@moretea-labs/forge 1.8.0 → 1.8.1

package/src/runtime/root/runtime-lane.ts

@@ -0,0 +1,191 @@
+import { randomBytes } from 'crypto';
+import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from 'fs';
+import { chmodSync } from 'fs';
+import { basename, dirname, join, resolve } from 'path';
+import { backupControlPlaneDatabase, type ControlPlaneDatabaseInspection } from '../control-plane/persistence/sqlite-store';
+import { normalizeRuntimeDeploymentTopology } from './deployment-topology';
+import { forgeRuntimeServicePaths, readForgeRuntimeServiceConfig, writeForgeRuntimeServiceConfig, type ForgeRuntimeServiceConfig } from './service';
+
+export interface StableExecutionLane {
+  schemaVersion: 1;
+  kind: 'stable';
+  controllerHome: string;
+  serviceLabel: string;
+  port: number;
+  authTokenFile: string;
+}
+
+export interface CandidateExecutionLane {
+  schemaVersion: 1;
+  kind: 'candidate';
+  sessionId: string;
+  controllerHome: string;
+  serviceLabel: string;
+  port: number;
+  authTokenFile: string;
+  databaseSnapshotPath: string;
+  sourceStableControllerHome: string;
+  createdAt: string;
+}
+
+function requireSessionId(value: string): string {
+  const sessionId = value.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9_-]{7,119}$/.test(sessionId)) {
+    throw new Error('RUNTIME_CANDIDATE_SESSION_ID_INVALID');
+  }
+  return sessionId;
+}
+
+function requireCandidatePort(port: number, stablePort: number): number {
+  if (!Number.isInteger(port) || port < 1 || port > 65_535) throw new Error('RUNTIME_CANDIDATE_PORT_INVALID');
+  if (port === stablePort) throw new Error('RUNTIME_CANDIDATE_PORT_COLLIDES_WITH_STABLE');
+  return port;
+}
+
+function candidateTokenPath(controllerHome: string): string {
+  return join(controllerHome, 'mcp', 'runtime-token');
+}
+
+export function readStableExecutionLane(controllerHome: string): StableExecutionLane {
+  const home = resolve(controllerHome);
+  const paths = forgeRuntimeServicePaths(home);
+  const config = readForgeRuntimeServiceConfig(paths.configPath, { missingRepositoryRoot: 'omit' });
+  return {
+    schemaVersion: 1,
+    kind: 'stable',
+    controllerHome: home,
+    serviceLabel: paths.label,
+    port: config.port,
+    authTokenFile: config.authTokenFile,
+  };
+}
+
+/** Pure lane derivation. It never starts a service or writes either Home. */
+export function planCandidateExecutionLane(input: {
+  stable: StableExecutionLane;
+  candidateControllerHome: string;
+  candidatePort: number;
+  sessionId: string;
+}): CandidateExecutionLane {
+  const candidateHome = resolve(input.candidateControllerHome);
+  if (candidateHome === resolve(input.stable.controllerHome)) {
+    throw new Error('RUNTIME_CANDIDATE_CONTROLLER_HOME_COLLIDES_WITH_STABLE');
+  }
+  const port = requireCandidatePort(input.candidatePort, input.stable.port);
+  const paths = forgeRuntimeServicePaths(candidateHome);
+  if (paths.label === input.stable.serviceLabel) throw new Error('RUNTIME_CANDIDATE_SERVICE_LABEL_COLLIDES_WITH_STABLE');
+  return {
+    schemaVersion: 1,
+    kind: 'candidate',
+    sessionId: requireSessionId(input.sessionId),
+    controllerHome: candidateHome,
+    serviceLabel: paths.label,
+    port,
+    authTokenFile: candidateTokenPath(candidateHome),
+    databaseSnapshotPath: join(candidateHome, 'control-plane.sqlite'),
+    sourceStableControllerHome: resolve(input.stable.controllerHome),
+    createdAt: new Date().toISOString(),
+  };
+}
+
+function createPrivateCandidateToken(stableTokenPath: string, destination: string): void {
+  if (!existsSync(stableTokenPath) || !statSync(stableTokenPath).isFile()) {
+    throw new Error('RUNTIME_CANDIDATE_STABLE_AUTH_TOKEN_MISSING');
+  }
+  mkdirSync(dirname(destination), { recursive: true, mode: 0o700 });
+  writeFileSync(destination, `${randomBytes(32).toString('base64url')}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+  try { chmodSync(destination, 0o600); } catch { /* platform best effort */ }
+}
+
+function candidateServiceConfig(stable: ForgeRuntimeServiceConfig, lane: CandidateExecutionLane): ForgeRuntimeServiceConfig {
+  const topology = normalizeRuntimeDeploymentTopology(stable.topology);
