@moretea-labs/forge 1.7.2 → 1.8.1

package/src/runtime/root/runtime.ts

@@ -1,11 +1,15 @@
 import { randomUUID } from 'crypto';
 import { statSync } from 'fs';
-import { dirname } from 'path';
-import { Client } from '@modelcontextprotocol/sdk/client/index.js';
-import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { writeJsonAtomic } from '../shared/json-files';
+import { ensureForgeInstanceIdentity } from '../../../packages/kernel/identity/api/index';
+import { dirname, join } from 'path';
+import { Client, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
 import type { ControlPlaneDatabaseInspection } from '../control-plane/persistence/sqlite-store';
-import { inspectControlPlaneDatabase } from '../control-plane/persistence/sqlite-store';
-import { activateExclusiveWorkAdmission } from '../control-plane/facade/work-admission-policy';
+import {
+  disableControlPlaneReadConnectionReuse,
+  enableControlPlaneReadConnectionReuse,
+  inspectControlPlaneDatabase,
+} from '../control-plane/persistence/sqlite-store';
 import { closeCodeGraphReadProviderSessions } from '../context/codegraph-read-provider';
 import { cancelAllLightweightProcesses } from '../execution/process-runtime/lightweight-managed';
 import {
@@ -17,27 +21,41 @@ import { createRuntimeGatewayServer, runtimeGatewayToolSurfaceFingerprint } from
 import { startRuntimeMcpTransport, type RuntimeMcpTransportHandle } from './mcp-transport';
 import { acquireRuntimeOwnership, type RuntimeOwnershipHandle } from './ownership';
 import { RuntimeReadinessState } from './readiness';
-import { loadRuntimeReleaseManifest } from './release-manifest';
-import { ensureActiveRuntimeRelease, type RuntimeReleaseAuthority } from './release-store';
+import { loadRuntimeReleaseManifest, requireCompleteCompiledRuntimeReleaseManifest } from './release-manifest';
+import { ensureActiveRuntimeRelease, readRuntimeReleaseAuthority, type RuntimeReleaseAuthority } from './release-store';
+import { migrateReleaseDurableState } from '../release/release-state-migration';
 import { bindRuntimeWriteClaim, clearRuntimeWriteClaim } from './write-fence';
 import { startInProcessScheduler, type RuntimeSchedulerHandle } from './scheduler';
 import { startConfiguredRuntimeLocalBridge, type RuntimeLocalBridgeHandle } from './local-bridge';
-import { removeRuntimeStatusSnapshot, writeRuntimeStatusSnapshot } from './status';
+import { startActiveExecutionPowerAssertion, type RuntimePowerAssertionHandle } from './active-execution-power-assertion';
+import { startWorkflowSupervisorRuntime, type RuntimeWorkflowSupervisorHandle } from './workflow-supervisor-runtime';
+import { normalizeRuntimeDeploymentTopology, type RuntimeDeploymentTopology } from './deployment-topology';
+import { removeRuntimeStartupFailureEvidence, removeRuntimeStatusSnapshot, writeRuntimeStartupFailureEvidence, writeRuntimeStatusSnapshot } from './status';
 import type {
   CanonicalRuntimeConfig,
+  CanonicalRuntimeStatusSnapshot,
   RuntimeExitEvidence,
   RuntimeReadiness,
   RuntimeReleaseManifest,
 } from './types';
 
