[PILOT-06] Execute project POST checks with Smol model and trial capabilities

.ci/behavior-ownership/partition.v1.json

@@ -80,6 +80,10 @@
       "group": "artifacts",
       "target": "backend/app/adapters/checkers/openrouter_model_provider.py"
     },
+    {
+      "group": "artifacts",
+      "target": "backend/app/adapters/checkers/trial_proxy.py"
+    },
     {
       "group": "shared",
       "target": "backend/app/adapters/github/app_facts.py"
@@ -428,6 +432,10 @@
       "group": "artifacts",
       "target": "backend/app/interfaces/checker_model_proxy.py"
     },
+    {
+      "group": "artifacts",
+      "target": "backend/app/interfaces/checker_trial_proxy.py"
+    },
     {
       "group": "artifacts",
       "target": "backend/app/interfaces/external_checker_execution.py"
@@ -460,6 +468,10 @@
       "group": "shared",
       "target": "backend/app/interfaces/setup_model_proxy.py"
     },
+    {
+      "group": "shared",
+      "target": "backend/app/interfaces/trial_execution.py"
+    },
     {
       "group": "lifecycle",
       "target": "backend/app/interfaces/trusted_submission_intake.py"
@@ -1256,6 +1268,10 @@
       "group": "artifacts",
       "target": "backend/app/modules/checkers/api/delivery_reconciliation.py"
     },
+    {
+      "group": "artifacts",
+      "target": "backend/app/modules/checkers/api/evaluation_context.py"
+    },
     {
       "group": "artifacts",
       "target": "backend/app/modules/checkers/api/evaluation_contract.py"
@@ -1300,6 +1316,10 @@
       "group": "artifacts",
       "target": "backend/app/modules/checkers/api/pre_submit_material.py"
     },
+    {
+      "group": "artifacts",
+      "target": "backend/app/modules/checkers/api/revision_feedback.py"
+    },
     {
       "group": "artifacts",
       "target": "backend/app/modules/checkers/api/selected_post_submit.py"
@@ -1308,6 +1328,14 @@
       "group": "artifacts",
       "target": "backend/app/modules/checkers/api/selected_pre_submit.py"
     },
+    {
+      "group": "artifacts",
+      "target": "backend/app/modules/checkers/api/trial_evidence.py"
+    },
+    {
+      "group": "artifacts",
+      "target": "backend/app/modules/checkers/api/trial_profiles.py"
+    },
     {
       "group": "artifacts",
       "target": "backend/app/modules/checkers/checker_retry.py"
@@ -1364,6 +1392,10 @@
       "group": "artifacts",
       "target": "backend/app/modules/checkers/pre_submit_defaults.py"
     },
+    {
+      "group": "artifacts",
+      "target": "backend/app/modules/checkers/revision_feedback.py"
+    },
     {
       "group": "artifacts",
       "target": "backend/app/modules/checkers/router.py"
@@ -1384,6 +1416,10 @@
       "group": "artifacts",
       "target": "backend/app/modules/checkers/selected_pre_submit_reads.py"
     },
+    {
+      "group": "artifacts",
+      "target": "backend/app/modules/checkers/trial_evidence.py"
+    },
     {
       "group": "lifecycle",
       "target": "backend/app/modules/compensation/api/adapter_bindings.py"
@@ -2064,6 +2100,10 @@
       "group": "lifecycle",
       "target": "backend/app/modules/tasks/api/contributor_reads.py"
     },
+    {
+      "group": "lifecycle",
+      "target": "backend/app/modules/tasks/api/evaluation_revision.py"
+    },
     {
       "group": "lifecycle",
       "target": "backend/app/modules/tasks/api/guide_documents.py"
@@ -2168,6 +2208,10 @@
       "group": "lifecycle",
       "target": "backend/app/modules/tasks/evaluation_delivery.py"
     },
+    {
+      "group": "lifecycle",
+      "target": "backend/app/modules/tasks/evaluation_revision.py"
+    },
     {
       "group": "lifecycle",
       "target": "backend/app/modules/tasks/lifecycle.py"
@@ -2537,7 +2581,7 @@
       "target": "backend/scripts/validate_test_lane_evidence.py"
     }
   ],
-  "authority_digest": "6822cec6baeab801bdfdc9a21bb901d68e84d3e2de91736e6d2786591ed4a3e1",
+  "authority_digest": "26fee37a0185e847201fa80d6952664fe8c403e98648b82cab673bcd1d6399c4",
   "protected_base_commit": "7676ce4347db0c9694962a9b587a20765e16eac6",
   "schema": "workstream.behavior-ownership-partition.v1"
 }

.commitrail/initiatives/WS-EXEC-001/OVERVIEW.md

@@ -17,14 +17,21 @@ guardians. Both capabilities have owner/adapter proof and a combined public API/
 journey on an isolated one-slot Smol node. Hosted composition requires pinned
 intake configuration; the intended production Flow/AWS deployment remains separate.
 
