...
` payload in sendMutation with this helper. Do not change recipients, subject semantics, attachment upload, provider rail, backend functions, or send confirmation flow. Frontend only. Add focused contract coverage for branded HTML generation and escaping, then ship through canonical Gate, squash merge, Cloudflare frontend release, and verify exact production source/deployment. Do not send an email during verification.","wordingChanged":false,"canonicalIntent":"Upgrade the universal proposal delivery email from plain paragraph HTML to a polished branded client-facing email while preserving the existing proposal attachment and send behavior. Add a reusable proposalDeliveryEmailHtml helper in UniversalProposalWorkspace.tsx that safely escapes editable message content, uses the proposal brand logo/name/contact details plus customer/event/proposal context, and renders an email-client-safe inline-style HTML card with premium dark/cream/gold presentation, a clear 'Your proposal is attached' section, and branded footer. Replace only the current minimal body `...
` payload in sendMutation with this helper. Do not change recipients, subject semantics, attachment upload, provider rail, backend functions, or send confirmation flow. Frontend only. Add focused contract coverage for branded HTML generation and escaping, then ship through canonical Gate, squash merge, Cloudflare frontend release, and verify exact production source/deployment. Do not send an email during verification.","resolutionStatus":"exact","uniqueResolution":true,"clarificationRequired":false},"source":"legacy_derived","version":1,"outcomes":[{"id":"outcome-1","statement":"Upgrade the universal proposal delivery email from plain paragraph HTML to a polished branded client-facing email while preserving the existing proposal attachment and send behavior. Add a reusable proposalDeliveryEmailHtml helper in UniversalProposalWorkspace.tsx that safely escapes editable message content, uses the proposal brand logo/name/contact details plus customer/event/proposal context, and renders an email-client-safe inline-style HTML card with premium dark/cream/gold presentation, a clear 'Your proposal is attached' section, and branded footer. Replace only the current minimal body `...
` payload in sendMutation with this helper. Do not change recipients, subject semantics, attachment upload, provider rail, backend functions, or send confirmation flow. Frontend only. Add focused contract coverage for branded HTML generation and escaping, then ship through canonical Gate, squash merge, Cloudflare frontend release, and verify exact production source/deployment. Do not send an email during verification.","proofConditionIds":["proof-production"]}],"objective":"Upgrade the universal proposal delivery email from plain paragraph HTML to a polished branded client-facing email while preserving the existing proposal attachment and send behavior. Add a reusable proposalDeliveryEmailHtml helper in UniversalProposalWorkspace.tsx that safely escapes editable message content, uses the proposal brand logo/name/contact details plus customer/event/proposal context, and renders an email-client-safe inline-style HTML card with premium dark/cream/gold presentation, a clear 'Your proposal is attached' section, and branded footer. Replace only the current minimal body `...
` payload in sendMutation with this helper. Do not change recipients, subject semantics, attachment upload, provider rail, backend functions, or send confirmation flow. Frontend only. Add focused contract coverage for branded HTML generation and escaping, then ship through canonical Gate, squash merge, Cloudflare frontend release, and verify exact production source/deployment. Do not send an email during verification.","constraints":[{"id":"capability-completeness","statement":"Every dependency the implementation declares or relies on must be wired and proven across applicable frontend, backend/runtime, schema/data/storage, authentication/authorization, provider configuration, prerequisite/loading/empty/error states, release ownership, and live production behavior; owner-authorized unavailable dependencies must become explicit prerequisite states rather than runtime failures.","proofConditionIds":["proof-production"]},{"id":"atomic-capability-lifecycle","statement":"Changed capabilities remain non-active until dependency readiness, N/N-1 compatibility, affected-target release, and claim-matched production canary proof are satisfied; missing optional dependencies become prerequisite_required, and runtime drift or health-contract violation quarantines only the affected capability instead of breaking unrelated working capability.","proofConditionIds":["proof-production"]}],"terminalPolicy":"all_required_proof_conditions_satisfied_after_live_release","proofConditions":[{"id":"proof-production","kind":"runtime","claim":"Upgrade the universal proposal delivery email from plain paragraph HTML to a polished branded client-facing email while preserving the existing proposal attachment and send behavior. Add a reusable proposalDeliveryEmailHtml helper in UniversalProposalWorkspace.tsx that safely escapes editable message content, uses the proposal brand logo/name/contact details plus customer/event/proposal context, and renders an email-client-safe inline-style HTML card with premium dark/cream/gold presentation, a clear 'Your proposal is attached' section, and branded footer. Replace only the current minimal body `...
` payload in sendMutation with this helper. Do not change recipients, subject semantics, attachment upload, provider rail, backend functions, or send confirmation flow. Frontend only. Add focused contract coverage for branded HTML generation and escaping, then ship through canonical Gate, squash merge, Cloudflare frontend release, and verify exact production source/deployment. Do not s","route":null,"roleRef":null,"userRef":null,"required":true,"expectedText":null,"targetedActions":[],"allowedReleaseTargets":[],"requiredReleaseTargets":[],"requireCapacityAdmissible":false,"expectedWatchdogPolicyVersion":null,"minConsecutiveHealthyHeartbeats":1,"requirePositiveMemoryAttribution":false,"requireMemoryAdmissionPressureFalse":false}],"validationErrors":[],"capabilityManifest":{"id":"Upgrade-the-universal-proposal-delivery-email-from-plain-paragraph-HTML-to-a-polished-branded-client","driftPolicy":"exact_manifest_source_release_dependency_or_runtime_identity_mismatch_is_nonterminal","proofLedger":"command_center_mission_ledger_request_contract_hash_bound","schemaVersion":1,"releaseTargets":[],"lifecycleStates":["prepare","deploy","verify","activate"],"activationPolicy":"dependencies_and_claim_matched_live_proof_before_exposure","dependencyDomains":["frontend","backend_runtime","schema_data_storage","authentication_authorization","provider_configuration","prerequisite_loading_empty_error_states","release_ownership","live_production_proof"],"prerequisitePolicy":"expected_unavailable_dependencies_are_prerequisite_required_not_runtime_failures","compatibilityWindow":["N","N-1"],"failureIsolationPolicy":"quarantine_or_rollback_affected_capability_only_preserve_unrelated_working_capabilities","canaryProofConditionIds":["proof-production"]},"capabilityCompleteness":{"domains":["frontend","backend_runtime","schema_data_storage","authentication_authorization","provider_configuration","prerequisite_loading_empty_error_states","release_ownership","live_production_proof"],"required":true,"prerequisitePolicy":"expected_unavailable_dependencies_are_prerequisite_states_not_runtime_failures"}},"requestedBranch":"ai/proposal-branded-delivery-email","anchor_tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","supervisor_owner":"cc-execution","verificationTier":"none","visualProofScope":"none","workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"requestContractHash":"7241cfbbe4d209b1cad140b77149aad036a6c1ef505d7a35571748964a704632","conversation_metrics":{"receipt_bytes":0,"release_count":0,"tool_call_keys":[],"tool_call_count":0,"repeated_call_count":0,"owner_interruption_count":0},"requestContractState":"pending","visualProofRequested":false,"requestContractRevision":1,"tenant_resolution_status":"not_requested","tenant_resolution_candidates":[],"requestContractPendingProofKinds":["runtime"],"witnessDeferredUntilReleaseVerified":false},"title":"Verify immutable production runtime identity","output":null,"status":"pending","step_key":"runtime_proof","tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-18T04:50:08.353694+00:00","started_at":null,"step_order":50,"updated_at":"2026-09-18T04:50:08.353694+00:00","deadline_at":"2026-09-18T08:20:08.353694+00:00","completed_at":null,"attempt_count":0,"idempotency_key":"mission:f9372123-3801-4b80-b211-4489c808236d:runtime_proof","last_progress_at":null,"command_center_event_id":"f9372123-3801-4b80-b211-4489c808236d"},{"id":"c3608f7e-a330-402f-8105-4128d065874d","lane":"cc-execution","error":null,"input":{"route":"/seaside-lawns/today","scope":"tenant","silent":true,"repository":"NYSOM-ENTERPRISES-INC/knocklaunchcrm","mission_key":"branch:15bbe9d25cb1bc81678a301a86403729cd6994d3b81679fec1d4335caf2ea0d6","requested_at":"2026-08-07T23:40:16.170Z","shipRequested":true,"conversation_id":null,"requestedBranch":"main","anchor_tenant_id":"c55998b4-82a3-467e-8d35-177bb4785f6e","supervisor_owner":"cc-execution","target_tenant_id":"c55998b4-82a3-467e-8d35-177bb4785f6e","workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"conversation_metrics":{"receipt_bytes":0,"release_count":0,"tool_call_keys":[],"tool_call_count":0,"repeated_call_count":0,"owner_interruption_count":0}},"title":"Open and evaluate the exact pull