+  return {
+    ...stable,
+    controllerHome: lane.controllerHome,
+    port: lane.port,
+    authTokenFile: lane.authTokenFile,
+    // Candidate B may verify the Supervisor socket and internal lifecycle,
+    // but it must never submit external browser effects against Stable A's
+    // real conversation during an isolated canary.
+    topology: {
+      ...topology,
+      components: { ...topology.components },
+    },
+  };
+}
+
+/**
+ * Create the only permitted Candidate B mutable foundation: a fresh Controller
+ * Home with a consistent SQLite snapshot and an independent declarative
+ * service contract. It deliberately does not copy Stable A's Runtime release
+ * authority and never starts/stops a service; portable artifacts are published into B under B's own authority.
+ */
+export function createCandidateExecutionLane(input: {
+  stableControllerHome: string;
+  candidateControllerHome: string;
+  candidatePort: number;
+  sessionId: string;
+}): { stable: StableExecutionLane; candidate: CandidateExecutionLane; database: ControlPlaneDatabaseInspection } {
+  const stable = readStableExecutionLane(input.stableControllerHome);
+  const candidate = planCandidateExecutionLane({
+    stable,
+    candidateControllerHome: input.candidateControllerHome,
+    candidatePort: input.candidatePort,
+    sessionId: input.sessionId,
+  });
+  if (existsSync(candidate.controllerHome)) throw new Error('RUNTIME_CANDIDATE_CONTROLLER_HOME_ALREADY_EXISTS');
+  try {
+    createPrivateCandidateToken(stable.authTokenFile, candidate.authTokenFile);
+    const database = backupControlPlaneDatabase(stable.controllerHome, candidate.databaseSnapshotPath);
+    writeForgeRuntimeServiceConfig(candidateServiceConfig(
+      readForgeRuntimeServiceConfig(forgeRuntimeServicePaths(stable.controllerHome).configPath, { missingRepositoryRoot: 'omit' }),
+      candidate,
+    ));
+    assertCandidateExecutionLaneIsolation(stable, candidate);
+    return { stable, candidate, database };
+  } catch (error) {
+    // No recursive cleanup is attempted here: this function never guesses at
+    // a pre-existing user directory. The only writable target was required to
+    // be absent, so the caller can inspect or explicitly retire a partial B.
+    throw error;
+  }
+}
+
+export function assertCandidateExecutionLaneIsolation(
+  stable: StableExecutionLane,
+  candidate: CandidateExecutionLane,
+): void {
+  if (resolve(stable.controllerHome) === resolve(candidate.controllerHome)) {
+    throw new Error('RUNTIME_CANDIDATE_CONTROLLER_HOME_COLLIDES_WITH_STABLE');
+  }
+  if (stable.port === candidate.port) throw new Error('RUNTIME_CANDIDATE_PORT_COLLIDES_WITH_STABLE');
+  if (stable.serviceLabel === candidate.serviceLabel) throw new Error('RUNTIME_CANDIDATE_SERVICE_LABEL_COLLIDES_WITH_STABLE');
+  if (resolve(stable.authTokenFile) === resolve(candidate.authTokenFile)) {
+    throw new Error('RUNTIME_CANDIDATE_AUTH_TOKEN_COLLIDES_WITH_STABLE');
+  }
+  if (resolve(candidate.databaseSnapshotPath) !== resolve(candidate.controllerHome, 'control-plane.sqlite')) {
+    throw new Error('RUNTIME_CANDIDATE_DATABASE_PATH_INVALID');
+  }
+}
+
+/**
+ * Remove one retired Candidate B home after its ReleaseSession has reached a
+ * terminal state. The path fence is deliberately derived from Stable A and
+ * the session identity so terminal cleanup can never target an arbitrary
+ * Controller Home.
+ */
+export function removeRetiredCandidateExecutionLane(
+  stable: StableExecutionLane,
+  candidate: Pick<CandidateExecutionLane, 'controllerHome' | 'sessionId'>,
+): boolean {
+  const stableHome = resolve(stable.controllerHome);
+  const candidateHome = resolve(candidate.controllerHome);
+  const candidateRoot = resolve(dirname(stableHome), 'candidate-runtime-lanes');
+  if (candidateHome === stableHome) throw new Error('RUNTIME_CANDIDATE_CLEANUP_STABLE_COLLISION');
+  if (resolve(dirname(candidateHome)) !== candidateRoot || basename(candidateHome) !== candidate.sessionId) {
+    throw new Error('RUNTIME_CANDIDATE_CLEANUP_PATH_INVALID');
+  }
+  if (!existsSync(candidateHome)) return false;
+  rmSync(candidateHome, { recursive: true, force: true });
+  return true;
+}

