@moretea-labs/forge 1.5.1 → 1.7.0

package/src/runtime/execution/process-runtime/persisted-check.ts

@@ -1,6 +1,7 @@
 import { createHash } from 'crypto';
 import { existsSync } from 'fs';
 import { dirname, resolve } from 'path';
+import { fileURLToPath } from 'url';
 import {
   controllerCheckExecutionIdentity,
   listControllerChecks,
@@ -23,9 +24,18 @@ import {
   type RunCheckFacadeResult,
 } from './check-facade';
 import { claimsForCheck, toProcessClaims } from './resource-claims';
-import { spawnManagedProcess } from './runtime';
+import { getProcessHandle, spawnManagedProcess } from './runtime';
+import { getProcessRecord, getProcessRequestBinding } from './store';
 import { allocatePersistedCheckResultReceiptPath } from './check-result';
 import { durationAwareInteractiveWaitMs } from './interactive-admission';
+
+/**
+ * Work verification may overlap another Work's repository-wide build cache.
+ * Wait through one ordinary sibling check, but never past Process Runtime's
+ * bounded lease-admission ceiling; explicit callers may still choose less.
+ */
+export const DEFAULT_WORK_CHECK_LEASE_WAIT_MS = 30_000;
+
 const PERSISTED_CHECK_SOURCE_ENTRY = 'src/runtime/execution/process-runtime/check-runner-sidecar.ts';
 
 export function resolvePersistedCheckCliInvocation(
@@ -37,7 +47,10 @@ export function resolvePersistedCheckCliInvocation(
 }
 
 export function resolveRuntimeCliTarget(controllerHome?: string): CliRuntimeTarget {
-  const moduleSourceRoot = resolve(import.meta.dir, '..', '..', '..', '..');
+  const moduleDir = typeof import.meta.dir === 'string' && import.meta.dir
+    ? import.meta.dir
+    : dirname(fileURLToPath(import.meta.url));
+  const moduleSourceRoot = resolve(moduleDir, '..', '..', '..', '..');
   const sourceEntry = resolve(moduleSourceRoot, 'src', 'cli', 'index.ts');
   const source = resolveControllerRuntimeSourceRoot({
     explicitRoot: existsSync(sourceEntry) ? moduleSourceRoot : undefined,
@@ -78,7 +91,7 @@ export function resolvePersistedCheckRuntimeExecutable(
   entryExists: (path: string) => boolean = existsSync,
 ): string {
   if (cliTarget.runtimeKind !== 'compiled_bun_release') return runtimeExecutable;
-  const checkRunner = resolve(dirname(runtimeExecutable), 'forge-check-runner');
+  const checkRunner = resolve(cliTarget.cwd, 'forge-check-runner');
   if (!entryExists(checkRunner)) {
     throw new Error(`PERSISTED_CHECK_RUNNER_MISSING: ${checkRunner}`);
   }
@@ -124,6 +137,38 @@ export async function runPersistedCheckViaProcessRuntime(
     workerSpawnCount: 0,
     projectionUpdateCount: 0,
   };
+  const requestId = input.requestId?.trim();
+  const requestSemanticFingerprint = input.requestSemanticFingerprint?.trim();
+  if (requestId && requestSemanticFingerprint) {
+    const binding = getProcessRequestBinding(input.controllerHome, input.repoId, input.checkoutId, requestId);
+    if (binding) {
+      const record = getProcessRecord(input.controllerHome, input.repoId, binding.processId);
+      const exactIdentity = Boolean(
+        record
+        && record.repoId === input.repoId
+        && (record.checkoutId?.trim() || undefined) === (input.checkoutId?.trim() || undefined)
+        && (record.workId?.trim() || undefined) === (input.workId?.trim() || undefined)
+        && record.origin?.surface === 'check'
+        && record.origin.requestId === requestId
+        && record.origin.checkId === input.checkId
+        && record.origin.requestSemanticFingerprint === requestSemanticFingerprint,
+      );
+      if (!exactIdentity) throw new Error(`PROCESS_REQUEST_ID_CONFLICT: ${requestId}`);
+      const existing = getProcessHandle(input.controllerHome, input.repoId, binding.processId);
+      if (!existing) {
+        throw new Error(`PROCESS_REQUEST_INCOMPLETE: request ${requestId} is bound to missing process ${binding.processId}; refusing re-execution`);
+      }
+      const check = listControllerChecks(input.repoRoot).find((entry) => entry.id === input.checkId);
+      return {
+        mode: existing.completed ? 'direct' : 'managed',
+        checkId: input.checkId,
+        check,
+        process: { ...existing, deduplicated: true, requestId },
+        ok: existing.completed ? existing.ok : undefined,
+        durableSideEffects: emptyEffects,
+      };
+    }
+  }
   const verificationSnapshot = input.verificationSnapshot
     ? materializeWorkVerificationSnapshot({
         controllerHome: input.controllerHome,
@@ -149,7 +194,7 @@ export async function runPersistedCheckViaProcessRuntime(
       durableSideEffects: emptyEffects,
     };
   }
-  if (input.forceDurable || checkRequiresDurableWorkflow(input.checkId, check)) {
+  if (input.forceDurable || (checkRequiresDurableWorkflow(input.checkId, check) && input.allowDurableCheckExecution !== true)) {
     cleanupVerificationSnapshot();
     return {
       mode: 'durable',
@@ -164,7 +209,8 @@ export async function runPersistedCheckViaProcessRuntime(
   }
 