request","output":null,"status":"ready","step_key":"pull_request","tenant_id":"c55998b4-82a3-467e-8d35-177bb4785f6e","created_at":"2026-08-07T23:40:16.625889+00:00","started_at":null,"step_order":30,"updated_at":"2026-08-07T23:42:23.524874+00:00","deadline_at":"2026-08-08T02:10:16.625889+00:00","completed_at":null,"attempt_count":0,"idempotency_key":"mission:560b8ddf-1a0e-422d-9f1f-0e1ed807d1eb:pull_request","last_progress_at":"2026-08-07T23:42:23.318+00:00","command_center_event_id":"560b8ddf-1a0e-422d-9f1f-0e1ed807d1eb"},{"id":"c360be69-52f3-464d-af21-6e5b66723f38","lane":"cc-execution","error":null,"input":{"route":null,"scope":"platform","silent":true,"repository":"noel/KnockLaunchOS","mission_key":"objective:46d8543f0eeebabad73df7bf54227b71f3cc60d8b755dddf7ab7c76d516e4e9e","requested_at":"2026-10-01T01:26:01.831Z","shipRequested":true,"sourceTargets":["workers/cc-execution/src/platform-sidekick-intelligence.js","workers/cc-execution/src/model-provider-gateway.js","workers/cc-execution/src/index-mcp.js","workers/cc-execution/src/version.js","supabase/functions/operator-respond/index.ts","supabase/functions/operator-respond/paul-memory.ts","supabase/functions/operator-respond/paul-owner-profile.ts","src/pages/admin/GodModeCommandConsole.tsx","config/platform-sidekick-intelligence.json","config/paul-owner-profile.json","src/__tests__/contracts/platform-sidekick-intelligence.contract.test.ts","src/__tests__/contracts/mobile-admin-console-authority.contract.test.ts"],"conversation_id":null,"requestContract":{"valid":true,"intent":{"evidence":[],"confidence":null,"compilation":{"stages":["owner_intent","conversation_context","scope","live_state","mutation_authority","affected_systems","dependencies","risk_and_blast_radius","execution_tactics","required_proof","release_plan","recovery_plan"],"version":2,"explicit":true,"objective":"Run one bounded PAUL Continuous Intelligence Lab cycle against the current canonical production stack. Begin read-only. Run representative production PAUL evaluations across fast, standard, and deep reasoning, including owner-realistic correction recovery, direct awareness questions, current/live-state reads, greetings while durable work is running, profanity/urgency semantics, tool-argument grounding, tenant isolation, memory/context selection, ambiguity handling, hallucination resistance, completion-proof discipline, and latency. Inspect the actual returned answer/tool-call text for false greens; never accept a numeric pass when the owner-visible response still violates the intended behavior. Compare results to current main/runtime truth and durable owner corrections. If and only if evidence proves one deterministic regression or clearly measurable intelligence improvement opportunity, make exactly one focused repair within the authorized PAUL source scope, add or strengthen a regression case for the proven failure, pass canonical Gate, squash merge, release only affected targets, and verify the live production behavior. If no change is justified, record a successful no-op evaluation and terminate cleanly. Do not broaden source scope without machine-readable dependency evidence. Never bypass tenant isolation, authorization, owner-intent fidelity, Gate, release ownership, or terminal proof. Do not materially interfere with active owner-critical work: read current queue/capacity/thermal/runtime state first, reduce intensity or no-op when capacity is constrained, avoid sustained heavy compute on owner MSI hardware, and use available KNOCKLAUNCH cloud/DigitalOcean heavy capacity only when genuinely needed. Keep cost bounded. Preserve Cloudflare Workers AI as the active non-OpenAI primary path and OpenAI only as replaceable fallback. Record durable eval outcomes, false-green findings, accepted/rejected improvements, latency/score trends, and exact runtime lineage.","proofKinds":["runtime"],"adaptiveDomains":["intent","tenant_route_role_viewport","urgency_deadline","dependency_scope","risk_blast_radius","runner_capacity","queue_active_work","provider_failure_circuits","qa_scope","retry_recovery","release_ownership","proof_depth"],"expansionPolicy":"later_stages_may_only_narrow_or_expand_with_machine_readable_dependency_evidence","dynamicStatePolicy":"live_state_may_change_execution_tactics_but_never_owner_outcome_or_explicit_constraints","dynamicRefreshStages":["preflight","gate","release","runtime_proof"],"adaptiveCompilerVersion":"paul-adaptive-objective-v1","inheritedContextBlockingAuthority":false},"rawUtterance":"Run one bounded PAUL Continuous Intelligence Lab cycle against the current canonical production stack. Begin read-only. Run representative production PAUL evaluations across fast, standard, and deep reasoning, including owner-realistic correction recovery, direct awareness questions, current/live-state reads, greetings while durable work is running, profanity/urgency semantics, tool-argument grounding, tenant isolation, memory/context selection, ambiguity handling, hallucination resistance, completion-proof discipline, and latency. Inspect the actual returned answer/tool-call text for false greens; never accept a numeric pass when the owner-visible response still violates the intended behavior. Compare results to current main/runtime truth and durable owner corrections. If and only if evidence proves one deterministic regression or clearly measurable intelligence improvement opportunity, make exactly one focused repair within the authorized PAUL source scope, add or strengthen a regression case for the proven failure, pass canonical Gate, squash merge, release only affected targets, and verify the live production behavior. If no change is justified, record a successful no-op evaluation and terminate cleanly. Do not broaden source scope without machine-readable dependency evidence. Never bypass tenant isolation, authorization, owner-intent fidelity, Gate, release ownership, or terminal proof. Do not materially interfere with active owner-critical work: read current queue/capacity/thermal/runtime state first, reduce intensity or no-op when capacity is constrained, avoid sustained heavy compute on owner MSI hardware, and use available KNOCKLAUNCH cloud/DigitalOcean heavy capacity only when genuinely needed. Keep cost bounded. Preserve Cloudflare Workers AI as the active non-OpenAI primary path and OpenAI only as replaceable fallback. Record durable eval outcomes, false-green findings, accepted/rejected improvements, latency/score trends, and exact runtime lineage.","wordingChanged":false,"canonicalIntent":"Run one bounded PAUL Continuous Intelligence Lab cycle against the current canonical production stack. Begin read-only. Run representative production PAUL evaluations across fast, standard, and deep reasoning, including owner-realistic correction recovery, direct awareness questions, current/live-state reads, greetings while durable work is running, profanity/urgency semantics, tool-argument grounding, tenant isolation, memory/context selection, ambiguity handling, hallucination resistance, completion-proof discipline, and latency. Inspect the actual returned answer/tool-call text for false greens; never accept a numeric pass when the owner-visible response still violates the intended behavior. Compare results to current main/runtime truth and durable owner corrections. If and only if evidence proves one deterministic regression or clearly measurable intelligence improvement opportunity, make exactly one focused repair within the authorized PAUL source scope, add or strengthen a regression case for the proven failure, pass canonical Gate, squash merge, release only affected targets, and verify the live production behavior. If no change is justified, record a successful no-op evaluation and terminate cleanly. Do not broaden source scope without machine-readable dependency evidence. Never bypass tenant isolation, authorization, owner-intent fidelity, Gate, release ownership, or terminal proof. Do not materially interfere with active owner-critical work: read current queue/capacity/thermal/runtime state first, reduce intensity or no-op when capacity is constrained, avoid sustained heavy compute on owner MSI hardware, and use available KNOCKLAUNCH cloud/DigitalOcean heavy capacity only when genuinely needed. Keep cost bounded. Preserve Cloudflare Workers AI as the active non-OpenAI primary path and OpenAI only as replaceable fallback. Record durable eval outcomes, false-green findings, accepted/rejected improvements, latency/score trends, and exact runtime lineage.","resolutionStatus":"exact","uniqueResolution":true,"clarificationRequired":false},"source":"explicit","version":1,"outcomes":[{"id":"scheduled-objective","statement":"Run one bounded PAUL Continuous Intelligence Lab cycle against the current canonical production stack. Begin read-only. Run representative production PAUL evaluations across fast, standard, and deep reasoning, including owner-realistic correction recovery, direct awareness questions, current/live-state reads, greetings while durable work is running, profanity/urgency semantics, tool-argument grounding, tenant isolation, memory/context selection, ambiguity handling, hallucination resistance, completion-proof discipline, and latency. Inspect the actual returned answer/tool-call text for false greens; never accept a numeric pass when the owner-visible response still violates the intended behavior. Compare results to current main/runtime truth and durable owner corrections. If and only if evidence proves one deterministic regression or clearly measurable intelligence improvement opportunity, make exactly one focused repair within the authorized PAUL source scope, add or strengthen a regression case for the proven failure, pass canonical Gate, squash merge, release only affected targets, and verify the live production behavior. If no change is justified, record a successful no-op evalua","provenance":{"reason":"PAUL schedule 