DevPay Gem Socketing: 004 + 009 + Mixed 004/009

Revision and observed baseline

Source	Observed value
Gem root	/home/<user>/workspace/nougat-gems (read-only specification source)
Gem branch / commit	main / 69b0707633a4afc0888ba1ce5092375386b630cd
Target repository	/home/<user>/workspace/nougat-playground, branch feat/pg-magician
Target HEAD at inspection	bcde4c23c2870e307c7972daa7c8524ae7a06a8a
Target application directory	nougat-devpay/
Target worktree	clean at inspection

The repository is the parent of nougat-devpay/. Changes in this task are limited to that directory. Every task record must retain the Gem root and immutable Gem commit so a generated worktree can resolve the same specification revision. Gem documents are not copied into the application and are not modified.

Evidence classification

• Observed means code, configuration, or tests present in the inspected DevPay revision. It does not mean the behavior was executed in this environment.
• Proposed means an adapter or new behavior designed here to satisfy the Gem contracts.
• Historical Target Blueprint means origin/009-agentic-development-control-plane/prompt-to-push-implementation-spec.md. It is a target design, not proof of the current Gem implementation. Current Origin 009 contracts in README, architecture, contracts, framework, runtime isolation, and failure/recovery take precedence.
• The Origin 004 application Action contract and Mixed 004+009 cross-plane envelope are proposals in the Gem source; neither is presumed to exist in this application.

