@moretea-labs/forge 1.7.2 → 1.8.0

package/src/runtime/execution/process-runtime/runtime.ts

@@ -30,6 +30,7 @@ import {
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
 import { capProcessOutput } from '../../../effects/process-runner';
+import { getRepository, selectRepositoryCheckout } from '../../../cli/repositories/registry';
 import { redactSensitiveText, sanitizeSensitiveTextFileInPlace } from '../../evidence/sensitive-output';
 import { isProcessAlive, terminateProcessTree } from '../../shared/process-tree';
 import { repositoryChildProcessEnvironment, resolveBunExecutable } from '../../shared/process-environment';
@@ -54,6 +55,13 @@ import {
   updateProcessRecord,
 } from './store';
 import { assertExecutionIdentity } from '../../control-plane/execution/execution-identity';
+import { settleWorkHandleExpectedHeadAfterRepositoryCommand } from '../../control-plane/execution/work-head-settlement';
+import {
+  clearWorkExecutionConcurrencyWaitForAttempt,
+  evaluateManagedProcessWorkCompatibility,
+  executionConcurrencyWaitProjection,
+  recordWorkExecutionConcurrencyWait,
+} from '../../control-plane/concurrency/work-execution-concurrency';
 import {
   DEFAULT_INTERACTIVE_WAIT_MS,
   DEFAULT_MAX_OUTPUT_BYTES,
@@ -487,7 +495,7 @@ export function releaseProcessLeasesOnce(
       repoId,
       processId,
       expectedRefs,
-      { visibility: 'ephemeral', notifyScheduler: false, invalidateProjection: false, emitRuntimeEvent: false },
+      { visibility: 'ephemeral', notifyScheduler: Boolean(record.workId), invalidateProjection: false, emitRuntimeEvent: false },
     );
   } catch (error) {
     // Exact-set or token mismatch remains pending and retryable. Failed cleanup
@@ -587,6 +595,38 @@ export function completeProcessFromEvidence(
   const afterTerminal = completion.record ?? getProcessRecord(controllerHome, repoId, processId);
   if (afterTerminal && (completion.ok || completion.reason === 'already_terminal' || afterTerminal.terminalWritten === true)) {
     const released = releaseProcessLeasesOnce(controllerHome, repoId, processId) ?? afterTerminal;
+    // Successful repository mutation settlement is deliberately downstream of
+    // durable terminal persistence. Recovery may repeat this block, but the
+    // WorkHandle CAS plus immutable expectedHead makes reconciliation idempotent.
+    if (
+      released.status === 'succeeded'
+      && released.exitCode === 0
+      && released.cancelled !== true
+      && released.timedOut !== true
+      && released.workId
+      && released.executionIdentity
+    ) {
+      try {
+        const repository = selectRepositoryCheckout(
+          getRepository(released.executionIdentity.repositoryId, controllerHome),
+          released.executionIdentity.checkoutId,
+          { allowArchived: released.executionIdentity.allowArchived },
+        );
+        settleWorkHandleExpectedHeadAfterRepositoryCommand({
+          controllerHome,
+          repository,
+          executionIdentity: released.executionIdentity,
+          workId: released.workId,
+          ok: true,
+          cancelled: false,
+          timedOut: false,
+        });
+      } catch {
+        // Terminal Process evidence remains valid even when its exact historical
+        // checkout is no longer selectable. Never infer authority from active
+        // checkout/session state; Work finalization will continue to fail closed.
+      }
+    }
     cleanupTerminalRunnerReceipts(released);
     return released;
   }
@@ -737,16 +777,14 @@ export function resolveProcessRunnerRuntime(
   return resolveBunExecutable(execPath, env);
 }
 