7335281c-bd3d-4aef-8016-6ab29cb466e1","source":"owner_authorized_schedule","inherited":false,"blockingAuthority":true},"proofConditionIds":["scheduled-runtime-proof"]}],"objective":"Run one bounded PAUL Continuous Intelligence Lab cycle against the current canonical production stack. Begin read-only. Run representative production PAUL evaluations across fast, standard, and deep reasoning, including owner-realistic correction recovery, direct awareness questions, current/live-state reads, greetings while durable work is running, profanity/urgency semantics, tool-argument grounding, tenant isolation, memory/context selection, ambiguity handling, hallucination resistance, completion-proof discipline, and latency. Inspect the actual returned answer/tool-call text for false greens; never accept a numeric pass when the owner-visible response still violates the intended behavior. Compare results to current main/runtime truth and durable owner corrections. If and only if evidence proves one deterministic regression or clearly measurable intelligence improvement opportunity, make exactly one focused repair within the authorized PAUL source scope, add or strengthen a regression case for the proven failure, pass canonical Gate, squash merge, release only affected targets, and verify the live production behavior. If no change is justified, record a successful no-op evaluation and terminate cleanly. Do not broaden source scope without machine-readable dependency evidence. Never bypass tenant isolation, authorization, owner-intent fidelity, Gate, release ownership, or terminal proof. Do not materially interfere with active owner-critical work: read current queue/capacity/thermal/runtime state first, reduce intensity or no-op when capacity is constrained, avoid sustained heavy compute on owner MSI hardware, and use available KNOCKLAUNCH cloud/DigitalOcean heavy capacity only when genuinely needed. Keep cost bounded. Preserve Cloudflare Workers AI as the active non-OpenAI primary path and OpenAI only as replaceable fallback. Record durable eval outcomes, false-green findings, accepted/rejected improvements, latency/score trends, and exact runtime lineage.","constraints":[{"id":"canonical-execution","statement":"Execute through canonical KNOCKLAUNCH mission, Gate, release, and proof rules; the schedule grants no arbitrary shell, SQL, URL, secret, or provider authority.","provenance":{"reason":"Bound unattended work to the existing mission safety model.","source":"scheduler_safety","inherited":false,"blockingAuthority":true},"proofConditionIds":["scheduled-runtime-proof"]},{"id":"capability-completeness","statement":"Every dependency the implementation declares or relies on must be wired and proven across applicable frontend, backend/runtime, schema/data/storage, authentication/authorization, provider configuration, prerequisite/loading/empty/error states, release ownership, and live production behavior; owner-authorized unavailable dependencies must become explicit prerequisite states rather than runtime failures.","provenance":{"reason":null,"source":"hard_safety_invariant","inherited":false,"blockingAuthority":true},"proofConditionIds":["scheduled-runtime-proof"]},{"id":"atomic-capability-lifecycle","statement":"Changed capabilities remain non-active until dependency readiness, N/N-1 compatibility, affected-target release, and claim-matched production canary proof are satisfied; missing optional dependencies become prerequisite_required, and runtime drift or health-contract violation quarantines only the affected capability instead of breaking unrelated working capability.","provenance":{"reason":null,"source":"hard_safety_invariant","inherited":false,"blockingAuthority":true},"proofConditionIds":["scheduled-runtime-proof"]}],"adaptivePolicy":{"risk":{"tier":"high","blastRadius":"sensitive"},"proof":{"requiredKinds":["runtime"],"visualProofScope":"none","interactionRequired":false,"runtimeProofRequired":true},"scope":{"route":null,"roleRef":null,"tenantRef":null,"sourceTargets":["workers/cc-execution/src/platform-sidekick-intelligence.js","workers/cc-execution/src/model-provider-gateway.js","workers/cc-execution/src/index-mcp.js","workers/cc-execution/src/version.js","supabase/functions/operator-respond/index.ts","supabase/functions/operator-respond/paul-memory.ts","supabase/functions/operator-respond/paul-owner-profile.ts","src/pages/admin/GodModeCommandConsole.tsx","config/platform-sidekick-intelligence.json","config/paul-owner-profile.json","src/__tests__/contracts/platform-sidekick-intelligence.contract.test.ts","src/__tests__/contracts/mobile-admin-console-authority.contract.test.ts"]},"dynamic":{"variables":["main_and_runtime_lineage","runner_capacity","queue_and_active_work","provider_health","failure_clusters_and_circuits","release_target_state","current_pr_and_gate_state"],"refreshStages":["preflight","gate","release","runtime_proof"],"refreshMayChange":["runner_selection","parallelism","retry_path","qa_depth","release_recovery","proof_timing"],"refreshMayNotChange":["owner_outcome","explicit_no_go_constraints","tenant_identity","credential_boundary","hard_safety_invariants"]},"urgency":{"priority":"normal","deadlineSignals":[],"deadlineExplicit":false},"version":"paul-adaptive-objective-v1","recovery":{"transient":"one_bounded_retry_then_alternate_eligible_pool_or_provider_path","deterministic":"repair_source_or_contract_do_not_blind_rerun","mutationDependencyFailure":"prerequisite_required_or_targeted_recovery_never_invent","readOnlyDependencyFailure":"degrade_to_available_grounded_context_and_keep_conversation_alive"},"unknowns":["tenant","route","deadline"],"authority":{"outcome":"current_explicit_owner_request","tactics":"live_prime_truth","unknownPolicy":"preserve_unknown_never_invent","historicalContext":"advisory_unless_current_request_confirms"},"execution":{"mutation":true,"concurrency":"serialize_overlapping_mutations","scopePolicy":"start_bounded_expand_only_with_machine_readable_dependency_evidence","staleStatePolicy":"refresh_dynamic_state_before_irreversible_or_acceptance_stage","conversationIsolation":true,"ownerOutcomeMayBeChangedByAdaptation":false},"experience":{"visual":false,"viewports":["desktop","mobile"],"behavioral":false,"visualProofScope":"none"},"dependencies":{"requiredDomains":["frontend","backend_runtime","schema_data_storage","authentication_authorization","provider_configuration","release_ownership","live_production_proof"],"capabilityDomains":["frontend","backend_runtime","schema_data_storage","authentication_authorization","provider_configuration","prerequisite_loading_empty_error_states","release_ownership","live_production_proof"],"releaseTargetHints":["ccExecution","supabaseEdge","frontend"]},"inputSignals":{"rawUtterance":"Run one bounded PAUL Continuous Intelligence Lab cycle against the current canonical production stack. Begin read-only. Run representative production PAUL evaluations across fast, standard, and deep reasoning, including owner-realistic correction recovery, direct awareness questions, current/live-state reads, greetings while durable work is running, profanity/urgency semantics, tool-argument grounding, tenant isolation, memory/context selection, ambiguity handling, hallucination resistance, completion-proof discipline, and latency. Inspect the actual returned answer/tool-call text for false greens; never accept a numeric pass when the owner-visible response still violates the intended behavior. Compare results to current main/runtime truth and durable owner corrections. If and only if evidence proves one deterministic regression or clearly measurable intelligence improvement opportunity, make exactly one focused repair within the authorized PAUL source scope, add or strengthen a regression case for the proven failure, pass canonical Gate, squash merge, release only affected targets, and verify the live production behavior. If no change is justified, record a successful no-op evaluation and terminate cleanly. Do not broaden source scope without machine-readable dependency evidence. Never bypass tenant isolation, authorization, owner-intent fidelity, Gate, release ownership, or terminal proof. Do not materially interfere with active owner-critical work: read current queue/capacity/thermal/runtime state first, reduce intensity or no-op when capacity is constrained, avoid sustained heavy compute on owner MSI hardware, and use available KNOCKLAUNCH cloud/DigitalOcean heavy capacity only when genuinely needed. Keep cost bounded. Preserve Cloudflare Workers AI as the active non-OpenAI primary path and OpenAI only as replaceable fallback. Record durable eval outcomes, false-green findings, accepted/rejected improvements, latency/score trends, and exact runtime lineage.","canonicalIntent":"Run one bounded PAUL Continuous Intelligence Lab cycle against the current canonical production stack. Begin read-only. Run representative production PAUL evaluations across fast, standard, and deep reasoning, including owner-realistic correction recovery, direct awareness questions, current/live-state reads, greetings while durable work is running, profanity/urgency semantics, tool-argument grounding, tenant isolation, memory/context selection, ambiguity handling, hallucination resistance, completion-proof discipline, and latency. Inspect the actual returned answer/tool-call text for false greens; never accept a numeric pass when the owner-visible response still violates the intended behavior. Compare results to current main/runtime truth and durable owner corrections. If and only if evidence proves one deterministic regression or clearly measurable intelligence improvement opportunity, make exactly one focused repair within the authorized PAUL source scope, add or strengthen a regression case for the proven failure, pass canonical Gate, squash merge, release only affected targets, and