+export interface RuntimeReleaseAuthorityMonitor {
+  stop(): void;
+}
+
 export interface CanonicalRuntimeDependencies {
   loadReleaseManifest(path: string, controllerHome: string): RuntimeReleaseManifest;
+  migrateReleaseState(controllerHome: string): void;
   ensureReleaseAuthority(controllerHome: string, manifestPath: string): RuntimeReleaseAuthority;
+  readReleaseAuthority(controllerHome: string): RuntimeReleaseAuthority | undefined;
+  startReleaseAuthorityMonitor(observe: () => void): RuntimeReleaseAuthorityMonitor;
   bindWriteClaim(input: { controllerHome: string; owner: RuntimeOwnershipHandle['record']; authority: RuntimeReleaseAuthority }): void;
   acquireOwnership(controllerHome: string, runtimeInstanceId: string): RuntimeOwnershipHandle;
   inspectDatabase(controllerHome: string): ControlPlaneDatabaseInspection;
-  startScheduler(controllerHome: string, timeoutMs?: number): RuntimeSchedulerHandle;
-  startLocalBridge(input: { controllerHome: string; repositoryRoot: string }): Promise<RuntimeLocalBridgeHandle | undefined>;
+  startScheduler(input: Parameters<typeof startInProcessScheduler>[0]): RuntimeSchedulerHandle;
+  startLocalBridge(input: { controllerHome: string; repositoryRoot?: string }): Promise<RuntimeLocalBridgeHandle | undefined>;
+  startPowerAssertion(input: { controllerHome: string; runtimePid: number }): RuntimePowerAssertionHandle;
+  startWorkflowSupervisor(controllerHome: string, options?: { nativeBrowserAdapter?: boolean }): Promise<RuntimeWorkflowSupervisorHandle>;
   startTransport(options: Parameters<typeof startRuntimeMcpTransport>[0]): Promise<RuntimeMcpTransportHandle>;
   runMcpProbe(endpoint: string, authToken: string): Promise<void>;
   collectRuntimeSourceIdentity: typeof collectRuntimeSourceIdentity;
@@ -45,6 +63,21 @@ export interface CanonicalRuntimeDependencies {
   stopLightweightProcesses(controllerHome: string): Promise<number>;
   stopContextReadHelpers(): Promise<void>;
   computeToolSurfaceFingerprint: typeof runtimeGatewayToolSurfaceFingerprint;
+  ensureForgeInstanceIdentity: typeof ensureForgeInstanceIdentity;
+  captureJscSamplingProfile(options: { durationMs: number; sampleIntervalUs: number }): Promise<{
+    requestedDurationMs: number;
+    elapsedMs: number;
+    sampleIntervalUs: number;
+    functions: string;
+    bytecodes: string;
+    stackTraces: {
+      interval: number | null;
+      totalTraceCount: number;
+      retainedTraceCount: number;
+      traces: Array<{ timestamp: number | null; frames: Array<Record<string, unknown>> }>;
+      sources: Array<Record<string, unknown>>;
+    };
+  }>;
 }
 
 async function defaultMcpProbe(endpoint: string, authToken: string): Promise<void> {
@@ -70,14 +103,94 @@ async function defaultMcpProbe(endpoint: string, authToken: string): Promise<voi
   }
 }
 
+const DEFAULT_RELEASE_AUTHORITY_MONITOR_INTERVAL_MS = 1_000;
+const JSC_SAMPLING_DURATION_MS = 2_000;
+const JSC_SAMPLING_INTERVAL_US = 1_000;
+const JSC_SAMPLING_TRACE_LIMIT = 2_000;
+const JSC_SAMPLING_FRAME_LIMIT = 32;
+const JSC_SAMPLING_SOURCE_LIMIT = 512;
+const JSC_SAMPLING_REPORT_CHAR_LIMIT = 128 * 1024;
+
+function startDefaultReleaseAuthorityMonitor(observe: () => void): RuntimeReleaseAuthorityMonitor {
+  const timer = setInterval(observe, DEFAULT_RELEASE_AUTHORITY_MONITOR_INTERVAL_MS);
+  timer.unref?.();
+  return { stop: () => clearInterval(timer) };
+}
+
+async function captureDefaultJscSamplingProfile(options: { durationMs: number; sampleIntervalUs: number }): Promise<{
+  requestedDurationMs: number;
+  elapsedMs: number;
+  sampleIntervalUs: number;
+  functions: string;
+  bytecodes: string;
+  stackTraces: {
+    interval: number | null;
+    totalTraceCount: number;
+    retainedTraceCount: number;
+    traces: Array<{ timestamp: number | null; frames: Array<Record<string, unknown>> }>;
+    sources: Array<Record<string, unknown>>;
+  };
+}> {
+  const { profile } = await import('bun:jsc');
+  const startedAt = performance.now();
+  const sampling = await profile(
+    () => new Promise<void>((resolve) => setTimeout(resolve, options.durationMs)),
+    options.sampleIntervalUs,
+  );
+  // Bun's current runtime returns an object here even though bun-types still
+  // declares SamplingProfile.stackTraces as string[]. Treat the runtime value
+  // as diagnostic input and normalize it defensively instead of trusting that
+  // stale declaration at the production boundary.
+  const rawStackTraces = sampling.stackTraces as unknown as {
+    interval?: unknown;
+    traces?: unknown;
+    sources?: unknown;
+  };
+  const rawTraces = Array.isArray(rawStackTraces?.traces) ? rawStackTraces.traces : [];
+  const traces = rawTraces.slice(-JSC_SAMPLING_TRACE_LIMIT).map((trace) => {
+    const record = trace && typeof trace === 'object' && !Array.isArray(trace)
+      ? trace as Record<string, unknown>
+      : {};
+    const frames = Array.isArray(record.frames)
+      ? record.frames.filter((frame): frame is Record<string, unknown> => Boolean(frame) && typeof frame === 'object' && !Array.isArray(frame)).slice(0, JSC_SAMPLING_FRAME_LIMIT)
+      : [];
+    return {
+      timestamp: typeof record.timestamp === 'number' ? record.timestamp : null,
+      frames,
+    };
+  });
+  const sources = Array.isArray(rawStackTraces?.sources)
+    ? rawStackTraces.sources.filter((source): source is Record<string, unknown> => Boolean(source) && typeof source === 'object' && !Array.isArray(source)).slice(0, JSC_SAMPLING_SOURCE_LIMIT)
+    : [];
+  return {
+    requestedDurationMs: options.durationMs,
+    elapsedMs: Math.max(0, performance.now() - startedAt),
+    sampleIntervalUs: options.sampleIntervalUs,
+    functions: sampling.functions.slice(0, JSC_SAMPLING_REPORT_CHAR_LIMIT),
+    bytecodes: sampling.bytecodes.slice(0, JSC_SAMPLING_REPORT_CHAR_LIMIT),
+    stackTraces: {
+      interval: typeof rawStackTraces?.interval === 'number' ? rawStackTraces.interval : null,
+      totalTraceCount: rawTraces.length,
+      retainedTraceCount: traces.length,
+      traces,
+      sources,
+    },
+  };
+}
+
 const DEFAULT_DEPENDENCIES: CanonicalRuntimeDependencies = {
   loadReleaseManifest: loadRuntimeReleaseManifest,
+  migrateReleaseState: migrateReleaseDurableState,
   ensureReleaseAuthority: ensureActiveRuntimeRelease,
+  readReleaseAuthority: readRuntimeReleaseAuthority,
+  startReleaseAuthorityMonitor: startDefaultReleaseAuthorityMonitor,
   bindWriteClaim: (input) => { bindRuntimeWriteClaim(input); },
   acquireOwnership: acquireRuntimeOwnership,
   inspectDatabase: inspectControlPlaneDatabase,
   startScheduler: startInProcessScheduler,
   startLocalBridge: startConfiguredRuntimeLocalBridge,
+  startPowerAssertion: startActiveExecutionPowerAssertion,
+  startWorkflowSupervisor: startWorkflowSupervisorRuntime,
   startTransport: startRuntimeMcpTransport,
   runMcpProbe: defaultMcpProbe,
   collectRuntimeSourceIdentity,
@@ -85,24 +198,35 @@ const DEFAULT_DEPENDENCIES: CanonicalRuntimeDependencies = {
   stopLightweightProcesses: cancelAllLightweightProcesses,
   stopContextReadHelpers: closeCodeGraphReadProviderSessions,
   computeToolSurfaceFingerprint: runtimeGatewayToolSurfaceFingerprint,
+  ensureForgeInstanceIdentity,
+  captureJscSamplingProfile: captureDefaultJscSamplingProfile,
 };
 