-function runnerInvocation(entry: string, descriptorPath: string): { command: string; args: string[] } {
+export function resolveProcessRunnerInvocation(entry: string, descriptorPath: string): { command: string; args: string[] } {
   const scriptEntry = /\.(?:[cm]?js|tsx?)$/i.test(entry);
   let standalone = !scriptEntry && process.env.FORGE_RUNTIME_EXECUTION === 'standalone-binary';
-  if (!scriptEntry && !standalone) {
-    try {
-      const manifest = JSON.parse(readFileSync(join(dirname(entry), 'manifest.json'), 'utf8')) as { executionMode?: unknown };
-      standalone = manifest.executionMode === 'standalone-binary';
-    } catch {
-      /* source and legacy script releases have no execution manifest */
-    }
+  try {
+    const manifest = JSON.parse(readFileSync(join(dirname(entry), 'manifest.json'), 'utf8')) as { executionMode?: unknown };
+    if (manifest.executionMode === 'standalone-binary') standalone = true;
+  } catch {
+    /* source and legacy script releases have no execution manifest */
   }
   const args = ['--descriptor', descriptorPath];
   return standalone
@@ -1043,6 +1081,7 @@ function recordToHandle(
       : completed ? safeProcessText(safeRecord.stderrTail || persistedStderr || '') : undefined,
     stdoutTail: safeRecord.stdoutTail ? safeProcessText(safeRecord.stdoutTail) : undefined,
     stderrTail: safeRecord.stderrTail ? safeProcessText(safeRecord.stderrTail) : undefined,
+    concurrencyWait: safeRecord.concurrencyWait,
     durableSideEffects: {
       executionJobCount: 0,
       localJobCount: 0,
@@ -1061,7 +1100,7 @@ function spawnProcessRunner(descriptor: ProcessCommandDescriptor, descriptorPath
   writeFileSync(descriptorPath, `${JSON.stringify(descriptor, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
   const entry = resolveProcessRunnerEntryPath();
   const useProcessGroup = process.platform !== 'win32';
-  const invocation = runnerInvocation(entry, descriptorPath);
+  const invocation = resolveProcessRunnerInvocation(entry, descriptorPath);
   // Detached so Controller crash does not kill the runner.
   return spawn(invocation.command, invocation.args, {
     cwd: descriptor.command.cwd,
@@ -1186,6 +1225,7 @@ export async function spawnManagedProcess(input: SpawnManagedProcessInput): Prom
     repoId: input.repoId,
     checkoutId: input.checkoutId,
     workId: input.workId,
+    executionIdentity: input.executionIdentity,
     commandId: input.commandId?.trim() || processId,
     requestFingerprint: requestId ? commandFingerprint : undefined,
     checkExecution: input.checkExecution,
@@ -1253,6 +1293,61 @@ export async function spawnManagedProcess(input: SpawnManagedProcessInput): Prom
     return recordToHandle(completed!, { completed: true });
   }
 
+  const leaseWaitMs = Math.max(
+    0,
+    Math.min(Math.trunc(input.leaseWaitMs ?? 0), 30_000),
+  );
+  let compatibility = evaluateManagedProcessWorkCompatibility({
+    controllerHome: input.controllerHome,
+    repoId: input.repoId,
+    processId,
+    workId: input.workId,
+    resourceClaims,
+    checkExecution: input.checkExecution,
+    origin: input.origin,
+  });
+  if (!compatibility.compatible && !compatibility.hardBlocked && leaseWaitMs > 0) {
+    const semanticDeadline = Date.now() + leaseWaitMs;
+    while (!compatibility.compatible && !compatibility.hardBlocked && Date.now() < semanticDeadline) {
+      if (input.signal?.aborted) break;
+      await new Promise((resolvePromise) => setTimeout(resolvePromise, 50));
+      compatibility = evaluateManagedProcessWorkCompatibility({
+        controllerHome: input.controllerHome,
+        repoId: input.repoId,
+        processId,
+        workId: input.workId,
+        resourceClaims,
+        checkExecution: input.checkExecution,
+        origin: input.origin,
+      });
+    }
+  }
+  if (!compatibility.compatible && compatibility.wait) {
+    recordWorkExecutionConcurrencyWait({
+      controllerHome: input.controllerHome,
+      repoId: input.repoId,
+      workId: input.workId,
+      attemptId: processId,
+      wait: compatibility.wait,
+      resourceClaims,
+      leaseRepoId: input.repoId,
+    });
+    updateProcessRecord(input.controllerHome, input.repoId, processId, { concurrencyWait: compatibility.wait });
+    const code = compatibility.hardBlocked ? 'PROCESS_WORK_COMPATIBILITY_INVALID' : 'PROCESS_WORK_COMPATIBILITY_WAIT';
+    completeProcessFromEvidence(input.controllerHome, input.repoId, processId, fenceToken, {
+      status: 'failed',
+      exitCode: 1,
+      errorMessage: `${code}: ${compatibility.wait.blockerCode}`,
+      exitReceiptPath,
+    }, { authority: 'durable_pre_spawn_abandonment' });
+    const blocked = getProcessRecord(input.controllerHome, input.repoId, processId)!;
+    return recordToHandle(blocked, {
+      completed: true,
+      stdout: '',
+      stderr: blocked.error?.message ?? `${code}: ${compatibility.wait.blockerCode}`,
+    });
+  }
+
   // Acquire real execution leases BEFORE spawning the runner. Fail closed on conflict.
   let leaseRefs: ProcessLeaseRef[] = [];
   if (resourceClaims.length > 0) {
@@ -1313,10 +1408,6 @@ export async function spawnManagedProcess(input: SpawnManagedProcessInput): Prom
     // Minimal bounded queue behavior: when the caller opts in, wait for
     // conflicting leases to release instead of failing immediately. The Lease
     // store remains the single conflict authority; this loop only polls it.
-    const leaseWaitMs = Math.max(
-      0,
-      Math.min(Math.trunc(input.leaseWaitMs ?? 0), 30_000),
-    );
     if (!acquisition.acquired && leaseWaitMs > 0) {
       const leaseDeadline = Date.now() + leaseWaitMs;
       while (!acquisition.acquired && Date.now() < leaseDeadline) {
@@ -1338,6 +1429,31 @@ export async function spawnManagedProcess(input: SpawnManagedProcessInput): Prom
       }
     }
     if (!acquisition.acquired) {
+      const resourceKeys = [...new Set(acquisition.blockers.map((blocker) => blocker.resourceKey))].sort();
+      const blockingWorkId = acquisition.blockers
+        .map((blocker) => blocker.ownerJobId.startsWith('process:')
+          ? getProcessRecord(input.controllerHome, input.repoId, blocker.ownerJobId.slice('process:'.length))?.workId
+          : undefined)
+        .find((value): value is string => Boolean(value));
+      const wait = executionConcurrencyWaitProjection({
+        source: 'resource_lease',
+        blockerCode: 'resource_claim_conflict',
+        disposition: 'wait',
+        blockingWorkId,
+        semanticScopeKeys: [],
+        resourceKeys,
+        wakeTrigger: { kind: 'resource_release', resourceKeys },
+      });
+      recordWorkExecutionConcurrencyWait({
+        controllerHome: input.controllerHome,
+        repoId: input.repoId,
+        workId: input.workId,
+        attemptId: processId,
+        wait,
+        resourceClaims,
+        leaseRepoId: input.repoId,
+    });
+      updateProcessRecord(input.controllerHome, input.repoId, processId, { concurrencyWait: wait });
       const blockers = acquisition.blockers
         .map((b) => `${b.resourceKey}@${b.ownerJobId}`)
         .join(', ');
@@ -1363,7 +1479,8 @@ export async function spawnManagedProcess(input: SpawnManagedProcessInput): Prom
       checkoutId: lease.checkoutId,
       workId: lease.workId,
     }));
-    updateProcessRecord(input.controllerHome, input.repoId, processId, { leaseRefs });
+    clearWorkExecutionConcurrencyWaitForAttempt({ controllerHome: input.controllerHome, repoId: input.repoId, workId: input.workId, attemptId: processId });
+    updateProcessRecord(input.controllerHome, input.repoId, processId, { leaseRefs, concurrencyWait: undefined });
   }
 
