Enforce architecture seams

A task uses its chosen coding agent for its session, follow-up messages and supported controls. Gimbal must keep recovery and result handling with the session's owning adapter, without silently starting unrelated replacement work.

Independent source audit at Gimbal 2dc8a21 (October 17): NOT CERTIFIED; no native-agent bypass established, but full coverage and substitution/denial evidence are missing. Current certification requires a fresh independent check; none is installed yet.

All participant requests, events, feedback, controls and outcomes use the selected logical message bus. The controller can operate execution hosts it cannot directly reach; each participant receives relevant messages.

Independent source audit at Gimbal 2dc8a21 (October 17): FAIL; execution RPC, control, observation, output and command paths bypass messaging. Current certification requires a fresh independent check; none is installed yet.

All application workflow launches use registered definitions and validated preparation. Built-ins and plugins share the same catalog and invocation boundary; alternate launch surfaces need explicit disposition.

Independent source audit at Gimbal 2dc8a21 (October 17): FAIL under the merge gate; run-prompt bypasses registered preparation. Current certification requires a fresh independent check; none is installed yet.

The selected orchestrator owns environment acquisition, readiness and release. Application features do not independently bootstrap a host around that selection.

Independent source audit at Gimbal 2dc8a21 (October 17): FAIL; SSH environment setup exists outside the selected orchestrator. Current certification requires a fresh independent check; none is installed yet.

Scoped named-value publication, acquisition and release use the selected SecretsBackend. Invalid or unavailable selected stores fail explicitly instead of silently becoming process-local memory.

Independent source audit at Gimbal 2dc8a21 (October 17): FAIL; nil selected-store construction can become memory storage. Current certification requires a fresh independent check; none is installed yet.

Every configured external login verifies identity through the selected auth.Provider, across the web and native application entrypoints.

Independent source audit at Gimbal 2dc8a21 (October 17): NOT CERTIFIED; no bypass established in inspected paths, but complete coverage and behavioral evidence are missing. Current certification requires a fresh independent check; none is installed yet.

Durable users, identity mappings and login sessions use the selected auth.Users store across login, protected requests, operator changes, logout and revocation.

Independent source audit at Gimbal 2dc8a21 (October 17): NOT CERTIFIED; no second authority established, but complete native/operator and substitution evidence are missing. Current certification requires a fresh independent check; none is installed yet.

Loading, registration, configuration validation and construction propagate the selected implementation to every caller. Missing or unusable selections cannot trigger a competing default.

Independent source audit at Gimbal 2dc8a21 (October 17): FAIL; selected-store fallback defeats construction authority, and other paths lack complete coverage. Current certification requires a fresh independent check; none is installed yet.

Storage capabilities have explicit owning seams. Public proof uploads, durable project attachments and run outputs are classified separately, with no unaccounted path around their selected backends.

Independent source audit at Gimbal 2dc8a21 (October 17): NOT CERTIFIED; CLI upload and project attachment storage boundaries remain unresolved. Current certification requires a fresh independent check; none is installed yet.

An independent whole-application check certifies every seam against the exact revision, build, plugin set and verification mechanism. Changes and expired evidence require rechecking; any failed, missing, partial or stale result blocks fulfillment and the required merge check.

Not installed. The baseline audit refused certification. Runner, cadence, freshness, independent verifier and bounded costs must be established before recurring execution.