brainx · brainx · Sep 14, 2026 · Sep 13, 2026 · Sep 13, 2026 · Sep 13, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -208,3 +208,24 @@ jobs:
             dist/SHA256SUMS.txt
           if-no-files-found: error
           retention-days: 7
+
+  ci-required:
+    if: always()
+    needs:
+      - test
+      - lifecycle-subprocess
+      - package
+      - real-hermes
+      - audit-docker-isolation
+      - macos-process-lifecycle
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+      - name: Require successful CI dependencies
+        env:
+          ZEUS_CI_NEEDS_JSON: ${{ toJSON(needs) }}
+        run: python scripts/check_ci_required.py
diff --git a/README.md b/README.md
@@ -74,6 +74,90 @@ The matching authenticated routes are `GET /reconcile/runs`,
 `GET /reconcile/runs/<run-id>`, and `GET /fleet`. See [API](docs/API.md) and
 [reconciliation](docs/RECONCILE.md) for filters and freshness semantics.
 
+## Quick Start
+
+### 1. Credential-free offline demo
+
+The fastest first success needs no Hermes installation, Docker, or provider
+credentials. From a checkout:
+
+```bash
+python3 -m venv .venv
+. .venv/bin/activate
+python -m pip install -e .
+
+zeus demo up
+zeus demo status
+zeus demo down
+```
+
+The demo uses Zeus' packaged fake-Hermes executable and stores its disposable
+runtime under `ZEUS_STATE_DIR` (the workspace-local `.zeus/` directory by
+default). It exercises real profile rendering and process lifecycle behavior
+without contacting a provider.
+
+### 2. Real Hermes setup
+
+Check the installed Hermes version, then prepare a private workspace secret
+file:
+
+```bash
+hermes --version
+cp .env.example .env
+chmod 0600 .env
+```
+
+`.env.example` contains empty placeholders and is not ready to import. Stop here
+until `.env` contains a real, non-empty provider key required by the selected
+template, such as `OPENROUTER_API_KEY` for `coding-bot`. As an alternative,
+provide the same named secret through a secure process-environment mechanism.
+
+Then validate Zeus and render the real Hermes profile:
+
+```bash
+zeus doctor
+zeus template list
+zeus bot create coder --template coding-bot --env-from OPENROUTER_API_KEY
+zeus bot doctor coder
+```
+
+`--env-from NAME` imports a named value from the process environment first and
+then the trusted workspace `./.env`; the value never enters the Zeus argument
+list or command output. A present but empty process value is an error and does
+not fall back to `.env`. Keep the workspace `.env` private with `chmod 0600 .env`.
+The legacy `--env NAME=VALUE` form remains available
+for non-secret compatibility values, but is unsafe for secrets because command
+arguments can be retained in shell history and exposed in process listings.
+
+Safety model: Zeus is a local process orchestrator, not a sandbox. Use Docker or
+another Hermes terminal backend for untrusted tasks. Do not expose the API
+directly to a network; keep it on loopback or behind a separately hardened
+access layer. Logs and audit events may contain sensitive operational data, so
+protect and rotate `$ZEUS_STATE_DIR`.
+
+Start the local API with an explicit key:
+
+```bash
+ZEUS_API_KEY=change-me sh scripts/start.sh
+```
+
+## 60-Second Demo
+
+The pre-recorded asciinema cast in [docs/assets/demo.cast](docs/assets/demo.cast)
+illustrates the local operator flow. It is not evidence that the current Zeus
+checkout is compatible with whichever Hermes version is installed today; use
+the live verification steps below for that evidence.
+
+```bash
+zeus doctor
+zeus template list
+zeus bot create coder --template coding-bot
+zeus bot start coder
+zeus bot status coder
+zeus bot logs coder
+zeus bot stop coder
+```
+
 ## Repository Audit
 
 `zeus audit` is a report-only, host-local review of the exact committed `HEAD`.
@@ -205,90 +289,6 @@ do not count as security coverage. Commands carrying `control_ids` run with the
 committed snapshot read-only; configure those tools to place caches and build
 output under `/tmp`.
 
