R2: remove AU-51 bearer layer from planning/spec-writing model composites; delete retired @1 templates (dbc5efc6)

The @2 templates use CP-side verdict/WIA decompose and never read the bearer.
Triggers already pin version 2.

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

harnesses/composites/planning-sonnet-repo/v1/harness.yaml

@@ -8,8 +8,3 @@ layers:
   - context: anthropic-cloud-paul-oauth/v1
   - context: gitea-ssh/v1
   - context: agent-repo/v1
-  # AU-51/AU-51b: this composite backs bug-verify-sonnet@1, whose agent node
-  # self-transitions its own item's flow_state (PATCH /v1/work-items/{id})
-  # as its final step — see work item 88ecd23e ("agent self-transition"
-  # pattern, spec/typed-workflows.md). Needs a CP write credential.
-  - context: cp-service-token/v1

harnesses/composites/spec-writing-sonnet-repo/v1/harness.yaml

@@ -8,6 +8,3 @@ layers:
   - context: anthropic-cloud-paul-oauth/v1
   - context: gitea-ssh/v1
   - context: agent-repo/v1
-  # AU-51/AU-51b: this composite backs scope-decompose-sonnet@1, which
-  # calls back POST /v1/work-items/{id}/decompose — needs a credential.
-  - context: cp-service-token/v1

task-templates/workflow/bug-verify-sonnet@1.yaml

@@ -1,103 +0,0 @@
-name: bug-verify-sonnet
-version: 1
-description: Read-only verification of an ai-resolve-tagged bug using Sonnet planning
-runtime: planning-sonnet-repo
-input:
-  state: verify-pending
-  tags_required: [ai-resolve]
-  tags_forbidden: []
-  required_artifacts: []
-output:
-  state: 'verified|rejected'
-scope_budget:
-  files_modified_max: 1
-  lines_diff_max: 400
-  wall_clock_seconds_max: 1800
-nodes:
-  # NOTE (2026-09-09, work item 88ecd23e): the `verdict-tx` script node that
-  # used to follow this one has been REMOVED. `kind: script` nodes are
-  # harness-exempt (WF-COMP-6 / MN-38) — they run in their own empty
-  # container with no credentialed way to clone the agent's branch or read
-  # /workspace/verdict, so verdict-tx never actually worked (it always ran
-  # against its own empty /workspace). Replaced with the "agent
-  # self-transition" pattern (spec/typed-workflows.md): this node's own
-  # `cp-service-token/v1` layer (via the `planning-sonnet-repo` composite)
-  # gives it CP write credentials, so the agent PATCHes its own item's
-  # flow_state directly as its final step, instead of relying on a second
-  # node to read a hand-off file. finalize_run's output.state auto-advance
-  # is intentionally disabled for this template (its `output.state` is the
-  # pipe-separated "verified|rejected" — finalize.py treats any
-  # pipe-separated output.state as schema-validation-only, never a literal
-  # value to PATCH, so it never clobbers the value set below).
-  - id: agent
-    kind: agent
-    template: planning-sonnet-repo
-    model: sonnet
-    runtime_env:
-      AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
-      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
-      AGENT_UPSTREAM_BRANCH: "main"
-      AGENT_BRANCH: "bug-verify/${item.uuid}"
-      CP_URL: "https://agents.oreillyit.nz/api"
-    prompt: |
-      The agent-runtimes project repo is cloned at /workspace/project.
-      Change to that directory before doing any work.
-
-      Verify the following bug report. This is a READ-ONLY investigation —
-      do NOT modify any source code. Your only file changes are the
-      verification artifact described below.
-
-      **Title**: ${item.title}
-
-      **Bug report**:
-      ${item.body}
-
-      Steps:
-      1. cd /workspace/project
-      2. Investigate the codebase to determine whether the reported bug is
-         real, reproducible, and correctly diagnosed. Do not make code
-         changes — this is verification, not a fix.
-      3. Write your findings to
-         spec/bugs/<slug>-verification.md (derive <slug> from this item's
-         own slug) with exactly these sections, in order:
-         - `## Reproduction` — concrete steps or evidence confirming (or
-           failing to confirm) the reported symptom
-         - `## Root-Cause Hypothesis` — the mechanism you believe causes it,
-           with file/line references
-         - `## Verdict` — exactly one of `verified` or `rejected`
-         - `## Rationale` — why you reached that verdict
-      4. Commit and push the verification artifact on this branch.
-      5. Transition this work item's own flow_state to your verdict by
-         PATCHing the control plane directly — you have a scoped CP
-         write credential for exactly this (`CP_SERVICE_TOKEN_FILE`,
-         `CP_URL`). Set `flow_state` to exactly `verified` or exactly
-         `rejected` (matching the `## Verdict` you wrote above) — no other
-         value is accepted. Run:
-
-         ```
-         python3 - <<'PY'
-         import json, os, urllib.request, uuid
-
-         VERDICT = "verified"  # or "rejected" — must match your ## Verdict
-         ITEM_UUID = "${item.uuid}"
-
-         token = open(os.environ["CP_SERVICE_TOKEN_FILE"]).read().strip()
-         url = os.environ["CP_URL"].rstrip("/") + f"/v1/work-items/{ITEM_UUID}"
-         body = json.dumps({
-             "flow_state": VERDICT,
-             "description": f"bug-verify-sonnet@1: verdict={VERDICT}",
-         }).encode()
-         req = urllib.request.Request(url, data=body, method="PATCH", headers={
-             "Authorization": f"Bearer {token}",
-             "Content-Type": "application/json",
-             "Idempotency-Key": str(uuid.uuid4()),
-         })
-         with urllib.request.urlopen(req, timeout=30) as resp:
-             print(resp.status, resp.read().decode())
-         PY
-         ```
-
-         Replace `VERDICT` with your actual verdict before running. This is
-         the ONLY code you may run outside the investigation itself — do
-         not use this credential for anything else.
-      6. Call task_complete only after the PATCH above returns 200.

