@dotdrelle/wiki-manager 0.15.66 → 0.15.70

package/src/orchestrator/providers/runtimeProviders.test.js

@@ -0,0 +1,361 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { capabilityRegistryForSession, createCapabilityRegistry } from '../capabilityRegistry.js';
+import { CapabilityUnavailableError, resolve } from '../capabilityResolver.js';
+import { createAssignmentManager } from '../assignmentManager.js';
+import { resolveObjective } from '../objectiveResolver.js';
+import { createFakeRuntimeProvider } from './fakeRuntimeProvider.js';
+import {
+  discoverRuntimeProviderAgents,
+  discoverRuntimeProvidersOnce,
+  loadAgentRuntimesConfig,
+  resolveRuntimeProviders,
+} from './runtimeProviders.js';
+
+function mcpAgent(agentInstanceId, capabilityId) {
+  return {
+    agentInstanceId,
+    health: 'available',
+    description: {
+      contractVersion: '1',
+      agentType: agentInstanceId.split('-')[0],
+      agentInstanceId,
+      displayName: agentInstanceId,
+      capabilities: [{
+        id: capabilityId,
+        version: '1',
+        description: capabilityId,
+        inputSchema: {},
+        outputSchema: {},
+        supportedOperations: ['run'],
+      }],
+    },
+  };
+}
+
+test('discovery projects a live runtime into synthetic agents', async () => {
+  const provider = createFakeRuntimeProvider({
+    runtime: 'deepagents',
+    capabilities: [{ name: 'agent.review', operations: ['run'] }],
+  });
+
+  const { agents, unavailable } = await discoverRuntimeProviderAgents([
+    { id: 'deepagents', provider },
+  ]);
+
+  assert.equal(unavailable.length, 0);
+  assert.equal(agents.length, 1);
+  const agent = agents[0];
+  assert.equal(agent.agentInstanceId, 'deepagents::agent.review');
+  assert.equal(agent.providerKind, 'external-runtime');
+  assert.equal(agent.health, 'available');
+  assert.equal(agent.serverName, null);
+  assert.equal(agent.runtimeProvider, provider);
+  assert.equal(agent.description.capabilities[0].id, 'agent.review');
+});
+
+test('a down runtime yields no agents and is reported', async () => {
+  const provider = createFakeRuntimeProvider({ available: false });
+
+  const { agents, unavailable } = await discoverRuntimeProviderAgents([
+    { id: 'deepagents', provider },
+  ]);
+
+  assert.equal(agents.length, 0);
+  assert.equal(unavailable.length, 1);
+  assert.equal(unavailable[0].runtimeId, 'deepagents');
+});
+
+test('the capability registry carries providerKind and runtimeProvider for external entries', async () => {
+  const provider = createFakeRuntimeProvider({ capabilities: [{ name: 'agent.review', operations: ['run'] }] });
+  const { agents } = await discoverRuntimeProviderAgents([{ id: 'deepagents', provider }]);
+
+  const registry = createCapabilityRegistry({ agents });
+
+  const providers = registry.providersFor('agent.review');
+  assert.equal(providers.length, 1);
+  assert.equal(providers[0].providerKind, 'external-runtime');
+  assert.equal(providers[0].runtimeProvider, provider);
+});
+
+test('resolve routes agent.* to the external runtime agent', async () => {
+  const provider = createFakeRuntimeProvider({ capabilities: [{ name: 'agent.review', operations: ['run'] }] });
+  const { agents } = await discoverRuntimeProviderAgents([{ id: 'deepagents', provider }]);
+  const registry = createCapabilityRegistry({ agents });
+
+  const assignment = resolve('agent.review', { workspaceConfig: {}, registry });
+
+  assert.equal(assignment.agentInstanceId, 'deepagents::agent.review');
+});
+
+test('assignmentManager produces an external-runtime assignment with a null serverName', async () => {
+  const provider = createFakeRuntimeProvider({ capabilities: [{ name: 'agent.review', operations: ['run'] }] });
+  const { agents } = await discoverRuntimeProviderAgents([{ id: 'deepagents', provider }]);
+  const session = {
+    capabilityRegistry: createCapabilityRegistry({ agents }),