   const interactiveWaitMs = durationAwareInteractiveWaitMs(check.command, input.interactiveWaitMs);
-  const leaseWaitMs = input.leaseWaitMs;
+  const leaseWaitMs = input.leaseWaitMs
+    ?? (input.workId?.trim() ? DEFAULT_WORK_CHECK_LEASE_WAIT_MS : undefined);
   const timeoutMs = Math.min(
     check.timeoutMs,
     typeof input.timeoutMs === 'number' && Number.isFinite(input.timeoutMs)
@@ -214,7 +260,11 @@ export async function runPersistedCheckViaProcessRuntime(
     scopeKey: persistedCheckSemanticScopeKey(input, semanticCheck.reuseScope),
   };
   const cliTarget = resolveRuntimeCliTarget(input.controllerHome);
-  const checkResultReceiptPath = allocatePersistedCheckResultReceiptPath(input.controllerHome, input.repoId);
+  const checkResultReceiptPath = allocatePersistedCheckResultReceiptPath(
+    input.controllerHome,
+    input.repoId,
+    input.requestId,
+  );
   const checkArgs = [
     '--repo',
     executionRoot,
@@ -254,6 +304,7 @@ export async function runPersistedCheckViaProcessRuntime(
       toolName: 'run_check',
       checkId: input.checkId,
       requestId: input.requestId,
+      requestSemanticFingerprint: input.requestSemanticFingerprint,
       correlationId: input.workId,
       executionSessionId: input.verificationBinding?.executionSessionId,
       editSessionId: input.verificationBinding?.editSessionId,

package/src/runtime/execution/process-runtime/resource-claims.ts

@@ -4,6 +4,8 @@
  */
 
 import type { ResourceClaimSpec } from '../jobs/types';
+import { readFileSync } from 'fs';
+import { join } from 'path';
 import type { ControllerCheckEffects } from '../../../cli/controller/check-runner';
 import { classifyRepositoryCommand, fixedShellWrapperCommand } from '../../../cli/repositories/command-classifier';
 import { normalizeRepositoryCommand } from '../../../cli/repositories/command-normalization';
@@ -157,7 +159,89 @@ function iosSimulatorTestCommandClaims(
   ]);
 }
 