-## Quick Start
-
-### 1. Credential-free offline demo
-
-The fastest first success needs neither Hermes nor provider credentials. From a
-checkout:
-
-```bash
-python3 -m venv .venv
-. .venv/bin/activate
-python -m pip install -e .
-
-zeus demo up
-zeus demo status
-zeus demo down
-```
-
-The demo uses Zeus' packaged fake-Hermes executable and stores its disposable
-runtime under `ZEUS_STATE_DIR` (the workspace-local `.zeus/` directory by
-default). It exercises real profile rendering and process lifecycle behavior
-without contacting a provider.
-
-### 2. Real Hermes setup
-
-Check the installed Hermes version, then prepare a private workspace secret
-file:
-
-```bash
-hermes version
-cp .env.example .env
-chmod 0600 .env
-```
-
-`.env.example` contains empty placeholders and is not ready to import. Stop here
-until `.env` contains a real, non-empty provider key required by the selected
-template, such as `OPENROUTER_API_KEY` for `coding-bot`. As an alternative,
-provide the same named secret through a secure process-environment mechanism.
-
-Then validate Zeus and render the real Hermes profile:
-
-```bash
-zeus doctor
-zeus template list
-zeus bot create coder --template coding-bot --env-from OPENROUTER_API_KEY
-zeus bot doctor coder
-```
-
-`--env-from NAME` imports a named value from the process environment first and
-then the trusted workspace `./.env`; the value never enters the Zeus argument
-list or command output. A present but empty process value is an error and does
-not fall back to `.env`. Keep the workspace `.env` private with `chmod 0600 .env`.
-The legacy `--env NAME=VALUE` form remains available
-for non-secret compatibility values, but is unsafe for secrets because command
-arguments can be retained in shell history and exposed in process listings.
-
-Safety model: Zeus is a local process orchestrator, not a sandbox. Use Docker or
-another Hermes terminal backend for untrusted tasks. Do not expose the API
-directly to a network; keep it on loopback or behind a separately hardened
-access layer. Logs and audit events may contain sensitive operational data, so
-protect and rotate `$ZEUS_STATE_DIR`.
-
-Start the local API with an explicit key:
-
-```bash
-ZEUS_API_KEY=change-me sh scripts/start.sh
-```
-
-## 60-Second Demo
-
-The pre-recorded asciinema cast in [docs/assets/demo.cast](docs/assets/demo.cast)
-illustrates the local operator flow. It is not evidence that the current Zeus
-checkout is compatible with whichever Hermes version is installed today; use
-the live verification steps below for that evidence.
-
-```bash
-zeus doctor
-zeus template list
-zeus bot create coder --template coding-bot
-zeus bot start coder
-zeus bot status coder
-zeus bot logs coder
-zeus bot stop coder
-```
-
 ## Documentation
 
 - [Architecture](docs/ARCHITECTURE.md)

diff --git a/docs/API.md b/docs/API.md
@@ -243,7 +243,7 @@ Returns:
 
 Authenticated state-store readiness check, also available as `GET /v1/ready`.
 It opens the existing SQLite database in read-only mode, requires schema version
-6, and executes `SELECT 1`; it does not inspect or start bots. A stopped bot does
+10, and executes `SELECT 1`; it does not inspect or start bots. A stopped bot does
 not make Zeus unready.
 
 The route uses the normal read-endpoint authentication policy. It requires
@@ -254,7 +254,7 @@ probe.
 Success returns:
 
 ```json
-{"schema_version":9,"status":"ready"}
+{"schema_version":10,"status":"ready"}
 ```
 
 An unavailable, missing, malformed, older, or newer state database returns

diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
@@ -33,7 +33,9 @@ Set `ZEUS_STATE_DIR` to use a different runtime root.
 - `zeus.templates`: Bundled plus local TOML template discovery with duplicate ID checks.
 - `zeus.renderer`: Hermes profile rendering.
 - `zeus.sqlite_db`: Shared SQLite connection factory and per-connection durability policy.
-- `zeus.schema`: Schema-v6 initialization, compatibility guards, and forward migrations.
+- `zeus.schema`: Schema-v10 initialization, compatibility guards, and forward migrations.
+- `zeus.message_store`: Durable job receipts, read-only capacity observations,
+  and bounded logical archival that retains replay identities.
 - `zeus.idempotency_store`: Durable API mutation claims and replay responses.
 - `zeus.reconcile_store`: Persisted fleet reconciliation runs and ordered results.
 - `zeus.bot_lifecycle_store`: Bot projection, intent, lifecycle ledger, history, and audit mirror.
@@ -55,9 +57,15 @@ Set `ZEUS_STATE_DIR` to use a different runtime root.
 - `zeus.gateway_runtime`: Public process-effects facade; launch, marker,
   ownership, stop, and low-level process helpers are isolated behind it.
 - `zeus.intent_recovery`: Store-free pending-intent recovery decisions through a structural host.
-- `zeus.supervisor`: Public lifecycle compatibility facade. Focused internal
-  modules own core coordination, runtime compatibility, start, stop/restart,
-  reconciliation/recovery, status/inspection, and registry/profile operations.
+- `zeus.supervisor`: Public lifecycle facade with explicit delegates to five
+  stateless operation services for registry, status, start, stop, and reconcile.
+  Each service receives the current supervisor through a narrow typed host
+  interface; callbacks are resolved when called so supported overrides remain live.
+- `zeus.supervisor_runtime`: The single concrete supervisor core owns construction,
+  locks, event coordination, and runtime compatibility properties. The old
+  `supervisor_core` import path and `_SupervisorRuntime` name remain compatibility
+  aliases. `GatewayRuntime` retains process effects; `ProfileManager` retains
+  profile transactions; `PendingIntentRecovery` retains bounded recovery decisions.
 - `zeus.api`: Local HTTP routes and compatibility facade.
 - `zeus.cli`: Operator CLI.
 - `zeus.audit_*`: Native, report-only audit components for committed `HEAD`
@@ -242,13 +250,20 @@ The v2-to-v3 migration is also one transaction. It creates a
 the projection/event invariant, and advances the schema version only after all
 steps succeed. Additive v3-to-v4 and v4-to-v5 upgrades add durable idempotency
 and desired/pending intent in forward-only transactions. Databases newer than
-schema v9 are rejected rather than downgraded.
+schema v10 are rejected rather than downgraded.
 
