + one-pass Codex handoff

Planning baseline used for this architecture: main@e9d1129ccf0699e41cc1625eeb9cdd62186147c6 after #354 closeout. This SHA is evidence, not a future execution lock. Every execution starts by re-fetching fresh GitHub/repository truth.

Detailed issue-owned implementation handoffs have been posted to:

• PR docs: align repository agent instructions with VNext runtime truth #351 — refresh VNext instruction truth and resolve its existing independent-review P2;
• [FEATURE][ARCH] VNext Phase 0 — generic runtime contracts and compatibility seam #334 — Phase-0 Mission/Execution canonical authority + staged compatibility migration;
• [BUG][P0] Eliminate periodic generative provider-health pings and enforce zero-token idle #346 — zero-token provider readiness evidence;
• [BUG][P0][SECURITY] Enforce Forge release gates with GitHub main-branch protection/ruleset #348 — enforced GitHub main base ruleset;
• [BUG][P0][PRIVACY] Stop default task-title egress to DuckDuckGo; make web research explicit and policy-bound #353 — explicit/minimized public web research;
• [OTHER] Retire superseded remote branches after VNext backlog canonicalization #358 — exact-ref branch retirement.

The instructions below are the cross-wave orchestration contract. The issue/PR handoffs remain authoritative for their own detailed scope. If there is conflict, use this order: current operator instruction → accepted repo specs/ADRs → current issue body + latest human-authored architecture handoff → live repository/tests → this consolidated sequencing note. Never weaken an accepted invariant to make the wave easier.

---

A. Architecture verdict after hostile review

The current ready frontier can proceed, but only with the following corrections/constraints baked in:

1. docs: align repository agent instructions with VNext runtime truth #351 is not merge-ready merely because old CI is green. Its existing Codex review contains an unresolved P2: it weakened independent Review from every PR to “substantive” PRs, conflicting with the repository's own core responsibility. Fix by requiring independent Review for every PR while allowing bounded/quick orthogonal review for trivial/mechanical work. No ceremonial full model call is required for trivial changes.

2. [FEATURE][ARCH] VNext Phase 0 — generic runtime contracts and compatibility seam #334 must perform a real strangler migration, not add Mission DTOs beside Task truth. SPEC-0014 requires EXPAND → BACKFILL/ADAPT → SHADOW → SWITCH → VERIFY → CONTRACT with exactly one authoritative write path.

3. task_attempts are transport claims, not VNext Executions. Live code records claims/recovery across task, approval, and answer queues. Redis redelivery/adoption must not create business Executions. Historical Task backfill starts with one compatibility Execution per Task; only explicit future business retry creates another Execution.

4. Existing Work Packages stay the Work Package truth. Bind them to Execution, but do not blindly translate current recoverable coding blocked semantics into generic terminal blocked outcome. Full lifecycle/outcome convergence belongs to later VNext integration unless a lossless mapping is proven.

5. [FEATURE][ARCH] VNext Phase 0 — generic runtime contracts and compatibility seam #334 must not steal [BUG][P0] Make Postgres-to-Redis wakeups durable, idempotent, and recoverable #347. Define a wakeup/continuation port, but leave the known Postgres-commit→Redis-LPUSH lost-wakeup defect to [BUG][P0] Make Postgres-to-Redis wakeups durable, idempotent, and recoverable #347's durable outbox/continuation implementation.

6. [BUG][P0] Eliminate periodic generative provider-health pings and enforce zero-token idle #346 must treat provider health as revision-bound evidence. Credential presence is not ready; an old successful observation is not permanently fresh. Cloud providers with valid-looking config but no fresh workload evidence are unknown_or_stale. Deterministic local/ACP checks remain non-generative. Config changes fence stale in-flight observations.

