@@ -12,16 +12,11 @@ This sequences docs/COMPUTE_CONTROL_PLANE.md's own mechanism — contracts, sche
 
 **Before phase 3**: enroll a small number of real nodes (a handful of workstations plus, ideally, one dedicated inference server) in one pool, and confirm heartbeats/assignments actually flow — `GET /compute/summary` should show them online, and `admin-console`'s Compute page should render them with live CPU/RAM/device telemetry.
 
-## Phase 3 — Shadow mode: a real, currently-missing feature, not just an ops step
+## Phase 3 — Shadow mode (done)
 
-The original design calls for running the scheduler in shadow mode — computing placement decisions without acting on them, to compare against whatever admission already happens today (locally, each node's own `ResourceOrchestrator` continues to decide for itself). **This does not exist in the code today.** `POST /compute/requests` always calls `ComputeControlPlane.submit()`, which schedules *and* commits a real lease (`store.commitPlacement()`) in the same call — there is no `dryRun`/observe-only flag anywhere in `submitRequestBody`, `ComputeScheduler.schedule()`, or `ComputeControlPlane`.
+`POST /compute/requests?dryRun=true` computes a real scheduler decision (`ComputeScheduler.schedule()` against the real current snapshot — same code path a committing request uses) and records it as a `compute_allocation_events` row (`event_type: "shadow_decision"`) plus a `computeRequest.shadowDecision` audit entry, but never calls `commitPlacement()` — no lease is created, no capacity or quota is consumed, and the underlying request is cancelled immediately rather than left sitting in the real queue (necessary since `compute_allocation_events.request_id` is a hard `NOT NULL` foreign key — a shadow decision has to be logged against *some* real, if immediately-cancelled, request row). Verified end-to-end, including that a real submission made right after a shadow one sees completely untouched capacity, and with a real-Postgres test proving the same holds under the actual database (`postgres-compute-control-store.test.ts`, gated on `DATABASE_URL` like every other Postgres-backed test in this repo).
 
-Shipping shadow mode for real needs:
-- A `dryRun?: boolean` field on the submit-request body and `ComputeControlPlane.submit()`'s `options`, short-circuiting before `store.commitPlacement()` and returning the scheduler's decision (`SchedulerDecision`) without ever creating a lease or consuming quota/capacity.
-- Somewhere to record dry-run decisions for later comparison against what actually happened (the simplest correct option: log them as `compute_allocation_events` rows tagged `event_type: "shadow_decision"`, reusing the existing append-only audit table rather than a new one).
-- A comparison report (even a manual one, cross-referencing shadow decisions against the timing/placement of whatever local admission actually did) before trusting the scheduler's judgment on real capacity.
-
-Until this is built, **phase 4 cannot be entered safely** — there is no way to observe the scheduler's decisions without it immediately committing real leases against real capacity. This is the one concrete blocking gap in the whole rollout sequence; everything from phase 4 onward assumes it's closed first.
+What's still manual: actually *comparing* shadow decisions against whatever local admission does in parallel is a reporting exercise, not more code — query `compute_allocation_events` for `event_type = 'shadow_decision'` and cross-reference against real placements over the same window before trusting the scheduler's judgment on real capacity.
 