+    agentRegistrySnapshot: [],
+    agents: [],
+  };
+  const assign = createAssignmentManager({ session });
+
+  const assignment = await assign.assign({
+    id: 'review-a',
+    requiredCapability: 'agent.review',
+    operation: 'run',
+    arguments: {},
+  });
+
+  assert.equal(assignment.agentInstanceId, 'deepagents::agent.review');
+  assert.equal(assignment.serverName, null);
+  assert.equal(assignment.runtimeProvider, provider);
+  assert.equal(assignment.providerKind, 'external-runtime');
+});
+
+test('a down runtime is isolated: agent.* resolves nowhere while MCP capabilities still do', async () => {
+  const { agents } = await discoverRuntimeProviderAgents([
+    { id: 'deepagents', provider: createFakeRuntimeProvider({ available: false }) },
+  ]);
+  assert.equal(agents.length, 0);
+
+  const session = {
+    agentRegistry: { snapshot: () => [mcpAgent('production-main', 'knowledge.update')] },
+    agentRegistrySnapshot: [],
+  };
+  const registry = capabilityRegistryForSession(session);
+
+  // The external capability is absent because its runtime is down.
+  assert.throws(
+    () => resolve('agent.review', { workspaceConfig: {}, registry }),
+    (error) => error instanceof CapabilityUnavailableError && error.reason === 'capability_not_found',
+  );
+  // The MCP capability is unaffected.
+  const mcpAssignment = resolve('knowledge.update', { workspaceConfig: {}, registry });
+  assert.equal(mcpAssignment.agentInstanceId, 'production-main');
+});
+
+function sessionWithEvents() {
+  return { workspace: 'test', mcp: {}, agentEvents: [], activities: {} };
+}
+
+test('resolveRuntimeProviders maps enabled entries and skips unknown types', () => {
+  const { providers, skipped } = resolveRuntimeProviders([
+    { id: 'fake-1', type: 'fake', capabilities: [{ name: 'agent.echo', operations: ['run'] }] },
+    { id: 'mystery', type: 'mystery-runtime' },
+    { id: 'off', type: 'fake', enabled: false },
+  ]);
+
+  assert.equal(providers.length, 1);
+  assert.equal(providers[0].id, 'fake-1');
+  assert.equal(providers[0].type, 'fake');
+  assert.equal(skipped.length, 1);
+  assert.equal(skipped[0].id, 'mystery');
+});
+
+test('loadAgentRuntimesConfig reads both array and object forms', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'agent-runtimes-'));
+  try {
+    writeFileSync(join(dir, 'agent-runtimes.json'), JSON.stringify({ runtimes: [{ id: 'a', type: 'fake' }] }));
+    assert.deepEqual(loadAgentRuntimesConfig({ stateDir: dir }), [{ id: 'a', type: 'fake' }]);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('loadAgentRuntimesConfig returns [] for a missing or unreadable file', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'agent-runtimes-'));
+  try {
+    assert.deepEqual(loadAgentRuntimesConfig({ stateDir: dir, env: {} }), []);
+    writeFileSync(join(dir, 'agent-runtimes.json'), '{not json');
+    const logs = [];
+    assert.deepEqual(loadAgentRuntimesConfig({ stateDir: dir, log: (message) => logs.push(message), env: {} }), []);
+    assert.equal(logs.length, 1);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('GATEWAY_ENABLED implies the deepagents runtime with the bearer token (one switch)', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'agent-runtimes-'));
+  try {
+    const config = loadAgentRuntimesConfig({
+      stateDir: dir,
+      env: { GATEWAY_ENABLED: 'true', GATEWAY_PORT: '7789', GATEWAY_AUTH_TOKEN: 'tok-1' },
+    });
+    const implied = config.find((entry) => entry.type === 'deepagents');
+    assert.ok(implied, 'the gateway is declared when GATEWAY_ENABLED is set');
+    assert.equal(implied.enabled, true);
+    assert.equal(implied.endpoint, 'http://localhost:7789');
+    assert.deepEqual(implied.headers, { Authorization: 'Bearer tok-1' });
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('an explicit enabled deepagents entry wins over the implied one', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'agent-runtimes-'));