verify the live production behavior. If no change is justified, record a successful no-op evaluation and terminate cleanly. Do not broaden source scope without machine-readable dependency evidence. Never bypass tenant isolation, authorization, owner-intent fidelity, Gate, release ownership, or terminal proof. Do not materially interfere with active owner-critical work: read current queue/capacity/thermal/runtime state first, reduce intensity or no-op when capacity is constrained, avoid sustained heavy compute on owner MSI hardware, and use available KNOCKLAUNCH cloud/DigitalOcean heavy capacity only when genuinely needed. Keep cost bounded. Preserve Cloudflare Workers AI as the active non-OpenAI primary path and OpenAI only as replaceable fallback. Record durable eval outcomes, false-green findings, accepted/rejected improvements, latency/score trends, and exact runtime lineage.","conversationContextPresent":true}},"terminalPolicy":"all_required_proof_conditions_satisfied_after_live_release","proofConditions":[{"id":"scheduled-runtime-proof","kind":"runtime","claim":"Run one bounded PAUL Continuous Intelligence Lab cycle against the current canonical production stack. Begin read-only. Run representative production PAUL evaluations across fast, standard, and deep reasoning, including owner-realistic correction recovery, direct awareness questions, current/live-state reads, greetings while durable work is running, profanity/urgency semantics, tool-argument grounding, tenant isolation, memory/context selection, ambiguity handling, hallucination resistance, completion-proof discipline, and latency. Inspect the actual returned answer/tool-call text for false greens; never accept a numeric pass when the owner-visible response still violates the intended behavior. Compare results to current main/runtime truth and durable owner corrections. If and only if evidence proves one deterministic regression or clearly measurable intelligence improvement opportunity, make exactly one focused repair within the authorized PAUL source scope, add or strengthen a regres","route":null,"roleRef":null,"userRef":null,"required":true,"expectedText":null,"targetedActions":[],"allowedReleaseTargets":[],"requiredReleaseTargets":[],"requireCapacityAdmissible":false,"expectedWatchdogPolicyVersion":null,"minConsecutiveHealthyHeartbeats":1,"requirePositiveMemoryAttribution":false,"requireMemoryAdmissionPressureFalse":false}],"validationErrors":[],"capabilityManifest":{"id":"Run-one-bounded-PAUL-Continuous-Intelligence-Lab-cycle-against-the-current-canonical-production-stac","driftPolicy":"exact_manifest_source_release_dependency_or_runtime_identity_mismatch_is_nonterminal","proofLedger":"command_center_mission_ledger_request_contract_hash_bound","schemaVersion":1,"releaseTargets":[],"lifecycleStates":["prepare","deploy","verify","activate"],"activationPolicy":"dependencies_and_claim_matched_live_proof_before_exposure","dependencyDomains":["frontend","backend_runtime","schema_data_storage","authentication_authorization","provider_configuration","prerequisite_loading_empty_error_states","release_ownership","live_production_proof"],"prerequisitePolicy":"expected_unavailable_dependencies_are_prerequisite_required_not_runtime_failures","compatibilityWindow":["N","N-1"],"failureIsolationPolicy":"quarantine_or_rollback_affected_capability_only_preserve_unrelated_working_capabilities","canaryProofConditionIds":["scheduled-runtime-proof"]},"capabilityCompleteness":{"domains":["frontend","backend_runtime","schema_data_storage","authentication_authorization","provider_configuration","prerequisite_loading_empty_error_states","release_ownership","live_production_proof"],"required":true,"prerequisitePolicy":"expected_unavailable_dependencies_are_prerequisite_states_not_runtime_failures"}},"anchor_tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","supervisor_owner":"cc-execution","verificationTier":"none","visualProofScope":"none","workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"requestContractHash":"9f832f00abb40411fc685805237f1ed214f3391a233c0710d74169a7cdd5cd35","conversation_metrics":{"receipt_bytes":0,"release_count":0,"tool_call_keys":[],"tool_call_count":0,"repeated_call_count":0,"owner_interruption_count":0},"requestContractState":"pending","visualProofRequested":false,"adaptiveExecutionState":{"queue":{"activeCount":0,"waitingCount":0,"blockedBacklogCount":0,"potentialStarvation":false},"stage":"preflight","source":"current_live_prime_machinery","mainSha":null,"version":"paul-adaptive-objective-v1","capacity":{"busyTotal":0,"admissible":true,"availableTotal":0},"runtimeSha":null,"reliability":{"openCircuits":[],"failureClasses":[]},"decisionHints":{"retry":"one_bounded_retry_then_alternate_eligible_pool_or_provider_path","release":"reconcile_component_owned_release_before_acceptance","parallelism":"serialize_for_capacity"},"runtimeAligned":false},"adaptiveExecutionPolicy":{"risk":{"tier":"high","blastRadius":"sensitive"},"proof":{"requiredKinds":["runtime"],"visualProofScope":"none","interactionRequired":false,"runtimeProofRequired":true},"scope":{"route":null,"roleRef":null,"tenantRef":null,"sourceTargets":["workers/cc-execution/src/platform-sidekick-intelligence.js","workers/cc-execution/src/model-provider-gateway.js","workers/cc-execution/src/index-mcp.js","workers/cc-execution/src/version.js","supabase/functions/operator-respond/index.ts","supabase/functions/operator-respond/paul-memory.ts","supabase/functions/operator-respond/paul-owner-profile.ts","src/pages/admin/GodModeCommandConsole.tsx","config/platform-sidekick-intelligence.json","config/paul-owner-profile.json","src/__tests__/contracts/platform-sidekick-intelligence.contract.test.ts","src/__tests__/contracts/mobile-admin-console-authority.contract.test.ts"]},"dynamic":{"variables":["main_and_runtime_lineage","runner_capacity","queue_and_active_work","provider_health","failure_clusters_and_circuits","release_target_state","current_pr_and_gate_state"],"refreshStages":["preflight","gate","release","runtime_proof"],"refreshMayChange":["runner_selection","parallelism","retry_path","qa_depth","release_recovery","proof_timing"],"refreshMayNotChange":["owner_outcome","explicit_no_go_constraints","tenant_identity","credential_boundary","hard_safety_invariants"]},"urgency":{"priority":"normal","deadlineSignals":[],"deadlineExplicit":false},"version":"paul-adaptive-objective-v1","recovery":{"transient":"one_bounded_retry_then_alternate_eligible_pool_or_provider_path","deterministic":"repair_source_or_contract_do_not_blind_rerun","mutationDependencyFailure":"prerequisite_required_or_targeted_recovery_never_invent","readOnlyDependencyFailure":"degrade_to_available_grounded_context_and_keep_conversation_alive"},"unknowns":["tenant","route","deadline"],"authority":{"outcome":"current_explicit_owner_request","tactics":"live_prime_truth","unknownPolicy":"preserve_unknown_never_invent","historicalContext":"advisory_unless_current_request_confirms"},"execution":{"mutation":true,"concurrency":"serialize_overlapping_mutations","scopePolicy":"start_bounded_expand_only_with_machine_readable_dependency_evidence","staleStatePolicy":"refresh_dynamic_state_before_irreversible_or_acceptance_stage","conversationIsolation":true,"ownerOutcomeMayBeChangedByAdaptation":false},"experience":{"visual":false,"viewports":["desktop","mobile"],"behavioral":false,"visualProofScope":"none"},"dependencies":{"requiredDomains":["frontend","backend_runtime","schema_data_storage","authentication_authorization","provider_configuration","release_ownership","live_production_proof"],"capabilityDomains":["frontend","backend_runtime","schema_data_storage","authentication_authorization","provider_configuration","prerequisite_loading_empty_error_states","release_ownership","live_production_proof"],"releaseTargetHints":["ccExecution","supabaseEdge","frontend"]},"inputSignals":{"rawUtterance":"Run one bounded PAUL Continuous Intelligence Lab cycle against the current canonical production stack. Begin read-only. Run representative production PAUL evaluations across fast, standard, and deep reasoning, including owner-realistic correction recovery, direct awareness questions, current/live-state reads, greetings while durable work is running, profanity/urgency semantics, tool-argument grounding, tenant isolation, memory/context selection, ambiguity handling, hallucination resistance, completion-proof discipline, and latency. Inspect the actual returned answer/tool-call text for false greens; never accept a numeric pass when the owner-visible response still violates the intended behavior. Compare results to current main/runtime truth and durable owner corrections. If and only if evidence proves one deterministic regression or clearly measurable intelligence improvement opportunity, make exactly one focused repair within the authorized PAUL source scope, add or strengthen a regression case for the proven failure, pass canonical Gate, squash merge, release only affected targets, and verify the live production behavior. If no change is justified, record a successful no-op evaluation and terminate cleanly. Do not broaden source scope without machine-readable dependency evidence. Never bypass tenant isolation, authorization, owner-intent fidelity, Gate, release ownership, or terminal proof. Do not materially interfere with active owner-critical work: read current queue/capacity/thermal/runtime state first, reduce intensity or no-op when capacity is constrained, avoid sustained heavy compute on owner MSI hardware, and use available KNOCKLAUNCH cloud/DigitalOcean heavy capacity only when genuinely needed. Keep cost bounded. Preserve Cloudflare Workers AI as the active non-OpenAI primary path and OpenAI only as replaceable fallback. Record durable eval outcomes, false-green findings, accepted/rejected