7. [BUG][P0][PRIVACY] Stop default task-title egress to DuckDuckGo; make web research explicit and policy-bound #353 cannot safely send even task-derived profile/category terms to public search before [FEATURE] VNext Phase 1 — deterministic budget, routing, and context economics #335. Derived data is not automatically declassified. Pre-[FEATURE] VNext Phase 1 — deterministic budget, routing, and context economics #335 automatic public queries must be trusted static PUBLIC terms only; task-aware research is deferred until Resource classification/destination/Grant authorization can occur before request construction.

8. [BUG][P0][SECURITY] Enforce Forge release gates with GitHub main-branch protection/ruleset #348 must bind exact check contexts/source, not workflow display names. Current intended contexts are web and check, emitted by GitHub Actions; rediscover integration identity at execution. Canary-test wrong-source status spoofing. Record the residual that same-GitHub-Actions workflow-definition trust is not fully solved until stronger supply-chain/external-controller work ([BUG][P1][SECURITY] Pin GitHub Actions dependencies to immutable commit SHAs #352/[OTHER][RELEASE] Complete S6 external-controller trust binding and live release evidence #357).

9. [OTHER] Retire superseded remote branches after VNext backlog canonicalization #358 is exact-manifest deletion only. Current extra stale-looking branches not named in [OTHER] Retire superseded remote branches after VNext backlog canonicalization #358 are out of scope. A branch SHA change, new PR, failed reachability proof, or new unported commit means skip—not force.

10. “One pass” means one orchestrated Codex session, not one mega-branch. [FEATURE][ARCH] VNext Phase 0 — generic runtime contracts and compatibility seam #334 schema migration, [BUG][P0] Eliminate periodic generative provider-health pings and enforce zero-token idle #346 provider behavior, [BUG][P0][PRIVACY] Stop default task-title egress to DuckDuckGo; make web research explicit and policy-bound #353 privacy, [BUG][P0][SECURITY] Enforce Forge release gates with GitHub main-branch protection/ruleset #348 GitHub governance, and [OTHER] Retire superseded remote branches after VNext backlog canonicalization #358 destructive ref cleanup have different rollback domains. Keep issue-owned branches/PRs and evidence so each can be reviewed/reverted independently.

11. No managed-readiness label edits. [BUG][P0] Make agent readiness dependency-aware and prevent tracking issues from direct dispatch #354 made readiness a derived projection. Let normal issue/PR events drive the automatic reconciliation. Never manually add/remove ready-for-agent, blocked, or other managed readiness labels to make the frontier look right.

12. No successor implementation until dependencies actually close. [BUG][P0] Make Postgres-to-Redis wakeups durable, idempotent, and recoverable #347 may begin only after [FEATURE][ARCH] VNext Phase 0 — generic runtime contracts and compatibility seam #334 closes; [FEATURE] VNext Phase 1 — deterministic budget, routing, and context economics #335 only after [FEATURE][ARCH] VNext Phase 0 — generic runtime contracts and compatibility seam #334/[BUG][P0] Eliminate periodic generative provider-health pings and enforce zero-token idle #346/[BUG][P0][PRIVACY] Stop default task-title egress to DuckDuckGo; make web research explicit and policy-bound #353 close; [BUG][P1][SECURITY] Pin GitHub Actions dependencies to immutable commit SHAs #352 only after [BUG][P0][SECURITY] Enforce Forge release gates with GitHub main-branch protection/ruleset #348 closes. Merely opening a green PR does not satisfy dependency closure.

After repeated architecture, migration, authority, privacy, concurrency, failure, regression, repository-governance, and destructive-operation passes, later findings collapsed into consequences of these same boundaries rather than new independent architecture defects. This is not proof that implementation will be defect-free; it is the implementation contract against which each PR must now be tested.

---

B. Full Codex handoff — execute the current Forge frontier in one orchestrated session

Use the following as the execution prompt.

You are the lead implementation/orchestration agent for Joncallim/Forge.

GOAL
Execute the current post-#354 Forge VNext frontier in one continuous work session while preserving issue-level isolation, repository trust boundaries, accepted VNext specifications, rollback safety, and independent verification.