-function hostOnlyCommandClaims(command: string | readonly string[]): ResourceClaimSpec[] | undefined {
+function localHttpServerClaims(command: string | readonly string[]): ResourceClaimSpec[] | undefined {
+  const canonical = normalizeRepositoryCommand(command);
+  if (canonical.kind !== 'argv') return undefined;
+  const program = (canonical.executable ?? '').split(/[\\/]/).at(-1)?.toLowerCase();
+  if (program !== 'python' && program !== 'python3') return undefined;
+  const args = canonical.args ?? [];
+  if (args[0] !== '-m' || args[1] !== 'http.server' || args.includes('--cgi')) return undefined;
+  let bind = '0.0.0.0';
+  let port = '8000';
+  for (let index = 2; index < args.length; index += 1) {
+    const arg = args[index]!;
+    if (arg === '--bind') { bind = args[index + 1] ?? bind; index += 1; continue; }
+    if (arg === '--directory' || arg === '-d' || arg === '--protocol') { index += 1; continue; }
+    if (!arg.startsWith('-') && /^\d{1,5}$/.test(arg)) port = arg;
+  }
+  return [claimHostService(`tcp-listen:${bind}:${port}`, 'write')];
+}
+
+function loopbackCurlClaims(command: string | readonly string[], repoId: string): ResourceClaimSpec[] | undefined {
+  const canonical = normalizeRepositoryCommand(command);
+  if (canonical.kind !== 'argv') return undefined;
+  const program = (canonical.executable ?? '').split(/[\\/]/).at(-1)?.toLowerCase();
+  if (program !== 'curl') return undefined;
+  const args = canonical.args ?? [];
+  if (args.some((arg) => /^(?:-X|--request|-d|--data|--data-raw|--data-binary|-F|--form|-T|--upload-file|-o|--output|-O|--remote-name)$/i.test(arg))) return undefined;
+  const explicitMethodIndex = args.findIndex((arg) => arg === '-X' || arg === '--request');
+  if (explicitMethodIndex >= 0 && !/^(?:GET|HEAD)$/i.test(args[explicitMethodIndex + 1] ?? '')) return undefined;
+  const urls = args.filter((arg) => /^https?:\/\//i.test(arg));
+  if (urls.length === 0 || urls.some((url) => {
+    try {
+      const host = new URL(url).hostname.toLowerCase();
+      return !['127.0.0.1', 'localhost', '::1'].includes(host);
+    } catch { return true; }
+  })) return undefined;
+  return [claimNetwork(repoId, 'read')];
+}
+
+function simpleViteScript(script: string): boolean {
+  const normalized = script.trim();
+  if (!normalized || /[;&|`$<>\n\r]/.test(normalized)) return false;
+  return /^(?:(?:\.\/)?node_modules\/.bin\/)?vite(?:\s|$)/.test(normalized);
+}
+
+function viteServiceClaims(
+  command: string | readonly string[],
+  repoId: string,
+  checkoutId?: string,
+  repoRoot?: string,
+): ResourceClaimSpec[] | undefined {
+  const canonical = normalizeRepositoryCommand(command);
+  if (canonical.kind !== 'argv') return undefined;
+  const program = (canonical.executable ?? '').split(/[\\/]/).at(-1)?.toLowerCase();
+  const args = canonical.args ?? [];
+  let vite = program === 'vite';
+  if (!vite && (program === 'npx' || program === 'bunx') && args[0]?.toLowerCase() === 'vite') vite = true;
+  if (!vite && program === 'bun' && args[0]?.toLowerCase() === 'x' && args[1]?.toLowerCase() === 'vite') vite = true;
+  if (!vite && repoRoot && ['npm', 'pnpm', 'yarn', 'bun'].includes(program ?? '')) {
+    const runIndex = args[0]?.toLowerCase() === 'run' ? 1 : program === 'yarn' ? 0 : -1;
+    const scriptName = runIndex >= 0 ? args[runIndex]?.toLowerCase() : undefined;
+    if (scriptName === 'dev') {
+      try {
+        const pkg = JSON.parse(readFileSync(join(repoRoot, 'package.json'), 'utf8')) as { scripts?: Record<string, unknown> };
+        const script = typeof pkg.scripts?.dev === 'string' ? pkg.scripts.dev : '';
+        vite = simpleViteScript(script);
+      } catch {
+        vite = false;
+      }
+    }
+  }
+  if (!vite) return undefined;
+  return normalizeClaims([
+    claimBuildCacheWrite(repoId),
+    claimHostService(`vite:${checkoutScope(checkoutId)}`, 'write'),
+  ]);
+}
+
+function hostOnlyCommandClaims(command: string | readonly string[], repoId: string, checkoutId?: string, repoRoot?: string): ResourceClaimSpec[] | undefined {
+  const localServer = localHttpServerClaims(command);
+  if (localServer) return localServer;
+  const loopbackCurl = loopbackCurlClaims(command, repoId);
+  if (loopbackCurl) return loopbackCurl;
+  const vite = viteServiceClaims(command, repoId, checkoutId, repoRoot);
+  if (vite) return vite;
   const canonical = normalizeRepositoryCommand(command);
   if (canonical.kind === 'shell') {
     return browserAppleScriptHeredocClaims(canonical.shellCommand ?? '');
@@ -347,13 +431,14 @@ export function claimsForRepositoryCommand(
   repoId: string,
   checkoutId?: string,
   defaultBranch?: string,
+  repoRoot?: string,
 ): ResourceClaimSpec[] {
   const classification = classifyRepositoryCommand(command, defaultBranch);
   const canonical = normalizeRepositoryCommand(command);
   const focused = isFocusedCheckCommand(command);
   const iosSimulatorClaims = iosSimulatorTestCommandClaims(command, repoId, checkoutId);
   if (iosSimulatorClaims) return iosSimulatorClaims;
-  const hostClaims = hostOnlyCommandClaims(command);
+  const hostClaims = hostOnlyCommandClaims(command, repoId, checkoutId, repoRoot);
   if (hostClaims) return hostClaims;
 
