**A2A facade over the engine and agent services.** arbora implements A2A as a facade over the public graph-engine and agent-utilities services exposed through MCP and REST, starting with unary agent-card discovery and task send/get/list/cancel, then adding durable task streaming and resubscribe without a second task store. Split into `ARBORA-A2A-R001.1` (the resubscribe method-table slice) with the event-cursor-backed streaming fixture remaining open under the parent. | Proven by contract tests covering the unary task operations and a durable stream/resubscribe fixture.

**Fail-closed `tasks/resubscribe` stub on the A2A method table.** arbora registers `tasks/resubscribe` in the A2A JSON-RPC method table with typed, validated params, and refuses it with a distinct error until durable, restart-safe event-cursor-backed streaming exists — never silently succeeding, never reported as an unrecognized method. | Proven by a test asserting `tasks/resubscribe` validates params and is refused with a dedicated JSON-RPC error code distinct from "method not found".

**Inbound task routing with caller-filtered tool exposure.** arbora routes inbound A2A tasks through the existing agent orchestration port into engine-backed work items. Caller-filtered assembly selects the agent and its exposed tool subset. The caller sees only authorized tools. `ARBORA-A2A-R002.1` covers fail-closed refusal when assembly selects a tool subset. `ARBORA-A2A-R002.2` covers caller-filtered enforcement through the AU signed dispatch carrier. That child remains open under the parent. | Proven by integration tests asserting routed tasks map to durable work-item identities and exposed tool subsets match the caller's authorization.

**Fail-closed refusal when assembly selects a tool subset.** arbora refuses `dispatch()` with a distinct error before durable admission when a routing decision selects a tool subset. The signed AU dispatch carrier cannot enforce an allowlist at execution time. | Proven by a test asserting dispatch raises `A2AAssemblyUnavailable` whenever `decision.selected_tools` is non-empty.

**Caller-filtered tool-subset enforcement at dispatch.** The signed AU agent-dispatch carrier accepts and enforces an allowed-tool subset end to end. The caller's exposed tools match its authorization at execution time. Split into `ARBORA-A2A-R002.2.1` (the owner-named AU dependency) because arbora has no public door to add this itself. | Proven by integration tests asserting an enforced tool subset at execution, not just an advisory list.

**Owner-blocked: AU carried, enforced tool-subset field.** `agent_utilities.orchestration.agent_dispatch.AgentTurnEnvelope`/`enqueue_agent_turn` has no field or mechanism to carry and enforce a caller-filtered tool allowlist at execution time. arbora's `WorkItemA2AAuthority._enqueue`/`dispatch` (`arbora/a2a/authority.py`) already refuse every request carrying `decision.selected_tools` (`ARBORA-A2A-R002.1`) rather than pass through an unenforced allowlist. agent-utilities owns adding that carried, enforced field. Until an agent-utilities spec exists and lands it, `ARBORA-A2A-R002.2` cannot be implemented in this repository. | No arbora-side test is possible against the current AU carrier contract. Verified by the fail-closed tests bound to `ARBORA-A2A-R002.1` continuing to refuse rather than silently drop the filter. Tracked as the explicit cross-repo dependency recorded in `tasks.md`.

**Reference-bound single-tool task worker.** Model: `ToolTaskRequest`, `ToolTaskResult`, `ToolTaskCarrier`, `ToolTaskDispatcher` and `WorkItemFence` in `arbora/a2a/tool_task.py`. The carrier holds the job ID, the content-addressed request reference, the tenant, the session and one allowed tool. The request holds canonical JSON parameters, never a prompt. Behavior: `run_tool_task` claims the admitted WorkItem through the EG coordination methods. It resolves the exact request through the dispatcher inside the lease. The request digest, tenant, session and single tool must match the carrier before execution starts. The dispatcher reauthorizes the original caller and uses the job ID as its durable idempotency key. A bound result commits its receipt reference under the claim. Wiring: `arbora.a2a` exports the worker. The queue consumer calls it for each verified tool-task carrier, and acknowledges the delivery only when `ToolTaskRun.acknowledge` is true. Refusal: A missing dispatcher, a changed request or a wrong tool refuses before execution and commits a failed result. Some outcomes are uncertain: an exception after execution starts, a result for another job or caller, and an indeterminate result. Each uncertain outcome leaves the WorkItem open and the delivery unacknowledged. An expired deadline starts no execution and leaves the item open for reconciliation. A lost lease stops the worker without a commit. A terminal item skips the delivery. The worker never repeats an uncertain effect. | `tests/a2a/test_tool_task.py` covers each committed outcome, each uncertain outcome and each refusal before execution. It also covers duplicate delivery, a claim held elsewhere, an expired deadline, a foreign carrier, lease loss and canonical requests.

**No duplicate skill or prompt harvesting in the multiplexer.** arbora removes the multiplexer's separate skill and prompt harvesting path so there is exactly one owner for tool, skill, and prompt discovery, with no duplicate ingestion path remaining in the running package. | Proven by a runtime absence check confirming no duplicate harvest path is present or reachable in the deployed package.

**Served MCP bridge runs FastMCP 4, matching its declared version.** arbora's deployed MCP bridge runs on FastMCP 4 end to end, including native WebMCP and a single composition loop, so the dependency version it declares matches the version actually serving requests. | Semantic tests run against the exact declared FastMCP and engine dependency versions. A live-deployment probe confirms the served version.

**Durable, fail-closed A2A approval exchange for tool calls.** arbora defines a human approval exchange for pending tool-call effects in the A2A contract. The task enters an input-required state. The effect requires a signed approval message bound to that specific pending call. Approval stays disabled until the full signed exchange is implemented and proven end to end. Until then, every approval attempt is rejected. Split into `ARBORA-A2A-R005.1` (the fail-closed `arbora.plan/confirm` stub) with `ARBORA-A2A-R005.2` (the full signed chain) remaining open under the parent. | Negative tests prove approval is refused while unimplemented. A later full-chain test covers request, signed approval and execution.

**Fail-closed `arbora.plan/confirm` stub on the A2A method table.** arbora registers `arbora.plan/confirm` in the A2A JSON-RPC method table with typed, validated params, and refuses every confirmation attempt with a distinct error until the full signed human approval exchange exists. | Proven by a test asserting `arbora.plan/confirm` validates params and is refused with a dedicated JSON-RPC error code distinct from "method not found".

**Full signed human approval chain and input-required task emission.** A pending effect moves its durable task to `input-required` with a typed, server-attested pending-call envelope, and an atomic compare-and-set consumes a revocable human grant exactly once before the effect runs. Split into `ARBORA-A2A-R005.2.1` (the durable, revocable human-grant store with atomic compare-and-set consumption) with the rest of the chain (input-required task emission wired to a live pending call, signature verification, and the full request-to-execution test) remaining open under this row. | Proven by a full chain test from request through signed approval to execution, and negative tests for replay, changed params, different human, and expired/revoked grant.

**Durable, revocable human-grant store with atomic compare-and-set consumption.** No grant store exists anywhere in arbora today (confirmed by source search: no `GrantStore`/compare-and-set human-approval primitive is defined). `ARBORA-A2A-R005.2` cannot move a task to `input-required` and consume a grant exactly once until this store — issuance, lookup, and a single atomic consume-once operation keyed by pending-call id — is specified and built as its own component. | Proven by unit tests asserting a grant is consumed at most once under concurrent compare-and-set attempts, and that consuming an expired or revoked grant fails closed.

**Validate detached pending-call signatures without authorizing execution.** Define a closed, frozen server-side binding over the existing plan, task and pending-call identities. Bind parent and child work items, original human, approver, grant identity/revision and expiry. Verify Ed25519 signatures over canonical bytes with a fixed domain/version. Keys and binding evidence never come from confirmation params. The existing confirmation refusal calls this boundary with absent evidence and stays unavailable. Signature validity alone cannot authorize execution. | Scoped tests prove real cryptographic validity and reject altered binding, foreign human, expiry and inactive grant snapshots. A route test proves missing authority still refuses. Snapshot tests do not prove replay prevention or atomic consumption. The full R005.2 chain stays open.

**Model.** `ToolActionAdmissionRequest` and `ToolActionApproval` are new frozen models in `arbora/a2a/tool_action_admission.py`. Extend `A2APlanConfirmParams` (`arbora/a2a/models.py:104`) as a closed discriminated union: `confirmation_kind=tool_action` carries this request; `confirmation_kind=held_item` carries HeldItemAdmissionRequest. Reject missing, unknown or mixed variants. The request carries `pending_call_id`, `params_digest`, `trust_mark_ref` and `action_class`. `action_class` is one of `egress`, `privileged_call` or `delegation`. The approval carries `verdict` (`admit` or `deny`), `approval_ref` and `decision_ref`. The engine produces the trust mark; arbora only carries its reference. | Proven by `tests/a2a/test_tool_action_admission.py::test_models_are_closed_and_frozen`.

**Behavior.** `ToolActionAdmitter.admit` makes one engine round trip and returns the engine's verdict unchanged. The named default `deny_without_verdict` applies only when the engine returns none. arbora holds no policy table and no threshold. The engine decides whether an action follows untrusted content. | Proven by `tests/a2a/test_tool_action_admission.py::test_admit_returns_engine_verdict_unchanged` and `::test_default_applies_only_without_verdict`.

**Wiring.** Replace the synchronous `_plan_confirm_stub` with one async confirm dispatcher over the closed confirmation_kind union; the tool_action branch awaits shared invoke with Surface.A2A, verified caller, signed authority and audit before `ToolActionAdmitter.admit`. The current stub is (`arbora/a2a/application.py:140`), registered at `arbora/a2a/application.py:154` and reached from `_invoke_method` (`arbora/a2a/application.py:157`) on `POST /a2a`. The harness check at `agent_utilities/security/tool_guard.py:383` calls it through this method and applies the returned approval. No production caller reaches an admission function today. | Proven by `tests/a2a/test_tool_action_admission.py::test_confirm_dispatch_reaches_admitter`.

**Refusal.** The admitter refuses with a typed `ToolActionRefusal` reason: `ENGINE_UNAVAILABLE`, `TRUST_MARK_MISSING`, `ACTION_CLASS_UNKNOWN`, `GRANT_STORE_UNAVAILABLE` or `ABSTAINED`. A refusal never reads as approval. The harness must treat every refusal as deny. Approval stays refused until the full ARBORA-A2A-R005.2 signed chain and ARBORA-A2A-R006.2 verified-caller bridge (including R006.2.1) pass: live input-required pending call, signature verification, exact params/human binding, one-time grant consumption, expiry and revocation checks. The grant store alone is insufficient. | Proven by `tests/a2a/test_tool_action_admission.py::test_each_refusal_reason_denies`.

**Evidence.** Every approval and refusal records `approval_ref`, `decision_ref`, `pending_call_id`, `action_class` and `params_digest` in the audit reservation of `ARBORA-A2A-R007`. No credential or parameter value appears in the record. | Proven by `tests/a2a/test_tool_action_admission.py::test_audit_entry_names_decision_without_values`.

**Hot-path proof.** The entry point is the wire method `arbora.plan/confirm` over `POST /a2a`. A scripted engine returns admit, deny and abstain for one pending call per action class. The test observes the verdict in the response and one linked audit entry per call. It proves a refusal never lets the action proceed. | Proven by `tests/a2a/test_tool_action_admission_e2e.py::test_confirm_returns_engine_verdict_and_audit`.

**Operation invoke and plan-confirm methods for A2A.** arbora implements arbora.op/invoke and arbora.plan/confirm as A2A methods registered in its method table, so invoking an operation and confirming its input-required approval use the same scope, policy, and error semantics as other hosted operations. Split into `ARBORA-A2A-R006.1` (both methods registered, fail-closed) with `ARBORA-A2A-R006.2` (the bridge to the shared hosted-operation registry) remaining open under the parent. | Proven by contract tests asserting invoke and confirm share identical authorization and error codes with the MCP and REST paths for the same operation.

**Register `arbora.op/invoke` and `arbora.plan/confirm`, fail-closed.** Arbora registers both methods in the A2A JSON-RPC table. It validates typed params. Each method refuses with a distinct error until shared hosted-operation invocation is bridged on `Surface.A2A`. | Tests validate params for both methods and assert refusal with a dedicated JSON-RPC code. The code differs from “method not found”.

**Bridge `arbora.op/invoke` to the shared hosted-operation registry.** Arbora must retain the request-bound verified caller and compose the shared InvokeServices into its A2A facade. Pass that caller to arbora.api.invoke.pipeline.invoke with Surface.A2A. Reuse the registered operation's scope, policy, effect, reservation, audit and error decisions. R006.2.1 owns the Arbora caller handoff. AU's existing GraphSession shape already supports the projection; no shape extension is required. Caller retention alone cannot establish the bridge. | Planned tests must enter the real /a2a route and compare read, write and fleet operations across A2A, MCP and HTTP. Verify operation-specific authorization and zero effects for refused requests.

**Preserve the verified caller through Arbora A2A authentication.** Model: Reuse AU's public GraphSession and Arbora VerifiedCaller projection. The existing session exposes actor, tenant and engine_verified_context. Behavior: Bind the resolved session to the current request's verified credential provenance and retain it through dispatch. Wiring: Extend AmbientA2AAuthenticator at `arbora/a2a/application.py:39` and reuse caller_from_session at `arbora/api/mcp/caller.py:12`. Refresh through verify_current_from_session at `arbora/api/invoke/bootstrap.py:99`. Refusal: Reject missing, stale, foreign-tenant or unsupported actor contexts before invocation. Do not relabel ai_agent or automated_service as human or service. Evidence: A synthetic human-session probe establishes shape compatibility only. It does not prove production authentication or invocation. | Planned `tests/a2a/test_verified_caller_bridge.py` must enter the real HTTP entry point. Cover request-bound credentials, refresh, actor/tenant preservation and each refusal. Assert zero authority or backend calls on refusal. Returning the caller alone cannot close R006.2.

**Wire request-bound caller retention and refresh.** Retain the authenticated session in `arbora/a2a/application.py:39` and pass its caller through dispatch at application.py:225. Reuse caller_from_session and verify_current_from_session without changing AU's compatible return shape. Preserve actor, tenant and credential provenance. Reject unsupported actors, stale authority and mismatched request identity before downstream calls. | Planned `tests/a2a/test_verified_caller_bridge.py::test_http_retains_and_refreshes_verified_caller` must enter /a2a with request-bound credentials. It must preserve identity and make zero downstream calls for every refusal. Synthetic ambient compatibility alone cannot satisfy this child.

**Compose shared invocation into A2A.** Extend `arbora/a2a/mcp.py:15` and `arbora/mcp_server/composition.py:185` to supply shared InvokeServices through the production serving path. Pass the verified caller to arbora.api.invoke.pipeline.invoke with Surface.A2A. Use the actual registered operation's scopes and shared effect, reservation, audit and error decisions. Keep signed confirmation subject to R005.2. | Planned `tests/a2a/test_verified_caller_bridge.py::test_serving_composition_reaches_shared_invoke` must exercise read, write and fleet operations through the real entry point. Compare A2A, MCP and HTTP authorization/refusal behavior. Refused calls must cause zero effects. Returning a caller without composed services cannot satisfy this child.

**Model.** `HeldItemAdmissionRequest` and `HeldItemVerdict` are new frozen models in `arbora/a2a/held_item_admission.py`. The request carries `item_kind` (`run_output_proposal` or `stored_run_program`), `item_ref`, `content_digest` and `engine_decision_ref`. The verdict carries `outcome` (`admitted`, `rejected` or `abstained`), `verdict_ref` and, for a program, `verification_ref`. The engine owns the held item and its stored form. [arXiv:2606.17929] | Proven by `tests/a2a/test_held_item_admission.py::test_models_are_closed_and_frozen`.

**Behavior.** `HeldItemAdmitter.admit` asks the engine for the verdict on a held item and returns it unchanged. For a stored program, it checks that the verification record names a verifier other than the compiler. It checks pass and retirement evidence against the engine-supplied policy and thresholds. Missing policy evidence or thresholds must refuse; Arbora has no local default count. arbora holds no policy of its own. [arXiv:2606.17929] | Proven by `tests/a2a/test_held_item_admission.py::test_program_needs_distinct_verifier_and_required_passes`.

**Wiring.** The held_item branch of the same async confirmation_kind dispatcher awaits shared invoke with Surface.A2A, signed authority and audit before `HeldItemAdmitter.admit`; it replaces the current synchronous `_plan_confirm_stub` (`arbora/a2a/application.py:140`), reached from `_invoke_method` (`arbora/a2a/application.py:157`). Wire a dedicated public engine held-item admission port through shared `arbora.api.invoke.pipeline.invoke` with the verified caller and `Surface.A2A`. Preserve the full signed approval prerequisites, scope/policy checks, pending-call/params/human binding, grant/plan fences, audit reservation and consume-once behavior; arbora keeps no local record. This port and adapter are new wiring. Do not call `approve_elevation` (`arbora/access/service.py:54`): it validates ElevationApproval and hardcodes OPERATOR_CONSOLE, which is a different authority surface. The harness moves its proposal approval from `agent_utilities/knowledge_graph/enrichment/writeback/approval.py:47`. No production caller reaches an admission function today. | Proven by `tests/a2a/test_held_item_admission.py::test_confirm_dispatch_reaches_held_item_admitter`.

**Refusal.** The admitter refuses with a typed reason: `ENGINE_UNAVAILABLE`, `ITEM_UNKNOWN`, `DIGEST_MISMATCH`, `VERIFIER_NOT_INDEPENDENT`, `PASSES_INSUFFICIENT`, `RETIRED`, `POLICY_EVIDENCE_MISSING` or `ABSTAINED`. A refusal leaves the item held. The harness must not apply a refused output or run a refused program. | Proven by `tests/a2a/test_held_item_admission.py::test_each_refusal_leaves_item_held`.

**Evidence.** Every verdict records `verdict_ref`, `item_kind`, `item_ref`, `content_digest` and `verification_ref` in the audit reservation of `ARBORA-A2A-R007`. A rejected item records its refusal reason. | Proven by `tests/a2a/test_held_item_admission.py::test_audit_entry_names_verdict_and_item`.

**Hot-path proof.** The entry point is the wire method `arbora.plan/confirm` over `POST /a2a`. A scripted engine holds one run output and one stored program. The test observes an admitted verdict applied once through shared invoke with Surface.A2A, a rejected verdict leaving the item held, and the linked audit entry. It proves operator elevation is never called and replay, changed params, wrong human, expired/revoked grants and unavailable producer ports cannot apply an item. | Proven by `tests/a2a/test_held_item_admission_e2e.py::test_confirm_admits_or_rejects_held_item`.

**Pre-effect audit reservation for every governed write.** Before any governed write or administrative effect, arbora reserves a tenant-scoped, idempotent audit entry in a pending state, binds it to the verified calling service's claims, and links the entry to the effect's outcome once known. A request with no audit class or an unavailable durable audit writer is rejected before the effect runs. | Proven by negative tests asserting a missing audit class or unavailable writer blocks the effect, and a reconciliation test linking a pending reservation to its final outcome.

**First-party A2A facade, not a vendored wrapper.** arbora implements the A2A protocol facade itself as first-party code over the public graph-engine and agent orchestration ports, rather than wrapping or depending on an external vendored A2A implementation. | Proven by a source-level dependency check confirming the A2A facade is implemented in this repository against the public ports.

**Advertise only what is wired.** arbora's Agent Card sets `capabilities.streaming`, `capabilities.pushNotifications`, and `capabilities.stateTransitionHistory` true only when a real durable authority object implementing the matching protocol (`A2AStreamingAuthority`, `A2APushNotificationAuthority`, `A2ATransitionHistoryAuthority`) is wired into the running composition; no flag or partial authority can force a field true. Split into `ARBORA-A2A-R009.1` (the typed capability-advertisement model, landed in this PR). | Proven by unit tests over `A2AAgentCapabilities.from_wired_authorities` asserting default-false, per-authority true, and a `TypeError` refusal on a non-conforming object.

**Typed Agent Card capability-advertisement model.** arbora defines `A2AAgentCapabilities.from_wired_authorities` plus `A2AStreamingAuthority`/`A2APushNotificationAuthority`/`A2ATransitionHistoryAuthority` runtime-checkable protocols in `arbora/a2a/models.py`, so a capability field is derived from whether a conforming authority object was supplied, never from a bare boolean. | Proven by `tests/a2a/test_models.py` covering default-false, selective true, all-true, and refusal on a non-conforming authority.

**WorkItem stream projection, not a shadow log.** Arbora must project status, step and terminal events through AU's public task-event reader. The exact producer requirement ID and durable task/tenant reader export remain unassigned in the current AU contracts. Define that owner contract before wiring message/stream, tasks/resubscribe or push delivery. Store no independent event-log copy. A missing, stale or unavailable projection must return typed UNAVAILABLE. Never backfill it from local state. | Future served integration must read real durable AU/EG events, enforce task and tenant scope, and resume after restart. Scripted fixtures alone cannot establish the missing producer or durable replay. Preserve all existing ordering, gap and zero-fabrication cases.

**Transition history is read-through to epistemic-graph.** arbora's `tasks/get` history path reads a task's full state-transition ledger through to epistemic-graph's durable kernel (`EG-DURABLE-KERNEL`) with no local reconstruction. | Proven by a contract test against a scripted EG durable-kernel fixture asserting the returned history exactly matches the fixture ledger.

**Typed refusal when the durable history authority is absent.** When no `A2ATransitionHistoryAuthority` is wired or the wired authority is unreachable, arbora returns a distinct JSON-RPC error `A2ATransitionHistoryUnavailable` with a privacy-safe message, never an empty or partially reconstructed history. | Proven by a negative test asserting the distinct error code and message shape, and that no history data is returned.

**Landed: the protocol exists, the error does not.** `arbora/a2a/models.py` defines the `A2ATransitionHistoryAuthority` runtime-checkable protocol (`ARBORA-A2A-R009.1`); no `A2ATransitionHistoryUnavailable` error type exists and `tasks/get` has no history-refusal wiring. | Proven today by `tests/a2a/test_models.py`; confirmed absent by `git grep -n A2ATransitionHistoryUnavailable arbora/ tests/`.

**Add the `A2ATransitionHistoryUnavailable` error type.** Add `A2ATransitionHistoryUnavailable(RuntimeError)` to `arbora/a2a/authority.py`, mirroring the existing `A2AStreamingUnavailable` sibling-error docstring pattern (`-3201x` block). | A new test in `tests/a2a/` asserts the class exists, subclasses `RuntimeError`, and is exported from `arbora/a2a/authority.py.__all__`.

**Blocked: wire `tasks/get`'s typed refusal.** Wire `tasks/get` to raise `A2ATransitionHistoryUnavailable` when no `A2ATransitionHistoryAuthority` is wired or the wired authority raises on call, per test-spec row `A2A-HT06`. Blocked on `ARBORA-A2A` landing (`ARBORA-A2A-R014`), since the real history read-through this wires against does not exist until then. | `A2A-HT06` in `test-spec.md` passes once unblocked. Tracked here as the explicit cross-dependency rather than left implicit.

**Push notifications are best-effort over a durable outbox.** arbora retries push delivery from epistemic-graph's durable outbox (`EG-DURABLE-KERNEL-R001`), never an in-process queue; a repeatedly failing target is dead-lettered and reported. | Proven by a restart test asserting pending pushes survive process restart via the outbox, and a repeated-failure test asserting dead-letter reporting.

**No capability advertised before ARBORA-A2A lands.** Until `ARBORA-A2A`'s context-budget subset is on the default branch, arbora's composition layer refuses to wire a real streaming/push/history authority, keeping all three capability fields fixed false. | Proven by a composition-layer test asserting authority wiring is refused (or absent) while the `ARBORA-A2A` dependency flag is unset.

**Card advertises no harness capability before it works.** The Agent Card (`A2AAgentCapabilities`, `arbora/a2a/models.py:167`) must not carry any harness-admission field or extension until `ARBORA-A2A-R017.6` passes on the default branch. | Proven by `tests/a2a/test_agent_card.py::test_card_has_no_harness_field_before_admission_e2e`.

**Caller-visible card matches served behavior.** A contract test asserts the Agent Card's advertised capability subset exactly matches which of streaming/push/history the integration fixture actually exercises at the tested revision. | Proven by a contract test comparing advertised capabilities against the fixture's exercised capability set at the exact tested revision.

**Typed admission request/decision model.** Arbora defines a typed `ToolSubsetAdmissionRequest` (selected agent graph reference, caller context budget) and `ToolSubsetAdmissionDecision` (admitted flag, admitted tool subset, typed refusal reason, provenance) at the A2A admission door. Split into `ARBORA-A2A-R016.1` (the model plus a refusal test proving today's exact fail-closed result), with live EG/AU wiring remaining open under the parent. | Proven by a unit test constructing both models and exercising the admission function's current fail-closed return.

**Fail-closed admission function proven against today's unavailable upstreams.** Arbora's `admit_tool_subset` function accepts a typed `ToolSubsetAdmissionRequest` and returns a typed `ToolSubsetAdmissionDecision` refusing every request with `admitted=False`, no admitted tools, reason `EG_ASSEMBLE_UNAVAILABLE`, and a provenance reference naming the unavailable EG operation — never silently succeeding, never an unrecognized/untyped error. | Proven by a test asserting the exact refusal fields for a representative request while EG `AgentAssemble` and AU's envelope field remain unavailable.

**Admission request carries model profile and task class.** `ToolSubsetAdmissionRequest` in `arbora/a2a/admission.py` gains `model_profile_ref` and `task_class`, both non-empty strings. Arbora takes both from the routed capability, never from the caller. | Proven by `tests/a2a/test_admission.py::test_request_requires_model_profile_and_task_class`.

**Admission decision carries the committed harness answer.** `ToolSubsetAdmissionDecision` gains `harness_config`, a typed mirror of the engine `HarnessConfigAnswer`, and `context_budget_tokens`. An admitted decision must carry both. A refused decision must carry neither. | Proven by `tests/a2a/test_admission.py::test_admitted_decision_carries_harness_config_and_budget`.

**Refusal enum gains the harness reasons.** `ToolSubsetAdmissionRefusalReason` gains `HARNESS_CONFIG_UNAVAILABLE`, `HARNESS_CONFIG_ABSTAINED`, `ENVELOPE_LACKS_HARNESS_CONFIG`, and `CONTEXT_BUDGET_MISSING`. Arbora holds no policy table and no default threshold. | Proven by `tests/a2a/test_admission.py::test_refusal_reasons_are_closed_set`.

**Routing decision carries model profile and task class.** `A2ARouteDecision` in `arbora/a2a/routing.py` gains `model_profile_ref` and `task_class`, read from the `resolve_capability` result at `arbora/a2a/routing.py:61`. A result lacking either field must raise `A2AAssemblyUnavailable`. | Proven by `tests/a2a/test_routing.py::test_route_decision_carries_model_profile_and_task_class`.

**Context-budget-bound subset sourced from EG assembly.** The admission door derives an admitted tool subset only from a committed epistemic-graph `AgentAssemble` answer (`EG-DECISION-ENGINE-R036`) covering the selected agent graph within the caller's context budget; while that operation returns unavailable, admission refuses closed with reason `EG_ASSEMBLE_UNAVAILABLE`. | Proven by integration tests against a scripted EG assembly client covering an available committed answer and an unavailable/abstained answer.

**Engine decision port for HarnessConfig.** `arbora/a2a/admission.py` defines the `HarnessConfigDecider` protocol with one async method. The method takes tenant, model profile reference, task class, budget tokens, and priority. It returns the engine `HarnessConfigAnswer` (EG-DECISION-ENGINE row for the `HarnessConfig` question). | Proven by `tests/a2a/test_admission.py::test_decider_port_returns_typed_answer`.

**Admission is async and calls the decider once.** `admit_tool_subset` becomes `async` and takes the decider as an argument. It makes exactly one engine round trip and reads the allowed tool subset from the answer's `action_space`. It makes no separate `AgentAssemble` call. | Proven by `tests/a2a/test_admission.py::test_admission_makes_one_engine_call`.

**Priority comes from the principal class.** The admission request carries `priority`, set from the authenticated principal class through the engine contract's priority enum. The caller must not supply it. | Proven by `tests/a2a/test_admission.py::test_priority_is_set_from_principal_class`.

**Missing budget refuses.** When `context_budget_tokens` is null or below 1, admission refuses with `CONTEXT_BUDGET_MISSING` before it calls the engine. | Proven by `tests/a2a/test_admission.py::test_missing_budget_refuses_before_engine_call`.

**Wire admission into the send path.** `A2AService.send_message` (`arbora/a2a/service.py:40`) calls `admit_tool_subset` after `router.route`. The call replaces the inline raises at `arbora/a2a/routing.py:74`, `arbora/a2a/authority.py:268`, and `arbora/a2a/authority.py:299`. | Proven by `tests/a2a/test_service_admission.py::test_send_message_refuses_without_admission`.

**End-to-end admitted task.** A scripted decider and a signing envelope fake drive `POST /a2a` `message/send` (`arbora/a2a/application.py:166`). The test asserts one enqueued envelope whose `harness_config` equals the scripted answer. | Proven by `tests/a2a/test_admission_e2e.py::test_message_send_enqueues_envelope_with_harness_config`.

**Cryptographic enforcement via the signed AU envelope.** An admitted tool subset is carried only inside the signed AU `AgentTurnEnvelope`'s allowed-tool-subset field (`AU-CONTROL-R035`); while that field does not exist in the signed envelope, admission refuses closed with reason `ENVELOPE_LACKS_ALLOWED_TOOL_SUBSET` even given an EG assembly answer. | Proven by a test asserting a request refuses with this reason when the EG answer exists but the envelope carries no allowed-tool-subset field, and admits only once the signed field is present and its signature verified.

**Envelope carries harness_config.** `WorkItemA2AAuthority._enqueue` (`arbora/a2a/authority.py:256`) passes the admitted `harness_config` into `AgentTurnEnvelope` next to the allowed tool subset. It depends on the AU-CONTROL row for the envelope `harness_config` field. | Proven by `tests/a2a/test_authority_envelope.py::test_enqueue_passes_harness_config`.

**Envelope without the field refuses.** When `AgentTurnEnvelope.model_fields` lacks `harness_config`, admission refuses with `ENVELOPE_LACKS_HARNESS_CONFIG`, even given a committed engine answer. | Proven by `tests/a2a/test_admission.py::test_envelope_lacking_harness_config_refuses`.

