fix(gateway): unblock task claim; full Phase 0/1/2 remediation

Resolves the 100% claim-failure rate introduced by the gateway rewrite
  (commit 62bda0c plus 78 follow-ups). Live smoke runs hit
  `404 /api/v2/flow/developer/...` on every dev verb plus a manifest
  fallback that silently exposed off-role verbs to PMs — confirmed
  firing simultaneously in NAS agent logs (be-dev-1, be-pm, main-pm).

  Audit reports under docs/internal/audit_2026_05_04/ catalogue 49
  defects across gateway, services, prompts, MCP transport, substrate,
  and tests (8 detail reports + master synthesis). Six smoking guns;
  three proven in production logs.

  Phase 0 — unblock claim:
  - URL prefix /api/v2/flow/dev → /developer; slug-map board roles
    (product_owner, head_marketing) → /board (D-01)
  - _i_will_work_on AttributeError on None across pending /
    needs_revision / claimed re-entry branches (D-02)
  - Seed last_heartbeat_at in _qa_or_doc_claim (D-03)
  - Drop misleading i_have_committed verb; dev flow uses commit() (D-04)
  - Manifest mount via compose; flow_server + do_server fail loud
    instead of exposing all-verbs fallback (D-12)
  - MCP _post() surfaces envelope body on 4xx so agents see remediate
    hints (D-13)
    on git failure so retries aren't blocked by half-state (S-01)

  Phase 1 — lifecycle stability:
  - _resolve_skill falls back to AgentTable.capabilities (D-06)
  - main_pm_complete uses kwargs for escalate_to_ceo (D-07)
  - i_am_done auto-runs submit_verification when in_progress (D-08)
  - active_claimant_id wired in claim/unclaim paths — single-claimant
    invariant now functional (D-05)
  - qa_pass/qa_fail assert claimed_by parity with qa_agent_id (D-18)
  - Prompt-drift sweep: fail() shape, i_am_done(task_id, notes),
    subtask cap (12 hard / 8 soft), error-code symbology rewritten in
    base.md + per-role anti-patterns (D-10/11/29/30/31, D-37)

  Phase 2 — invariants + architecture:
  - Real-DB integration test exercising claim → in_progress → commit
    → submit_for_qa → i_am_done → awaiting_qa (P2-1)
  - choreographer.py → package; 3 of 6 role mixins extracted
    (board, doc, qa). _impl.py 2,526 → 2,080 lines (-18%). Continuation
    plan in docs/internal/audit_2026_05_04/p2_2_decompose_plan.md (P2-2)
  - Closure guards consolidated via _subtasks_not_terminal_envelope (P2-3)
  - TaskService.unclaim_for_reaper routed through canonical
    _validate_and_set_status; in_progress → pending added to
    VALID_TRANSITIONS (P2-4)
  - Dead code removed: i_am_done_with_catchup verb, _run_catch_up helper
    (P2-5)
  - 6 state-machine invariants asserted via property test (P2-6)
  - attempt_id (uuid4) stamped on every gateway.rejected audit row (P2-7)
  - _reconcile_orphan_claims_on_startup rolls back tasks left CLAIMED
    with branch_name=NULL from prior crashes (P2-8)
  - scripts/regenerate_verb_tables.py introspects Pydantic schemas +
    role_config; compose_prompt injects per-role tables as a layer.
    Eliminates the prompt-drift class structurally (P2-9)

  Other:
  - D-48: orchestrator mounts host's ~/.claude.json when present so
    agents don't boot from backup recovery on every spawn
  - D-49: dev dispatcher rejects role-mismatched spawns (e.g. doc task
    assigned to dev agent)

  Tests: 553 pass · ruff + mypy clean. Live NAS smoke verification
  pending — needs the stack brought back up.

tests/unit/api/routes/v2/test_flow_dev.py

@@ -1,4 +1,4 @@
-"""Unit tests for /api/v2/flow/dev/* endpoints.
+"""Unit tests for /api/v2/flow/developer/* endpoints.
 
 Uses a minimal FastAPI test client built from the new router only.
 No DB required — Choreographer is mocked.
@@ -40,13 +40,13 @@ def _build_app(mock_choreographer: MagicMock) -> FastAPI:
 
 @pytest.mark.asyncio
 async def test_give_me_work_returns_envelope() -> None:
-    """POST /api/v2/flow/dev/give_me_work returns 200 with envelope shape."""
+    """POST /api/v2/flow/developer/give_me_work returns 200 with envelope shape."""
     mock_chore = MagicMock()
     mock_chore.give_me_work = AsyncMock(return_value=_make_envelope(status="idle"))
     client = TestClient(_build_app(mock_chore))
 
     resp = client.post(
-        "/api/v2/flow/dev/give_me_work",
+        "/api/v2/flow/developer/give_me_work",
         json={},
         headers=_HEADERS,
     )
@@ -59,7 +59,7 @@ async def test_give_me_work_returns_envelope() -> None:
 