package/src/runtime/root/runtime.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from 'crypto';
-import { mkdirSync, statSync } from 'fs';
+import { statSync } from 'fs';
 import { writeJsonAtomic } from '../shared/json-files';
 import { ensureForgeInstanceIdentity } from '../../../packages/kernel/identity/api/index';
 import { dirname, join } from 'path';
@@ -10,7 +10,6 @@ import {
   enableControlPlaneReadConnectionReuse,
   inspectControlPlaneDatabase,
 } from '../control-plane/persistence/sqlite-store';
-import { activateExclusiveWorkAdmission } from '../control-plane/facade/work-admission-policy';
 import { closeCodeGraphReadProviderSessions } from '../context/codegraph-read-provider';
 import { cancelAllLightweightProcesses } from '../execution/process-runtime/lightweight-managed';
 import {
@@ -24,11 +23,14 @@ import { acquireRuntimeOwnership, type RuntimeOwnershipHandle } from './ownershi
 import { RuntimeReadinessState } from './readiness';
 import { loadRuntimeReleaseManifest, requireCompleteCompiledRuntimeReleaseManifest } from './release-manifest';
 import { ensureActiveRuntimeRelease, readRuntimeReleaseAuthority, type RuntimeReleaseAuthority } from './release-store';
+import { migrateReleaseDurableState } from '../release/release-state-migration';
 import { bindRuntimeWriteClaim, clearRuntimeWriteClaim } from './write-fence';
 import { startInProcessScheduler, type RuntimeSchedulerHandle } from './scheduler';
 import { startConfiguredRuntimeLocalBridge, type RuntimeLocalBridgeHandle } from './local-bridge';
 import { startActiveExecutionPowerAssertion, type RuntimePowerAssertionHandle } from './active-execution-power-assertion';
-import { removeRuntimeStatusSnapshot, writeRuntimeStatusSnapshot } from './status';
+import { startWorkflowSupervisorRuntime, type RuntimeWorkflowSupervisorHandle } from './workflow-supervisor-runtime';
+import { normalizeRuntimeDeploymentTopology, type RuntimeDeploymentTopology } from './deployment-topology';
+import { removeRuntimeStartupFailureEvidence, removeRuntimeStatusSnapshot, writeRuntimeStartupFailureEvidence, writeRuntimeStatusSnapshot } from './status';
 import type {
   CanonicalRuntimeConfig,
   CanonicalRuntimeStatusSnapshot,
@@ -43,6 +45,7 @@ export interface RuntimeReleaseAuthorityMonitor {
 
 export interface CanonicalRuntimeDependencies {
   loadReleaseManifest(path: string, controllerHome: string): RuntimeReleaseManifest;
+  migrateReleaseState(controllerHome: string): void;
   ensureReleaseAuthority(controllerHome: string, manifestPath: string): RuntimeReleaseAuthority;
   readReleaseAuthority(controllerHome: string): RuntimeReleaseAuthority | undefined;
   startReleaseAuthorityMonitor(observe: () => void): RuntimeReleaseAuthorityMonitor;
@@ -52,6 +55,7 @@ export interface CanonicalRuntimeDependencies {
   startScheduler(input: Parameters<typeof startInProcessScheduler>[0]): RuntimeSchedulerHandle;
   startLocalBridge(input: { controllerHome: string; repositoryRoot?: string }): Promise<RuntimeLocalBridgeHandle | undefined>;
   startPowerAssertion(input: { controllerHome: string; runtimePid: number }): RuntimePowerAssertionHandle;
+  startWorkflowSupervisor(controllerHome: string, options?: { nativeBrowserAdapter?: boolean }): Promise<RuntimeWorkflowSupervisorHandle>;
   startTransport(options: Parameters<typeof startRuntimeMcpTransport>[0]): Promise<RuntimeMcpTransportHandle>;
   runMcpProbe(endpoint: string, authToken: string): Promise<void>;
   collectRuntimeSourceIdentity: typeof collectRuntimeSourceIdentity;
@@ -60,7 +64,20 @@ export interface CanonicalRuntimeDependencies {
   stopContextReadHelpers(): Promise<void>;
   computeToolSurfaceFingerprint: typeof runtimeGatewayToolSurfaceFingerprint;
   ensureForgeInstanceIdentity: typeof ensureForgeInstanceIdentity;
-  startJscSamplingProfiler(directory: string): Promise<void>;
+  captureJscSamplingProfile(options: { durationMs: number; sampleIntervalUs: number }): Promise<{
+    requestedDurationMs: number;
+    elapsedMs: number;
+    sampleIntervalUs: number;
+    functions: string;
+    bytecodes: string;
+    stackTraces: {
+      interval: number | null;
+      totalTraceCount: number;
+      retainedTraceCount: number;
+      traces: Array<{ timestamp: number | null; frames: Array<Record<string, unknown>> }>;
+      sources: Array<Record<string, unknown>>;
+    };
+  }>;
 }
 
