[Tcuzzo]

Hydra now keeps normal model execution, optional local decisions, memory and independent review separate. Changing a provider does not replace the skills or source map, and an unavailable independent tribunal does not block ordinary work.

• Add bounded specialist teams and seven public canon/essence profiles, plus blind artifact review that checks resolved author/judge identities and actual fallback families. Missing independent judges produce an inconclusive review, never fabricated cross-family proof.
• Wire Needle tool selection and Laya typed decisions into the regular tool catalog. Local workers apply explicit CPU affinity and finite deadlines. They do not replace a general coding model.
• Persist literal provider failure states: account-wide eight-hour exhausted-budget suspension, Retry-After, explicit retirement evidence, configured fallback routes and actual model receipts. Remove invented emergency routes; refresh provider catalogs explicitly.
• Add shared incremental source maps, verified content keys, optional local semantic indexing, configurable embedding identities and OpenVINO device checks. Preserve contradictory memory entries; inventory and snapshot candidates without deleting originals. Bound queue ownership, retries and maintenance ticks.
• Use the pinned official Zapier SDK locally over stdio, with no hosted-MCP fallback and no automatic write retries. Add account/setup links, Twingate guidance, model load/unload commands and a hardware diagram. SDK beta pricing is external; permanent free service is not promised.
• Keep private source, weights and canon outside the public package. Replace 18 historical hive profile copies and deployment receipts with generic public profiles; remove confirmed personal paths and machine identifiers. Five OSS retrieval engines are documented setup recipes, not five implemented backends.

Validation: full repository suite 793 passed / 7 skipped on Windows; final standard topology-fixture change 20 passed. Actual local SDK tool discovery passed without authentication or app actions. Actual offline Needle proposed the correct source lookup and reported three-CPU affinity on a 24-logical-CPU host. Real child-process embedding HTTP tests, proxy bypass, stale-key rejection, account reset persistence, bounded worker cleanup and tribunal alias/fallback regressions passed. Independent code review reproduced and closed identified runtime defects.

The upload tree was verified identical to the tested local Git tree. The subsequent public-profile and test-only cleanup passed 35 focused tests. The final source freshness and configured-auditor fixes passed 35 tests with 1 optional skip; a timestamp-preserving restore now invalidates stale index metadata after a rejected read. The concurrency integrity test now uses an explicit ten-second test budget while production retains its one-second lock limit and a separate fast-refusal regression; 29 health/queue checks passed, with independent review. Exact-head CI status is visible below; earlier-head checks are not reused. This remains a development preview: 4080/iGPU inference validation (the actual AMD 680M/4080 host currently reports an NVIDIA driver/library mismatch), OCuLink verification, connected-account workflows, complete private deployment parity and Cloudflare transaction semantics are not claimed. Public canon is generic; private material has not been copied into this PR.

Project credit remains Cuzzo / BACKS AIOS. Model services and coding assistants receive tool credit only; upstream licenses remain intact.