Contract traceability matrix

Gem / section	Engineering intent and mandatory invariant	DevPay observed state	Contract gap / adapter	Intended implementation and owning part	Test / status
Origin 009 README, Architecture: Task isolation	Parallel task edits must not share a checkout; each task owns a branch and worktree.	No manager at Base; task worktrees/branch now exist per Task ID with Gem/Base pinned.	CLI and Git worktree adapter with project-path boundary and owned cleanup.	tools/devpay_control/control.py, git_worktrees.py; ④.	Two independent fixture Tasks plus real Task 8cc5…; owned worktree cleaned. VERIFIED.
Origin 009 Contracts / Framework: lifecycle and persistence	State transitions and attempt evidence are durable; retries append attempts.	Application SQLite is separate from private control-plane SQLite.	Append-only attempts/events/gates/artifact hashes plus SQLite task/queue state.	store.py, control.py, provenance.py.	Ten attempts retained across failures/retries; crash recovery test. VERIFIED for local scope.
Origin 009 Contracts / Framework: verification profiles	Select checks by change class; missing or unavailable checks cannot pass.	Existing CI already separates Worker, Axum, FE and Playwright jobs.	Conservative profiles; unknown paths escalate; FE browser coverage is required.	profiles.py, runner.py, browser_runner.py; ④/⑤.	Exact control/typecheck/browser profiles passed Gate 1/2; unknown/missing tests. VERIFIED for these profiles.
Origin 009 Architecture / Contracts: Gate 1	Verify exact submitted Task HEAD and preserve failure evidence.	No Gate at Base.	Detached worktree, exact SHA before/after, policy and controller digest binding.	control.py, git_worktrees.py.	Gate 1 a2ce2a33… PASS at 3963ed8…; earlier failed attempts preserved. VERIFIED.
Origin 009 Architecture / Contracts: Gate 2	Integrate Gate 1-passed SHA onto latest validated Base; only a passing Candidate advances Base.	No Candidate gate at Base.	Serialized merge worktree, Candidate regression, expected-old CAS.	control.py, git_worktrees.py; PM / Tech Lead.	Gate 2 17545197… PASS at 4c36a04…, Base bcde4c2…; local Ref only. VERIFIED.
Origin 009 Architecture / Failure & Recovery: queue, retry, CAS	One writer for shared refs; stale/failing candidates do not promote; preserve attempts.	Single-host local queue and integration lock; no distributed lease/fencing.	SQLite queue, flock, Git expected-old update and append-only attempts.	control.py, store.py, git_worktrees.py.	Candidate failure, stale Base, conflict, moved HEAD, retries and recovery. PARTIAL; distributed scheduling absent.
Origin 009 Runtime Isolation / Failure & Recovery	Task/Gate-owned Xephyr/profile/artifact/process ownership; no host DISPLAY fallback.	Existing Playwright was local; runtime allocation absent at Base.	Xvfb parent + Xephyr display, private profile/home/<user> PID identity cleanup, fail closed.	runtime.py, browser_runner.py; ④/⑤.	Two real Xephyr displays and headed Gate 1/2 Browser tests. VERIFIED for Linux browser scope; native OS input not claimed.
Origin 009 Contracts / Framework: evidence, artifacts, security	Bind results to Task/Attempt/Gate/exact SHA/profile/artifact; exclude secrets/raw output.	No commit-bound orchestration evidence at Base.	SQLite content hashes, safe Action receipt projection; command stdout/stderr suppressed.	store.py, control.py, runner.py.	Exact SHA artifacts, immutable rows, privacy and provenance negative tests. VERIFIED for local scope.
Origin 009 Publish / Historical Target Blueprint	Non-force publish only after Gate 2; delivery needs remote ancestry proof.	Deployment scripts are separate; no orchestration publisher.	Remote publish is disabled; no remote ref was touched. The target branch was fast-forwarded locally only after Gate 1/2.	No publisher module.	refs/devpay/validated/local only; remote publication remains PARTIAL by local-only instruction.
Origin 004 Design: Registry, schema/version, single dispatch	Stable semantic ID/version and payload validation; backend authorization stays authoritative.	useOverlayNav was navigation-only; seller product UI directly called db.saveProduct.	Separate domain Action registry/dispatcher; preserve URL/Overlay contract. Normalize backend license_json alias.	fe/lib/actions/registry.ts, dispatcher.ts, product-create.ts, product-update.ts, product-contract.ts; ③ Seller FE, ② shared FE adapter.	Product-create and Product-update Gate E2E verified at exact Task/Candidate SHAs. VERIFIED for lifecycle slice; other Actions not migrated.
Origin 004 Design: safe Trace and Receipt	Command result differs from domain/runtime checks; missing verification is unverified.	No product receipt or independent UI/domain verification.	Bounded safe receipt; server read-after-write and rendered detail are independent checks.	receipts.ts, dispatcher.ts, product-create.ts, product-update.ts.	Gate 1/2 receipts assert create and update domain/runtime checks. VERIFIED for this slice.
Origin 004 Design: navigation/legacy bridge	Preserve Router/Overlay; URL is optional and excludes mutations/secrets.	useOverlayNav owns ?action= history/lifetime/focus.	Product create/update are non-URL Actions; no Nav source rewrite.	useOverlayNav.ts unchanged.	Existing Overlay Playwright suite passed in Gate 1/2. VERIFIED.
Origin 004 Design: backend authority and side-effect safety	UI validation is not authorization; APIs authorize; do not automatically replay unsafe side effects.	Axum and Worker/D1 remain distinct; seller product CRUD APIs are seller-scoped.	Reuse existing seller API; local Axum uses disposable SQLite/dev-auth fixture; no D1/production.	No route/auth/payment policy changes; ④.	Local create/update and independent GET passed; full Axum suite is green with explicit test fixtures. VERIFIED for these Actions.
Mixed 004+009 Architecture / Contracts: envelope and run trust	Join receipt to trusted Task/Attempt/Gate/Commit/Scenario; correlation ID alone is not trust.	No cross-plane envelope at Base.	Read-only collector validates exact run tuple, Action schema/version, HMAC and driver assertions. It has no Git/queue/ref methods.	action_evidence.py, provenance.py; ④/⑤.	Forged signature/commit, wrong run and duplicates rejected; Gate 1/2 exact SHA verified for both Actions. VERIFIED for seller lifecycle.
Mixed 004+009 Contracts / Validation: reconciliation	Required Action/version/check/fidelity must match; command success alone cannot pass.	Existing E2E had no semantic coverage contract.	Require persisted domain row, visible detail/update, independent driver assertions, browser fidelity.	PRODUCT_ACTION_COVERAGE, trusted browser scenario, Gate adapter.	Missing assertion, command-only, version/run mismatch and unexpected Action tests; exact create/update Candidate receipts. VERIFIED for v1.
Mixed 004+009 Privacy / Recovery	Separate namespaces; preserve interrupted evidence; exclude raw payload/token/cookie/email/path.	No bridge at Base.	Safe receipt projection, private artifacts, immutable retry attempts; no Playwright screenshots or raw output.	action_evidence.py, store.py, runtime.py.	Unsafe projections rejected, earlier attempts retained, Gate artifacts hash-verified. VERIFIED for local scope.
Axum fixture / regression contract (supplemental)	Keep production seeding disabled; tests must own disposable fixture data and retain auth/tenant/payment/ledger assertions.	db::open() intentionally does not auto-seed by default. Tests previously depended on demo rows being present.	Add an explicit test-only seed helper that refuses APP_ENV=production and DB paths outside the OS temp directory. Migration test verifies that open() does not seed. No route or commerce policy changed.	be/src/db.rs, be/tests/{api_test,migration_test,security_test,outbox_test}.rs; ④.	Full Axum cargo test --locked --offline passes; local Gate 1/2 backend profile passes. VERIFIED.