 async function defaultMcpProbe(endpoint: string, authToken: string): Promise<void> {
@@ -87,6 +104,12 @@ async function defaultMcpProbe(endpoint: string, authToken: string): Promise<voi
 }
 
 const DEFAULT_RELEASE_AUTHORITY_MONITOR_INTERVAL_MS = 1_000;
+const JSC_SAMPLING_DURATION_MS = 2_000;
+const JSC_SAMPLING_INTERVAL_US = 1_000;
+const JSC_SAMPLING_TRACE_LIMIT = 2_000;
+const JSC_SAMPLING_FRAME_LIMIT = 32;
+const JSC_SAMPLING_SOURCE_LIMIT = 512;
+const JSC_SAMPLING_REPORT_CHAR_LIMIT = 128 * 1024;
 
 function startDefaultReleaseAuthorityMonitor(observe: () => void): RuntimeReleaseAuthorityMonitor {
   const timer = setInterval(observe, DEFAULT_RELEASE_AUTHORITY_MONITOR_INTERVAL_MS);
@@ -94,14 +117,70 @@ function startDefaultReleaseAuthorityMonitor(observe: () => void): RuntimeReleas
   return { stop: () => clearInterval(timer) };
 }
 
-async function startDefaultJscSamplingProfiler(directory: string): Promise<void> {
-  mkdirSync(directory, { recursive: true });
-  const { startSamplingProfiler } = await import('bun:jsc');
-  startSamplingProfiler(directory);
+async function captureDefaultJscSamplingProfile(options: { durationMs: number; sampleIntervalUs: number }): Promise<{
+  requestedDurationMs: number;
+  elapsedMs: number;
+  sampleIntervalUs: number;
+  functions: string;
+  bytecodes: string;
+  stackTraces: {
+    interval: number | null;
+    totalTraceCount: number;
+    retainedTraceCount: number;
+    traces: Array<{ timestamp: number | null; frames: Array<Record<string, unknown>> }>;
+    sources: Array<Record<string, unknown>>;
+  };
+}> {
+  const { profile } = await import('bun:jsc');
+  const startedAt = performance.now();
+  const sampling = await profile(
+    () => new Promise<void>((resolve) => setTimeout(resolve, options.durationMs)),
+    options.sampleIntervalUs,
+  );
+  // Bun's current runtime returns an object here even though bun-types still
+  // declares SamplingProfile.stackTraces as string[]. Treat the runtime value
+  // as diagnostic input and normalize it defensively instead of trusting that
+  // stale declaration at the production boundary.
+  const rawStackTraces = sampling.stackTraces as unknown as {
+    interval?: unknown;
+    traces?: unknown;
+    sources?: unknown;
+  };
+  const rawTraces = Array.isArray(rawStackTraces?.traces) ? rawStackTraces.traces : [];
+  const traces = rawTraces.slice(-JSC_SAMPLING_TRACE_LIMIT).map((trace) => {
+    const record = trace && typeof trace === 'object' && !Array.isArray(trace)
+      ? trace as Record<string, unknown>
+      : {};
+    const frames = Array.isArray(record.frames)
+      ? record.frames.filter((frame): frame is Record<string, unknown> => Boolean(frame) && typeof frame === 'object' && !Array.isArray(frame)).slice(0, JSC_SAMPLING_FRAME_LIMIT)
+      : [];
+    return {
+      timestamp: typeof record.timestamp === 'number' ? record.timestamp : null,
+      frames,
+    };
+  });
+  const sources = Array.isArray(rawStackTraces?.sources)
+    ? rawStackTraces.sources.filter((source): source is Record<string, unknown> => Boolean(source) && typeof source === 'object' && !Array.isArray(source)).slice(0, JSC_SAMPLING_SOURCE_LIMIT)
+    : [];
+  return {
+    requestedDurationMs: options.durationMs,
+    elapsedMs: Math.max(0, performance.now() - startedAt),
+    sampleIntervalUs: options.sampleIntervalUs,
+    functions: sampling.functions.slice(0, JSC_SAMPLING_REPORT_CHAR_LIMIT),
+    bytecodes: sampling.bytecodes.slice(0, JSC_SAMPLING_REPORT_CHAR_LIMIT),
+    stackTraces: {
+      interval: typeof rawStackTraces?.interval === 'number' ? rawStackTraces.interval : null,
+      totalTraceCount: rawTraces.length,
+      retainedTraceCount: traces.length,
+      traces,
+      sources,
+    },
+  };
 }
 