+  try {
+    writeFileSync(join(dir, 'agent-runtimes.json'), JSON.stringify({
+      runtimes: [{ id: 'deepagents', type: 'deepagents', endpoint: 'http://custom:9000', enabled: true }],
+    }));
+    const config = loadAgentRuntimesConfig({ stateDir: dir, env: { GATEWAY_ENABLED: 'true' } });
+    assert.equal(config.length, 1);
+    assert.equal(config[0].endpoint, 'http://custom:9000');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('discoverRuntimeProvidersOnce populates session.runtimeProviderAgents and announces down runtimes', async () => {
+  const session = sessionWithEvents();
+
+  const agents = await discoverRuntimeProvidersOnce(session, {
+    config: [
+      { id: 'fake', type: 'fake', capabilities: [{ name: 'agent.echo', operations: ['run'] }] },
+      { id: 'down', type: 'fake', available: false },
+    ],
+  });
+
+  assert.equal(agents.length, 1);
+  assert.equal(session.runtimeProviderAgents.length, 1);
+  assert.equal(session.runtimeProviderAgents[0].agentInstanceId, 'fake::agent.echo');
+
+  const logs = (session.agentEvents ?? []).filter((event) => event.type === 'runtime_log');
+  assert.ok(
+    logs.some((event) => String(event.payload?.message ?? '').includes('down')
+      && String(event.payload?.message ?? '').includes('unavailable')),
+    'a down runtime is announced in the journal',
+  );
+});
+
+test('discoverRuntimeProvidersOnce announces a down runtime only once across re-scans', async () => {
+  const session = sessionWithEvents();
+  const config = [{ id: 'down', type: 'fake', available: false }];
+
+  await discoverRuntimeProvidersOnce(session, { config });
+  await discoverRuntimeProvidersOnce(session, { config });
+
+  const logs = (session.agentEvents ?? []).filter((event) => event.type === 'runtime_log'
+    && String(event.payload?.message ?? '').includes('unavailable'));
+  assert.equal(logs.length, 1, 'the degradation is announced once, not on every re-scan');
+});
+
+test('a transient probe failure keeps the last-known capability set (a failed probe is not a lost agent)', async () => {
+  const session = sessionWithEvents();
+  const up = [{ id: 'gw', type: 'fake', capabilities: [{ name: 'agent.review', operations: ['run'] }] }];
+  const down = [{ id: 'gw', type: 'fake', available: false }];
+
+  await discoverRuntimeProvidersOnce(session, { config: up });
+  assert.equal(session.runtimeProviderAgents.length, 1);
+
+  // Network blip during a periodic re-scan: discovery returns nothing.
+  await discoverRuntimeProvidersOnce(session, { config: down });
+  assert.equal(session.runtimeProviderAgents.length, 1, 'the capability survives the blip');
+  assert.equal(session.runtimeProviderAgents[0].agentInstanceId, 'gw::agent.review');
+
+  const logs = (session.agentEvents ?? []).filter((event) => event.type === 'runtime_log'
+    && String(event.payload?.message ?? '').includes('keeping'));
+  assert.equal(logs.length, 1, 'the preservation is announced');
+
+  // Recovery: a fresh answer is authoritative again.
+  await discoverRuntimeProvidersOnce(session, { config: up });
+  assert.equal(session.runtimeProviderAgents.length, 1);
+});
+
+test('a healthy runtime that answers is authoritative — its set replaces, never merges with, the last-known one', async () => {
+  const session = sessionWithEvents();
+  await discoverRuntimeProvidersOnce(session, {
+    config: [{ id: 'gw', type: 'fake', capabilities: [{ name: 'agent.review', operations: ['run'] }] }],
+  });
+  assert.deepEqual(session.runtimeProviderAgents.map((a) => a.agentInstanceId), ['gw::agent.review']);
+
+  await discoverRuntimeProvidersOnce(session, {
+    config: [{ id: 'gw', type: 'fake', capabilities: [{ name: 'agent.consistency', operations: ['run'] }] }],
+  });
+  assert.deepEqual(
+    session.runtimeProviderAgents.map((a) => a.agentInstanceId),
+    ['gw::agent.consistency'],