 export class CanonicalForgeRuntime {
+  readonly forgeInstanceId: string;
   readonly runtimeInstanceId: string;
+  readonly topology: RuntimeDeploymentTopology;
   private readonly readinessState = new RuntimeReadinessState();
   private readonly dependencies: CanonicalRuntimeDependencies;
   private ownership?: RuntimeOwnershipHandle;
   private scheduler?: RuntimeSchedulerHandle;
   private localBridge?: RuntimeLocalBridgeHandle;
+  private powerAssertion?: RuntimePowerAssertionHandle;
+  private workflowSupervisor?: RuntimeWorkflowSupervisorHandle;
   private toolSurfaceFingerprint?: string;
   private transport?: RuntimeMcpTransportHandle;
   private controller?: RuntimeControllerServices;
   private release?: RuntimeReleaseManifest;
+  private releaseAuthorityMonitor?: RuntimeReleaseAuthorityMonitor;
   private stopPromise?: Promise<void>;
   private stoppedResolve!: () => void;
   private readonly stopped = new Promise<void>((resolve) => { this.stoppedResolve = resolve; });
   private started = false;
   private stopping = false;
+  private jscHeapDiagnosticsSignalHandler?: () => void;
+  private jscHeapDiagnosticsCaptureInFlight = false;
+  private jscSamplingProfilerSignalHandler?: () => void;
+  private jscSamplingProfileCaptureInFlight = false;
   lastExit?: RuntimeExitEvidence;
 
