beyondnetcode · beyondnetPeru · Jul 13, 2026 · Jul 13, 2026 · chatgpt-codex-connector · Jul 13, 2026
diff --git a/product/infra/helm/evolith-agent-runtime/values-local.yaml b/product/infra/helm/evolith-agent-runtime/values-local.yaml
@@ -7,6 +7,14 @@ image:
 
 replicaCount: 1
 
+# GT-438 (local kind): govern over the REAL stateless Core in the cluster (not the stub).
+# The agent-runtime calls core-api POST /api/v1/evaluate over the in-cluster service, with
+# the shared local API key. AGENT_RUNTIME_CORE_ENDPOINT must be the FULL evaluate URL.
+extraEnv:
+  AGENT_RUNTIME_CORE_ENDPOINT: "http://evolith-core-api-evolith-core-api/api/v1/evaluate"
+  AGENT_RUNTIME_CORE_TOKEN: "local-dev-key"
+  AGENT_RUNTIME_AUDIT_DIR: "/tmp/audit"
+
 ingressRoute:
   enabled: false
 

diff --git a/reference/core/control-center/gaps/gap-tracking.es.md b/reference/core/control-center/gaps/gap-tracking.es.md
@@ -100,7 +100,7 @@ Este tablero es la única fuente de verdad para deuda técnica, gaps, oportunida
 | [`GT-435`](./gap-reference-catalog.es.md#gt-435) | EPIC — Camino a Producción del diagrama conceptual de la suite (Core hubs → Hermes/Agent Runtime → Exposición CLI/API/MCP → Tracker → satélites). Evaluación 2026-07-04: Core ~95% listo (L4); el único bloqueante de CD activo es `GT-324`; la distribución está bloqueada por la deprecación a 0.0.1; el agent-runtime usa stubs por defecto; el Tracker es un scaffold .NET real pero desfasado del diseño actual de Core. **Umbrella — descompuesto en `GT-436`…`GT-446` (+ `GT-324`), organizado en dos milestones: `GT-447` (Objetivo 1 — funcional local) y `GT-448` (Objetivo 2 — producción).** | `Cross` | Cross | P0 | XL | `PENDIENTE` |
 | [`GT-436`](./gap-reference-catalog.es.md#gt-436) | Publicar los paquetes npm. El scope viejo `@evolith/*` estaba contaminado con historial publicado (1.0.x/1.1.x/2.0.0-beta/tombstones) que bloqueaba un 1.0.0 limpio, así que se renombró toda la familia a un scope nuevo unificado. **HECHO (0edaa22b): los 7 libs publicados a `1.0.0` limpio bajo `@beyondnet/evolith-*` (core-domain, infra-providers, core, agent-runtime, sdk, mcp, cli — todos HTTP 200 en el registry). Viejos `@evolith/*` deprecados apuntando a los nuevos (4 quedaron en estado 404 corrupto del registry, inservibles de todos modos).** Follow-on: barrido de docs `@evolith/*` → `@beyondnet/evolith-*`. | `CLI` | Cross | P0 | M | `COMPLETADO` |
 | [`GT-437`](./gap-reference-catalog.es.md#gt-437) | Añadir `agent-runtime-api` al CI/CD (docker build+push a GHCR + deploy Coolify) — hoy tiene Dockerfile pero NINGÚN workflow lo buildea/testea/despliega. | `Infra` | Cross | P1 | M | `PENDIENTE` |
-| [`GT-438`](./gap-reference-catalog.es.md#gt-438) | Cableado de adapters de producción para `agent-runtime-api`: el bootstrap por defecto usa `StubCoreEvaluationAdapter` + `StubAgentEngineAdapter` + estado in-memory; cablear Core-eval real (HTTP), engine (Hermes/routing), memoria durable + scheduler por defecto/env en prod. | `Agent Runtime` | Cross | P1 | M | `PENDIENTE` |
+| [`GT-438`](./gap-reference-catalog.es.md#gt-438) | Cableado de adapters de producción para `agent-runtime-api`: el bootstrap por defecto usa `StubCoreEvaluationAdapter` + `StubAgentEngineAdapter` + estado in-memory; cablear Core-eval real (HTTP), engine (Hermes/routing), memoria durable + scheduler por defecto/env en prod. **EN-PROGRESO (kind local):** el `HttpCoreEvaluationAdapter` real ya está en la factory (por env); cableado + **verificado en el cluster kind** — `values-local` del agent-runtime setea `AGENT_RUNTIME_CORE_ENDPOINT` al servicio `core-api` in-cluster, y un `POST /v1/agent/handle` produjo un `POST /api/v1/evaluate` real al core-api (SecurityAudit: `200 ALLOW 569ms`, desde el pod del runtime). El runtime ya gobierna sobre el Core REAL, no el stub. **Pendiente:** agent-engine real (gated GT-385), estado durable, y ensamblar un contexto de workspace real (hoy el Core evalúa un contexto vacío → 39 findings correctos tipo GOV-000). | `Agent Runtime` | Cross | P1 | M | `EN-PROGRESO` |
 | [`GT-439`](./gap-reference-catalog.es.md#gt-439) | Forzar auth fail-closed + cablear `TenantCorpusGuard` (ABAC multi-tenant, GT-394 runtime): `EVOLITH_API_KEY` es opt-in y el guard de tenant está definido pero no en `APP_GUARD`; sin extracción de tenant-claim del JWT, sin aislamiento de corpus por tenant. | `Security` | Cross | P1 | M | `EN-PROGRESO` |
 | [`GT-440`](./gap-reference-catalog.es.md#gt-440) | Completar observabilidad: añadir `/metrics` (Prometheus) a `mcp-server` + `agent-runtime-api`; `OTEL_EXPORTER_OTLP_ENDPOINT` configurable; split liveness/readiness. **HECHO (b3c6557f): `/metrics` en los 3 servicios (core-api existente + mcp `evolith_mcp_*` + agent-runtime `evolith_agent_runtime_*`), `/health/live`+`/health/ready` en mcp+agent-runtime, OTEL endpoint por env. Verificado en el stack local (todos 200).** | `Observability` | Cross | P1 | M | `COMPLETADO` |
 | [`GT-441`](./gap-reference-catalog.es.md#gt-441) | HITL real de aprobación (extiende GT-387): el `AutoApprovalAdapter` por defecto auto-aprueba y `ChatApprovalAdapter`/`SlackApprovalAdapter` son stubs — cablear un flujo human-in-the-loop real de Tracker/chat detrás de `IApprovalPort`. | `Agent Runtime` | Cross | P1 | M | `EN-PROGRESO` |
@@ -547,7 +547,7 @@ Este tablero es la única fuente de verdad para deuda técnica, gaps, oportunida
 | [`GT-246`](./gap-reference-catalog.es.md#gt-246) | Implementar experimentos Chaos Mesh/Litmus | `QA` | Cross | P3 | L | `COMPLETADO` |
 