   const descriptor: ProcessCommandDescriptor = {

package/src/runtime/execution/process-runtime/types.ts

@@ -6,6 +6,23 @@
 
 import type { ResolvedExecutionIdentity } from '../../control-plane/execution/execution-identity';
 
+export interface ExecutionConcurrencyWaitProjection {
+  schemaVersion: 1;
+  source: 'work_compatibility' | 'resource_lease' | 'scheduler_capacity';
+  blockerCode: string;
+  disposition: 'wait' | 'invalid';
+  blockingWorkId?: string;
+  semanticScopeKeys: string[];
+  resourceKeys: string[];
+  wakeTrigger:
+    | { kind: 'work_terminal'; workId: string }
+    | { kind: 'resource_release'; resourceKeys: string[] }
+    | { kind: 'controller_release'; workId: string }
+    | { kind: 'scheduler_capacity'; capacityKey: string }
+    | { kind: 'work_contract_change'; workId: string };
+  observedAt: string;
+}
+
 export type ProcessRuntimeStatus =
   | 'starting'
   | 'running'
@@ -171,6 +188,8 @@ export interface ManagedProcessRecord {
   checkoutId?: string;
   /** Optional facade WorkContract that owns this command. */
   workId?: string;
+  /** Immutable pre-spawn authority required for post-terminal Work reconciliation. */
+  executionIdentity?: ResolvedExecutionIdentity;
   /** Caller-stable command identity; defaults to processId when omitted. */
   commandId?: string;
   /** Fingerprint bound to origin.requestId before spawn. */
@@ -183,6 +202,8 @@ export interface ManagedProcessRecord {
   command: ProcessCommandSpec;
   identity?: ProcessIdentityRecord;
   resourceClaims: ProcessResourceClaim[];
+  /** Actionable semantic/resource wait projection; never an execution lease authority. */
+  concurrencyWait?: ExecutionConcurrencyWaitProjection;
   /** Real execution leases acquired before spawn; released exactly once on terminal. */
   leaseRefs?: ProcessLeaseRef[];
   /** Durable terminal cleanup phase; pending remains retryable after controller restart. */
@@ -320,6 +341,7 @@ export interface ProcessHandle {
   stderr?: string;
   stdoutTail?: string;
   stderrTail?: string;
+  concurrencyWait?: ExecutionConcurrencyWaitProjection;
   durableSideEffects: {
     executionJobCount: number;
     localJobCount: number;