improvements, latency/score trends, and exact runtime lineage.","canonicalIntent":"Run one bounded PAUL Continuous Intelligence Lab cycle against the current canonical production stack. Begin read-only. Run representative production PAUL evaluations across fast, standard, and deep reasoning, including owner-realistic correction recovery, direct awareness questions, current/live-state reads, greetings while durable work is running, profanity/urgency semantics, tool-argument grounding, tenant isolation, memory/context selection, ambiguity handling, hallucination resistance, completion-proof discipline, and latency. Inspect the actual returned answer/tool-call text for false greens; never accept a numeric pass when the owner-visible response still violates the intended behavior. Compare results to current main/runtime truth and durable owner corrections. If and only if evidence proves one deterministic regression or clearly measurable intelligence improvement opportunity, make exactly one focused repair within the authorized PAUL source scope, add or strengthen a regression case for the proven failure, pass canonical Gate, squash merge, release only affected targets, and verify the live production behavior. If no change is justified, record a successful no-op evaluation and terminate cleanly. Do not broaden source scope without machine-readable dependency evidence. Never bypass tenant isolation, authorization, owner-intent fidelity, Gate, release ownership, or terminal proof. Do not materially interfere with active owner-critical work: read current queue/capacity/thermal/runtime state first, reduce intensity or no-op when capacity is constrained, avoid sustained heavy compute on owner MSI hardware, and use available KNOCKLAUNCH cloud/DigitalOcean heavy capacity only when genuinely needed. Keep cost bounded. Preserve Cloudflare Workers AI as the active non-OpenAI primary path and OpenAI only as replaceable fallback. Record durable eval outcomes, false-green findings, accepted/rejected improvements, latency/score trends, and exact runtime lineage.","conversationContextPresent":true}},"requestContractRevision":1,"tenant_resolution_status":"not_requested","tenant_resolution_candidates":[],"adaptiveExecutionRefreshStages":["preflight","gate","release","runtime_proof"],"requestContractPendingProofKinds":["runtime"],"witnessDeferredUntilReleaseVerified":false},"title":"Prepare the bounded implementation change","output":{"model":"@cf/openai/gpt-oss-120b","reason":"inference_returned_no_edits","provider":"cloudflare-workers-ai","latencyMs":7069,"structuredKeys":["edits"],"synthesisAttempt":2,"synthesisAttemptLimit":2},"status":"blocked","step_key":"implementation","tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-10-01T01:26:01.890778+00:00","started_at":null,"step_order":20,"updated_at":"2026-10-04T21:42:10.968127+00:00","deadline_at":"2026-10-01T03:26:01.890778+00:00","completed_at":"2026-10-04T21:42:10.956+00:00","attempt_count":0,"idempotency_key":"mission:189f62c4-36de-4aad-aca8-726179ae110f:implementation","last_progress_at":"2026-10-04T21:42:10.956+00:00","command_center_event_id":"189f62c4-36de-4aad-aca8-726179ae110f"},{"id":"c363739e-9bfc-4df7-8533-ef3364e8b371","lane":"cc-execution","error":null,"input":{"route":null,"scope":"platform","branch":"ai/forgejo-merge-queue-snapshot-bound-20260908","silent":true,"repository":"noel/KnockLaunchOS","mission_key":"branch:20946d8676bec139b294c2de22764c6193002104cdcf46006e0c793846169a57","requested_at":"2026-09-08T21:23:12.850Z","shipRequested":true,"conversation_id":null,"requestContract":{"valid":true,"intent":{"evidence":[],"confidence":null,"rawUtterance":"Unfreeze the control plane for the Forgejo merge-queue reconciler snapshot-bound repair. Current live runtime on main 36aa977b42283fefb76776c91a0eb9bebc50d15c still returns automatic_merge_queue_read_failed only for the global Actions snapshot, while direct Actions reads and Forgejo host health are good. Reduce only the merge supervisor's bounded recent Actions snapshot from 10 runs to 3 runs, leaving exact-head commit-status fallback, readiness checks, protected-main rules, and all merge/release safety unchanged. Update control-plane config and regression assertions to match. Run KnockLaunch Gate, squash merge, deploy only cc-execution, and prove live forgejo_queue_reconcile no longer returns automatic_merge_queue_read_failed.","wordingChanged":false,"canonicalIntent":"Unfreeze the control plane for the Forgejo merge-queue reconciler snapshot-bound repair. Current live runtime on main 36aa977b42283fefb76776c91a0eb9bebc50d15c still returns automatic_merge_queue_read_failed only for the global Actions snapshot, while direct Actions reads and Forgejo host health are good. Reduce only the merge supervisor's bounded recent Actions snapshot from 10 runs to 3 runs, leaving exact-head commit-status fallback, readiness checks, protected-main rules, and all merge/release safety unchanged. Update control-plane config and regression assertions to match. Run KnockLaunch Gate, squash merge, deploy only cc-execution, and prove live forgejo_queue_reconcile no longer returns automatic_merge_queue_read_failed.","resolutionStatus":"exact","uniqueResolution":true,"clarificationRequired":false},"source":"explicit","version":1,"outcomes":[{"id":"outcome-1","statement":"merge supervisor requests at most three recent global Actions runs per cycle","proofConditionIds":["proof-repository","proof-runtime"]},{"id":"outcome-2","statement":"existing exact-head gate fallback and protected-main safety remain unchanged","proofConditionIds":["proof-repository","proof-release"]},{"id":"outcome-3","statement":"live merge-queue reconciliation completes without the queue-read failure","proofConditionIds":["proof-runtime"]}],"objective":"Unfreeze the control plane for the Forgejo merge-queue reconciler snapshot-bound repair. Current live runtime on main 36aa977b42283fefb76776c91a0eb9bebc50d15c still returns automatic_merge_queue_read_failed only for the global Actions snapshot, while direct Actions reads and Forgejo host health are good. Reduce only the merge supervisor's bounded recent Actions snapshot from 10 runs to 3 runs, leaving exact-head commit-status fallback, readiness checks, protected-main rules, and all merge/release safety unchanged. Update control-plane config and regression assertions to match. Run KnockLaunch Gate, squash merge, deploy only cc-execution, and prove live forgejo_queue_reconcile no longer returns automatic_merge_queue_read_failed.","constraints":[{"id":"constraint-1","statement":"explicit owner unfreeze authorization applies to this repair","proofConditionIds":["proof-repository"]},{"id":"constraint-2","statement":"mutation is limited to the three supplied files","proofConditionIds":["proof-repository"]},{"id":"constraint-3","statement":"cc-execution is the only production release target","proofConditionIds":["proof-release"]}],"terminalPolicy":"all_required_proof_conditions_satisfied_after_live_release","proofConditions":[{"id":"proof-repository","kind":"repository","claim":"Exact diff changes only the merge supervisor Actions snapshot bound from 10 to 3 plus matching config/test assertions, without changing merge/readiness semantics.","route":null,"roleRef":null,"userRef":null,"required":true,"expectedText":null,"targetedActions":[],"allowedReleaseTargets":[],"requiredReleaseTargets":[]},{"id":"proof-release","kind":"release","claim":"Canonical Gate passes, PR squash-merges, and only cc-execution is released.","route":null,"roleRef":null,"userRef":null,"required":true,"expectedText":null,"targetedActions":[],"allowedReleaseTargets":[],"requiredReleaseTargets":["ccExecution"]},{"id":"proof-runtime","kind":"runtime","claim":"Live cc-execution runs the merged source and forgejo_queue_reconcile no longer returns automatic_merge_queue_read_failed.","route":null,"roleRef":null,"userRef":null,"required":true,"expectedText":null,"targetedActions":[],"allowedReleaseTargets":[],"requiredReleaseTargets":["ccExecution"]}],"validationErrors":[]},"requestedBranch":"ai/forgejo-merge-queue-snapshot-bound-20260908","anchor_tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","supervisor_owner":"cc-execution","verificationTier":"none","visualProofScope":"none","workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"requestContractHash":"13643bbc7cb0a1f2c0fef647a3f57a79244dacebfd683815b708a072b27aab7a","conversation_metrics":{"receipt_bytes":0,"release_count":0,"tool_call_keys":[],"tool_call_count":0,"repeated_call_count":0,"owner_interruption_count":0},"requestContractState":"pending","visualProofRequested":false,"requestContractRevision":1,"tenant_resolution_status":"not_requested","tenant_resolution_candidates":[],"requestContractPendingProofKinds":["repository","release","runtime"],"witnessDeferredUntilReleaseVerified":false},"title":"Prepare the bounded implementation change","output":{"ok":false,"jobId":null,"phase":"pull_request","branch":"ai/forgejo-merge-queue-snapshot-bound-20260908","reason":"retryable_provider_transport:forgejo_provider_read_timeout","status":"retryable","metrics":{"receiptBytes":0,"releaseCount":0,"toolCallCount":0,"repeatedCallCount":0,"ownerInterruptionCount":0},"version":"1.58.77-mcp-oauth-es256","prNumber":2175,"terminal":false,"missionId":"14aa0b6b-dd06-4cca-8de2-0fc1138e3218","operation":"execute_mission","proofGate":"repair_mission_pr_ready_retryable","sourceSha":null,"timingsMs":{"gateMs":0,"proofMs":0,"handlerMs":6325,"releaseMs":0,"mutationMs":0,"repositoryMs":0,"prReadinessMs":4491,"approvedPlanMs":0,"missionSetupMs":5266,"providerAuthMs":0,"shipAndProveMs":0,"ledgerPrepareMs":266,"ledgerReconcileMs":0,"lineageReconcileMs":5000,"resolvePreflightMs":5266,"repositoryMutationMs":0,"repositoryProviderMs":0,"authoritativeLedgerMs":0,"ledgerAsyncDispatchMs":0,"repositoryAtomicCommitMs":0,"repositoryBranchCreateMs":0,"totalSynchronousLedgerMs":266,"asyncBookkeepingDispatchMs":0,"ledgerAuthoritativeCommitMs":0,"repositoryPullRequestCreateMs":0},"nextAction":"Reconcile