CURRENT WORK SCOPE
- Existing PR #351
- Issue #348
- Issue #358
- Issue #334
- Issue #346
- Issue #353

Do NOT implement successors #347/#335/#352/#357 or later VNext phases merely because you can see them. At the end, report newly unlocked successors from fresh readiness truth.

AUTHORIZATION BOUNDARY
This handoff authorizes, when directly invoked by Jonathan for execution:
- local repository inspection and commands;
- creating/updating issue-owned branches;
- source/test/docs/migration changes within the six scopes above;
- commits and pushes to non-main branches;
- opening/updating PRs;
- posting implementation/evidence comments to the owning issues/PR;
- #348's canary and final repository-ruleset/governance mutations when all safety gates pass;
- #358 deletion of ONLY the exact branch allowlist in that issue, and only when every current-state assertion passes;
- disposable canary branches/PRs/statuses needed to prove #348/#358 safety, followed by safe cleanup.

This handoff does NOT by itself authorize:
- merging any PR into main;
- direct push/force push to main;
- closing issues merely to advance dependencies;
- manual managed-readiness label edits;
- manual Reconcile Readiness dispatch intended to fake/update projection state;
- implementation outside the issue scopes.

If the invoking operator message explicitly adds MERGE AUTHORIZED, then merge only after the exact owning issue acceptance criteria, required CI, fresh independent review, current-base/freshness requirements, and dependency/order rules all pass. Without those exact words (or equivalently explicit merge authorization in the invocation), leave PRs merge-ready and stop before merge.

ONE PASS DOES NOT MEAN ONE BRANCH
Use separate issue-owned worktrees/branches/PRs. Never combine unrelated #334/#346/#353 code or #348 governance docs into a single mega-PR. #334 itself may use its planned 3-4 PR stack because the issue explicitly expects small migration slices.

======================================================================
0. PRE-FLIGHT — ESTABLISH FRESH TRUTH BEFORE ANY MUTATION
======================================================================

0.1 Verify repository identity and clean execution environment.
- Confirm origin is Joncallim/Forge.
- Fetch/prune all refs.
- Record current main SHA.
- Record local dirty/untracked state; never overwrite unrelated operator work.
- If the working tree is not safe, use fresh worktrees rather than deleting/stashing unknown work.

0.2 Read current instructions/specs from main, at minimum:
- AGENTS.md
- CLAUDE.md
- web/CLAUDE.md
- .ai/skills/orthogonal-review.md
- docs/adr/0014-forge-vnext-general-agent-runtime.md
- docs/forge-vnext-architecture.md
- docs/specs/SPEC-0002.md
- SPEC-0003.md
- SPEC-0005.md
- SPEC-0006.md
- SPEC-0008.md
- SPEC-0014.md
- SPEC-0015.md
- docs/specs/data-model-reference.md
- docs/implementation-checklist.md
- current issue bodies and latest human-authored architecture handoffs on #334/#346/#348/#353/#358 and PR #351.

0.3 Query fresh GitHub state.
- Open PRs and heads.
- Issue state/labels/dependencies for the current frontier.
- Current main rulesets/effective protection.
- Current workflow/check identities.
- Current remote branch inventory.
- PR #351 current head/base/comments/checks/mergeability.

0.4 Compare fresh ready frontier to the expected current wave.
- Do NOT edit managed labels.
- If an issue is no longer semantically ready because a dependency/current issue state changed, skip it and report the exact blocker.
- If a new ready issue appears, do not auto-expand this execution scope.

0.5 Create an execution ledger locally (not a new product source of truth) containing:
- main baseline SHA;
- issue → branch/worktree → planned PR mapping;
- destructive/governance action manifest;
- test/review status;
- stop/skip reason.
Do not include secrets.

======================================================================
1. SECURE THE OUTER REPOSITORY BOUNDARY — #348
======================================================================

Do #348 early so new implementation PRs enter a GitHub-enforced base boundary.