package/src/runtime/execution/workers/executor.ts

@@ -1,14 +1,14 @@
 import { bindRepositoryEntities } from '../../../cli/repositories/entity-migration';
 import { getRepository, repositorySummary, selectRepositoryCheckout } from '../../../cli/repositories/registry';
-import { callRepositoryTool } from '../../../cli/mcp/repository-tools';
-import { callMcpTool, type CallToolResult, type McpToolContext } from '../../../cli/mcp/tools';
-import { runtimePolicy, type MultiRepositoryMcpToolContext } from '../../../cli/mcp/multi-repository';
-import { callRuntimeTool } from '../../gateway/mcp/runtime-tools';
+import { callRepositoryTool } from '../../../../adapters/mcp/tool-mapping/repository-tools';
+import { callMcpTool, type CallToolResult, type McpToolContext } from '../../../../adapters/mcp/tool-mapping/tools';
+import { runtimePolicy, type MultiRepositoryMcpToolContext } from '../../../../adapters/mcp/multi-repository';
+import { callRuntimeTool } from '../../../../adapters/mcp/runtime-gateway/runtime-tools';
 import { ensureRepositoryRuntimeStorage } from '../../../cli/repositories/runtime-storage';
 import { evaluateReleaseGate } from '../../release/release-gate';
 import { executeLocalBridgeJobInline, getLocalBridgeJob } from '../../../cli/local-bridge/job-store';
 import type { LocalBridgeJob } from '../../../cli/local-bridge/types';
-import { settleScheduledExecution } from '../../workflow/schedules/settlement';
+import { settleScheduledExecution } from '../../../../packages/kernel/scheduler/api/index';
 import type { ExecutionJob, ExecutionJobOutcome } from '../jobs/types';
 import {
   buildDelegatedExecutionResult,
@@ -30,6 +30,7 @@ import { isAbsolute, relative, resolve, sep } from 'path';
 import { isAssistantPluginError } from '../../plugins/errors';
 import { executeWork, validateWork } from '../../control-plane/execution/work-operation-service';
 import { finalizeWork } from '../../control-plane/execution/work-finalization-service';
+import { describeFailure } from '../../../../packages/protocols/failure';
 
 
 function childReferenceFromLocalJob(
@@ -255,11 +256,6 @@ function toolResultRecord(result: CallToolResult): Record<string, unknown> {
   return { content: result.content };
 }
 
-function errorCode(message: string): string {
-  const index = message.indexOf(':');
-  return index > 0 ? message.slice(0, index) : 'WORKER_EXECUTION_FAILED';
-}
-
 function materializePluginArtifacts(
   controllerHome: string,
   job: ExecutionJob,
@@ -637,8 +633,15 @@ export async function executeExecutionJob(controllerHome: string, job: Execution
         repoRoot: controllerHome,
       };
     }
-    const message = error instanceof Error ? error.message : String(error);
-    const retryable = /ECONN|EPIPE|temporar|timeout|worker|network/i.test(message);
-    return { ok: false, error: { code: errorCode(message), message, retryable }, repoRoot: controllerHome };
+    const failure = describeFailure(error, { fallbackCode: 'WORKER_EXECUTION_FAILED' });
+    return {
+      ok: false,
+      error: {
+        code: failure.code,
+        message: failure.message,
+        retryable: failure.retryDisposition === 'transient',
+      },
+      repoRoot: controllerHome,
+    };
   }
 }

package/src/runtime/execution/workers/worker-entry.ts

@@ -15,7 +15,7 @@ import {
   mergeChildReferences,
 } from '../jobs/child-reference';
 import { markOperationCompleted, markOperationStarted, operationReceiptMatchesJobOwnership, readOperationReceipt } from '../jobs/receipt-store';
-import { markScheduledExecutionRunning } from '../../workflow/schedules/settlement';
+import { markScheduledExecutionRunning } from '../../../../packages/kernel/scheduler/api/index';
 import { invalidateExecutionWorker } from './ownership';
 import { markRepositoryProjectionDirty } from '../../projections/invalidation';
 import { bindInheritedRuntimeWriteClaimFromEnvironment } from '../../root/write-fence';