 const DEFAULT_DEPENDENCIES: CanonicalRuntimeDependencies = {
   loadReleaseManifest: loadRuntimeReleaseManifest,
+  migrateReleaseState: migrateReleaseDurableState,
   ensureReleaseAuthority: ensureActiveRuntimeRelease,
   readReleaseAuthority: readRuntimeReleaseAuthority,
   startReleaseAuthorityMonitor: startDefaultReleaseAuthorityMonitor,
@@ -111,6 +190,7 @@ const DEFAULT_DEPENDENCIES: CanonicalRuntimeDependencies = {
   startScheduler: startInProcessScheduler,
   startLocalBridge: startConfiguredRuntimeLocalBridge,
   startPowerAssertion: startActiveExecutionPowerAssertion,
+  startWorkflowSupervisor: startWorkflowSupervisorRuntime,
   startTransport: startRuntimeMcpTransport,
   runMcpProbe: defaultMcpProbe,
   collectRuntimeSourceIdentity,
@@ -119,18 +199,20 @@ const DEFAULT_DEPENDENCIES: CanonicalRuntimeDependencies = {
   stopContextReadHelpers: closeCodeGraphReadProviderSessions,
   computeToolSurfaceFingerprint: runtimeGatewayToolSurfaceFingerprint,
   ensureForgeInstanceIdentity,
-  startJscSamplingProfiler: startDefaultJscSamplingProfiler,
+  captureJscSamplingProfile: captureDefaultJscSamplingProfile,
 };
 
 export class CanonicalForgeRuntime {
   readonly forgeInstanceId: string;
   readonly runtimeInstanceId: string;
+  readonly topology: RuntimeDeploymentTopology;
   private readonly readinessState = new RuntimeReadinessState();
   private readonly dependencies: CanonicalRuntimeDependencies;
   private ownership?: RuntimeOwnershipHandle;
   private scheduler?: RuntimeSchedulerHandle;
   private localBridge?: RuntimeLocalBridgeHandle;
   private powerAssertion?: RuntimePowerAssertionHandle;
+  private workflowSupervisor?: RuntimeWorkflowSupervisorHandle;
   private toolSurfaceFingerprint?: string;
   private transport?: RuntimeMcpTransportHandle;
   private controller?: RuntimeControllerServices;
@@ -144,8 +226,7 @@ export class CanonicalForgeRuntime {
   private jscHeapDiagnosticsSignalHandler?: () => void;
   private jscHeapDiagnosticsCaptureInFlight = false;
   private jscSamplingProfilerSignalHandler?: () => void;
-  private jscSamplingProfilerStartInFlight = false;
-  private jscSamplingProfilerStarted = false;
+  private jscSamplingProfileCaptureInFlight = false;
   lastExit?: RuntimeExitEvidence;
 