**Typed refusal reason and provenance on every decision.** Every `ToolSubsetAdmissionDecision`, admitted or refused, carries a stable machine-readable field sufficient to audit exactly which upstream answer authorized or blocked it. | Proven by a schema test asserting every decision instance has a non-empty `provenance` and, when refused, a `refusal_reason` drawn from the typed enumeration.

**Provenance names the harness decision.** An admitted decision's `provenance` names the engine decision record identifier of the `HarnessConfig` answer. A refused decision names the refusing operation. | Proven by `tests/a2a/test_admission.py::test_provenance_names_harness_decision_record`.

**No advisory, cached, or partial substitute.** The admission door never returns a tool subset that is advisory-only, drawn from a prior request's cached answer, or a partial/best-effort coverage of the selected agent graph; an incomplete upstream answer is a refusal, not a smaller admission. | Proven by negative tests asserting a partial or stale upstream answer produces a refusal, never a trimmed admission.

**Abstention refuses and records the named default.** When the engine answer is a typed abstention, admission refuses with `HARNESS_CONFIG_ABSTAINED`. The decision records the abstention's named default in `provenance`. It must not apply that default. | Proven by `tests/a2a/test_admission.py::test_abstention_refuses_and_does_not_apply_default`.

**Unavailable, stale, or partial answers refuse.** An unreachable engine, an expired decision record, or an answer missing a threshold under a summarizing policy refuses with `HARNESS_CONFIG_UNAVAILABLE`. | Proven by `tests/a2a/test_admission.py::test_unavailable_stale_or_partial_harness_answer_refuses`.

**Fresh checkout.** Contract and unit tests for the admission model and its refusal behavior run with published packages and no private network, sibling checkout, or live production identity provider. | Proven by running the admission test suite from a clean public clone with no additional configuration.

**Critique-gated output release.** Require the owning AU runtime's typed checklist and questions. Bind the EG critique verdict to the exact generated output. Before release, apply the held-item contract in `ARBORA-A2A-R006.3` through `ARBORA-A2A-R006.8`. Preserve the verified-caller prerequisite in `ARBORA-A2A-R006.2.1` and signed-authority prerequisites in `ARBORA-A2A-R006.5`. Gate output at `arbora/a2a/application.py:_send_message`. Keep this separate from `arbora/a2a/routing.py:OrchestratorA2ARouter.route`; routing selects an agent and cannot satisfy critique acceptance. Keep release unavailable until the AU and EG producer contracts are published. Add no second approval authority. | Future acceptance: `tests/a2a/test_application.py::test_send_message_holds_output_until_bound_critique_passes` and `tests/a2a/test_application.py::test_send_message_rejects_untyped_preflight_and_failed_critique`. Exercise a verified caller through held-item admission. Bind the verdict to the exact output. Missing, mismatched, rejected, or abstained evidence leaves the item held and sends no output. Prove routing alone cannot satisfy critique acceptance. These tests are proposed; no execution is claimed.

**AU:21 Arbora definition slice.** AU:21 cross-owner slice. Residual: The complete agent-run checkpoint payload and cross-process resume binding are not defined by a WorkItem lifecycle test. Short-term versus long-term memory lifecycle/retention and resumed-output binding to that run/memory state remain unspecified. Arbora minimum action: Retain partial; preserve existing host streaming IDs. Define EG durable checkpoint/memory state and retention, plus AU resume application. Also define exact host stream cursor/run-state binding with explicit dependency edges. Do not replace the existing streaming definition with a new rollup. Producer/consumer boundary: EG WorkItem lifecycle and isolation -> AU run execution -> existing ARBORA-A2A-R001/ARBORA-OPS-R001 streaming facade. The reviewed packet has no explicit dependency joining a complete run-checkpoint/memory contract to the resume and stream consumers. External engine, SDK, AU, Pipelines or WebUI behavior remains owned there; this row specifies only Arbora. Current IDs: `EG-DURABLE-KERNEL-R028, EG-IDENTITY-R006, ARBORA-A2A-R001, ARBORA-A2A-R001.1, ARBORA-OPS-R001`. Source record SHA-256: `d89bb9c69e2fdef6a5c3fd428ede3f91868539056c2b949700867d8d8087d1e7`. Reviewed evidence paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/review-external-eg01-06-20261012.json, epistemic-graph/specs/durable-graph-kernel/requirements.md:57#sha256=66e1226b2a189a06b745726076e2d9488ff11c39f37cf8d92771a2b1f7fe397a, epistemic-graph/specs/engine-identity-and-scope/requirements.md:10#sha256=391f0652a4ce4948ee2c627bf4a7b4c4c401856d04486b1d06868d4249bb78c8, arbora/specs/a2a/requirements.md:5#sha256=e00c4e341cbd5b772d17844fed798d0443604bdf4f03f763a368e5978e136714, arbora/specs/a2a/requirements.md:6#sha256=e1a365736468ee13707d0e1498b3508136c7e9564b5116f60db91bcf80a705c1, arbora/specs/hosted-api-operations/requirements.md:5#sha256=38fdae1cb2880fed7da4fba36e88e037022d0ba22cec18619c095e6c3d1d63fb`. Packet row: `spec-audit/reconciliation/repository-batches-20261012/arbora.json#/rows/13`. No implementation or runtime evidence is claimed. | Future Arbora tests must prove the owner behavior and cover every positive, refusal, and zero-effect case defined above. Retain all existing parent acceptance for IDs `EG-DURABLE-KERNEL-R028, EG-IDENTITY-R006, ARBORA-A2A-R001, ARBORA-A2A-R001.1, ARBORA-OPS-R001`. Use the exact reviewed source paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/review-external-eg01-06-20261012.json, epistemic-graph/specs/durable-graph-kernel/requirements.md:57#sha256=66e1226b2a189a06b745726076e2d9488ff11c39f37cf8d92771a2b1f7fe397a, epistemic-graph/specs/engine-identity-and-scope/requirements.md:10#sha256=391f0652a4ce4948ee2c627bf4a7b4c4c401856d04486b1d06868d4249bb78c8, arbora/specs/a2a/requirements.md:5#sha256=e00c4e341cbd5b772d17844fed798d0443604bdf4f03f763a368e5978e136714, arbora/specs/a2a/requirements.md:6#sha256=e1a365736468ee13707d0e1498b3508136c7e9564b5116f60db91bcf80a705c1, arbora/specs/hosted-api-operations/requirements.md:5#sha256=38fdae1cb2880fed7da4fba36e88e037022d0ba22cec18619c095e6c3d1d63fb`. This definition does not assert these tests have run.

**Opt-in committed terminal point read.** `tasks/get` and the shared MCP get action may request `includeCommittedEvent`. After existing task ownership admission, read AU RunClient.outcome through the current verified graph session. Validate the EG terminal record against tenant, graph, task and terminal outcome; revalidate caller authority after the read. Project only safe committed identity and result references. Missing or legacy producer data is explicitly unavailable. Never enable streaming, fabricate cursors or copy an event log. | Tests exercise shared service and HTTP parameter dispatch, valid readback, foreign bindings, stale caller, malformed producer records and zero reads for unauthorized tasks. Real native producer acceptance remains EG-DURABLE-KERNEL-R028.2; full lifecycle streaming stays under R010.

**Served agent keeps and lists caller conversations.** The served A2A application that `mount_sdk_a2a` builds in `arbora/host_bindings.py` keeps tasks and context history in an `InMemoryStorage`, and it does not serve `tasks/list`. A restart loses every conversation, and no client can list one. The served agent must store tasks and context history in the durable task store of the parent row. It must serve `tasks/list` filtered to the verified caller, newest first, with each context's identifier, title and last update. A `contextId` sent after a restart must continue that context. | A served-app test restarts the application between two turns of one context. The second turn must see the first. `tasks/list` must return only the caller's contexts, and a foreign `contextId` must be refused.

**Served agent streams turn events or refuses streaming by type.** The served agent advertises `capabilities.streaming: false`. It answers `message/stream` with HTTP 500, because fasta2a raises `NotImplementedError`. Until streaming is served, `message/stream` and `tasks/resubscribe` must return the typed JSON-RPC refusal of `ARBORA-A2A-R001.1`. When streaming is served, `message/stream` must emit answer text deltas, each tool call with its name and arguments, each tool result, and the final state as A2A events. The card must then advertise `streaming: true`. | A served-app test expects the typed refusal, not HTTP 500, while streaming is unserved. A streaming fixture must observe text deltas, a tool call, its result and the final state in order.

**Served agent accepts file parts.** The served agent must accept A2A `file` parts, which carry an image or text file as bytes with a media type, up to a configured size. It must pass them to the agent as model input. An oversized or unsupported part must be refused by type before any task is created. | A served-app test sends a PNG part and observes it in the agent's model input. An oversized part must create zero tasks.

**Caller model preference.** A caller may name a preferred model profile in message metadata as `arboraModelProfile`. Arbora decides the model. The routing decision of `ARBORA-A2A-R016.5` uses the preferred profile only when the routed capability allows it. Otherwise it uses the routed profile and records that the preference was not honoured. The task metadata must name the profile used. A read-only `models.list` operation must list the profiles the caller may prefer, with display name and provider. | Routing tests cover an allowed preference, a disallowed preference and an absent preference. An operation test must list only the caller's allowed profiles.

**Typed acceptance-evidence model and freeze-gap checker.** Arbora ships a typed model of the three evidence kinds a requirement needs for `ACCEPTED` (`merged_head`, `test`, and operational `consumer`/`release`, all at the same commit) and a checker that, given a spec's `status.json`, lists every `LANDED`/`CLOSED` requirement missing one or more of those kinds at its `merged_head` commit. | A unit test against a fixture `status.json` asserts the checker reports exactly the gapped requirement IDs with their missing evidence kind names, and a refusal test asserts a malformed or missing `status.json` raises rather than reporting a false pass.

**implement the typed EvidenceRecord/RequirementGap model and gaps_for_status/load_status functions plus the standalone CLI entry point in scripts/check_acceptanc.** Child slice of `ARBORA-ACCEPTANCE-R001` (see tasks.md). | A unit test against a fixture status.json asserts the checker reports exactly the gapped requirement IDs with their missing evidence kind names, and a refusal test asserts a malformed or missing status.json raises rather than reporting a false pass

**Auditor distinct from delivery lane.** A requirement's `acceptance_state` moves from `NOT_AUDITED` to `ACCEPTED` only in a change where the reviewing identity differs from the author of the `merged_head` commit it cites, and only after `ARBORA-ACCEPTANCE-R001`'s checker reports no gap for that requirement. | A review-trail test over a sample `status.json` edit asserts the recorded auditor identity differs from the cited commit's author, and that the checker was run (or its report attached) before the state flip.

**Evidence is append-only.** Once an evidence entry is recorded for a requirement, its `kind`, `commit`, `result`, and `url` fields are never rewritten in place; a correction is a new appended entry, and the checker only honors entries matching the requirement's current `merged_head` commit. | A regression test diffs two revisions of the same `status.json` and fails if any existing evidence entry's fields changed rather than a new entry being appended.

**Operational evidence tracks the current commit, not a stale one.** A `consumer` or `release` receipt satisfies the `ACCEPTED` gate only when recorded against the requirement's current `merged_head` commit; a receipt recorded against a superseded commit is treated as missing. | A fixture test moves a requirement's `merged_head` forward without a fresh operational receipt and asserts the checker reports the operational-evidence kind as missing again.

**Checker is the only path to an `ACCEPTED` report.** The acceptance-evidence checker is runnable standalone (as a script or an importable module) against any spec directory under `specs/`, producing a deterministic, machine-parseable gap report with no network or live-cluster dependency. | A CLI invocation test runs the checker against each tracked spec's `status.json` offline and asserts exit code and report shape are deterministic across two consecutive runs.

**AIMD error-budget throttling that only narrows automatically (rollup).** arbora observes a bounded error budget per tenant, child, and operation class and applies additive-increase/multiplicative-decrease throttling against the graph engine's declared capacity cell limit. An automatic control action may only narrow the allowed concurrency, never raise it above that ceiling, and every decision is recorded with its input window, old and new limits, and reason. Delivered through its child requirements, producer first. | Proven by a deterministic fixture test demonstrating decrease on budget breach, bounded recovery, and an idempotent decision receipt for a replayed window.

**Pure partitioned AIMD decision rule.** `arbora/fleet/error_budget.py` defines typed `Partition`, `OutcomeSample`, `BudgetWindow`, `AimdConfig`, `ThrottleMode` and `ThrottleDecision`, and a pure `decide()` function that computes the next concurrency limit from a closed window and the controller's prior state: eligible service failures (not caller errors or policy denials) drive the error fraction, breach multiplicatively decreases bounded by a floor, a healthy window additively increases bounded by the engine/policy ceiling, and replaying the same window is idempotent. No clock, I/O or fleet dispatch wiring. | `tests/fleet/test_error_budget.py` covers bounded recovery, multiplicative decrease, the floor and engine-headroom ceiling, caller-error/policy-denial neutrality, insufficient-sample handling, idempotent replay, and tenant/child partition isolation.

**Capacity status and mode operations.** arbora exposes capacity operations in arbora/api/ops/capacity.py and a read/config facade in arbora/fleet/throttle_service.py that report controller status, update cell limits, report throttle state, and select observe or enforce mode per child, using the same hosted-operation registry, identity, and error handling as other operations. | Proven by contract tests asserting a mode change requires verified administrator authorization while capacity:read permits status only.

**AU:26 Arbora definition slice.** AU:26 cross-owner slice. Residual: Per-run error frequency over a declared window is not the host tenant/child/operation partition. No joint latency/cost/error-driven model-and-width adjustment contract records each before/after model, width, budget and rationale on that run. Arbora minimum action: Extend the existing EG routing/continuation contract with the joint per-run observation window and adjustment receipt. Bind AU observations and trace application. Preserve host ceiling and narrow-only enforcement. Producer/consumer boundary: AU ObservedCost routing.py -> EG routing; AU continuation.py narrows and releases capacity. Arbora error_budget.decide computes partitioned AIMD. These separate paths have no reviewed joint per-run adjustment producer/consumer contract. External engine, SDK, AU, Pipelines or WebUI behavior remains owned there; this row specifies only Arbora. Current IDs: `AU-HARNESS-R007, AU-CONTROL-R006, AU-CONTROL-R006.1, AU-CONTROL-R019, EG-ORCH-VOCAB-R009, EG-ORCH-VOCAB-R009.1, EG-ORCH-VOCAB-R009.2, EG-ORCH-VOCAB-R009.3, EG-ORCH-VOCAB-R009.4, EG-ORCH-VOCAB-R009.5, EG-ORCH-VOCAB-R009.6, EG-ORCH-VOCAB-R009.7, EG-ORCH-VOCAB-R009.8, EG-ORCH-VOCAB-R009.9, EG-ORCH-VOCAB-R009.10, EG-ORCH-VOCAB-R009.11, EG-ORCH-VOCAB-R009.12, EG-ORCH-VOCAB-R009.13, EG-ORCH-VOCAB-R009.14, EG-ORCH-VOCAB-R009.15, EG-ORCH-VOCAB-R009.16, EG-ORCH-VOCAB-R009.17, ARBORA-CAPACITY-R001, ARBORA-CAPACITY-R001.1`. Source record SHA-256: `8d2f83f788c5fdd36c4dc47f85c9f7673393b6b9075dc46a5ac1c32afd2386e2`. Reviewed evidence paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-70.json, agent-utilities/specs/agent-control-plane/requirements.md:10#sha256=d23694e108652e92337ab4997286d2f3119818b3e7a9ff3f8a65f72a13bbb709, agent-utilities/specs/agent-control-plane/requirements.md:24#sha256=5e7396750953ba0daf829dd0df1d85d868211579eb5673bb158645ceb5204bb5, agent-utilities/specs/harness-evolution/requirements.md:12#sha256=6b67b965ae1e92c7eee335722320248c32212aef6b2a9add2bd117d4c56ba57b, epistemic-graph/specs/orchestration-vocabulary/requirements.md:60#sha256=48fa2a2cf52544702d56b50861ea5a0ceaf85ef47c0d39aba4792baeaeeb1b92, epistemic-graph/specs/orchestration-vocabulary/requirements.md:61#sha256=e4b274c430f4a5f68666f80a71c4e0efa4b18800e9027947b67d91d327b53863, arbora/specs/adaptive-capacity/requirements.md:6#sha256=7ab4ff5d4823d469480e338976991916a161b284d4fec717981291830bbc16f1`. Packet row: `spec-audit/reconciliation/repository-batches-20261012/arbora.json#/rows/14`. No implementation or runtime evidence is claimed. | Future Arbora tests must prove the owner behavior and cover every positive, refusal, and zero-effect case defined above. Retain all existing parent acceptance for IDs `AU-HARNESS-R007, AU-CONTROL-R006, AU-CONTROL-R006.1, AU-CONTROL-R019, EG-ORCH-VOCAB-R009, EG-ORCH-VOCAB-R009.1, EG-ORCH-VOCAB-R009.2, EG-ORCH-VOCAB-R009.3, EG-ORCH-VOCAB-R009.4, EG-ORCH-VOCAB-R009.5, EG-ORCH-VOCAB-R009.6, EG-ORCH-VOCAB-R009.7, EG-ORCH-VOCAB-R009.8, EG-ORCH-VOCAB-R009.9, EG-ORCH-VOCAB-R009.10, EG-ORCH-VOCAB-R009.11, EG-ORCH-VOCAB-R009.12, EG-ORCH-VOCAB-R009.13, EG-ORCH-VOCAB-R009.14, EG-ORCH-VOCAB-R009.15, EG-ORCH-VOCAB-R009.16, EG-ORCH-VOCAB-R009.17, ARBORA-CAPACITY-R001, ARBORA-CAPACITY-R001.1`. Use the exact reviewed source paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-70.json, agent-utilities/specs/agent-control-plane/requirements.md:10#sha256=d23694e108652e92337ab4997286d2f3119818b3e7a9ff3f8a65f72a13bbb709, agent-utilities/specs/agent-control-plane/requirements.md:24#sha256=5e7396750953ba0daf829dd0df1d85d868211579eb5673bb158645ceb5204bb5, agent-utilities/specs/harness-evolution/requirements.md:12#sha256=6b67b965ae1e92c7eee335722320248c32212aef6b2a9add2bd117d4c56ba57b, epistemic-graph/specs/orchestration-vocabulary/requirements.md:60#sha256=48fa2a2cf52544702d56b50861ea5a0ceaf85ef47c0d39aba4792baeaeeb1b92, epistemic-graph/specs/orchestration-vocabulary/requirements.md:61#sha256=e4b274c430f4a5f68666f80a71c4e0efa4b18800e9027947b67d91d327b53863, arbora/specs/adaptive-capacity/requirements.md:6#sha256=7ab4ff5d4823d469480e338976991916a161b284d4fec717981291830bbc16f1`. This definition does not assert these tests have run.

**AU:70 Arbora definition slice.** AU:70 cross-owner slice. Residual: The contract does not define paper throughput numerator, denominator, window, or a 2000-papers/day target. It also lacks below-target policy to prioritize maintenance backlog purge and per-goal budget allocation. It lacks safe purge candidates, authorization/admission, refusal, and decision/result evidence. Arbora minimum action: Define an EG-owned observed-throughput decision with explicit window, units, and safe-purge rules. Also define purge/budget obligations. Bind hosted execution and connector observations. Test below/at/above threshold and refusal through the actual ingestion/maintenance route. Existing repository latency is not paper/day acceptance. Producer/consumer boundary: SDK paper transport -> EG SourceIngest/native commits + enrichment WorkItems -> ingestion telemetry -> EG budget/purge decision. (Missing) -> Arbora governed maintenance dispatch (missing). AU instrumentation supplies observations, not policy authority. External engine, SDK, AU, Pipelines or WebUI behavior remains owned there; this row specifies only Arbora. Current IDs: `AU-RETIRE-R005, EG-REPO-INGEST-R006`. Source record SHA-256: `902f964dd909186f3a31d1f8a84d146b715446e64dfeec62480c8151baa06996`. Reviewed evidence paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/review-sdk-20261012.json, epistemic-graph/specs/repository-index-and-ingestion/requirements.md:21#sha256=31b0c0f71492eba7ea58a154f3a2bb1552aff5c227a88548c09b3f9748b9b49b, agent-utilities/specs/au-engine-duplicate-retirement/requirements.md:14#sha256=0f054dbf4383f287ee72a12135a67fc0a6228e89bff2ee9e32df77fabb7f0ca9`. Packet row: `spec-audit/reconciliation/repository-batches-20261012/arbora.json#/rows/22`. No implementation or runtime evidence is claimed. | Future Arbora tests must prove the owner behavior and cover every positive, refusal, and zero-effect case defined above. Retain all existing parent acceptance for IDs `AU-RETIRE-R005, EG-REPO-INGEST-R006`. Use the exact reviewed source paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/review-sdk-20261012.json, epistemic-graph/specs/repository-index-and-ingestion/requirements.md:21#sha256=31b0c0f71492eba7ea58a154f3a2bb1552aff5c227a88548c09b3f9748b9b49b, agent-utilities/specs/au-engine-duplicate-retirement/requirements.md:14#sha256=0f054dbf4383f287ee72a12135a67fc0a6228e89bff2ee9e32df77fabb7f0ca9`. This definition does not assert these tests have run.

**AU:122 Arbora definition slice.** AU:122 cross-owner slice. Arbora must qualify the served agents.run path using the versioned load profile in plan.md. Run 1,000 requests at each concurrency of 1, 8, and 32. Require terminal latency p95 at most 2,000 ms and failure rate at most 1 percent per level. Count 30-second timeouts as failures. Record workload, fixture, owner revisions, measurements, and a pass/fail result. Missing producer bindings or samples must refuse qualification. Synthetic bounded-map or scorer-only tests cannot qualify this path. Producer/consumer boundary: AU load driver -> served agent operation through Arbora -> measured per-run report/admission evidence. No exact load-driver/report producer contract was found. External engine, SDK, AU, Pipelines or WebUI behavior remains owned there; this row specifies only Arbora. Current IDs: `none assigned in this packet`. Source record SHA-256: `440703d339dcff0a4ca3658c11f5b32974a921515769f5f29e313bf26ba74fad`. Reviewed evidence paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-24-owner-supplements.json, spec-audit/writer-queue-merged/agent-utilities.tsv:122, agent-utilities/specs/harness-evolution/requirements.md:141#sha256=7119a5b3ce026c7d1d3f47abe073ee89be517dae342e4e290b32a5969af85747, agent-utilities/specs/harness-evolution/requirements.md:82#sha256=f7ef7e6ef3f5b93aa4294dbb1371a21f1cf29ae7ec62c739a11deec7782d45c5, epistemic-graph/specs/decision-engine/requirements.md:152#sha256=a59accc536bb7195f5bebf8d0b75e7a2fd31628bbd3932d35c29d58ec0b342a0`. Packet row: `spec-audit/reconciliation/repository-batches-20261012/arbora.json#/rows/31`. No implementation or runtime evidence is claimed. | Future Arbora tests must prove the owner behavior and cover every positive, refusal, and zero-effect case defined above. Retain all existing parent acceptance for IDs `none assigned in this packet`. Use the exact reviewed source paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-24-owner-supplements.json, spec-audit/writer-queue-merged/agent-utilities.tsv:122, agent-utilities/specs/harness-evolution/requirements.md:141#sha256=7119a5b3ce026c7d1d3f47abe073ee89be517dae342e4e290b32a5969af85747, agent-utilities/specs/harness-evolution/requirements.md:82#sha256=f7ef7e6ef3f5b93aa4294dbb1371a21f1cf29ae7ec62c739a11deec7782d45c5, epistemic-graph/specs/decision-engine/requirements.md:152#sha256=a59accc536bb7195f5bebf8d0b75e7a2fd31628bbd3932d35c29d58ec0b342a0`. This definition does not assert these tests have run.

**EG:9 Arbora definition slice.** EG:9 cross-owner slice. Residual: Define bounded load/headroom scaling proposals, Arbora application and applied-state reconciliation. Arbora minimum action: Add the closed-loop producer/Arbora consumer and applied-state receipt; preserve existing ARBORA-HOST references. Producer/consumer boundary: EG capacity premises/place verdicts feed hosting policy; Arbora exposes limits/mode and pure AIMD. Engine scaling actuation/reconciliation is an absent definition, not an unlinked throttle. External engine, SDK, AU, Pipelines or WebUI behavior remains owned there; this row specifies only Arbora. Current IDs: `EG-DECISION-ENGINE-R112, EG-PLACEMENT-R001.6, ARBORA-CAPACITY-R001, ARBORA-CAPACITY-R002`. Source record SHA-256: `cb17ea03a7344584fed7a9f22a78c1e97c58919616433e7026481606fd0bdccb`. Reviewed evidence paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-18-final-eg.json, arbora/specs/adaptive-capacity/requirements.md:6#sha256=7ab4ff5d4823d469480e338976991916a161b284d4fec717981291830bbc16f1, epistemic-graph/specs/decision-engine/requirements.md:185#sha256=72ce9d891b8d3516a1041e5864816c04ae7f9fe772cc21afb8197f3d76036f81, arbora/specs/adaptive-capacity/requirements.md:5#sha256=81c3cae01a99708bf80635022e4c2372a7af3c950ddd88c55de5e6cd52694023, epistemic-graph/specs/placement-and-worker-policy/requirements.md:11#sha256=9cf3cc47b48a14a0afa3294aecf03e3015af29dd76781f30464008f0c0b5045b, arbora/specs/adaptive-capacity/requirements.md:7#sha256=a85c3cfac8bbd110aa18bad324bbc1fce87fb2c69c9c1593618d096011a1bf9d`. Packet row: `spec-audit/reconciliation/repository-batches-20261012/arbora.json#/rows/32`. No implementation or runtime evidence is claimed. | Future Arbora tests must prove the owner behavior and cover every positive, refusal, and zero-effect case defined above. Retain all existing parent acceptance for IDs `EG-DECISION-ENGINE-R112, EG-PLACEMENT-R001.6, ARBORA-CAPACITY-R001, ARBORA-CAPACITY-R002`. Use the exact reviewed source paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-18-final-eg.json, arbora/specs/adaptive-capacity/requirements.md:6#sha256=7ab4ff5d4823d469480e338976991916a161b284d4fec717981291830bbc16f1, epistemic-graph/specs/decision-engine/requirements.md:185#sha256=72ce9d891b8d3516a1041e5864816c04ae7f9fe772cc21afb8197f3d76036f81, arbora/specs/adaptive-capacity/requirements.md:5#sha256=81c3cae01a99708bf80635022e4c2372a7af3c950ddd88c55de5e6cd52694023, epistemic-graph/specs/placement-and-worker-policy/requirements.md:11#sha256=9cf3cc47b48a14a0afa3294aecf03e3015af29dd76781f30464008f0c0b5045b, arbora/specs/adaptive-capacity/requirements.md:7#sha256=a85c3cfac8bbd110aa18bad324bbc1fce87fb2c69c9c1593618d096011a1bf9d`. This definition does not assert these tests have run.

**Scaling authority and intent contracts (rollup).** `arbora/fleet/scaling/` holds typed, immutable contracts for scaling intents. arbora applies these contracts when it admits a scaling intent. The contracts cover scale units, pools, workload classes, controllers, lease fences and lifecycle records. Each unit has exactly one replica writer. The package also holds a scale evaluator and a resource-pool placement evaluator. The engine (EG-DECISION-ENGINE) decides how far to scale. These modules validate and apply that decision. Child requirements deliver this row. | The child requirements' tests under `tests/fleet/scaling/` prove this row.

**Scale authority validation.** `scaling_authority.py` refuses two replica writers for one unit. It refuses dependency cycles and headroom beyond the replica bounds. It refuses stale unit revisions, replica counts out of range and offline failure domains. It refuses failed or simulated execution states without evidence. It refuses a lease fence that changes between lifecycle records. | `tests/fleet/scaling/test_scaling_authority_contract.py` asserts each refusal by name.

**Authenticated bounded signal reads.** `scaling_signal_authority.py` reads scaling signals through one bound provider. The provider rejects samples outside the scope, from another source, stale samples and replayed samples. Pagination stays pinned to one snapshot digest. A missing batch never reads as zero. Samples never enter the graph projection. | `tests/fleet/scaling/test_scaling_signal_authority.py` asserts each rejection.

**Idempotent scale-intent reconciliation.** `scaling_intent_reconciler.py` persists an intent before it calls the actuator. A duplicate delivery replays the recorded result and makes no second call. Crash recovery never actuates a recorded result twice. A retry keeps the execution key and takes a newer fenced lease. A changed target or revision under the same key fails closed. A dry run never calls the actuator. A denied intent needs an audited break-glass approval before actuation. | `tests/fleet/scaling/test_scaling_intent_reconciler.py` uses an in-memory ledger and an injected clock.

**Service-surface scale evaluator.** `service_scale_units.py` returns one deterministic decision per scale unit. The inputs are signal, capacity, quota, continuity and load-safety observations. Stale or missing evidence blocks scaling. An exhausted provider quota, saturated engine axes, active sessions and overload also block scaling. | `tests/fleet/scaling/test_service_scale_units.py` asserts each blocking reason.

**Attested resource-pool placement.** `resource_pool_authority.py` places a requirement only on a fresh, attested pool. The known capabilities of that pool must satisfy the requirement. Unknown, unverified or stale capability gives a denial with a named reason. The result does not depend on pool order. | `tests/fleet/scaling/test_resource_pool_authority.py` asserts each denial reason.

**Engine-native reservation and development-lane transport.** `resource_reservation.py` and `development_lane.py` expose only the typed synchronous engine operations. They refuse an async client. They refuse an engine that does not advertise the operation. They refuse a status result larger than the requested limit. | `tests/fleet/scaling/test_resource_reservation.py` asserts each refusal.

**Conversational ACP gateway session admission and policy.** Arbora admits an ACP session only for a verified principal from the existing identity path, binds the session immutably to that principal/tenant/scope snapshot, enforces configured idle and absolute expiry limits, and returns one typed `chat_adapter_unavailable` refusal for admission and messages whenever the agent-utilities chat adapter is absent or unreachable, without a local reply or REST fallback. Split into `ARBORA-ACP-R001.1` (the arbora-owned typed session-policy model and admission/refusal check) with the transport wiring to the real ACP endpoint and the identical REST-path projection check remaining open under the parent until `ARBORA-ACP-R001.2`'s dependency is satisfied. | Unit and integration tests cover admission refusal for missing/invalid credentials, immutable binding, idle-expired refusal, absolute-expired refusal, the typed adapter-unavailable refusal on both admission and message, identical principal/tenant/scope projection against the REST path, and a status/doctor read that reports adapter and limit state without secrets.

