@@ -112,7 +112,16 @@ jobs:
           # v2.5.0's release binary is built with go1.25.1; older v2 binaries
           # (e.g. v2.1.6, built with go1.24) refuse a config targeting go 1.25.
           version: v2.5.0
-          only-new-issues: true
+          # Compute NEW issues from git, not the GitHub diff API. The action's
+          # only-new-issues path fetches the PR patch from the API, which has a
+          # hard 20k-line ceiling ("diff too large") — a large PR then trips it
+          # and the action falls back to reporting the entire ~106-issue
+          # backlog. `--new-from-merge-base` does the identical filtering via
+          # git (fetch-depth: 0 above provides origin/main), with no ceiling:
+          # only issues on lines this PR changed relative to the merge base
+          # fail the build. Same gate, robust to PR size.
+          only-new-issues: false
+          args: --new-from-merge-base=origin/main
 
   test-go:
     name: Test (Go)
 
@@ -1,4 +1,6 @@
 .PHONY: help preflight dev test test-go test-py test-ts lint lint-go lint-py lint-ts \
+        lint-migrations \
+        sdk-conformance worker-conformance \
         build build-go build-cli build-runtime build-dashboard build-images \
         install-cli smoke-cli \
         up down logs clean install-deps fmt
@@ -17,6 +19,8 @@ help:
 	@echo "  make test-go        Run Go tests"
 	@echo "  make test-py        Run Python tests"
 	@echo "  make test-ts        Run TypeScript tests"
+	@echo "  make sdk-conformance     Live SDK conformance (py+ts) vs a running stack"
+	@echo "  make worker-conformance  Live worker-protocol conformance vs a running stack"
 	@echo "  make lint           Run all linters"
 	@echo "  make fmt            Auto-format all code"
 	@echo "  make build          Build all artifacts (CLI + runtime + dashboard)"
@@ -63,14 +67,41 @@ test-ts:
 	@echo "==> Running TypeScript tests"
 	@command -v pnpm >/dev/null && pnpm -r test 2>/dev/null || echo "(no TS tests yet)"
 
+# ─── Live conformance harnesses (run against a RUNNING stack) ──────────────
+# Config: BASE_URL (default below) and API_KEY (optional in personal mode).
+# Both harnesses emit a JSON summary on stdout and exit non-zero on any FAIL.
+BASE_URL ?= http://localhost:8080
+
+# sdk-conformance runs the Python AND TypeScript SDK harnesses back-to-back,
+# proving both SDKs speak the same live wire contract (see scripts/sdk-conformance).
+sdk-conformance:
+	@echo "==> SDK conformance (Python)"
+	@BASE_URL="$(BASE_URL)" API_KEY="$(API_KEY)" python3 scripts/sdk-conformance/run.py
+	@echo "==> SDK conformance (TypeScript)"
+	@pnpm --filter @af-stack/sdk build >/dev/null
+	@BASE_URL="$(BASE_URL)" API_KEY="$(API_KEY)" sh -c 'if command -v tsx >/dev/null 2>&1; then tsx scripts/sdk-conformance/run.ts; else node --experimental-strip-types scripts/sdk-conformance/run.ts; fi'
+
+# worker-conformance enqueues the spec.json vector jobs and verifies their
+# terminal states against a reference worker (see scripts/worker-conformance).
+# WORKER=py|ts selects the reference worker language (default py).
+worker-conformance:
+	@echo "==> Worker conformance (WORKER=$(or $(WORKER),py))"
+	@BASE_URL="$(BASE_URL)" API_KEY="$(API_KEY)" WORKER="$(or $(WORKER),py)" bash scripts/worker-conformance/run.sh
+
 lint: lint-go lint-py lint-ts
 	@echo "==> Lint passed"
 
-lint-go:
+lint-go: lint-migrations
 	@echo "==> Linting Go"
 	@command -v golangci-lint >/dev/null && golangci-lint run ./... 2>/dev/null || echo "(golangci-lint not installed or no Go yet)"
 	@go vet ./... 2>/dev/null || echo "(no Go packages yet)"
 
+# Static safety lint for goose migrations (Up/Down present, no unmarked
+# destructive Up ops, balanced StatementBegin/End). Fails hard on any finding.
+lint-migrations:
+	@echo "==> Linting migrations"
+	@go run ./services/runtime/cmd/migrationlint
+
 lint-py:
 	@echo "==> Linting Python"
 	@command -v ruff >/dev/null && ruff check packages/sdk-py 2>/dev/null || echo "(ruff not installed or no Python yet)"
 