+    'the stale agent.review is gone, not kept alongside',
+  );
+});
+
+test('GATEWAY_ENABLED inherits the disabled entry\'s declared capabilities', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'agent-runtimes-'));
+  try {
+    writeFileSync(join(dir, 'agent-runtimes.json'), JSON.stringify({
+      runtimes: [{
+        id: 'deepagents',
+        type: 'deepagents',
+        endpoint: 'http://agent-runtime:7789',
+        enabled: false,
+        capabilities: [
+          { name: 'agent.notify', operations: ['run'], defaultRequiresApproval: true },
+        ],
+      }],
+    }));
+    const config = loadAgentRuntimesConfig({ stateDir: dir, env: { GATEWAY_ENABLED: 'true' } });
+    const implied = config.find((entry) => entry.type === 'deepagents');
+    assert.ok(implied);
+    assert.equal(implied.enabled, true);
+    assert.equal(implied.endpoint, 'http://localhost:7789', 'the endpoint stays host-local');
+    assert.deepEqual(implied.capabilities, [
+      { name: 'agent.notify', operations: ['run'], defaultRequiresApproval: true },
+    ], 'the shipped approval metadata is not discarded');
+    assert.equal(config.filter((entry) => entry.type === 'deepagents').length, 1, 'no duplicate entry');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('external runtime capabilities carry aliases through to the registry', async () => {
+  const provider = createFakeRuntimeProvider({
+    capabilities: [{ name: 'agent.review', operations: ['run'], aliases: ['audit', 'review', 'analyze'] }],
+  });
+  const { agents } = await discoverRuntimeProviderAgents([{ id: 'deepagents', provider }]);
+
+  assert.deepEqual(agents[0].description.capabilities[0].aliases, ['audit', 'review', 'analyze']);
+  assert.equal(agents[0].description.orchestration.canPlan, false);
+  assert.equal(agents[0].description.orchestration.singleTaskOnly, true, 'external runtimes are executor-only single-task');
+});
+
+test('external runtime capabilities carry mutationClass and defaultRequiresApproval through', async () => {
+  const provider = createFakeRuntimeProvider({
+    capabilities: [
+      { name: 'agent.research', operations: ['run'], mutationClass: 'ingest' },
+      { name: 'agent.notify', operations: ['run'], defaultRequiresApproval: true },
+    ],
+  });
+  const { agents } = await discoverRuntimeProviderAgents([{ id: 'deepagents', provider }]);
+
+  const byName = new Map(
+    agents.map((agent) => [agent.description.capabilities[0].id, agent.description.capabilities[0]]),
+  );
+  assert.equal(byName.get('agent.research').mutationClass, 'ingest');
+  assert.equal(byName.get('agent.research').defaultRequiresApproval, undefined);
+  assert.equal(byName.get('agent.notify').defaultRequiresApproval, true);
+  assert.equal(byName.get('agent.notify').mutationClass, undefined);
+});
+
+test('external runtime capabilities carry aliasOperations through', async () => {
+  const provider = createFakeRuntimeProvider({
+    capabilities: [{ name: 'agent.plan', operations: ['plan', 'run'], aliasOperations: { plan: 'plan', apply: 'run' } }],
+  });
+  const { agents } = await discoverRuntimeProviderAgents([{ id: 'deepagents', provider }]);
+
+  assert.deepEqual(agents[0].description.capabilities[0].aliasOperations, { plan: 'plan', apply: 'run' });
+});
+
+test('resolveObjective deterministically routes "audit" to agent.review via aliases (no LLM)', async () => {
+  const provider = createFakeRuntimeProvider({
+    capabilities: [{ name: 'agent.review', operations: ['run'], aliases: ['audit', 'review', 'analyze'] }],
+  });
+  const { agents } = await discoverRuntimeProviderAgents([{ id: 'deepagents', provider }]);
+  const session = { runtimeProviderAgents: agents };
+
+  const selection = await resolveObjective('audit la couverture conceptuelle', session);
+
+  assert.equal(selection.capability, 'agent.review');
+  assert.equal(selection.operation, 'run');
+});