**Typed ACP session-policy model and fail-closed admission check.** arbora defines the typed `PrincipalContext`/`AcpSessionPolicy`/`AcpSessionSnapshot` model and an `AcpSessionAdmission` that admits only a verified principal, binds the session immutably, enforces idle/absolute expiry, and refuses with a distinct `chat_adapter_unavailable` reason — on both admission and message — whenever the caller-supplied chat-adapter probe reports unavailable, with no transport wired yet. | Proven by unit tests asserting unauthenticated refusal, immutable principal binding, idle- and absolute-expiry refusal, and the dedicated `chat_adapter_unavailable` refusal on both admission and message.

**Model.** Arbora defines `CodingSessionRequest` (workspace root, declared client capabilities), `WorkspaceGrant` (root, capability, standing flag) and `CodingSessionAdmitted` as frozen types. They live in new `arbora/acp/coding_session.py`, beside `AcpSessionSnapshot` at `arbora/acp/session_policy.py:68`. The snapshot gains no mutable field. Client capabilities use the ACP names: `fs/read_text_file`, `fs/write_text_file`, `terminal/create`, `terminal/output`, `terminal/wait_for_exit`, `terminal/kill`, `session/request_permission`. | `tests/acp/test_coding_session.py` asserts the types are frozen, reject an empty root, and reject an undeclared capability name.

**Behavior.** `CodingSessionAdmission.admit` extends `AcpSessionAdmission.admit` (`arbora/acp/session_policy.py:101`). That function lacks any workspace-root or capability input. Named defaults: `trusted_root_rule` admits a root only when it matches a configured trusted-root entry. `permission_rule` requires `session/request_permission` for `fs/write_text_file` and every `terminal/*` request. A matching standing grant skips that request. Reads pass. Arbora records each grant on the session. | `tests/acp/test_coding_session_behavior.py` asserts a trusted root is admitted, a read passes, a write needs permission, and a standing grant skips the prompt.

**Wiring.** The existing implementation is `AcpSessionAdmission` at `arbora/acp/session_policy.py:89`. No production caller reaches it today, since only `tests/acp/test_session_policy.py` constructs it. This child creates the call site: a new `register_acp_routes(app, prefix)` in `arbora/acp/routes.py` handles the `session/new` wire method. `arbora/gateway/graph_api.py:368` registers it beside `register_dashboard_routes`, and `arbora/webui_host/webui_co_service.py:77` calls that function. The route resolves the principal through the existing identity path. It forwards each client-capability request over the same connection to the client. | `tests/acp/test_acp_routes_wiring.py` asserts the app exposes the ACP route after `register_graph_routes` and that `session/new` calls `CodingSessionAdmission.admit`.

**Refusal.** `CodingSessionAdmission` refuses with typed reasons added to `AcpRefusalReason` (`arbora/acp/session_policy.py:21`). `untrusted_root` applies at `session/new`. `capability_not_declared` applies to a request outside the declared set. `permission_denied` applies when the client rejects `session/request_permission`. `client_disconnected` applies when no client is connected. Each refusal returns before any forwarded request. | `tests/acp/test_coding_session_refusal.py` asserts each reason arrives as the typed refusal, with no forwarded request.

**Evidence.** Each admission and each forwarded capability request emits one trace record. Fields: session ID, principal ID, tenant, workspace root, capability name, permission outcome (`standing`, `granted`, `denied`) and refusal reason. The record carries no file content and no command output. It uses the existing emitter in `arbora/observability`. | `tests/acp/test_coding_session_evidence.py` asserts the record fields for an admit, a granted write and a denied command, and the absence of file content.

**Hot-path proof.** The entry point is the ACP wire method `session/new` served by `arbora/acp/routes.py`. The test `tests/acp/test_coding_session_hot_path.py` opens a session with a temporary trusted root. The agent then requests `fs/read_text_file` and `fs/write_text_file`. The read passes and the write waits for `session/request_permission`. An untrusted root is refused at `session/new` with `untrusted_root`. | `tests/acp/test_coding_session_hot_path.py` runs against a fake connected client and the registered route, and asserts the three observations.

**Durable, deduplicated flip alert delivery.** arbora subscribes durably to the finance flip event topic and delivers alerts to configured notification channels, deduplicating by tenant, event ID, and subscriber so a restart cannot cause a duplicate user-visible alert. An alert never authorizes an order or changes a portfolio. | Proven by a restart/redelivery test confirming at-least-once transport with idempotent, deduplicated delivery.

**Scheduled finance backfill, scan, and explanation jobs.** arbora schedules finance backfill, scan, and flip-explanation jobs through its existing scheduler, recording each schedule's tenant, owner, authorized action, timezone, trigger, idempotency key, and last run, so a daylight-saving transition or replay cannot duplicate an effect. The explanation itself is produced by the agent workflow and must cite its exact calculation inputs. | Proven by a scheduler test crossing a daylight-saving transition and a replay test confirming no duplicate job execution.

**Server-side finance and markets reads and paper order submission.** arbora serves tenant-scoped market and finance reads, and paper order submission, through arbora/api/ops/finance.py and markets.py, with the market read logic ported server-side into arbora/finance/markets.py. Each read requires the finance:read grant. If tenant or account binding is unverified, return a typed unavailable result before any provider call. Paper order submission requires a tenant-bound account and the finance:paper-trade grant. | Acceptance: two-tenant tests must confirm zero cross-tenant reads. A negative test must confirm unverified account binding returns unavailable before any provider call.

**One-at-a-time application admission with rollback.** arbora admits one named application and its data source into the shared data plane at a time, using a dry-run plan, an idempotency key, explicit approval, health and parity probes, and a rollback fence. An application's existing ingest connector is retired only after the admitted source is healthy, parity checks pass, and the retirement is approved. | Proven by a restart/fault test demonstrating a failed admission rolls back without retiring the prior connector.

**schema_context query surface for tables and ontology mappings.** arbora serves authenticated `schema_context` over REST and MCP. Callers can request definitions, joins, ontology class mapping, owning application, or change impact. The response labels unverified and inferred relationships as proposals, not approved facts. When the engine lacks `schema_context` or an approved source catalog snapshot, Arbora returns typed unavailable. It does not fabricate an answer. | Proven by contract tests covering each intent (definition, joins, ontology, owner, impact) and a negative test for an unsupported source returning a typed unavailable result.

**Recurring DCA plans with deterministic, non-duplicating proposals.** arbora stores a recurring dollar-cost-averaging plan's owner, tenant, symbol, account binding, decimal amount and currency, timezone, recurrence rule, bounds, pause state, and paper or live mode, and produces one durable proposal per due occurrence with a key derived from the plan revision so replay or clock drift cannot create a duplicate. Paper mode executes only under the paper grant and lease; live mode stays proposal-only until a human approves the exact preview and a connector consumes a write-back lease through the governed path in AU-CONTEXT-R006. A missed or failed contribution is reported, never silently skipped or doubled. | Proven by a replay and clock-drift test asserting exactly one proposal per occurrence, and a fault test confirming a missed contribution is reported rather than silently dropped.

**Confirmed order and position changes.** Require explicit confirmation before an order or position effect. Consume the SDK-GOVERNED-WRITEBACK-R001.1 through R001.6 signature-verification contract for wallet operations. EG owns authorization; Arbora serves authenticated confirmation and preserves its decision. Keep wallet operations unavailable until the producer and all durable bindings are implemented. ARBORA-DATA-MARKET-R003 owns paper submission; ARBORA-OPS-R017.2 owns subject ownership. | Served acceptance in tests/integration/test_order_confirmation.py; runtime proof remains required.

**Model.** OrderChange and PositionChange bind exact intent. WalletOperation imports SDK WalletBusinessIntent and WalletExecutionEnvelope. Proof and confirmation metadata remain outside business parameters. The plan defines the exact immutable projection; never embed WalletProofRequest inside hashed intent. Bind authenticated caller tenant and actor, account, network, wallet, operation and exact change-set identity. Read-only models at arbora/finance/markets.py:34 do not implement this contract. | Served acceptance in tests/integration/test_order_confirmation.py; runtime proof remains required.

**Behavior.** Prepare immutable intent and require explicit confirmation under `confirm_before_commit`. `plan_digest` means `params_digest({"intent": WalletBusinessIntent})`. Sign after confirmation; adding proof cannot change that digest. Consume the authenticated SDK proof result unchanged and match every binding before dispatch. A valid signature is insufficient without EG authorization, account entitlement and durable effect reservation. Use the existing effect key for retries; never create another nonce or approval store. | Served acceptance in tests/integration/test_order_confirmation.py; runtime proof remains required.

**Wiring.** Register the new operations through arbora/api/ops/registry_factory.py with Confirm.PLAN. Reuse `_effect` at arbora/api/invoke/pipeline.py:218 and `bind_plan` at line 230. The operation handler must invoke the admitted connector SDK proof and governed apply composition before any provider effect. The shared WalletExecutionEnvelope extension must separate proof before plan hashing, validation, audit and reservation. HTTP and MCP lack this extension. No order or wallet operation is reachable today. | Served acceptance in tests/integration/test_order_confirmation.py; runtime proof remains required.

**Refusal.** Return CONFIRMATION_REQUIRED for absent confirmation and PLAN_MISMATCH for intent tampering. Return POLICY_DENIED for invalid proof and UNAVAILABLE for absent verifier, envelope, trust or durable binding authority. Preserve the SDK typed reason in redacted error details. No refused request reaches provider mutation; an uncertain prior effect enters reconciliation instead of blind retry. | Served acceptance in tests/integration/test_order_confirmation.py; runtime proof remains required.

**Evidence.** Record request, tenant, actor, plan and confirmation in the existing audit record. Join EG authorization, proof digest, signer, trust revision and effect receipt. Preserve the SDK verification outcome unchanged. Never log raw signatures, private keys or reusable proof bodies. | Served acceptance in tests/integration/test_order_confirmation.py; runtime proof remains required.

**Hot-path proof.** `tests/integration/test_order_confirmation.py::test_wallet_proof_confirmation_and_replay` enters the served operation at POST /api/v1/ops/{op_id} and its MCP twin. Use the real SDK verifier, synthetic keys, durable graph authority and a controlled provider. Serve prepare, confirm, sign and execute; proof insertion preserves the intent digest and yields one effect. Missing confirmation, altered account/network/payload, revoked key, expiry and unavailable producer yield none. Concurrent retries and restart read the same effect receipt without another mutation. | Served acceptance in tests/integration/test_order_confirmation.py; runtime proof remains required.

**Market list/search/get.** Define read-only `markets.list`, `markets.search`, and `markets.get` on `finance:read`. List/search accept `limit` (default 50, 1–100), optional opaque cursor, and only `event_id`, `status`, `starts_at_from`, `starts_at_to`, `ends_at_from`, and `ends_at_to`; search also requires the bounded `query` defined in plan.md. Get accepts only `market_id`. Search matches case-sensitive NFC substrings in `question` or outcome `name`. Sort by `starts_at` ascending with nulls last, then `market_id` ascending. | Served tests cover exact filters, query bounds, stable ordering, get-by-ID, and zero effect calls.

**Event list/search/get.** Define read-only `events.list`, `events.search`, and `events.get` on `finance:read`. List/search accept `limit` (default 50, 1–100), optional opaque cursor, and only `status`, `starts_at_from`, `starts_at_to`, `ends_at_from`, and `ends_at_to`; search also requires the bounded `query` defined in plan.md. Get accepts only `event_id`. Search matches case-sensitive NFC substrings in `title` or `description`. Sort by `starts_at` ascending with nulls last, then `event_id` ascending. | Served tests cover exact filters, query bounds, stable ordering, get-by-ID, and zero effect calls.

**Order list/search/get.** Define read-only `orders.list`, `orders.search`, and `orders.get` on `finance:read`, bound to the caller's resolved tenant/account. List/search accept `limit` (default 50, 1–100), optional opaque cursor, and only `market_id`, `status`, `side` (`buy` or `sell`), `created_at_from`, and `created_at_to`; search also requires the bounded `query` defined in plan.md. Get accepts only `order_id`. Search matches case-sensitive NFC substrings in `order_id`, `market_id`, or `outcome`. Sort by `created_at` descending with nulls last, then `order_id` ascending. | Served tests cover all three bindings, account scoping, deterministic ordering, and zero mutation calls.

**Stable JSON projections.** Define closed version-1 `MarketPageV1`/`MarketGetV1`, `EventPageV1`/`EventGetV1`, and `OrderPageV1`/`OrderGetV1` envelopes with typed `MarketItemV1`, `EventItemV1`, and `OrderItemV1` records. `plan.md` defines exact keys, nullability, metadata, decimal, identifier, and cursor rules. Preserve provider `source`, `as_of`, `session`, currency/unit, freshness, and provenance; never calculate or fabricate missing source metadata. Decimal values are strings. Serialize nullable fields as explicit null. Use deterministic keys. Bind cursors to tenant, account, filters, sort, and snapshot. Omit provider-only extras. | Contract tests pin exact keys/types, nullable fields, metadata, decimal/time encodings, filters, pagination, and normalized REST/MCP JSON.

**Authority before provider calls.** All nine bindings require `finance:read`. Handlers resolve authenticated tenant membership and proof of the account binding before constructing provider requests. They derive tenant and account from authority and reject caller-selected identity. If binding is missing or mismatched, Arbora returns typed unavailable before dispatch. R010 maps scope denials; inaccessible IDs are nonrevealing. Preserve parent R003 and ARBORA-OPS-R017.1. EG must add `finance:read` to its scope catalog before Arbora registers these operations. | Served two-tenant cases prove denials and malformed authority make zero provider calls and reveal no cross-tenant record.

**Producer port, registration, and read/effect separation.** Define `FinanceReadPortV1` in `arbora/finance/markets.py` with typed `list_markets`, `search_markets`, `get_market`, `list_events`, `search_events`, `get_event`, `list_orders`, `search_orders`, and `get_order` methods. Existing `MarketProvider.market_read` is only a single-symbol read and does not implement this port. Bind it as `finance_read_port`; register handlers from `arbora/api/ops/finance.py::operations` through `arbora/api/ops/registry_factory.py::get_registry`. REST uses `NativeGatewayApplication.mount_rest_routes` → `create_api_application` → `POST /api/v1/ops/{op_id}` after contract admission. MCP uses `register_intent_surface` on the streamable HTTP `/mcp` route; JSON-RPC `tools/call` invokes tool `ask` with `op` and `params`. The current process has not activated these API/MCP compositions, and the legacy MCP registrar remains in use, so no serving is claimed. Read handlers require only `finance:read` and cannot reserve leases or invoke submission. Paper submission keeps its separate `finance:paper-trade`, tenant/account, lease, receipt, and ARBORA-OPS-R017.2 ownership requirements. | `tests/mcp_server/test_data_market_reads_served.py` must exercise both real routes, shared provider dispatch, denial before calls, and read/effect isolation; existing paper-submit acceptance remains required.

**Dependency-ordered, digest-verified release promotion.** Arbora validates digest-pinned candidate images in a dedicated Kubernetes test namespace before promoting them, and performs its dependency-ordered pushes to each repository in sequence, checking that repository's continuous-integration result before advancing to the next. | An integration test against a fixture dependency graph confirms the rollout stops before the next stage when a predecessor's digest or CI result is missing.

**Local Kubernetes validation gates every push.** Arbora runs local Kubernetes validation in a dedicated test namespace as part of release qualification, and the release process refuses to push or deploy until the repository's local gates report green. | A negative integration test confirms a push is blocked while a local gate is failing and proceeds once all local gates report green.

**Exit-criteria matrix maps readiness to tests.** Arbora maintains an exit-criteria matrix mapping each release-readiness obligation to an executable test, including ingestion receipts, proofs over SPARQL and natural-language queries, one complete multi-agent orchestration graph, connector certification, one write-back receipt, a browser-and-identity-provider login probe, and a typed-abstention response to an agent-capability question. | A test-suite audit confirms every row of the exit-criteria matrix resolves to a passing automated test. Rollup; see `ARBORA-RELEASE-R003.1` onward (split 2026-10-09, net-new: no exit-criteria model existed).

**Exit-criteria matrix registry and audit mechanism (arbora side, against the currently pinned epistemic-graph).** Arbora defines the exit-criteria matrix as a typed registry of obligation -> test-node-id rows and an audit function a test-suite audit runs against pytest's collected node IDs; an unregistered or uncollected obligation audits as missing, never a silent pass. | A unit test confirms the audit function marks a row satisfied when its test node ID is present among collected test IDs and missing when it is absent.

**Full exit-criteria matrix closes green across all seven obligations.** Each of the seven obligation rows (ingestion receipts, SPARQL/natural-language query proofs, the multi-agent orchestration graph, connector certification, the write-back receipt, the browser-and-identity-provider login probe, and the typed-abstention response) is registered against a real, currently-passing cross-repo test once the epistemic-graph v2.28 release (the 44-PR integration audit it is gated on) lands, since several obligations exercise epistemic-graph capabilities this repository cannot certify against a release that has not been cut. | A test-suite audit confirms every row of the exit-criteria matrix resolves to a passing automated test.

**SPARQL and natural-language query-proof rows.** Child slice of `ARBORA-RELEASE-R003` (see tasks.md). | A test-suite audit confirms every row of the exit-criteria matrix resolves to a passing automated test. Rollup; see ARBORA-RELEASE-R003.1 onward (split 2026-10-09, net-new: no exit-criteria model existed)

**multi-agent orchestration-graph row.** Child slice of `ARBORA-RELEASE-R003` (see tasks.md). | A test-suite audit confirms every row of the exit-criteria matrix resolves to a passing automated test. Rollup; see ARBORA-RELEASE-R003.1 onward (split 2026-10-09, net-new: no exit-criteria model existed)

**connector-certification row.** Child slice of `ARBORA-RELEASE-R003` (see tasks.md). | A test-suite audit confirms every row of the exit-criteria matrix resolves to a passing automated test. Rollup; see ARBORA-RELEASE-R003.1 onward (split 2026-10-09, net-new: no exit-criteria model existed)

**write-back receipt row.** Child slice of `ARBORA-RELEASE-R003` (see tasks.md). | A test-suite audit confirms every row of the exit-criteria matrix resolves to a passing automated test. Rollup; see ARBORA-RELEASE-R003.1 onward (split 2026-10-09, net-new: no exit-criteria model existed)

**browser-and-identity-provider login probe row.** Child slice of `ARBORA-RELEASE-R003` (see tasks.md). | A test-suite audit confirms every row of the exit-criteria matrix resolves to a passing automated test. Rollup; see ARBORA-RELEASE-R003.1 onward (split 2026-10-09, net-new: no exit-criteria model existed)

**typed-abstention response row.** Child slice of `ARBORA-RELEASE-R003` (see tasks.md). | A test-suite audit confirms every row of the exit-criteria matrix resolves to a passing automated test. Rollup; see ARBORA-RELEASE-R003.1 onward (split 2026-10-09, net-new: no exit-criteria model existed)

**Typed pack publisher replaces placeholder ContentPack.** arbora publishes fleet content packs using the engine-generated SQL record types instead of the placeholder `ContentPack` structure, so SQL and market-data connector items carry real typed schemas when they are added to the catalog. | Integration test asserts published packs use the generated types and that no code path constructs the placeholder `ContentPack`.

**Tool schema fingerprints recomputed from served schemas (rollup).** Every fleet tool pin's schema fingerprint is computed from the tool's actual served schema rather than an empty placeholder. Catalog entries reflect real input and output shapes fleet-wide. Delivered through its child requirements, producer first. | An automated check re-certifies each pin against its live served schema and fails on any empty-schema fingerprint.

**Per-tool schema fingerprint computed from the served schema.** `arbora/fleet/catalog_items.py` defines `compute_schema_fingerprint()`, a pure SHA-256 digest of a canonicalized schema that refuses an empty mapping, and `CatalogItem.schema_fingerprint`; `items_from_child_probe`'s tool rows populate it from the probed tool's real `inputSchema` through `_probed_item`, leaving it unset rather than empty for an unprobed schema or a non-tool item. No fleet-wide re-certification check yet (`ARBORA-FLEET-R002.2`, not yet specified). | `tests/fleet/test_schema_fingerprint.py` covers a stable digest, sensitivity to the served schema's content, refusal of an empty schema, population for a probed tool, and no fingerprint for an unprobed schema or a non-tool kind.

**Remaining scope of ARBORA-FLEET-R002 (slice .2): Tool schema fingerprints recomputed from served schemas (rollup).** Child slice of `ARBORA-FLEET-R002` (see tasks.md). | An automated check re-certifies each pin against its live served schema and fails on any empty-schema fingerprint

**D18 write-back exposed only as a typed, previewed operation (rollup).** arbora exposes the D18 write-back capability solely as a typed, idempotent, previewed registry operation rather than an unguarded native child tool, and the writable connector fleet continues to function correctly across a service restart. Delivered through its child requirements, producer first. | A restart/fault test confirms write-back idempotency and typed preview gating survive a service restart.

**Typed write-back preview model and its refusal rule.** `arbora/api/ops/write_back.py` defines `WriteBackPreviewRequest`/`WriteBackPreviewResult` and `preview_write_back()`, which never applies a write and refuses a blank idempotency key, so D18 write-back cannot be reached as an unguarded native child tool. No registry binding yet (`ARBORA-FLEET-R003.2`, not yet specified). | `tests/api/test_write_back_preview.py` covers a successful preview, the blank-idempotency-key refusal, and that the result never marks the write as applied.

**Write-back registered as a typed, gated registry operation, not a native child tool.** `arbora/api/ops/write_back.py` registers `fleet.write_back.preview` and `fleet.write_back.commit` as typed `OpSpec` entries. They consume the models of `ARBORA-FLEET-R003.1`. They are wired into `arbora/api/ops/registry_factory.py`'s registry. The pipeline rejects `commit` unless it matches a prior `preview`'s idempotency key. No native child tool exposes write-back directly. | `tests/api/test_write_back_ops.py` covers preview-then-commit and an idempotent replayed commit returning the original receipt. It also covers rejection of a commit with no matching preview or a mismatched key.

**Pack annotations carry capability, digest, modality, cost, latency.** Every fleet pack item's catalog entry carries its capability, schema digest, modality, cost and latency annotations, populated across the whole fleet rather than a subset. | A catalog audit test confirms all required annotation fields are present and non-empty for every pack item fleet-wide.

**A2A task routing with typed work-item and lease operations (rollup).** arbora routes inbound A2A tasks through typed `GetWorkItem` and `ListWorkItems` operations. It exposes capability-based agent search. It issues single-use, provenance-tracked control leases for assigned work. The multiplexer exposes only the subset of tools reachable through this task-routing assembly. Delivered through its child requirements, producer first. | Native library tests cover work-item retrieval, listing, capability search, and control-lease issuance and consumption.

**Typed WorkItem view, the GetWorkItem/ListWorkItems producer.** `arbora/a2a/work_items.py` defines a frozen `WorkItemView` and projects it. The projection reads the same durable work-item record fields `WorkItemA2AAuthority` already writes (`kind`, `tenant`, `created_by`, `metadata`, the `workitem:orchestrator:` id), The view refuses a record missing or blanking a required identity field for a single get. It drops (not fails) a malformed record for a listing. No `GetWorkItem`/`ListWorkItems` operation, capability search, or control lease yet (`ARBORA-FLEET-R005.2`+, not yet specified). | `tests/a2a/test_work_items.py` covers correct projection, optional-field defaults, missing or blank fields, and non-mapping metadata refusals. It also proves listing drops malformed records while preserving order.

**Remaining scope of ARBORA-FLEET-R005 (slice .2): A2A task routing with typed work-item and lease operations (rollup).** Child slice of `ARBORA-FLEET-R005` (see tasks.md). | Native library tests cover work-item retrieval, listing, capability search, and control-lease issuance and consumption

**Multiplexer skill and prompt harvest path removed.** The multiplexer no longer harvests or statically hydrates skills and prompts at startup. That code path and its boot-time ingestion are removed once the resident-tool catalog serves the same capability. | A package/runtime audit confirms no skill or prompt harvest or hydration code remains in the shipped package.

**Bridge upgraded to FastMCP 4 (rollup).** arbora's MCP bridge declares and runs on FastMCP 4, using its native tool, prompt, resource, template and Skills-over-MCP capabilities within a single composed server loop. Delivered through its child requirements, producer first, one child per owning repo/root since the bridge instance is constructed outside arbora. | See the child requirements' verification.

**RUM, security-audit and CI/CD feeds join the catalog (rollup).** arbora adds real-user-monitoring, security-audit and CI/CD event connectors as catalog items, exposing only approved, sanitized data through the same operation registry and tenant boundary as its other feeds. Delivered through its child requirements, producer first. | Integration test confirms each new feed's data passes sanitization and tenant-boundary checks before it appears in the registry.

**Typed feed-event model per feed kind.** `arbora/fleet/feeds.py` defines `FeedEvent`/`FeedEventRejected` and `rum_event()`/`security_audit_event()`/`cicd_event()`, each refusing an unsanitized payload or a missing tenant before a feed event can exist. No live connector ingestion yet (`ARBORA-FLEET-R008.2`, not yet specified). | `tests/fleet/test_feeds.py` covers construction of each feed kind, the unsanitized-payload refusal, and the missing-tenant refusal.

**Live feed ingestion wired into the catalog.** Real RUM, security-audit and CI/CD connector ingestion produces `ARBORA-FLEET-R008.1` feed events and passes them through `connector_items()`/`_pack_annotations()` into the operation registry and tenant-boundary check, so each feed's data appears in the catalog only once sanitized and tenant-scoped. | Integration test confirms each new feed's data passes sanitization and tenant-boundary checks before it appears in the registry.

**Run admission evaluates, commits and publishes with capacity control.** arbora's run admission in `arbora/a2a/routing.py`, `arbora/a2a/composition.py` and `control_plane/runs/admission.py` evaluates a candidate run, commits it with synthesis evidence, and publishes it only after an all-or-nothing capacity acquisition. A denied acquisition allows exactly one re-decision, and a stopped run releases its held capacity. Split across its 3 code roots (exceeds the 2-code-root threshold): `ARBORA-FLEET-R009.1` delivers the capacity primitive; `ARBORA-FLEET-R009.2` wires evaluate/commit/publish in `arbora/a2a/routing.py` and `arbora/a2a/composition.py` through it. | Rollup: both children deliver.

**Capacity acquisition is all-or-nothing with one re-decision.** `arbora/control_plane/runs/admission.py` gains a capacity primitive: a candidate run acquires every requested resource unit or none at all; the first denial consumes that run's single re-decision and returns a retry signal instead of failing, a second denial for the same run fails closed, and releasing a run (stop, or a reset after denial) returns every unit it held and restores its re-decision budget. | Unit test drives the primitive through grant, partial-unavailability no-op, denial-then-one-redecision, a second denial failing closed, and release restoring both capacity and the redecision budget.

**Routing and composition publish only through acquired capacity.** `arbora/a2a/routing.py` and `arbora/a2a/composition.py` evaluate a candidate run, commit it with synthesis evidence, and call the `ARBORA-FLEET-R009.1` primitive before publishing; a denial surfaces the single re-decision to the caller and a stopped run releases its hold. | Integration test drives a candidate run end to end through evaluate, commit, capacity grant/re-decision, and publish, plus stop releasing capacity.

**Run admission publishes with all-or-nothing capacity control.** `control_plane/runs/admission.py` publishes a `ARBORA-FLEET-R009.2`-committed run only after an all-or-nothing capacity acquisition, allows a denied acquisition exactly one re-decision, and releases held capacity when the run stops. | Integration test drives admission through grant, a single re-decision on denial, and capacity release on stop.

**Write-back idempotency and preview gating survive a service restart.** A restart/fault test exercises `fleet.write_back.preview`/`fleet.write_back.commit` (`ARBORA-FLEET-R003.2`) across a simulated service restart and a faulted child call, closing `ARBORA-FLEET-R003`'s original acceptance criterion. | `tests/fleet/test_write_back_restart.py` restarts the registry/service state mid-sequence and confirms a replayed commit returns the original receipt rather than double-applying, and a faulted child call leaves no partial write-back state.

**Harvest call-site inventory, the removal baseline.** `tests/fleet/test_harvest_inventory.py` enumerates every harvest-named entry point in `arbora/fleet/multiplexer.py` (`_harvest_deadline`, `_harvest_error_reason`, `_harvest_resource_bodies` and its call sites in `_probe_protocol_families`/`_probe_skills`/`_probe_prompts`, and `_harvest_probe_results`) and pins today's call-site count as the baseline `ARBORA-FLEET-R006.2`-`.5` must reduce. No removal in this child. | `tests/fleet/test_harvest_inventory.py` passes against current `main` and fails if a harvest-named symbol or call site is added or removed without updating the pinned baseline.

**Skill/prompt body-harvest cutover for an already-admitted child.** `_probe_skills` and `_probe_prompts` (`arbora/fleet/multiplexer.py`) stop calling `_harvest_resource_bodies` for a mounted child server already covered by the resident local-skill catalog (`arbora/fleet/local_skill_catalog.py`'s `build_local_skill_catalog`), keeping the fleet-harvest fallback only for a child server that catalog does not yet admit, consuming `ARBORA-FLEET-R006.1`'s baseline. | A multiplexer test confirms an admitted child's skills/prompts resolve through the resident catalog with no `_harvest_resource_bodies` call, while a non-admitted child still falls back to the existing harvest path.

**Dead harvest helpers removed (rollup over `ARBORA-FLEET-R006.3.1`-`.4`).** `ARBORA-FLEET-R006.2` deliberately kept the live-harvest fallback for a child the resident catalog does not admit, so `_harvest_resource_bodies` and its helpers are not yet dead; they are removed in four ordered steps once no caller is left. | `ARBORA-FLEET-R006.3.1`-`.4` are all delivered and `_harvest_resource_bodies`, `_harvest_deadline`, `_harvest_error_reason`, `_SKILL_HARVEST_SPEC` and `_PROMPT_HARVEST_SPEC` no longer exist in `arbora/fleet/multiplexer.py`.