@@ -0,0 +1,48 @@
+# BackAI Prometheus alert rules
+
+`alerts.yml` ships the default alert rules for the R7 production operating
+contract. They cover readiness flapping, LLM provider failure rate, background
+job queue backlog, budget-enforcement rejection spikes, outbound webhook
+delivery failures, Postgres pool saturation, and backup-test staleness.
+
+Every `backai_*` metric referenced is exported by the runtime at `/metrics`
+(registered in `services/runtime/internal/appmetrics`). A Go test
+(`TestAlertsReferenceOnlyExistingMetrics`) fails the build if a rule ever
+references a metric the runtime doesn't export, so these rules can't rot.
+
+## Wiring
+
+Plain Prometheus:
+
+```yaml
+# prometheus.yml
+rule_files:
+  - /etc/prometheus/alerts.yml       # mount deploy/prometheus/alerts.yml here
+
+scrape_configs:
+  - job_name: backai-runtime         # the readiness rules assume this job name
+    metrics_path: /metrics
+    static_configs:
+      - targets: ["runtime:9090"]     # the runtime metrics listener (AF_STACK_METRICS_ADDR)
+```
+
+The `up{job="backai-runtime"}` selector in the readiness rules assumes the
+scrape job is named `backai-runtime`. If you scrape under a different job name
+(e.g. via the Prometheus Operator `ServiceMonitor` in
+`deploy/helm/af-stack`), update that selector to match.
+
+## Validating locally
+
+```bash
+promtool check rules deploy/prometheus/alerts.yml   # if promtool is installed
+go test ./services/runtime/internal/appmetrics/...   # structural + metric-existence check
+```
+
+## Notes
+
+- The `/metrics` endpoint is served on its own listener
+  (`AF_STACK_METRICS_ADDR`, default `:9090`) so per-tenant cost/usage labels are
+  never exposed on the public API port. Restrict it to your Prometheus.
+- `BackAIBackupTestStale` only fires once at least one successful backup test
+  has been recorded (`backai_backup_test_last_success_timestamp > 0`), so it
+  stays quiet when `BACKUP_TEST_ENABLED` is off.
@@ -0,0 +1,104 @@
+# BackAI default Prometheus alert rules (R7 production operating contract).
+#
+# Load these into Prometheus via `rule_files:` (see deploy/prometheus/README.md).
+# Every `backai_*` metric referenced here is registered by the runtime
+# (services/runtime/internal/appmetrics) and asserted to exist by
+# TestAlertsReferenceOnlyExistingMetrics — an alert can never reference a metric
+# the runtime doesn't export.
+#
+# The `up` series is synthesised by Prometheus per scrape target. The selector
+# `job="backai-runtime"` is the assumed scrape-job name for the runtime's
+# /metrics endpoint — adjust it to match your scrape config / ServiceMonitor.
+groups:
+  - name: backai-readiness
+    rules:
+      - alert: BackAIRuntimeDown
+        expr: up{job="backai-runtime"} == 0
+        for: 2m
+        labels:
+          severity: critical
+        annotations:
+          summary: "BackAI runtime target is down"
+          description: "The runtime /metrics target {{ $labels.instance }} has been unscrapeable for 2m."
+      - alert: BackAIReadinessFlapping
+        expr: changes(up{job="backai-runtime"}[10m]) > 4
+        for: 0m
+        labels:
+          severity: warning
+        annotations:
+          summary: "BackAI runtime readiness is flapping"
+          description: "Target {{ $labels.instance }} changed up/down state more than 4 times in 10m — readiness is unstable (check /ready envelope for a prodcheck_code or db_unavailable)."
+
+  - name: backai-llm
+    rules:
+      - alert: BackAILLMProviderFailureRateHigh
+        expr: |
+          sum(rate(backai_llm_requests_total{status="error"}[5m]))
+            / clamp_min(sum(rate(backai_llm_requests_total[5m])), 1) > 0.2
+        for: 10m
+        labels:
+          severity: warning
+        annotations:
+          summary: "BackAI LLM gateway error rate above 20%"
+          description: "More than 20% of LLM gateway requests have failed over the last 5m — a provider or the LiteLLM proxy is likely degraded."
+
+  - name: backai-jobs
+    rules:
+      - alert: BackAIJobsQueueBacklog
+        expr: backai_jobs_queue_oldest_age_seconds > 900
+        for: 10m
+        labels:
+          severity: warning
+        annotations:
+          summary: "BackAI background job queue is backed up"
+          description: "The oldest past-due background job has waited over 15m for a worker — the jobs manager may be stalled or under-provisioned."
+
+  - name: backai-budget
+    rules:
+      - alert: BackAIBudgetRejectionsSpike
+        expr: sum(rate(backai_budget_rejections_total[5m])) > 1
+        for: 5m
+        labels:
+          severity: warning
+        annotations:
+          summary: "BackAI budget-enforcement rejections spiking"
+          description: "Budget enforcement is rejecting more than 1 LLM call/s (402) over 5m — a tenant or key has hit its cap, or a budget is misconfigured."
+
+  - name: backai-webhooks
+    rules:
+      - alert: BackAIWebhookDeliveryFailureRateHigh
+        expr: |
+          sum(rate(backai_webhook_deliveries_total{result="failed"}[10m]))
+            / clamp_min(sum(rate(backai_webhook_deliveries_total[10m])), 1) > 0.5
+        for: 15m
+        labels:
+          severity: warning
+        annotations:
+          summary: "BackAI outbound webhook delivery failure rate above 50%"
+          description: "More than half of outbound webhook deliveries have failed over 10m — subscriber endpoints may be down or misconfigured."
+
+  - name: backai-db
+    rules:
+      - alert: BackAIDBConnectionSaturation
+        expr: |
+          backai_db_pool_acquired_connections
+            / clamp_min(backai_db_pool_max_connections, 1) > 0.9
+        for: 5m
+        labels:
+          severity: warning
+        annotations:
+          summary: "BackAI Postgres pool near saturation"
+          description: "The runtime Postgres pool has been over 90% of max connections for 5m — queries may start queueing; raise AF_STACK_DATABASE_MAX_CONNECTIONS or investigate slow queries."
+
+  - name: backai-backup
+    rules:
+      - alert: BackAIBackupTestStale
+        expr: |
+          backai_backup_test_last_success_timestamp > 0
+            and (time() - backai_backup_test_last_success_timestamp) > 129600
+        for: 0m
+        labels:
+          severity: critical
+        annotations:
+          summary: "BackAI backup/restore verification is stale"
+          description: "No successful backup/restore test has completed in over 36h — restore integrity is unverified. Check the backup-test cron (BACKUP_TEST_ENABLED)."
@@ -120,6 +120,14 @@ services:
       AF_STACK_DATABASE_URL: postgres://afstack_app:${AF_STACK_APP_DB_PASSWORD:-afstack_app}@postgres:5432/afstack?sslmode=disable
       AF_STACK_MIGRATE_DATABASE_URL: postgres://afstack:afstack@postgres:5432/afstack?sslmode=disable
       AF_STACK_AGENTFIELD_URL: http://agentfield:8080
+      # Workload modules (PRD R2). The path matches the ro mount below;
+      # the enabled list is empty by default — the shipped notes module
+      # is a reference, opt in with AF_STACK_WORKLOAD_MODULES=notes.
+      WORKLOAD_MODULES_PATH: /app/workload-modules
+      AF_STACK_WORKLOAD_MODULES: ${AF_STACK_WORKLOAD_MODULES:-}
+      # Remote (Python/TS) job kinds served by external pull-workers (R3):
+      # comma list of <kind>[:<language>], e.g. "index-document:python".
+      AF_STACK_REMOTE_JOB_KINDS: ${AF_STACK_REMOTE_JOB_KINDS:-}
       # KMS for the secrets vault (envelope encryption). Override in
       # production with `openssl rand -hex 32`.
       AF_STACK_AUTH_SECRET: ${AF_STACK_AUTH_SECRET:-dev-secret-change-me-in-prod}
@@ -216,6 +224,12 @@ services:
       # at the runtime's expected lookup path. Optional — when missing
       # the runtime falls back to defaults + env overrides.
       - ./apps/backend/config.yaml:/config.yaml:ro
+      # Declarative workload modules (PRD R2): the runtime discovers
+      # backai.module.yaml manifests here, applies their migrations and
+      # serves tenant-scoped CRUD under /api/v1/workload/<id>/. Enable a
+      # discovered module with AF_STACK_WORKLOAD_MODULES=<id>[,<id>...]
+      # (or enabled: true in its manifest).
+      - ./workload-modules:/app/workload-modules:ro
       # Docker socket for the sandbox adapter. Without this mount the
       # sandbox falls back to "unconfigured" and run endpoints return 503.
       # In production, prefer gVisor or e2b for stronger isolation.