   constructor(
@@ -110,13 +234,15 @@ export class CanonicalForgeRuntime {
     dependencies: Partial<CanonicalRuntimeDependencies> = {},
   ) {
     this.runtimeInstanceId = config.runtimeInstanceId?.trim() || `runtime_${randomUUID().replaceAll('-', '')}`;
+    this.topology = normalizeRuntimeDeploymentTopology(config.topology);
     this.dependencies = { ...DEFAULT_DEPENDENCIES, ...dependencies };
     if (!config.controllerHome.trim()) throw new Error('RUNTIME_CONFIG_REQUIRED: controllerHome');
-    if (!config.repositoryRoot.trim()) throw new Error('RUNTIME_CONFIG_REQUIRED: repositoryRoot');
-    try {
-      if (!statSync(config.repositoryRoot).isDirectory()) throw new Error('not a directory');
-    } catch {
-      throw new Error('RUNTIME_CONFIG_INVALID: repositoryRoot must be an existing directory');
+    if (config.repositoryRoot?.trim()) {
+      try {
+        if (!statSync(config.repositoryRoot).isDirectory()) throw new Error('not a directory');
+      } catch {
+        throw new Error('RUNTIME_CONFIG_INVALID: repositoryRoot must be an existing directory');
+      }
     }
     if (!config.releaseManifestPath.trim()) throw new Error('RUNTIME_CONFIG_REQUIRED: releaseManifestPath');
     if (!config.host.trim()) throw new Error('RUNTIME_CONFIG_REQUIRED: host');
@@ -124,17 +250,136 @@ export class CanonicalForgeRuntime {
       throw new Error('RUNTIME_CONFIG_INVALID: port');
     }
     if (!config.authToken.trim()) throw new Error('RUNTIME_CONFIG_REQUIRED: authToken');
+    this.forgeInstanceId = this.dependencies.ensureForgeInstanceIdentity({
+      controllerHome: config.controllerHome,
+      preferredInstanceId: process.env.FORGE_INSTANCE_ID?.trim(),
+    }).instanceId;
   }
 
   readiness(): RuntimeReadiness {
     return this.readinessState.snapshot();
   }
 
+  private installJscHeapDiagnosticsSignal(): void {
+    if (process.platform === 'win32' || this.jscHeapDiagnosticsSignalHandler) return;
+    const handler = () => {
+      if (this.jscHeapDiagnosticsCaptureInFlight) return;
+      this.jscHeapDiagnosticsCaptureInFlight = true;
+      void import('bun:jsc').then(({ fullGC, heapStats, memoryUsage }) => {
+        const gcStartedAt = performance.now();
+        const fullGcResult = fullGC();
+        const fullGcDurationMs = Math.max(0, performance.now() - gcStartedAt);
+        const heap = heapStats();
+        const topTypes = (counts: Record<string, number>, limit: number) => Object.entries(counts)
+          .sort((left, right) => right[1] - left[1])
+          .slice(0, limit)
+          .map(([type, count]) => ({ type, count }));
+        writeJsonAtomic(join(this.config.controllerHome, 'diagnostics', 'jsc-heap.json'), {
+          schemaVersion: 1,
+          capturedAt: new Date().toISOString(),
+          pid: process.pid,
+          runtimeInstanceId: this.runtimeInstanceId,
+          releaseId: this.release?.releaseId,
+          gc: {
+            forced: true,
+            kind: 'full',
+            durationMs: fullGcDurationMs,
+            result: fullGcResult,
+          },
+          heap: {
+            heapSize: heap.heapSize,
+            heapCapacity: heap.heapCapacity,
+            extraMemorySize: heap.extraMemorySize,
+            objectCount: heap.objectCount,
+            protectedObjectCount: heap.protectedObjectCount,
+            globalObjectCount: heap.globalObjectCount,
+            protectedGlobalObjectCount: heap.protectedGlobalObjectCount,
+            objectTypeCount: Object.keys(heap.objectTypeCounts).length,
+            protectedObjectTypeCount: Object.keys(heap.protectedObjectTypeCounts).length,
+            topObjectTypes: topTypes(heap.objectTypeCounts, 100),
+            topProtectedObjectTypes: topTypes(heap.protectedObjectTypeCounts, 50),
+          },
+          memoryUsage: memoryUsage(),
+        });
+      }).catch((error) => {
+        process.stderr.write(`${JSON.stringify({
+          event: 'forge_runtime_jsc_heap_diagnostics_failed',
+          runtimeInstanceId: this.runtimeInstanceId,
+          message: error instanceof Error ? error.message : String(error),
+          observedAt: new Date().toISOString(),
+        })}\n`);
+      }).finally(() => {
+        this.jscHeapDiagnosticsCaptureInFlight = false;
+      });
+    };
+    process.on('SIGUSR2', handler);
+    this.jscHeapDiagnosticsSignalHandler = handler;
+  }
+
+  private removeJscHeapDiagnosticsSignal(): void {
+    const handler = this.jscHeapDiagnosticsSignalHandler;
+    if (!handler) return;
+    process.off('SIGUSR2', handler);
+    this.jscHeapDiagnosticsSignalHandler = undefined;
+  }
+
+  private installJscSamplingProfilerSignal(): void {
+    if (process.platform === 'win32' || this.jscSamplingProfilerSignalHandler) return;
+    const handler = () => {
+      if (this.jscSamplingProfileCaptureInFlight) return;
+      this.jscSamplingProfileCaptureInFlight = true;
+      void this.dependencies.captureJscSamplingProfile({
+        durationMs: JSC_SAMPLING_DURATION_MS,
+        sampleIntervalUs: JSC_SAMPLING_INTERVAL_US,
+      }).then((sampling) => {
+        const path = join(this.config.controllerHome, 'diagnostics', 'jsc-sampling-profile.json');
+        writeJsonAtomic(path, {
+          schemaVersion: 1,
+          capturedAt: new Date().toISOString(),
+          pid: process.pid,
+          runtimeInstanceId: this.runtimeInstanceId,
+          releaseId: this.release?.releaseId,
+          bounded: true,
+          ...sampling,
+        });
+        process.stderr.write(`${JSON.stringify({
+          event: 'forge_runtime_jsc_sampling_profile_captured',
+          runtimeInstanceId: this.runtimeInstanceId,
+          path,
+          requestedDurationMs: sampling.requestedDurationMs,
+          elapsedMs: sampling.elapsedMs,
+          sampleIntervalUs: sampling.sampleIntervalUs,
+          retainedTraceCount: sampling.stackTraces.retainedTraceCount,
+          observedAt: new Date().toISOString(),
+        })}\n`);
+      }).catch((error) => {
+        process.stderr.write(`${JSON.stringify({
+          event: 'forge_runtime_jsc_sampling_profile_failed',
+          runtimeInstanceId: this.runtimeInstanceId,
+          message: error instanceof Error ? error.message : String(error),
+          observedAt: new Date().toISOString(),
+        })}\n`);
+      }).finally(() => {
+        this.jscSamplingProfileCaptureInFlight = false;
+      });
+    };
+    process.on('SIGUSR1', handler);
+    this.jscSamplingProfilerSignalHandler = handler;
+  }
+
+  private removeJscSamplingProfilerSignal(): void {
+    const handler = this.jscSamplingProfilerSignalHandler;
+    if (!handler) return;
+    process.off('SIGUSR1', handler);
+    this.jscSamplingProfilerSignalHandler = undefined;
+  }
+
   private publishStatus(): void {
     if (!this.ownership || !this.release) return;
     try {
-      writeRuntimeStatusSnapshot(this.config.controllerHome, {
+      const snapshot: CanonicalRuntimeStatusSnapshot = {
         schemaVersion: 1,
+        forgeInstanceId: this.forgeInstanceId,
         runtimeInstanceId: this.runtimeInstanceId,
         pid: this.ownership.record.pid,
         releaseId: this.release.releaseId,
@@ -144,7 +389,8 @@ export class CanonicalForgeRuntime {
         readiness: this.readiness(),
         startedAt: this.ownership.record.acquiredAt,
         updatedAt: new Date().toISOString(),
-      });
+      };
+      writeRuntimeStatusSnapshot(this.config.controllerHome, snapshot);
     } catch {
       // Status is a read-only projection. Projection failure cannot become a
       // second Runtime readiness or lifecycle authority.
@@ -166,11 +412,40 @@ export class CanonicalForgeRuntime {
     return this.transport?.endpoint;
   }
 