1.1 Re-read the #348 architecture handoff and inspect current workflows.
- Resolve exact required contexts from real check runs; current planning expectation is job contexts `web` and `check`, NOT workflow display names.
- Resolve exact expected GitHub App/source identity; never hard-code planning App ID without rediscovery.
- Inspect required workflows for an immediate gate-bypass flaw. Do not absorb #352 dependency-pinning work; if a direct trust flaw makes the check unsuitable as a gate, stop #348 and open a narrow blocker.

1.2 Create #348 branch for documentation/read-only verification changes if needed.
Do not put repository-rule authority in a config file and pretend it is active; the live GitHub ruleset is authority.

1.3 Build a temporary canary ruleset/branch and disposable PRs.
Prove:
- normal PR with both checks passes;
- direct push rejected;
- non-fast-forward/force rejected;
- deletion rejected;
- missing/failing `web` rejects merge;
- missing/failing `check` rejects merge;
- stale base requires refresh under strict policy;
- ordinary Actions/agent token cannot bypass;
- wrong-source commit status named `web`/`check` does not satisfy source-bound requirement;
- review-thread resolution behaves as intended if configured;
- operator-only break-glass behavior is exactly documented.
Never run destructive canary tests on main.

1.4 Apply one versioned active ruleset only to refs/heads/main.
Required: PR-only, source-bound `web` + `check`, strict freshness/equivalent, deletion blocked, force blocked, no bot/Actions bypass, minimal auditable operator break-glass. Do not add the unprovisioned host-boundary-controller check.

1.5 Read back effective main rules and run a final disposable positive/negative proof.
Clean all canary artifacts safely. Commit/push #348 docs/evidence helper, open/update its PR, run CI and fresh repository-governance/Security review.

If any rule/API identity changed between dry-run and apply, STOP and re-plan rather than overwriting live governance.

======================================================================
2. REFRESH EXISTING PR #351 — DO NOT MERGE WITHOUT MERGE AUTHORIZATION
======================================================================

2.1 Update PR #351 branch non-destructively to current main using normal repo convention. Avoid force-rewriting shared history unless absolutely required and explicitly safe.

2.2 Resolve the existing Codex P2:
- Every PR requires independent Review before merge recommendation.
- Trivial/mechanical/docs PRs may use bounded/quick orthogonal review.
- Substantive/security/migration/release/privacy/concurrency/governance PRs require full review.
- Deterministic checks preferred over ceremonial cognition.

2.3 Refresh all three instruction surfaces against accepted VNext specs and live runtime.
Ensure:
- target architecture is not claimed as shipped;
- specialist/host repo writes remain fail-closed;
- role/prompt/feature flag/reviewer cannot mint authority;
- coding roles are the Software Engineering taxonomy, not universal Workforce roles;
- review evidence does not replace deterministic policy gates.

2.4 Run diff check, required CI, and a NEW fresh independent orthogonal review after the fix. Resolve all change-blocking findings. Adjacent findings become narrow issues, not infinite scope expansion.

2.5 Update the PR evidence comment. If MERGE AUTHORIZED is absent, leave it merge-ready. If present, merge only after current ruleset checks/freshness/review pass.

======================================================================
3. CLEAN HISTORICAL BRANCH NOISE — #358
======================================================================

Run #358 before generating many new branches where practical. Preserve `audit/vnext-instruction-boundary` while PR #351 remains open.

3.1 Build current candidate manifest using BOTH Git/GitHub inventories and open PRs. Only issue-listed candidates are eligible.

3.2 For already-merged candidates require exact current SHA, no open PR, expected PR merged, and exact branch head reachable from current main. Squash/content equivalence is not enough if the issue acceptance criterion requires reachability.

3.3 For superseded candidates require exact reviewed lineage, no open PR, no newer unported commit, and explicit requirement preservation in named canonical issues.

