Evaluate hosted activation for an Agent OS deployment

Evaluates the activation gate before any provider call, then dispatches only the immutable operator-approved provider projection behind the deployment-wide provider-effect fence. Nested provider_state and caller-supplied adapter controls are rejected. After fulfillment review, smoke, and intent reconciliation pass, the exposure arbiter may keep the runtime private, expose a public runtime API, create/update a review-gated marketplace candidate, or request x402 exposure. Pending/blocked candidates do not receive live direct-invoke or x402 compatibility invoke metadata.

Activation requires provider status runtime_ready_for_marketplace_activation, service status RUNNING, READY, or ACTIVE, runtime trust reachable or verified, and a valid public HTTPS service URL. Marketplace publication separately requires a supported pricing model and either price zero or the immutable paid listing floor. The persisted listing draft is validated before the activation provider effect: omitted model defaults to per_call, omitted activation price defaults to exact 0 (distinct from preview/create's 0.01), numeric/string zero is allowed, and malformed/non-decimal strings, positive-string underflow, alias conflict, or a positive price below 0.01 returns typed HTTP 400. A successful activation reports activated=true, but a new or review-content-changed listing is active/pending, requires semantic review plus owner release, and queues no sandbox run yet. Only an exact- identity unchanged already approved listing preserves approval and queues canonical reverification. Both remain execution_eligible=false until current proof passes. Detail, list, and completed-effect replay presentation is hydrated from the canonical listing. For x402 exposure, compatibility_invoke_path remains null and stable-edge status is x402_listing_pending or x402_listing_blocked until the canonical listing is effective; only then can a live compatibility status be returned.

When a listing is atomically committed, its transport selection may be returned as listing.endpoint_binding_id and listing.endpoint_binding_state; an active platform_managed_runtime binding means selected transport only and does not imply public exposure, verified/reachable trust, billing/custody readiness, live provisioning, or invocability. A non-ready provider result is a completed replayable outcome: HTTP 202, success=false, activated=false, readiness details, no listing, and marketplace verification not_requested. An existing bound listing may be republished only while seller-owned, hosted/platform-hosted, exactly active/approved, and unchanged from its evidence snapshot. Paused or reviewer/lifecycle/revision-changed rows are preserved and return the same negative shape at HTTP 409; hosting never autoapproves or silently resumes them. Exact completed effects replay without another provider call; uncertain effects require reconciliation.