Explicit supervised execution v1

The operator creates one immutable offer for one existing project task, one reviewed Bridge enrollment identity and one explicit provider account. This is an opt-in HTTP/CLI vertical slice; there is no autonomous dispatcher or Work Center launch button. Account secrets stay in the existing local provider credential boundary. Plans and reports contain references, never repository contents or raw PTY output.

Endpoint	Principal	Effect
POST /bridge/v1/executions	Project owner/admin with tasks:write and write_context	Create/replay an immutable offer
GET /bridge/v1/executions?project_id=<uuid>	Reviewed Bridge transport token	List up to 20 offers for an explicitly bound project
GET /bridge/v1/executions/<id>	Project tasks:read or assigned Bridge	Read authoritative execution state
POST /bridge/v1/executions/<id>/claim	Assigned Bridge, empty JSON body	Atomically claim once and obtain a lease
POST /bridge/v1/executions/<id>/renew	Assigned Bridge, lease_id and fencing_token	Renew an active lease
POST /bridge/v1/executions/<id>/events	Assigned Bridge, lease and consecutive sequence	Record a bounded state/result-reference event
POST /bridge/v1/executions/<id>/cancel	Project owner/admin, write_context	Cancel offered/running execution

Every response is Cache-Control: no-store. Each Bridge operation rechecks identity, project binding and provider account authorization. The operator must administer both the target project and the node's enrollment project. Creation requires the current task version; claim rechecks it. Idempotency keys bind the complete request hash. Concurrent claim has exactly one winner. Only one offered/running execution per Bridge and per task is permitted.

Creation fields are write_context, task_id, expected_task_version, bridge_id (the enrollment identity UUID), idempotency_key, profile, workspace, prompt, base_commit and branch. Profile pins its ID/version, runtime, model, account_id, instructions, optional soul and skills. Only headless PTY and non-interactive execution are accepted. Provider runs require repository identity, exact 40-character base SHA and branch. Synthetic runs are explicitly labelled and need no provider account. Profiles are explicit operator-authored snapshots in v1, not automatically resolved catalog agents.

A lease lasts 90 seconds, renews only while active, and has an absolute 15-minute execution deadline. Expiry cannot be revived. Cancellation, token revocation, binding revocation or account removal prevents further renewal. The Bridge also enforces expiry locally and stops its process. An expired running record can be reaped by the next authorized offer in the same scope. Recovery requires operator inspection and a new explicit offer; claim is never automatically replayed after an ambiguous response or process restart.

Events accept only state, exit code, optional provider session ID, result SHA and repository-relative evidence path. Unknown fields, raw output, skipped sequences and conflicting event replays are rejected. A terminal event writes one durable work receipt transactionally. It does not change the task status, verify test claims or prove that the provider accomplished the task. completed means the reported process returned zero. Independent Git/test verification and the existing completion handoff remain required.

Migration 018 is additive. Existing MCP clients, local manual sessions, Work Center feeds and deployed Bridge versions continue to work without using these endpoints. Rolling back application code leaves the additive tables intact; no down-migration or destructive cleanup is part of rollout.

Authorized production acceptance

After exact-commit CI, merge, guarded deployment and matched Bridge installation, scripts/production_execution_canary.py can verify the public HTTPS path. It requires an explicit expected revision/instance, dedicated heyaira SSH key and installed Bridge path. It creates one uniquely named synthetic project, runs only the fixed-output synthetic provider, verifies the MCP receipt and unchanged task status, then deletes only that exact project/name pair. Tokens remain in memory and stdin. Its remote bootstrap/cleanup source is tested against a disposable PostgreSQL database before use. This operation requires explicit production-test authorization and must not run as a background CI job against production.