   if (classification.risk === 'readonly') {
@@ -426,12 +511,16 @@ export function claimsForCheck(
 ): ResourceClaimSpec[] {
   const heavy = /(?:^|:)(?:test(?::coverage)?|check:(?:ci|forge-runtime|public-export|release(?:-[a-z0-9-]+)?))$/.test(checkId)
     || /release|migration|integrate/i.test(checkId);
-  if (heavy) return [claimHeavyCheck(repoId)];
-  if (effects) return claimsForDeclaredCheckEffects(checkId, effects, repoId, checkoutId);
-  if (staticAnalysisCheckId(checkId)) return [claimWorkspaceRead(checkoutId), claimBuildCacheWrite(repoId)];
-  if (command && command.length > 0) return claimsForRepositoryCommand(command, repoId, checkoutId);
-  // Unknown named checks without a command/effects contract remain conservative.
-  return [claimWorkspaceWrite(checkoutId)];
+  const baseClaims = effects
+    ? claimsForDeclaredCheckEffects(checkId, effects, repoId, checkoutId)
+    : staticAnalysisCheckId(checkId)
+      ? [claimWorkspaceRead(checkoutId), claimBuildCacheWrite(repoId)]
+      : command && command.length > 0
+        ? claimsForRepositoryCommand(command, repoId, checkoutId)
+        : [claimWorkspaceWrite(checkoutId)];
+  // Heavy-check is an additional cross-check serialization fence, not a
+  // substitute for the resources the check actually reads or writes.
+  return heavy ? normalizeClaims([claimHeavyCheck(repoId), ...baseClaims]) : baseClaims;
 }
 