package/src/orchestrator/resultAggregator.js

@@ -2,6 +2,7 @@ import { validateContract } from '../contracts/schemas.js';
 import { parseJsonText } from '../core/activity.js';
 import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
 import { callMcpTool, formatMcpToolResult } from '../core/mcp.js';
+import { capabilityRegistryForSession } from './capabilityRegistry.js';
 import { resolve as resolveCapability } from './capabilityResolver.js';
 import { integrate } from './planIntegrator.js';
 import { validateFragment } from './planValidator.js';
@@ -112,7 +113,11 @@ async function maybeExpandPlan(result, {
     return rejectExpansion({ session, runId, taskId, store, errors: requestValidation.errors.map((message) => ({ code: 'invalid_plan_expansion_request', message })) });
   }
 
-  const effectiveRegistry = registry ?? session.capabilityRegistry;
+  // session.capabilityRegistry is never assigned anywhere in production;
+  // falling back to it here meant every planExpansionRequest resolved
+  // against `undefined` and was unconditionally rejected as
+  // capability_unavailable, regardless of whether the capability existed.
+  const effectiveRegistry = registry ?? capabilityRegistryForSession(session);
   let resolved;
   try {
     resolved = resolveCapability(request.capability, {
@@ -151,6 +156,24 @@ async function maybeExpandPlan(result, {
   const toolName = toolNameFor(session, serverName, 'agent_plan');
   const planRequest = agentPlanRequest(request, session);
   const fragment = parseToolPayload(await callTool(session.mcp, serverName, toolName, planRequest));
+  // A planner that REFUSES answers { ok: false, error } (the production agent
+  // does, e.g. "knowledge.update cannot plan operation: doctor"). Feeding that
+  // envelope to validateFragment turned the planner's actual sentence into
+  // contract noise ("taskGraphFragment.ok is not allowed") — the human saw a
+  // schema violation instead of the reason. Surface the planner's words.
+  if (fragment && typeof fragment === 'object' && !Array.isArray(fragment) && fragment.ok === false) {
+    return rejectExpansion({
+      session,
+      runId,
+      taskId,
+      store,
+      errors: [{
+        code: 'planner_rejected',
+        message: String(fragment.error ?? 'the planner rejected the objective without a reason'),
+        details: { capability: request.capability, operation: request.operation ?? null },
+      }],
+    });
+  }
   const validation = validateFragment(fragment, {
     registry: effectiveRegistry,
     run: { plannerAgentInstanceId: resolved.agentInstanceId },
@@ -211,7 +234,17 @@ function agentPlanRequest(request, session) {
     objective: request.objective ?? request.reason ?? undefined,
     workspace: request.workspace ?? workspaceRequest(session),
     arguments: request.arguments && typeof request.arguments === 'object' ? request.arguments : {},
-    constraints: request.constraints && typeof request.constraints === 'object' ? request.constraints : {},
+    constraints: {
+      ...(request.constraints && typeof request.constraints === 'object' ? request.constraints : {}),
+      // Default governance, same as prepareDelegation: mutations wait for a
+      // human grant. Omitting it here let the planner answer mutating tasks
+      // with requiresApproval:false — the scheduler dispatched an ingest
+      // plan with no gate, and the production agent's confirmation guard
+      // then rejected every job ("requires confirm=true").
+      // requireApprovalForMutations: false from the proposal itself remains
+      // an explicit opt-out (a runtime declaring its own policy).
+      requireApprovalForMutations: request.constraints?.requireApprovalForMutations !== false,
+    },
   };
 }
 