task-templates/workflow/scope-decompose-sonnet@1.yaml

@@ -1,68 +0,0 @@
-name: scope-decompose-sonnet
-version: 1
-description: Scope and decompose a spec into tagged tasks using Sonnet planning
-runtime: spec-writing-sonnet-repo
-input:
-  state: spec-reviewed-arch
-  tags_forbidden: []
-  required_artifacts: []
-output:
-  state: scoped-tagged
-scope_budget:
-  files_modified_max: 10
-  lines_diff_max: 500
-  wall_clock_seconds_max: 2400
-nodes:
-  - id: agent
-    kind: agent
-    # Decomposition is spec-test-tier work (claude/stage-routing.md): Sonnet,
-    # not airouter. 2026-07-04 E2E: Qwen3.6 empty-delivered this stage (task
-    # "succeeded" touching only .gitignore, zero work items created) — the
-    # template NAME never set the model; the node model: field does.
-    template: spec-writing-sonnet-repo
-    # cli defaults to "claude" — the anthropic-cloud OAuth composite drives
-    # the claude CLI; "cli: agentic" is the OpenAI-compatible runner and
-    # fails fast with "OPENAI_BASE_URL required" (E2E 2026-07-04).
-    model: sonnet
-    runtime_env:
-      AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
-      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
-      AGENT_UPSTREAM_BRANCH: "main"
-      AGENT_BRANCH: "spec/${item.uuid}"
-      CP_URL: "https://agents.oreillyit.nz/api"
-      # AR-38: this stage's deliverable is work items POSTed to the CP, not a
-      # repo diff — the empty-deliverable audit would fail every success.
-      AGENT_EMPTY_DELIVERABLE_CHECK: "false"
-    prompt: |
-      The agent-runtimes project repo is cloned at /workspace/project.
-      Change to that directory before doing any work.
-
-      Find the spec file in /workspace/project/spec/ (the spec was
-      written in an earlier pipeline stage — look for a file whose name matches
-      the concept title '${item.title}' as a slug, e.g. spec/<slug>.md).
-      Read that spec carefully.
-
-      Write a decomposition plan to /workspace/.agent-output/decompose.json with
-      exactly this structure:
-      {
-        "project_id": "${item.project_id}",
-        "space_id": "${item.space_id}",
-        "parent_item_uuid": "${item.uuid}",
-        "tasks": [
-          {
-            "title": "...",
-            "description": "...",
-            "flow_state": "needs-tests",
-            "spec_ids": ["WT-EVAL-1", "..."],
-            "test_files": ["tests/triggers/test_schema.py", "..."],
-            "tags": ["airouter-eligible"]
-          }
-        ]
-      }
-
-      Include "airouter-eligible" in tags only for single-file, self-contained
-      tasks that Qwen3.6 can handle alone. Omit tags for complex multi-file tasks.
-
-      After writing decompose.json, run this command to create the work items:
-
-      python3 -m lib.cp_cli planner items decompose ${item.uuid} --file /workspace/.agent-output/decompose.json

tests/invariants/test_state_tx_runtime_env.py

@@ -93,9 +93,7 @@ def test_cp_url_templates_discovered():
     assert {
         "test-validate@1.yaml",
         "frozen-fixture-emit@1.yaml",
-        "scope-decompose-sonnet@1.yaml",
         "scope-decompose-sonnet@2.yaml",
-        "bug-verify-sonnet@1.yaml",
         "bug-verify-sonnet@2.yaml",
     } <= names