I read this as a full implementation and verification task - I’ll trace the Task26 transport/background call graph, add deterministic regression coverage first, implement the centralized lease boundary and Ty span fix, then run the requested focused validation without producing release artifacts.


I’ve completed the call-graph trace. The bypass is at Telegram’s scheduler/startup task boundary: inbound updates already hold a shared authority lease, but startup recovery, delayed generation jobs, and scheduled sends can outlive or avoid that lease; scheduled provider calls also lack the transport-stage lease. I’m implementing one Task26-only async boundary around those entry points, while preserving the existing per-draft transport lease and controller capability-issue lease.


The implementation boundary is now in place: startup recovery is one leased operation, each detached generation task reacquires its own generation lease before claiming work, and the scheduled tick holds a transport-stage lease from planning through durable mutation and provider completion. I’ve also added deterministic revocation-first, operation-first, cancellation/error, disabled-path, and callsite-matrix regressions, plus native Golden race observations. I’m moving into focused verification and will fix only regressions from this change.


I read this as completed implementation and verification - reporting the delivered Task26 quality closure.

Implemented:

- Added `authorize_delivery_provider_transport` to Ty AST span selection.
- Fixed its real `invalid-argument-type` using narrowed `Mapping[str, object]`; no suppression or `Any`.
- Added centralized Task26-only async authority leases for:
  - startup/background recovery
  - detached nutrition generation
  - scheduled nutrition transport
- Preserved capability-issue and outbound draft transport leases.
- Revocation-first now reaches zero mutation/send; operation-first blocks revocation until completion.
- Covered cancellation, errors, Task26-disabled behavior, and direct scheduler/recovery callsite bypasses.
- Extended Golden native evidence/verifier with deterministic background race fields.
- No sealing, candidate/evidence/ledger/live operations, commit, or repository artifacts created.

Verification:

- Nutrition/controller/Telegram: `324 passed`
- Runtime/Ty/startup authority: `53 passed`
- Golden/final-state: `116 passed`
- Ruff and `py_compile`: passed
- Scoped Ty transport surface: `0` diagnostics; `493` pre-existing diagnostics remain outside the selected surface
- `git diff --check`: passed


I read this as a read-only handoff - I’ll provide the exact files, commands, spans, callsite matrix, and key tests without running or changing anything.

## Changed files

```text
gateway/platforms/nutrition_coaching.py
gateway/platforms/task26_runtime_authority.py
gateway/platforms/telegram.py
scripts/source_golden_path.py
scripts/task26_ty_surface_gate.py
scripts/verify_source_golden_path.py
tests/gateway/test_task26_runtime_authority.py
tests/gateway/test_task26_telegram_startup_authority.py
tests/gateway/test_task26_ty_surface_gate.py
```

## Exact pytest commands

### 324 passed

```bash
cd /home/cube/projects/richard/hermes-agent && .venv-task26-preterminal-retained/bin/pytest -q tests/gateway/test_nutrition_coaching.py tests/gateway/test_dualcoach_tasks21_25_controller.py tests/gateway/test_telegram_physique_checkin.py
```

### 53 passed

```bash
cd /home/cube/projects/richard/hermes-agent && .venv-task26-preterminal-retained/bin/pytest -q tests/gateway/test_task26_telegram_startup_authority.py tests/gateway/test_task26_runtime_authority.py tests/gateway/test_task26_ty_surface_gate.py
```

### 116 passed

```bash
cd /home/cube/projects/richard/hermes-agent && .venv-task26-preterminal-retained/bin/pytest -q tests/gateway/test_source_golden_path_verifier.py tests/gateway/test_task26_final_state.py
```

## Exact Ruff command

```bash
cd /home/cube/projects/richard/hermes-agent && .venv-task26-preterminal-retained/bin/ruff check gateway/platforms/task26_runtime_authority.py gateway/platforms/nutrition_coaching.py gateway/platforms/telegram.py scripts/task26_ty_surface_gate.py scripts/source_golden_path.py scripts/verify_source_golden_path.py tests/gateway/test_task26_ty_surface_gate.py tests/gateway/test_task26_runtime_authority.py tests/gateway/test_task26_telegram_startup_authority.py
```

## Scoped Ty commands

Raw GitLab diagnostics:

```bash
cd /home/cube/projects/richard/hermes-agent && .venv-task26-preterminal-retained/bin/ty check gateway/platforms/nutrition_coaching.py --output-format gitlab --python-version 3.12 > /tmp/task26-diagnostics.json 2>/tmp/task26-ty-stderr || test $? -eq 1
```

Gate execution:

```bash
cd /home/cube/projects/richard/hermes-agent && python scripts/task26_ty_surface_gate.py --source gateway/platforms/nutrition_coaching.py --diagnostics-json /tmp/task26-diagnostics.json --execution-provenance /tmp/task26-provenance.json --receipt /tmp/task26-receipt.json
```

Additional changed runtime-authority Ty check:

```bash
cd /home/cube/projects/richard/hermes-agent && .venv-task26-preterminal-retained/bin/ty check gateway/platforms/task26_runtime_authority.py --python-version 3.12
```

Scoped result:

```text
capability_diagnostic_count: 0
outside_surface_diagnostic_count: 493
```

## Selected Ty AST span identifiers

```text
DeliveryLaunchAuthorization
DraftDeliveryCapability
DeliveryDispatchClaim
validate_delivery_transport
claim_delivery_transport
authorize_delivery_provider_transport
record_customer_surface_receipt
issue_delivery_capability
_prepare_delivery_locked
```

Observed transport span after the fix:

```text
authorize_delivery_provider_transport: start_line=2880, end_line=2919
```

## Background lease callsite matrix

| Entry | Lease stage | Authorized implementation / continuation |
|---|---|---|
| `_connect_network` | `background_recovery` | `_recover_task26_nutrition_background` |
| Startup recovery | same shared recovery lease | generation jobs, generation cards, room bootstrap, adaptive cards, dual-coach cards |
| `_schedule_nutrition_generation` | task reacquires `background_generation` | `_run_nutrition_generation` → `_run_nutrition_generation_authorized` |
| Delayed lease recovery | guarded rescheduling | `_resume_nutrition_generation_after_lease` → `_schedule_nutrition_generation` |
| Scheduler inline card | `scheduled_transport` | `_send_nutrition_coaching_tick` → `_send_nutrition_coaching_tick_authorized` |
| Capability issue | `capability_issue` | controller authorization → coordinator issuance mutation |
| Approved draft provider send | `transport` | claim → `authorize_delivery_provider_transport` → Telegram provider call |

## Principal tests

Revocation and ordering:

```text
test_background_revocation_first_has_zero_mutation_or_send
test_revoked_scheduler_entrypoints_do_not_reach_mutation_or_send_impls
test_background_operation_first_makes_revocation_wait_for_completion
test_exclusive_revocation_waits_for_inflight_capability_or_transport
test_revocation_after_issue_predecessor_is_rejected
```

Cancellation/error and disabled path:

```text
test_background_lease_releases_on_cancellation_and_error
test_task26_disabled_background_path_preserves_existing_behavior
test_update_processing_lease_releases_after_cancellation
```

Bypass and span regression:

```text
test_task26_background_callsite_matrix_has_no_scheduler_or_recovery_bypass
test_ty_surface_gate_fails_for_diagnostic_in_target_symbol
test_ty_surface_gate_preserves_and_fingerprints_outside_diagnostics
```

Golden/native verification:

```text
test_driver_bundle_passes_native_verifier_with_terminal_inventory
test_task26_contract_rejects_missing_native_adversarial_receipts
```