**`_probe_protocol_families` harvest calls routed through the cutover helper.** The two direct `_harvest_resource_bodies` calls in `_probe_protocol_families` (`arbora/fleet/multiplexer.py`) are replaced by `_resolve_via_local_catalog_or_harvest`, leaving that helper the single `_harvest_resource_bodies` call site. | `tests/fleet/test_harvest_inventory.py` pins `_probe_protocol_families` at zero direct `_harvest_resource_bodies` call sites and `_resolve_via_local_catalog_or_harvest` at one; an admitted child's skills resolve with no wire read.

**Non-admitted fallback and `_harvest_resource_bodies` deleted.** Once every mounted fleet child is admitted by the resident catalog (`arbora/fleet/local_skill_catalog.py`; admitting the remaining children is a prerequisite and may need an `agent-utilities` or per-agent package change), the fallback branch of `_resolve_via_local_catalog_or_harvest` and `_harvest_resource_bodies` are deleted. | The inventory test confirms `_harvest_resource_bodies` no longer exists and the skill/prompt discovery tests still pass.

**Deadline and error-reason helpers deleted.** `_harvest_deadline`, `_HARVEST_DEADLINE_SHARE` and `_harvest_error_reason` are deleted from `arbora/fleet/multiplexer.py` after `ARBORA-FLEET-R006.3.2` leaves them without a caller. | The inventory test confirms these symbols no longer exist.

**Harvest specs deleted.** `_SKILL_HARVEST_SPEC`, `_PROMPT_HARVEST_SPEC` and the harvest-only budget constants are deleted, and `_probe_resource_family` keeps only the kind and body-field data it still needs, after `ARBORA-FLEET-R006.3.3`. | The inventory test confirms the two spec symbols no longer exist and `_probe_skills`/`_probe_prompts` tests still pass.

**Residual `_harvest`-named symbol renamed off the removed path.** `_harvest_probe_results` (`arbora/fleet/multiplexer.py`) is renamed to `_settled_probe_results` and its docstring/call sites updated, since it folds generic per-server probe-task results rather than skill/prompt body harvest and must not be mistaken for the path removed in `ARBORA-FLEET-R006.3`. | A grep-based test confirms no `_harvest`-named symbol remains in `arbora/fleet/multiplexer.py` except in historical comments/log strings, and `probe_catalog`'s existing tests still pass under the new name.

**Closing audit: no harvest or hydration code remains.** A package/runtime audit confirms no skill or prompt harvest or boot-time hydration code remains in the shipped `arbora` package, closing `ARBORA-FLEET-R006`'s original acceptance criterion. | `tests/fleet/test_no_harvest_remains.py`, built on `ARBORA-FLEET-R006.1`'s inventory, asserts the pinned baseline count is now zero for skill/prompt harvest and hydration call sites.

**agent-connector-sdk's FastMCP instance gains native prompt/resource/template registration (cross-repo, owner: agent-connector-sdk).** `agent_connector_sdk/mcp/server.py`'s `create_mcp_server()` registers at least one native `.prompt()` and one native `.resource()`/`.resource_template()` on its constructed `FastMCP[Any]` instance alongside its existing `.tool()`/Skills-over-MCP registrations. | A protocol test in agent-connector-sdk confirms `create_mcp_server()`'s served instance answers a native prompt list, a resource read and a resource-template list.

**agent-utilities' arbora bridge surface gains native prompt/resource/template registration (cross-repo, owner: agent-utilities).** `agent_utilities/mcp/arbora_surface.py`'s `register_arbora_surface()` and its backing `FastMCP("arbora-backing")` instance register native prompts, resources and resource templates (not only tools, consuming `ARBORA-FLEET-R007.1`'s pattern) onto the single composed server loop handed to arbora. | A protocol test in agent-utilities confirms `register_arbora_surface()`'s backing instance exposes native prompts/resources/templates alongside `arbora_registrars()`'s tools.

**arbora's served bridge exercises native prompts, resources and templates end to end.** arbora's bootstrap (`arbora/mcp_server/server.py`) mounts the single composed server loop built from `ARBORA-FLEET-R007.1`/`ARBORA-FLEET-R007.2` and serves its native tools, prompts, resources, resource templates and Skills-over-MCP together, closing `ARBORA-FLEET-R007`'s original acceptance criterion. | `tests/mcp/test_fastmcp4_native.py` exercises FastMCP 4 native tools, prompts, resources, templates and Skills-over-MCP against the served bridge.

**Registry core computes a canonical digest and authorized find.** `arbora/api/registry/` defines `OpSpec`, its enums, and the `Registry` type with a canonical serialization and a `registry_digest` that identifies the active generation, and `find` evaluates caller authorization at lookup time rather than deferring it. | `tests/api/test_registry.py` covers canonical-form stability, digest computation, and authorized-versus-denied `find` results.

**EG-direct binding generator with reviewed exclusions.** `arbora/api/registry/eg_binding.py` generates one registry operation for each wire-callable engine method. `eg_exclusions.yaml` lists each method that is left out. Each exclusion records a replacement or an internal-only reason. Every method has a generated operation or a reviewed exclusion. | `tests/api/test_eg_binding.py` asserts full method coverage by generated bindings plus documented exclusions.

**MCP projection exposes the six verbs with typed schemas.** `arbora/api/mcp/verbs.py`, `discovery.py` and `resources.py` project the registry as the six intent verbs produced by `make_verb`, each with a typed input schema, a `find` operation returning typed schemas, `arbora://` resources, and the active registry digest embedded in server instructions. | `tests/api/test_mcp_verbs.py` validates verb schemas, `find` output, resource URIs, and the embedded digest.

**Resolver ranks catalog items with partitioned feedback.** `arbora/api/mcp/resolve.py` ranks catalog items using lexical and semantic matching over generated descriptors, an exponential moving average of tenant- and policy-partitioned outcome feedback, and a bounded result cache. Natural-language queries produce a preview rather than an executed mutation, and `ask` falls back to a natural-language `query.nl` call under `query:nl` (never `query.uql` under `query:unified`) when no direct match is found. | `tests/api/test_resolve.py` covers ranking, partitioned feedback, cache bounds, and the NL-to-preview and `ask` fallback paths.

**Typed operations cover agents, browser and fleet calls.** `arbora/api/ops/agents.py`, `browser.py` and `fleet.py` implement typed operations for agent/A2A tasks, reasoning calls, browser actions and fleet calls, where `fleet.call`'s effect classification is derived from the target item's own annotations. `arbora/fleet/gateway_ops.py` wraps resolution and mounting of catalog tools for these operations to call through. | Integration tests exercise each operation family and confirm `fleet.call` effect classification matches the invoked item's annotation.

**Automated gates catch API surface and compatibility drift.** `scripts/check_api_surface.py` and `scripts/check_api_compat.py` run as pre-commit hooks that detect drift in the registry's public API surface and backward compatibility, covering the full gate set defined for this specification. | `tests/api/test_gates_*.py` exercises each gate against both a compliant and a drifted fixture registry.

**Authority-parity oracle validates principal, operation and surface.** `tests/api/authority_matrix.yaml` defines the expected authorization outcome for each principal, operation and serving-surface combination, and `tests/api/test_authority_parity.py` asserts the registry's actual authorization decisions match that matrix exactly. | `tests/api/test_authority_parity.py` runs the full principal-by-operation-by-surface matrix and fails on any mismatch.

**Multiplexer exposes four resident fleet tools over one catalog.** `api/ops/fleet.py` and `arbora/fleet/{gateway_ops,catalog_items,session_loads}.py` implement `find_tools` (with `browse=true` replacing a separate catalog listing), `load_tools`, `unload_tools` and `multiplexer_status` over a single catalog filtered per caller, covering fleet tools, prompts, resources, resource templates, agent skills and connector items. Each caller's loaded-tool set defaults to a 64-item cap (hard cap 256) with optional least-recently-used eviction and a one-hour idle expiry, and each loaded tool's body invokes `fleet.call` using the caller's own delegated credential. | Scoped integration tests confirm cap enforcement, LRU eviction, idle expiry, and that invocation always carries the caller's delegated credential.

**Eunomia narrows authority at discover, load and call.** `arbora/api/policy/` applies Eunomia as a narrowing-only policy step in the discover, load and call path, after scope and principal-rule checks and before the deputy and confirmation steps reach the engine; scope filtering always applies even when Eunomia is disabled, and an enabled-but-unreachable Eunomia fails the request closed rather than open. A deployment with no policy configured runs Eunomia off by default, a local deployment ships a default policy with it on, and an external deployment runs it on; `deployment/doctor.py` warns when it is off. | Policy integration tests cover all three default modes plus the fail-closed-on-unreachable and never-unfiltered-when-off cases.

**Fleet capability checks require exact scopes, deny unknown tools.** `_require_fleet_capability` requires the exact fleet scope for the requested action and does not accept a broader `admin` or `kg:admin` grant in its place, and it enforces the same check for local stdio connections as for any other transport. `tool_dispatchable` denies any unrecognized native host tool by default instead of allowing it, and the served MCP surface always runs an Eunomia policy filter rather than serving unfiltered. | Tests cover both the previously over-broad path (now denied) and the correctly scoped path (now allowed), plus a served-surface check that Eunomia middleware is active.

**Catalog reconciliation re-ingests via durable replay.** arbora reconciles its served MCP catalog against the engine's durable event log, re-ingesting changed tools, prompts, resources and skills by replaying ordered delta receipts keyed by tenant, generation, sequence and item ID so replays are idempotent. | Integration test replays a delta sequence twice and confirms the resulting catalog state is identical.

**Catalog reload rejects invalid candidates, proves replica convergence.** Fleet catalog reload rejects duplicate, malformed, stale, missing, deleted or digest-mismatched candidate assets without publishing a partial generation, and multi-replica convergence is observed by generation and digest so a replica unable to reach the active generation reports degraded rather than serving a mixed catalog. | Negative-case tests cover each invalid-candidate condition, and a multi-replica integration test confirms convergence reporting.

**Connector count pins stay consistent across the fleet.** Every fleet connector count reference — the compatibility matrix, the bundle-catalog schema, the check scripts, `ontology.lock`, the federated IRI, and `genesis.yaml` — reflects the same current total connector count, with no site lagging behind an actual fleet change. Delivered through its child requirements, producer first. | A check script scans all count-pin sites and fails if any of them disagrees with the live connector count.

**Pure connector count-pin comparison (producer).** `arbora/fleet/connector_count_pins.py` defines typed `CountPinSite` and `ConnectorCountMismatch`, and a pure `check_connector_count_pins()` that reports every site whose declared count disagrees with a given live count. `scripts/check_connector_count_pins.py` is the real CLI entry point: it parses `--site name=location=declared_count` arguments, runs the comparison, and exits non-zero on any mismatch. Wiring the fleet's actual count-pin sites (the compatibility matrix, the bundle-catalog schema, `ontology.lock`, the federated IRI) is cross-repo/AU-owned follow-up, not done here. | `tests/test_check_connector_count_pins.py` covers agreement, a flagged mismatch, a deliberate-mismatch fixture run through the real CLI (non-zero exit, mismatch on stderr), and a malformed `--site` argument.

**Fleet reconciliation, scaling and deploy watch are served by Arbora.** Arbora owns the fleet reconciler, autoscaler, scaling authority and deploy-watch behavior that previously sat beside the agent runner in the agent runtime's `orchestration/` package. They run as Arbora services behind typed operations with the same caller verification, policy filter and audit as other fleet operations, and the agent runtime keeps only the agent runner and planning code and reaches fleet behavior through those operations. | Parity tests reproduce the prior reconcile, scale-up, scale-down and deploy-watch decisions through the Arbora operations, negative tests refuse an unauthorized caller, and a census shows the agent runtime no longer ships these modules.

**Catalog reload rejects invalid candidates.** `FleetCatalogReader`/`FleetCatalogIntegrityError` fail closed on duplicate, malformed, stale, missing, deleted or digest-mismatched candidate assets without publishing a partial generation. | Negative-case tests cover cross-tenant, no-longer-current, unresolved provenance, content-revision mismatch and cyclic-cursor conditions.

**Multi-replica convergence is observed by generation and digest.** A replica unable to reach the active generation+digest reports degraded rather than serving a mixed catalog. No generation/replica concept exists yet in `arbora/fleet/catalog_reader.py`. | A multi-replica integration test confirms convergence reporting.

**Deploy-watch verdict is a typed Arbora operation.** Arbora owns the deploy-watch verdict decision (the success/failed/unobserved reduction over a probe sequence) that previously sat in the agent runtime's `orchestration/deploy_watch.py`, served as a typed operation (`fleet.deploy_watch.evaluate`) behind the same caller verification and policy filter as other fleet operations. | Parity tests reproduce the prior success/failed/unobserved verdict rule through the operation, and a negative test refuses a caller lacking the required scope.

**Remaining fleet reconciler, autoscaler, scaling-authority and deploy-watch scheduling behavior is served by Arbora.** Arbora owns the fleet reconciler, autoscaler, scaling authority, and the deploy-watch scheduling/rollback-dispatch behavior (beyond the R024.1 verdict rule) that previously sat beside the agent runner in the agent runtime's `orchestration/` package, each as a typed, wired-in operation with the same caller verification, policy filter and audit as other fleet operations. | Parity tests reproduce the prior reconcile, scale-up, scale-down and deploy-watch-dispatch decisions through the Arbora operations, and negative tests refuse an unauthorized caller for each.

**Agent runtime no longer ships the superseded fleet modules (cross-repo).** The agent runtime keeps only the agent runner and planning code and reaches fleet reconciliation, autoscaling, scaling authority and deploy watch through the Arbora operations from `ARBORA-FLEET-R024.1`/`ARBORA-FLEET-R024.2`, with the superseded `orchestration/` modules removed. | A census shows the agent runtime no longer ships the reconciler/autoscaler/scaling-authority/deploy-watch modules.

**Fail-closed fleet health evidence.** `arbora/fleet/health.py` collects one typed `fleet.health.v1` snapshot. The caller injects a reader for the control store, the goal authority and the worker registry. An authority this release does not serve (no reader, or a reader that raises `AuthorityNotServed`) reports `not_served`: it is not applicable and does not gate readiness. A failed read reports `unavailable` and never becomes an empty result. Readiness needs every served authority `healthy` (a rollup of `healthy` or `not_served`). Autoscaling and convergence need every authority served and `healthy`. Diagnostics hold the exception type only. The gateway fleet routes use this collector. | `tests/fleet/test_health.py` asserts the healthy rollup, a failed authority, an unserved authority that leaves readiness set, and secret-free diagnostics.

**Skills from every installed package, and an always-offered core pack, join the find/load path.** arbora serves skills from its own package. It also serves skills from each installed package that declares the `agent_connector_sdk.skill_providers` entry point. `arbora.core.providers` discovers those packages (`ARBORA-HOST-R001.10`). The fleet harvest adds its skills too. All of them use the same catalog and the `find_tools`, `discover_tools` and `list_catalog` path. A short core-pack list is served without a search query. A locally served skill takes precedence over a fleet-harvested skill of the same name. Arbora reports an unreadable skill and a core-pack name that no installed package provides. It never drops them silently. | `tests/fleet/test_local_skill_discovery.py` ranks a local skill with fleet tools and lists local skills without a query.

**The intent tools are the only MCP surface.** arbora serves the six intent tools and two MCP Apps launchers from the agent-utilities contract. `find` searches, lists and reports fleet status. `act` calls fleet tools, browser control, A2A and RLM operations. `manage` mounts and releases fleet servers. arbora registers no fleet meta-tool and no per-session visibility middleware. This requirement supersedes the four resident tools in ARBORA-FLEET-R018 and ARBORA-FLEET-R020. | Served-surface tests list exactly the intent tools. Fleet tests reach find, call, load and status through the intent tools.

**The catalog admits each server on its own.** The catalog reader skips a live registration without a current `mcp_server` component. It logs a warning and records the server name. `multiplexer_status` reports the names as `unadmitted_servers`. Boot never fails for this state. Receipt, revision, pin, content, duplicate and page-bound faults stay fatal. | `tests/test_fleet_catalog_reader.py` proves the reader skips and reports a bare registration. The existing fail-closed cases still raise. A multiplexer test reads `unadmitted_servers` from status.

**Arbora onboards every configured fleet server.** One idempotent pass reads the enabled streamable-HTTP servers from the MCP config. The pass registers each server and captures its catalog through the connector SDK. It attests the catalog with EG and imports the pack. One server's failure leaves the others unaffected. `arbora-production-ops onboard-fleet` runs a full pass and exits non-zero on any failure. Boot runs the pass on a background thread. A pass fault never blocks or stops serving. | `tests/fleet/test_fleet_onboarding.py` covers config filtering, a fresh-store pass, a failing server, an admitted server, a registry outage, a missing child credential, the CLI and a failing boot pass.

**Arbora renews every registration before its lease lapses.** Each pass re-registers each fleet and self-served lease that expires within six hours. Each renewal window uses its own idempotency key. A self-served registration renews at the configured served URL, else at its live URL. The boot thread repeats the pass every 30 minutes. A pass that admits a new server refreshes the multiplexer catalog when no child session runs. | `tests/fleet/test_fleet_onboarding.py` covers lapsing, fresh and absent leases, windowed keys, self-served renewal, the pass schedule and the refresh rule.

**Fleet onboarding registers connector access contracts unapproved.** After a pack import, onboarding parses each `ontology://` resource with the SDK access-contract parser. It registers one `SourceConnection` per source and one unapproved `VirtualMapping` per contract. An unapproved mapping serves no reads. A missing SDK parser skips contracts without failure. A repeated pass adds no duplicate mapping. | `tests/fleet/test_fleet_access_contracts.py` covers registration, the unapproved state, idempotency and the missing parser.

**`find` ranks catalog-admitted tools when a live probe cannot answer.** `discover_tools` reads each admitted server's `tool`-kind components straight off the installed EG catalog snapshot (`MCPMultiplexer._catalog_tool_probe_info`), with no live probe, and ranks them when that server's live probe errored. The live probe stays the freshness refresh; the server still appears in `unavailable` so a real probe failure is never hidden, and a live answer is never shadowed by the snapshot. | `tests/fleet/test_catalog_tool_fallback.py` covers a timed-out server ranking its catalog-sourced tools as stale while still reported `unavailable`, an empty snapshot, and a live answer taking precedence over the snapshot.

**Gateway widget fetches run under a bound service actor.** `arbora/gateway/aggregator.py` mints the gateway's own verified process actor (the same `acquire_process_identity_token` → `mint_actor_from_token_sync` → `mint_graph_session` authority `arbora/gateway/daemon.py::mint_process_identity` already mints for the host daemon) and binds it with `use_actor`/`use_session` around each widget fetch dispatched to the thread pool, propagating the bound context across the executor boundary instead of losing it to a plain `ThreadPoolExecutor` thread. | Every widget fetch reaches the fleet multiplexer with the gateway's service actor bound (context propagated across the worker-thread boundary), and no fetch fails with a missing process context.

**Fleet-catalog `servers` read owned by arbora.** Rollup of `ARBORA-FLEET-R033.1` and `.2`; unblocks `AU-BOUNDARY-R001.4.2.2`. | All child rows are verified.

**Define the typed fleet-catalog `servers` reader.** Add `FleetCatalogServersReader` in `arbora/gateway/` returning typed server records scoped by tenant and principal, replacing the catalog read of AU `gateway/registry_api.py` used by `kg_server.py`. Unblocks `AU-BOUNDARY-R001.4.2.2`. | A test lists only servers visible to the calling tenant and principal.

**Add refusal tests for the `servers` reader.** Missing principal, cross-tenant and unauthorized reads are refused with typed errors. Unblocks `AU-BOUNDARY-R001.4.2.2`. | Tests cover each refusal and confirm no records leak.

**Skills and SI workflows are admitted before they run (rollup).** The host must audit each skill for unsafe instructions and tools. It must admit a workflow only with one owner, structured inputs, mapped data flows and a tool inventory. | All child rows are verified.

**Model.** Add `SkillAuditReport` (findings, severity, policy limit) and `WorkflowAdmissionRecord` (owner, inputs schema, data flows, tool inventory) in arbora/fleet/admission_models.py. | tests/fleet/test_admission_models.py checks required fields.

**Behavior.** The default `skill_audit_policy` must scan skill text and declared tools and fail a skill when findings exceed a configured severity count. The default `workflow_admission_policy` must require all four workflow fields. Each default is replaceable by name. | Unit tests in tests/fleet/test_admission_models.py cover pass and fail cases.

**Wiring.** Call both policies in `invoke` at arbora/api/invoke/pipeline.py:810 before `_confirmation_gate`, for any operation that loads a skill or starts a workflow. The production caller is the served route at arbora/api/http/routes.py:127. This row creates the call site. | tests/fleet/test_admission_wiring.py asserts the policies run before the effect.

**Refusal.** The pipeline must return `OpError("SKILL_AUDIT_FAILED")` or `OpError("WORKFLOW_NOT_ADMITTED")`, naming the missing field or the exceeded limit. | Refusal tests in tests/fleet/test_admission_wiring.py.

**Evidence.** The outcome trace must record the audit report digest, the policy name and the missing fields. | A trace test in tests/fleet/test_admission_wiring.py.

**Hot-path proof.** The served route at arbora/api/http/routes.py enters `invoke` (entry point: the served invoke operation), passes the wired policies, and the test observes refusal of an unsafe skill and of an ownerless workflow, then admission of a complete one. | tests/fleet/test_admission_hot_path.py passes.

**Model.** Bind certification to skill identity/version, dependency digests, model endpoint revision, system prompt digest and producer attestation. Bind workflow admission to tenant, caller, workflow declaration, every tool schema and current grant revision. | Typed fixtures reject missing bindings and dependency cycles.

**Behavior.** Certify atomic dependencies through the configured local model before composed workflows. EG selects and scores; Arbora validates attestations. Admit every bound tool against the trusted workflow declaration and caller grant before any tool executes. | A stale dependency or one denied tool prevents all workflow calls.

**Wiring.** Extend invoke at arbora/api/invoke/pipeline.py:810 before confirmation and dispatch. Reuse arbora/api/ops/agents.py:97 operations and the served MCP intent projection. This row creates the certification and workflow admission call sites. | Served agents.run reaches the admission gate before AU execution.

**Refusal.** Return CERTIFICATION_REQUIRED, CERTIFICATION_STALE, WORKFLOW_NOT_ADMITTED or PRODUCER_UNAVAILABLE. Generated plans cannot enlarge EG policy. Recheck grant, declaration and schema revisions before each dispatch. | Unknown tools, cyclic dependencies and revoked grants produce no new effects.

**Evidence.** Record ordered certification receipts, dependency identities, model and prompt revisions, workflow snapshot digest and authoritative decision references. Exclude prompt bodies and credentials. | Independent trace reads prove atomic-before-composed ordering and exact tool binding.

**Hot-path proof.** Entry point agents.run through REST and MCP must exercise local-model certification, workflow admission and actual tool execution. Specify tests/fleet/test_certified_workflow_served.py with allowed, denied and stale cases. | Observe the configured model request and zero denied backend calls.

**Model.** Define ProvisionRequest, ProvisionResult and FleetCapacityProof as described in plan.md. Preserve image digest, OS, runtime, tenant, instance identity, budget and idempotency binding. | Typed nested request/result round trips preserve every allocation boundary.

**Behavior.** Validate the declared platform matrix and acquire bounded capacity before allocation. Reuse EG decisions and aggregation; collect durable results from real instances. Replay returns the same allocation receipt. | Observe at least 200 concurrent instances and independent durable results under the declared budget.

**Wiring.** Reuse arbora/control_plane/runs/admission.py:108 NativeWorkItemAdmissionProtocol and arbora/control_plane/runs/capacity.py:53 CapacityLedger. Extend arbora/api/ops/agents.py:97 through invoke. This row creates the served provisioning adapter call site. | The served operation reaches the approved SDK provisioner and returned-result consumer.

**Refusal.** Reject unsupported platform/image, denied grant, stale decision, exceeded budget and changed replay bodies before allocation. Unknown allocation outcomes require reconciliation; never repeat an uncertain effect. | No denied allocation occurs; partial failures retain actual resource identities for cleanup.

**Evidence.** Record requested, admitted, started, completed and failed instance identities, peak concurrency, budget consumption, timestamps and result receipts. Preserve EG aggregation operation/version and input receipt identities. | Counters reconcile with independent runtime and durable result observations.

**Hot-path proof.** Entry point agents.run must exercise real disposable provisioners in tests/fleet/test_provisioned_capacity_served.py. Cover every declared matrix row, 200 concurrent instances, refusal, replay, interruption and aggregate result reads. | Mock allocations and smaller extrapolated runs cannot establish capacity.

**Model.** Define VersionedDefinition with kind, producer identity, semantic version, nested schema, schema digest, body digest and compatibility receipt. Tools retain input/output shapes; prompts retain typed role, instruction, context and example sections. | Fixtures parse nested definitions and reject missing versions or unknown required fields.

**Behavior.** Gate candidate publication on producer schema validity and compatibility with the admitted version. Same-version content changes refuse. Breaking changes require a new major version and explicit re-admission. | Compatible updates publish atomically; incompatible evolution leaves the prior generation active.

**Wiring.** Extend arbora/fleet/catalog_items.py:208 compute_schema_fingerprint and arbora/fleet/onboarding.py:236 FleetOnboarding.onboard before import. Preserve EG prompt authority and SDK tool schema ownership. | Real served catalog probes provide both schema versions and verified producer receipts.

**Refusal.** Return DEFINITION_VERSION_REQUIRED, SCHEMA_INVALID, SCHEMA_INCOMPATIBLE or PRODUCER_UNAVAILABLE before catalog visibility. Host parsing cannot certify absent producer evolution semantics. | Missing or contradictory producer evidence never permits a generation swap.

**Evidence.** Record old/new definition versions, schema/body digests, producer revision, compatibility decision and catalog generation. Preserve tenant and source provenance. | Receipt reads identify exactly which definition each admitted workflow consumed.

**Hot-path proof.** Entry point served catalog reload in tests/fleet/test_versioned_definitions_served.py admits a compatible nested update. Breaking updates, forged receipts and stale workflow schemas refuse before execution. | MCP and REST expose the same complete admitted generation.

**Model.** Bind IntegratedProvisionReceipt to discovery generation, EG skill identity/version, distribution decision, admission receipt, provisioned instance and durable result. Reuse typed work-item projections from R005. | All phases retain one tenant, run identity and exact skill digest.

**Behavior.** Discover authorized domain capabilities, consume EG distribution decisions, provision real agents and attach the graph-ingested skill version. The agent must use that exact identity during execution. | Independent graph and agent observations agree before a successful completion claim.

**Wiring.** Reuse arbora/fleet/onboarding.py:236 FleetOnboarding.onboard and arbora/api/ops/agents.py:97 operations. Connect the admitted work-item route to provisioning and result evidence. This row creates the integrated acceptance call site. | One served request traverses discovery, distribution, provisioning and ingested skill consumption.

**Refusal.** Deny missing skills, unavailable producers, incompatible schemas, cross-tenant receipts and unapproved tools. Stop before affected dispatch; retain known partial allocation state without claiming rollback. | Denied discovery returns no protected identity; no unauthorized agent or tool effect occurs.

**Evidence.** Correlate catalog generation, graph read receipt, distribution decision, instance identity, model trace and result receipt. Read graph state independently after ingestion and agent execution. | The evidence proves graph identity consumption rather than matching copied skill text.

**Hot-path proof.** Entry point agents.run through real MCP and REST in tests/fleet/test_discovery_distribution_provisioning.py must execute the whole sequence. Include denial, unavailable producer, restart and duplicate delivery. | Separate helper tests cannot satisfy integrated acceptance.

**Behavior.** Workflow admission also applies R034.7 through R034.12 through the same narrowing policy boundary. No separate host identity authority is introduced. | The served integrated tests cover this consumer dependency.

**Behavior.** Every workflow tool requires the declaration and grant binding in R034.7 through R034.12 before the first call. Revalidate before later calls. | The served integrated tests cover this consumer dependency.

**Behavior.** Integrated work-item distribution and provisioning use R027.1 through R027.6. Preserve EG work-item identity, control lease and returned-result authority. | The served integrated tests cover this consumer dependency.

**Original policy contract.** Apply narrowing-only policy at discover, load and call after exact scope and principal checks. Policy precedes deputy and confirmation steps. Disabled policy still filters by scope and principal. With no configured policy, default to off. Local deployments ship the default policy enabled; external deployments enable it. deployment/doctor.py warns when policy is off. An enabled but unreachable policy service fails closed at discover, load and call. An explicit policy denial cannot become an allow. | Exercise every phase with allowed and denied callers while policy is enabled and disabled. No denied call reaches the engine. Cover all three deployment modes and assert the doctor warning for off mode. For each phase, compare an allowed decision, denied decision and unavailable service. Refused discovery leaks no item; refused loading or calling produces no effect.

**Original fleet authority contract.** Require the exact fleet scope for each action through _require_fleet_capability. Neither admin nor kg:admin substitutes for that scope. Local stdio enforces the same rule as network transports. tool_dispatchable denies every unrecognized native host tool. The served MCP surface applies the existing policy filter before visibility and dispatch. | Exercise correctly scoped and over-broad callers for each action on stdio and network transports. Only the exact authorized scope permits the action. Unknown native names refuse. Start the actual MCP surface and prove policy middleware filters discovery and execution for denied callers.

**Original fleet onboarding contract.** One pass selects every enabled streamable-HTTP server from MCP config. It registers each server, captures its catalog through SDK, attests with EG and imports the pack. Repeated onboarding is idempotent and handles admitted servers without duplicate imports. A failing server leaves the others unaffected. Registry outages and missing child credentials produce explicit per-server failure outcomes. arbora-production-ops onboard-fleet runs one complete pass, reports each server and exits non-zero when any server fails. Boot starts the same onboarding pass on a background thread. A pass failure never blocks or stops serving. | A fresh-store pass covers multiple enabled servers. Disabled servers and other transports are excluded. Each eligible server has registration, capture, attestation and import evidence. Repeat a pass and observe no duplicate imports. Mix failing and healthy servers, then exercise registry outage and missing credentials. Preserve successful server outcomes. Invoke the real CLI for successful and mixed-result passes. Assert complete server reporting and the required exit status. Start the actual serving composition with a failing boot pass. Observe the failure report while MCP requests still complete.