this same mission and pull request automatically; do not create a replacement branch or PR.","receiptRef":{"mode":"full","missionId":"14aa0b6b-dd06-4cca-8de2-0fc1138e3218"},"performance":null,"deploymentId":null,"workflowRunId":null,"releaseTargets":null,"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":1526,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true},"status":"failed","step_key":"implementation","tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-08T21:23:12.981188+00:00","started_at":null,"step_order":20,"updated_at":"2026-09-08T21:35:46.418398+00:00","deadline_at":"2026-09-08T23:23:12.981188+00:00","completed_at":"2026-09-08T21:35:46.4+00:00","attempt_count":0,"idempotency_key":"mission:14aa0b6b-dd06-4cca-8de2-0fc1138e3218:implementation","last_progress_at":"2026-09-08T21:35:46.4+00:00","command_center_event_id":"14aa0b6b-dd06-4cca-8de2-0fc1138e3218"},{"id":"c364b6e3-6f9c-4ffa-a8d8-daca25b7b5dd","lane":"production-release-conductor","error":null,"input":{"route":null,"scope":"platform","silent":true,"repository":"noel/KnockLaunchOS","mission_key":"objective:bd2ad9e53e298d992d029a333f76075d1b83d6d9b34c46a53e47552dd879ef61","requested_at":"2026-10-05T16:45:37.867Z","shipRequested":true,"sourceTargets":["workers/cc-execution/src/objective-intent.js","workers/cc-execution/src/index-mission-control.js","src/__tests__/contracts/cc-execution-objective-intent.contract.test.ts","workers/cc-execution/src/version.js","config/system-reference-points/release-reliability-standard-2026-10-05.json"],"conversation_id":null,"requestContract":{"valid":true,"intent":{"evidence":[],"confidence":null,"compilation":{"stages":["owner_intent","conversation_context","scope","live_state","mutation_authority","affected_systems","dependencies","risk_and_blast_radius","execution_tactics","required_proof","release_plan","recovery_plan"],"version":2,"explicit":true,"objective":"Protect KNOCKLAUNCH from unnecessary repository mutations during ordinary daily work. Harden objective intent admission so only positively proven mutation intent can enter durable repository mutation: explicit mutation payload, an existing mission continuation, ship/release continuation with canonical mission identity, or a clear mutation/action verb. Ambiguous objectives with no positive mutation evidence must fail closed with zero writes instead of defaulting into mutation. Preserve action shorthand by recognizing common owner commands including optimize, streamline, clean up, lock down, protect, handle it, get it done, and make it happen as mutation intent when they are explicit commands. Read/status/inspect/check/diagnose/audit/review questions remain read-only. Add regression coverage proving ambiguous everyday text cannot create mutation while explicit action commands and durable continuation still can. Update the release reliability reference manifest with this invariant and ship cc-execution live.","proofKinds":["runtime"],"adaptiveDomains":["intent","tenant_route_role_viewport","urgency_deadline","dependency_scope","risk_blast_radius","runner_capacity","queue_active_work","provider_failure_circuits","qa_scope","retry_recovery","release_ownership","proof_depth"],"expansionPolicy":"later_stages_may_only_narrow_or_expand_with_machine_readable_dependency_evidence","dynamicStatePolicy":"live_state_may_change_execution_tactics_but_never_owner_outcome_or_explicit_constraints","dynamicRefreshStages":["preflight","gate","release","runtime_proof"],"adaptiveCompilerVersion":"paul-adaptive-objective-v1","inheritedContextBlockingAuthority":false},"rawUtterance":"Protect KNOCKLAUNCH from unnecessary repository mutations during ordinary daily work. Harden objective intent admission so only positively proven mutation intent can enter durable repository mutation: explicit mutation payload, an existing mission continuation, ship/release continuation with canonical mission identity, or a clear mutation/action verb. Ambiguous objectives with no positive mutation evidence must fail closed with zero writes instead of defaulting into mutation. Preserve action shorthand by recognizing common owner commands including optimize, streamline, clean up, lock down, protect, handle it, get it done, and make it happen as mutation intent when they are explicit commands. Read/status/inspect/check/diagnose/audit/review questions remain read-only. Add regression coverage proving ambiguous everyday text cannot create mutation while explicit action commands and durable continuation still can. Update the release reliability reference manifest with this invariant and ship cc-execution live.","wordingChanged":false,"canonicalIntent":"Protect KNOCKLAUNCH from unnecessary repository mutations during ordinary daily work. Harden objective intent admission so only positively proven mutation intent can enter durable repository mutation: explicit mutation payload, an existing mission continuation, ship/release continuation with canonical mission identity, or a clear mutation/action verb. Ambiguous objectives with no positive mutation evidence must fail closed with zero writes instead of defaulting into mutation. Preserve action shorthand by recognizing common owner commands including optimize, streamline, clean up, lock down, protect, handle it, get it done, and make it happen as mutation intent when they are explicit commands. Read/status/inspect/check/diagnose/audit/review questions remain read-only. Add regression coverage proving ambiguous everyday text cannot create mutation while explicit action commands and durable continuation still can. Update the release reliability reference manifest with this invariant and ship cc-execution live.","resolutionStatus":"exact","uniqueResolution":true,"clarificationRequired":false},"source":"explicit","version":1,"outcomes":[{"id":"admission","statement":"Ambiguous ordinary objectives cannot enter repository mutation without positive mutation evidence.","provenance":{"reason":null,"source":"current_explicit_owner_request","inherited":false,"blockingAuthority":true},"proofConditionIds":["live"]},{"id":"actions","statement":"Explicit owner action shorthand remains mutation-capable.","provenance":{"reason":null,"source":"current_explicit_owner_request","inherited":false,"blockingAuthority":true},"proofConditionIds":["live"]},{"id":"reference","statement":"The forward release reliability reference records positive mutation admission as a platform invariant.","provenance":{"reason":null,"source":"current_explicit_owner_request","inherited":false,"blockingAuthority":true},"proofConditionIds":["live"]}],"objective":"Protect KNOCKLAUNCH from unnecessary repository mutations during ordinary daily work. Harden objective intent admission so only positively proven mutation intent can enter durable repository mutation: explicit mutation payload, an existing mission continuation, ship/release continuation with canonical mission identity, or a clear mutation/action verb. Ambiguous objectives with no positive mutation evidence must fail closed with zero writes instead of defaulting into mutation. Preserve action shorthand by recognizing common owner commands including optimize, streamline, clean up, lock down, protect, handle it, get it done, and make it happen as mutation intent when they are explicit commands. Read/status/inspect/check/diagnose/audit/review questions remain read-only. Add regression coverage proving ambiguous everyday text cannot create mutation while explicit action commands and durable continuation still can. Update the release reliability reference manifest with this invariant and ship cc-execution live.","constraints":[{"id":"zero-writes","statement":"Unknown intent must fail closed before branch, PR, repository write, release, or mission mutation is created.","provenance":{"reason":null,"source":"explicit_request_contract","inherited":false,"blockingAuthority":true},"proofConditionIds":["live"]},{"id":"continuation","statement":"Existing durable mission continuation remains authorized by mission identity.","provenance":{"reason":null,"source":"explicit_request_contract","inherited":false,"blockingAuthority":true},"proofConditionIds":["live"]},{"id":"capability-completeness","statement":"Every dependency the implementation declares or relies on must be wired and proven across applicable frontend, backend/runtime, schema/data/storage, authentication/authorization, provider configuration, prerequisite/loading/empty/error states, release ownership, and live production behavior; owner-authorized unavailable dependencies must become explicit prerequisite states rather than runtime failures.","provenance":{"reason":null,"source":"hard_safety_invariant","inherited":false,"blockingAuthority":true},"proofConditionIds":["live"]},{"id":"atomic-capability-lifecycle","statement":"Changed capabilities remain non-active until dependency readiness, N/N-1 compatibility, affected-target release, and claim-matched production canary proof are satisfied; missing optional dependencies become prerequisite_required, and runtime drift or health-contract violation quarantines only the affected capability instead of breaking unrelated working