feat(observatory): add portable LAB V1 foundation

docs/15_LABORATORY_RUN_CANON.md

@@ -300,16 +300,29 @@ branches rather than hidden retries. The durable queue serializes one recorded
 compute owner and does not equate a queued receipt with a Worker execution
 receipt.
 
-The only currently queueable pair is the exact `RAVNOVES00` source and
-`M4.9T5 · TRAVEL TGS · CPU-only, без ML` RunDefinition. It seals an explicitly
-empty learned-model list because TGS is an algorithmic CPU pipeline, not an
-unknown model dependency. The binding pins the exact source pack rather than a
-volatile whole-catalog digest; the server captures and seals the current catalog
-snapshot into each admitted job. `LAB V1 · EoMT Cityscapes Large 1024 + DDRNet-39`
-remains a result-only replay: no independently versioned durable executor exists
-for that published result, so Mission Core does not invent one. Every other
-session/setup pair fails closed until its own source adapter, capability manifest,
-RunDefinition and executor identities are admitted.
+The only pair currently admitted to the durable queue is the exact `RAVNOVES00`
+source and `M4.9T5 · TRAVEL TGS · CPU-only, без ML` RunDefinition. It seals an
+explicitly empty learned-model list because TGS is an algorithmic CPU pipeline,
+not an unknown model dependency. The binding pins the exact source pack rather
+than a volatile whole-catalog digest; the server captures and seals the current
+catalog snapshot into each admitted job.
+
+`LAB V1 · EoMT Cityscapes Large 1024 + DDRNet-39` now has a source-independent
+portable RunDefinition and lightweight recorded-source capability probe. The
+definition seals the exact model/component/resource identities, observation-only
+authority and generic `missioncore.recorded-eomt-ddrnet-review/v2` result
+contract; it contains no source Session id or label. Compatibility is derived
+from the selected Session's real K1 capabilities rather than its name. A
+compatible source may therefore report capability `pass` independently from
+executor readiness.
+
+That portable foundation is not an executable product path yet. Its executor is
+`not-installed`, and there is no accepted server-side definition-SHA/check-SHA
+fenced check/submit API, generic v2 result assembler/publisher or deployed Worker
+executor. Preflight consequently remains blocked and the UI must not promise or
+expose enqueue. The old `missioncore.lab-v1-vegetation-shadow/v1` result is not an
+exact/existing result of the generic portable definition, even for its original
+source; it remains available only in the immutable legacy LAB catalog.
 
 Recorded work has priority rank `100`. A future live K1 lease has rank `0` and
 closes new recorded claims while it is pending or active. Cooperative executors
@@ -323,11 +336,14 @@ pending for retry; a conflicting or indeterminate receipt enters reconciliation.
 Every unresolved form blocks live activation and concurrent ownership.
 An explicit live terminal trigger requeues paused recorded work.
 
-ADR 0046 records this decision. The durable queue and identity contracts are
-implemented; Worker claim transport, installation of the exact M4.9T5 executor
-and wiring from the real K1 lifecycle to live-lease triggers remain pending.
-Therefore a submitted M4.9T5 job may honestly wait in `queued` without implying
-that Worker 006 can execute it yet.
+ADR 0046 records this decision. Durable queue and identity contracts, the
+authenticated Worker pull protocol and transport-agnostic Worker agent exist as
+foundation. The production app hard-disables the Worker router even when a valid
+credential is present until an expiring claim lease and verified result publisher
+are accepted. Installation of the exact executors, Worker deployment and wiring
+from the real K1 lifecycle to live-lease triggers remain pending. Therefore a
+submitted M4.9T5 job may honestly wait in `queued` without implying that Worker
+006 can execute it yet; portable LAB V1 cannot currently be submitted at all.
 