3.4 Use compare-and-delete / force-with-lease-equivalent safety against the reviewed full SHA. If atomic compare-delete is not available, re-fetch immediately before each serialized deletion. Never use wildcard/prefix deletion.

3.5 Delete merged batch, re-fetch, then superseded batch. Skip safely on any drift. Do not delete unlisted stale-looking branches; report them separately.

3.6 Post exact branch→pre-delete SHA audit and postcondition proof.

======================================================================
4. IMPLEMENT #334 AS A STRANGLER MIGRATION STACK
======================================================================

Use dedicated worktree(s). Do not let #334 edits leak into #346/#353 branches.

Follow the full #334 architecture handoff. Core required architecture:

4.1 PR A — contracts/ownership/mapping
- Pure `runtime/v1` strict Zod/TS contracts for Mission/Execution/Resource/Capability/Principal/Grant projection and lifecycle.
- No Project/Task/DB/Redis/provider imports in pure contracts.
- Separate requested Capability from actual GrantEnvelope.
- Versioned compatibility pins for current Software Engineering workflow/workforce/policy/budget behavior; do not pretend #335/#338 already ship.
- Opaque UUIDv7/equivalent IDs via maintained direct dependency; no custom semantic IDs.
- Explicit legacy Task status projection mapping and migration declaration.
- Static dependency-direction/conformance tests.

4.2 PR B — EXPAND/BACKFILL/SHADOW
- Add canonical durable missions/executions, compatibility binding(s), transition audit, Work Package execution linkage, migration state using repository migration conventions.
- Do not create replacement Work Package/Agent Run/Artifact/Gate/Operation/MCP grant truth.
- Historical backfill creates one compatibility Execution per Task; task_attempts remain queue evidence.
- Keyset-batched, restartable, idempotent backfill with concurrent-create coverage/high-watermark/journal strategy.
- Resource binding snapshots bind existing Project root identity/revision without leaking raw local path/credentials.
- Shadow compare blocks switch on any divergence.

4.3 PR C — SWITCH canonical writer
- One Mission/Execution transition service with lifecycle/outcome separation and revision/CAS.
- All old Task compatibility writes route through adapter → canonical writer → same-transaction Task projection.
- No independent Task lifecycle writer after switch.
- Add correctness/static guard against future direct projected-state writes.
- Add WakeupPort only; current Redis compatibility implementation remains until #347.
- Preserve Epic-172 admission/grants/evidence exactly behind ports.

4.4 PR D — VERIFY/rollback/non-repo proof
- Non-repository Mission persists/loads/transitions with zero Project/Git fake fields.
- Do not expose rollback-stranding production nonrepo Mission creation before switch verification.
- Forward/backfill interruption/shadow/switch/rollback/re-forward/historical evidence tests.
- C1-C8 matrix and residual uncertainty.
- Full existing Task/Project/MCP/Operation/evidence regression suite.

Critical #334 semantic tests:
- Redis task/approval/answer retries do NOT create additional Executions.
- Resource binding revision changes cannot silently reuse old authority.
- terminal lifecycle is absorbing.
- Work Package existing recoverable blocked semantics are not falsely rewritten to generic terminal blocked.
- no raw prompt/title/path copied into generic audit/migration evidence.
- #334 introduces no new model calls.

Do not begin #347 or #335 merely after creating these PRs. Issue #334 must actually close first.

======================================================================
5. IMPLEMENT #346 — PASSIVE/WORKLOAD-DERIVED READINESS
======================================================================

Follow its detailed handoff.