capability.","provenance":{"reason":null,"source":"hard_safety_invariant","inherited":false,"blockingAuthority":true},"proofConditionIds":["live"]}],"adaptivePolicy":{"risk":{"tier":"high","blastRadius":"sensitive"},"proof":{"requiredKinds":["runtime"],"visualProofScope":"none","interactionRequired":false,"runtimeProofRequired":true},"scope":{"route":null,"roleRef":null,"tenantRef":null,"sourceTargets":["workers/cc-execution/src/objective-intent.js","workers/cc-execution/src/index-mission-control.js","src/__tests__/contracts/cc-execution-objective-intent.contract.test.ts","workers/cc-execution/src/version.js","config/system-reference-points/release-reliability-standard-2026-10-05.json"]},"dynamic":{"variables":["main_and_runtime_lineage","runner_capacity","queue_and_active_work","provider_health","failure_clusters_and_circuits","release_target_state","current_pr_and_gate_state"],"refreshStages":["preflight","gate","release","runtime_proof"],"refreshMayChange":["runner_selection","parallelism","retry_path","qa_depth","release_recovery","proof_timing"],"refreshMayNotChange":["owner_outcome","explicit_no_go_constraints","tenant_identity","credential_boundary","hard_safety_invariants"]},"urgency":{"priority":"deadline_sensitive","deadlineSignals":["by recognizing common owner commands including optimize"],"deadlineExplicit":true},"version":"paul-adaptive-objective-v1","recovery":{"transient":"one_bounded_retry_then_alternate_eligible_pool_or_provider_path","deterministic":"repair_source_or_contract_do_not_blind_rerun","mutationDependencyFailure":"prerequisite_required_or_targeted_recovery_never_invent","readOnlyDependencyFailure":"degrade_to_available_grounded_context_and_keep_conversation_alive"},"unknowns":["tenant","route"],"authority":{"outcome":"current_explicit_owner_request","tactics":"live_prime_truth","unknownPolicy":"preserve_unknown_never_invent","historicalContext":"advisory_unless_current_request_confirms"},"execution":{"mutation":true,"concurrency":"serialize_overlapping_mutations","scopePolicy":"start_bounded_expand_only_with_machine_readable_dependency_evidence","staleStatePolicy":"refresh_dynamic_state_before_irreversible_or_acceptance_stage","conversationIsolation":true,"ownerOutcomeMayBeChangedByAdaptation":false},"experience":{"visual":false,"viewports":["desktop","mobile"],"behavioral":false,"visualProofScope":"none"},"dependencies":{"requiredDomains":["frontend","backend_runtime","release_ownership","live_production_proof"],"capabilityDomains":["frontend","backend_runtime","schema_data_storage","authentication_authorization","provider_configuration","prerequisite_loading_empty_error_states","release_ownership","live_production_proof"],"releaseTargetHints":["ccExecution","frontend"]},"inputSignals":{"rawUtterance":"Protect KNOCKLAUNCH from unnecessary repository mutations during ordinary daily work. Harden objective intent admission so only positively proven mutation intent can enter durable repository mutation: explicit mutation payload, an existing mission continuation, ship/release continuation with canonical mission identity, or a clear mutation/action verb. Ambiguous objectives with no positive mutation evidence must fail closed with zero writes instead of defaulting into mutation. Preserve action shorthand by recognizing common owner commands including optimize, streamline, clean up, lock down, protect, handle it, get it done, and make it happen as mutation intent when they are explicit commands. Read/status/inspect/check/diagnose/audit/review questions remain read-only. Add regression coverage proving ambiguous everyday text cannot create mutation while explicit action commands and durable continuation still can. Update the release reliability reference manifest with this invariant and ship cc-execution live.","canonicalIntent":"Protect KNOCKLAUNCH from unnecessary repository mutations during ordinary daily work. Harden objective intent admission so only positively proven mutation intent can enter durable repository mutation: explicit mutation payload, an existing mission continuation, ship/release continuation with canonical mission identity, or a clear mutation/action verb. Ambiguous objectives with no positive mutation evidence must fail closed with zero writes instead of defaulting into mutation. Preserve action shorthand by recognizing common owner commands including optimize, streamline, clean up, lock down, protect, handle it, get it done, and make it happen as mutation intent when they are explicit commands. Read/status/inspect/check/diagnose/audit/review questions remain read-only. Add regression coverage proving ambiguous everyday text cannot create mutation while explicit action commands and durable continuation still can. Update the release reliability reference manifest with this invariant and ship cc-execution live.","conversationContextPresent":false}},"terminalPolicy":"all_required_proof_conditions_satisfied_after_live_release","proofConditions":[{"id":"live","kind":"runtime","claim":"Positive mutation admission guard is live in cc-execution and current runtime contains the regression-covered change.","route":null,"roleRef":null,"userRef":null,"required":true,"expectedText":null,"targetedActions":[],"allowedReleaseTargets":["ccExecution"],"requiredReleaseTargets":["ccExecution"],"requireCapacityAdmissible":true,"expectedWatchdogPolicyVersion":null,"minConsecutiveHealthyHeartbeats":1,"requirePositiveMemoryAttribution":false,"requireMemoryAdmissionPressureFalse":false}],"validationErrors":[],"capabilityManifest":{"id":"Protect-KNOCKLAUNCH-from-unnecessary-repository-mutations-during-ordinary-daily-work.-Harden-objecti","driftPolicy":"exact_manifest_source_release_dependency_or_runtime_identity_mismatch_is_nonterminal","proofLedger":"command_center_mission_ledger_request_contract_hash_bound","schemaVersion":1,"releaseTargets":["ccExecution"],"lifecycleStates":["prepare","deploy","verify","activate"],"activationPolicy":"dependencies_and_claim_matched_live_proof_before_exposure","dependencyDomains":["frontend","backend_runtime","schema_data_storage","authentication_authorization","provider_configuration","prerequisite_loading_empty_error_states","release_ownership","live_production_proof"],"prerequisitePolicy":"expected_unavailable_dependencies_are_prerequisite_required_not_runtime_failures","compatibilityWindow":["N","N-1"],"failureIsolationPolicy":"quarantine_or_rollback_affected_capability_only_preserve_unrelated_working_capabilities","canaryProofConditionIds":["live"]},"capabilityCompleteness":{"domains":["frontend","backend_runtime","schema_data_storage","authentication_authorization","provider_configuration","prerequisite_loading_empty_error_states","release_ownership","live_production_proof"],"required":true,"prerequisitePolicy":"expected_unavailable_dependencies_are_prerequisite_states_not_runtime_failures"}},"anchor_tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","supervisor_owner":"cc-execution","verificationTier":"none","visualProofScope":"none","workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"requestContractHash":"fbd04c8edc311bc4b4cc12393d74f2f6344450e9bf4693089b847beaa1a1ff38","conversation_metrics":{"receipt_bytes":0,"release_count":0,"tool_call_keys":[],"tool_call_count":0,"repeated_call_count":0,"owner_interruption_count":0},"requestContractState":"pending","visualProofRequested":false,"adaptiveExecutionState":{"queue":{"activeCount":0,"waitingCount":0,"blockedBacklogCount":0,"potentialStarvation":false},"stage":"preflight","source":"current_live_prime_machinery","mainSha":null,"version":"paul-adaptive-objective-v1","capacity":{"busyTotal":0,"admissible":true,"availableTotal":0},"runtimeSha":null,"reliability":{"openCircuits":[],"failureClasses":[]},"decisionHints":{"retry":"one_bounded_retry_then_alternate_eligible_pool_or_provider_path","release":"reconcile_component_owned_release_before_acceptance","parallelism":"serialize_for_capacity"},"runtimeAligned":false},"adaptiveExecutionPolicy":{"risk":{"tier":"high","blastRadius":"sensitive"},"proof":{"requiredKinds":["runtime"],"visualProofScope":"none","interactionRequired":false,"runtimeProofRequired":true},"scope":{"route":null,"roleRef":null,"tenantRef":null,"sourceTargets":["workers/cc-execution/src/objective-intent.js","workers/cc-execution/src/index-mission-control.js","src/__tests__/contracts/cc-execution-objective-intent.contract.test.ts","workers/cc-execution/src/version.js","config/system-reference-points/release-reliability-standard-2026-10-05.json"]},"dynamic":{"variables":["main_and_runtime_lineage","runner_capacity","queue_and_active_work","provider_health","failure_clusters_and_circuits","release_target_state","current_pr_and_gate_state"],"refreshStages":["preflight","gate","release","runtime_proof"],"refreshMayChange":["runner_selection","parallelism","retry_path","qa_depth","release_recovery","proof_timing"],"refreshMayNotChange":["owner_outcome","explicit_no_go_constraints","tenant_identity","credential_boundary","hard_safety_invariants"]},"urgency":{"priority":"deadline_sensitive","deadlineSignals":["by recognizing common owner commands including optimize"],"deadlineExplicit":true},"version":"paul-adaptive-objective-v1","recovery":{"transient":"one_bounded_retry_then_alternate_eligible_pool_or_provider_path","deterministic":"repair_source_or_contract_do_not_blind_rerun","mutationDependencyFailure":"prerequisite_required_or_targeted_recovery_never_invent","readOnlyDependencyFailure":"degrade_to_available_grounded_context_and_keep_conversation_alive"},"unknowns":["tenant","route"],"authority":{"outcome":"current_explicit_owner_request","tactics":"live_prime_truth","unknownPolicy":"preserve_unknown_never_invent","historicalContext":"advisory_unless_current_request_confirms"},"execution":{"mutation":true,"concurrency":"serialize_overlapping_mutations","scopePolicy":"start_bounded_expand_only_with_machine_readable_dependency_evidence","staleStatePolicy":"refresh_dynamic_state_before_irreversible_or_acceptance_stage","conversationIsolation":true,"ownerOutcomeMayBeChangedByAdaptation":false},"experience":{"visual":false,"viewports":["desktop","mobile"],"behavioral":false,"visualProofScope":"none"},"dependencies":{"requiredDomains":["frontend","backend_runtime","release_ownership","live_production_proof"],"capabilityDomains":["frontend","backend_runtime","schema_data_storage","authentication_authorization","provider_configuration","prerequisite_loading_empty_error_states","release_ownership","live_production_proof"],"releaseTargetHints":["ccExecution","frontend"]},"inputSignals":{"rawUtterance":"Protect