 export function scopeResourceClaims(

package/src/runtime/execution/process-runtime/runtime.ts

@@ -258,8 +258,23 @@ function captureIdentity(pid: number | undefined): {
 } {
   if (!pid || pid <= 0) return {};
   const probe = defaultProcessIdentityProbe;
-  if (!probe.isAlive(pid)) return {};
+  // The combined inspect probe already proves the PID exists on the normal
+  // POSIX path. Avoid an immediately preceding ps(stat) child process; only
+  // fall back to the separate alive/command/start-time probes when the combined
+  // observation is unavailable or incomplete.
   const inspected = probe.inspect?.(pid);
+  if (inspected?.command && inspected.startTime) {
+    return {
+      identity: {
+        pid,
+        processStartTime: inspected.startTime,
+        executableFingerprint: executableFingerprint(inspected.command),
+        processGroupId: process.platform !== 'win32' ? pid : undefined,
+      },
+      identityUntrusted: false,
+    };
+  }
+  if (!probe.isAlive(pid)) return {};
   const command = inspected?.command ?? probe.command(pid);
   const startTime = inspected?.startTime ?? probe.startTime(pid);
   if (!command || !startTime) {
@@ -291,8 +306,9 @@ function identityStillMatches(identity: ManagedProcessRecord['identity'] | undef
   }
   if (!isProcessAlive(identity.pid)) return false;
   const probe = defaultProcessIdentityProbe;
-  const startTime = probe.startTime(identity.pid);
-  const command = probe.command(identity.pid);
+  const inspected = probe.inspect?.(identity.pid);
+  const startTime = inspected?.startTime ?? probe.startTime(identity.pid);
+  const command = inspected?.command ?? probe.command(identity.pid);
   if (!startTime || !command) return false;
   if (startTime !== identity.processStartTime) return false;
   if (executableFingerprint(command) !== identity.executableFingerprint) return false;
@@ -526,7 +542,7 @@ export function completeProcessFromEvidence(
     stdoutTail?: string;
     stderrTail?: string;
   },
-  options: { authority?: 'runtime_writer' | 'durable_exit_receipt' | 'durable_pre_spawn_abandonment' } = {},
+  options: { authority?: 'runtime_writer' | 'durable_exit_receipt' | 'durable_pre_spawn_abandonment' | 'durable_stale_active_reconciliation' } = {},
 ): ManagedProcessRecord | undefined {
   // Validated independent evidence may only perform the monotonic,
   // fence-token-bound terminal CAS below. It does not grant general writer
@@ -612,6 +628,45 @@ export function reconcileAbandonedPreSpawnProcess(
   }, { authority: 'durable_pre_spawn_abandonment' });
 }
 
+/**
+ * Bounded maintenance reconciliation for stale active Process records that are
+ * no longer reachable through the v2 recovery index. This never deletes an
+ * active record and never re-executes a command: it first consumes any durable
+ * Runner receipt, preserves live monitors / matching process identities, and
+ * only then commits a monotonic terminal state for a provably dead identity.
+ */
+export function reconcileStaleManagedProcessForMaintenance(
+  controllerHome: string,
+  repoId: string,
+  processId: string,
+  options: { nowMs?: number; minAgeMs?: number } = {},
+): ManagedProcessRecord | undefined {
+  let record = getProcessRecord(controllerHome, repoId, processId);
+  if (!record || !isManagedProcessActive(record)) return record;
+
+  const nowMs = options.nowMs ?? Date.now();
+  const minAgeMs = Math.max(1_000, options.minAgeMs ?? DEFAULT_PRE_SPAWN_ABANDONMENT_MS);
+  const updatedAtMs = Date.parse(record.updatedAt || record.startedAt);
+  if (!Number.isFinite(updatedAtMs) || nowMs - updatedAtMs < minAgeMs) return record;
+
+  const fromReceipt = applyReceiptIfPresent(controllerHome, repoId, processId, record);
+  if (fromReceipt) return fromReceipt;
+
+  if (record.status === 'starting' && !record.identity) {
+    return reconcileAbandonedPreSpawnProcess(controllerHome, repoId, processId, { nowMs, minAgeMs });
+  }
+
+  record = getProcessRecord(controllerHome, repoId, processId) ?? record;
+  if (!isManagedProcessActive(record) || liveMonitors.has(processId)) return record;
+  if (identityStillMatches(record.identity, record.identityUntrusted)) return record;
+
+  return completeProcessFromEvidence(controllerHome, repoId, processId, record.terminalFenceToken, {
+    status: 'completed_unknown',
+    finishedAt: new Date(nowMs).toISOString(),
+    errorMessage: 'PROCESS_STALE_ACTIVE_RECONCILED: stale active record has no live matching process identity or durable exit receipt',
+  }, { authority: 'durable_stale_active_reconciliation' });
+}
+
 async function killTree(child: ChildProcess): Promise<void> {
   const pid = child.pid;
   if (!pid) return;