 
-**Progreso:** 503 / 532 completados · 17 en progreso · 10 pendientes · 2 diferido
+**Progreso:** 503 / 532 completados · 18 en progreso · 9 pendientes · 2 diferido
 
 **Oleada 2026-06-23 (auditoría profunda de Winston III):** Añadidos 14 gaps nuevos `GT-212`…`GT-225` del Winston Audit Playbook que cubren: higiene de estado ADR (GT-212), metadata + presupuestos operativos + corpus de guías por topología (GT-213, GT-217, GT-219), observabilidad + OpenAPI en controladores REST (GT-214, GT-215), paridad de input-schemas OPA + densidad de tests por topología (GT-216, GT-222), plantillas de rollback + on-call de Fase 05 (GT-218), cobertura de ramas CLI + paridad de envelope --format + limpieza de skip-list (GT-220, GT-224, GT-225), audit logging HTTP de MCP (GT-221), y tests e2e de paridad cross-surface (GT-223).
 

diff --git a/reference/core/control-center/gaps/gap-tracking.md b/reference/core/control-center/gaps/gap-tracking.md
@@ -100,7 +100,7 @@ This board is the single source of truth for technical debt, gaps, opportunities
 | [`GT-435`](./gap-reference-catalog.md#gt-435) | EPIC — Road to Production of the conceptual suite diagram (Core hubs → Hermes/Agent Runtime → Exposure CLI/API/MCP → Tracker → satellites). Assessment 2026-07-04: Core ~95% ready (L4); the sole active CD blocker is `GT-324`; distribution blocked by the 0.0.1 package deprecation; agent-runtime defaults to stubs; Tracker is a real .NET scaffold but lagging the current Core design. **Umbrella — decomposed into `GT-436`…`GT-446` (+ `GT-324`), organized under two milestones: `GT-447` (Objective 1 — local functional) and `GT-448` (Objective 2 — production).** | `Cross` | Cross | P0 | XL | `PENDING` |
 | [`GT-436`](./gap-reference-catalog.md#gt-436) | Ship the npm packages. The old `@evolith/*` scope was polluted with published history (1.0.x/1.1.x/2.0.0-beta/tombstones) that blocked a clean 1.0.0, so the whole library family was renamed to a fresh unified scope. **DONE (0edaa22b): all 7 libs published at a clean `1.0.0` under `@beyondnet/evolith-*` (core-domain, infra-providers, core, agent-runtime, sdk, mcp, cli — all HTTP 200 on the registry). Old `@evolith/*` deprecated pointing to the new names (4 are in a broken 404 registry state and unusable anyway).** Follow-on: sweep the docs from `@evolith/*` → `@beyondnet/evolith-*`. | `CLI` | Cross | P0 | M | `DONE` |
 | [`GT-437`](./gap-reference-catalog.md#gt-437) | Add `agent-runtime-api` to CI/CD (docker build+push to GHCR + Coolify deploy) — today it has a Dockerfile but is NOT built/tested/deployed by any workflow. | `Infra` | Cross | P1 | M | `PENDING` |
-| [`GT-438`](./gap-reference-catalog.md#gt-438) | Production adapter wiring for `agent-runtime-api`: default bootstrap uses `StubCoreEvaluationAdapter` + `StubAgentEngineAdapter` + in-memory state; wire real Core-eval (HTTP), engine (Hermes/routing), durable memory + scheduler by default/env in prod. | `Agent Runtime` | Cross | P1 | M | `PENDING` |
