CTW-37: durable timer, model and stream runtime

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,10 @@
+## Behavior and evidence
+
+Describe the behavior changed, the durable boundary involved, and the recovery path after interruption. Link implementation, conformance, fault/security test and documentation evidence for each capability claimed. Mark any missing gate as unverified rather than stable.
+
+## Review checklist
+
+- [ ] Record each design source as `ADRO-origin`, `public-standard-derived` or `independent-design` and review public naming against the organization's private lexical policy.
+- [ ] Check license and dependency changes; regenerate and verify the SBOM, notices and license copies when dependencies change.
+- [ ] Run the applicable tests and report commands, results, and any skipped external infrastructure or credentials.
+- [ ] Update `docs/rebuild/progress.md` and the 451-item ledger conservatively without closing an item before main-branch acceptance.

.github/workflows/contracts.yml

@@ -34,15 +34,13 @@ jobs:
       - run: ./scripts/orchestration-guard.sh
       - name: Enforce independent project identity
         run: |
-          blocked_name="$(printf '%s%s' multi ca)"
-          blocked_acronym="$(printf '%s%s' a os)"
-          if git grep -I -n -i -E "${blocked_name}|(^|[^[:alnum:]_])${blocked_acronym}([^[:alnum:]_]|$)" -- ':!THIRD_PARTY_LICENSES/**'; then
-            echo 'References to unrelated delivery platforms are not allowed.' >&2
-            exit 1
-          fi
+          ./scripts/test-public-identity.py
+          ./scripts/verify-public-identity.py
       - run: node scripts/check-html.mjs
       - run: ruby scripts/openapi-contract.rb
       - run: ruby scripts/coverage-ledger.rb --check
+      - run: ./scripts/verify-rebuild-ledger.py
+      - run: ./scripts/verify-threat-test-map.py
       - run: ruby -e 'require "yaml"; require "json"; YAML.load_file("openapi/openapi.yaml"); YAML.load_file("deploy/compose/docker-compose.yml"); YAML.load_file("charts/adro/values.yaml"); JSON.parse(File.read("charts/adro/values.schema.json")); JSON.parse(File.read("release/dependencies.json")); JSON.parse(File.read("SBOM"))'
       - run: bash -n examples/three-repo-feign/run.sh
       - run: bash -n start.sh

Makefile

@@ -1,4 +1,4 @@
-.PHONY: test test-race vet build architecture fuzz-smoke store-conformance coverage-ledger contracts supply-chain fault-matrix browser postgres-conformance production-conformance real-e2e dsh-real real-evidence test-expert test-all verify run local
+.PHONY: test test-race vet build architecture fuzz-smoke store-conformance coverage-ledger rebuild-ledger threat-map contracts supply-chain fault-matrix browser postgres-conformance production-conformance real-e2e dsh-real real-evidence test-expert test-all verify run local
 
 GO ?= ./scripts/e2e-go.sh
 
@@ -26,6 +26,12 @@ store-conformance:
 coverage-ledger:
 	ruby scripts/coverage-ledger.rb --check
 
+rebuild-ledger:
+	./scripts/verify-rebuild-ledger.py
+
+threat-map:
+	./scripts/verify-threat-test-map.py
+
 contracts:
 	bash -n start.sh
 	bash -n scripts/lib/env-file.sh
@@ -60,6 +66,10 @@ contracts:
 	node scripts/check-html.mjs
 	ruby scripts/openapi-contract.rb
 	ruby scripts/coverage-ledger.rb --check
+	./scripts/verify-rebuild-ledger.py
+	./scripts/verify-threat-test-map.py
+	./scripts/test-public-identity.py
+	./scripts/verify-public-identity.py
 	ruby -rjson -e 'require "yaml"; YAML.load_file("openapi/openapi.yaml"); YAML.load_file("deploy/compose/docker-compose.yml"); YAML.load_file("charts/adro/Chart.yaml"); YAML.load_file("charts/adro/values.yaml"); JSON.parse(File.read("charts/adro/values.schema.json")); JSON.parse(File.read("release/dependencies.json")); JSON.parse(File.read("SBOM"))'
 	bash -n examples/three-repo-feign/run.sh
 

README.md

@@ -76,6 +76,12 @@ with a different value does not replace an existing password. For a local
 profile where the password is unknown, stop ADRO, back up and remove its
 `auth.json`, then start once with a new password of at least 10 characters.
 
+Machine callers use short-lived, audience-bound service credentials; the old
+shared `ADRO_API_TOKEN` setting is rejected. Initialize and issue credentials
+with `adroctl service-credential`, then set `ADRO_SERVICE_CREDENTIAL_FILE`.
+Rotation, revocation, file permissions, and failure semantics are documented in
+`docs/operations/identity-and-service-credentials.md`.
+
 Open `http://127.0.0.1:8081`. The API readiness endpoint is
 `http://127.0.0.1:8080/readyz`.
 

README.zh-CN.md

@@ -65,6 +65,11 @@ ADRO_ADMIN_PASSWORD='change-this-password' \
 如果忘记了本地密码，请先停止 ADRO，备份并删除对应的 `auth.json`，再使用至少
 10 个字符的新密码启动一次。
 
+机器调用方使用绑定 audience 的短期服务凭据；旧的共享 `ADRO_API_TOKEN` 配置会
+被拒绝。使用 `adroctl service-credential` 初始化、签发、轮换和撤销凭据，并设置
+`ADRO_SERVICE_CREDENTIAL_FILE`。完整运维与失败语义见
+`docs/operations/identity-and-service-credentials.md`。
+
 启动后访问 `http://127.0.0.1:8081`，API 就绪检查为
 `http://127.0.0.1:8080/readyz`。