feat: activate bounded dogfood runtime

README.md

@@ -57,6 +57,7 @@ the running service's own `/health` response.
 | OpenAPI v0 wire contract + generated TypeScript SDK + breaking-change gate | Active |
 | Private File-backed bot delivery flow (deterministic twin) | Active |
 | Autonomous File import dispatch + bounded expired-lease reclaim | Active |
+| Loopback single-Membership File dogfood `Acquire` | Active when explicitly configured |
 | Production authentication (OAuth/JWT) | `NOT_ACTIVE` |
 | Real source ACLs, general content retrieval, `Continue` / `OpenCitation` | `NOT_ACTIVE` |
 | Live Feishu / Slack / Google Docs connectors, group chat | `NOT_ACTIVE` |
@@ -122,6 +123,50 @@ curl http://127.0.0.1:8137/health
 rejects every credential and performs zero content I/O. The public wire contract
 is `POST /v0/resolve`, frozen in [`openapi/v0/openapi.json`](./openapi/v0/openapi.json).
 
+### Run the bounded dogfood API
+
+The only served content-bearing composition is a local, loopback-only dogfood
+carrier. It is an explicit opt-in and is not production authentication. First
+seed one Organization, User, and current Membership with the configured
+migrator connection:
+
+```bash
+uv run context-engine-dogfood-seed \
+  --organization-id "$CONTEXT_ENGINE_DOGFOOD_ORGANIZATION_ID" \
+  --user-id "$CONTEXT_ENGINE_DOGFOOD_USER_ID" \
+  --membership-id "$CONTEXT_ENGINE_DOGFOOD_MEMBERSHIP_ID"
+```
+
+Configure the API with the Runtime database source and these dogfood settings:
+
+```text
+CONTEXT_ENGINE_API_COMPOSITION=dogfood-local-v1
+CONTEXT_ENGINE_DOGFOOD_SECRET
+CONTEXT_ENGINE_DOGFOOD_ORGANIZATION_ID
+CONTEXT_ENGINE_DOGFOOD_USER_ID
+CONTEXT_ENGINE_DOGFOOD_MEMBERSHIP_ID
+CONTEXT_ENGINE_DOGFOOD_MEMBERSHIP_VERSION
+CONTEXT_ENGINE_DOGFOOD_PRINCIPAL_REF
+CONTEXT_ENGINE_DOGFOOD_AGENT_VERSION_REF
+CONTEXT_ENGINE_DOGFOOD_APPLICATION_REF
+CONTEXT_ENGINE_DOGFOOD_AUTHENTICATION_BINDING_REF
+CONTEXT_ENGINE_DOGFOOD_EMBEDDING_PROVIDER=deterministic-twin-v1
+```
+
+Before activation, freshly reimport the File corpus with the Supply worker's
+network-free `twin` embedding mode and promote those exact Revision references
+through the existing Learning release operation using the dogfood vector index
+profile. The active Release binds the deterministic model and contextual-
+fragment input profile; a mismatch fails composition. Then run the API with an
+explicit loopback host. A valid composition reports `runtime_delivery: ACTIVE`;
+missing or partial configuration fails closed. The dogfood secret must come
+from one local secret source and must never be committed or printed.
+
+External query embeddings, production or multi-user authentication, remote
+network exposure, group/public delivery, dogfood `OpenCitation`, `Continue`, hybrid retrieval, and
+non-File providers remain `NOT_ACTIVE`; see
+[ADR-0068](./docs/decisions/0068-activate-loopback-dogfood-runtime.md).
+
 ### Run the worker
 
 The Supply worker is a separate process from the API, with one entry point and

STATUS.md

@@ -38,15 +38,17 @@ capability can never be reported as a passing one.
 ## Currently `NOT_ACTIVE`
 
