[echoomegaprime]

Objective

Reconcile source-bound project runners with the newer governed execution and recovery lineage. The API and worker select the same operator-owned tenant/project/repository/exact-source binding, verify dependency hashes before customer execution, and commit that binding to the measured environment. Other repositories retain the default restricted sandbox; callers cannot select an image or replace the validated journey.

This draft is stacked on PR31, agent/certforge-ecf-release-reconcile-20261027 at 4878c04fc044f16fa917f473b965cacd62d48609. It ports the existing PR33 project-binding delta while preserving the newer operator-input circuit, subscriber claims, tenant isolation, intake recovery, signing and deployment protections. The new binding rejection uses the existing bounded tenant retry delay. Real Windows acceptance also exposed transaction-only SQLite contexts that retained owned handles; explicit closure preserves commit/rollback and strict cleanup.

Evidence

• Exact source: 95bfed62905543c061414a5149b471605f51c65b; tree c099925fccb08a7e9b1cbe787bcc3cc7c5f76e67.
• Full deterministic suite: 829 passed, 7 existing platform-specific cases skipped; 81.43% branch coverage, above the unchanged 80% threshold.
• Compile, generated 62-capability SDK contract, staged Gitleaks scan and diff whitespace checks passed.
• P1, P6 and P7 local fixture acceptance passed. Their original committed report bytes were restored exactly; these new fixture outputs are not production attestations.
• Negative controls reproduced absent project-profile support, an immediate retry of an unadmitted source, and open SQLite handles before the respective repairs.
• API/worker profile agreement, altered/missing dependency rejection, default isolation, operator-drift circuit classification, two-tenant progress, connection closure and transaction commit/rollback passed.
• Structural comparison preserved all 22 existing telemetry methods after normalizing only the 16 context-manager replacements; SQL and authorization logic are unchanged.
• Independent parent source review and fresh exact-candidate Commander build preflight: 32 required checks passed.
• Hosted CI: pending this draft's actual run.

Security and release impact

• No secrets, private evidence, customer data or personal information are included.
• Verdict behavior remains deterministic and fail closed.
• Public contract and documentation changes are included.
• Staging-first deployment and paired release/profile rollback implications are documented.
• Unrelated history, existing artifacts, image declarations, deployment files, policies and license boundaries are preserved.

This is source delivery only. No running service, live SDK registration, runtime profile, scope, trust root, signing key or current report renewal changed. Install the matching API/worker/dispatcher, generated SDK contract and paired App caller only through the existing release path. Actual image qualification, App-principal/project ownership, profile admission, staging acceptance and independent exact-SHA certification remain required before installation, merge or deployment.