[G01] Prove Scale Set delivery, acquisition and drain contracts

[jjangg96]

Goal

Select and pin one supported Scale Set integration path and produce a reusable evidence packet for recovery at message acknowledgement, acquisition and JIT boundaries, rerunning only changed-boundary checks while keeping unchanged evidence and live gaps explicit.

Create one active Codex goal from the statement above when this issue is dispatched. The Project Goal field is a work specification; it does not start an agent. Do not invent a token budget.

Execution contract

Field	Value
Goal key	G01
Stage	M0 - Evidence gates
Initial status	Ready
Primary route	gpt-luna-max (gpt-5.6-luna / max)
Priority / risk	P0 / High
Test profiles	offline, trusted-live-github

Use one issue branch/worktree and one focused PR. Independent gpt-luna-max review is required for authentication, protocol, concurrency, resource ownership, cleanup or service identity boundaries; other changes need independent contract review. Model fields are routing instructions, not GitHub user assignments. New work uses gpt-luna-max by default or an explicit grok-high override; Astra is historical-only.

Dependencies

None. This issue is initially Ready.

Dependencies must be Done before implementation begins. A new issue is not blocked simply because its future evidence has not been collected.

Scope

Isolated protocol spike and ADR; compare release v0.4.0 with audited commit cb0405b2d874500e75ae34eff8d582ab75956b45. Do not implement production providers or copy the demo shutdown policy.

TDD and failure evidence

1. Red: fake session server reproduces ACK-before-callback crash and missing lifecycle callback.
2. Cover pre/post ACK, acquisition, >50 events, repeated/stale statistics, 202, 401/403/429, callback failure and session replacement with deterministic barriers.
3. Test idle-assignment races while drain withdraws capacity; mocks alone cannot prove server deregistration/acquisition behavior. Run an explicitly authorized disposable private live canary before closing the gate.

Capture a meaningful failing case before the implementation, then green evidence and relevant refactor checks. During iteration, keep intermediate commits local, batch one stable candidate push, and rerun full validation only when the head or relevant risk boundary changes. Reuse unchanged evidence by immutable SHA. Tooling/prose-only work uses appropriate negative checks without artificial application tests. Live/runtime profiles require reviewed commits, a dedicated trusted test environment and explicit authorization for the concrete experiment. Public PR CI uses hosted environments without credentials. Planned or skipped tests never count as passed.

Acceptance criteria

• Record exact module/runner versions and supported JIT bootstrap transports, including any secret exposure.
• Choose high-level listener plus independent reconciliation OR a lower-level supported message loop; do not simply reverse ordering without evidence.
• Document recoverable state versus quarantine for lost callback/request IDs; no exactly-once claim.
• Publish sanitized live contract evidence or keep the gate unresolved; obtain independent gpt-luna-max protocol review.
• Record exact validation commands, actual results, skipped/live-test gaps and applicable rollback notes in the PR.
• Use one change-impact ledger and one stable candidate CI/review cycle; reuse unchanged evidence by immutable SHA and rerun only changed-boundary checks.
• Independent review is resolved and the focused PR is merged under the repository execution policy.
• Update issue/Project accurately; mark the active goal complete only after all required evidence and work are complete.

Safety invariants

Preserve existing manual runners; no global Docker prune/context switching, broad process kill, implicit App enrollment, busy-job cancellation during ordinary scale-down or transparent workflow replay. Use only verifiably owned resources. Keep management credentials and raw secret-bearing SDK errors out of worker environments, logs, fixtures and commits; per-worker JIT transport follows G01. Native pools remain trusted-only.

Design references

• Architecture and gates
• Language decision
• Security design
• TDD strategy
• Goal/model execution policy
• Ordered backlog

[jjangg96]

Offline SDK contract evidence merged in #22 (1396e20) after independent Astra xhigh review. Actual SDK v0.4.0 and the audited comparison commit passed the fault-contract race tests and static checks. The record separates recoverable aggregate demand from quarantined acquisition/JIT uncertainty.

This issue remains in progress: authorized private live evidence is still required. A separately opt-in canary driver is now being prepared for independent review before any live resource creation. No existing manual runners or credentials were changed, and dependent production integration stays gated.

[jjangg96]

Review audit #30 is complete. PR37 integrates the six reproduced PR25/28 fixes plus independently discovered work-evidence and ownership-proof guards. Final reviewed head a9fb8de passed full checks, independent Astra xhigh verification, hosted CI and exact-head Codex clean review before merge2fd5844. Original threads carry individual red/fix evidence and are resolved. Final main make check passed. Evidence: docs/evidence/g01-audit-corrections.md.

This does not close G01: actual server/worker recovery, integrated/global worker admission and sanitized authorized live evidence remain open. PR29 remains draft for its six known defects. No live resources or existing manual runners were changed.

[jjangg96]

PR38 is integrated as c1c0b6a. Red495d078 proved the per-directory worker cap could admit two containers; the fixed native-account claim now limits the finite G01 worker experiment across state directories and retains its slot across close, cleanup and unknown outcomes. Independent Astra review verified separate-process crash/competition/copy/tamper and unsupported-build guards, and full make check/hosted CI passed. Codex's timestamped summary names final head e3fcc32 and marks review Completed at14:22:30 UTC, before merge14:33:02 UTC; both finding sources and all threads were empty. Evidence: docs/evidence/g01-worker-admission.md.

This closes the finite controller-account worker admission preparation gap. Paired controller/worker binding, baseline execution/terminal reconciliation, finite successor experiments, actual platform/live evidence and production fleet admission remain open. No real worker or account admission directory was created.