 The default application **rejects every credential and performs zero content
-I/O**. The following are known, designed, and deliberately not active:
+I/O**. ADR-0068 separately activates one explicit loopback dogfood composition;
+it does not widen the default. The following are known, designed, and
+deliberately not active:
 
 | Capability | Note |
 |---|---|
 | Production authentication (OAuth / JWT) | Module-level default application is reject-all across all three production authorities (authentication, Organization, Membership) |
-| Durable Principal / Agent grants | Scope authority returns seven missing trusted operands by default, so no deliverable scope can be produced |
-| Real Source / Resource ACLs | Only synthetic conformance fixtures exist |
-| General content retrieval | No production candidate path |
-| `Continue` / `OpenCitation` carriers | The M0 *refusal* path is active; real issuance and redemption are not |
+| Durable general Principal / Agent grants | The default scope authority returns seven missing operands; dogfood separately carries the bounded current File operands and binds one configured Agent/purpose to the Release ceiling only |
+| General / multi-user Source and Resource ACLs | Dogfood uses current mirrored File access plus Membership field rights only; source-native and multi-user authorities remain absent |
+| General content retrieval | Only the loopback File pgvector dogfood `Acquire` carrier is active |
+| `Continue` / dogfood `OpenCitation` carriers | The bounded dogfood composition keeps both unavailable; other accepted ADRs own their narrower citation carriers |
 | Federated discovery, source-native authorization | Deterministic refusal only |
 | Live Feishu / Slack / Google Docs connectors | See [PLAN.md](./PLAN.md) milestones M4 / M6 / M7 |
 | Group-chat delivery, compensating deletes | M5 |
@@ -56,6 +58,19 @@ I/O**. The following are known, designed, and deliberately not active:
 | Streaming delivery | Explicit V1 non-goal — placeholder + edit instead |
 | Answer generation inside the engine | Permanent non-goal — generation always lives above the engine boundary |
 
+### Bounded dogfood Runtime
+
+| ADR | Activates |
+|---|---|
+| [0068](./docs/decisions/0068-activate-loopback-dogfood-runtime.md) | Explicit loopback single-Membership authentication plus File pgvector `Acquire`, with exact EffectiveScope removal before ANN `LIMIT`, sealed Kernel reauthorization, deterministic twin query embedding, and final Policy Epoch veto |
+
+`RUNTIME-DOGFOOD-AUTH-102`, `RUNTIME-DOGFOOD-CARRIER-102`, and
+`RUNTIME-DOGFOOD-EPOCH-102` are registered release-veto evidence. The default
+application remains reject-all and reports `NOT_ACTIVE`. Production
+authentication, a second human, network exposure beyond the maintainer machine,
+group/public audience, dogfood `OpenCitation`, `Continue`, hybrid retrieval, non-File providers, and
+external query embeddings remain `NOT_ACTIVE`.
+
 ## Activation ledger
 
 Each accepted ADR below activated a bounded, separately proven capability.

adapters/exact_phrase.py

@@ -9,6 +9,7 @@
     MaterializedProjectionSession,
     _discover_materialized_exact_phrase,
 )
+from engine.runtime.scope import EffectiveScope
 
 
 class PostgreSQLExactPhraseCandidateIndex:
@@ -18,9 +19,13 @@ def discover(
         self,
         request: Acquire,
         projection_session: MaterializedProjectionSession,
+        *,
+        effective_scope: EffectiveScope,
     ) -> tuple[CandidateRef, ...]:
         if type(request) is not Acquire:
             raise TypeError("exact phrase discovery requires Acquire")
+        if type(effective_scope) is not EffectiveScope:
+            raise TypeError("exact phrase discovery requires EffectiveScope")
         return _discover_materialized_exact_phrase(
             projection_session,
             exact_phrase_digest(request.need.query),

adapters/http/app.py

@@ -5,7 +5,7 @@
 from datetime import UTC, datetime
 from hashlib import sha256
 from json import loads
-from typing import Annotated, Final
+from typing import Annotated, Final, NoReturn
 from uuid import UUID, uuid4
 
 from fastapi import Body, Depends, FastAPI, Header, Request, Response, Security
@@ -175,6 +175,34 @@ class DuplicateJsonObjectKey(ValueError):
     """Strict JSON decoding found an ambiguous object member."""
 