 @pytest.mark.asyncio
 async def test_i_will_work_on_dispatches_task_id() -> None:
-    """POST /api/v2/flow/dev/i_will_work_on forwards task_id and plan."""
+    """POST /api/v2/flow/developer/i_will_work_on forwards task_id and plan."""
     mock_chore = MagicMock()
     mock_chore.i_will_work_on = AsyncMock(
         return_value=_make_envelope(status="in_progress", task_id=_TASK_ID)
@@ -67,7 +67,7 @@ async def test_i_will_work_on_dispatches_task_id() -> None:
     client = TestClient(_build_app(mock_chore))
 
     resp = client.post(
-        "/api/v2/flow/dev/i_will_work_on",
+        "/api/v2/flow/developer/i_will_work_on",
         json={"task_id": _TASK_ID, "plan": "implement the feature"},
         headers=_HEADERS,
     )
@@ -82,29 +82,9 @@ async def test_i_will_work_on_dispatches_task_id() -> None:
     assert call_args.args[2] == "implement the feature"
 
 
-@pytest.mark.asyncio
-async def test_i_have_committed_dispatches_message() -> None:
-    """POST /api/v2/flow/dev/i_have_committed forwards commit message."""
-    mock_chore = MagicMock()
-    mock_chore.i_have_committed = AsyncMock(
-        return_value=_make_envelope(status="in_progress")
-    )
-    client = TestClient(_build_app(mock_chore))
-
-    resp = client.post(
-        "/api/v2/flow/dev/i_have_committed",
-        json={"message": "add auth endpoint"},
-        headers=_HEADERS,
-    )
-
-    assert resp.status_code == _HTTP_200
-    mock_chore.i_have_committed.assert_awaited_once()
-    assert mock_chore.i_have_committed.call_args.args[1] == "add auth endpoint"
-
-
 @pytest.mark.asyncio
 async def test_i_am_done_dispatches_task_and_notes() -> None:
-    """POST /api/v2/flow/dev/i_am_done forwards task_id and notes."""
+    """POST /api/v2/flow/developer/i_am_done forwards task_id and notes."""
     mock_chore = MagicMock()
     mock_chore.i_am_done = AsyncMock(
         return_value=_make_envelope(status="awaiting_qa", task_id=_TASK_ID)
@@ -112,7 +92,7 @@ async def test_i_am_done_dispatches_task_and_notes() -> None:
     client = TestClient(_build_app(mock_chore))
 
     resp = client.post(
-        "/api/v2/flow/dev/i_am_done",
+        "/api/v2/flow/developer/i_am_done",
         json={"task_id": _TASK_ID, "notes": "all tests pass"},
         headers=_HEADERS,
     )
@@ -125,7 +105,7 @@ async def test_i_am_done_dispatches_task_and_notes() -> None:
 
 @pytest.mark.asyncio
 async def test_i_am_blocked_dispatches_reason() -> None:
-    """POST /api/v2/flow/dev/i_am_blocked forwards task_id and reason."""
+    """POST /api/v2/flow/developer/i_am_blocked forwards task_id and reason."""
     mock_chore = MagicMock()
     mock_chore.i_am_blocked = AsyncMock(
         return_value=_make_envelope(status="blocked", task_id=_TASK_ID)
@@ -133,7 +113,7 @@ async def test_i_am_blocked_dispatches_reason() -> None:
     client = TestClient(_build_app(mock_chore))
 
     resp = client.post(
-        "/api/v2/flow/dev/i_am_blocked",
+        "/api/v2/flow/developer/i_am_blocked",
         json={"task_id": _TASK_ID, "reason": "waiting for design spec"},
         headers=_HEADERS,
     )
@@ -145,13 +125,13 @@ async def test_i_am_blocked_dispatches_reason() -> None:
 
 @pytest.mark.asyncio
 async def test_i_am_idle_dispatches_agent_id() -> None:
-    """POST /api/v2/flow/dev/i_am_idle delegates to Choreographer.i_am_idle."""
+    """POST /api/v2/flow/developer/i_am_idle delegates to Choreographer.i_am_idle."""
     mock_chore = MagicMock()
     mock_chore.i_am_idle = AsyncMock(return_value=_make_envelope(status="idle"))
     client = TestClient(_build_app(mock_chore))
 
     resp = client.post(
-        "/api/v2/flow/dev/i_am_idle",
+        "/api/v2/flow/developer/i_am_idle",
         json={},
         headers=_HEADERS,
     )
@@ -162,27 +142,13 @@ async def test_i_am_idle_dispatches_agent_id() -> None:
     mock_chore.i_am_idle.assert_awaited_once()
 
 
-def test_i_have_committed_rejects_empty_message() -> None:
-    """POST i_have_committed rejects empty message (min_length=1)."""
-    mock_chore = MagicMock()
-    client = TestClient(_build_app(mock_chore))
-
-    resp = client.post(
-        "/api/v2/flow/dev/i_have_committed",
-        json={"message": ""},
-        headers=_HEADERS,
-    )
-
-    assert resp.status_code == _HTTP_422
-
-
 def test_i_am_blocked_rejects_empty_reason() -> None:
     """POST i_am_blocked rejects empty reason (min_length=1)."""
     mock_chore = MagicMock()
     client = TestClient(_build_app(mock_chore))
 
     resp = client.post(
-        "/api/v2/flow/dev/i_am_blocked",
+        "/api/v2/flow/developer/i_am_blocked",
         json={"task_id": _TASK_ID, "reason": ""},
         headers=_HEADERS,
     )