5.1 Evolve existing provider_health_checks; no second readiness truth.
5.2 Exact SPEC-0006 taxonomy; legacy migration explicit.
5.3 Add readiness-affecting config revision fencing. Stale in-flight result cannot overwrite evidence for newer provider config.
5.4 Cloud passive rules:
- invalid config = configuration_error;
- missing credential = authentication_error;
- credential merely present + no fresh workload evidence = unknown_or_stale;
- never call a model for routine readiness.
5.5 Preserve bounded non-generative Ollama/LM Studio/ACP readiness.
5.6 One workload-observation helper around actual existing model invocation paths; successful real work records ready, provider failures map to stable classes, caller cancellation/application error does not poison provider status.
5.7 Redact before persistence; structured failure codes first; generic 429 is rate_limited unless explicit quota evidence.
5.8 Effective staleness is server-side and deterministic; UI does not infer separately.
5.9 Worker startup/interval/UI/passive refresh all prove model_call_count == 0 with actual invocation-boundary instrumentation.
5.10 Leave full class-specific circuit/budget/routing policy to #335.

Run C1-C8 relevant tests, full CI, and fresh privacy/correctness review.

======================================================================
6. IMPLEMENT #353 — SECURE PUBLIC WEB RESEARCH BASELINE
======================================================================

Follow its detailed handoff.

6.1 One setting parser. Only explicit opt-in enables; missing/malformed/fresh install disable. Upgrade/repair preserves explicit 1/0 and never turns missing into enabled.
6.2 One typed public-search module. Automatic path takes trusted allowlisted topic ID, not arbitrary Task query string.
6.3 Before #335, automatic public queries contain no Task title/prompt/Project/repo/answers/artifact data and no task-derived profile/category terms. Use static PUBLIC topic constants only.
6.4 Fixed HTTPS DuckDuckGo destination, redirects rejected, timeout, response-byte/content-type/nesting/result/context bounds, no retry, no credentials.
6.5 Returned web text is structurally delimited untrusted evidence and cannot affect policy/Grant/tools/routing/budget/verification.
6.6 Architect and agent-evaluation share the same setting/boundary; no alternate fetch path.
6.7 Sentinel suite proves Task/Project/environment/context secrets never appear in outbound URL/query/header/body/log even with feature explicitly enabled.
6.8 Task-aware public research remains intentionally deferred to #335, where classify→destination→Grant→construct ordering can be implemented.

Run shell installer/repair matrix, unit/E2E, full CI, and fresh privacy/security review.

======================================================================
7. REVIEW / PR CONTRACT FOR EVERY CREATED OR UPDATED PR
======================================================================

For every PR in this wave:

7.1 One writer per file per active branch/worktree. Avoid concurrent agents editing the same file.
7.2 Run targeted deterministic tests continuously, then the full applicable suite before final review.
7.3 Apply `.ai/skills/orthogonal-review.md`:
- independent read-only reviewer with fresh context;
- additional Security/Privacy/Migration/Concurrency/Governance angles where relevant;
- findings classified change-blocking vs adjacent;
- validate every finding before fixing;
- after fixes, verify old findings AND run fresh passes for regressions.
7.4 Do not claim absolute correctness. Report inspected scope, evidence, residual uncertainty.
7.5 Required GitHub checks must run on final head under #348 protection.
7.6 No PR merges without the invocation's explicit MERGE AUTHORIZED flag.

Recommended cross-issue orthogonal review ownership:
- #334: data-model/migration, lifecycle correctness, authority, concurrency/restart, historical evidence, performance.
- #346: provider taxonomy, zero-token instrumentation, error classification, config-race fencing, privacy.
- #353: egress/privacy, prompt injection/untrusted input, installer migration, SSRF/response bounds.
- #348: GitHub governance, source/check identity, bypass authority, deadlock/recovery, supply-chain residuals.
- #358: destructive-command safety, PR/ref race, ancestry/supersession preservation.