package/src/runtime/gateway/mcp/execution-tools.ts

@@ -1,207 +1,2 @@
-import { existsSync, readFileSync } from 'fs';
-import type { McpToolDefinition, CallToolResult } from '../../../cli/mcp/tools';
-import type { MultiRepositoryMcpToolContext } from '../../../cli/mcp/multi-repository';
-import { repositoryGitStatus, repositoryGitDiff } from '../../../cli/repositories/structured-git';
-import { listControllerChecks } from '../../../cli/controller/check-runner';
-import { buildWorkContinuationSnapshot } from '../../control-plane/facade/work-continuation';
-import { currentControllerInstanceId, startExecutionSession, type ExecutionSessionContext } from '../../control-plane/execution/session-store';
-import { currentPermissionSnapshotVersion, validateWorkHandle } from '../../control-plane/execution/validation';
-import { resolveAuthorizationRequest } from '../../control-plane/governance/authorization';
-import { readControllerResult, searchControllerResult } from '../../evidence/result-store';
-import { resumeExecutionJobAfterApproval } from '../../execution/jobs/store';
-import { recordMcpTiming, type McpTimingTrace } from '../../diagnostics/mcp-timing';
-import { compactHandle, contractFor, identityFor, makeBoundedWorkResult, principalFor, requireSession, workForSession } from '../../control-plane/execution/work-execution-support';
-import { finalizeWork } from '../../control-plane/execution/work-finalization-service';
-import { bindSessionRepository, prepareWork } from '../../control-plane/execution/work-preparation-service';
-import { executeWork, validateWork } from '../../control-plane/execution/work-operation-service';
-
-
-// Compatibility exports: implementation authority lives in control-plane execution.
-export {
-  inspectWorkTargetAdvance,
-  targetAdvanceLinearMergeCommits,
-  planTargetAdvanceValidationAuthority,
-  targetAdvanceWorkScopeViolation,
-  inspectDirectTargetDelivery,
-  inspectTargetDirtyWorkOwnership,
-  inspectDirectCanonicalTargetAdvanceReconciliation,
-  completionReceiptChangedPaths,
-  inspectCleanupOnlyMergedHead,
-  resetFinalizationStagesForRequest,
-} from '../../control-plane/execution/work-finalization-service';
-export { releasePreparedWorkOwnership } from '../../control-plane/execution/work-execution-support';
-export { selectDefaultWorkValidationChecks } from '../../control-plane/execution/work-operation-service';
-export type {
-  DirectCanonicalTargetAdvanceInspection,
-  DirectTargetDeliveryInspection,
-  TargetAdvanceValidationTransferPlan,
-  TargetDirtyWorkOwnershipInspection,
-  WorkTargetAdvanceInspection,
-} from '../../control-plane/execution/work-finalization-service';
-
-function definition(name: string, description: string, properties: Record<string, unknown>, required: string[] = [], readOnlyHint = false, destructiveHint = false): McpToolDefinition {
-  return { name, description, inputSchema: { type: 'object', properties, ...(required.length ? { required } : {}), additionalProperties: false }, annotations: { readOnlyHint, openWorldHint: false, destructiveHint } };
-}
-
-const sessionId = { type: 'string', description: 'Controller-issued session id returned by session_start. Omit only when the MCP transport binds one.' };
-const workId = { type: 'string', description: 'Controller-owned work handle id returned by work_prepare.' };
-const repoId = { type: 'string', description: 'Stable repository id. Repository switching must be explicit through session_bind_repository.' };
-
-export const executionToolDefinitions: McpToolDefinition[] = [
-  definition('session_start', 'Start or resume a controller-owned MCP execution session. Identity comes from the authenticated/controller-issued transport context.', {}, [], false),
-  definition('session_bind_repository', 'Explicitly bind the current session to one registered repository and checkout.', { session_id: sessionId, repo_id: repoId, checkout_id: { type: 'string' } }, ['repo_id'], false),
-  definition('work_prepare', 'Prepare or reuse one controller-owned work handle and bind it to a WorkContract, checkout, branch, and permission snapshot.', {
-    session_id: sessionId, repo_id: repoId, checkout_id: { type: 'string' }, work_id: workId,
-    objective: { type: 'string' }, goal_id: { type: 'string' }, acceptance_criteria: { type: 'array', items: { type: 'string' } }, allowed_paths: { type: 'array', items: { type: 'string' } }, checks: { type: 'array', items: { type: 'string' } },
-    isolation: { type: 'string', enum: ['reuse', 'new_worktree', 'auto'] }, base_ref: { type: 'string' }, needs_dependencies: { type: 'boolean' },
-    expected_previous_head: { type: 'string', description: 'Explicit prior WorkHandle HEAD required for audited successor adoption of an existing work_id.' },
-    adopt_candidate_head: { type: 'string', description: 'Explicit current successor commit to adopt after exact identity, ownership, cleanliness, ancestry, and path-scope validation.' },
-  }, [], false),
-  definition('work_inspect', 'Collect bounded Git, WorkContract, path, check, and readiness evidence through one work handle.', { session_id: sessionId, repo_id: repoId, work_id: workId, detail: { type: 'string', enum: ['summary', 'detail'] } }, ['work_id'], true),
-  definition('work_execute', 'Execute approved, repository-scoped commands against a validated work handle while preserving the existing command policy and audit path.', {
-    session_id: sessionId, controller_id: { type: 'string', description: 'Controller identity that holds the Work lease. Defaults to the authenticated principal.' }, repo_id: repoId, work_id: workId,
