@moretea-labs/forge 1.8.0 → 1.8.1

package/adapters/mcp/runtime-gateway/status-inbox-adapter.ts

@@ -4,34 +4,55 @@ import { runProcess } from '../../../src/effects/process-runner';
 import type { MultiRepositoryMcpToolContext } from "../multi-repository";
 import { allControllerToolDefinitions, controllerExposureSnapshot, controllerToolSurfaceStatus } from "../toolset";
 import { result } from "./result-adapter";
-import { selected } from "./shared-adapter";
-import { reconcileReadinessProjectionSource } from "../readiness-projection";
-import { listExecutionJobs } from "../../../src/runtime/execution/jobs/store";
+import { selected, selectedOptional } from "./shared-adapter";
+import { SEMANTIC_SCOPE_KEY } from "../../../src/cli/repositories/controller-home";
 import type { ExecutionJob } from '../../../src/runtime/execution/jobs/types';
 import { getProcessRecord, isManagedProcessActive, processRuntimeResourceDiagnostics } from "../../../src/runtime/execution/process-runtime";
-import { readForgeRuntimeStatus } from "../../../src/runtime/control-plane/runtime-status-client";
-import { readSchedulerHealthSnapshot } from "../../../src/runtime/control-plane/global-scheduler/scheduler";
-import { evaluateActiveRuntimeSourceDrift, formatRuntimeSourceDriftMessage, readRuntimeGeneration, type RuntimeSourceIdentity } from "../../../src/runtime/control-plane/runtime-generation";
-import { projectionObservation, readRepositoryProjectionSnapshot } from "../../../src/runtime/projections/materialized-view";
-import { buildRuntimeOperationalView, classifyRuntimeReadinessSemantics, evaluateRuntimeHealth, RUNTIME_HEALTH_THRESHOLDS, type RuntimeOperationalView, type GradedObservation } from "../../../src/runtime/health";
-import { buildControllerTaskLedgerProjection } from "../../../src/cli/controller/task-ledger";
-import { legacyIssueAuthorityRetired } from "../../../src/cli/controller/legacy-issue-cutover";
+import { formatRuntimeSourceDriftMessage, readRuntimeGeneration } from "../../../src/runtime/control-plane/runtime-generation";
 import { listControllerChecks } from "../../../src/cli/controller/check-runner";
 import { buildCheckExecutionSchedule } from "../../../src/runtime/execution/process-runtime/check-scheduling";
-import { FORGE_MCP_SCHEMA_VERSION, FORGE_TOOL_SURFACE, FORGE_VERSION } from "../../../src/cli/controller/runtime-config";
-import { resolveLocalBridgeSurface } from "../../../src/runtime/shared/local-bridge-surface";
 import { listAssistantPluginManifests } from "../../../src/runtime/plugins/store";
 import { cachedGitIdentity, gitSnapshot } from "../../../src/cli/repository/inspector";
 import { buildRuntimeMaintenanceStatus } from "../../../src/runtime/recovery";
-import { allowedFacadeOperations, buildFacadeResult, listCapabilityDescriptors, summarizeCapabilityGroups, listHandoffAttentionItems, listHandoffItems, normalizeCheckIds, buildWorkContinuationSnapshot, listPlanContracts, summarizePlanContract, runHandoffInboxApplication, type FacadeTool } from "../../../src/runtime/control-plane/facade";
+import { allowedFacadeOperations, buildFacadeResult, listCapabilityDescriptors, summarizeCapabilityGroups, listHandoffAttentionItems, normalizeCheckIds, buildWorkContinuationSnapshot, listPlanContracts, summarizePlanContract, runHandoffInboxApplication, type FacadeTool } from "../../../src/runtime/control-plane/facade";
 import { buildJobOperationDigest } from '../../../src/runtime/control-plane/facade/operation-digest';
 import { readActiveWorkCandidates, type InvalidActiveWorkCandidate } from "../../../packages/kernel/work/api/index";
 import { observeRuntimeStatus } from "../../../src/runtime/root/status";
 import { getControllerSession } from "../../../packages/kernel/controller/api/index";
+import { listActiveOccurrences, listSchedules, scheduleOwnsWork } from "../../../packages/kernel/scheduler/api/index";
 import { summarizeHandoffItem } from '../../../src/runtime/control-plane/facade';
 import type { CallToolResult } from '../../../packages/protocols/mcp/tool-contract';
-import { handoffResolvedContinuationEventName, triggerWorkContinuationRepositoryEvent } from '../../../src/runtime/workflow/schedules/work-continuation';
+import { triggerResolvedHandoffContinuation } from '../../../src/runtime/workflow/schedules/work-continuation';
+import { getUserRequest, listUserRequests, recordUserRequest, resolveUserRequest, type UserRequest } from '../../../packages/kernel/identity/api/index';
+import { controllerReadinessEvidence, runtimeSourceSnapshotStatus } from './runtime-readiness-observation';
+import { readRuntimeReleaseAuthority } from '../../../src/runtime/root/release-store';
+import { getWorkflowSupervisorConsumerStatus, getWorkflowSupervisorContinuationProof } from '../../../supervisor/client';
+import { resolveWorkflowSupervisorForgeHome } from '../../../supervisor/paths';
+export { ageMs, probeLocalControllerHealth, localControllerDiagnosticMatchesRuntime, controllerReadinessEvidence, runtimeSourceSnapshotStatus } from './runtime-readiness-observation';
+export type { ControllerReadinessSignals } from './runtime-readiness-observation';
 