 
+class _RuntimeDeliveryActivation:
+    """Nominal receipt issued only by a validated served composition."""
+
+    __slots__ = ("_seal",)
+
+    def __init__(self) -> None:
+        raise TypeError("Runtime delivery activation is not constructible")
+
+    def __reduce__(self) -> NoReturn:
+        raise TypeError("Runtime delivery activation is not serializable")
+
+
+_RUNTIME_DELIVERY_ACTIVATION_SEAL = object()
+
+
+def _construct_runtime_delivery_activation() -> _RuntimeDeliveryActivation:
+    activation = object.__new__(_RuntimeDeliveryActivation)
+    object.__setattr__(activation, "_seal", _RUNTIME_DELIVERY_ACTIVATION_SEAL)
+    return activation
+
+
+def _is_runtime_delivery_active(value: object) -> bool:
+    return (
+        type(value) is _RuntimeDeliveryActivation
+        and getattr(value, "_seal", None) is _RUNTIME_DELIVERY_ACTIVATION_SEAL
+    )
+
+
 def _utc_now() -> datetime:
     return datetime.now(UTC)
 
@@ -219,6 +247,7 @@ def create_app(
     clock: Callable[[], datetime] = _utc_now,
     request_id_factory: Callable[[], str] = _new_request_id,
     transport_profile: HttpTransportProfile = HTTP_TRANSPORT_PROFILE_V1,
+    runtime_delivery_activation: _RuntimeDeliveryActivation | None = None,
 ) -> FastAPI:
     """Construct API; the module-level composition remains reject-all."""
 
@@ -234,6 +263,10 @@ def create_app(
         )
     if type(selected_runtime) is not Runtime:
         raise TypeError("runtime must be the sealed Runtime composition")
+    if runtime_delivery_activation is not None and not _is_runtime_delivery_active(
+        runtime_delivery_activation
+    ):
+        raise TypeError("Runtime delivery activation has the wrong nominal type")
     selected_authenticator = authenticator or RejectingAuthenticator()
     selected_organization_authority = (
         organization_authority or RejectingOrganizationAuthority()
@@ -393,7 +426,10 @@ def require_public_request_id(
 
     @app.get("/health", include_in_schema=False)
     def health() -> dict[str, str]:
-        return HEALTH_RESPONSE.copy()
+        response = HEALTH_RESPONSE.copy()
+        if _is_runtime_delivery_active(runtime_delivery_activation):
+            response["runtime_delivery"] = "ACTIVE"
+        return response
 
     @app.post(
         LEGACY_RESOLVE_PATH,
@@ -545,6 +581,12 @@ def resolve_context(
                             current_membership_verification.authentication_binding_ref
                         ),
                         checked_at=current_membership_verification.checked_at,
+                        materialized_projection_session=(
+                            current_membership_verification.materialized_projection_session
+                        ),
+                        active_runtime_release=(
+                            current_membership_verification.active_runtime_release
+                        ),
                     )
                 except (TypeError, ValueError):
                     raise TransportAuthenticationFailed from None

adapters/http/authentication.py

@@ -1,5 +1,6 @@
 """Trusted HTTP authentication adapter contracts and fail-closed default."""
 
+import hmac
 from dataclasses import dataclass, field
 from typing import Protocol
 from uuid import UUID
@@ -115,3 +116,41 @@ def authenticate(
         opaque_credential: str,
     ) -> VerifiedAuthenticationContext:
         raise AuthenticationRejected
+
+
+class DogfoodAuthenticator:
+    """Constant-time local-secret verifier for one fixed seeded identity."""
+
+    __slots__ = ("_authentication", "_secret")
+
+    def __init__(
+        self,
+        *,
+        secret: str,
+        authentication: VerifiedAuthenticationContext,
+    ) -> None:
+        if (
+            type(secret) is not str
+            or len(secret.encode("utf-8")) < 32
+            or secret != secret.strip()
+            or any(character.isspace() for character in secret)
+        ):
+            raise ValueError("dogfood authentication configuration is unavailable")
+        if type(authentication) is not VerifiedAuthenticationContext:
+            raise TypeError("dogfood authentication identity is unavailable")
+        self._secret = secret.encode("utf-8")
+        self._authentication = authentication
+
+    def authenticate(self, opaque_credential: str) -> VerifiedAuthenticationContext:
+        if type(opaque_credential) is not str:
+            raise AuthenticationRejected
+        try:
+            supplied = opaque_credential.encode("utf-8")
+        except UnicodeEncodeError:
+            raise AuthenticationRejected from None
+        if not hmac.compare_digest(supplied, self._secret):
+            raise AuthenticationRejected
+        return self._authentication
+
+    def __repr__(self) -> str:
+        return "DogfoodAuthenticator(<redacted>)"