**Original writable-fleet acceptance residual.** Model: The original R003 contract covers every admitted writable connector, not just repository files. Behavior: Preserve typed registry exposure, preview gating, deterministic replay and correct fleet behavior across service restart. Wiring: Retain R003.1 through R003.3 and their original acceptance; extend the served fleet fixture. Refusal: No unguarded native tool, missing preview or mismatched effect key may produce a write. Evidence: Restart and fault each admitted writable profile. Observe original receipts without duplicate effects and no partial protocol state. Missing previews and mismatched keys must prevent writes. | Proposed test: `tests/fleet/test_repository_source_effect_served.py::test_original_fleet_restart`. Restart and fault each admitted writable profile. Observe original receipts without duplicate effects and no partial protocol state. Missing previews and mismatched keys must prevent writes.

**Complete repository request binding.** Model: RepositoryWriteBackParams carries the full SDK RepositorySourceEffectRequest and a trusted connector-binding digest. Behavior: Keep every SDK field, including exact bytes, immutable base, actor, approval and effect key, inside the confirmed projection. Wiring: Extend the existing write-back operation schemas with the closed repository profile defined in plan.md. Refusal: Unknown fields, changed bindings and request.intent differing from durable.desired_patch["repository_effect"] refuse. Evidence: Round-trip seeded byte fixtures through HTTP and MCP. Compare canonical projections and refuse each independently altered field. | Proposed test: `tests/fleet/test_repository_source_effect_served.py::test_request_binding`. Round-trip seeded byte fixtures through HTTP and MCP. Compare canonical projections and refuse each independently altered field.

**Trusted composition through shared invoke.** Model: An admitted binding identifies the connector, source instance, repository, operation schema and existing execution authority. Behavior: Resolve it from trusted configuration and route both operations through the existing invoke checks. Wiring: Extend write_back.py and registry_factory.py; compose the admitted SDK operation through the existing fleet gateway and executor. Refusal: Missing producer, changed configuration or unavailable replay authority returns a typed refusal before provider mutation. Evidence: A served request reaches the real admitted connector once. Unbound configuration and direct native bypass attempts reach it zero times. | Proposed test: `tests/fleet/test_repository_source_effect_served.py::test_trusted_composition`. A served request reaches the real admitted connector once. Unbound configuration and direct native bypass attempts reach it zero times.

**Preview and approval bind the commit operation.** Model: The existing plan binds the commit operation, full parameters, caller, tenant, policy and registry revision. Behavior: Require the SDK dry-run and recorded approval for the same canonical change set before commit. Wiring: Reuse bind_plan and the existing confirmation, audit and reservation path under ARBORA-OPS-R009. Refusal: A preview-operation lease, expired plan, changed payload or unbound approval cannot authorize commit. Evidence: One exact approved preview commits. Each binding change, invalid lease and missing required step-up produces zero provider mutations. | Proposed test: `tests/fleet/test_repository_source_effect_served.py::test_commit_binding`. One exact approved preview commits. Each binding change, invalid lease and missing required step-up produces zero provider mutations.

**Served effect and independent readback evidence.** Model: The result carries the actual SDK RepositorySourceEffectReceipt, request digest and receipt digest. Behavior: Return success only for a bound durable attempt with an actual immutable revision and matching independent readback. Wiring: Project SDK R004.8 through R004.10 and R004.12 results through the served operation response. Refusal: An echoed effect key, applied flag, fabricated revision or unbound receipt cannot establish success. Evidence: Serve preview, approval and commit against a disposable provider. Independently read its revision and durable graph attempt. An echoed flag or unbound receipt must refuse success. | Proposed test: `tests/fleet/test_repository_source_effect_served.py::test_actual_effect_readback`. Serve preview, approval and commit against a disposable provider. Independently read its revision and durable graph attempt. An echoed flag or unbound receipt must refuse success.

**Zero-effect refusal parity.** Model: The negative matrix binds each changed request or denied authority to the observed provider call count. Behavior: Apply existing principal, scope, policy, subject-read, plan, approval and audit rules identically across HTTP and MCP. Wiring: Use the shared invoke error envelope and SDK refusal semantics; retain original engine and fleet error provenance. Refusal: Reject missing approval, stale base, path escape, changed bytes and denied scope before mutation. Post-effect uncertainty never means rollback. Evidence: Observe zero denied mutations on both surfaces. Inject readback failure after an effect and observe uncertainty without another write. | Proposed test: `tests/fleet/test_repository_source_effect_served.py::test_refusal_parity`. Observe zero denied mutations on both surfaces. Inject readback failure after an effect and observe uncertainty without another write.

**Durable replay across host and connector restart.** Model: The host plan and reservation bind the original SDK effect key, request and durable receipt. Behavior: Recover the same proven result after restart; reconcile uncertain effects without blind reapply. Wiring: Use the existing qualified effect coordinator with SDK R004.2 and R004.11 through shared invoke. Refusal: A consumed plan alone cannot prove completion; conflicting replay, lost receipts and unavailable causal lookup cannot trigger another mutation. Evidence: Race identical calls and crash at each effect boundary. Restart both processes and prove one effect or a truthful unresolved result. | Proposed test: `tests/fleet/test_repository_source_effect_served.py::test_restart_replay`. Race identical calls and crash at each effect boundary. Restart both processes and prove one effect or a truthful unresolved result.

**Authenticated schema preflight for OpenAPI operation aliases.** Before invoking a schema-bound alias, Arbora reads its SDK manifest and complete ordered fragments over the same authority-admitted MCP session. It reconstructs the canonical document with the public SDK. It checks both schema hashes and exact equality with the admitted input/output schemas. It binds the manifest alias and operation to the requested action. Revalidate caller delegation, child generation, catalog revision and tool mapping before each resource read and final call. Missing, stale, invalid, incomplete, oversized or mismatched disclosure refuses before invocation. Schema-bound aliases are not automatically retried after uncertain outcomes; existing MCP confirmation and effect handling remain authoritative. | `tests/fleet/test_multiplexer_schema_disclosure.py` covers complete reconstruction, stale/incomplete/mismatched refusal, missing output-schema refusal, authority/session/catalog binding, OAuth session reuse and no write replay. These fixture tests do not establish live-provider or deployment evidence.

**AU:29 Arbora definition slice.** AU:29 cross-owner slice. Residual: SDK allocation/reconciliation producer API with actual instance receipts, unknown-result handling and replay fencing. Binding from the AU sandbox port through the hosted agents.run operation to that producer Arbora minimum action:. Define only the missing SDK allocation/reconciliation contract and exact consumer binding; preserve the existing host matrix and refusal definitions. Acceptance must cross the served agents.run route into real disposable adapters. With unsupported combinations producing zero allocation and uncertain outcomes never blindly retried. Producer/consumer boundary: AU direct sandbox port -> Arbora agents.run/invoke -> arbora/control_plane/runs/admission.py. NativeWorkItemAdmissionProtocol and capacity.py CapacityLedger -> SDK provisioner (producer operation/module not defined) -> runtime allocation receipt -> Arbora returned-result consumer. External engine, SDK, AU, Pipelines or WebUI behavior remains owned there; this row specifies only Arbora. Current IDs: `AU-CONTROL-R021, AU-CONTROL-R038, AU-CONTROL-R038.1, AU-CONTROL-R038.2, AU-CONTROL-R038.3, AU-CONTROL-R038.4, AU-CONTROL-R038.5, AU-CONTROL-R038.6, AU-CONTROL-R039, AU-CONTROL-R039.1, AU-CONTROL-R039.2, AU-CONTROL-R039.3, AU-CONTROL-R039.4, AU-CONTROL-R039.5, AU-CONTROL-R039.6, AU-CONTROL-R041, AU-CONTROL-R041.1, AU-CONTROL-R041.2, AU-CONTROL-R041.3, AU-CONTROL-R041.4, AU-CONTROL-R041.5, AU-CONTROL-R041.6, ARBORA-FLEET-R024.4, ARBORA-FLEET-R024.5, ARBORA-FLEET-R024.6, ARBORA-FLEET-R024.7, ARBORA-FLEET-R024.8, ARBORA-FLEET-R024.9`. Source record SHA-256: `49df21c60c947240d4f02b1424b1de29183f10a69c76bd885f19d13e7237061c`. Reviewed evidence paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/review-sdk-20261012.json, arbora/specs/fleet-catalog-and-tools/plan.md:150#sha256=8fe992c0172fe99e82885d398c4490c00643801df8b64db82dafe2dd235a9223, arbora/specs/fleet-catalog-and-tools/plan.md:151#sha256=33a792338bd6baa69fca00bcf7ac8202fe029911eb5f9b83a9244ddb29926b1f, arbora/specs/fleet-catalog-and-tools/plan.md:152#sha256=3862f89efb1ead7c8a8684e6204def414d615207f4fff79ef30cfa66b00f4e95, arbora/specs/fleet-catalog-and-tools/plan.md:153#sha256=6a4c23b6a961588e9a6ed00a06813b6d584a607bc2668e7f2d94d1739055752b, arbora/specs/fleet-catalog-and-tools/plan.md:154#sha256=0c9a2ad707136387a8088a0d003599eff6614e46b7b27ea461249a1a7d235790, arbora/specs/fleet-catalog-and-tools/plan.md:155#sha256=40538332c2a8ed9e1e71533cd87dec249b62697786ae302d55115d10bdf256f8, arbora/specs/fleet-catalog-and-tools/plan.md:156#sha256=3752c6301423554e39f0d762f2e9aed78cf4247f061639641df3e7575f95c181, arbora/specs/fleet-catalog-and-tools/plan.md:157#sha256=8ec92bc0ae2191f7f6d7716eb898154322122194a2739dbcbf1d1a82bd1b6d02, arbora/specs/fleet-catalog-and-tools/plan.md:158#sha256=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, arbora/specs/fleet-catalog-and-tools/plan.md:159#sha256=000bafff0b1df418ca2a05537925f6e57b8d1e1654b3d4eb998197ce6d6e43fb, arbora/specs/fleet-catalog-and-tools/plan.md:160#sha256=5cce45243da01c4af746641382ca6c84ac7a73cf291c51779fd47cb28cf1699a, arbora/specs/fleet-catalog-and-tools/plan.md:161#sha256=d0aacbb14d48d0923d26d8efdb45e159b41f3ddb8f1ee160477565222eaa774c, arbora/specs/fleet-catalog-and-tools/plan.md:162#sha256=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, arbora/specs/fleet-catalog-and-tools/plan.md:163#sha256=9bbb969aee819a16737ffdba1d15ebdb3541c3773144dc09df2663797111b334, arbora/specs/fleet-catalog-and-tools/plan.md:164#sha256=4da1ec6f47782090102dc16bda978efb5655fbf2ddce0f84ecf1faf79a930f2d, arbora/specs/fleet-catalog-and-tools/plan.md:165#sha256=4b665287c64ea278c7b9b29be6549b9b20f6cbca908c6f0c480794f17beaf60f, arbora/specs/fleet-catalog-and-tools/plan.md:166#sha256=5736970e981605d0675fa3a2825712560785082e58af6229d834e9c107314aa6, arbora/specs/fleet-catalog-and-tools/plan.md:167#sha256=887fc0aced120fc3763f3e8f6d06f7eb989937812afe1539e93a2c27f20f53f3, arbora/specs/fleet-catalog-and-tools/plan.md:168#sha256=3ae24c1a63f728e4336597f14282e88401359ed438638cf17b59e0e41343f810, arbora/specs/fleet-catalog-and-tools/plan.md:169#sha256=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, arbora/specs/fleet-catalog-and-tools/plan.md:170#sha256=1d1d6723ad8b0c2d94691135886fb6bfd6772b57ba751c4435204ff796f4548e, arbora/specs/fleet-catalog-and-tools/plan.md:171#sha256=308a3420a69c828fafc2381d64c4acd7b23a6ce6c7e944b0dbf4e1e83e946993, arbora/specs/fleet-catalog-and-tools/plan.md:172#sha256=77a31d59a69f081e6b8f97303ae58eadc1b5c0e87416333177f56204ae107d98, arbora/specs/fleet-catalog-and-tools/plan.md:173#sha256=ef68c4a84ec4424b847382c5b9fbc1ddee34d560abc4e7bffa372ee4cb720943, arbora/specs/fleet-catalog-and-tools/plan.md:174#sha256=4f01f77b17d1907a0baf9642db8cde70e04a5e51d489ebe6fbc9ba706797441f, arbora/specs/fleet-catalog-and-tools/plan.md:175#sha256=c11fc8d2e1fd526ab00f3cb36b1672086dbc4b9b48a1923de014e5220bd0514d, arbora/specs/fleet-catalog-and-tools/plan.md:176#sha256=57b64cc7c260f47db959b048a7c867a71f9e8798fcb64d144cce5a0473806968, arbora/specs/fleet-catalog-and-tools/requirements.md:89#sha256=2b8dadeef0c0cd61f4437ca5899360ae99208ad363f409f2930816543fea8b04, arbora/specs/fleet-catalog-and-tools/requirements.md:90#sha256=ad310fd6727a224c24b128721a9095f620c5e8ca87bc3342c3cf06b3fb046676, arbora/specs/fleet-catalog-and-tools/requirements.md:91#sha256=5c976b8e84f7c83b5f14d0974a64b8a2370a32cd395c2480adeef40b9b511a7b, arbora/specs/fleet-catalog-and-tools/requirements.md:92#sha256=ae533aa48c60bf84a766f91c2f39ef890cc0b5d4cff541d36b3a293bf1b9639f, arbora/specs/fleet-catalog-and-tools/requirements.md:93#sha256=8bf49a7de9c909fc5be29beeedd19e5a2b21ecade2a00da409fc667c0c465fa8, arbora/specs/fleet-catalog-and-tools/requirements.md:94#sha256=c3ded92adffb8f82c5ce532c1e9a8f91b034496642757e48f24f95d346ea5ecf, agent-utilities/specs/agent-control-plane/requirements.md:26#sha256=643e7a1f961e5b313cbafb9cbf8b85873f33be7463c17736870cf1c6e9dd6848`. Packet row: `spec-audit/reconciliation/repository-batches-20261012/arbora.json#/rows/15`. No implementation or runtime evidence is claimed. | Future Arbora tests must prove the owner behavior and cover every positive, refusal, and zero-effect case defined above. Retain all existing parent acceptance for IDs `AU-CONTROL-R021, AU-CONTROL-R038, AU-CONTROL-R038.1, AU-CONTROL-R038.2, AU-CONTROL-R038.3, AU-CONTROL-R038.4, AU-CONTROL-R038.5, AU-CONTROL-R038.6, AU-CONTROL-R039, AU-CONTROL-R039.1, AU-CONTROL-R039.2, AU-CONTROL-R039.3, AU-CONTROL-R039.4, AU-CONTROL-R039.5, AU-CONTROL-R039.6, AU-CONTROL-R041, AU-CONTROL-R041.1, AU-CONTROL-R041.2, AU-CONTROL-R041.3, AU-CONTROL-R041.4, AU-CONTROL-R041.5, AU-CONTROL-R041.6, ARBORA-FLEET-R024.4, ARBORA-FLEET-R024.5, ARBORA-FLEET-R024.6, ARBORA-FLEET-R024.7, ARBORA-FLEET-R024.8, ARBORA-FLEET-R024.9`. Use the exact reviewed source paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/review-sdk-20261012.json, arbora/specs/fleet-catalog-and-tools/plan.md:150#sha256=8fe992c0172fe99e82885d398c4490c00643801df8b64db82dafe2dd235a9223, arbora/specs/fleet-catalog-and-tools/plan.md:151#sha256=33a792338bd6baa69fca00bcf7ac8202fe029911eb5f9b83a9244ddb29926b1f, arbora/specs/fleet-catalog-and-tools/plan.md:152#sha256=3862f89efb1ead7c8a8684e6204def414d615207f4fff79ef30cfa66b00f4e95, arbora/specs/fleet-catalog-and-tools/plan.md:153#sha256=6a4c23b6a961588e9a6ed00a06813b6d584a607bc2668e7f2d94d1739055752b, arbora/specs/fleet-catalog-and-tools/plan.md:154#sha256=0c9a2ad707136387a8088a0d003599eff6614e46b7b27ea461249a1a7d235790, arbora/specs/fleet-catalog-and-tools/plan.md:155#sha256=40538332c2a8ed9e1e71533cd87dec249b62697786ae302d55115d10bdf256f8, arbora/specs/fleet-catalog-and-tools/plan.md:156#sha256=3752c6301423554e39f0d762f2e9aed78cf4247f061639641df3e7575f95c181, arbora/specs/fleet-catalog-and-tools/plan.md:157#sha256=8ec92bc0ae2191f7f6d7716eb898154322122194a2739dbcbf1d1a82bd1b6d02, arbora/specs/fleet-catalog-and-tools/plan.md:158#sha256=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, arbora/specs/fleet-catalog-and-tools/plan.md:159#sha256=000bafff0b1df418ca2a05537925f6e57b8d1e1654b3d4eb998197ce6d6e43fb, arbora/specs/fleet-catalog-and-tools/plan.md:160#sha256=5cce45243da01c4af746641382ca6c84ac7a73cf291c51779fd47cb28cf1699a, arbora/specs/fleet-catalog-and-tools/plan.md:161#sha256=d0aacbb14d48d0923d26d8efdb45e159b41f3ddb8f1ee160477565222eaa774c, arbora/specs/fleet-catalog-and-tools/plan.md:162#sha256=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, arbora/specs/fleet-catalog-and-tools/plan.md:163#sha256=9bbb969aee819a16737ffdba1d15ebdb3541c3773144dc09df2663797111b334, arbora/specs/fleet-catalog-and-tools/plan.md:164#sha256=4da1ec6f47782090102dc16bda978efb5655fbf2ddce0f84ecf1faf79a930f2d, arbora/specs/fleet-catalog-and-tools/plan.md:165#sha256=4b665287c64ea278c7b9b29be6549b9b20f6cbca908c6f0c480794f17beaf60f, arbora/specs/fleet-catalog-and-tools/plan.md:166#sha256=5736970e981605d0675fa3a2825712560785082e58af6229d834e9c107314aa6, arbora/specs/fleet-catalog-and-tools/plan.md:167#sha256=887fc0aced120fc3763f3e8f6d06f7eb989937812afe1539e93a2c27f20f53f3, arbora/specs/fleet-catalog-and-tools/plan.md:168#sha256=3ae24c1a63f728e4336597f14282e88401359ed438638cf17b59e0e41343f810, arbora/specs/fleet-catalog-and-tools/plan.md:169#sha256=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, arbora/specs/fleet-catalog-and-tools/plan.md:170#sha256=1d1d6723ad8b0c2d94691135886fb6bfd6772b57ba751c4435204ff796f4548e, arbora/specs/fleet-catalog-and-tools/plan.md:171#sha256=308a3420a69c828fafc2381d64c4acd7b23a6ce6c7e944b0dbf4e1e83e946993, arbora/specs/fleet-catalog-and-tools/plan.md:172#sha256=77a31d59a69f081e6b8f97303ae58eadc1b5c0e87416333177f56204ae107d98, arbora/specs/fleet-catalog-and-tools/plan.md:173#sha256=ef68c4a84ec4424b847382c5b9fbc1ddee34d560abc4e7bffa372ee4cb720943, arbora/specs/fleet-catalog-and-tools/plan.md:174#sha256=4f01f77b17d1907a0baf9642db8cde70e04a5e51d489ebe6fbc9ba706797441f, arbora/specs/fleet-catalog-and-tools/plan.md:175#sha256=c11fc8d2e1fd526ab00f3cb36b1672086dbc4b9b48a1923de014e5220bd0514d, arbora/specs/fleet-catalog-and-tools/plan.md:176#sha256=57b64cc7c260f47db959b048a7c867a71f9e8798fcb64d144cce5a0473806968, arbora/specs/fleet-catalog-and-tools/requirements.md:89#sha256=2b8dadeef0c0cd61f4437ca5899360ae99208ad363f409f2930816543fea8b04, arbora/specs/fleet-catalog-and-tools/requirements.md:90#sha256=ad310fd6727a224c24b128721a9095f620c5e8ca87bc3342c3cf06b3fb046676, arbora/specs/fleet-catalog-and-tools/requirements.md:91#sha256=5c976b8e84f7c83b5f14d0974a64b8a2370a32cd395c2480adeef40b9b511a7b, arbora/specs/fleet-catalog-and-tools/requirements.md:92#sha256=ae533aa48c60bf84a766f91c2f39ef890cc0b5d4cff541d36b3a293bf1b9639f, arbora/specs/fleet-catalog-and-tools/requirements.md:93#sha256=8bf49a7de9c909fc5be29beeedd19e5a2b21ecade2a00da409fc667c0c465fa8, arbora/specs/fleet-catalog-and-tools/requirements.md:94#sha256=c3ded92adffb8f82c5ce532c1e9a8f91b034496642757e48f24f95d346ea5ecf, agent-utilities/specs/agent-control-plane/requirements.md:26#sha256=643e7a1f961e5b313cbafb9cbf8b85873f33be7463c17736870cf1c6e9dd6848`. This definition does not assert these tests have run.

**AU:30 Arbora definition slice.** AU:30 cross-owner slice. Residual: The selected AggregationOp lacks binding to AU FanoutResult and real fleet receipts. No generated public operation/version, result schema, consumer call, or independent served readback is named. Host plan line 207 explicitly preserves this producer gap. Arbora minimum action: Retain only the aggregation-interface residual. Bind existing EG aggregation to AU/Arbora result receipts with operation/version/schema/caller/readback evidence. Do not add another 200-instance definition or aggregation policy. Producer/consumer boundary: EG decompose_task selects AggregationOp; AU _fork_fanout returns FanoutResult; Arbora agents.run collects durable instance receipts. Applying aggregation to those receipts lacks the named public producer/consumer contract. External engine, SDK, AU, Pipelines or WebUI behavior remains owned there; this row specifies only Arbora. Current IDs: `AU-CONTROL-R043, AU-CONTROL-R043.1, AU-CONTROL-R043.2, AU-CONTROL-R043.3, AU-CONTROL-R043.4, AU-CONTROL-R043.5, AU-CONTROL-R043.6, AU-CONTROL-R007, AU-CONTROL-R018, AU-HARNESS-R026, AU-HARNESS-R026.1, AU-HARNESS-R026.2, AU-HARNESS-R026.3, AU-HARNESS-R026.4, AU-HARNESS-R026.5, AU-HARNESS-R026.6, AU-HARNESS-R026.7, ARBORA-FLEET-R024.4, ARBORA-FLEET-R024.5, ARBORA-FLEET-R024.6, ARBORA-FLEET-R024.7, ARBORA-FLEET-R024.8, ARBORA-FLEET-R024.9`. Source record SHA-256: `8f2ff3030a71d67b20cd19301f0ed8cef75e975403595cec4060abf9fa8952c1`. Reviewed evidence paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-70.json, agent-utilities/specs/agent-control-plane/requirements.md:12#sha256=ccedbc80e3c3d981854ae5c31f76f63b7c8bdd27af501dcb4546b988294e851c, agent-utilities/specs/agent-control-plane/requirements.md:100#sha256=ee88348e7504497509d3f035e319bb34ab65fbfe0d860d1b2828417bbd6f0ed1, agent-utilities/specs/agent-control-plane/requirements.md:101#sha256=d3d01e99903b7c42070d019b6133df2f74078b01a9ab3e12dc167ced500c0cd9, arbora/specs/fleet-catalog-and-tools/requirements.md:90#sha256=ad310fd6727a224c24b128721a9095f620c5e8ca87bc3342c3cf06b3fb046676, arbora/specs/fleet-catalog-and-tools/requirements.md:92#sha256=ae533aa48c60bf84a766f91c2f39ef890cc0b5d4cff541d36b3a293bf1b9639f, arbora/specs/fleet-catalog-and-tools/requirements.md:93#sha256=8bf49a7de9c909fc5be29beeedd19e5a2b21ecade2a00da409fc667c0c465fa8, arbora/specs/fleet-catalog-and-tools/requirements.md:94#sha256=c3ded92adffb8f82c5ce532c1e9a8f91b034496642757e48f24f95d346ea5ecf, epistemic-graph/specs/decision-engine/requirements.md:280#sha256=c6863f3a208df505d64ef6a9c672fdc04f8061b1c361c224d1d45d5f87d50fc8, epistemic-graph/specs/decision-engine/requirements.md:282#sha256=ab6257664369433a509277ad01a474bb8e769c04693cdf99f6861c9ff45b9a02, arbora/specs/fleet-catalog-and-tools/plan.md:130#sha256=9c3a9be68e50c3395f82c3ee14554891b0bd19d1419fd5f372a0a4da5764ae7f, arbora/specs/fleet-catalog-and-tools/plan.md:131#sha256=72edacadb577797544a01534a7f49b9fe046ec1d65022572185586e3782aeff4, arbora/specs/fleet-catalog-and-tools/plan.md:132#sha256=3349bd2a7f486086dd14ec9c28b56f35c742daf2dd5cc43f1557ed7b5414358e, arbora/specs/fleet-catalog-and-tools/plan.md:133#sha256=c1af0b78233d5d23d72e347020553eaae486f681f5f41aa107c0ed8ddcf43e58, arbora/specs/fleet-catalog-and-tools/plan.md:207#sha256=cacec740ca546d9ab6b818b7986359edfa4d6f51277c453f51df5d3e44b1e2ff, arbora/specs/fleet-catalog-and-tools/plan.md:209#sha256=11b9626ad9b27e25d0ec1ef636320de5062d7c731e681876b8c59ee98688df3d, arbora/specs/fleet-catalog-and-tools/plan.md:211#sha256=feb0279ce1d92bc3120ecee04c588483c42eb4ec5999d1f3d7a95639cb66d849, arbora/specs/fleet-catalog-and-tools/plan.md:212#sha256=1d54719777ef43536e0077eb5f2f3bda89a34f57e1b08c96e013e09171d2f67b, arbora/specs/fleet-catalog-and-tools/plan.md:213#sha256=9d21c74d67b683ba1dd44587115fbee059259366a352998a86d9808abd62c0ef, arbora/specs/fleet-catalog-and-tools/plan.md:219#sha256=57a10a4bba1bac9b9b05cd0722cdf1f4773c4374a797885b9bc540fe38401ab6, arbora/specs/fleet-catalog-and-tools/plan.md:220#sha256=2a1eba0606487abcef074148bb979a01b3289614c514f8b027ccb148c780a4ba`. Packet row: `spec-audit/reconciliation/repository-batches-20261012/arbora.json#/rows/16`. No implementation or runtime evidence is claimed. | Future Arbora tests must prove the owner behavior and cover every positive, refusal, and zero-effect case defined above. Retain all existing parent acceptance for IDs `AU-CONTROL-R043, AU-CONTROL-R043.1, AU-CONTROL-R043.2, AU-CONTROL-R043.3, AU-CONTROL-R043.4, AU-CONTROL-R043.5, AU-CONTROL-R043.6, AU-CONTROL-R007, AU-CONTROL-R018, AU-HARNESS-R026, AU-HARNESS-R026.1, AU-HARNESS-R026.2, AU-HARNESS-R026.3, AU-HARNESS-R026.4, AU-HARNESS-R026.5, AU-HARNESS-R026.6, AU-HARNESS-R026.7, ARBORA-FLEET-R024.4, ARBORA-FLEET-R024.5, ARBORA-FLEET-R024.6, ARBORA-FLEET-R024.7, ARBORA-FLEET-R024.8, ARBORA-FLEET-R024.9`. Use the exact reviewed source paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-70.json, agent-utilities/specs/agent-control-plane/requirements.md:12#sha256=ccedbc80e3c3d981854ae5c31f76f63b7c8bdd27af501dcb4546b988294e851c, agent-utilities/specs/agent-control-plane/requirements.md:100#sha256=ee88348e7504497509d3f035e319bb34ab65fbfe0d860d1b2828417bbd6f0ed1, agent-utilities/specs/agent-control-plane/requirements.md:101#sha256=d3d01e99903b7c42070d019b6133df2f74078b01a9ab3e12dc167ced500c0cd9, arbora/specs/fleet-catalog-and-tools/requirements.md:90#sha256=ad310fd6727a224c24b128721a9095f620c5e8ca87bc3342c3cf06b3fb046676, arbora/specs/fleet-catalog-and-tools/requirements.md:92#sha256=ae533aa48c60bf84a766f91c2f39ef890cc0b5d4cff541d36b3a293bf1b9639f, arbora/specs/fleet-catalog-and-tools/requirements.md:93#sha256=8bf49a7de9c909fc5be29beeedd19e5a2b21ecade2a00da409fc667c0c465fa8, arbora/specs/fleet-catalog-and-tools/requirements.md:94#sha256=c3ded92adffb8f82c5ce532c1e9a8f91b034496642757e48f24f95d346ea5ecf, epistemic-graph/specs/decision-engine/requirements.md:280#sha256=c6863f3a208df505d64ef6a9c672fdc04f8061b1c361c224d1d45d5f87d50fc8, epistemic-graph/specs/decision-engine/requirements.md:282#sha256=ab6257664369433a509277ad01a474bb8e769c04693cdf99f6861c9ff45b9a02, arbora/specs/fleet-catalog-and-tools/plan.md:130#sha256=9c3a9be68e50c3395f82c3ee14554891b0bd19d1419fd5f372a0a4da5764ae7f, arbora/specs/fleet-catalog-and-tools/plan.md:131#sha256=72edacadb577797544a01534a7f49b9fe046ec1d65022572185586e3782aeff4, arbora/specs/fleet-catalog-and-tools/plan.md:132#sha256=3349bd2a7f486086dd14ec9c28b56f35c742daf2dd5cc43f1557ed7b5414358e, arbora/specs/fleet-catalog-and-tools/plan.md:133#sha256=c1af0b78233d5d23d72e347020553eaae486f681f5f41aa107c0ed8ddcf43e58, arbora/specs/fleet-catalog-and-tools/plan.md:207#sha256=cacec740ca546d9ab6b818b7986359edfa4d6f51277c453f51df5d3e44b1e2ff, arbora/specs/fleet-catalog-and-tools/plan.md:209#sha256=11b9626ad9b27e25d0ec1ef636320de5062d7c731e681876b8c59ee98688df3d, arbora/specs/fleet-catalog-and-tools/plan.md:211#sha256=feb0279ce1d92bc3120ecee04c588483c42eb4ec5999d1f3d7a95639cb66d849, arbora/specs/fleet-catalog-and-tools/plan.md:212#sha256=1d54719777ef43536e0077eb5f2f3bda89a34f57e1b08c96e013e09171d2f67b, arbora/specs/fleet-catalog-and-tools/plan.md:213#sha256=9d21c74d67b683ba1dd44587115fbee059259366a352998a86d9808abd62c0ef, arbora/specs/fleet-catalog-and-tools/plan.md:219#sha256=57a10a4bba1bac9b9b05cd0722cdf1f4773c4374a797885b9bc540fe38401ab6, arbora/specs/fleet-catalog-and-tools/plan.md:220#sha256=2a1eba0606487abcef074148bb979a01b3289614c514f8b027ccb148c780a4ba`. This definition does not assert these tests have run.