 Worker telemetry remains secondary observation evidence. It does not replace the
 authoritative queue ledger, result validation or common laboratory receipt. K1

docs/adr/0046-durable-observatory-recorded-queue-and-live-k1-priority.md

@@ -1,7 +1,9 @@
 # ADR 0046: Durable Observatory recorded queue and live K1 priority
 
 Date: 2026-08-31
-Status: accepted; durable queue core implemented; Worker and live-trigger wiring pending
+Status: accepted; portable LAB V1 admission and Worker pull foundations implemented;
+production executor, claim lease, result publication, Worker deployment and
+live-trigger wiring pending
 
 ## Context
 
@@ -51,11 +53,24 @@ The same key with changed identity is a conflict. Jobs advance through `accepted
 `paused`, `preemption-pending` and `reconciliation-required` expose safety-relevant
 branches. Mission Core admits only one active recorded compute owner.
 
-The queue is an orchestration and evidence boundary, not a Worker transport. A
-queued job proves durable admission, not remote execution or eventual success.
-Worker claims, terminal result publication and telemetry must later use a separate
-authenticated, versioned service boundary; no arbitrary PowerShell or filesystem
-payload is added to this contract.
+The queue remains the authoritative orchestration and evidence boundary. A queued
+job proves durable admission, not remote execution or eventual success. An
+authenticated, versioned Worker pull protocol is now implemented as a separate
+boundary. The configured Worker contour may claim one server-sealed job and
+advance it through start, checkpoint, succeed or fail receipts. The caller cannot
+supply commands, paths, environment variables, container images, model identities,
+resource policy or priority. This protocol and its tests are foundation only.
+The production app hard-disables the Worker router even when a valid private
+credential exists. A token must not turn an incomplete transport into a production
+execution surface before an expiring claim lease and verified result publisher
+are implemented and accepted. The gate remains isolated from K1, Simulation and
+legacy LAB startup.
+
+The transport receipt is not result publication. A Worker `succeed` transition
+records the returned result id and SHA-256 against the claim, but a separate
+publisher must still validate the generic result contract, immutable artifacts,
+source/job/definition/model identities and observation-only authority before the
+result enters the Observatory catalog.
 
 ## Current setup admission
 
@@ -74,12 +89,41 @@ binding deliberately does not pin a digest of the whole mutable catalog: the
 exact compute input is the immutable source pack, while the catalog snapshot is
 job-specific provenance.
 
-`LAB V1 · EoMT Cityscapes Large 1024 + DDRNet-39` remains result-only. The
-published evidence stays viewable, but the setup cannot be queued until a new
-independently versioned source adapter, RunDefinition and executable release are
-created and accepted. The same fail-closed rule applies to every other
-session/setup combination. The product may grow toward any admitted setup over
-any compatible recorded source, but compatibility is evidence, not an assumption.
+`LAB V1 · EoMT Cityscapes Large 1024 + DDRNet-39` now has a source-independent
+portable RunDefinition. Its identity contains the exact EoMT and DDRNet model
+artifacts, algorithm/configuration components, resource profile, observation-only
+authority and the generic `missioncore.recorded-eomt-ddrnet-review/v2` result
+contract. It contains no source session id, source label, host path, command,
+environment or caller-selected priority. The old
+`missioncore.lab-v1-vegetation-shadow/v1` result is not an exact or existing
+result of this generic v2 definition, including for its original RAV004 source.
+It remains available only through the immutable legacy LAB catalog; the portable
+catalog neither maps nor projects it.
+
+Compatibility is decided by capability admission against the immutable selected
+Session, not by `RAVNOVES*` naming. The source must satisfy the admitted K1
+plugin/archive, point-cloud/trajectory/video modalities, RIGHT-camera semantic
+channel, exact recorded media profile, single seekable media epoch and sealed
+calibration identity. Catalog compatibility uses a lightweight `probe` result
+containing only the selected Session/catalog identity, source-adapter identity and
+camera segment count. It neither prepares/restores a recorded-media sidecar nor
+builds a source bundle or capability manifest. A later explicit admission performs
+the full immutable read, emits content-addressed path-free documents and rejects
+source or definition drift before writing contracts or a queue intent.
+
+This portable definition is intentionally not executable yet. Its executor state
+is `not-installed`; no executor release or image identity is sealed. Conversion to
+the durable queue definition therefore fails before source persistence or queue
+mutation. A compatible recording, including RAV004, has only a successful
+source-capability probe, not an existing portable result or runnable LAB V1 job.
+The legacy RAV004 result remains independently viewable in the legacy catalog.
+The same fail-closed rule applies to every other session/setup combination.
+
+The implemented Worker 006 agent core accepts only path-free queue projections,
+validates their sealed identities and resolves execution through a local
+four-digest allowlist: executor release, image, model manifest and resource
+profile. Network polling cadence, model/runtime installation and deployment are
+outside that core and are not inferred from its presence in the repository.
 