package/src/orchestrator/resultAggregator.test.js

@@ -209,3 +209,65 @@ function expansionRegistry() {
     },
   };
 }
+
+test('resultAggregator surfaces the planner rejection instead of contract noise', async () => {
+  const session = sessionWithPlan();
+  session.approvals = [{ id: 'approval-run', scope: 'run', status: 'approved', runId: 'run-expansion' }];
+
+  const result = await accept(taskResultWithExpansion(), {
+    session,
+    runId: 'run-expansion',
+    task: session.headlessPlan[0],
+    assignment: { agentInstanceId: 'production-main', serverName: 'production' },
+    registry: expansionRegistry(),
+    callTool: async () => ({ ok: false, error: 'knowledge.update cannot plan operation: doctor' }),
+  });
+
+  assert.equal(result.ok, true, 'the producing task itself completed');
+  assert.equal(result.expansion.ok, false);
+  assert.equal(result.expansion.errors[0].code, 'planner_rejected');
+  assert.match(result.expansion.errors[0].message, /cannot plan operation: doctor/);
+});
+
+test('resultAggregator defaults requireApprovalForMutations to true on the plan request', async () => {
+  const session = sessionWithPlan();
+  session.approvals = [{ id: 'approval-run', scope: 'run', status: 'approved', runId: 'run-expansion' }];
+  const calls = [];
+
+  await accept(taskResultWithExpansion(), {
+    session,
+    runId: 'run-expansion',
+    task: session.headlessPlan[0],
+    assignment: { agentInstanceId: 'production-main', serverName: 'production' },
+    registry: expansionRegistry(),
+    callTool: async (_mcp, serverName, toolName, args) => {
+      calls.push(args);
+      return expansionFragment();
+    },
+  });
+
+  assert.equal(calls[0].constraints.requireApprovalForMutations, true);
+});
+
+test('resultAggregator honours an explicit opt-out from the proposal constraints', async () => {
+  const session = sessionWithPlan();
+  session.approvals = [{ id: 'approval-run', scope: 'run', status: 'approved', runId: 'run-expansion' }];
+  const calls = [];
+  const expansion = taskResultWithExpansion();
+  expansion.planExpansionRequest.constraints = { requireApprovalForMutations: false, maxTasks: 2 };
+
+  await accept(expansion, {
+    session,
+    runId: 'run-expansion',
+    task: session.headlessPlan[0],
+    assignment: { agentInstanceId: 'production-main', serverName: 'production' },
+    registry: expansionRegistry(),
+    callTool: async (_mcp, serverName, toolName, args) => {
+      calls.push(args);
+      return expansionFragment();
+    },
+  });
+
+  assert.equal(calls[0].constraints.requireApprovalForMutations, false);
+  assert.equal(calls[0].constraints.maxTasks, 2);
+});

package/src/runtime/recoveryManager.js

@@ -1,7 +1,7 @@
 import { parseJsonText } from '../core/activity.js';
 import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
 import { formatMcpToolResult, callMcpTool as defaultCallMcpTool } from '../core/mcp.js';
-import { createCapabilityRegistry } from '../orchestrator/capabilityRegistry.js';
+import { capabilityRegistryForSession } from '../orchestrator/capabilityRegistry.js';
 import { accept as acceptResult } from '../orchestrator/resultAggregator.js';
 import { isSuccessful, isTerminal } from '../orchestrator/taskStatuses.js';
 