**AU:52 Arbora definition slice.** AU:52 cross-owner slice. Residual: EG prompt and SDK tool producer-specific compatibility/evolution decisions and exact receipts remain unbound to host admission. Declared contract-version pin equality and source-ingest drift classification do not define nested incremental producer compatibility. Arbora minimum action: Define or link only the missing producer-specific evolution/compatibility and receipt contracts, then bind R002.5 consumption. Preserve existing host parsing, version-conflict and breaking-change refusal rules. Producer/consumer boundary: EG prompt authority and SDK tool schema authority -> Arbora compute_schema_fingerprint/FleetOnboarding.onboard -> versioned. Catalog publication; missing producer decision/receipt semantics are explicit. External engine, SDK, AU, Pipelines or WebUI behavior remains owned there; this row specifies only Arbora. Current IDs: `AU-HARNESS-R011, ARBORA-FLEET-R002.1, SDK-CONNECTOR-CONTROL-R003, ARBORA-FLEET-R002.3, ARBORA-FLEET-R002.4, ARBORA-FLEET-R002.5, ARBORA-FLEET-R002.6, ARBORA-FLEET-R002.7, ARBORA-FLEET-R002.8`. Source record SHA-256: `e03b25156a4f84d27c4afba63d0cd9e526b549b5905994a53664d193416d048c`. Reviewed evidence paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-70.json, arbora/specs/fleet-catalog-and-tools/requirements.md:95#sha256=db0fa3fa0b8129adf0e47cedf251d23a4c1cefc8042c3ac0ce21e7f3bb4d4a18, arbora/specs/fleet-catalog-and-tools/requirements.md:96#sha256=23d0b06d0f5a5db82f6838576ae49df3ade434e07265b9fd59b668da21ee7fe5, arbora/specs/fleet-catalog-and-tools/requirements.md:97#sha256=43163d5f0ef5eecbf19d9746730b79dab2989926997bfae90551106cfdee5072, arbora/specs/fleet-catalog-and-tools/requirements.md:98#sha256=8adc75979cdeeb5df9df597b4bd56f6830450dd66c15b44046f4b8636ba1cc3b, agent-connector-sdk/specs/SDK-CONNECTOR-CONTROL/requirements.md:7#sha256=8cc97e7070b51629df4f13ac354b3b7185851f9d8dac025d84b2355f6e8c4e73, epistemic-graph/specs/typed-packs-and-catalog/requirements.md:40#sha256=a909288fc0cb3efe0ce849be7b743333bf57d3259fab9a7afaa71c3af17836fb, epistemic-graph/specs/typed-packs-and-catalog/requirements.md:90#sha256=e7a4994bdd6f87d858ad1f0425f24bf17a37858cacf8ff7a17402710367ec0bc`. Packet row: `spec-audit/reconciliation/repository-batches-20261012/arbora.json#/rows/20`. No implementation or runtime evidence is claimed. | Future Arbora tests must prove the owner behavior and cover every positive, refusal, and zero-effect case defined above. Retain all existing parent acceptance for IDs `AU-HARNESS-R011, ARBORA-FLEET-R002.1, SDK-CONNECTOR-CONTROL-R003, ARBORA-FLEET-R002.3, ARBORA-FLEET-R002.4, ARBORA-FLEET-R002.5, ARBORA-FLEET-R002.6, ARBORA-FLEET-R002.7, ARBORA-FLEET-R002.8`. Use the exact reviewed source paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-70.json, arbora/specs/fleet-catalog-and-tools/requirements.md:95#sha256=db0fa3fa0b8129adf0e47cedf251d23a4c1cefc8042c3ac0ce21e7f3bb4d4a18, arbora/specs/fleet-catalog-and-tools/requirements.md:96#sha256=23d0b06d0f5a5db82f6838576ae49df3ade434e07265b9fd59b668da21ee7fe5, arbora/specs/fleet-catalog-and-tools/requirements.md:97#sha256=43163d5f0ef5eecbf19d9746730b79dab2989926997bfae90551106cfdee5072, arbora/specs/fleet-catalog-and-tools/requirements.md:98#sha256=8adc75979cdeeb5df9df597b4bd56f6830450dd66c15b44046f4b8636ba1cc3b, agent-connector-sdk/specs/SDK-CONNECTOR-CONTROL/requirements.md:7#sha256=8cc97e7070b51629df4f13ac354b3b7185851f9d8dac025d84b2355f6e8c4e73, epistemic-graph/specs/typed-packs-and-catalog/requirements.md:40#sha256=a909288fc0cb3efe0ce849be7b743333bf57d3259fab9a7afaa71c3af17836fb, epistemic-graph/specs/typed-packs-and-catalog/requirements.md:90#sha256=e7a4994bdd6f87d858ad1f0425f24bf17a37858cacf8ff7a17402710367ec0bc`. This definition does not assert these tests have run.

**AU:98 Arbora definition slice.** AU:98 cross-owner slice. Residual: Skill upgrades preserve consuming-code compatibility; refuse breaking changes without declared migration. Arbora minimum action: Extend skill admission with previous/new consumer contract evidence and declared migration identity. Refuse an incompatible upgrade lacking migration before effects. Test compatible upgrade, breaking upgrade without migration and declared migration; require no compatibility wrapper. Producer/consumer boundary: Arbora R034.9 attaches skill/workflow certification to invoke before dispatch and EG provides selection/scoring. Neither side has a skill upgrade compatibility/migration receipt. External engine, SDK, AU, Pipelines or WebUI behavior remains owned there; this row specifies only Arbora. Current IDs: `none assigned in this packet`. Source record SHA-256: `531cb0ba1accd9e88833249fb253a9f5f7a3c1a911f653b3c9a5bfc42341f978`. Reviewed evidence paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-70.json, arbora/specs/fleet-catalog-and-tools/requirements.md:86#sha256=afdf1896106cee19135cc6b876362db14f84cf7dd619395dcd028b5207824aa7, arbora/specs/fleet-catalog-and-tools/requirements.md:83#sha256=9150856bf410b027f2982e1fa01999a597beeaead7b2663f54b7c2c997ce85bd, arbora/specs/fleet-catalog-and-tools/requirements.md:84#sha256=ea3d8a899ec58f50cb4164ff3cf4c55d3bb58ca68bac754804b7cf8ead075a81`. Packet row: `spec-audit/reconciliation/repository-batches-20261012/arbora.json#/rows/27`. No implementation or runtime evidence is claimed. | Future Arbora tests must prove the owner behavior and cover every positive, refusal, and zero-effect case defined above. Retain all existing parent acceptance for IDs `none assigned in this packet`. Use the exact reviewed source paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-70.json, arbora/specs/fleet-catalog-and-tools/requirements.md:86#sha256=afdf1896106cee19135cc6b876362db14f84cf7dd619395dcd028b5207824aa7, arbora/specs/fleet-catalog-and-tools/requirements.md:83#sha256=9150856bf410b027f2982e1fa01999a597beeaead7b2663f54b7c2c997ce85bd, arbora/specs/fleet-catalog-and-tools/requirements.md:84#sha256=ea3d8a899ec58f50cb4164ff3cf4c55d3bb58ca68bac754804b7cf8ead075a81`. This definition does not assert these tests have run.

**ARBORA:8 Arbora definition slice.** ARBORA:8 cross-owner slice. Residual: Reviewed producer requirements define neither the EG certification decision/attestation producer nor the qualified AU orchestration consumer. Arbora prerequisite rules cannot provide those missing producer contracts. Arbora minimum action: Define the minimal EG certification producer and AU orchestration consumer with existing R034 identity bindings. Then link them into R034.7-.12. Retain no-effect refusal and do not add host scoring authority. Producer/consumer boundary: EG selection/scoring/attestation -> AU configured-local-model orchestration -> Arbora invoke/agents.run attestation validation. Exact producer operations and receipts remain unbound. External engine, SDK, AU, Pipelines or WebUI behavior remains owned there; this row specifies only Arbora. Current IDs: `ARBORA-FLEET-R034.7, ARBORA-FLEET-R034.8, ARBORA-FLEET-R034.9, ARBORA-FLEET-R034.10, ARBORA-FLEET-R034.11, ARBORA-FLEET-R034.12`. Source record SHA-256: `5df3f5a45d486aeba5765a31b6c6283637adf2bd8ce63a87938eddd28b90f082`. Reviewed evidence paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-24-owner-supplements.json, spec-audit/writer-queue-merged/arbora.tsv:8, arbora/specs/fleet-catalog-and-tools/requirements.md:88#sha256=91b9cc728ad6b131157c7cf10a596469a77e83fd550f1eb59d50820715473df5, arbora/specs/fleet-catalog-and-tools/requirements.md:83#sha256=9150856bf410b027f2982e1fa01999a597beeaead7b2663f54b7c2c997ce85bd, arbora/specs/fleet-catalog-and-tools/requirements.md:84#sha256=ea3d8a899ec58f50cb4164ff3cf4c55d3bb58ca68bac754804b7cf8ead075a81, arbora/specs/fleet-catalog-and-tools/requirements.md:85#sha256=a89a31e12cbcbbe9ca8322df97e586e7ebfffb17de36a6f36c0ef676e0236e2a`. Packet row: `spec-audit/reconciliation/repository-batches-20261012/arbora.json#/rows/34`. No implementation or runtime evidence is claimed. | Future Arbora tests must prove the owner behavior and cover every positive, refusal, and zero-effect case defined above. Retain all existing parent acceptance for IDs `ARBORA-FLEET-R034.7, ARBORA-FLEET-R034.8, ARBORA-FLEET-R034.9, ARBORA-FLEET-R034.10, ARBORA-FLEET-R034.11, ARBORA-FLEET-R034.12`. Use the exact reviewed source paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-24-owner-supplements.json, spec-audit/writer-queue-merged/arbora.tsv:8, arbora/specs/fleet-catalog-and-tools/requirements.md:88#sha256=91b9cc728ad6b131157c7cf10a596469a77e83fd550f1eb59d50820715473df5, arbora/specs/fleet-catalog-and-tools/requirements.md:83#sha256=9150856bf410b027f2982e1fa01999a597beeaead7b2663f54b7c2c997ce85bd, arbora/specs/fleet-catalog-and-tools/requirements.md:84#sha256=ea3d8a899ec58f50cb4164ff3cf4c55d3bb58ca68bac754804b7cf8ead075a81, arbora/specs/fleet-catalog-and-tools/requirements.md:85#sha256=a89a31e12cbcbbe9ca8322df97e586e7ebfffb17de36a6f36c0ef676e0236e2a`. This definition does not assert these tests have run.

**The connector contract is established on first connect (rollup).** On first connect and on each `notifications/resources/list_changed`, the multiplexer reads the connector contract resources. They are `manifest://connector`, the ontology pack and the seed graph. arbora sends only changed resources to the engine. The engine imports ontologies (`EG-TYPED-PACKS-R103`) and seed graphs (`EG-TYPED-PACKS-R104`). arbora holds no validation rule. Children `.1` to `.6` deliver it. | See each child.

**Model.** Add `ConnectContract{connector, manifest_digest, ontology_digests, seed_digest, observed_at}` in `arbora/fleet/connect_contract.py`. Each digest is SHA-256 over the resource body. The record keeps the last digests per connector. Proving test: `tests/fleet/test_connect_contract.py::test_contract_record_round_trips`. | A round trip keeps every field and refuses a blank connector.

**Behavior.** The multiplexer reads the contract resources and compares each digest with the last record. It sends each changed ontology to `ImportOntology` and a changed seed graph to the seed import. An unchanged resource sends nothing. Repeated `list_changed` events within 2 s coalesce into one pass. Proving test: `tests/fleet/test_connect_contract.py::test_only_changed_resources_import`. | A second connect with one changed resource sends one import.

**Wiring.** The pass attaches in `onboard` at `arbora/fleet/onboarding.py:236`, after `capture` at line 254. The resource change subscription of the multiplexer client session triggers the same `onboard` pass. Proving test: `tests/fleet/test_connect_contract.py::test_list_changed_reaches_onboard`. | A served connect and a `list_changed` event both reach `onboard`.

**Refusal.** A connector without a seed resource must onboard without a seed and record `seed_absent`. An engine refusal must mark the connector `contract_rejected`, and arbora must admit none of its tools. A resource over 8 MiB must refuse with `CONTRACT_RESOURCE_TOO_LARGE` before any engine call. Proving test: `tests/fleet/test_connect_contract.py::test_contract_refusals`. | Each case records its reason, and a rejected connector serves no tools.

**Evidence.** The onboarding record must carry each resource digest and the engine receipt for each import. `find` status must report the contract state per connector. Proving test: `tests/fleet/test_connect_contract.py::test_status_reports_contract`. | The status read shows the digests and the engine receipts.

**Hot-path proof.** The entry point is a real connector process over MCP. The test connects it, changes its seed graph and emits `list_changed`. A served engine query must read the new catalog objects. Proving test: `tests/fleet/test_connect_contract_served.py::test_first_connect_and_list_changed_reimport_only_changed`. | The first connect imports all resources, and the change imports only the seed graph.

**Tools load per job from the engine answer (rollup).** A harness asks arbora what a job needs. arbora asks the engine for the load set (`EG-DECISION-ENGINE-R176`). arbora lazily loads only the answered tools into the caller session. It returns the answered skills and local agent starts. arbora computes no ranking. The session cap of `ARBORA-FLEET-R018` still applies. Children `.1` to `.6` deliver it. | See each child.

**Model.** Add `JobLoadRequest{job_text, required_capabilities}` and `JobLoadResult{loaded, over_cap, skills, agent_starts, decision_id}` in `arbora/fleet/job_loads.py`. Proving test: `tests/fleet/test_job_loads.py::test_job_load_round_trips`. | A round trip keeps every field and refuses an empty request.

**Behavior.** `find` with a job sends one load-set question to the engine. arbora loads the answered tools in answer order until the session cap. It reports the rest as `over_cap`. It loads nothing that the answer omits. Proving test: `tests/fleet/test_job_loads.py::test_loads_only_answered_tools`. | A 300-tool fleet loads only the answered tools.

**Wiring.** The `find` verb (`arbora/api/mcp/verbs.py:18`) routes a job request to `find_tools` (`arbora/fleet/multiplexer_ops.py:150`). It loads through `load_tools` at `arbora/fleet/multiplexer_ops.py:245`. Agent starts dispatch through the existing `act` delegation path. Proving test: `tests/fleet/test_job_loads.py::test_find_job_reaches_load_tools`. | A served `find` with a job reaches `load_tools`.

**Refusal.** An engine abstention must load nothing and return the abstention reason. An unreachable engine must return `decision_unavailable`. arbora must not fall back to its own ranking. Proving test: `tests/fleet/test_job_loads.py::test_job_load_refusals`. | Each case loads no tool and returns its reason.

**Evidence.** The result must carry the engine decision id and one premise reference per loaded tool. Proving test: `tests/fleet/test_job_loads.py::test_result_cites_decision`. | Each loaded tool names its decision premise.

**Hot-path proof.** The entry point is the served `find` intent tool over MCP. The test connects three fixture connectors with 300 tools and asks for a web search job. Proving test: `tests/fleet/test_job_loads_served.py::test_find_job_lazily_loads_answered_tools`. | The session lists only the answered search tools, and `tools/list_changed` fires once.

**One protocol stack with one implementation per role.** MCP and A2A each have a serving role and a consuming role. arbora owns MCP serving, A2A serving and the multiplexer MCP client. The SDK owns connector client transports and connector server scaffolding. A second implementation of one role is a defect. The role table is in `plan.md`. | An import-graph test fails when a arbora module implements a connector transport or connector server scaffolding.

**Domain pack reads compose engine methods.** A served read operation returns a domain pack for the human-resources, legal, medical or government domain. It composes `eg.storage.ConnectorPack`, `eg.reasoning.OntologyInspect` and `eg.reasoning.ShaclValidate`. Consumer: the legal, human-resources, medical and government skills. The operation holds no pack model, no store and no validator. The pack definition is `EG-TYPED-PACKS-R097`. Children `.1` to `.6` cover model, behavior, wiring, refusal, evidence and hot-path proof. | See each child.

**Model.** The operation declares one request, `{domain, version}`, and one result, `{pack_digest, classes, enumerations, shapes_verdict}`. It declares no other data structure. | A contract test lists the request and the result and fails on an extra field.

**Behavior.** The operation reads the pack through `ConnectorPack`, lists its classes through `OntologyInspect` and checks them through `ShaclValidate`. It returns the engine results unchanged. It adds no ranking and no cache. | A fixture test compares the result with the three engine responses.

**Wiring.** The registry serves the operation as an intent tool. A skill calls it and holds no copy of the pack. | A wiring test shows the served tool reaches the three engine methods.

**Refusal.** The operation refuses an unknown domain or version with the engine code. It refuses a caller outside the tenant. It never falls back to a local pack. | One refusal test per case asserts the stable code.

**Evidence.** The result carries the pack digest and the engine request ids of the three calls. | A test reads the digest and ids from the result.

**Hot-path proof.** The test calls the served tool over MCP for each of the four domains. The added latency over the three engine calls is at most 5 ms at p99. | `tests/fleet/test_domain_pack_served.py::test_domain_pack_read_composes_engine_methods`.

**Cross-repository composition boundary assignment.** Arbora composes its runtime gateway on top of boundary contracts in which the graph engine owns ontology, SHACL and durable graph records, the connector SDK owns connector transport, and the agent runtime exposes only its public agent control-plane API; the web UI consumes this composed boundary rather than any internal package. | An import-boundary census confirms each dependency is reached only through its published public API, enforced as a continuous-integration check.

**Arbora owns the MCP, REST and API serving code that agent-utilities 3.0.0 drops.** The agent runtime keeps only the harness. Arbora holds the served MCP backing surface in `arbora/mcp_server/backing/` (graph tools, server factory, tasks extension, intent contract, remote OAuth broker, client credentials). It holds the control-plane contracts and the single session port in `arbora/api/contracts/`. It holds WebUI contact and voice delegation in `arbora/webui_host/`. Arbora imports no agent runtime `mcp`, `gateway`, `server` or `api` module and requires `agent-utilities>=3.0.0,<4.0.0`. Child slice of `ARBORA-HOST-R001`. | `tests/test_package_layout.py::test_arbora_imports_no_au_serving_packages` finds no such import under `arbora/`.

**Arbora registers the harness host bindings at startup.** The `arbora` MCP entry point registers three bindings with `agent_utilities.host_ports`. The native toolset provider serves its operations through the governed `_execute_tool` path. The fleet catalog provider maps each server to its public prefix and URL from the served multiplexer. The session keepalive factory renews the session. Shutdown clears the bindings. Without them the harness fails closed. Child slice of `ARBORA-HOST-R001`. | `tests/mcp_server/test_harness_host.py` proves fail-closed before registration, bound tools, fleet and keepalive after it, and cleared bindings after shutdown.

**Arbora binds the run-loop providers at startup.** `bind_run_ports()` registers a run decision provider, a model provider and a run event sink with `agent_utilities.host_ports`. The engine serves no run-plan decision, so the decision provider returns the harness default plan over the Arbora model registry. The model provider builds an OpenAI-compatible model for a registry endpoint. The event sink writes each run event to the engine as a `RunEvent` node. `AgentRunPort` adapts the harness `AgentRunExecutor` to the Arbora agent execution port. A run without a model fails closed. Child slice of `ARBORA-HOST-R001.2`. | `tests/test_agent_runs.py` runs an agent through `AgentRunPort` with a fake model and checks the persisted run events. It also checks the registry model and the fail-closed run.

**A served agents.run call runs end to end.** The invoke pipeline admits the call and dispatches it to the A2A service. The A2A WorkItem authority admits one engine WorkItem through `arbora.work_items` and leases it. The harness `AgentRunExecutor` runs the agent, and the authority commits the outcome to the WorkItem. The run events reach the engine as `RunEvent` nodes. The idempotency key derives the task id, so the A2A authority owns replay for `agents.run`. Every `InvokeServices` that registers `agents.run` declares that owner. The served `arbora` factory runs an A2A `message/send` the same way. Child slice of `ARBORA-HOST-R001.2`. | `tests/test_agents_run_end_to_end.py` invokes `agents.run` with a fake model and a fake engine client. It also boots the served factory and posts `message/send` to `/a2a`. Each test checks the completed task, the committed outcome and the persisted run events.

**The served process mounts the operation-invoke API.** When `GRAPH_SERVICE_ENDPOINTS` names an engine, `mcp_server()` mints the process authority first and composes one `HostedInvocation`. The composition joins the generated registry and the bootstrap client factories over one engine client pool. It adds the control-lease plan store, the policy gate and a schema validator over the engine contract schemas. The web UI host calls `POST /api/v1/ops/<op_id>` on that API. `fleet.call` refuses until the served root composes the governed fleet operations. Child slice of `ARBORA-HOST-R001.2`. | `tests/test_served_operation_api.py` mounts the composed API the way the web UI co-service does. It calls `agents.run`, `query.uql` and `eg.graph.GetNodesByLabel` over HTTP and checks each value the web UI parses, and finds no `memory.*` operation. It also lists the served MCP intent verbs and runs `find`.

**Arbora ships the surface client as its generated client.** The typed REST client for the surface front ends is the generated client wheel that `scripts/gen_api.py` emits from the served registry. Arbora ships no hand-written gateway client. The stable application API facade lives in `arbora.api.contracts`. Child slice of `ARBORA-HOST-R001`. | `tests/deployment/test_generated_client_wheel.py` builds the generated client wheel and checks its contents.

**Provider plugin entry-point groups use the connector SDK namespace.** Arbora declares its bundled skills under `agent_connector_sdk.skill_providers` and its docs name the `agent_connector_sdk.*_providers` groups; it declares no `agent_utilities.*_providers` group. Child slice of `ARBORA-HOST-R001`. | `tests/deployment/test_arbora_deploy_artifacts.py` asserts the `agent_connector_sdk.skill_providers` entry-point group in `pyproject.toml`.

**The moved serving code keeps its tests and runs on FastMCP 4.** The tests of the MCP, API and gateway modules that Arbora took over live under `tests/mcp_server/backing/`, `tests/api/contracts/` and `tests/gateway/`. They import the Arbora paths. Arbora declares `fastmcp>=4` itself. Child slice of `ARBORA-HOST-R001`. | `tests/test_package_layout.py::test_arbora_declares_and_runs_fastmcp_4` checks the declared floor and the installed major version.

**Arbora publishes its operation registry as versioned data.** `arbora/mcp_server/arbora_operations.json` holds the schema version, digest, intent verbs, operations, tool verbs and supported features. `python -m arbora.mcp_server.operation_registry --write` generates it from the served tool specs. The harness skill validation reads this document. Child slice of `ARBORA-HOST-R001`. | `tests/mcp_server/test_operation_registry.py` proves the packaged document is current, names exactly the served operations and loads through the harness reader.

**Gate G-26: the served MCP surface is wired to epistemic-graph.** Every served `engine_<domain>` family resolves to an installed epistemic-graph client class. Every served method is an EG coroutine. `graph_query scope=uql` dispatches to the engine's `uql` method. Only the epistemic-graph planner plans natural-language queries (`nl_query`, `graph_ask`, `ask_data`). Each tool calls `QueryClient.nl_query` through the governed `engine_query` dispatch under `kg:read`. Arbora imports no local NL planner. Arbora refuses options that the engine planner cannot honor with `invalid_request`. Replaces agent-utilities certification gate G-26. Child slice of `ARBORA-HOST-R001`. | `tests/mcp_server/test_engine_wiring_gate.py` passes against the installed epistemic-graph, including the proof that each NL tool reaches only `engine_query.nl_query`.

**The tiny profile serves the graph with zero containers.** Arbora and the embedded engine run with no message broker, relational store or remote graph store. Children `.1` and `.2` cover the import footprint and the served graph. Child slice of `ARBORA-HOST-R001`. | See each child.

**The served surface imports no external-service driver.** A cold import of the gateway routes and the MCP server entry loads no broker client. It also loads no relational, labelled-property or remote RDF store client. Child slice of `ARBORA-HOST-R001.9`. | `tests/deployment/test_small_profile_footprint.py` checks the loaded modules in a clean interpreter.

**The tiny profile serves the graph with zero containers.** Arbora and the embedded engine cold-boot and serve graph reads and writes through the gateway routes with no external service. Child slice of `ARBORA-HOST-R001.9`. | A gateway test writes and reads one node against the embedded engine with no external service configured.

**Arbora owns provider discovery over the connector SDK groups.** `arbora.core.providers` discovers skill, prompt, ontology, source-connector and other data providers from the `agent_connector_sdk.<x>_providers` entry-point groups only, without importing provider code. It rejects ambiguous, unowned, linked or unrecorded provider assets. It refuses any `agent_utilities.*_providers` group. Arbora imports no `agent_utilities.core.providers`. The bounded-manifest and managed-generation primitives remain the harness install-tree contract. Child slice of `ARBORA-HOST-R001`. | `tests/core/test_providers.py` covers SDK-only groups, non-importing owned discovery, unsafe-target refusal, duplicate-owner refusal, skill and prompt resolution, and the import ban.

**Graph engine client exposes the session/discovery surface.** The engine client exposes session, engine, source-sync, shard-topology, fleet-catalog, and discovery-authority methods. Arbora gateway and fleet modules call those methods directly. Moving these modules from the agent runtime must not create another implementation. | A contract test checks the installed client before migration. It confirms every required method exists and is callable.

**Web UI rename cutover across Arbora.** Arbora's import sites, web UI package extra, preflight checks, and browser-control tests and docs reference the renamed package. The extra resolves from the package index. The release workflow checks out no web UI source. | A focused test run and the offline lock check confirm every reference resolves against the renamed package.

**Single gateway implementation under arbora/gateway.** Arbora retains one gateway implementation under `arbora/gateway/`, incorporating any behavior unique to the agent runtime's duplicate gateway package once that duplicate is removed, reconciling the `schemas/graph_core` and `ontology_api` modules against their counterparts, and dropping the `arbora-daemon` console script and the `gateway-widgets` package extra. | A package-layout test confirms no duplicate gateway implementation remains and the retired script and extra are absent.

**arbora.mcp_server.runtime serves retired MCP actions.** `arbora/mcp_server/runtime.py` serves every MCP action that the legacy agent-runtime MCP host provided. An approved action-to-operation mapping verifies each action. This applies once the legacy host is retired. | A parity test maps each served MCP operation to the approved registry. It confirms no action is dropped without a recorded mapping.

**Landed: the typed approved-mapping model.** `arbora/mcp_server/legacy_action_mapping.py` defines `APPROVED_ACTION_MAPPING`, `build_approved_action_mapping` and `validate_served_actions` (construction-time duplicate refusal, lookup-time unmapped-action refusal). `runtime.py` defines `served_legacy_actions_within_approved_mapping` over this table, but nothing calls it against the actual served MCP operation list yet. | Proven today by `tests/mcp_server/test_legacy_action_mapping.py`.

**Parity test proves no served action is dropped.** Rollup: the approved table covers six of the legacy host's actions; a parity test over the legacy host's full action surface fails today, so the table is extended per action family (`.2.1`-`.2.7`) and the parity test lands last (`.2.8`). Child slice of `ARBORA-HOST-R005`. | Satisfied when all `ARBORA-HOST-R005.2.n` children are verified.

**Approved mapping for the analyze action family.** Add an approved `ActionOperationMapping` entry for every legacy `graph_analyze` MCP action and REST twin. Include `code_context`, `explain`, `process_writeback`, `blast_radius`, and `call_graph`. List remaining actions too. Name each Arbora registry operation, or record that none exists yet. Child slice of `ARBORA-HOST-R005.2`. | Tests assert every family action appears in `APPROVED_ACTION_MAPPING`. They also assert each mapped operation resolves in the Arbora registry.

**Add arbora operation for code navigation actions.** Gap: no registry operation serves legacy `code_context`, `explain`, `call_graph`, `routes`; add the operation(s) under `arbora/api/ops/` and never invent an id before it exists. Child slice of `ARBORA-HOST-R005.2.1`. | Satisfied when the operation exists in the registry and a test bound to this ID proves it resolves.

**Add arbora operation for impact actions.** Gap: no registry operation serves legacy `blast_radius`, `change_coupling`; add it under `arbora/api/ops/`. Child slice of `ARBORA-HOST-R005.2.1`. | Satisfied when the operation exists in the registry and a test bound to this ID proves it resolves.

**Add arbora operation for `similar_code` and the remaining `graph_analyze` actions.** No registry operation serves `similar_code` or other unlisted `graph_analyze` REST twins. Enumerate these legacy actions, then add operation(s). Child slice of `ARBORA-HOST-R005.2.1`. | Satisfied when an operation exists in the registry and an ID-bound test proves it resolves.

**Add arbora operation for `process_writeback`.** Gap: no registry operation serves legacy `process_writeback` (the current table maps it to a non-registry id); add the operation and remap. Child slice of `ARBORA-HOST-R005.2.1`. | Satisfied when the operation exists in the registry and a test bound to this ID proves it resolves.

**Approve the analyze mappings.** Replace analyze entries in `APPROVED_ACTION_MAPPING` with real operation IDs from the children above. This covers the whole family under `ARBORA-HOST-R005.2.1`. | An ID-bound test checks each listed action in `APPROVED_ACTION_MAPPING`. It confirms every mapped ID exists in `{op.id for op in operations()}` from `arbora/api/ops/*.py`.

**Approved mapping for the configure action family.** Add an approved `ActionOperationMapping` entry for every legacy MCP action of `graph_configure`, `graph_config` and secret/hook/vault-sync actions, each naming the Arbora registry operation that serves it, or record that none exists as a gap to build. Child slice of `ARBORA-HOST-R005.2`. | A test asserts every legacy action of the family appears in `APPROVED_ACTION_MAPPING` and that each mapped operation resolves in the Arbora registry.