   constructor(
@@ -153,6 +234,7 @@ export class CanonicalForgeRuntime {
     dependencies: Partial<CanonicalRuntimeDependencies> = {},
   ) {
     this.runtimeInstanceId = config.runtimeInstanceId?.trim() || `runtime_${randomUUID().replaceAll('-', '')}`;
+    this.topology = normalizeRuntimeDeploymentTopology(config.topology);
     this.dependencies = { ...DEFAULT_DEPENDENCIES, ...dependencies };
     if (!config.controllerHome.trim()) throw new Error('RUNTIME_CONFIG_REQUIRED: controllerHome');
     if (config.repositoryRoot?.trim()) {
@@ -183,7 +265,10 @@ export class CanonicalForgeRuntime {
     const handler = () => {
       if (this.jscHeapDiagnosticsCaptureInFlight) return;
       this.jscHeapDiagnosticsCaptureInFlight = true;
-      void import('bun:jsc').then(({ heapStats, memoryUsage }) => {
+      void import('bun:jsc').then(({ fullGC, heapStats, memoryUsage }) => {
+        const gcStartedAt = performance.now();
+        const fullGcResult = fullGC();
+        const fullGcDurationMs = Math.max(0, performance.now() - gcStartedAt);
         const heap = heapStats();
         const topTypes = (counts: Record<string, number>, limit: number) => Object.entries(counts)
           .sort((left, right) => right[1] - left[1])
@@ -195,6 +280,12 @@ export class CanonicalForgeRuntime {
           pid: process.pid,
           runtimeInstanceId: this.runtimeInstanceId,
           releaseId: this.release?.releaseId,
+          gc: {
+            forced: true,
+            kind: 'full',
+            durationMs: fullGcDurationMs,
+            result: fullGcResult,
+          },
           heap: {
             heapSize: heap.heapSize,
             heapCapacity: heap.heapCapacity,
@@ -235,26 +326,41 @@ export class CanonicalForgeRuntime {
   private installJscSamplingProfilerSignal(): void {
     if (process.platform === 'win32' || this.jscSamplingProfilerSignalHandler) return;
     const handler = () => {
-      if (this.jscSamplingProfilerStarted || this.jscSamplingProfilerStartInFlight) return;
-      this.jscSamplingProfilerStartInFlight = true;
-      const directory = join(this.config.controllerHome, 'diagnostics', 'jsc-profile');
-      void this.dependencies.startJscSamplingProfiler(directory).then(() => {
-        this.jscSamplingProfilerStarted = true;
+      if (this.jscSamplingProfileCaptureInFlight) return;
+      this.jscSamplingProfileCaptureInFlight = true;
+      void this.dependencies.captureJscSamplingProfile({
+        durationMs: JSC_SAMPLING_DURATION_MS,
+        sampleIntervalUs: JSC_SAMPLING_INTERVAL_US,
+      }).then((sampling) => {
+        const path = join(this.config.controllerHome, 'diagnostics', 'jsc-sampling-profile.json');
+        writeJsonAtomic(path, {
+          schemaVersion: 1,
+          capturedAt: new Date().toISOString(),
+          pid: process.pid,
+          runtimeInstanceId: this.runtimeInstanceId,
+          releaseId: this.release?.releaseId,
+          bounded: true,
+          ...sampling,
+        });
         process.stderr.write(`${JSON.stringify({
-          event: 'forge_runtime_jsc_sampling_profiler_started',
+          event: 'forge_runtime_jsc_sampling_profile_captured',
           runtimeInstanceId: this.runtimeInstanceId,
-          directory,
+          path,
+          requestedDurationMs: sampling.requestedDurationMs,
+          elapsedMs: sampling.elapsedMs,
+          sampleIntervalUs: sampling.sampleIntervalUs,
+          retainedTraceCount: sampling.stackTraces.retainedTraceCount,
           observedAt: new Date().toISOString(),
         })}\n`);
       }).catch((error) => {
         process.stderr.write(`${JSON.stringify({
-          event: 'forge_runtime_jsc_sampling_profiler_failed',
+          event: 'forge_runtime_jsc_sampling_profile_failed',
           runtimeInstanceId: this.runtimeInstanceId,
           message: error instanceof Error ? error.message : String(error),
           observedAt: new Date().toISOString(),
         })}\n`);
       }).finally(() => {
-        this.jscSamplingProfilerStartInFlight = false;
+        this.jscSamplingProfileCaptureInFlight = false;
       });
     };
     process.on('SIGUSR1', handler);
@@ -339,7 +445,7 @@ export class CanonicalForgeRuntime {
     if (this.started) throw new Error('RUNTIME_ALREADY_STARTED');
     this.started = true;
     this.readinessState.markNotReady();
-    let stage: 'release' | 'ownership' | 'source' | 'database' | 'scheduler' | 'localBridge' | 'transport' | 'probe' = 'release';
+    let stage: 'release' | 'ownership' | 'source' | 'database' | 'supervisor' | 'scheduler' | 'localBridge' | 'transport' | 'probe' = 'release';
     try {
       this.release = this.dependencies.loadReleaseManifest(this.config.releaseManifestPath, this.config.controllerHome);
 