@@ -100,6 +100,9 @@ async function recoverTask({ store, session, run, task, callTool, resultAggregat
   }
 
   const agent = agentFor(session, assignment.agentInstanceId);
+  if (agent?.providerKind === 'external-runtime' && typeof agent?.runtimeProvider?.status === 'function') {
+    return recoverExternalRuntimeTask({ store, session, run, task, attempt, assignment, agent, resultAggregator });
+  }
   const serverName = agent?.serverName ?? assignment.agentId ?? assignment.agentInstanceId;
   const statusTool = toolNameFor(session, serverName, 'agent_status');
   const status = parseToolPayload(await callTool(session.mcp, serverName, statusTool, { jobId: attempt.jobId }));
@@ -146,6 +149,70 @@ async function recoverTask({ store, session, run, task, callTool, resultAggregat
   return interruptTask({ store, session, run, task, reason: 'active job is non-terminal and task has no idempotencyKey' });
 }
 
+// An MCP job survives a manager restart on the agent's own side and reports
+// its status through agent_status. An external-runtime job has no such
+// side-channel here: the only way to check on it, or to give it up, is the
+// same RuntimeProvider the dispatcher used to start it, re-resolved by
+// agentInstanceId from the live registry rather than replayed from storage.
+async function recoverExternalRuntimeTask({ store, session, run, task, attempt, assignment, agent, resultAggregator }) {
+  const runtimeProvider = agent.runtimeProvider;
+  let status;
+  try {
+    status = await runtimeProvider.status(attempt.jobId);
+  } catch (error) {
+    return interruptTask({
+      store,
+      session,
+      run,
+      task,
+      reason: `external runtime status check failed: ${error instanceof Error ? error.message : String(error)}`,
+    });
+  }
+
+  if (isTerminal(status?.status)) {
+    const result = {
+      ok: isSuccessful(String(status?.status ?? '').toLowerCase()),
+      taskId: task.id,
+      attemptId: attempt.attemptId ?? null,
+      jobId: attempt.jobId,
+      agentInstanceId: assignment.agentInstanceId,
+      status: status?.status,
+      outputRefs: Array.isArray(status?.result?.outputRefs) ? status.result.outputRefs : [],
+      metrics: status?.result?.metrics ?? {},
+      // The gateway reports its failure at the TOP level of the status
+      // payload ({ runId, status, error }), not inside `result` — same fix
+      // already applied in dispatcher.js's taskResultFromStatus and
+      // deepAgentsProvider.js's status().
+      error: status?.result?.error ?? status?.error ?? null,
+      rawStatus: status,
+    };
+    await resultAggregator(result, {
+      session,
+      runId: run.id,
+      task,
+      assignment: { agentInstanceId: assignment.agentInstanceId, serverName: null, agent },
+      store,
+      registry: capabilityRegistryForSession(session),
+      workspaceConfig: session.wikircConfig ?? session.wikirc?.config ?? {},
+    });
+    return { status: 'recovered', runId: run.id, taskId: task.id, jobId: attempt.jobId };
+  }
+
+  // The runtime declares supportsIdempotency: false (runtimeProviders.js), so
+  // a fresh invocation cannot be deduped against the one still running on the
+  // external side. Requeuing it to `pending` like the MCP path below would
+  // start a duplicate while the orphaned original keeps running/billing.
+  // Cancel it explicitly instead of leaving it to run unattended.
+  await runtimeProvider.cancel(attempt.jobId).catch(() => null);
+  return interruptTask({
+    store,
+    session,
+    run,
+    task,
+    reason: 'active external-runtime job cancelled on recovery (no idempotency support)',
+  });
+}
+
 function interruptTask({ store, session, run, task, reason }) {
   dispatch(session, store, 'runtime_log', {
     origin: 'recovery_manager',
@@ -171,10 +238,7 @@ function latestAssignment(assignments, attemptId) {
 