**Approved mapping for the ingest action family.** Add an approved `ActionOperationMapping` entry for every legacy MCP action of `graph_ingest`, `graph_jobs` and knowledge-pack/corpus/materialize actions, each naming the Arbora registry operation that serves it, or record that none exists as a gap to build. Child slice of `ARBORA-HOST-R005.2`. | A test asserts every legacy action of the family appears in `APPROVED_ACTION_MAPPING` and that each mapped operation resolves in the Arbora registry.

**Map `sync` to `ingest.sources.sync`.** The only legacy ingest action with an existing registry operation: add `ActionOperationMapping("sync", "ingest.sources.sync")` with a bound resolution test. Child slice of `ARBORA-HOST-R005.2.3`. | Satisfied when the mapping is in the table and a bound test proves the id resolves.

**Add arbora operation for ingest submission actions.** Gap: no registry operation serves legacy `ingest`, `ingest_url`, `ingest_knowledge_pack`, `fact_extract`, `distill`; add the operation(s) and remap the existing non-registry `ingest_knowledge_pack` entry. Child slice of `ARBORA-HOST-R005.2.3`. | Satisfied when the operation exists in the registry and a test bound to this ID proves it resolves.

**Add arbora operation for `corpus`.** Gap: no registry operation serves this legacy action. Child slice of `ARBORA-HOST-R005.2.3`. | Satisfied when the operation exists in the registry and a test bound to this ID proves it resolves.

**Add arbora operation for job lifecycle actions.** Gap: no registry operation serves legacy `jobs`, `job_status`, `cancel`, `clear`, `prioritize`. Child slice of `ARBORA-HOST-R005.2.3`. | Satisfied when the operation exists in the registry and a test bound to this ID proves it resolves.

**Add arbora operation for `rebuild_indexes` and `observe`.** Gap: no registry operation serves these legacy actions. Child slice of `ARBORA-HOST-R005.2.3`. | Satisfied when the operation exists in the registry and a test bound to this ID proves it resolves.

**Add arbora operation for `materialize` and `materialize_source`.** Gap: no registry operation serves these legacy actions. Child slice of `ARBORA-HOST-R005.2.3`. | Satisfied when the operation exists in the registry and a test bound to this ID proves it resolves.

**Add arbora operation for `reflect` and `agent_toolkit`.** Gap: no registry operation serves these legacy actions. Child slice of `ARBORA-HOST-R005.2.3`. | Satisfied when the operation exists in the registry and a test bound to this ID proves it resolves.

**Approve the ingest mappings.** Extend `APPROVED_ACTION_MAPPING` with every ingest action using the real ids from the children above, then the whole family is covered. Child slice of `ARBORA-HOST-R005.2.3`. | A test bound to this ID asserts the listed actions appear in `APPROVED_ACTION_MAPPING` and that each mapped operation id is in `{op.id for op in operations()}` from `arbora/api/ops/*.py`.

**Approved mapping for the query-memory action family.** Add an approved `ActionOperationMapping` entry for every legacy MCP action of `graph_query`, `graph_memory` and `graph_write` memory/recall/SDD actions, each naming the Arbora registry operation that serves it, or record that none exists as a gap to build. Child slice of `ARBORA-HOST-R005.2`. | A test asserts every legacy action of the family appears in `APPROVED_ACTION_MAPPING` and that each mapped operation resolves in the Arbora registry.

**Approved mapping for the orchestrate action family.** Add an approved `ActionOperationMapping` entry for every legacy MCP action of `graph_orchestrate`, `graph_loops`, `graph_agents`, `graph_goals` and `graph_evolution` actions, each naming the Arbora registry operation that serves it, or record that none exists as a gap to build. Child slice of `ARBORA-HOST-R005.2`. | A test asserts every legacy action of the family appears in `APPROVED_ACTION_MAPPING` and that each mapped operation resolves in the Arbora registry.

**Approved mapping for the mine-learn action family.** Add an approved `ActionOperationMapping` entry for every legacy MCP action of `graph_mine`, `graph_mine_deep`, `graph_learn` and `graph_evaluate` actions, each naming the Arbora registry operation that serves it, or record that none exists as a gap to build. Child slice of `ARBORA-HOST-R005.2`. | A test asserts every legacy action of the family appears in `APPROVED_ACTION_MAPPING` and that each mapped operation resolves in the Arbora registry.

**Approved mapping for the governance-ops action family.** Add an approved `ActionOperationMapping` entry for every legacy MCP action of the remaining legacy tool families (`graph_audit`, `graph_governance`, `graph_compliance`, `graph_bus`, `graph_message`, `graph_ontology`, `graph_incident` and others), each naming the Arbora registry operation that serves it, or record that none exists as a gap to build. Child slice of `ARBORA-HOST-R005.2`. | A test asserts every legacy action of the family appears in `APPROVED_ACTION_MAPPING` and that each mapped operation resolves in the Arbora registry.

**Parity test over the full legacy action surface.** Add the parity test enumerating every action the legacy agent-runtime MCP host registers and asserting each is in `APPROVED_ACTION_MAPPING` with a resolvable operation; depends on `.2.1`-`.2.7`. Child slice of `ARBORA-HOST-R005.2`. | The parity test fails when any legacy action is removed from the mapping or its operation stops resolving.

**arbora.fleet is the sole multiplexer and host owner.** Arbora's `arbora/fleet/` package is the sole multiplexer implementation and additionally hosts the OAuth broker, task-extension, principal, harness-server, middleware, skill-coverage and environment-drift-check modules that only Arbora imports. | A package-layout test confirms the duplicate multiplexer no longer exists outside `arbora/fleet/` and each moved module resolves only through Arbora imports.

**Agent runtime imported only through its public API.** Arbora imports the agent runtime exclusively through `agent_utilities.api`, with every other import site rewired to a Arbora-owned module or the connector SDK's public interface, and `arbora/tests/test_package_layout.py` enforces this as an `agent_utilities.api`-only fence. | The package-layout test fails on any import of an agent-runtime module outside `agent_utilities.api` and passes once the rewiring is complete.

**Landed: none of the fence exists yet.** `arbora/tests/test_package_layout.py` does not exist; `arbora/mcp_server/runtime.py` and other modules still import `agent_utilities.core.config`, `agent_utilities.security.*`, `agent_utilities.messaging.*`, `agent_utilities.usage.*` and `agent_utilities.observability.*` directly rather than through `agent_utilities.api`. | No test exists today; confirmed by `git grep -n "^from agent_utilities\." arbora/`.

**Add the import-fence test (rollup of `ARBORA-HOST-R007.2.1` to `ARBORA-HOST-R007.2.69`).** Add `arbora/tests/test_package_layout.py`, asserting via an import census over `arbora/` that no module imports `agent_utilities` except through `agent_utilities.api` (an initial allowlist of today's known violations is acceptable so the test lands green, shrinking as each site is rewired). | `arbora/tests/test_package_layout.py` exists, runs under `uv run pytest`, and fails if a new non-`agent_utilities.api` import is added outside the allowlist.

**Rewire `arbora/a2a/authority.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/a2a/authority.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/a2a/routing.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/a2a/routing.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/access/service.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/access/service.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/agent_host/__init__.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/agent_host/__init__.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/api/http/auth.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/api/http/auth.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/api/mcp/serving.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/api/mcp/serving.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/api/ops/access.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/api/ops/access.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/api/policy/pdp_remote.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/api/policy/pdp_remote.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/browser_control/browser_control_binding.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/browser_control/browser_control_binding.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/browser_control/browser_control_dispatch.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/browser_control/browser_control_dispatch.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/browser_control/browser_control_durability.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/browser_control/browser_control_durability.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/browser_control/browser_control_outcome.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/browser_control/browser_control_outcome.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/browser_control/browser_control_policy.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/browser_control/browser_control_policy.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/browser_control/browser_control_provenance.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/browser_control/browser_control_provenance.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/browser_control/browser_control_service.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/browser_control/browser_control_service.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/browser_control/browser_control_state.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/browser_control/browser_control_state.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/browser_control/trace_bundle.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/browser_control/trace_bundle.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/deployment/cli.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/deployment/cli.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/deployment/config_generator.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/deployment/config_generator.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/deployment/doctor_certification.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/deployment/doctor_certification.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/deployment/doctor_coverage.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/deployment/doctor_coverage.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/deployment/doctor_lakehouse.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/deployment/doctor_lakehouse.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/deployment/doctor_observability.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/deployment/doctor_observability.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/deployment/doctor.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/deployment/doctor.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/deployment/genesis_environments.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/deployment/genesis_environments.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/deployment/preflight.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/deployment/preflight.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/deployment/production_ops.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/deployment/production_ops.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/deployment/release_canary.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/deployment/release_canary.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/deployment/release_candidate.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/deployment/release_candidate.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/deployment/self_deploy.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/deployment/self_deploy.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/fleet/access_contracts.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/fleet/access_contracts.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/fleet/child_resilience.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/fleet/child_resilience.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/fleet/gateway_ops.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/fleet/gateway_ops.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/fleet/local_skill_catalog.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/fleet/local_skill_catalog.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/fleet/multiplexer.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/fleet/multiplexer.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/fleet/onboarding.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/fleet/onboarding.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/gateway/aggregator.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/gateway/aggregator.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/gateway/config.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/gateway/config.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/gateway/daemon.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/gateway/daemon.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/gateway/dashboard_api.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/gateway/dashboard_api.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/gateway/fleet_events.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/gateway/fleet_events.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/gateway/fleet.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/gateway/fleet.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/gateway/graph_api.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/gateway/graph_api.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/gateway/rate_limit.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/gateway/rate_limit.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/gateway/remote_oauth_api.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/gateway/remote_oauth_api.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/gateway/schemas/graph_core.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/gateway/schemas/graph_core.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/gateway/usage_api.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/gateway/usage_api.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/gateway/widgets/base.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/gateway/widgets/base.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/gateway/widgets/ollama.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/gateway/widgets/ollama.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/gateway/widgets/vector_db.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/gateway/widgets/vector_db.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/mcp_server/bootstrap.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/mcp_server/bootstrap.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/mcp_server/composition.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/mcp_server/composition.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/mcp_server/decide_wiring.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/mcp_server/decide_wiring.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/mcp_server/runtime.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/mcp_server/runtime.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/mcp_server/server.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/mcp_server/server.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/messaging/alert_intake.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/messaging/alert_intake.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/messaging/backends/mattermost.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/messaging/backends/mattermost.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/messaging/backends/telegram.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/messaging/backends/telegram.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/messaging/governed_send.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/messaging/governed_send.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/messaging/lease.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/messaging/lease.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/messaging/polling.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/messaging/polling.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/messaging/reach.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/messaging/reach.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/messaging/registry.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/messaging/registry.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/messaging/router.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/messaging/router.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/messaging/service.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/messaging/service.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/observability/gateway_health.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/observability/gateway_health.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/semantic_content.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/semantic_content.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Rewire `arbora/webui_host/webui_co_service.py` off agent-runtime internals.** Child slice of `ARBORA-HOST-R007.2`. Every `agent_utilities` import in `arbora/webui_host/webui_co_service.py` other than `agent_utilities.api` is rewired to a Arbora-owned module, the connector SDK public interface, or `agent_utilities.api`; no allowlist entry. | A focused test for the module passes and a grep of the module shows no `agent_utilities` import outside `agent_utilities.api`.

**Add the `agent_utilities.api`-only import-fence test.** Final child of `ARBORA-HOST-R007.2`, blocked until `ARBORA-HOST-R007.2.1` to `ARBORA-HOST-R007.2.68` land. `tests/test_package_layout.py` walks every `arbora/**/*.py` AST and fails on any `agent_utilities` import other than `agent_utilities.api`, with no allowlist or baseline. | The fence test passes against the rewired tree and fails when a non-api `agent_utilities` import is injected into a fixture module.

**Arbora hosts its own boundary modules.** Arbora hosts its own security request-identity, error-surface, browser-auth and security-policy-middleware modules with their conformance tests; its own gateway and runtime health and metrics observability; its own profile-guard, install, release-channel, live-mount-guard, paths, workspace and config-admin core modules; its own hook-installer, agent-manager-dashboard, release-catalog and gateway-client modules; and its own connection-registry and engine-discovery modules under `arbora.fleet`. | A package-layout census confirms these modules are imported only from their Arbora location and the agent runtime no longer declares equivalents.

**Arbora hosts the agent HTTP server and A2A endpoints.** Arbora hosts the agent HTTP server under `arbora/a2a/` and `arbora/webui_host/`, including the A2A, A2A-config and A2A-graph-skill protocol modules migrated from the agent runtime; the duplicate broker and its separate task store are not ported, since durable task state has a single owner. The editor-facing Agent Client Protocol is provided by the agent runtime's harness integration, so Arbora carries no ACP adapter of its own and mounts that implementation where a deployment exposes it. | Route and task-lifecycle tests cover the hosted A2A endpoints, and a source check confirms Arbora contains no separate ACP adapter implementation.

**Arbora owns hosting/deployment configuration settings.** Arbora owns the hosting and deployment configuration settings split out of the agent runtime's monolithic configuration module, while connector base settings move to the connector SDK's own configuration module and agent/model settings remain with the agent runtime. | A configuration-schema test confirms Arbora resolves its hosting and deployment settings from its own module. It must not import the agent runtime's configuration internals.

**Arbora serves the messaging channel and routing layer.** Arbora serves the messaging channel adapters, listener, service, daemon, polling, reaper and host routing for the agent bus, while the graph engine remains the sole authority for durable message append, reads, cursors, dead letters and depth. Superseded-by: the supervision-lifecycle detail (states, transitions, health-gated start, restart backoff bounds, stop/drain, typed degraded state for a missing adapter) is specified in [`ARBORA-MESSAGING-001`](../messaging-channel-supervision/spec.md) (`ARBORA-MESSAGING-R001`–`R005`); this row's broader ownership claim is kept. | A served test exercises a messaging action through Arbora and confirms the graph engine records the durable result exactly once.

**Component registry carries Arbora and SDK boundary entries.** Arbora publishes boundary seed entries for itself and the connector SDK in the architecture component registry. Each names its owning modules and public import surface. | A registry-completeness check confirms Arbora and the connector SDK each have a registry entry with no coverage gap.

**Front ends import only public Arbora/agent-runtime surfaces.** Arbora's web UI package imports the agent runtime only through `agent_utilities.api`, directly from Arbora, or from the graph engine's client library, with no import of an agent-runtime-internal module. | A package-layout test on the web UI package fails on any import outside these allowed surfaces.

**Agent runtime split into connector SDK, Arbora and engine.** The former runtime is split into three repositories: connector SDK, Arbora, and graph engine. Each repository publishes an installable package. Arbora depends on the others only through public APIs. | Arbora's dependency manifest pins those published packages. It does not use paths into the former combined source tree.

**Layered agent capability model with a harness abstraction.** Arbora defines a layered agent-capability model, from its lowest to its highest defined layer, implemented over the graph engine, together with a harness abstraction that lets a given layer run under different execution environments. | A conformance test suite exercises each defined layer through the harness abstraction and confirms its expected behavior boundary.

**main branch includes the published dependency composition.** Arbora's default branch history includes the published composition of the graph engine, connector SDK and agent runtime dependencies, so later changes build on that composition rather than reverting behind it. | A git ancestry check in continuous integration confirms the published composition commit remains reachable from the default branch.

**Browser inventory lists native Arbora tools.** The WebUI inventory helper lists the native `arbora` server from its registered tool surface. It never probes `arbora` as a catalog child. | `tests/webui_host/test_native_mcp_delegation.py` lists the registered native tools and fails when a child probe runs.

**Browser catalog reads run under the process authority.** The enhanced catalog binds the Arbora process session for each engine read. Its receipts name that process context. A failed read logs its cause before the masked 503. | `tests/gateway/test_enhanced_catalog_api.py` proves the read runs inside the process scope and logs the denial cause.

**Arbora serves the service dashboard surface the web UI composes.** Arbora mounts `/api/dashboard/*` and the `/ws/dashboard` stream through its gateway route registrar. The routes run behind the same identity and web UI authorization middleware as other `/api` routes. The stream sends a snapshot, then periodic updates, and honors a `subscribe` message. | A route-mount test confirms `/api/dashboard/full`, `/health`, `/daemon/status`, `/daemon/shards` and `/ws/dashboard`. A stream test confirms snapshot, update and subscription scoping.

**Serving start installs the decide consumers.** Arbora installs the library-bound assembler, the task planner and the cross-source report at serving start. The assembler and planner bind the bootstrap session's engine client. The cross-source report binds the fleet virtual catalog and an engine SPARQL ontology provider. A missing input logs a reason and skips that consumer. A fault never stops serving. | `tests/mcp_server/test_decide_wiring.py` proves all three installs with fakes. It proves each guarded skip.

**Serving start binds the assembler's commit and publish providers and installs the topology asker.** Arbora mints an `AgentLibraryMutationContext` from the verified bootstrap session's identity and tenant, and binds it as the assembler's `commit_context` and `publish_context` (AU `agent_utilities.decide.consumers.assembly`, mapping to EG's `DecisionCommit` and `AgentGraph.publish`, EG-DECISION-ENGINE-R047/R051). Serving start also installs the topology asker over the published reference templates, the same way it installs the task planner. A missing input logs a reason and skips that consumer. | `tests/mcp_server/test_decide_wiring.py` proves the topology asker installs alongside the planner, and proves a solved assembly commits and publishes through a fake engine client that records each call.

**Serving start binds the task planner's capability-search, guardrail and workflow lookups.** Arbora binds the planner's `capability_search` to the served EG agent-card search, `guardrail_source` to one side-effect-free AU action-policy verdict per planned task, and `workflows` to the registered graph-workflow store's semantic match over the planned tasks (AU `agent_utilities.decide.consumers.task_planner`, `agent_utilities.layers.clients.AgentClient`, `agent_utilities.orchestration.action_policy`, `agent_utilities.knowledge_graph.workflow_store`). A missing input logs a reason and skips that consumer. | `tests/mcp_server/test_decide_wiring.py` proves the three lookups are bound at serving start, and proves a planned task gets non-empty assembled agent skills and tools with a fake capability source populating its reuse metadata.

**Arbora serves its eight-tool MCP intent surface from its own operation registry.** `arbora/api/mcp` serves eight tools: `ask`, `find`, `why`, `write`, `act`, `manage`, `graph_task_progress_app`, and `graph_trace_waterfall_app`. The agent runtime serves no MCP tools. It supplies only the library registrar Arbora uses for both app launchers. Arbora includes ranking and its deterministic tie-break. It merges fleet discovery into `find` and routes fleet child calls through `act`. Natural-language `ask` falls back only when no registry operation matches, using the visible registered `query.nl` operation under `query:nl` through the shared invocation pipeline. No synthetic descriptor or direct fallback callable grants an alternate path. | Tests register a real `FastMCP` surface and compare all eight names. Another test dispatches through the policy/Eunomia invocation pipeline. A third proves the `ask` fallback runs only when no operation matches.

**`arbora.mcp_server.server` registers Arbora's own intent surface, not the agent runtime's.** Serving start calls `arbora.api.mcp.serving.register_intent_surface` instead of the agent runtime's `agent_utilities.mcp.arbora_surface.register_arbora_surface`/backing-server path. | `python3 scripts/check_wiring.py unreachable` lists fewer unreached `arbora.api.{mcp,invoke,ops,policy}` modules after this change than before it; the exact before/after counts are recorded as PR evidence.

**The agent runtime's MCP serving stack is removed.** Once `ARBORA-HOST-R024` lands, the agent runtime deletes `agent_utilities/mcp/tools/intent_tools.py`, `agent_utilities/mcp/arbora_surface.py`, and the `kg_server` MCP serving entry point that only Arbora called; the library functions those modules called (the harness, the control plane and the KG clients) are retained and stay reachable from Arbora's own registry operations. | A grep-based import census over Arbora confirms no remaining import of the deleted modules, and the agent runtime's test suite passes with them absent.

**Durable A2A task persistence in the arbora agent host.** Rollup of `ARBORA-HOST-R026.1` to `.5`; unblocks `AU-BOUNDARY-R015.2`. | All child rows are verified.

**Define the typed A2A task-store port.** Add `A2ATaskStore` Protocol (get, put, list, cancel by tenant and principal) in `arbora/a2a/task_store.py`. Unblocks `AU-BOUNDARY-R015.2` (replaces AU `protocols/a2a_epistemic.py`). | A type-check test confirms a fake store satisfies the Protocol.

**Implement the engine-backed A2A task store.** Add `EngineA2ATaskStore` implementing `A2ATaskStore` over the public engine client, with no second task store. Unblocks `AU-BOUNDARY-R015.2`. | A focused test persists and reloads a task through a stubbed engine client.

**Wire the hosted A2A app to the task store, fail-closed when absent.** The hosted A2A app in `arbora/a2a/` takes the `A2ATaskStore` at composition and refuses task methods with a typed error when none is bound. Unblocks `AU-BOUNDARY-R015.2`. | A test confirms task submit is refused with no store and succeeds with one.

**Add the doctor check for A2A task persistence.** Add a arbora doctor check `a2a_persistence` reporting whether the task store is bound and durable, replacing AU's check of the same name. Unblocks `AU-BOUNDARY-R015.2`. | A doctor test reports failure with no store and pass with the engine-backed store.

**Point the `g34-a2a` certification gate at arbora tests.** The `g34-a2a` gate runs arbora `tests/a2a/` task-persistence tests instead of AU's. Unblocks `AU-BOUNDARY-R015.2`. | The gate definition names arbora test paths and passes on main.

**Loopback OIDC authority for skill certification.** Rollup of `ARBORA-HOST-R027.1` to `.3`; unblocks `AU-BOUNDARY-R002.3.1`. | All child rows are verified.

**Add the loopback OIDC authority owner module for skill certification.** Add `arbora/certification/oidc.py` serving loopback-only OIDC discovery, JWKS and token endpoint, replacing AU `deployment/certification_oidc.py`. Unblocks `AU-BOUNDARY-R002.3.1`. | A test confirms discovery and JWKS respond on loopback and the module refuses a non-loopback bind.

**Add the loopback OIDC authority test fixture.** Add a pytest fixture in `tests/certification/conftest.py` that starts and stops the authority and mints a signed token. Unblocks `AU-BOUNDARY-R002.3.1`. | A test uses the fixture to mint a token that verifies against the served JWKS.

**Add the loopback OIDC authority script.** Add `scripts/certification_oidc.py` launching the owner module for skill certification runs. Unblocks `AU-BOUNDARY-R002.3.1`. | The script starts, serves discovery, and exits cleanly on signal in a test.

**Bump the pinned agent-utilities source for the new `agent_utilities.api.*` export modules.** Advance the agent-utilities ref in `.github/workflows/release.yml` and the uv sources and lock so `persistence_privacy`, `orchestration`, `work_durability`, `agent_dispatch`, `trace_ontology`, `action_policy` and `elevation` import. Unblocks `ARBORA-HOST-R007.2.1`, `ARBORA-HOST-R007.2.2` and `ARBORA-HOST-R007.2.3`. | A test imports each of the seven `agent_utilities.api` modules and the lock and release pins name one ref.

**Tenant-bound native desktop actions.** Require a verified caller's tenant-bound sandbox grant. Background click, type, and verification cannot capture or change cursor/focus. Attach through `arbora/api/invoke/pipeline.py:invoke` and `arbora/api/invoke/executor.py:BoundOperationRuntime.dispatch` (line 273). `OperationRuntime.dispatch` is only a protocol. The SDK native-desktop port/provider contract is missing. Keep this capability unavailable until that owner contract is published. | Future acceptance: `tests/api/test_agent_browser_ops.py::test_native_desktop_actions_require_verified_grant_without_focus_capture`. Compose the runtime and invoke through the real pipeline and `BoundOperationRuntime.dispatch`. Verify valid grants reach the provider with request-bound verification. Missing, revoked, or cross-tenant grants must refuse before provider calls. Confirm cursor and focus remain unchanged. The proposed test has not run.

**Run-bound visual state.** Preserve source/frame/revision provenance for each typed observation within a run. Bind reusable perception state to identity, tenant scope, lifetime, invalidation, and retention rules. Later spatial steps consume prior state. Stale or cross-tenant state refuses before dispatch. Attach at `arbora/api/invoke/pipeline.py:invoke` and real `arbora/api/invoke/executor.py:BoundOperationRuntime.dispatch` (line 273); `OperationRuntime.dispatch` is only a protocol. The SDK observation producer and EG state/context contracts remain unassigned. Do not add a local state store. | Future acceptance: `tests/api/test_agent_browser_ops.py::test_visual_state_is_run_source_and_tenant_bound`. Compose the runtime and traverse the real pipeline and `BoundOperationRuntime.dispatch`. Verify sequential reuse within one run and source/frame/revision provenance. Verify invalidation after expiry or source change. Cross-tenant or stale state must refuse before dispatch. The proposed test has not run.

**Coding-agent discovery and sandbox handoff.** Discover coding agents on `PATH`. Apply the EG-selected skill transformation through the AU harness. Render generated artifacts only in the WebUI sandboxed frame. Arbora owns the host/admission boundary at `arbora/mcp_server/server.py:mcp_server`. EG, AU, and WebUI producer/consumer contracts remain unbound. Keep the complete flow unavailable until those owner ports are published. | Future acceptance: `tests/mcp_server/test_composition.py::test_coding_agent_flow_uses_owner_ports_and_sandbox`. Verify discovery identifies the selected executable. Verify the AU harness receives the EG-selected transformation. Verify WebUI renders only generated artifacts in its sandbox. Missing owner contracts or unavailable executables must refuse without dispatch or rendering. The proposed test has not run.

**Preserve configuration ownership.** Model: Hosting and deployment settings retain their current owner. Behavior: Preserve every original R010 boundary, including connector and model configuration ownership. Wiring: Reuse `arbora/core/config_admin.py:51`; import only public owner contracts. Refusal: No runtime configuration internals may become a host dependency. Evidence: Retain the original configuration-schema acceptance alongside the new startup cases. | The original R010 schema test remains required. A forbidden private import fails the boundary check.

**Declare every consumed environment name.** Model: `HostEnvironmentManifest` contains version, component, source revision and uniquely named declarations. Behavior: Each declaration records type, required condition, default, sensitivity and consuming call sites. Include indirect library reads. Wiring: Extend the existing configuration loader; compose public SDK and agent-runtime declarations without copying their settings. Refusal: Undeclared reads, conflicting declarations and unavailable enabled-component manifests prevent startup. Evidence: Record the manifest digest and missing declaration names without values. | A census matches all consumed names to declarations. Inject a dynamic undeclared read and require a named startup refusal.

**Validate before any service starts.** Model: `HostStartupConfiguration` binds the manifest digest, selected components and resolved typed settings. Behavior: Resolve existing configuration precedence once, then validate every enabled component before opening listeners or starting children. Wiring: Attach validation before `runtime._build_server` in `arbora/mcp_server/server.py:164`. Refusal: Missing required or malformed values refuse with component, variable name and reason; never include the value. Evidence: Record the configuration digest and zero listener, child-process and deployment effects on refusal. | The real launcher accepts valid configuration. Missing values, malformed ports and unknown profiles produce named refusals before any start.

**Keep conditional configuration precise.** Model: Declarations distinguish required, optional and conditionally required values. Behavior: Validate enabled dependencies and explicit defaults. An unrelated disabled component does not require credentials. Wiring: Use the selected component plan and the existing configuration resolver; no ambient environment grants authority. Refusal: An unresolved condition or invalid default refuses rather than silently choosing another profile. Evidence: Record each selected condition and default identifier without secret material. | Enable and disable a controlled component. Its missing credential refuses only when required; an invalid default always refuses.

**Bind environment guidance to declarations.** Model: A declaration digest binds the server configuration example and both transport examples. Behavior: Generate example names from the same manifest; document defaults and required conditions with secret placeholders. Wiring: Use ARBORA-DEPLOY-R010 guidance checks for the skill, README and documentation. Refusal: A consumed name missing from configuration or examples fails conformance. Evidence: Record manifest and example digests, never live configuration. | Parse both documented transport configurations and compare their names with the manifest. Inject an omitted name and require failure.

**Prove startup validation through the launcher.** Model: An isolated process fixture records sockets, child starts and safe diagnostics. Behavior: Exercise real startup with valid settings and every refusal class before accepting traffic. Wiring: Proposed `tests/host/test_launch_configuration_served.py` invokes the installed Arbora launcher with controlled dependencies. Refusal: A helper-only test cannot establish startup ordering or complete consumed-name coverage. Evidence: Bind source revision, manifest digest, process exit, observation counts and redacted diagnostics. | Repeat valid and invalid runs after restart. A refused start starts zero children and opens zero listeners; valid startup serves a probe.

**Preserve every boundary module.** Model: The original parent remains the complete contract. Behavior: Preserve all R008 security, gateway, observability, core, installer, dashboard, catalog, registry and discovery ownership obligations. Wiring: Use the original package-layout census across every module named by R008. Refusal: New child evidence cannot replace any original acceptance obligation. Evidence: Retain the original parent receipts and require its complete acceptance. | The original census proves every named module has its Arbora owner and no agent-runtime equivalent remains.

**Detect installed harnesses without effects.** Model: `HarnessInstallation` binds adapter ID, supported version, detected executable, configuration root and detection evidence. Behavior: Inspect supported local installation markers before preparing any tool, instruction or hook change. Wiring: Extend `deployment/cli.py:134` and its existing registration path; generic detection adapters are missing. Refusal: Ambiguous roots, unsupported versions and unknown adapters refuse; an absent harness creates no files. Evidence: Return the detected set and reasoned refusals without private file contents. | Run the installer against mixed present, absent and malformed harness fixtures. Absent roots and existing unrelated bytes remain unchanged.

**Bind exact harness configuration changes.** Model: `HarnessConfigurationChange` binds detected installation, before digest, proposed digest, managed keys and authorized destination. Behavior: Prepare tool entries, instruction sections and supported pre-tool hooks for each detected harness. Wiring: Reuse the existing registration command; add versioned format adapters behind the same installer boundary. Refusal: An unsupported hook capability is reported explicitly. It never causes a fabricated hook or another harness format. Evidence: The reviewable change lists each supported artifact and each unsupported capability. | Invoke the installer for a supported fixture and parse all three artifacts. An unsupported hook reports its limitation without a hook file.