package/src/runtime/execution/process-runtime/store.ts

@@ -299,6 +299,7 @@ function sanitizeProcessRecord(record: ManagedProcessRecord): { record: ManagedP
       toolName: safeText(record.origin.toolName),
       requestId: safeText(record.origin.requestId),
       checkId: safeText(record.origin.checkId),
+      requestSemanticFingerprint: safeText(record.origin.requestSemanticFingerprint),
       correlationId: safeText(record.origin.correlationId),
     } : undefined,
   };
@@ -308,6 +309,12 @@ function sanitizeProcessRecord(record: ManagedProcessRecord): { record: ManagedP
 function readProcessRecord(path: string): ManagedProcessRecord | undefined {
   const record = readJson<ManagedProcessRecord>(path);
   if (!record || record.schemaVersion !== 1) return undefined;
+  // Legacy/partial Process files can predate the required command descriptor.
+  // They are not executable recovery authority and must never be repaired by
+  // inventing a command. Treat them as unavailable to normal Runtime readers;
+  // bounded GC has its own metadata-only parser so one such file cannot block
+  // cleanup of unrelated proven terminal records.
+  if (!record.command || typeof record.command !== 'object' || Array.isArray(record.command)) return undefined;
   const sanitized = sanitizeProcessRecord(record);
   if (sanitized.changed) atomicWrite(path, sanitized.record);
   return sanitized.record;

package/src/runtime/execution/process-runtime/types.ts

@@ -239,6 +239,8 @@ export interface ManagedProcessRecord {
     toolName?: string;
     requestId?: string;
     checkId?: string;
+    /** Stable semantic identity supplied by a facade for exact request reattachment. */
+    requestSemanticFingerprint?: string;
     correlationId?: string;
     /** Controller MCP session that initiated this check, when applicable. */
     executionSessionId?: string;

package/src/runtime/execution/thin-harness/async-process.ts

@@ -10,6 +10,9 @@ export interface BoundedProcessOptions {
   signal?: AbortSignal;
   /** When true (default on non-Windows), create a new process group for tree kill. */
   processGroup?: boolean;
+  onSpawn?: (pid: number) => void;
+  onStdout?: (chunk: string) => void;
+  onStderr?: (chunk: string) => void;
 }
 
 export interface BoundedProcessResult {
@@ -114,6 +117,7 @@ export async function runBoundedProcess(
       stdio: ['ignore', 'pipe', 'pipe'],
       detached: useProcessGroup,
     });
+    if (child.pid) options.onSpawn?.(child.pid);
 
     const finish = (exitCode: number) => {
       if (settled) return;
@@ -150,8 +154,14 @@ export async function runBoundedProcess(
 
     options.signal?.addEventListener('abort', onAbort, { once: true });
 
-    child.stdout?.on('data', (chunk: Buffer) => stdout.write(chunk));
-    child.stderr?.on('data', (chunk: Buffer) => stderr.write(chunk));
+    child.stdout?.on('data', (chunk: Buffer) => {
+      stdout.write(chunk);
+      options.onStdout?.(chunk.toString('utf8'));
+    });
+    child.stderr?.on('data', (chunk: Buffer) => {
+      stderr.write(chunk);
+      options.onStderr?.(chunk.toString('utf8'));
+    });
     child.on('error', (error) => {
       spawnError = error.message;
     });

package/src/runtime/execution/thin-harness/search-worker.ts

@@ -5,7 +5,12 @@
 import { isMainThread, parentPort, workerData, Worker } from 'worker_threads';
 import { fileURLToPath } from 'url';
 import { getMcpPolicy } from '../../../cli/mcp/policy';
-import { searchRepository } from '../../../cli/repository/inspector';
+import type { McpPolicy } from '../../../cli/mcp/types';
+import {
+  searchRepository,
+  searchRepositoryMany,
+  type SearchRepositoryManyResult,
+} from '../../../cli/repository/inspector';
 
 export interface SearchWorkerInput {
   repoRoot: string;
@@ -14,14 +19,44 @@ export interface SearchWorkerInput {
   maxFiles: number;
 }
 