 
 function capabilityResolvable(session, capability) {
-  const registry = session.capabilityRegistry
-    ?? ((session.agentRegistrySnapshot ?? []).length > 0
-      ? createCapabilityRegistry({ agents: session.agentRegistrySnapshot })
-      : null);
+  const registry = capabilityRegistryForSession(session);
   if (!registry || typeof registry.providersFor !== 'function') return true;
   // Only trust a registry that actually knows about capabilities. An empty
   // one (discovery not finished, or agents described without capability
@@ -211,6 +275,7 @@ function agentFor(session, agentInstanceId) {
   return [
     ...(session.agentRegistrySnapshot ?? []),
     ...(session.agents ?? []),
+    ...(session.runtimeProviderAgents ?? []),
   ].find((agent) => agent?.agentInstanceId === agentInstanceId) ?? null;
 }
 

package/src/runtime/skillChain.e2e.test.js

@@ -142,7 +142,7 @@ test('E2E-002 wiki-sync: two objectives, two ordered runs, one chainId', async (
   assert.equal(body.objectives, 2);
   assert.equal(env.runs.length, 2, 'the second objective must run after the first');
   assert.match(env.runs[0].input, /^Export the requested Confluence source/);
-  assert.match(env.runs[1].input, /^Run the production pipeline over the newly exported Markdown/);
+  assert.match(env.runs[1].input, /^Run the production pipeline step ingest over the newly exported Markdown/);
   // CME first, Production second — and the parameter reaches the step that
   // consumes it, not only the last objective.
   for (const run of env.runs) assert.match(run.input, /User parameters:\nsource: docs/);
@@ -202,7 +202,7 @@ test('E2E-003 cancel: the running step and its chain stop, unrelated queue survi
 // that silently fragments would show up as extra runs, not as extra objectives.
 const PERFORMANCE_TABLE = {
   pipeline: 1,
-  'wiki-ingest': 2,
+  'wiki-ingest': 1,
   'wiki-build': 1,
   deliver: 1,
   diagnose: 1,

package/src/runtime/supervisor.js

@@ -1,11 +1,11 @@
 import { openSync, readSync, closeSync, fstatSync } from 'node:fs';
 import { isAbsolute, join, normalize, resolve } from 'node:path';
-import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
+import { createAgentEvent, dispatchAgentEvent, dispatchRuntimeLog } from '../core/agentEvents.js';
 import { extractActivity, mergePolledActivity, parseJsonText, sessionActivities } from '../core/activity.js';
 import { callMcpTool, formatMcpToolResult } from '../core/mcp.js';
-import { normalizeRuntimeLog } from '../core/runtimeLog.js';
 import { startNextQueuedJob, syncQueueWithActivity } from '../core/jobQueue.js';
 import { createAgentRegistry } from '../orchestrator/agentRegistry.js';
+import { discoverRuntimeProvidersOnce } from '../orchestrator/providers/runtimeProviders.js';
 
 export function startActivitySupervisor(session, {
   intervalMs = 1000,
@@ -52,11 +52,13 @@ export function startActivitySupervisor(session, {
         }
       }
       void discoverAgentsOnce(session, { registry, signal: runSignal });
+      void discoverRuntimeProvidersOnce(session, { signal: runSignal });
     }, agentRegistryIntervalMs)
     : null;
 
   void pollActivitiesOnce(session, { pollBusy, callTool, signal: runSignal });
   void discoverAgentsOnce(session, { registry, signal: runSignal });
+  void discoverRuntimeProvidersOnce(session, { signal: runSignal });
 
   return {
     pollBusy,
@@ -199,14 +201,7 @@ export async function pollActivitiesOnce(session, {
 }
 
 export function emitRuntimeLog(session, message) {
-  const payload = normalizeRuntimeLog(message, { session });
-  dispatchAgentEvent(session, createAgentEvent('runtime_log', {
-    origin: 'runtime',
-    runId: payload.runId ?? null,
-    taskId: payload.taskId ?? null,
-    workspace: payload.workspaceId ?? null,
-    payload,
-  }));
+  dispatchRuntimeLog(session, message);
 }
 
 function registryIntervalFromEnv() {