@@ -347,6 +453,7 @@ export class CanonicalForgeRuntime {
       this.ownership = this.dependencies.acquireOwnership(this.config.controllerHome, this.runtimeInstanceId);
 
       stage = 'release';
+      this.dependencies.migrateReleaseState(this.config.controllerHome);
       const releaseAuthority = this.dependencies.ensureReleaseAuthority(this.config.controllerHome, this.config.releaseManifestPath);
       stage = 'source';
       // A compiled release is a closed execution surface. Fail before Scheduler
@@ -400,11 +507,15 @@ export class CanonicalForgeRuntime {
       this.installJscSamplingProfilerSignal();
       this.readinessState.setDiagnostic('database', 'pass');
       this.publishStatus();
-      if (this.config.exclusiveWorkId) {
-        activateExclusiveWorkAdmission(this.config.controllerHome, {
-          allowedWorkId: this.config.exclusiveWorkId,
-          reason: 'P0 canonical single Runtime migration isolation',
+      if (this.topology.components.workflowSupervisor) {
+        stage = 'supervisor';
+        this.workflowSupervisor = await this.dependencies.startWorkflowSupervisor(this.config.controllerHome, {
+          nativeBrowserAdapter: this.topology.components.workflowSupervisorNativeBrowser,
         });
+        void this.workflowSupervisor.done.then(
+          () => this.failCore('WORKFLOW_SUPERVISOR_STOPPED', 'Workflow Supervisor stopped while Runtime was active.'),
+          (error) => this.failCore('WORKFLOW_SUPERVISOR_FAILED', error instanceof Error ? error.message : String(error)),
+        );
       }
 
       stage = 'scheduler';
@@ -464,12 +575,30 @@ export class CanonicalForgeRuntime {
       this.readinessState.setDiagnostic('mcpEndToEnd', 'pass');
       this.readinessState.markReady();
       this.publishStatus();
+      removeRuntimeStartupFailureEvidence(this.config.controllerHome);
       stage = 'release';
       this.startReleaseAuthorityMonitor();
     } catch (error) {
       const reason = this.startupReason(stage);
+      const message = error instanceof Error ? error.message : String(error);
       this.markStartupFailure(stage, reason);
-      await this.stop(reason, error instanceof Error ? error.message : String(error));
+      try {
+        writeRuntimeStartupFailureEvidence(this.config.controllerHome, {
+          schemaVersion: 1,
+          runtimeInstanceId: this.runtimeInstanceId,
+          stage,
+          reasonCode: reason,
+          message,
+          ...(this.release ? {
+            releaseId: this.release.releaseId,
+            artifactIdentity: this.release.artifactIdentity,
+          } : {}),
+          observedAt: new Date().toISOString(),
+        });
+      } catch {
+        // Diagnostic persistence must never replace the original startup failure.
+      }
+      await this.stop(reason, message);
       throw error;
     }
   }
@@ -479,6 +608,7 @@ export class CanonicalForgeRuntime {
     if (stage === 'ownership') return 'RUNTIME_OWNERSHIP_CONFLICT';
     if (stage === 'source') return 'RUNTIME_SOURCE_SNAPSHOT_FAILED';
     if (stage === 'database') return 'DATABASE_UNAVAILABLE';
+    if (stage === 'supervisor') return 'WORKFLOW_SUPERVISOR_INITIALIZATION_FAILED';
     if (stage === 'scheduler') return 'SCHEDULER_INITIALIZATION_FAILED';
     if (stage === 'localBridge') return 'LOCAL_BRIDGE_STARTUP_FAILED';
     if (stage === 'transport') return 'MCP_LISTENER_FAILED';
@@ -525,6 +655,8 @@ export class CanonicalForgeRuntime {
       this.removeJscSamplingProfilerSignal();
       // Stop accepting new MCP work before quiescing Scheduler activity, then
       // release the Controller Home claim only after all in-process services stop.
+      await this.workflowSupervisor?.close().catch(() => undefined);
+      this.workflowSupervisor = undefined;
       await this.transport?.close().catch(() => undefined);
       await this.dependencies.stopLightweightProcesses(this.config.controllerHome).catch(() => undefined);
       await this.dependencies.stopContextReadHelpers().catch(() => undefined);