+  private startReleaseAuthorityMonitor(): void {
+    const release = this.release;
+    if (!release || this.releaseAuthorityMonitor) return;
+    this.releaseAuthorityMonitor = this.dependencies.startReleaseAuthorityMonitor(() => {
+      if (this.stopping || this.lastExit) return;
+      let authority: RuntimeReleaseAuthority | undefined;
+      try {
+        authority = this.dependencies.readReleaseAuthority(this.config.controllerHome);
+      } catch {
+        // A read failure or ambiguous authority is not proof that this Runtime
+        // was superseded. Existing write fencing remains authoritative.
+        return;
+      }
+      if (!authority) return;
+      const active = authority.active;
+      if (
+        active.releaseId === release.releaseId
+        && active.artifactIdentity === release.artifactIdentity
+        && active.workerProtocolVersion === release.workerProtocolVersion
+      ) return;
+      const reasonCode = 'RUNTIME_RELEASE_SUPERSEDED';
+      this.readinessState.setDiagnostic('releaseCoherence', 'fail', reasonCode);
+      this.failCore(
+        reasonCode,
+        `Active Runtime release authority changed from ${release.releaseId}/${release.artifactIdentity} to ${active.releaseId}/${active.artifactIdentity}.`,
+      );
+    });
+  }
+
   async start(): Promise<void> {
     if (this.started) throw new Error('RUNTIME_ALREADY_STARTED');
     this.started = true;
     this.readinessState.markNotReady();
-    let stage: 'release' | 'ownership' | 'source' | 'database' | 'scheduler' | 'localBridge' | 'transport' | 'probe' = 'release';
+    let stage: 'release' | 'ownership' | 'source' | 'database' | 'supervisor' | 'scheduler' | 'localBridge' | 'transport' | 'probe' = 'release';
     try {
       this.release = this.dependencies.loadReleaseManifest(this.config.releaseManifestPath, this.config.controllerHome);
 