Current system boundaries (observed)

• Frontend: Nuxt 3 / Vue / Pinia. useOverlayNav remains the established navigation-only adapter. Seller product create/update dispatch seller.product.create and seller.product.update v1 Actions and reuse db.saveProduct → fe/lib/api/client.ts → the seller-protected API. Mock mode is not accepted as domain evidence.
• Ownership: public and platform operator surfaces belong to Platform Frontend; seller product workflows belong to Seller Frontend. Shared FE action plumbing needs a single steward. Backend/Cloudflare and contract changes belong to Backend & Infrastructure; independent acceptance belongs to QA & Release. AI work does not represent vendor or human acceptance.
• Backend: be/ is Rust Axum + SQLite/local test path. be-cloudflare/ is Rust Worker + D1 deployment path. Axum success cannot be reported as Worker/D1 verification. Existing authenticated product route and FE API client are reused; no auth/payment/DB policy is weakened.
• Verification/deployment: Playwright is configured for local Nuxt and current E2E setup uses Axum dev auth and temporary DB. GitHub Actions runs Axum tests, Worker WASM build, FE typecheck, Playwright and Docker smoke. Scripts can deploy to Cloudflare; no deploy or production/staging DB operation is part of this task.
• Tooling at Base: no Git worktree controller, task queue, Xephyr runtime allocator, or action-to-gate evidence collector was present. The session prepared a user-owned, checksum-verified Node/pnpm/Rust/Xephyr/Chromium toolchain. Locked Cargo dependencies were fetched only after approval. No changes were made to the Gem repo, package manifests/lockfiles, or production/staging resources.

Contract gaps and resolution

1. Separate state authorities: app-domain SQLite/D1 and control-plane SQLite remain separate. The control plane stores only orchestration/evidence metadata and local Git paths; the browser runner uses a disposable seeded Axum SQLite DB.
2. Gate evidence: one command exit code is insufficient. Gate 1 binds to exact Task HEAD; Gate 2 binds to an exact merged Candidate and latest Base. Both require all profile checks and required Mixed evidence.
3. CAS and publication: Git local branch advancement uses expected-old SHA. Remote publish and DevPay deployment remain disabled; no force operation is allowed.
4. Runtime availability: no fallback to host DISPLAY. If Xephyr prerequisites are absent, GUI verification is BLOCKED and the gate cannot pass. Headless Rust/API/DB checks do not start GUI.
5. Mock versus real: a mock product action may test dispatch only; it cannot satisfy server/domain verification. API mode requires independent read-after-write verification.
6. Historical blueprint: the 2026-10 Prompt-to-Push document is a historical target. Its abstract PUBLISHED, multi-host distributed leases, external notifications and full resume behavior are not treated as observed contracts or implemented functionality.
7. Control-plane provenance: submit and gate runs pin the control-plane source digest and Python version. Detached Gate execution is BLOCKED unless its runner and scenario source match that digest, preventing a dirty controller checkout from supplying evidence for another submitted SHA.

Shared FE API adapter

• Observed gap: parseJsonFields turns a backend license_json property into license, while the FE Product contract expects licensePolicy. The existing FIELD_MAP normalized licenseJson but did not cover the actual parsed key. Strict Action payload validation correctly rejected this unexpected field during the first Product Update Gate.
• Implemented adapter: normalize the parsed license_json field to licensePolicy in fe/lib/api/client.ts. This does not change request/response JSON, Rust/Worker authorization, D1, or migrations.
• Ownership: Main Agent / Tech Lead designated one writer for shared fe/lib/api/client.ts; Seller Frontend owns the Product Actions and pages.
• Evidence: an actual Gate run caught the unexpected DTO key (PRODUCT_INVALID_SHAPE); the adapter fix passed typecheck and local Axum create/update browser Gates at exact Task/Candidate SHAs.

Proposed module boundaries and ownership

tools/devpay_control/
  cli.py                    local CLI boundary
  control.py                task lifecycle, Gate 1/2, CAS and runtime leases
  git_worktrees.py          exact SHA, worktree owner and local lock operations
  profiles.py               allow-listed classifier and policy revision
  runner.py                 no-shell checks, timeout and safe result projection
  browser_runner.py         isolated local API + headed Playwright Gate
  runtime.py                task/Gate-owned Xephyr and PID ownership
  action_evidence.py        read-only Mixed validation and reconciliation
  provenance.py             control-plane/scenario content digest
  store.py                  private SQLite task and evidence records
  trusted_product_scenario.mjs independent browser/server assertions
fe/lib/actions/
  registry.ts               semantic ID/version and payload contract
  dispatcher.ts             app-side dispatch policy and safe receipt
  receipts.ts               bounded allow-listed app receipt
  product-create.ts         seller product-create vertical action
  product-update.ts         seller product-update vertical action
  product-contract.ts       shared strict Product payload validator

The Product Action Plane does not invoke task commands. The Mixed adapter has no Git, queue, ref-update, deployment, or publish capability. Existing route and API authorization remain authoritative.