+export const PRIMARY_WORK_RUNTIME_ACTIVITIES = [
+  'running',
+  'waiting_for_user',
+  'scheduled',
+  'recoverable',
+  'needs_reconciliation',
+] as const;
+export type PrimaryWorkRuntimeActivity = (typeof PRIMARY_WORK_RUNTIME_ACTIVITIES)[number];
+
+/** Read-only runtime projection. These facts never mutate or extend semantic Work state. */
+export function primaryWorkRuntimeActivity(facts: {
+  running: boolean;
+  waitingForUser: boolean;
+  scheduled: boolean;
+  needsReconciliation: boolean;
+}): PrimaryWorkRuntimeActivity {
+  if (facts.running) return 'running';
+  if (facts.waitingForUser) return 'waiting_for_user';
+  if (facts.scheduled) return 'scheduled';
+  if (facts.needsReconciliation) return 'needs_reconciliation';
+  return 'recoverable';
+}
 
 export const GIT_IDENTITY_SAMPLE_TTL_MS = Math.max(1_000, Number(process.env.FORGE_GIT_IDENTITY_SAMPLE_TTL_MS ?? 3_000));
 
@@ -79,7 +100,7 @@ export function summarizeWorkListItem(job: ExecutionJob): Record<string, unknown
     createdAt: job.createdAt,
     updatedAt: job.updatedAt,
     suggestedNextAction: digest.suggestedNextActions[0],
-    detailPointer: { tool: 'work_get', work_id: job.jobId },
+    detailPointer: { tool: 'rh_work', operation: 'get', work_id: job.jobId },
   };
 }
 
@@ -103,210 +124,6 @@ export function invalidFacadeOperation(tool: FacadeTool, operation: string): Cal
 }
 