-    command: { anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1 }] }, approval_token: { type: 'string' }, cwd: { type: 'string' }, timeout_ms: { type: 'number' }, max_output_bytes: { type: 'number' },
-    commands: { type: 'array', items: { type: 'object' } }, approval_request_id: { type: 'string' },
-  }, ['work_id'], false),
-  definition('work_validate', 'Run targeted checks or read-only validation commands against a work handle with full current-state validation.', {
-    session_id: sessionId, controller_id: { type: 'string', description: 'Controller identity that holds the Work lease. Defaults to the authenticated principal.' }, repo_id: repoId, work_id: workId, check_ids: { type: 'array', items: { type: 'string' } }, commands: { type: 'array', items: { type: 'object' } },
-  }, ['work_id'], false),
-  definition('work_finalize', 'Idempotently validate, commit, merge, clean a managed worktree, and complete the existing WorkContract in independently recorded stages.', {
-    session_id: sessionId, controller_id: { type: 'string', description: 'Controller identity that holds the Work lease. Defaults to the authenticated principal.' }, repo_id: repoId, work_id: workId, commit: { type: 'boolean' }, message: { type: 'string' }, merge: { type: 'boolean' }, target_branch: { type: 'string' }, remote_write: { type: 'boolean', description: 'When true, push the exact locally integrated target revision to origin before cleanup and Work terminalization.' }, delete_branch: { type: 'boolean' }, cleanup: { type: 'boolean' }, no_ff: { type: 'boolean' }, approval_request_id: { type: 'string' },
-    completion_outcome: { type: 'string', enum: ['completed_changed', 'completed_no_change'] }, no_change_evidence: { type: 'string', description: 'Objective-specific proof that the requested state already holds; required for completed_no_change.' },
-  }, ['work_id'], false, true),
-  definition('approval_resolve', 'Resolve a controller approval request from the current conversation; GUI approval is optional and not required for continuation.', { session_id: sessionId, repo_id: repoId, work_id: workId, approval_request_id: { type: 'string' }, confirm_authorization: { type: 'boolean' } }, ['approval_request_id', 'confirm_authorization'], false),
-  definition('result_read', 'Read a session-scoped result reference with bounded pagination.', { session_id: sessionId, result_ref: { type: 'string' }, work_id: workId, cursor: { type: 'number' }, limit: { type: 'number' } }, ['result_ref'], true),
-  definition('result_search', 'Search a session-scoped result reference without returning the full payload.', { session_id: sessionId, result_ref: { type: 'string' }, work_id: workId, query: { type: 'string' }, limit: { type: 'number' } }, ['result_ref', 'query'], true),
-];
-
-const executionToolNames = new Set(executionToolDefinitions.map((tool) => tool.name));
-
-/**
- * Work mutation tool names remain grouped for compatibility with older Worker
- * entrypoints. On the public MCP surface they execute directly through
- * WorkContract + Process Runtime ownership rather than durable ExecutionJobs.
- */
-const DURABLE_WORK_OPERATION_NAMES = new Set([
-  'work_execute',
-  'work_validate',
-  'work_finalize',
-]);
-
-export function isDurableWorkOperation(name: string): boolean {
-  return DURABLE_WORK_OPERATION_NAMES.has(name);
-}
-
-function result(value: Record<string, unknown>, isError = false): CallToolResult {
-  return { content: [{ type: 'text', text: JSON.stringify(value, null, 2) }], structuredContent: value, ...(isError ? { isError: true } : {}) };
-}
-
-function failure(error: unknown): CallToolResult {
-  const message = error instanceof Error ? error.message : String(error);
-  const code = message.includes(':') ? message.slice(0, message.indexOf(':')) : 'EXECUTION_TOOL_FAILED';
-  return result({ error: { code, message } }, true);
-}
-
-function startOrResumeSession(ctx: MultiRepositoryMcpToolContext): ExecutionSessionContext {
-  const permissionVersion = ctx.explicitRepository ? currentPermissionSnapshotVersion(ctx.controllerHome, ctx.explicitRepository.repoId) : 0;
-  return startExecutionSession(ctx.controllerHome, {
-    sessionId: ctx.sessionId,
-    principalId: principalFor(ctx),
-    controllerInstanceId: ctx.controllerInstanceId ?? currentControllerInstanceId(),
-    permissionSnapshotVersion: permissionVersion,
-    capabilitySnapshotVersion: 1,
-  });
-}
-
-function inspectWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): Record<string, unknown> {
-  const session = requireSession(ctx, args);
-  // work_inspect is authorized read-only evidence; it must not require the write lease.
-  const handle = workForSession(ctx, session, args);
-  const started = performance.now();
-  const validationStarted = performance.now();
-  const validated = validateWorkHandle(ctx.controllerHome, handle, identityFor(ctx, args), 'cheap', 'inspect');
-  const validationMs = performance.now() - validationStarted;
-  const status = repositoryGitStatus(validated.worktreeRepository);
-  const diff = repositoryGitDiff(validated.worktreeRepository, { maxBytes: 64 * 1024 });
-  const contract = contractFor(ctx, handle);
-  const checks = contract?.checks ?? [];
-  const packageManifest = existsSync(`${validated.worktreeRepository.canonicalRoot}/package.json`)
-    ? JSON.parse(readFileSync(`${validated.worktreeRepository.canonicalRoot}/package.json`, 'utf-8')) as Record<string, unknown>
-    : undefined;
-  const value = {
-    session: { sessionId: session.sessionId, repoId: session.activeRepositoryId, checkoutId: session.activeCheckoutId },
-    work: compactHandle(handle),