@@ -178,15 +453,30 @@ export class CanonicalForgeRuntime {
       this.ownership = this.dependencies.acquireOwnership(this.config.controllerHome, this.runtimeInstanceId);
 
       stage = 'release';
+      this.dependencies.migrateReleaseState(this.config.controllerHome);
       const releaseAuthority = this.dependencies.ensureReleaseAuthority(this.config.controllerHome, this.config.releaseManifestPath);
       stage = 'source';
-      // A materialized immutable release carries its frozen source identity in
-      // the release manifest and must snapshot that release directory. Source/
-      // fixture manifests without source identity keep the historical explicit
-      // repositoryRoot behavior so development-mode Runtime drift remains live.
-      const runtimeSourceRoot = this.release.sourceCommit && this.release.releaseRevision
+      // A compiled release is a closed execution surface. Fail before Scheduler
+      // composition if a stale/corrupt manifest omits any immutable component;
+      // standalone Runtime must never regain source/import.meta.url fallback.
+      if (this.release.executionMode === 'standalone-binary') {
+        requireCompleteCompiledRuntimeReleaseManifest(this.release);
+      }
+      // A materialized immutable release carries either a source revision or a
+      // package release revision and must snapshot that release directory.
+      // Source/fixture manifests without either identity keep the historical
+      // explicit repositoryRoot behavior so development-mode Runtime drift
+      // remains live.
+      const materializedRelease = Boolean(
+        this.release.releaseRevision
+        && (this.release.sourceCommit || this.release.releaseRevision.startsWith('package:')),
+      );
+      const runtimeSourceRoot = materializedRelease
         ? dirname(this.config.releaseManifestPath)
         : this.config.repositoryRoot;
+      if (!runtimeSourceRoot) {
+        throw new Error('RUNTIME_CONFIG_REQUIRED: repositoryRoot is required only for non-materialized development Runtime');
+      }
       const runtimeSource = this.dependencies.collectRuntimeSourceIdentity(runtimeSourceRoot);
       this.dependencies.rotateRuntimeGeneration(this.config.controllerHome, runtimeSource);
 
@@ -208,20 +498,41 @@ export class CanonicalForgeRuntime {
         this.dependencies.inspectDatabase,
       );
       this.controller.initialize();
+      // The Canonical Runtime is the only process that keeps a control-plane
+      // reader alive across operations. Writers remain short-lived WAL/CAS
+      // transactions, while CLI/tests/workers keep their existing close-on-read
+      // semantics.
+      enableControlPlaneReadConnectionReuse(this.config.controllerHome);
+      this.installJscHeapDiagnosticsSignal();
+      this.installJscSamplingProfilerSignal();
       this.readinessState.setDiagnostic('database', 'pass');
       this.publishStatus();
-      if (this.config.exclusiveWorkId) {
-        activateExclusiveWorkAdmission(this.config.controllerHome, {
-          allowedWorkId: this.config.exclusiveWorkId,
-          reason: 'P0 canonical single Runtime migration isolation',
+      if (this.topology.components.workflowSupervisor) {
+        stage = 'supervisor';
+        this.workflowSupervisor = await this.dependencies.startWorkflowSupervisor(this.config.controllerHome, {
+          nativeBrowserAdapter: this.topology.components.workflowSupervisorNativeBrowser,
         });
+        void this.workflowSupervisor.done.then(
+          () => this.failCore('WORKFLOW_SUPERVISOR_STOPPED', 'Workflow Supervisor stopped while Runtime was active.'),
+          (error) => this.failCore('WORKFLOW_SUPERVISOR_FAILED', error instanceof Error ? error.message : String(error)),
+        );
       }
 
