Parent: treeseed-ai/platform#501. Live work/review acceptance is blocked: SDK has tracked allocation profiles, but workdays plan returns workday_profile_not_indexed. Only GitHub check-run webhook invokes the existing profile reconciler; PAT-connected local installations cannot receive that App webhook.
Contract
Add an explicit SDK/CLI workdays profiles reconcile operation, plus indexed list/show. API requires team-manage authority for reconcile; resolve the team/project-bound repository via existing Vault GitHub authority, freeze current publication head, verify successful trusted verify check for that exact head, read canonical .treeseed/workdays/allocation-profile.json and reuse existing reconciler. Reject moved heads, wrong team/repository, absent/failed checks, malformed profiles. No caller-provided JSON/commit/webhook spoof, no manual SQL, no changing readonly preflight into implicit policy activation. Result contains exact immutable receipt, never credentials. Idempotent replay must return existing accepted generation.
Tests / evidence
|Gate|Evidence|Status|
|Live preflight|workday_profile_not_indexed for sdk-testing-heavy|Confirmed|
|Ownership, check/ref scope, replay, CLI contracts, Actions|Pending|Required|
|Bounded work candidate/review acceptance|Pending|Blocked by profile indexing|
Delivery / rollback
SDK contracts -> API handlers -> CLI published dependency -> managed composition. Workday start remains separate exact-preflight admission. No workday launched automatically, no schema migration required; existing allocation receipts retained. Revert code via PR if necessary without deleting accepted profile generations.
Parent: treeseed-ai/platform#501. Live work/review acceptance is blocked: SDK has tracked allocation profiles, but workdays plan returns workday_profile_not_indexed. Only GitHub check-run webhook invokes the existing profile reconciler; PAT-connected local installations cannot receive that App webhook.
Contract
Add an explicit SDK/CLI workdays profiles reconcile operation, plus indexed list/show. API requires team-manage authority for reconcile; resolve the team/project-bound repository via existing Vault GitHub authority, freeze current publication head, verify successful trusted verify check for that exact head, read canonical .treeseed/workdays/allocation-profile.json and reuse existing reconciler. Reject moved heads, wrong team/repository, absent/failed checks, malformed profiles. No caller-provided JSON/commit/webhook spoof, no manual SQL, no changing readonly preflight into implicit policy activation. Result contains exact immutable receipt, never credentials. Idempotent replay must return existing accepted generation.
Tests / evidence
|Gate|Evidence|Status|
|Live preflight|workday_profile_not_indexed for sdk-testing-heavy|Confirmed|
|Ownership, check/ref scope, replay, CLI contracts, Actions|Pending|Required|
|Bounded work candidate/review acceptance|Pending|Blocked by profile indexing|
Delivery / rollback
SDK contracts -> API handlers -> CLI published dependency -> managed composition. Workday start remains separate exact-preflight admission. No workday launched automatically, no schema migration required; existing allocation receipts retained. Revert code via PR if necessary without deleting accepted profile generations.