-    readiness: { valid: true, warnings: validated.warnings, permissionSnapshotVersion: handle.permissionSnapshotVersion },
-    git: { status, diff: { nameOnly: diff.nameOnly, stat: diff.stat, patch: diff.patch, truncated: diff.truncated } },
-    workContract: contract ? {
-      workId: contract.workId,
-      status: contract.status,
-      objective: contract.objective,
-      checks: contract.checks,
-      acceptanceCriteria: contract.acceptanceCriteria,
-      allowedPaths: contract.allowedPaths,
-      semantics: buildWorkContinuationSnapshot(contract).semantics,
-    } : undefined,
-    continuation: contract ? buildWorkContinuationSnapshot(contract) : undefined,
-    paths: { allowed: handle.workContractId ? contract?.allowedPaths ?? [] : [], relevant: diff.nameOnly },
-    checks: checks.map((checkId) => ({ checkId, registered: listControllerChecks(validated.worktreeRepository.canonicalRoot).some((check) => check.id === checkId) })),
-    package: packageManifest ? { name: packageManifest.name, scripts: packageManifest.scripts } : undefined,
-  };
-  const response = makeBoundedWorkResult(ctx, session, handle.repositoryId, handle.workId, 'inspection', value);
-  const trace: McpTimingTrace = { tool: 'work_inspect', sessionResolutionMs: 0, repositoryResolutionMs: 0, workHandleValidationMs: Math.round(validationMs * 100) / 100, resultSerializationMs: 0, totalToolDurationMs: Math.round((performance.now() - started) * 100) / 100, sessionId: session.sessionId, repoId: handle.repositoryId, workId: handle.workId };
-  recordMcpTiming(ctx.controllerHome, trace);
-  return response;
-}
-
-export async function callExecutionTool(ctx: MultiRepositoryMcpToolContext, name: string, args: Record<string, unknown>): Promise<CallToolResult | undefined> {
-  if (!executionToolNames.has(name)) return undefined;
-  try {
-    switch (name) {
-      case 'session_start': {
-        const session = startOrResumeSession(ctx);
-        return result({ session: { sessionId: session.sessionId, principalId: session.principalId, activeRepositoryId: session.activeRepositoryId, activeCheckoutId: session.activeCheckoutId, activeWorkId: session.activeWorkId, permissionSnapshotVersion: session.permissionSnapshotVersion, capabilitySnapshotVersion: session.capabilitySnapshotVersion, controllerInstanceId: session.controllerInstanceId, createdAt: session.createdAt, updatedAt: session.updatedAt } });
-      }
-      case 'session_bind_repository': return result(bindSessionRepository(ctx, args));
-      case 'work_prepare': return result(prepareWork(ctx, args));
-      case 'work_inspect': return result(inspectWork(ctx, args));
-      case 'work_execute': return result(await executeWork(ctx, args));
-      case 'work_validate': return result(await validateWork(ctx, args));
-      case 'work_finalize': return result(await finalizeWork(ctx, args));
-      case 'approval_resolve': {
-        const session = requireSession(ctx, args);
-        const repositoryId = typeof args.repo_id === 'string' && args.repo_id.trim() ? args.repo_id.trim() : session.activeRepositoryId;
-        if (!repositoryId) throw new Error('SESSION_REPOSITORY_REQUIRED: bind a repository before resolving approval');
-        const resolved = resolveAuthorizationRequest({
-          controllerHome: ctx.controllerHome,
-          repositoryId,
-          approvalRequestId: String(args.approval_request_id ?? ''),
-          sessionId: session.sessionId,
-          principalId: session.principalId,
-          workId: typeof args.work_id === 'string' ? args.work_id : session.activeWorkId,
-          permissionSnapshotVersion: currentPermissionSnapshotVersion(ctx.controllerHome, repositoryId),
-          confirm: args.confirm_authorization === true,
-        });
-        const resumed = resumeExecutionJobAfterApproval(ctx.controllerHome, repositoryId, resolved.approvalRequestId);
-        return result({
-          authorization: { decision: 'allow', source: 'user_confirmation', reason: 'User confirmation was recorded for the exact pending operation.' },
-          approval: resolved,
-          resumedJob: resumed ? { jobId: resumed.jobId, status: resumed.status, requestId: resumed.requestId } : undefined,
-          continuation: resumed
-            ? `The original durable Job ${resumed.jobId} was resumed with the resolved approval request.`
-            : `Retry the original operation with approval_request_id=${resolved.approvalRequestId}.`,
-        });
-      }
-      case 'result_read': {
-        const session = requireSession(ctx, args);
-        return result(readControllerResult({ controllerHome: ctx.controllerHome, resultRef: String(args.result_ref ?? ''), sessionId: session.sessionId, principalId: session.principalId, workId: typeof args.work_id === 'string' ? args.work_id : undefined, cursor: typeof args.cursor === 'number' ? args.cursor : undefined, limit: typeof args.limit === 'number' ? args.limit : undefined }));
-      }
-      case 'result_search': {
-        const session = requireSession(ctx, args);
-        return result(searchControllerResult({ controllerHome: ctx.controllerHome, resultRef: String(args.result_ref ?? ''), sessionId: session.sessionId, principalId: session.principalId, workId: typeof args.work_id === 'string' ? args.work_id : undefined, query: String(args.query ?? ''), limit: typeof args.limit === 'number' ? args.limit : undefined }));
-      }
-      default: return undefined;
-    }
-  } catch (error) {
-    return failure(error);
-  }
-}
+/** @deprecated Kernel V2 compatibility shim. MCP gateway mapping authority lives in adapters/mcp. */
+export * from '../../../../adapters/mcp/runtime-gateway/execution-tools';