       stage = 'scheduler';
-      this.scheduler = this.dependencies.startScheduler(
-        this.config.controllerHome,
-        this.config.schedulerReadyTimeoutMs,
-      );
+      const standaloneReleaseRoot = this.release.executionMode === 'standalone-binary'
+        ? dirname(this.config.releaseManifestPath)
+        : undefined;
+      this.scheduler = this.dependencies.startScheduler({
+        controllerHome: this.config.controllerHome,
+        readyTimeoutMs: this.config.schedulerReadyTimeoutMs,
+        runtimeSourceRoot: standaloneReleaseRoot ? undefined : runtimeSourceRoot,
+        workerExecutable: standaloneReleaseRoot && this.release.schedulerWorkerEntrypoint
+          ? join(standaloneReleaseRoot, this.release.schedulerWorkerEntrypoint)
+          : undefined,
+        periodicCleanupExecutable: standaloneReleaseRoot && this.release.periodicCleanupEntrypoint
+          ? join(standaloneReleaseRoot, this.release.periodicCleanupEntrypoint)
+          : undefined,
+      });
       await this.scheduler.ready;
       this.readinessState.setDiagnostic('scheduler', 'pass');
       this.publishStatus();
@@ -229,6 +540,10 @@ export class CanonicalForgeRuntime {
         () => this.failCore('SCHEDULER_STOPPED', 'Scheduler stopped while Runtime was active.'),
         (error) => this.failCore('SCHEDULER_STALLED', error instanceof Error ? error.message : String(error)),
       );
+      this.powerAssertion = this.dependencies.startPowerAssertion({
+        controllerHome: this.config.controllerHome,
+        runtimePid: this.ownership.record.pid,
+      });
 
       stage = 'localBridge';
       this.localBridge = await this.dependencies.startLocalBridge({
@@ -260,10 +575,30 @@ export class CanonicalForgeRuntime {
       this.readinessState.setDiagnostic('mcpEndToEnd', 'pass');
       this.readinessState.markReady();
       this.publishStatus();
+      removeRuntimeStartupFailureEvidence(this.config.controllerHome);
+      stage = 'release';
+      this.startReleaseAuthorityMonitor();
     } catch (error) {
       const reason = this.startupReason(stage);
+      const message = error instanceof Error ? error.message : String(error);
       this.markStartupFailure(stage, reason);
-      await this.stop(reason, error instanceof Error ? error.message : String(error));
+      try {
+        writeRuntimeStartupFailureEvidence(this.config.controllerHome, {
+          schemaVersion: 1,
+          runtimeInstanceId: this.runtimeInstanceId,
+          stage,
+          reasonCode: reason,
+          message,
+          ...(this.release ? {
+            releaseId: this.release.releaseId,
+            artifactIdentity: this.release.artifactIdentity,
+          } : {}),
+          observedAt: new Date().toISOString(),
+        });
+      } catch {
+        // Diagnostic persistence must never replace the original startup failure.
+      }
+      await this.stop(reason, message);
       throw error;
     }
   }
@@ -273,6 +608,7 @@ export class CanonicalForgeRuntime {
     if (stage === 'ownership') return 'RUNTIME_OWNERSHIP_CONFLICT';
     if (stage === 'source') return 'RUNTIME_SOURCE_SNAPSHOT_FAILED';
     if (stage === 'database') return 'DATABASE_UNAVAILABLE';
+    if (stage === 'supervisor') return 'WORKFLOW_SUPERVISOR_INITIALIZATION_FAILED';
     if (stage === 'scheduler') return 'SCHEDULER_INITIALIZATION_FAILED';
     if (stage === 'localBridge') return 'LOCAL_BRIDGE_STARTUP_FAILED';
     if (stage === 'transport') return 'MCP_LISTENER_FAILED';
@@ -311,13 +647,24 @@ export class CanonicalForgeRuntime {
       this.stopping = true;
       this.readinessState.markNotReady(reasonCode);
       this.publishStatus();
+      // Stop the release observer before withdrawing MCP work so no second
+      // supersession callback can race the teardown sequence.
+      try { this.releaseAuthorityMonitor?.stop(); } catch { /* cleanup is best effort */ }
+      this.releaseAuthorityMonitor = undefined;
+      this.removeJscHeapDiagnosticsSignal();
+      this.removeJscSamplingProfilerSignal();
       // Stop accepting new MCP work before quiescing Scheduler activity, then
       // release the Controller Home claim only after all in-process services stop.
+      await this.workflowSupervisor?.close().catch(() => undefined);
+      this.workflowSupervisor = undefined;
       await this.transport?.close().catch(() => undefined);
       await this.dependencies.stopLightweightProcesses(this.config.controllerHome).catch(() => undefined);
       await this.dependencies.stopContextReadHelpers().catch(() => undefined);
       await this.localBridge?.close().catch(() => undefined);
       await this.scheduler?.stop().catch(() => undefined);
+      try { this.powerAssertion?.stop(); } catch { /* power assertion cleanup is best effort */ }
+      this.powerAssertion = undefined;
+      disableControlPlaneReadConnectionReuse(this.config.controllerHome);
       const ownerPid = this.ownership?.record.pid;
       this.ownership?.release();
       clearRuntimeWriteClaim(this.runtimeInstanceId);