Delivery plan and acceptance

1. Phase 0 — VERIFIED: traceability, current contract gaps, module boundaries, and safe execution plan.
2. Phase 1 — VERIFIED (local-only): two independent fixture Tasks passed Gate 1; failing Candidate left Base unchanged; retry passed. Actual Task 3963ed8… passed Gate 1 and Candidate 4c36a04… passed Gate 2/CAS. A follow-up local Backend fixture Task also passed Gate 1/2. Remote publish remains disabled.
3. Phase 2 — VERIFIED for local Linux browser scope: task/Gate-owned Xvfb+Xephyr, private profile/artifact, process ownership and cleanup, and headed Chromium Gate runs passed. Native OS-input fidelity is not claimed.
4. Phase 3 — VERIFIED for seller product create/update v1: strict Action payload validation and drop concurrency reuse the seller API; separate server read-after-write and rendered-detail checks passed at Gate 1 and Gate 2. Other Actions remain unmigrated.
5. Phase 4 — VERIFIED for the seller product lifecycle: create/update domain/runtime/driver Receipts reconcile against exact Task/Candidate runs. Missing, mismatched, duplicate, mock-fidelity, or command-only evidence cannot pass.

Scope remains single-host: distributed leases/fencing, complete viewer, notification service, remote publisher, production-auth verification, staging/D1 verification, and production release are not implemented.

Acceptance uses temporary Git repositories, task-owned worktrees, local refs, private SQLite and fixture data. No production/staging DB, deployment, real payment, remote push, or secret-bearing artifact capture occurs.

Executed evidence and remaining limits

Evidence	Exact scope/result
Specification/target	Gem main@69b0707633a4afc0888ba1ce5092375386b630cd; target feat/pg-magician@bcde4c23c2870e307c7972daa7c8524ae7a06a8a.
Actual Task / Gate 1	Task 8cc5d2c7966b4b738ea58506eebe7956, final head 3963ed8ece653d0557b9f1ebf679fc51d1778d0b, Gate a2ce2a33e7e340e19a276620a825b3f7 PASS.
Product Candidate / Gate 2	Candidate 4c36a04a2c24d6960a9ec70d6d9726ea6402c7cc, expected Base bcde4c23c2870e307c7972daa7c8524ae7a06a8a, Gate 175451974648404e8102a14892015811 PASS; local ref only.
Product create/update Task	Task f3f27b680bff4ad9aa9af0dbba6f233c, final Task Head f40559921485918dd47af9eaeb204384b9ed6302, Gate 1 4c12cfb7… PASS; Candidate 86c384b5f76ebdbc0dc9bb9f80174d6e7dabcb45, Gate 2 45bf1b4f… PASS. Earlier attempts preserve schema and DTO-adapter failures.
Backend fixture Task / Gate 1 + 2	Task 92393119356c4b50966fc7f0857bbdb8 head 3d7a3ebf590fb7f9ba0c910024273cd914de8578; Gate 1 f9b2b917… and Gate 2 82986cbd… PASS. Backend fixture candidate 58890079461f4c32346ad899ac62d75862756dc8 was validated locally before the docs-only follow-up.
Real browser evidence	Headed Chromium in owned Xephyr; seller Product create/update plus existing product-flow and Overlay Playwright specs passed at Gate 1/2. Both Actions matched exact Gate/Commit/Scenario and all six domain/runtime/driver checks passed.
Control-plane tests	python3 -m unittest discover -s tools/devpay_control/tests -v: 28 total, 26 passed and two real-Xephyr tests skipped by default. DEVPAY_TEST_XEPHYR=1 run passed all 28 tests.
Frontend checks	pnpm exec vue-tsc --noEmit -p tsconfig.json PASS; pnpm exec nuxi generate PASS with existing dynamic-import warnings. Frozen FE lockfile SHA256 remained 7e0b3dfe1c042aa8c3e18f2ee61f8ee3a3eb17e7f9a6e9d50f4554088a4040c0.
Worker build	cargo build --locked --offline --release --target wasm32-unknown-unknown PASS. This is a local build, not a D1 or Cloudflare deployment test.
Axum suite	cargo test --locked --offline PASS after fixture-only corrections: API 8, migration 5, outbox 5, security 7, store 4 passed; one PostgreSQL test ignored because no PG server was configured. The explicit fixture helper rejects production and non-temp DB paths. No API route, auth, tenant, payment, or ledger policy was relaxed.

The E2E evidence is local Axum + disposable SQLite and DEV auth, not production auth, Worker/D1, staging, payment, or native OS input. Remote publish, independent human/vendor QA sign-off, distributed fencing, and native-input fidelity remain NOT_VERIFIED / out of scope. feat/pg-magician was fast-forwarded locally to the verified refs/devpay/validated/local; origin/feat/pg-magician remains at the inspected Base.