 Schema v8 adds operator-message receipts without rewriting bot projections or
 events. A FULL-synchronous transaction reserves a stable upstream idempotency key
 before an HTTP request; no database lock spans network I/O. Attempt leases and
 compare-and-swap versions prevent overlapping retries or stale acknowledgements.
 Schema v9 adds a nullable release timestamp without rewriting existing receipts.
+Schema v10 adds logical archival to the same table. Only rejected or accepted
+terminal receipts can be archived; unresolved and released nonterminal work
+remains ineligible. Archival frees admission slots while retaining complete
+identity, historical replay lookup, and outcomes. It advances the concurrency
+version without refreshing gateway observation timestamps and does not reclaim
+disk space. Capacity reporting and archive preview read existing state without
+migrations, workflow construction, or gateway calls.
 One unreleased unresolved/nonterminal receipt is admitted per bot incarnation.
 The captured process generation and launch-bound messaging policy are checked
 around network operations. See [operator messaging](MESSAGING.md) for recovery

diff --git a/docs/COMPATIBILITY.md b/docs/COMPATIBILITY.md
@@ -29,7 +29,11 @@ platform guarantee.
 Python 3.14 is a provisional Zeus-only lane with `continue-on-error` behavior.
 It does not promote Python 3.14 to required Hermes compatibility: the repository
 pins Hermes Agent 0.21.0, whose package metadata requires Python 3.11 through
-3.13, and runs that compatibility gate only on Python 3.11.
+3.13, and runs that compatibility gate only on Python 3.11. The `ci-required`
+merge aggregate therefore covers the supported Python 3.11 through 3.13 matrix
+and the five focused required jobs, without the provisional Python 3.14 lane.
+Tagged release promotion applies a stricter evidence policy and separately
+requires the Python 3.14 job to have succeeded for the exact release commit.
 
 The package metadata declares `requires-python = ">=3.11"`, while committed CI
 currently tests the versions listed above. A version absent from that matrix is
@@ -52,10 +56,24 @@ setting, to persist dispatch intent before submitting a job.
 The synchronous policy itself does not change database structure. Zeus v0.6
 adds an independent forward-only migration from schema v6 to schema v7 for
 operator-query indexes. Schema v8 then adds durable operator-message receipts.
-Schema v9 adds explicit local release timestamps to those receipts.
-Existing v6/v7/v8 databases upgrade during normal startup;
+Schema v9 adds explicit local release timestamps to those receipts. Schema v10
+adds nullable logical archival timestamps and an unarchived selection index,
+preserving existing rows, unique keys, and the active-target uniqueness rule.
+Zeus `0.6.1.dev0` now reports readiness schema 10. Existing v6/v7/v8/v9 databases
+upgrade transactionally during normal startup;
 read-only history/fleet commands require the current schema. Keep all writers
-on the same Zeus version and retain a quiesced backup for rollback.
+on the same Zeus build and retain a quiesced backup for rollback. Stop every
+writer before backup and upgrade. An interrupted migration rolls back both schema
+and data. Older schema-9 binaries reject schema 10; rollback restores the complete
+pre-upgrade backup with its matching binary, rather than downgrading metadata.
+
+Olymp must explicitly accept the Zeus `0.6.1.dev0` / readiness-schema-10 pairing
+before this build is deployed with it. The same development package version may
+exist with schema 9, so a matching version string alone is insufficient evidence.
+No compatibility with an unchanged schema-9-only Olymp client is claimed.
+Message capacity/archive commands require current state and never migrate it.
+Archival restores only the unarchived admission allowance; all receipt identity
+and deduplication history remain retained and disk space is not reclaimed.
 
 ## Manual clean-host evidence
 
@@ -112,7 +130,7 @@ rendered profile, environment, logs, or process arguments.
 
 The manual [`scripts/verify_real_hermes.sh`](../scripts/verify_real_hermes.sh)
 check still uses whichever `hermes` executable is installed on `PATH` unless
-`ZEUS_VERIFY_EXPECTED_HERMES_VERSION` is set. Record `hermes version` with manual
+`ZEUS_VERIFY_EXPECTED_HERMES_VERSION` is set. Record `hermes --version` with manual
 evidence. Passing the pinned baseline does not establish compatibility with every
 Hermes release or optional integration.