-The Smol 1.31.4 qualification (PR #672) proves fresh VM overlap, real Python checker
-execution, cancellation/deadlines and request-process recovery, but not production
-resource parity, host/controller restart recovery, ART integration or deployment.
-The merged model-runtime capability owns gateway, budget and private-grant
-custody. Its host Unix-socket relay currently supports Docker/runsc project
-execution; Smol rejects model-entitled project execution until that transport is
-qualified inside the guest. Trusted Smol intake remains independently available.
-Do not replace that ownership with arbitrary network access or secrets in a VM.
+The initial Smol 1.31.4 qualification (PR #672) covered fresh VM overlap, Python
+checker execution, cancellation/deadlines and request-process recovery. Current
+native build `b2ce3fa45` additionally has controlled model/trial KVM composition,
+verified ART receipts, no-call replay and direct predecessor/resource evidence;
+its [recorded limits](../../changes/terminal-systems-project-checkers.md#repaired-confinement-and-resource-qualification-on-real-kvm)
+remain explicit. Active nested caller cancellation, child VMM death and controller
+death/restart also passed physical cases 026–028 at test proof source `8012f2792`,
+with no false completion/trial ART effects, full owned cleanup and both admission
+slots reused ([evidence](../../changes/terminal-systems-project-checkers.md#active-nested-interruption-qualification-on-real-kvm)).
+Smol now forwards
+authorized POST model/trial capabilities through the trusted guest stream to
+the existing private relays. The shared model owner retains gateway, budget and
+grant custody; no provider credential or host socket enters the guest. Trusted
+intake remains an independent typed capability. These proofs do not establish
+the real Terminal Systems revision or full contribution journey.
 
 ## Design
 

.github/workflows/backend.yml

@@ -257,6 +257,9 @@ jobs:
           # Tests that exercise concurrency create their own threads.
           cargo test --workspace --locked -- --test-threads=1
 
+      - name: Verify trial qualification evidence guards
+        run: python3 external_checkers/workstream-checker-service/tests/test_qualify_smol_script.py -v
+
   lanes:
     needs: [scope, minio-image]
     if: >-

.github/workflows/mcp.yml

@@ -141,6 +141,7 @@ jobs:
           set -euo pipefail
           export WORKSTREAM_MCP_OPENAPI_COMMAND="uv run --frozen python -c 'import json; from app.main import app; print(json.dumps(app.openapi()))'"
           uv run --frozen pytest -q tests/test_contract_drift.py \
+            tests/test_checker_artifact_contract_drift.py \
             tests/test_task_execution_contract_drift.py
 
       - name: Run real isolated API-to-MCP lifecycle parity

.github/workflows/terminal-systems-checkers.yml

@@ -7,6 +7,10 @@ on:
       - 'scripts/checker-image'
       - 'backend/scripts/checker_image*.py'
       - 'backend/app/modules/checkers/api/external.py'
+      - 'external_checkers/workstream-checker-sdk/**'
+      - 'external_checkers/workstream-checker-service/src/model_relay.rs'
+      - 'external_checkers/workstream-checker-service/src/trial_relay.rs'
+      - 'external_checkers/workstream-checker-service/src/proxy_transport.rs'
       - 'backend/pyproject.toml'
       - 'backend/uv.lock'
       - '.github/workflows/terminal-systems-checkers.yml'
@@ -17,6 +21,10 @@ on:
       - 'scripts/checker-image'
       - 'backend/scripts/checker_image*.py'
       - 'backend/app/modules/checkers/api/external.py'
+      - 'external_checkers/workstream-checker-sdk/**'
+      - 'external_checkers/workstream-checker-service/src/model_relay.rs'
+      - 'external_checkers/workstream-checker-service/src/trial_relay.rs'
+      - 'external_checkers/workstream-checker-service/src/proxy_transport.rs'
       - 'backend/pyproject.toml'
       - 'backend/uv.lock'
       - '.github/workflows/terminal-systems-checkers.yml'
@@ -41,3 +49,30 @@ jobs:
         run: python -m unittest discover -s pilots/terminal_systems/checkers/pre -p 'test_*.py' -v
       - name: Build and test the actual networkless image
         run: ./scripts/checker-image pilots/terminal_systems/checkers/pre
+
+  post-image:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: '3.12'
+      - name: Check guide-derived POST rules and protocols
+        run: |
+          python -m unittest discover -s pilots/terminal_systems/checkers/post/model -p 'test_*.py' -v
+          python -m unittest discover -s pilots/terminal_systems/checkers/post/qualification -p 'test_*.py' -v
+      - name: Fetch the digest-pinned POST base
+        run: docker pull python:3.12-slim-bookworm@sha256:4766d8b510c428e595d74b9cc5bbb2fae8e26316fffb4adc89908d79aacd58a2
+      - name: Build the POST image without build-network access
+        run: >-
+          docker build --pull=false --network=none
+          --tag workstream-terminal-systems-post:ci
+          --file pilots/terminal_systems/checkers/post/model/Dockerfile
+          pilots/terminal_systems/checkers/post/model
+      - name: Smoke the actual image with a controlled model session
+        run: >-
+          python pilots/terminal_systems/checkers/post/qualify_image.py
+          --image workstream-terminal-systems-post:ci

backend/alembic/env.py

@@ -21,7 +21,7 @@
 target_metadata = Base.metadata
 
 _BASELINE_REVISION = "0001_uuid7_v01"
-_CURRENT_HEAD_REVISION = "0062_model_usage"
+_CURRENT_HEAD_REVISION = "0064_checker_trial_evidence"
 _RECREATE_GUIDANCE = (
     "Workstream v0.1 requires a fresh database; recreate this database before "
     "running the 0001_uuid7_v01 migration"
@@ -115,6 +115,8 @@ def do_run_migrations(connection: Connection) -> None:
             ("0059_neutral_guide_runtime",),
             ("0060_audit_restore_path",),
             ("0061_project_catalogue_read",),
+            ("0062_model_usage",),
+            ("0063_checker_revision_input",),
             (_CURRENT_HEAD_REVISION,),
         ):
             raise RuntimeError(_RECREATE_GUIDANCE)