 ## Priority and preemption protocol
 
@@ -110,22 +154,43 @@ zero; partial staging never becomes evidence.
 ## Acceptance boundary
 
 This decision accepts the durable queue core and its identity, lifecycle,
-idempotency and preemption contracts. It does not claim that the complete compute
-loop is deployed. The following remain implementation gates:
+idempotency and preemption contracts; the source-independent LAB V1
+RunDefinition; capability-based recorded-source admission; the fail-closed bridge
+from portable identities to the durable queue; the authenticated Worker pull
+protocol; and the transport-agnostic Worker agent core. It does not claim that the
+complete compute loop is deployed. The following remain implementation gates:
 
-- authenticated Worker claim and result transport;
+- sealing and installing a production LAB V1 executor release and container image
+  with the exact EoMT/DDRNet artifacts on Worker 006;
+- implementing and accepting the generic v2 result assembler, validator and
+  idempotent Observatory publisher rather than trusting a terminal Worker receipt;
+- replacing the current one-shot claim receipt with an expiring, renewable claim
+  lease whose loss prevents stale execution and terminal acknowledgement;
+- deploying, credentialing and physically validating the Worker pull agent and
+  its local four-digest executor allowlist;
 - installation of the exact M4.9T5 executor on the Worker;
 - binding real K1 acquisition start/terminal events to live-lease triggers;
 - physical acceptance that cancellation releases the required Worker resources
   and that recorded work resumes only after the live lease terminates.
 
 Until those gates close, an M4.9T5 submission may remain honestly `queued`. LAB V1
-cannot be submitted, and no UI state may present it as executable.
+cannot be submitted. The UI must project source compatibility independently from
+executor readiness: a compatible recording may show capability `pass` while the
+`not-installed` executor keeps preflight blocked. The portable v2 setup always
+reports no existing result; its historical vegetation result stays in legacy LAB.
+Even a future `ready` executor cannot make this projector expose enqueue until
+server-side definition-SHA and check-SHA fenced check/submit endpoints are
+implemented and accepted. No current UI state may promise or expose LAB V1
+enqueue.
 
 ## Consequences
 
-- The UI stays a bounded selector and submitter; executable authority remains on
-  the server.
+- The UI stays a bounded selector and read-only preflight surface; executable
+  authority remains on the server, and LAB V1 enqueue stays absent while its
+  executor is `not-installed`.
+- Source compatibility and executor readiness are separate product facts; neither
+  labels nor an existing result upgrades a compatible Session into an executable
+  definition.
 - Every accepted job is reproducible from sealed source, setup, executor, model
   and resource identities rather than mutable host paths.
 - Live K1 can receive hard priority without silently losing or concurrently
@@ -133,6 +198,7 @@ cannot be submitted, and no UI state may present it as executable.
 - Non-checkpointable replay pays the deliberate cost of discard and
   restart-from-zero after preemption.
 - K1 acquisition/control principles, the legacy LAB archive and
-  Simulation/Gaussian remain unchanged.
+  Simulation/Gaussian remain unchanged; this foundation adds no viewer profile,
+  data migration, equipment command or lifecycle coupling to those contours.
 - Adding a setup or source requires an admitted adapter and RunDefinition; a
   display name or historical result is insufficient.