======================================================================
8. CONDITIONAL MERGE/CLOSE PATH — ONLY IF MERGE AUTHORIZED
======================================================================

If and only if the invoking message explicitly authorizes merges:

8.1 Re-fetch main/rules/checks immediately before every merge.
8.2 Merge only a PR whose issue dependencies remain satisfied and whose current final head has required checks + fresh independent review.
8.3 Merge #351 only after its P2 is resolved and final review is clean in scope.
8.4 Merge #334 stack in order A→B→C→D; after each merge update the next stack PR to current main and rerun required checks. Close #334 only after D acceptance/evidence.
8.5 Merge #346 and #353 independently when complete; do not couple their closure to #334 implementation timing.
8.6 #348 closes only after effective live ruleset proof plus any required docs/evidence PR is landed.
8.7 #358 closes after its exact ref/audit criteria; it may complete without a code PR if no source changes were needed.
8.8 Let Issue Intake/Reconcile Readiness converge automatically after closes. Do not manually edit managed labels.
8.9 From fresh GitHub truth, verify successor frontier:
- #347 only when #334 closed completed;
- #335 only when #334/#346/#353 all closed completed;
- #352 only when #348 closed completed.
Do not launch those successor implementations in this execution unless Jonathan separately expands scope.

If merge authorization is absent, do all implementation/review/evidence work and leave a precise merge-order handoff instead.

======================================================================
9. GLOBAL STOP CONDITIONS
======================================================================

Stop the affected issue/slice and report exact blocker rather than weakening invariants if any of these occur:

- accepted spec and live implementation require contradictory authority semantics;
- migration shadow compare is non-zero/unexplained;
- rollback cannot preserve currently representable user data/evidence;
- Task/Project direct writer cannot be strangled without a second canonical truth;
- provider error cannot be classified safely and code attempts permissive ready fallback;
- provider config changes allow stale readiness result to win;
- any idle/passive provider path invokes a model;
- any public-search sentinel/user-derived term leaves Forge unexpectedly;
- GitHub check/App identity is ambiguous or changed during #348 apply;
- canary shows ordinary bot/Actions bypass or wrong-source status satisfies gate;
- #358 candidate SHA/PR/supersession/reachability changes;
- a destructive operation cannot be made compare-and-delete safe;
- source changes would require importing Hermes state/code/config or violating VNext non-goals;
- tests are flaky/skipped/retried in a way that would make claimed evidence non-authoritative.

Do not "solve" a blocker by broad permissions, manual readiness labels, blanket force, disabling CI, accepting unknown as success, or expanding issue scope silently.

======================================================================
10. FINAL REPORT REQUIRED FROM THIS ONE-PASS EXECUTION
======================================================================

Return one consolidated report with:

1. Current main baseline and final main state (unchanged if no merges authorized).
2. PR #351 final head/status and P2 resolution.
3. #348 ruleset ID/effective rule evidence/canary matrix/bypass residuals.
4. #358 deleted branch→pre-delete SHA list + skipped branches/reasons + unreviewed extra refs.
5. #334 PR stack, module/schema map, migration phase evidence, shadow divergence count, rollback proof, nonrepo proof, transport-vs-Execution proof.
6. #346 PR, exact readiness taxonomy/migration, zero-token instrumentation result, config-race/redaction proof.
7. #353 PR, setting migration matrix, public-search boundary, sentinel/redirect/size/injection proof.
8. Every required CI/check/review result on exact final head SHAs.
9. Adjacent findings opened (with issue numbers) rather than silently absorbed.
10. Fresh ready frontier derived from GitHub truth; no manual label edits.
11. Exact remaining human actions, especially merges if not authorized.
12. Residual uncertainty — specific and bounded, not "none".

Do not stop after writing code. Complete tests, adversarial reviews, PR creation/update, GitHub issue/PR evidence comments, #348 live-governance proof, and #358 safe cleanup within the same session wherever their safety preconditions pass.