package/src/runtime/root/scheduled-controller-composition.ts

@@ -1,11 +1,13 @@
 import {
   bindControllerSessionBinding,
+  getRequirementControllerRoundRelay,
   type ControllerBinding,
   type ControllerHost,
   type ControllerSession,
 } from '../../../packages/kernel/controller/api/index';
-import { createChatgptControllerHost } from '../../../adapters/chatgpt/controller-host';
 import { upsertChatgptControllerBinding } from '../../../adapters/chatgpt/controller-binding-store';
+import { getWorkContract } from '../../../packages/kernel/work/api/index';
+import { inheritWorkflowSupervisorConversationBinding } from './workflow-supervisor-composition';
 import { getChatgptWorkConversationBinding } from '../../../adapters/chatgpt/work-conversation-binding-store';
 import { createProcessControllerHost } from '../../../adapters/controller-process/controller-host';
 import { upsertProcessControllerBinding, type ProcessControllerType } from '../../../adapters/controller-process/binding-store';
@@ -22,9 +24,13 @@ export function ensureScheduledControllerBinding(
       workId: input.workId, sessionId: input.session.sessionId,
       browserSessionId: durable?.latestBrowserSessionId ?? (typeof input.args.browser_session_id === 'string' ? input.args.browser_session_id : undefined),
       conversationUrl: durable?.conversationUrl ?? (typeof input.args.conversation_url === 'string' ? input.args.conversation_url : undefined),
+      authorizationGrantRefs: [
+        ...(durable?.authorizationGrantRefs ?? []),
+        ...(Array.isArray(input.args.authorization_grant_refs) ? input.args.authorization_grant_refs.map(String) : []),
+      ].map(value => value.trim()).filter(Boolean).filter((value, index, values) => values.indexOf(value) === index),
       title: input.scheduleName,
       model: typeof input.args.model === 'string' ? input.args.model : 'gpt-5.6',
-      reasoning: input.args.reasoning === 'medium' || input.args.reasoning === 'xhigh' ? input.args.reasoning : 'high',
+      reasoning: input.args.reasoning === 'medium' || input.args.reasoning === 'high' || input.args.reasoning === 'xhigh' ? input.args.reasoning : 'medium',
       tabPolicy: input.args.tab_policy === 'reuse' || input.args.tab_policy === 'new' ? input.args.tab_policy : 'auto',
       timeoutMs: typeof input.args.timeout_ms === 'number' ? input.args.timeout_ms : undefined,
     }).binding;
@@ -43,9 +49,28 @@ export function ensureScheduledControllerBinding(
   return binding;
 }
 
+export function ensureScheduledControllerBindingForWork(
+  options: { controllerHome: string; repoId: string },
+  input: { workId: string; session: ControllerSession; scheduleName?: string; args: Record<string, unknown> },
+): ControllerBinding {
+  if (input.session.controllerType === 'chatgpt') {
+    const work = getWorkContract(options, input.workId);
+    if (work?.requirementId && !getChatgptWorkConversationBinding(options, input.workId)) {
+      const requirementRelay = getRequirementControllerRoundRelay(options, work.requirementId);
+      if (requirementRelay?.originWorkId && requirementRelay.originWorkId !== input.workId) {
+        inheritWorkflowSupervisorConversationBinding(options, requirementRelay.originWorkId, input.workId);
+      }
+    }
+  }
+  return ensureScheduledControllerBinding(options, input);
+}
+
 export function controllerHostForScheduledBinding(
   options: { controllerHome: string; repoId: string; repoRoot: string },
   binding: ControllerBinding,
 ): ControllerHost {
-  return binding.hostKind === 'chatgpt' ? createChatgptControllerHost(options) : createProcessControllerHost(options);
+  if (binding.hostKind === 'chatgpt') {
+    throw new Error('CHATGPT_CONTROLLER_HOST_SUPERVISOR_OWNED');
+  }
+  return createProcessControllerHost(options);
 }

package/src/runtime/root/service-runner.ts

@@ -4,6 +4,7 @@ import { spawn, type ChildProcess } from 'child_process';
 import { loadRuntimeReleaseManifest } from './release-manifest';
 import { readRuntimeReleaseAuthority } from './release-store';
 import { readForgeRuntimeServiceConfig } from './service';
+import { runtimeAuthorityFreeEnvironment } from '../shared/process-environment';
 
 export interface ForgeRuntimeServiceCommand {
   executable: string;
@@ -31,10 +32,9 @@ export function resolveForgeRuntimeServiceCommand(controllerHome: string, config
       '--port', String(config.port),
       '--auth-token-file', config.authTokenFile,
       ...activeRuntimeReleaseManifest.arguments,
-      ...(config.exclusiveWorkId ? ['--exclusive-work-id', config.exclusiveWorkId] : []),
     ],
     env: {
-      ...process.env,
+      ...runtimeAuthorityFreeEnvironment(process.env),
       FORGE_CONTROLLER_HOME: home,
       FORGE_CONTROLLER_RUNTIME_SOURCE_ROOT: releaseRoot,
       FORGE_RELEASE_PATH: releaseRoot,