[arDaraz]

Summary

• make the Bash-to-service cutover single-writer and crash-safe with revisioned checkpoints, a write barrier, and durable event spooling
• define brokered, run-scoped provider authentication for sandboxed Claude and Codex workers
• require revision-pinned branch publication before verified or direct pull-request delivery
• persist deterministic return-state provenance for suspended and waiting jobs and runs

Why

The platform specification still had two critical and two important design gaps. They could cause state loss during migration, expose reusable model-provider credentials, create a PR from an unverified remote revision, or restore a job to the wrong state after restart.

Impact

This is a documentation-only change to the proposed CrewBoss 1.0 design. It does not change the currently shipped Bash CLI. The schema, state machines, adapter contracts, migration plan, security model, roadmap, and acceptance gates now describe the same behavior.

Validation

• bash tests/run — 75 tests passed
• git diff --check
• targeted contract assertions for all four findings
• independent focused review confirmed every original finding is closed