 ## Phase 4 — Canary pools, no preemption or borrowing
 
 
@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+// Admin tooling: signs a compute-control-plane resource policy for
+// POST /organizations/:organizationId/compute/policies (see
+// server/src/compute/policy-signature.ts and
+// server/src/routes/compute-control.ts). This is a *different* signed
+// policy from app/scripts/sign-policy.js's desktop central-policy (a local
+// AppSettings lockdown) — this one governs the compute fleet's hard CPU/GPU
+// guardrails, and its verifier lives server-side, not in the desktop app.
+//
+// Usage:
+//   node server/scripts/sign-compute-policy.js <draft.json> <private-key.pem> <organization-id> [output.json]
+//
+// <draft.json> shape (matches ResourcePolicyInput minus signature/issuedAt/
+// expiresAt, which this script fills in):
+//   {
+//     "name": "Interactive pool guardrails",
+//     "poolId": "3f2a...-uuid (optional — omit for an org-wide policy)",
+//     "expiresInDays": 30,
+//     "hardLimits": { "maxCpuThreads": 32, "maxAccelerators": 2 },
+//     "workloadClassLimits": {
+//       "background": { "maxCpuThreads": 8, "allowCpuFallback": true }
+//     }
+//   }
+//
+// The private key must be an Ed25519 PEM (see
+// app/scripts/generate-policy-keypair.js's --curve ed25519 mode, or any
+// `openssl genpkey -algorithm ed25519` key) — the server's
+// createComputePolicySignatureVerifier() only ever verifies Ed25519.
+//
+// Output is the exact JSON body POST /compute/policies expects — pipe it
+// straight into that request (e.g. via curl -d @output.json), or paste it
+// into the admin console's "paste signed policy" step.
+
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+
+const [, , draftPath, privateKeyPath, organizationId, outputPathArg] = process.argv;
+if (!draftPath || !privateKeyPath || !organizationId) {
+    console.error("Usage: node sign-compute-policy.js <draft.json> <private-key.pem> <organization-id> [output.json]");
+    process.exit(1);
+}
+
+const draft = JSON.parse(fs.readFileSync(draftPath, "utf-8"));
+if (!draft.name || typeof draft.name !== "string") {
+    console.error('draft.json must include a non-empty string "name"');
+    process.exit(1);
+}
+if (!Number.isFinite(draft.expiresInDays) || draft.expiresInDays <= 0) {
+    console.error('draft.json must include a positive number "expiresInDays"');
+    process.exit(1);
+}
+if (!draft.hardLimits || typeof draft.hardLimits !== "object") {
+    console.error('draft.json must include a "hardLimits" object (may be empty: {})');
+    process.exit(1);
+}
+
+const now = new Date();
+const expiresAt = new Date(now.getTime() + draft.expiresInDays * 24 * 60 * 60 * 1000);
+
+// The exact unsigned shape createComputePolicySignatureVerifier() re-derives
+// server-side and compares the signature against — every field here must
+// match resourcePolicyInputSchema (minus signature) or the server's own
+// recomputed canonical payload will differ and verification will fail.
+const unsigned = {
+    ...(draft.poolId ? { poolId: draft.poolId } : {}),
+    name: draft.name,
+    hardLimits: draft.hardLimits,
+    workloadClassLimits: draft.workloadClassLimits ?? {},
+    issuedAt: now.toISOString(),
+    expiresAt: expiresAt.toISOString(),
+};
+
+// Mirrors server/src/compute/policy-signature.ts's canonicalize()/
+// canonicalComputePolicyPayload() exactly — this script is standalone (not
+// part of the server's TS build) so it can't import that function directly.
+// If you change one, change both; policy-signature.test.ts's round-trip
+// tests are what would catch drift on the server side.
+function canonicalize(value) {
+    if (Array.isArray(value)) return value.map(canonicalize);
+    if (value && typeof value === "object") {
+        const sorted = {};
+        for (const key of Object.keys(value).sort()) sorted[key] = canonicalize(value[key]);
+        return sorted;
+    }
+    return value;
+}
+function canonicalComputePolicyPayload(orgId, input) {
+    return JSON.stringify(canonicalize({ organizationId: orgId, ...input }));
+}
+
+const payloadString = canonicalComputePolicyPayload(organizationId, unsigned);
+const privateKey = crypto.createPrivateKey(fs.readFileSync(privateKeyPath, "utf-8"));
+// Unlike sign-policy.js's desktop central-policy (hex signature), the
+// compute-policy verifier expects base64 — see
+// createComputePolicySignatureVerifier()'s `Buffer.from(input.signature,
+// "base64")`. Getting this encoding wrong is the single easiest way to
+// produce a policy that silently fails verification (400
+// invalid_compute_policy_signature) despite a technically-correct signature.
+const signature = crypto.sign(null, Buffer.from(payloadString, "utf-8"), privateKey);
+
+const signed = { ...unsigned, signature: signature.toString("base64") };
+
+const outputPath = outputPathArg ?? "compute-policy.json";
+fs.writeFileSync(outputPath, JSON.stringify(signed, null, 2));
+
+console.log(`Wrote ${outputPath}`);
+console.log(`  name:      ${signed.name}`);
+console.log(`  poolId:    ${signed.poolId ?? "(org-wide)"}`);
+console.log(`  issuedAt:  ${signed.issuedAt}`);
+console.log(`  expiresAt: ${signed.expiresAt}`);
+console.log(`\nPOST this file's contents to /organizations/${organizationId}/compute/policies to create it.`);
@@ -15,12 +15,29 @@ export interface SubmitResult {
 export class ComputeControlPlane {
     constructor(private readonly store: ComputeControlStore, private readonly scheduler = new ComputeScheduler(), private readonly now: () => Date = () => new Date()) {}
 
