# Архив исходника Broker

Историческая копия до очистки репозитория 2026-10-16. Источник: `mallexxx/execution-broker`, commit `ae92c15d31c8396789765cebf82f7971d6f4cb12`, файл `docs/support.md`. Старые статусы и deployment pins ниже не заменяют актуальную [[personal/projects/balda/execution-broker|эксплуатационную карточку]].

---

# Supported configurations

Execution Broker is a single-operator control plane. One authenticated principal
can control its runs. Chat/topic binding prevents accidental cross-session
routing; it is not tenant isolation or independent user authorization.

## Runtime matrix

| Configuration | Status | Boundary |
|---|---|---|
| Native service archives | Runtime accepted on Darwin/Linux, ARM64/AMD64 | Exact archive provenance, seven binary versions, synthetic credential lifecycle, authenticated MCP/API, SQLite backup and graceful shutdown; this does not accept every provider on those hosts |
| Docker deterministic workflows | Integration tested | Fixed non-root image, no host mounts, read-only filesystem and restricted capabilities |
| Run-to-run artifact inputs | Docker integration and native transfer/restart tested | Exact session, source and SHA256 binding, transactional retention holds, resumable transfer before execution; requires the matching execution/v2 worker and gateway |
| Declarative project tooling | Native macOS and isolated Linux projects, real Docker handoff and deployed macOS VM accepted | Make/C, Python, Node and JVM projects, cache hit and actual Node SDK change; the tested VM verified the approved Go archive through its scoped tunnel, retained tooling evidence and passed an XCTest |
| Immutable repository cache | Native transfer/restart and real Docker/Callee accepted | Exact repository/commit, private checkouts, scoped capabilities and durable deadline holds; opt-in execution/v3 |
| Environment replacement | Real Docker/Callee checkpoint, two Broker restarts and single-mutation acceptance | Operator-authored continuation, preserved raw source/base ancestry, separate approval, original deadline, bounded lineage and cancellation; matching execution/v3 workers required |
| Virfield v2 macOS workflows | Production macos27 reacceptance passed on 2026-10-16 | Installed Virfield `8bfff9f`: native GUI/new SSH key storage and console qualification, pinned SSH bootstrap, production Story, actual reviewer write denial, independent tests, hashed artifacts, credential settlement and confirmed release |
| macOS Codex with persistent OAuth | Story, credential reuse and actual reviewer write denial accepted on the tested operator setup | Earlier fresh-VM/restart checks plus the current owner-approved production continuation passed; eight artifacts were independently downloaded and hashed, four tests repeated, and reviewer `os.open` returned EPERM. Provider expiration/revocation and browser reauthentication were not exercised |
| macOS Claude account | Accepted on the tested operator setup | Full Story, quality gate, denied-write probe and fresh-VM reuse after issuer/Broker restart passed; provider expiration/revocation and browser reauthentication were not exercised |
| macOS OpenCode with DeepSeek API key | Accepted on the tested operator setup | Real inference, full Story, quality gate and fresh-VM reuse after issuer/Broker restart passed; upstream revocation was not exercised; both read-only role sessions reject injected ACP writes with the native plan policy unchanged |
| Docker OpenCode with DeepSeek API key | Story, credential reuse and controlled invalid-key refusal accepted | Two fresh-worker Stories, re-executed quality assertions, hashed artifacts, Broker/issuer restart and checkpoint before cleanup passed. The native client rejected a never-valid API key in a separate synthetic vault; artifacts, credential settlement and cleanup passed. Actual upstream revocation was not exercised; both read-only role sessions reject injected ACP writes with the native plan policy unchanged |
| Docker Codex | Updated reviewer policy, production Story, cancellation, restart/reuse and controlled credential refusal accepted | The new image preserves the previously accepted runtime binaries and uses reviewer deny. Broker/gateway/worker pins and the actual image pack agree. Two production Stories passed independent four-test replays and artifact hashes; one survived Broker/gateway/issuer restart with the same run, deadline and credential owner. Cancellation during implementation retained logs and checkpointed credentials. A separate synthetic vault produced native HTTP 401/token_expired refusal with artifacts, credential settlement and cleanup. Every owned worker/container volume was removed; actual upstream revocation and browser reauthentication were not exercised |
| Docker Claude account | Story, credential reuse, natural access-token expiry and controlled credential refusal accepted | Two fresh-worker Stories, all six roles, independently repeated tests, hashed artifacts, Broker/issuer restart and checkpoint before cleanup passed; both read-only role sessions reject injected ACP writes. A naturally expired access token refreshed on a fresh worker, three planning roles completed, and the renewed session was checkpointed after cancellation. A separate synthetic vault produced native Authentication required and reauthentication_required with artifacts, credential settlement and cleanup. Actual upstream revocation and browser reauthentication were not exercised |
| Managed-host plans | Protocol and local rollback tested | Each real host still requires dedicated identity, reviewed fixed operations and deployment acceptance |
| Docker provider credential issuance | Code/synthetic lifecycle and live Claude/OpenCode checkpoint/reuse tested | Broker issues after durable admission, checkpoints a stopped runner, and retains the owner if worker state is lost; each provider's sandbox and credential-failure gates still apply |
| Remote host provider credentials | Not enabled | Fixed capability plans do not grant provider login; each host requires its own identity and deployment acceptance |

On 2026-10-16 the production macos27 gate passed on installed Virfield `8bfff9f`.
The successful continuation reused the actual owner-approved plan. Its reviewer
executed a bounded `os.open` probe and received EPERM; the verifier and independent
checkout passed four tests. All eight retained artifacts were downloaded again
with size/SHA256 verification, Prism closed the Story, the credential owner was
cleared and Virfield reported no workers or jobs. The Runner package includes
the macOS zombie-group settlement correction; the exact source workflow matches
the deployed pack. The dated [Virfield acceptance record](https://github.com/mallexxx/virfield/blob/a1460d3372bdfbb5cb19d633d41dd5d3fb3164e6/docs/VERIFICATION.md#broker-macos27-reacceptance)
and private operator receipts preserve the tested versions and earlier failed
preparations. Those historical failures remain recorded.

