L05 — Production Orchestrator module gate #6

Outcome

Bounded headless production, batch order, and isolated untrusted worker supervision.

Module owner

PdfTool. Adapters in other surfaces consume this module contract; they do not create alternate PDF or provenance authority.

Entry dependencies

• L01 — Evidence Core
• L04 — Governed Operation Engine

Exit gate

Supervisor survives worker faults; batch and interactive flows share Core semantics, exact identities, and artifact receipts.

Native sub-issues

• L05-01 — Define PdfTool supervisor-worker protocol
• L05-02 — Survive worker crash, timeout, and breach
• L05-03 — Preserve production stage order
• L05-04 — Audit scheduler consumers and queue pressure
• L05-05 — Prove CLI and Action List policy parity
• L05-06 — Qualify restartable batch publication

Evidence and scope rules

Pin the starting SHA. Distinguish implementation, runtime proof, independent proof, and release admission. Use the repository's mapped tests, architecture proof lanes, check-change gate, and a scoped changelog fragment for PRs. Do not import legacy status as loop2 completion. Resolve overlaps by verifying current code first and updating an existing outcome branch if one exists.

Sources

Approved master roadmap · Legacy/research intake (legacy #238).