Close F7, F5 and F8 before resuming burn-in

F7, security. An unset surface token makes the middleware skip its check, so a
full-control surface with no credential is an open control plane rather than a
closed one. With ORCHESTRA_TUI_TOKEN unset, any LAN caller could lease, release,
complete or block any task by declaring one header, which is how this session's
manual leases were issued. authz.RequireCredentials now refuses startup instead
of logging. Web is exempt: Sessions makes its login mandatory.

F5, lifecycle. router.go's silent `continue` was the first bug, not the
predicate behind it. Every eligibility gate now records a router.Rejection with
task, herdr and reason, exposed at GET /v1/router/health, reset per pass. No
gate was weakened: a direct Store.Lease succeeding proves the lease path, not
that eligibility should have selected that worker.

F8, correctness. Reconcile iterated every configured source for every task, so a
task's external id was looked up in whatever repository each source pointed at.
Once two repositories share an issue number, an unrelated human comment becomes
an authoritative decision for the wrong task. Reconciliation is now bound to
task.Source, the provider:project identity the ingest stamped, and a source that
cannot prove it owns the task is skipped. A task with no matching source
reconciles to nothing and still launches, because nothing to import is not a
failure to read.

The integration fixture ingested from "jsonl" while reconciling from "gitea",
which is exactly the shape F8 makes impossible; it now ingests from the source
it reconciles.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/authz/authz.go

@@ -72,6 +72,22 @@ func (s Surface) RequiresApproval(typ string) bool {
 	return CapabilityFor(s) == GatedWrite && typ != "ApprovalRequested"
 }
 
+// RequireCredentials refuses to serve a full-control surface that has no token.
+// An unset token means the middleware performs no check for that surface, so an
+// unconfigured FullControl surface is an unauthenticated control plane, not a
+// closed one. Found live during burn-in: with ORCHESTRA_TUI_TOKEN unset, any
+// LAN caller could lease, release, complete or block any task by declaring one
+// header. Web is exempt because Sessions makes its login mandatory and it
+// carries its own credentials.
+func RequireCredentials(tokens map[Surface]string) error {
+	for _, s := range []Surface{TUI} {
+		if CapabilityFor(s) == FullControl && strings.TrimSpace(tokens[s]) == "" {
+			return fmt.Errorf("surface %q is full control and has no token: set its credential or leave the surface unused", s)
+		}
+	}
+	return nil
+}
+
 func AuthorizeEvent(s Surface, typ string) error {
 	if !s.CanEmit(typ) {
 		return fmt.Errorf("surface %q cannot emit %s", s, typ)

internal/authz/authz_test.go

@@ -278,3 +278,22 @@ func TestHarnessTurnBypassesSurfaceGate(t *testing.T) {
 		t.Fatalf("harness turn = %d, want 204", w.Code)
 	}
 }
+
+// An unset surface token means no check, so a full-control surface without a
+// credential is an open control plane. Startup must refuse, not warn.
+func TestRequireCredentialsRefusesUncredentialedFullControl(t *testing.T) {
+	if err := RequireCredentials(map[Surface]string{}); err == nil {
+		t.Fatal("an uncredentialed TUI surface was accepted")
+	}
+	if err := RequireCredentials(map[Surface]string{TUI: "   "}); err == nil {
+		t.Fatal("a blank TUI token was accepted")
+	}
+	if err := RequireCredentials(map[Surface]string{TUI: "tui-secret"}); err != nil {
+		t.Fatalf("a credentialed deployment was refused: %v", err)
+	}
+	// Gated and notify-only surfaces are bounded by capability, so an unset
+	// token there is a deployment choice rather than an open control plane.
+	if err := RequireCredentials(map[Surface]string{TUI: "tui-secret", MCP: "", Agent: ""}); err != nil {
+		t.Fatalf("gated surfaces must not block startup: %v", err)
+	}
+}