## 1. Query-scoped controls

- [x] 1.1 Add validated allowlisted per-query overrides for pages, page size, and maximum targets.
- [x] 1.2 Add focused tests proving exact-query overrides apply and ordinary queries remain unchanged.

## 2. OpenAI discovery coverage

- [x] 2.1 Add literal `openai` queries and source-specific safety bounds for GitHub, GitLab, and DockerHub.
- [x] 2.2 Test canonical configuration coverage, Docker isolation, and rollout limits.

## 3. Verification and rollout

- [x] 3.1 Run focused and full regression suites with bytecode writes disabled.
- [x] 3.2 Run strict OpenSpec validation and verify implementation against artifacts.
- [x] 3.3 Coordinately restart the authority-managed runtime and verify PostgreSQL, pipeline, and core sources.
- [x] 3.4 Observe the first bounded exact-query cycles and measure admissions, scan outcomes, OpenAI candidates, API outcomes, and pipeline drain.