The shared `prism/story` version changed with the reviewer policy. The Linux
worker image and gateway allowlist were switched together on 2026-10-16 after
explicit operator approval and a zero-active-run check. Live container config,
the actual image pack and source digest agree. A production Story and fresh
worker reuse across Broker/gateway/issuer restart both passed; independent
checkouts repeated four tests each. Cancellation during implementation retained
five hashed artifacts and settled the credential lease. Both successful runs
retained seven hashed artifacts. No owned worker container or volume remained,
and all three credential identities were idle and unrevoked after the cycle.

On 2026-10-16 a separate Docker Claude probe started with an access token that
had expired on 2026-10-15. The native client renewed the session and completed
specify, design and breakdown. The operator canceled before implementation;
Broker checkpointed the renewed token with the same account and organization,
released the identity and removed the worker and volume. All five artifacts
passed size/SHA256 verification. This accepts natural access-token expiry and
refresh on that Docker setup; upstream revocation and browser reauthentication
remain separate checks.

Integration evidence is specific to the tested configuration. It does not certify
arbitrary guest images, provider versions, Docker hosts or remote services.
Application/device installation is owned by the calling project; the
[iPad workflow](ipad-deployment-plan.md) is a separate scenario, not a Broker
release requirement.

## Balda integration

The portable plugin provides the execution skill and `/execute` command. Broker
and Prism remain external services with operator-owned MCP connections. The
plugin contains no bearer tokens, does not install Docker or provision VM images,
and cannot approve a managed-host plan itself.

The CI managed-plugin compatibility gate pins Balda
[`6621b189`](https://github.com/baldaworks/balda/commit/6621b189c9533ef8adaddfdb81f3155ea083c363).
It exercises the actual package through discovery, managed install, upgrade,
disable/enable, removal with retained data, and recovery. Install and upgrade
through Backoffice; use a new or explicitly reset session to adopt its snapshot.
Repeat the gate against the exact Balda source and binary selected for deployment;
the CI pin alone does not attest a different running revision.

The operator deployment separately qualified clean upstream Balda
[`b5f7d5b4`](https://github.com/baldaworks/balda/commit/b5f7d5b485301c3ab21c9622e6bf1dad2f0f307b)
with the managed-plugin lifecycle and native wait restart gates. Both deployed
instances retained their provider sessions, locator/snapshot bindings, history,
configuration and authorization; post-deploy MCP parity and Eagle Asana read-only
checks passed.

Automatic observation uses the bundled `balda.state` and `balda.session.wait`
tools. Persist the attempt and arm the original-session wait before Start or
retry. Recover lost admission responses with `execution_lookup`; close abandoned
attempts with the exact-payload cancellation fence. A separate TTL recovery wait
survives a failed intermediate observer turn. The compatibility gate tests the
native one-shot's original-session scope and restart recovery, as well as managed
plugin lifecycle. A real conversational acceptance is a separate deployment gate.

Generic webhooks in this Balda revision run isolated jobs with optional literal
report destinations; they cannot replace a session observer. Neither wait
acceptance nor transport deduplication proves provider delivery or prevents an
LLM from repeating a message. Monitor failed Balda turns and provider failures.
Existing sessions retain their capability snapshots until explicitly reset.

## Accepted release scope

On 2026-10-16 the operator explicitly accepted release readiness for the tested
configurations and boundaries above. Production Stories, credential reuse and
restart, write denial, cancellation, retained artifact checks and cleanup passed.
Separate synthetic vaults exercised native provider refusals for Codex, Claude
and DeepSeek on Linux; these runs retained artifacts and settled credential
ownership before cleanup. Docker Claude also passed natural access-token expiry
and refresh with the working account.

Working credentials for all three providers were restored on an independent
physical Linux host without the original Mac or Keychain. Restored vaults passed
native issue/checkpoint/release and authenticated read-only provider checks.
The encrypted package, matching vault records and recovery software remain on
that host with an independent protected recipient. See [recovery](recovery.md).

The operator excluded deliberate revocation of working provider authorizations
and subsequent browser login from this acceptance. Those operations remain
unverified limitations; controlled invalid credentials do not prove actual
upstream revocation or browser reauthentication. Linux failure checks do not
establish the corresponding macOS behavior. This scoped acceptance does not
publish a release or promise unattended recovery when a provider requires login.
Additional configurations still require the applicable
[executor acceptance](executors.md#deployment-acceptance) gates.

## Operational limits

- Run one Broker per database on a local reliable filesystem. SQLite over NFS and
  multiple writers are unsupported.
- Coding roles are sequential. Parallel Stories have separate workers; per-role
  worktree allocation and parallel mutation are not implemented.
- TTL and retry limits bound execution lifetime. They are not token or monetary
  budgets, and there is no automatic model-tier escalation.
- Beads uses embedded Dolt inside Prism. An external shared Dolt server is outside
  the supplied deployment.
- Coordinated backup requires a drained stack. Lost master keys, golden-image
  restoration and active-worker disaster recovery require separate procedures.

See [security](security.md) for privilege boundaries and [testing](testing.md)
for the distinction between tests, emulation and deployment acceptance.