+| [`GT-438`](./gap-reference-catalog.md#gt-438) | Production adapter wiring for `agent-runtime-api`: default bootstrap uses `StubCoreEvaluationAdapter` + `StubAgentEngineAdapter` + in-memory state; wire real Core-eval (HTTP), engine (Hermes/routing), durable memory + scheduler by default/env in prod. **IN-PROGRESS (local kind):** the real `HttpCoreEvaluationAdapter` is already in the factory (env-driven); wired + **verified in the kind cluster** — the agent-runtime `values-local` sets `AGENT_RUNTIME_CORE_ENDPOINT` to the in-cluster `core-api` service, and a `POST /v1/agent/handle` produced a real `POST /api/v1/evaluate` to core-api (SecurityAudit: `200 ALLOW 569ms`, from the runtime pod). The runtime now governs over the REAL Core, not the stub. **Remaining:** real agent-engine (GT-385-gated), durable state, and assembling a real workspace context (today the Core evaluates an empty context → 39 correct GOV-000-style findings). | `Agent Runtime` | Cross | P1 | M | `IN-PROGRESS` |
 | [`GT-439`](./gap-reference-catalog.md#gt-439) | Enforce fail-closed auth + wire `TenantCorpusGuard` (ABAC multi-tenancy, GT-394 runtime): `EVOLITH_API_KEY` is opt-in and the tenant guard is defined but not in `APP_GUARD`; no JWT tenant-claim extraction, no per-tenant corpus isolation. | `Security` | Cross | P1 | M | `IN-PROGRESS` |
 | [`GT-440`](./gap-reference-catalog.md#gt-440) | Observability completeness: add `/metrics` (Prometheus) to `mcp-server` + `agent-runtime-api`; `OTEL_EXPORTER_OTLP_ENDPOINT` configurable; liveness/readiness split. **DONE (b3c6557f): `/metrics` on all 3 services (core-api existing + mcp `evolith_mcp_*` + agent-runtime `evolith_agent_runtime_*`), `/health/live`+`/health/ready` on mcp+agent-runtime, OTEL endpoint via env. Verified on the local stack (all 200).** | `Observability` | Cross | P1 | M | `DONE` |
 | [`GT-441`](./gap-reference-catalog.md#gt-441) | Real HITL approval (extends GT-387): the default `AutoApprovalAdapter` auto-grants and `ChatApprovalAdapter`/`SlackApprovalAdapter` are stubs — wire a real Tracker/chat human-in-the-loop workflow behind `IApprovalPort`. | `Agent Runtime` | Cross | P1 | M | `IN-PROGRESS` |
@@ -547,7 +547,7 @@ This board is the single source of truth for technical debt, gaps, opportunities
 | [`GT-246`](./gap-reference-catalog.md#gt-246) | Implement Chaos Mesh/Litmus experiments | `QA` | Cross | P3 | L | `DONE` |
 
 
-**Progress:** 503 / 532 done · 17 in progress · 10 pending · 2 deferred
+**Progress:** 503 / 532 done · 18 in progress · 9 pending · 2 deferred
 
 **Wave 2026-06-23 (Winston deep audit III):** Added 14 new gaps `GT-212`…`GT-225` from the Winston Audit Playbook covering: ADR status hygiene (GT-212), topology manifest metadata + operational budgets + guidance corpus (GT-213, GT-217, GT-219), REST controller observability + OpenAPI (GT-214, GT-215), OPA input-schema parity + per-topology test density (GT-216, GT-222), SDLC Phase 05 rollback + on-call templates (GT-218), CLI branch coverage + envelope format coverage + skip-list cleanup (GT-220, GT-224, GT-225), MCP HTTP audit logging (GT-221), and cross-surface parity e2e tests (GT-223).