package/src/runtime/gateway/mcp/legacy-ios-tool-adapter.ts

@@ -1,61 +1,2 @@
-/**
- * Compatibility translation only: legacy iOS MCP tool names are normalized to
- * the canonical typed iOS plugin action surface. This module owns no runtime,
- * repository, Work, approval, or plugin execution state.
- */
-export interface LegacyIosPluginInvocation {
-  actionId: string;
-  requestId: string;
-  arguments: Record<string, unknown>;
-  confirmAuthorization: boolean;
-}
-
-function definedArguments(value: Record<string, unknown>): Record<string, unknown> {
-  return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
-}
-
-function optionalString(args: Record<string, unknown>, key: string): string | undefined {
-  return typeof args[key] === 'string' ? args[key] as string : undefined;
-}
-
-function optionalNumber(args: Record<string, unknown>, key: string): number | undefined {
-  return typeof args[key] === 'number' ? args[key] as number : undefined;
-}
-
-export function legacyIosPluginInvocation(
-  legacyTool: string,
-  args: Record<string, unknown>,
-): LegacyIosPluginInvocation | undefined {
-  const invocation = (() => {
-    switch (legacyTool) {
-      case 'ios_xcode_status':
-        return { actionId: 'xcode_status', arguments: {} };
-      case 'ios_simulators_list':
-        return { actionId: 'list_simulators', arguments: { runtime: optionalString(args, 'runtime'), name: optionalString(args, 'name') } };
-      case 'ios_project_discover':
-        return { actionId: 'discover_project', arguments: {} };
-      case 'ios_schemes_list':
-        return { actionId: 'list_schemes', arguments: { workspace: optionalString(args, 'workspace'), project: optionalString(args, 'project') } };
-      case 'ios_simulator_boot':
-        return { actionId: 'launch_simulator', arguments: { udid: String(args.udid ?? '').trim(), open_simulator: args.open_simulator !== false, timeout_ms: optionalNumber(args, 'timeout_ms') } };
-      case 'ios_app_build':
-        return { actionId: 'build', arguments: { scheme: String(args.scheme ?? '').trim(), udid: optionalString(args, 'udid'), simulator_name: optionalString(args, 'simulator_name'), workspace: optionalString(args, 'workspace'), project: optionalString(args, 'project'), configuration: optionalString(args, 'configuration'), timeout_ms: optionalNumber(args, 'timeout_ms') } };
-      case 'ios_simulator_screenshot':
-        return { actionId: 'capture_screenshot', arguments: { udid: String(args.udid ?? '').trim(), label: optionalString(args, 'label') } };
-      case 'ios_ui_smoke_test':
-        return { actionId: 'smoke_review', arguments: { scheme: optionalString(args, 'scheme'), bundle_id: optionalString(args, 'bundle_id'), udid: optionalString(args, 'udid'), simulator_name: optionalString(args, 'simulator_name'), workspace: optionalString(args, 'workspace'), project: optionalString(args, 'project'), configuration: optionalString(args, 'configuration'), app_path: optionalString(args, 'app_path'), screenshot_label: optionalString(args, 'screenshot_label') } };
-      default:
-        return undefined;
-    }
-  })();
-  if (!invocation) return undefined;
-  const requestId = typeof args.request_id === 'string' && args.request_id.trim()
-    ? args.request_id.trim()
-    : `legacy-${legacyTool}-${Date.now()}`;
-  return {
-    actionId: invocation.actionId,
-    requestId,
-    arguments: definedArguments(invocation.arguments),
-    confirmAuthorization: args.confirm_authorization === true,
-  };
-}
+/** @deprecated Kernel V2 compatibility shim. MCP gateway mapping authority lives in adapters/mcp. */
+export * from '../../../../adapters/mcp/runtime-gateway/legacy-ios-tool-adapter';

package/src/runtime/gateway/mcp/persisted-check-process.ts

@@ -1,3 +1,2 @@
-// Compatibility import path. Persisted check execution belongs to Process Runtime
-// so Scheduler reconciliation can advance validation without depending on Gateway.
-export * from '../../execution/process-runtime/persisted-check';
+/** @deprecated Kernel V2 compatibility shim. MCP gateway mapping authority lives in adapters/mcp. */
+export * from '../../../../adapters/mcp/runtime-gateway/persisted-check-process';