KNOCKLAUNCH from unnecessary repository mutations during ordinary daily work. Harden objective intent admission so only positively proven mutation intent can enter durable repository mutation: explicit mutation payload, an existing mission continuation, ship/release continuation with canonical mission identity, or a clear mutation/action verb. Ambiguous objectives with no positive mutation evidence must fail closed with zero writes instead of defaulting into mutation. Preserve action shorthand by recognizing common owner commands including optimize, streamline, clean up, lock down, protect, handle it, get it done, and make it happen as mutation intent when they are explicit commands. Read/status/inspect/check/diagnose/audit/review questions remain read-only. Add regression coverage proving ambiguous everyday text cannot create mutation while explicit action commands and durable continuation still can. Update the release reliability reference manifest with this invariant and ship cc-execution live.","canonicalIntent":"Protect KNOCKLAUNCH from unnecessary repository mutations during ordinary daily work. Harden objective intent admission so only positively proven mutation intent can enter durable repository mutation: explicit mutation payload, an existing mission continuation, ship/release continuation with canonical mission identity, or a clear mutation/action verb. Ambiguous objectives with no positive mutation evidence must fail closed with zero writes instead of defaulting into mutation. Preserve action shorthand by recognizing common owner commands including optimize, streamline, clean up, lock down, protect, handle it, get it done, and make it happen as mutation intent when they are explicit commands. Read/status/inspect/check/diagnose/audit/review questions remain read-only. Add regression coverage proving ambiguous everyday text cannot create mutation while explicit action commands and durable continuation still can. Update the release reliability reference manifest with this invariant and ship cc-execution live.","conversationContextPresent":false}},"requestContractRevision":1,"tenant_resolution_status":"not_requested","tenant_resolution_candidates":[],"adaptiveExecutionRefreshStages":["preflight","gate","release","runtime_proof"],"requestContractPendingProofKinds":["runtime"],"witnessDeferredUntilReleaseVerified":false},"title":"Merge and deploy through the canonical release conductor","output":null,"status":"skipped","step_key":"release","tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-10-05T16:45:38.117016+00:00","started_at":null,"step_order":40,"updated_at":"2026-10-05T16:45:43.374465+00:00","deadline_at":"2026-10-05T19:45:38.117016+00:00","completed_at":"2026-10-05T16:45:43.171+00:00","attempt_count":0,"idempotency_key":"mission:a5bcb915-78e9-4073-8589-6b78d2bb127a:release","last_progress_at":"2026-10-05T16:45:43.171+00:00","command_center_event_id":"a5bcb915-78e9-4073-8589-6b78d2bb127a"},{"id":"c364b721-af16-4189-898e-0820a2deab62","lane":"cc-execution","error":null,"input":{"route":"/la-vista-del-mar/dashboard","scope":"tenant","branch":"ai/fix-vista-card-text-contrast-20260828","silent":true,"repository":"noel/KnockLaunchOS","mission_key":"tenant-workstream:lavistadelmar:key:42374087b2095623ecb81a21cf55f3f25e8beb21369b261d728b519aeceb9ac9","requested_at":"2026-08-28T01:30:53.965Z","shipRequested":true,"workstream_key":"tenant-workstream:lavistadelmar:key:42374087b2095623ecb81a21cf55f3f25e8beb21369b261d728b519aeceb9ac9","conversation_id":null,"requestContract":{"valid":true,"intent":{"evidence":[],"confidence":null,"rawUtterance":"Fix La Vista property-card text contrast only. Replace the unreliable Tailwind gradient on The View/The Nest cards with a deterministic literal CSS bottom gradient and add inherited text shadow to the existing bottom text container. Preserve photos, text colors, titles, layout, modal styling, routing, data, and backend. Ship frontend only and prove the production cards are readable.","wordingChanged":false,"canonicalIntent":"Fix La Vista property-card text contrast only. Replace the unreliable Tailwind gradient on The View/The Nest cards with a deterministic literal CSS bottom gradient and add inherited text shadow to the existing bottom text container. Preserve photos, text colors, titles, layout, modal styling, routing, data, and backend. Ship frontend only and prove the production cards are readable.","resolutionStatus":"exact","uniqueResolution":true,"clarificationRequired":false},"source":"explicit","version":1,"outcomes":[{"id":"outcome-card-contrast","statement":"The View and The Nest card titles, status text, and review text are clearly readable over their photos while the upper portions of the photos remain visually clear.","proofConditionIds":["proof-live-runtime","proof-live-visual"]}],"objective":"Fix La Vista property-card text contrast only. Replace the unreliable Tailwind gradient on The View/The Nest cards with a deterministic literal CSS bottom gradient and add inherited text shadow to the existing bottom text container. Preserve photos, text colors, titles, layout, modal styling, routing, data, and backend. Ship frontend only and prove the production cards are readable.","constraints":[{"id":"constraint-frontend-only","statement":"Change only frontend presentation in src/pages/rental/LongTermRentalDashboard.tsx; do not change data, routing, backend, photos, titles, text colors, or modal behavior.","proofConditionIds":["proof-live-runtime","proof-live-visual"]}],"terminalPolicy":"all_required_proof_conditions_satisfied_after_live_release","proofConditions":[{"id":"proof-live-runtime","kind":"runtime","claim":"The exact merged frontend release is live on /la-vista-del-mar/dashboard.","route":"/la-vista-del-mar/dashboard","required":true,"expectedText":"The View","targetedActions":[],"allowedReleaseTargets":["frontend"],"requiredReleaseTargets":["frontend"]},{"id":"proof-live-visual","kind":"visual","claim":"On the live /la-vista-del-mar/dashboard route, The View and The Nest bottom text is clearly readable because the lower image area has a strong dark gradient, while the upper image remains unobscured.","route":"/la-vista-del-mar/dashboard","required":true,"expectedText":"The View","targetedActions":[],"allowedReleaseTargets":["frontend"],"requiredReleaseTargets":["frontend"]}],"validationErrors":[]},"requestedBranch":"ai/fix-vista-card-text-contrast-20260828","anchor_tenant_id":"71b397ba-b9ad-496b-914c-985d97dbb12e","supervisor_owner":"cc-execution","target_tenant_id":"71b397ba-b9ad-496b-914c-985d97dbb12e","tenantWorkstream":true,"verificationTier":"none","visualProofScope":"none","workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"target_tenant_name":"La Vista del Mar Rentals","target_tenant_slug":"la-vista-del-mar","requestContractHash":"aefcb7607bb5c9d52323eeeb1f730eee2544f38d58a142ba4555dbac6796893a","conversation_metrics":{"receipt_bytes":0,"release_count":0,"tool_call_keys":[],"tool_call_count":0,"repeated_call_count":0,"owner_interruption_count":0},"requestContractState":"pending","visualProofRequested":false,"workstream_active_key":"tenant-workstream:lavistadelmar:key:42374087b2095623ecb81a21cf55f3f25e8beb21369b261d728b519aeceb9ac9","workstream_generation":0,"workstream_tenant_ref":"lavistadelmar","tenant_reference_input":"lavistadelmar","requestContractRevision":1,"tenant_resolution_method":"learned_alias_exact","tenant_resolution_status":"resolved","tenant_reference_normalized":"lavistadelmar","tenant_resolution_candidates":[{"name":"La Vista del Mar Rentals","slug":"la-vista-del-mar","tenant_id":"71b397ba-b9ad-496b-914c-985d97dbb12e","confidence":0.998,"match_kind":"learned_alias_exact"},{"name":"SeaSide Lawns","slug":"seaside-lawns","tenant_id":"c55998b4-82a3-467e-8d35-177bb4785f6e","confidence":0.5629,"match_kind":"word_similarity"}],"tenant_resolution_confidence":0.998,"requestContractPendingProofKinds":["runtime","visual"],"witnessDeferredUntilReleaseVerified":false},"title":"Inspect current truth and establish execution plan","output":null,"status":"ready","step_key":"preflight","tenant_id":"71b397ba-b9ad-496b-914c-985d97dbb12e","created_at":"2026-08-28T01:30:54.107078+00:00","started_at":null,"step_order":10,"updated_at":"2026-08-28T01:30:54.107078+00:00","deadline_at":"2026-08-28T01:40:54.107078+00:00","completed_at":null,"attempt_count":0,"idempotency_key":"mission:96b5b7c2-c6cd-40be-b0d3-744241fce7d4:preflight","last_progress_at":null,"command_center_event_id":"96b5b7c2-c6cd-40be-b0d3-744241fce7d4"},{"id":"c36527db-c0cf-429c-805d-44a9ed20dcce","lane":"cc-execution","error":null,"input":{"route":null,"scope":"platform","silent":true,"repository":"noel/KnockLaunchOS","mission_key":"objective:7e47f072824ce20ca31586f94de3c29b5aa17821232fd3d809b8bf3cd95aa086","requested_at":"2026-09-12T23:15:25.941Z","shipRequested":true,"conversation_id":null,"requestContract":{"valid":true,"intent":{"evidence":[],"confidence":null,"rawUtterance":"Replace the owner Tenant Bootstrap repair control with a deterministic per-tenant Bootstrap control. Every tenant row in /admin/tenant-bootstrap must always expose a Bootstrap button, disabled only while that same tenant is actively bootstrapping. Clicking it must run one idempotent backend bootstrap contract for exactly that tenant. The backend must ensure and verify the private tenant bucket and canonical scaffold; for MODES tenants it must reconcile persisted mode cards, seed the real existing platform_mode_default_media image into each tenant-specific media/modes/