package/src/runtime/root/scheduled-controller-composition.ts

@@ -0,0 +1,76 @@
+import {
+  bindControllerSessionBinding,
+  getRequirementControllerRoundRelay,
+  type ControllerBinding,
+  type ControllerHost,
+  type ControllerSession,
+} from '../../../packages/kernel/controller/api/index';
+import { upsertChatgptControllerBinding } from '../../../adapters/chatgpt/controller-binding-store';
+import { getWorkContract } from '../../../packages/kernel/work/api/index';
+import { inheritWorkflowSupervisorConversationBinding } from './workflow-supervisor-composition';
+import { getChatgptWorkConversationBinding } from '../../../adapters/chatgpt/work-conversation-binding-store';
+import { createProcessControllerHost } from '../../../adapters/controller-process/controller-host';
+import { upsertProcessControllerBinding, type ProcessControllerType } from '../../../adapters/controller-process/binding-store';
+
+// Kernel V2 composition root: Scheduler selects Kernel continuation; this file wires concrete provider adapters.
+export function ensureScheduledControllerBinding(
+  options: { controllerHome: string; repoId: string },
+  input: { workId: string; session: ControllerSession; scheduleName?: string; args: Record<string, unknown> },
+): ControllerBinding {
+  let binding: ControllerBinding;
+  if (input.session.controllerType === 'chatgpt') {
+    const durable = getChatgptWorkConversationBinding(options, input.workId);
+    binding = upsertChatgptControllerBinding(options, {
+      workId: input.workId, sessionId: input.session.sessionId,
+      browserSessionId: durable?.latestBrowserSessionId ?? (typeof input.args.browser_session_id === 'string' ? input.args.browser_session_id : undefined),
+      conversationUrl: durable?.conversationUrl ?? (typeof input.args.conversation_url === 'string' ? input.args.conversation_url : undefined),
+      authorizationGrantRefs: [
+        ...(durable?.authorizationGrantRefs ?? []),
+        ...(Array.isArray(input.args.authorization_grant_refs) ? input.args.authorization_grant_refs.map(String) : []),
+      ].map(value => value.trim()).filter(Boolean).filter((value, index, values) => values.indexOf(value) === index),
+      title: input.scheduleName,
+      model: typeof input.args.model === 'string' ? input.args.model : 'gpt-5.6',
+      reasoning: input.args.reasoning === 'medium' || input.args.reasoning === 'high' || input.args.reasoning === 'xhigh' ? input.args.reasoning : 'medium',
+      tabPolicy: input.args.tab_policy === 'reuse' || input.args.tab_policy === 'new' ? input.args.tab_policy : 'auto',
+      timeoutMs: typeof input.args.timeout_ms === 'number' ? input.args.timeout_ms : undefined,
+    }).binding;
+  } else if (input.session.controllerType !== 'human') {
+    binding = upsertProcessControllerBinding(options, {
+      workId: input.workId, sessionId: input.session.sessionId, controllerType: input.session.controllerType as ProcessControllerType,
+      executable: typeof input.args.executable === 'string' ? input.args.executable : undefined,
+      launchArgs: Array.isArray(input.args.launch_args) ? input.args.launch_args.map(String) : [],
+      handoffId: typeof input.args.handoff_id === 'string' ? input.args.handoff_id : undefined,
+      launchReservationMs: typeof input.args.launch_reservation_ms === 'number' ? input.args.launch_reservation_ms : undefined,
+    }).binding;
+  } else {
+    throw new Error('SCHEDULE_CONTINUATION_HUMAN_HOST_UNSUPPORTED');
+  }
+  bindControllerSessionBinding(options, { workId: input.workId, sessionId: input.session.sessionId, binding });
+  return binding;
+}
+
+export function ensureScheduledControllerBindingForWork(
+  options: { controllerHome: string; repoId: string },
+  input: { workId: string; session: ControllerSession; scheduleName?: string; args: Record<string, unknown> },
+): ControllerBinding {
+  if (input.session.controllerType === 'chatgpt') {
+    const work = getWorkContract(options, input.workId);
+    if (work?.requirementId && !getChatgptWorkConversationBinding(options, input.workId)) {
+      const requirementRelay = getRequirementControllerRoundRelay(options, work.requirementId);
+      if (requirementRelay?.originWorkId && requirementRelay.originWorkId !== input.workId) {
+        inheritWorkflowSupervisorConversationBinding(options, requirementRelay.originWorkId, input.workId);
+      }
+    }
+  }
+  return ensureScheduledControllerBinding(options, input);
+}
+
+export function controllerHostForScheduledBinding(
+  options: { controllerHome: string; repoId: string; repoRoot: string },
+  binding: ControllerBinding,
+): ControllerHost {
+  if (binding.hostKind === 'chatgpt') {
+    throw new Error('CHATGPT_CONTROLLER_HOST_SUPERVISOR_OWNED');
+  }
+  return createProcessControllerHost(options);
+}