**Apply harness edits without overwriting unrelated content.** Model: Each managed artifact retains its original digest and configuration ownership marker. Behavior: Validate every destination before mutation; conditionally replace only the reviewed managed sections. Repeated identical installation changes no bytes. Wiring: The Arbora installer owns local configuration edits; governed remote source changes remain SDK effects. Refusal: Changed bases, symlink escapes, malformed configuration and conflicting keys refuse before replacing that artifact. Evidence: Record actual before and after digests, including partial outcomes after an interrupted multi-file application. | Seed unrelated keys and instructions. Check preservation, idempotence, stale-base refusal and recovery without falsely reporting all artifacts installed.

**Prove detected-harness installation.** Model: An isolated home contains two supported installations and one absent harness. Behavior: Run the actual installer, then use each harness configuration parser and controlled hook invocation. Wiring: Proposed `tests/deployment/test_harness_install_served.py` enters the installed configuration command. Refusal: Helper-only detection and successful file writes do not prove valid tool entries or executable hook configuration. Evidence: Record detected versions, parsed configuration, hook observations and untouched-file digests. | Discover the configured MCP tool through a real client. Prove valid instructions and hook dispatch; absent harnesses receive zero writes.

**Preserve hosted protocols and task authority.** Model: The original parent remains the complete contract. Behavior: Retain HTTP and all original A2A protocol migration, task-lifecycle and externally owned ACP obligations. Add no broker or task store. Wiring: Keep the original route and task-lifecycle tests plus the ACP source census. Refusal: New child evidence cannot replace any original acceptance obligation. Evidence: Retain the original parent receipts and require its complete acceptance. | The complete original R009 acceptance remains required alongside terminal start and log acceptance.

**Select terminal web or combined start.** Model: `HostLaunchRequest` carries schema version, workspace, interface selection and log-view preference. Behavior: `--terminal` selects terminal mode; `--web` selects web mode; both select both. Keep existing behavior when neither appears. Wiring: Extend `agent_host/__init__.py:192` and the owning start parser; a public terminal-client adapter is a prerequisite. Refusal: Unknown modes, missing requested clients and invalid workspace bindings refuse before host startup. No `--cli` alias is introduced. Evidence: Record selected interfaces, host instance, workspace binding and actual client readiness. Additional binding: Resolve the effective web_logs boolean before the authenticated R009.5 handoff to run_host_terminal and HostLogReader.read under TUI-RUNTIME-R002.2 through R002.4. Bind host, workspace, tenant and principal. Disabled logs and every web-only case make zero TUI reads without disabling the host sink. Missing runtime preference binding cannot claim log readiness. | Start terminal, web and both through the real command. Observe the requested clients only; missing terminal support yields a typed refusal.

**Check injected startup admission.** Require an explicit host.start grant and a trusted owner attestation binding the exact GraphSession to current SessionState. Bind workspace, interfaces, preference, configuration digest, policy and expiry. Default missing owners deny. | Controlled owners admit matching facts. Mismatches, expiry and revocation refuse before graph construction or listeners. Successful admission still refuses absent client composition.

**Wire admitted interface startup.** Connect the checked start context to terminal and WebUI factories sharing the admitted authority. Preserve the original command selection and readiness acceptance. | Real terminal, web and combined launches expose only requested clients. Missing clients refuse before startup.

**Bind actual declarative startup inputs.** Compare a canonical digest of actual builder, listener and metadata inputs before admission owners run. Refuse supplied runtime objects and unused hosting arguments on this path. | Deterministic input changes refuse with zero owner or startup calls; mapping order preserves the digest.

**Complete admitted client composition.** Bind supplied runtime configuration through its trusted owner and connect terminal/WebUI factories. | Real clients share admitted authority and preserve readiness, ownership and command selection.

**Run terminal-mode HTTP in a supervised background thread.** Model: `HostLaunchReceipt` binds host instance, checked session, HTTP endpoint and selected client interfaces. Behavior: Terminal mode keeps HTTP serving in a background thread while the terminal client owns foreground interaction. Wiring: Reuse `CoServiceSupervisor.start_service` and `run_web_ui`; adapt `create_agent_server` instead of creating another host lifecycle. Refusal: Failed binding, absent authority or duplicate host identity refuses startup; never start another engine or multiplexer. Evidence: Record thread identity, readiness probe and the single shared authority identity. | During foreground terminal interaction, probe real HTTP and observe a distinct serving thread with exactly one engine authority.

**Project scoped workspace logs.** Model: `HostLogRecord` binds host, workspace, tenant, request, sequence, timestamp, severity and redacted message. Behavior: Write host logs to `agent_data/logs/server.log` below the authorized workspace. Keep terminal rendering and stdio protocol output clean. Wiring: Attach bounded logging before the background service starts. Pass only tenant-exclusive descriptor contents or an authenticated tenant-filtered stream/reference to the terminal adapter. Never expose a shared log descriptor. Refusal: Path escape, another tenant, unsafe file ownership and unreadable required logging destinations refuse without leaking records. Evidence: Record safe log-reference identity, rotation generation and delivery gaps; never credentials or raw request bodies. | Serve a request and read its correlated record from the workspace log. Two tenants sharing one workspace receive only their own records. Forged references and shared descriptors refuse; injected secrets remain absent.

**Bound log delivery and shutdown.** Model: Log references include generation and sequence; start receipts include lifecycle ownership. Behavior: Rotate bounded files, report overwritten ranges, drain on exit and stop only resources owned by this start. Wiring: Extend `CoServiceSupervisor` shutdown and the existing HTTP stop event; keep one MCP owner loop. Refusal: A stalled reader cannot block serving. Missing retained history returns an explicit gap instead of fabricated continuity. Evidence: Record last retained sequence, stopped thread identity and surviving reused-resource identity. | Overflow a bounded fixture, reconnect its reader, and require a gap. Terminal exit stops the owned HTTP thread and preserves reused services.

**Bound owned supervisor shutdown.** Stop one named service without signaling siblings. Apply one monotonic deadline to all-service shutdown and retain live handles for retry. This prerequisite does not establish terminal startup, sink draining or restart recovery. | Real loopback HTTP remains reachable on a borrowed sibling after targeted stop. Stalled threads consume one total deadline and cleanup succeeds on retry.

**Integrate delivery and terminal shutdown.** Bind launch ownership to the supervisor and required sink. Preserve generation and sequence, report rotation gaps, drain on exit and stop only owned resources. Keep the existing MCP owner loop. | The production terminal exit stops its HTTP thread and drains the sink. Reused services survive. Overflow and reconnect report missing retained history as a gap.

**Publish the terminal log-consumer handoff.** Model: `HostLaunchReceipt` carries the authorized log reference, endpoint and workspace binding for one terminal client. Behavior: The terminal client must combine agent interaction and host log viewing through its public interface. Wiring: Require an exact agent-terminal-ui owning requirement and adapter before claiming the complete user journey. Refusal: Unavailable client rendering refuses the requested capability; a host log file alone cannot establish unified terminal viewing. Evidence: Bind host records to actual client observations without implementing terminal widgets in Arbora. Additional binding: Require the authenticated effective HostLaunchReceipt.web_logs boolean, bound to host, workspace, tenant, principal and session with generation and expiry. Wire agent_terminal_ui.app.run_host_terminal and agent_terminal_ui.client.HostLogReader.read under TUI-RUNTIME-R002.2 through R002.5. Missing runtime fields or consumer exports remain prerequisites; invalid or disabled handoffs cause zero reads while preserving agent interaction and the required redacted sink. | A real terminal client shows a correlated HTTP request log during an interaction. Missing client support leaves this journey unfulfilled.

**Prove start and logs through real processes.** Model: A disposable workspace and controlled terminal client observe host processes, threads and logs. Behavior: Exercise each selected interface, HTTP request, log rotation, restart and clean termination. Wiring: Proposed `tests/host/test_terminal_host_served.py` invokes the real agent host and its public client adapter. Refusal: Missing client contracts or successful helper calls do not establish the complete served journey. Evidence: Record actual endpoint responses, thread IDs, workspace digests, log sequences and engine start counts. Additional binding: Enter run_host_terminal and HostLogReader.read under TUI-RUNTIME-R002.6. Exercise terminal, web and both with authenticated web_logs true and false. Only terminal/both with true may read. Missing preference, reader or authority and changed scope cause zero reads; agent interaction and the required host sink remain available. Bind producer and consumer revisions in future evidence. | Combined mode serves HTTP while the terminal receives scoped logs. Denied workspace and missing client cases have zero unauthorized starts.

**Preserve the sole multiplexer owner.** Model: The original parent remains the complete contract. Behavior: Retain every original R006 ownership clause, including all additional hosted modules and the absence of duplicate multiplexers. Wiring: Reuse the original package-layout test and the single serving lifecycle. Refusal: New child evidence cannot replace any original acceptance obligation. Evidence: Retain the original parent receipts and require its complete acceptance. | The original full module census passes; transport conformance alone cannot establish module ownership.

**Use one standard transport scaffold.** Model: `HostTransportConfiguration` declares stdio or streamable HTTP with explicit host, port and security settings. Behavior: Serve both modes through the same Arbora entrypoint and one multiplexer; reject unsupported arguments consistently. Wiring: Reuse `mcp_server/server.py:164` and `runtime._build_server:2208`; retire private factory coupling under existing R007 obligations. Refusal: Invalid transport or missing required network identity refuses before serving. Diagnostic output never corrupts stdio frames. Evidence: Record transport, schema generation, registered tool digest and one multiplexer instance. | A real MCP client initializes both modes and calls one admitted operation. Malformed options and unauthorized HTTP requests refuse.

**Preserve the entire intent surface.** Model: The original parent remains the complete contract. Behavior: Keep all eight original tools, ranking tie-breaks, fleet discovery and calls, fallback behavior and public registrar ownership. Wiring: Reuse the original FastMCP parity, invoke-policy and natural-language fallback acceptance. Refusal: New child evidence cannot replace any original acceptance obligation. Evidence: Retain the original parent receipts and require its complete acceptance. | All original R023 cases remain required, including the unmatched-operation fallback and registry ownership boundaries.

**Prove transport parity on the served surface.** Model: The same registry generation binds both transport sessions and their tool schemas. Behavior: Compare normalized tool names and schemas, then dispatch through the existing invocation pipeline. Wiring: Use the real `arbora.api.mcp` registration from the production server for both clients. Refusal: A missing intent tool, divergent schema or bypassed policy fails conformance. Evidence: Record both served catalogs and positive and negative invocation receipts. | Both transports expose the same eight tools. Each permits one scoped call and refuses an unauthorized call before downstream effects.

**AU:20 Arbora definition slice.** AU:20 primary-owner slice. Residual: No explicit complete binding was established for analogy search, blast radius, memory recall. Ontology validation and design operations to existing EG methods with the no-new-engine-code constraint. Generic mappings that may record a gap do not prove this clause. Arbora minimum action: Extend the existing HOST mapping with the five named capability-to-existing-EG-method-to-served-operation bindings and the reuse constraint. Retain R023 transport/refusal obligations. Do not create replacement engine implementations. Producer/consumer boundary: Existing EG public capabilities -> Arbora operation registry -> MCP intent transport; AU legacy action mappings identify migration obligations. External engine, SDK, AU, Pipelines or WebUI behavior remains owned there; this row specifies only Arbora. Current IDs: `ARBORA-HOST-R005.2.1.2, ARBORA-HOST-R023`. Source record SHA-256: `c49d11e763cfc99efbd0cd5492045295f7295ec848651bbe80f2ee24f25d5cf9`. Reviewed evidence paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-24-owner-supplements.json, spec-audit/writer-queue-merged/agent-utilities.tsv:20, arbora/specs/host-composition-boundary/requirements.md:14#sha256=2bc29c46a44297cfe9623f780dc3ae54db9b7c525748d8cc2aded60bed7cdf20, arbora/specs/host-composition-boundary/requirements.md:121#sha256=914c1d23cf28f73bca43d0cbee99730e22743301c4e2b8381e7a22d38503741c, arbora/specs/host-composition-boundary/requirements.md:155#sha256=ff22277268b4b8429f8e0dd4a9066776cdfe5278a49828434f8cfdab451e4037, arbora/specs/host-composition-boundary/requirements.md:156#sha256=6226d4570cececdc1a610dc01aa0398d41a8ad28e442fd3be471f19272b416dd`. Packet row: `spec-audit/reconciliation/repository-batches-20261012/arbora.json#/rows/0`. No implementation or runtime evidence is claimed. | Future Arbora tests must prove the owner behavior and cover every positive, refusal, and zero-effect case defined above. Retain all existing parent acceptance for IDs `ARBORA-HOST-R005.2.1.2, ARBORA-HOST-R023`. Use the exact reviewed source paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-24-owner-supplements.json, spec-audit/writer-queue-merged/agent-utilities.tsv:20, arbora/specs/host-composition-boundary/requirements.md:14#sha256=2bc29c46a44297cfe9623f780dc3ae54db9b7c525748d8cc2aded60bed7cdf20, arbora/specs/host-composition-boundary/requirements.md:121#sha256=914c1d23cf28f73bca43d0cbee99730e22743301c4e2b8381e7a22d38503741c, arbora/specs/host-composition-boundary/requirements.md:155#sha256=ff22277268b4b8429f8e0dd4a9066776cdfe5278a49828434f8cfdab451e4037, arbora/specs/host-composition-boundary/requirements.md:156#sha256=6226d4570cececdc1a610dc01aa0398d41a8ad28e442fd3be471f19272b416dd`. This definition does not assert these tests have run.

**AU:96 Arbora definition slice.** AU:96 primary-owner slice. Residual: The installer skill entry and supported IDE/agent target set are not explicitly bound. So every supported target cannot yet be accounted for. Arbora minimum action: Bind the existing installer contract to its skill/command and supported IDE/agent target/version matrix. Require per-target configuration, parser, and client proof. Do not duplicate R008.2-.5. Producer/consumer boundary: Arbora deployment/cli.py registration -> versioned harness adapters -> client configuration/parser. Plan lines 68-85 extend this command with install-harnesses. External engine, SDK, AU, Pipelines or WebUI behavior remains owned there; this row specifies only Arbora. Current IDs: `ARBORA-HOST-R008.3, ARBORA-HOST-R008.5`. Source record SHA-256: `40a2468c82402f222fcf76bdd83bc1afb606f81c2442fc96221dfa8881ffb2e9`. Reviewed evidence paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-24-owner-supplements.json, spec-audit/writer-queue-merged/agent-utilities.tsv:96, arbora/specs/host-composition-boundary/requirements.md:145#sha256=3654330f43b95dd38a9809238121fe34d48130eb383e7f83929eee598f7f5398, arbora/specs/host-composition-boundary/requirements.md:143#sha256=2cd3ee11b0ea3308f4d0aca26ec46f9fe70d9505d583cb535e80377e7e8cd8f4`. Packet row: `spec-audit/reconciliation/repository-batches-20261012/arbora.json#/rows/5`. No implementation or runtime evidence is claimed. | Future Arbora tests must prove the owner behavior and cover every positive, refusal, and zero-effect case defined above. Retain all existing parent acceptance for IDs `ARBORA-HOST-R008.3, ARBORA-HOST-R008.5`. Use the exact reviewed source paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-24-owner-supplements.json, spec-audit/writer-queue-merged/agent-utilities.tsv:96, arbora/specs/host-composition-boundary/requirements.md:145#sha256=3654330f43b95dd38a9809238121fe34d48130eb383e7f83929eee598f7f5398, arbora/specs/host-composition-boundary/requirements.md:143#sha256=2cd3ee11b0ea3308f4d0aca26ec46f9fe70d9505d583cb535e80377e7e8cd8f4`. This definition does not assert these tests have run.

**AU:112 Arbora definition slice.** AU:112 primary-owner slice. Residual: Primary-session-channel unavailability triggering A2A team coordination, plus graph-discoverable team records binding persisted task status and team members. Is not defined. Agent Library membership is not team membership. Arbora minimum action: Define the unavailable-channel fallback and team/member/task-status graph projection using existing A2A task persistence and library primitives. Require discovery and restart acceptance. Producer/consumer boundary: AU coordinator -> Arbora A2A host/A2ATaskStore -> EG durable task state and Agent Library projection. Fallback and team-record projection contracts are missing. External engine, SDK, AU, Pipelines or WebUI behavior remains owned there; this row specifies only Arbora. Current IDs: `EG-ORCH-VOCAB-R003, AU-CONTROL-R027`. Source record SHA-256: `ba4906ae3da7d4a15704dbf7546a89500b613855c8c4a9c4e30a8f62e43a5b84`. Reviewed evidence paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-24-owner-supplements.json, spec-audit/writer-queue-merged/agent-utilities.tsv:112, agent-utilities/specs/agent-control-plane/requirements.md:32#sha256=52694293669bb6f229065e32204d4a00d544a5e3633f5313ebe51ae771443888, epistemic-graph/specs/orchestration-vocabulary/requirements.md:22#sha256=37112be5a2998ea8246961b0085ae9a23dc798ed4182cae44e50ccfce42a1333, epistemic-graph/specs/orchestration-vocabulary/requirements.md:23#sha256=0ef7100b2937a8592623a9885583404e19c4f2a9edee58c0c2241946f1bcb413, arbora/specs/host-composition-boundary/requirements.md:124#sha256=77f8745793fe05072b57f163e71479afdbde059cb7f3e13b24f9967a8b6fa00b`. Packet row: `spec-audit/reconciliation/repository-batches-20261012/arbora.json#/rows/6`. No implementation or runtime evidence is claimed. | Future Arbora tests must prove the owner behavior and cover every positive, refusal, and zero-effect case defined above. Retain all existing parent acceptance for IDs `EG-ORCH-VOCAB-R003, AU-CONTROL-R027`. Use the exact reviewed source paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-24-owner-supplements.json, spec-audit/writer-queue-merged/agent-utilities.tsv:112, agent-utilities/specs/agent-control-plane/requirements.md:32#sha256=52694293669bb6f229065e32204d4a00d544a5e3633f5313ebe51ae771443888, epistemic-graph/specs/orchestration-vocabulary/requirements.md:22#sha256=37112be5a2998ea8246961b0085ae9a23dc798ed4182cae44e50ccfce42a1333, epistemic-graph/specs/orchestration-vocabulary/requirements.md:23#sha256=0ef7100b2937a8592623a9885583404e19c4f2a9edee58c0c2241946f1bcb413, arbora/specs/host-composition-boundary/requirements.md:124#sha256=77f8745793fe05072b57f163e71479afdbde059cb7f3e13b24f9967a8b6fa00b`. This definition does not assert these tests have run.

**AU:97 Arbora definition slice.** AU:97 cross-owner slice. Residual: Workflow registration lifecycle, lazy engine initialization on first use and invocation through that registry. Arbora minimum action: Extend the workflow registry owner with registration/read identity and first-use engine initialization. Then require registry-resolved invocation through the existing host/AU path. Test no eager initialization, one first-use initialization, registered invocation and unknown-workflow refusal. Producer/consumer boundary: Preserve ARBORA-HOST-R022 workflow_store semantic match and AU-CONTROL-R037.5 graph_orchestrate -> `execute_workflow`. Registration and lazy initialization contracts/edges remain absent. External engine, SDK, AU, Pipelines or WebUI behavior remains owned there; this row specifies only Arbora. Current IDs: `ARBORA-HOST-R022, AU-CONTROL-R037`. Source record SHA-256: `f73767d1a3fdba29a702254ed1db2c9904158b6136f6f4b38a3c9a0d3e4fcb03`. Reviewed evidence paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-70.json, agent-utilities/specs/agent-control-plane/requirements.md:61#sha256=c9ca88ac1ff33130b2caa173750be1216a1e7810286020716678e8afa0a4bd45, arbora/specs/host-composition-boundary/requirements.md:120#sha256=68c8f3db0255314462979c5a1b67ce7fd6936008f85490d8c3f110a52f6d21cd`. Packet row: `spec-audit/reconciliation/repository-batches-20261012/arbora.json#/rows/26`. No implementation or runtime evidence is claimed. | Future Arbora tests must prove the owner behavior and cover every positive, refusal, and zero-effect case defined above. Retain all existing parent acceptance for IDs `ARBORA-HOST-R022, AU-CONTROL-R037`. Use the exact reviewed source paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-70.json, agent-utilities/specs/agent-control-plane/requirements.md:61#sha256=c9ca88ac1ff33130b2caa173750be1216a1e7810286020716678e8afa0a4bd45, arbora/specs/host-composition-boundary/requirements.md:120#sha256=68c8f3db0255314462979c5a1b67ce7fd6936008f85490d8c3f110a52f6d21cd`. This definition does not assert these tests have run.

**ARBORA:9 Arbora definition slice.** ARBORA:9 cross-owner slice. Residual: Exact public SDK and AU component environment-manifest producer definitions/operations are missing in the reviewed owner requirements. The host schema does not establish declarations for every enabled external component. Arbora minimum action: Define public versioned SDK/AU declaration exports covering enabled-component and indirect reads. Then link existing R010 census/startup tests to them. Preserve owner boundaries and secret-free diagnostics. Producer/consumer boundary: SDK/AU public declaration producers -> HostEnvironmentManifest -> Arbora configuration loader -> launcher startup validation; producer contracts remain undefined. External engine, SDK, AU, Pipelines or WebUI behavior remains owned there; this row specifies only Arbora. Current IDs: `ARBORA-HOST-R010.1, ARBORA-HOST-R010.2, ARBORA-HOST-R010.3, ARBORA-HOST-R010.4, ARBORA-HOST-R010.5, ARBORA-HOST-R010.6`. Source record SHA-256: `cfd8f1270b5ec1f19d8c78f50e5a833695573763a691584e8c74d8fa5f1cb225`. Reviewed evidence paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-24-owner-supplements.json, spec-audit/writer-queue-merged/arbora.tsv:9, arbora/specs/host-composition-boundary/requirements.md:136#sha256=77164ef7706ee3876b3011adcbae8fcb565b0e742d5ef8a9692fa062974fcdcd, arbora/specs/host-composition-boundary/requirements.md:137#sha256=e08340bc3097811ea44231a896a19b44d212617853bdf22c45fa3d50178cc3ca, arbora/specs/host-composition-boundary/requirements.md:139#sha256=43468ceaff9866f8f82decf9ac81f671787e1c63a3da68567f1e18c83150b76e, arbora/specs/host-composition-boundary/requirements.md:140#sha256=5c5986a1218fd3dd30f33fb4f423a00d04a624f9c1faa1becbba1227f7012852`. Packet row: `spec-audit/reconciliation/repository-batches-20261012/arbora.json#/rows/35`. No implementation or runtime evidence is claimed. | Future Arbora tests must prove the owner behavior and cover every positive, refusal, and zero-effect case defined above. Retain all existing parent acceptance for IDs `ARBORA-HOST-R010.1, ARBORA-HOST-R010.2, ARBORA-HOST-R010.3, ARBORA-HOST-R010.4, ARBORA-HOST-R010.5, ARBORA-HOST-R010.6`. Use the exact reviewed source paths: `spec-audit/reconciliation/fresh-validation-20261012/semantic-reviews/incoming-24-owner-supplements.json, spec-audit/writer-queue-merged/arbora.tsv:9, arbora/specs/host-composition-boundary/requirements.md:136#sha256=77164ef7706ee3876b3011adcbae8fcb565b0e742d5ef8a9692fa062974fcdcd, arbora/specs/host-composition-boundary/requirements.md:137#sha256=e08340bc3097811ea44231a896a19b44d212617853bdf22c45fa3d50178cc3ca, arbora/specs/host-composition-boundary/requirements.md:139#sha256=43468ceaff9866f8f82decf9ac81f671787e1c63a3da68567f1e18c83150b76e, arbora/specs/host-composition-boundary/requirements.md:140#sha256=5c5986a1218fd3dd30f33fb4f423a00d04a624f9c1faa1becbba1227f7012852`. This definition does not assert these tests have run.

**Remote workbench compatibility manifest and admission.** Define `workbench.compatibility.get` and `workbench.extensions.admit` with closed `WorkbenchCompatibilityV1` and `ExtensionAdmissionV1` schemas. Publish editor protocol/version, supported extension IDs/version ranges/capabilities, keybinding profiles, workspace and session identity. Focus/reserved shortcut rules, and explicit admission outcome. Bind to the existing embedded editor/context bridge and normal Arbora operation registry. Preserve the AU-owned ACP boundary and do not create another editor or Arbora ACP implementation. Require authenticated workspace/session scope before admission; refuse incompatible protocol/extensions or cross-workspace access without exposing credentials. Consumer counterpart: `WEBUI-APPS-R001.4`, agent-webui PR #95 head `05ea3dab39a34b48e538fe70ea8d24fd4335f1e9`. | A real served browser tests a declared extension and shortcut, focus rules, reserved shortcuts, and incompatible extension refusal. It also tests denied cross-workspace access and confirms that credentials do not leak. This is a Arbora host contract; editor rendering and ACP execution remain with their owners.

**Refuse unsupported client interfaces before host effects.** The connector host rejects enabled terminal, web or log options with client_unavailable. Reject non-boolean options with invalid_launch. Refuse before workspace initialization, graph construction or listener startup. Omitted and false options preserve ordinary HTTP hosting. This row covers refusal only. R009.2 through R009.6 and R010.7 retain their full served acceptance. | Sentinel tests observe zero constructor and listener calls for refused options. Default HTTP cases reach the existing server.

**Injected host log authority.** Resolve current identity through SessionAuthority and exact workspace grants through trusted composition. Deny absent owners. Bind opaque references to current session, tenant, principal, workspace, host, grant revision and expiry. Revalidate before and after each bounded source read. Wire the optional adapter into the existing host. | Controlled HTTP tests prove successful reads, isolation, expiry, revocation, mismatches and zero unauthorized source calls. This does not prove deployed grants or the full sink and terminal journey.

**Production host log sink.** Compose an owner-only rotating sink with authenticated host request recording and private tenant projections. Redact before writing. Reject unsafe links and modes. Keep the sink active independently of terminal preference. | Real filesystem and HTTP tests prove rotation, redaction, refusal and tenant isolation using controlled identity grants. Full terminal and restart acceptance remain pending.

**Admit exact source generations.** Extend the existing workspace grant with a bounded immutable set of explicit source host IDs. Empty sets deny. Bind handles and cursors to that set. Refresh grants before and after source reads. Preserve original record host identity. | HTTP tests prove generation refusal, change invalidation and fresh admission. This does not prove durable restart replay.

**Retain restart acceptance.** Durable source replay must preserve original generation, sequence, request and time. Require integrity-bound tenant cursors and explicit retention gaps. | Real restart and rotation acceptance remains required.

**Replay retained host files after restart.** Reuse the owner-only rotating log files. Validate bounded records and preserve source host, sequence, request, timestamp and severity. Bind a durable resume cursor to tenant, workspace, exact generation set and record position with a private persisted integrity key. Fresh session and generation admission is required after restart. Missing cursor anchors refuse with an explicit retention gap. | Real file close/reopen and HTTP fixtures resume authorized history, reject changed grants and forged cursors, and report rotated-away positions. No production grant issuer is supplied.

**Complete consumer metadata presentation.** Carry original record metadata through a versioned consumer contract and render retained-history gaps in both clients. | Real Python and native clients prove metadata and restart-gap presentation; message-only version one remains insufficient evidence.

**Startup bindings for messaging, A2A and readiness.** The composition root binds the messaging host ports, mounts the SDK A2A application for the fleet agent and binds the readiness probes before it serves. | `tests/test_host_bindings.py`

**Model.** `SendDecision` holds the admission result of one send. The fleet agent is one agent whose only toolset is the `find` and `act` intent tools, so it reaches the multiplexer. | `tests/test_host_bindings.py::test_send_gate_admits_only_a_session_with_a_send_scope`

**Behavior.** The turn handler runs one turn on the fleet agent. The action gate admits a send only for a verified session with a send scope. The outbound mirror writes one `OutboundMessage` node for each sent message. The runtime signal goes to the bounded signal buffer. | `tests/test_host_bindings.py::test_outbound_mirror_records_one_node_per_message`

**Wiring.** `mcp_server()` calls `bind_messaging_ports()` and `bind_health_probes()`. The tool surface registration calls `mount_sdk_a2a()`, which mounts the admitted A2A application at `/a2a/agent` and runs its task manager through a server extension. | `tests/test_host_bindings.py::test_bind_messaging_ports_binds_all_four_ports`

**Refusal.** The action gate denies a send without a verified session or without a send scope. An A2A request without verified authority gets status 401 before the application runs. An unbound readiness probe makes the process not ready. | `tests/observability/test_runtime_health.py::test_unbound_mandatory_probes_make_the_process_not_ready`

**Evidence.** Tests use fakes for the engine and the session. They check the gate table, the port bindings, the mirror and the A2A path prefix. | `tests/test_host_bindings.py::test_prefixed_app_strips_the_mount_path`

**Hosted observability, ecosystem and deployment modules.** Arbora hosts the run correlation context, the gateway metrics and the runtime health core. It hosts the trace export setup, the trace records and the error-detail sink. It hosts the ARD registry, its federation and its signing. It hosts the hook installer, the profile guard, the mount guard and the asset readers. It hosts the source catalogue. None of these modules imports the agent harness. | `tests/observability/test_correlation.py`, `tests/observability/test_telemetry.py`, `tests/observability/test_trace_records.py`, `tests/ecosystem/test_ard.py`, `tests/ecosystem/test_hook_installer.py`, `tests/deployment/test_guards.py`, `tests/ingest/test_source_catalog.py`

**Behavior.** Correlation headers carry one run id, the session, the priority and the caller identity across processes. A health probe that errors or hangs reports unhealthy with its reason. | `tests/observability/test_runtime_health.py::test_a_failing_probe_is_unhealthy_with_its_reason`

**Refusal.** Arbora refuses a cleartext Langfuse host outside loopback. The asset reader refuses an asset over its size bound or with duplicate JSON keys. | `tests/deployment/test_guards.py::test_json_reader_rejects_duplicate_keys`

**Native MCP/REST facade with A2A unary operations then streaming.** Arbora provides a native MCP and REST host. It fronts the engine and agent-utilities services. It first exposes unary A2A operations: card, send, get, list, and cancel. It then adds durable streaming to those same handlers. | Integration tests exercise the A2A unary endpoints against a fixture engine, followed by a separate test proving durable streaming delivery.

**Scoped A2A task routing and fleet tool exposure.** Arbora routes inbound A2A tasks to the correct operation handler and exposes, through its assembled multiplexer, only the caller-authorized subset of fleet tools, including typed work-item retrieval and listing bound by control leases and read classifications. | Integration tests assert inbound A2A tasks resolve to the correct handler and that multiplexer tool listings are filtered per caller.