-    async submit(organizationId: string, input: SubmitComputeRequestInput, actor: AuditActor, options: { allowSafePreemption?: boolean } = {}): Promise<SubmitResult> {
+    async submit(organizationId: string, input: SubmitComputeRequestInput, actor: AuditActor, options: { allowSafePreemption?: boolean; dryRun?: boolean } = {}): Promise<SubmitResult> {
         const request = await this.store.submitRequest(organizationId, input, actor);
+        if (options.dryRun) return this.submitDryRun(organizationId, request, actor, options);
         const scheduled = await this.scheduleRequest(request, actor, options);
         return { request: (await this.store.getRequest(organizationId, request.id)) ?? request, ...scheduled };
     }
 
+    /** Computes and records what the scheduler *would* decide, without ever
+     * calling commitPlacement — no lease is created, no capacity is
+     * consumed, and no other request's admission is affected. The
+     * underlying request row still has to exist momentarily (see
+     * recordShadowDecision's own doc comment on the store interface) but is
+     * cancelled immediately after, so it never lingers in the real queue. */
+    private async submitDryRun(organizationId: string, request: ComputeResourceRequest, actor: AuditActor, options: { allowSafePreemption?: boolean }): Promise<SubmitResult> {
+        const snapshot = await this.store.getSchedulingSnapshot(organizationId, request.poolId, this.now().toISOString());
+        const decision: SchedulerDecision = snapshot
+            ? this.scheduler.schedule(request, snapshot, options)
+            : { status: "rejected", reasons: ["The selected compute pool no longer exists."] };
+        await this.store.recordShadowDecision(organizationId, request.id, decision, actor);
+        const cancelled = await this.store.cancelRequest(organizationId, request.id, actor);
+        return { request: cancelled ?? request, decision };
+    }
+
     async scheduleRequest(request: ComputeResourceRequest, actor: AuditActor, options: { allowSafePreemption?: boolean } = {}): Promise<{ decision: SchedulerDecision; lease?: ComputeResourceLease }> {
         const snapshot = await this.store.getSchedulingSnapshot(request.organizationId, request.poolId, this.now().toISOString());
         if (!snapshot) return { decision: { status: "rejected", reasons: ["The selected compute pool no longer exists."] } };
 
@@ -88,6 +88,30 @@ describe("compute control routes", () => {
         expect(after.json()).toMatchObject({ poolId, weight: 3, reservedCpuThreads: 4, burstAccelerators: 2 });
     });
 
+    it("shadow mode (dryRun) computes a real placement decision without creating a lease or leaving the request queued", async () => {
+        const { poolId } = await enrollAndPool();
+        const body = {
+            poolId, workloadKind: "active-inference", priority: "interactive", profile: "interactive", checkpointable: false, restartable: false,
+            requirements: { cpuThreads: 4, ramMB: 4_096, pinnedMemoryMB: 0, acceleratorCount: 1, acceleratorDeviceIds: [], acceleratorVendor: "nvidia", vramMBPerDevice: 4_096, sameNumaNode: false, sameVendor: true, exclusiveAccelerators: true, runtime: "llamacpp", modelId: "model-4b", allowCpuFallback: false },
+        };
+
+        const dryRun = await app.inject({ method: "POST", url: `/organizations/${organizationId}/compute/requests?dryRun=true`, headers: { authorization: `Bearer ${token}` }, payload: body });
+        expect(dryRun.statusCode, dryRun.body).toBe(200);
+        expect(dryRun.json().decision.status).toBe("placed");
+        expect(dryRun.json().lease).toBeUndefined();
+        expect(dryRun.json().request.state).toBe("cancelled");
+
+        // A real (non-dry-run) request right after must still see full
+        // capacity — the shadow decision consumed nothing.
+        const real = await app.inject({ method: "POST", url: `/organizations/${organizationId}/compute/requests`, headers: { authorization: `Bearer ${token}` }, payload: body });
+        expect(real.statusCode, real.body).toBe(201);
+        expect(real.json().decision.status).toBe("placed");
+        expect(real.json().lease).toBeDefined();
+
+        const leases = await app.inject({ method: "GET", url: `/organizations/${organizationId}/compute/leases`, headers: { authorization: `Bearer ${token}` } });
+        expect(leases.json()).toHaveLength(1);
+    });
+
     it("does not expose another organization's inventory", async () => {
         await enrollAndPool();
         const otherToken = await new SignJWT({ sub: "idp|other" }).setProtectedHeader({ alg: "RS256", kid: KID }).setIssuedAt().setIssuer(ISSUER).setAudience(AUDIENCE).setExpirationTime("1h").sign(key);
 