+export interface SearchManyWorkerInput {
+  repoRoot: string;
+  policy: McpPolicy;
+  queries: string[];
+  files?: string[];
+  includeGlobs?: string[];
+  excludeGlobs?: string[];
+  maxResultsPerQuery?: number;
+  maxFiles?: number;
+  caseSensitive?: boolean;
+  cacheKey?: string;
+}
+
 export interface SearchWorkerResult {
   ok: boolean;
   payload?: Record<string, unknown>;
   error?: string;
 }
 
-function runSearchSync(input: SearchWorkerInput): SearchWorkerResult {
+function isManySearch(input: SearchWorkerInput | SearchManyWorkerInput): input is SearchManyWorkerInput {
+  return Array.isArray((input as SearchManyWorkerInput).queries);
+}
+
+function runSearchSync(input: SearchWorkerInput | SearchManyWorkerInput): SearchWorkerResult {
   try {
+    if (isManySearch(input)) {
+      const result = searchRepositoryMany(input.repoRoot, input.policy, {
+        queries: input.queries,
+        files: input.files,
+        includeGlobs: input.includeGlobs,
+        excludeGlobs: input.excludeGlobs,
+        maxResultsPerQuery: input.maxResultsPerQuery,
+        maxFiles: input.maxFiles,
+        caseSensitive: input.caseSensitive,
+        cacheKey: input.cacheKey,
+      }) as unknown as Record<string, unknown>;
+      return { ok: true, payload: result };
+    }
     const result = searchRepository(input.repoRoot, getMcpPolicy('controller', { repoRoot: input.repoRoot }), {
       query: input.query,
       maxResults: input.maxResults,
@@ -36,8 +71,8 @@ function runSearchSync(input: SearchWorkerInput): SearchWorkerResult {
   }
 }
 
-export async function runInspectorSearchInWorker(
-  input: SearchWorkerInput,
+async function runSearchWorker(
+  input: SearchWorkerInput | SearchManyWorkerInput,
   options: { timeoutMs?: number; signal?: AbortSignal } = {},
 ): Promise<Record<string, unknown>> {
   if (options.signal?.aborted) throw new Error('CANCELLED: search aborted');
@@ -108,7 +143,21 @@ export async function runInspectorSearchInWorker(
   });
 }
 
+export async function runInspectorSearchInWorker(
+  input: SearchWorkerInput,
+  options: { timeoutMs?: number; signal?: AbortSignal } = {},
+): Promise<Record<string, unknown>> {
+  return await runSearchWorker(input, options);
+}
+
+export async function runInspectorSearchManyInWorker(
+  input: SearchManyWorkerInput,
+  options: { timeoutMs?: number; signal?: AbortSignal } = {},
+): Promise<SearchRepositoryManyResult> {
+  return await runSearchWorker(input, options) as unknown as SearchRepositoryManyResult;
+}
+
 if (!isMainThread && parentPort) {
-  const input = workerData as SearchWorkerInput;
+  const input = workerData as SearchWorkerInput | SearchManyWorkerInput;
   parentPort.postMessage(runSearchSync(input));
 }

package/src/runtime/execution/workers/executor.ts

@@ -21,7 +21,6 @@ import {
 } from '../jobs/child-reference';
 import { markOperationDelegated } from '../jobs/receipt-store';
 import { assertAutomatedOperationAllowed } from '../../control-plane/governance/external-effects';
-import { recordCandidateFinding, updateCandidateFinding } from '../../workflow/findings/store';
 import { triggerWorkspaceAgent } from '../workspace-agent';
 import { executeAssistantPluginAction } from '../../plugins/store';
 import { CONTROLLER_SCOPE_REPO_ID, controllerSystemRoot, repositoryControllerRoot } from '../../../cli/repositories/controller-home';
@@ -29,7 +28,6 @@ import { writeExecutionArtifact } from '../../evidence/artifact-store';
 import { existsSync } from 'fs';
 import { isAbsolute, relative, resolve, sep } from 'path';
 import { isAssistantPluginError } from '../../plugins/errors';
-import { executeAssistantRoutineRuntime } from '../../assistant/routine-runtime';
 