---

C. Expected post-wave dependency shape

If the wave is later merged/closed successfully, the intended dependency convergence is:

• [FEATURE][ARCH] VNext Phase 0 — generic runtime contracts and compatibility seam #334 complete → [BUG][P0] Make Postgres-to-Redis wakeups durable, idempotent, and recoverable #347 becomes eligible;
• [FEATURE][ARCH] VNext Phase 0 — generic runtime contracts and compatibility seam #334 + [BUG][P0] Eliminate periodic generative provider-health pings and enforce zero-token idle #346 + [BUG][P0][PRIVACY] Stop default task-title egress to DuckDuckGo; make web research explicit and policy-bound #353 complete → [FEATURE] VNext Phase 1 — deterministic budget, routing, and context economics #335 becomes eligible;
• [BUG][P0][SECURITY] Enforce Forge release gates with GitHub main-branch protection/ruleset #348 complete → [BUG][P1][SECURITY] Pin GitHub Actions dependencies to immutable commit SHAs #352 becomes eligible;
• [BUG][P1][SECURITY] Pin GitHub Actions dependencies to immutable commit SHAs #352 + [BUG][P0][SECURITY] Enforce Forge release gates with GitHub main-branch protection/ruleset #348 eventually enable [OTHER][RELEASE] Complete S6 external-controller trust binding and live release evidence #357's external S6 closeout path;
• [OTHER] Retire superseded remote branches after VNext backlog canonicalization #358 is hygiene and should not alter the VNext semantic graph.

Do not pre-label or pre-dispatch those successors. The #354 control plane must derive readiness from fresh issue truth.

D. Final planning caveat

The hostile review goal is to drive residual uncertainty into explicit testable boundaries, not to claim a proof no implementation bug can exist. The remaining uncertainty is implementation-dependent: exact migration SQL/privilege shape, live GitHub ruleset API semantics at execution time, provider SDK error shapes, and current branch/PR races. Each is now paired with a fail-closed stop condition and executable evidence requirement above.

[Joncallim]

Consolidated handoff addendum — two final implementation refinements

Two additional repo-grounded findings were added after the integrated prompt was posted. Treat the latest issue handoffs as authoritative and apply these explicitly during the one-pass run:

#334 — current Execution pointer + execution-lineage audit

The existing coding schema assumes one package sequence/current planning cycle per Task. VNext allows multiple business Executions per Mission/Task. Therefore:

• add/derive an explicit current compatibility Execution pointer for each Task↔Mission binding;
• move Work Package canonical sequence uniqueness from (task_id, sequence) to (execution_id, sequence) after backfill/writer switch, retaining Task indexes only for compatibility;
• propagate unambiguous Execution lineage through execution-produced existing records such as Work Packages, Agent Runs (including runs without a package), Artifacts, Approval Gates, Task clarification rows, Operation runs, and the delivered execution_outcomes evidence ledger as their semantics require;
• approval/gate evidence from Execution 1 must never authorize Execution 2 merely because task_id matches;
• do not mechanically narrow every Task-scoped key: some external-side-effect idempotency may intentionally remain Mission/Task-wide so a retry cannot duplicate a confirmed mutation;
• inventory every Task-scoped unique/idempotency constraint and classify its proper Mission/Execution/WorkPackage/transport/resource scope before migration.

This is detailed in the two latest architecture addenda on #334. Add a two-genuine-Execution fixture with overlapping Work Package sequence numbers and old-vs-current gate/question evidence.

#346 — reuse current provider execution fingerprint

web/lib/providers/registry.ts already contains ProviderExecutionSnapshot / providerExecutionSnapshot(config) and a fingerprint used to fail closed when provider configuration changes after a protected claim.

• reuse that existing snapshot/fingerprint to fence readiness observations instead of creating a redundant provider readiness revision unless a concrete gap is proven;
• prefer wrapping/decorating the canonical getModel() model boundary for workload readiness observation so current/future generateText/streamText callers are covered automatically and [BUG][P0][PRIVACY] Stop default task-title egress to DuckDuckGo; make web research explicit and policy-bound #353 does not have to conflict with provider-observation edits in agent-evaluation.ts;
• fall back to explicit call-site wrappers only if the installed AI SDK cannot preserve the error/cancellation fidelity needed to avoid poisoning readiness.

This is detailed in the latest #346 addendum.

These refinements do not change the wave ordering or successor graph; they reduce duplicate version truth and prevent historical Execution evidence/authority from bleeding into a later retry.