@@ -152,12 +152,18 @@ export function registerComputeControlRoutes(fastify: FastifyInstance, deps: Rou
         const { organizationId } = organizationParams.parse(request.params);
         const caller = await requireOrgUser(deps, request, organizationId);
         await requirePermission(deps.store, caller, "compute:submit", `organization:${organizationId}/computeRequest:*`);
+        // Shadow mode (docs/COMPUTE_CONTROL_PLANE_ROLLOUT.md phase 3): a
+        // query flag, not a body field, since it shapes how this call is
+        // processed rather than being a property of the request itself —
+        // matches poolId/state below being query params, not body fields,
+        // for the same reason.
+        const dryRun = (request.query as { dryRun?: string }).dryRun === "true";
         const elapsed = startTimer();
-        const result = await deps.computeControlPlane.submit(organizationId, submitRequestBody.parse(request.body), actorFrom(caller), { allowSafePreemption: true });
+        const result = await deps.computeControlPlane.submit(organizationId, submitRequestBody.parse(request.body), actorFrom(caller), { allowSafePreemption: true, dryRun });
         const decisionStatus = result.decision.status;
-        computeSchedulingDecisionDuration.observe({ result: decisionStatus }, elapsed());
-        computeSchedulingDecisions.inc({ result: decisionStatus });
-        reply.code(201).send(result);
+        computeSchedulingDecisionDuration.observe({ result: dryRun ? `shadow-${decisionStatus}` : decisionStatus }, elapsed());
+        computeSchedulingDecisions.inc({ result: dryRun ? `shadow-${decisionStatus}` : decisionStatus });
+        reply.code(dryRun ? 200 : 201).send(result);
     });
 
     fastify.get("/organizations/:organizationId/compute/requests", { preHandler: deps.authPreHandler }, async (request, reply) => {
 
@@ -42,4 +42,25 @@ describe("InMemoryComputeControlStore", () => {
         expect(await store.sweepExpired(now.toISOString())).toEqual([result.lease!.id]);
         expect((await store.getRequest(ORG, result.request.id))?.state).toBe("queued");
     });
+
+    it("dryRun computes a real decision, consumes no capacity, and leaves the request cancelled, not queued", async () => {
+        const now = new Date("2026-08-30T12:00:00.000Z");
+        const store = new InMemoryComputeControlStore(undefined, () => now);
+        await store.registerNode(ORG, { id: NODE, name: "cpu", region: "eu-tr", labels: {}, operatingSystem: "linux", architecture: "x64", agentVersion: "1", certificateFingerprint: "fp", cpuThreads: 8, freeCpuThreads: 7, totalRamMB: 16_000, freeRamMB: 14_000, numaNodes: 1, supportedRuntimes: ["llamacpp"], warmModelIds: [], inventoryVersion: "1", devices: [] }, actor);
+        const pool = await store.createPool(ORG, { name: "pool", region: "eu-tr", labels: {}, nodeIds: [NODE], status: "active", schedulingPolicy: "interactive-first" }, actor);
+        const control = new ComputeControlPlane(store, undefined, () => now);
+        const body = { poolId: pool.id, workloadKind: "cpu", priority: "background" as const, profile: "balanced" as const, requirements: { cpuThreads: 4, ramMB: 4_000, pinnedMemoryMB: 0, acceleratorCount: 0, acceleratorDeviceIds: [], vramMBPerDevice: 0, sameNumaNode: false, sameVendor: true, exclusiveAccelerators: false, runtime: "llamacpp" as const, allowCpuFallback: false }, checkpointable: false, restartable: false };
+
+        const shadow = await control.submit(ORG, body, actor, { dryRun: true });
+        expect(shadow.decision.status).toBe("placed");
+        expect(shadow.lease).toBeUndefined();
+        expect(shadow.request.state).toBe("cancelled");
+        expect(await store.listLeases(ORG)).toHaveLength(0);
+
+        // A real submission right after must see completely untouched
+        // capacity — the shadow decision must never have reserved anything.
+        const real = await control.submit(ORG, body, actor);
+        expect(real.decision.status).toBe("placed");
+        expect(real.lease).toBeDefined();
+    });
 });