 
 function childReferenceFromLocalJob(
@@ -445,20 +443,6 @@ export async function executeExecutionJob(controllerHome: string, job: Execution
     }
     bindRepositoryEntities(repository);
 
-    if (job.payload.target === 'runtime' && job.payload.operation === 'assistant_routine_execute') {
-      const routineId = String(job.payload.arguments?.routineId ?? job.payload.arguments?.routine_id ?? '').trim();
-      if (!routineId) throw new Error('ASSISTANT_ROUTINE_ID_REQUIRED');
-      const routineResult = await executeAssistantRoutineRuntime({
-        controllerHome,
-        repository,
-        routineId,
-        requestId: job.requestId,
-        origin: job.origin,
-        occurrenceId: typeof job.payload.occurrenceId === 'string' ? job.payload.occurrenceId : undefined,
-      });
-      return { ok: true, result: { assistantRoutine: routineResult }, repoRoot };
-    }
-
     if (job.payload.target === 'runtime' && job.payload.operation === 'legacy-local-job') {
       const localJobId = String(job.payload.arguments?.localJobId ?? '').trim();
       if (!localJobId) throw new Error('LEGACY_JOB_ID_REQUIRED');
@@ -511,26 +495,6 @@ export async function executeExecutionJob(controllerHome: string, job: Execution
         : { ok: false, error: { code: 'RELEASE_GATE_BLOCKED', message: 'Release gate has blockers.', retryable: false, details: { gate } }, repoRoot };
     }
 
-    if (job.payload.operation === 'record_candidate_finding') {
-      const args = job.payload.arguments ?? {};
-      const finding = recordCandidateFinding(controllerHome, {
-        repoId: job.repoId,
-        requestId: job.requestId,
-        semanticKey: String(args.semantic_key ?? args.semanticKey ?? '').trim(),
-        title: String(args.title ?? '').trim(),
-        summary: typeof args.summary === 'string' ? args.summary : undefined,
-        severity: ['low', 'medium', 'high', 'critical'].includes(String(args.severity))
-          ? String(args.severity) as 'low' | 'medium' | 'high' | 'critical'
-          : 'medium',
-        evidence: {
-          source: job.origin.surface,
-          reference: typeof args.reference === 'string' ? args.reference : job.origin.correlationId,
-          details: args.evidence && typeof args.evidence === 'object' ? args.evidence as Record<string, unknown> : undefined,
-        },
-      });
-      return { ok: true, result: { finding }, repoRoot };
-    }
-
     const allowedAgents = Array.isArray(job.payload.allowedAgents)
       ? job.payload.allowedAgents.filter((value): value is string => typeof value === 'string')
       : [];
@@ -651,18 +615,6 @@ export async function executeExecutionJob(controllerHome: string, job: Execution
       );
     }
 
-    if (job.origin.actor === 'promote_candidate_finding' && job.origin.correlationId) {
-      try {
-        updateCandidateFinding(controllerHome, job.repoId, job.origin.correlationId, (current) => ({
-          ...current,
-          status: result.isError ? 'candidate' : 'promoted',
-          promotedJobId: job.jobId,
-        }), job.requestId, result.isError ? 'candidate_promotion_failed' : 'candidate_finding_promoted');
-      } catch {
-        // The Issue result remains authoritative even if the candidate projection needs reconciliation.
-      }
-    }
-
     if (result.isError) {
       return { ok: false, error: { code: 'MCP_TOOL_FAILED', message: JSON.stringify(record), retryable: false }, repoRoot };
     }