 
-export function ageMs(value: string | undefined): number | undefined {
-  if (!value) return undefined;
-  const parsed = Date.parse(value);
-  return Number.isFinite(parsed) ? Math.max(0, Date.now() - parsed) : undefined;
-}
-
-export async function probeLocalControllerHealth(endpoint: string | undefined): Promise<Record<string, unknown> | null> {
-  if (!endpoint) return null;
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 1_500);
-  try {
-    const url = new URL(endpoint);
-    url.pathname = '/health';
-    url.search = '';
-    url.hash = '';
-    const response = await fetch(url, { signal: controller.signal, headers: { accept: 'application/json' } });
-    if (!response.ok) return null;
-    return await response.json() as Record<string, unknown>;
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-
-export function localControllerDiagnosticMatchesRuntime(
-  payload: Record<string, unknown> | null,
-  expected: { generation?: string } = {},
-): boolean {
-  return payload?.status === 'ok'
-    && payload.toolSurface === FORGE_TOOL_SURFACE
-    && payload.schemaVersion === FORGE_MCP_SCHEMA_VERSION
-    && payload.version === FORGE_VERSION
-    && (expected.generation === undefined || payload.generation === expected.generation);
-}
-
-export interface ControllerReadinessSignals {
-  externalEndpoint?: GradedObservation;
-  mcpHandshake?: GradedObservation;
-  sessionContinuity?: GradedObservation;
-}
-
-export async function controllerReadinessEvidence(
-  ctx: MultiRepositoryMcpToolContext,
-  repository = ctx.explicitRepository,
-  signals: ControllerReadinessSignals = {},
-) {
-  const daemon = readForgeRuntimeStatus(ctx.controllerHome);
-  const scheduler = readSchedulerHealthSnapshot(ctx.controllerHome);
-  const projectionSnapshot = repository ? readRepositoryProjectionSnapshot(ctx.controllerHome, repository.repoId) : undefined;
-  const projection = projectionSnapshot?.projection;
-  const taskLedger = repository && !legacyIssueAuthorityRetired(repository.canonicalRoot)
-    ? buildControllerTaskLedgerProjection(repository.canonicalRoot)
-    : undefined;
-  const projectionReconciliation = projectionSnapshot
-    ? reconcileReadinessProjectionSource(projectionSnapshot, taskLedger)
-    : undefined;
-  const localBridgeSurface = repository
-    ? resolveLocalBridgeSurface({
-      controllerHome: ctx.controllerHome,
-      repoRoot: repository.canonicalRoot,
-      allowProcessScan: false,
-    })
-    : undefined;
-  const localBridgeEndpoint = localBridgeSurface?.endpoint;
-  const shouldProbeLocalBridge = Boolean(
-    localBridgeSurface?.enabled
-    && localBridgeSurface.endpointConfigured
-    && localBridgeEndpoint
-    && localBridgeSurface.mode !== 'disabled',
-  );
-  const localBridgeLiveHealth = shouldProbeLocalBridge
-    ? await probeLocalControllerHealth(localBridgeEndpoint)
-    : null;
-  const localBridgeEndpointReachable = localBridgeLiveHealth !== null;
-  const localBridgeExpectedSurface = shouldProbeLocalBridge
-    ? localControllerDiagnosticMatchesRuntime(localBridgeLiveHealth, {
-      generation: localBridgeSurface?.generation,
-    })
-    : true;
-  const schedulerHeartbeatAgeMs = ageMs(scheduler.lastTickAt);
-  const dispatchHeartbeatAgeMs = ageMs(scheduler.lastDispatchAt);
-  const localBridgeObservation = {
-    enabled: localBridgeSurface?.enabled ?? false,
-    requiredForReadiness: localBridgeSurface?.requiredForReadiness ?? false,
-    mode: localBridgeSurface?.mode ?? ('disabled' as const),
-    endpoint: localBridgeEndpoint,
-    endpointReachable: shouldProbeLocalBridge ? localBridgeEndpointReachable : true,
-    expectedSurface: localBridgeExpectedSurface,
-    processAlive: localBridgeSurface?.processRunning,
-    runtimeStateFresh: localBridgeSurface?.source === 'service-runtime'
-      || localBridgeSurface?.source === 'repo-runtime',
-    error: localBridgeSurface?.error,
-  };
-  const runtimeHealth = evaluateRuntimeHealth({
-    daemon: {
-      status: daemon.status,
-      error: daemon.error,
-      // Scheduler ticks are emitted by the Canonical Forge Runtime process and provide
-      // its continuously refreshed heartbeat without introducing a second timer.
-      heartbeatAgeMs: schedulerHeartbeatAgeMs,
-    },
-    scheduler: {
-      status: daemon.degraded ? 'degraded' : daemon.status,
-      heartbeatAgeMs: schedulerHeartbeatAgeMs,
-      dispatchHeartbeatAgeMs,
-    },
-    workers: {
-      queueDepth: projection?.queueDepth,
-      runningWorkers: projection?.runningWorkers,
-      activeLeases: projection?.activeLeases,
-      activeAttentionCount: projection?.currentAttention.length,
-    },
-    projection: projectionSnapshot ? projectionObservation(projectionSnapshot, projectionReconciliation) : {
-      readable: true,
-      persisted: true,
-    },
-    localBridge: localBridgeObservation,
-    runtimeStorage: { readable: true, ready: true },
-    ...signals,
-  });
-  const operationalView: RuntimeOperationalView = buildRuntimeOperationalView({
-    health: runtimeHealth,
-    handoffs: repository
-      ? listHandoffItems({ controllerHome: ctx.controllerHome, repoId: repository.repoId, status: 'all', limit: 100 })
-      : [],
-    jobs: repository ? listExecutionJobs(ctx.controllerHome, repository.repoId, 100) : [],
-  });
-  const reasons: Array<{ code: string; message: string }> = runtimeHealth.activeBlockers.map((item) => ({
-    code: item.code === 'SCHEDULER_NOT_PROGRESSING'
-      ? 'DISPATCH_LOOP_STALLED'
-      : item.code === 'LEASE_WITHOUT_WORKER' || item.code === 'WORKER_NOT_RUNNING'
-        ? 'WORKER_NOT_RUNNING'
-        : item.code,
-    message: item.message,
-  }));
-  if (
-    reasons.some((item) => item.code === 'WORKER_NOT_RUNNING')
-    && (dispatchHeartbeatAgeMs === undefined || dispatchHeartbeatAgeMs > RUNTIME_HEALTH_THRESHOLDS.queueProgressStaleMs)
-  ) {
-    reasons.push({
-      code: 'QUEUE_NOT_PROGRESSING',
-      message: 'Queued Jobs have not received a recent dispatch heartbeat.',
-    });
-  }
-  const ready = runtimeHealth.ready;
-  return {
-    ready,
-    state: ready ? runtimeHealth.state === 'healthy' ? 'ready' as const : 'degraded' as const : daemon.status === 'ready' ? 'degraded' as const : 'not_ready' as const,
-    reasons,
-    warnings: runtimeHealth.warnings.map((item) => ({ code: item.code, message: item.message })),
-    health: runtimeHealth,
-    operationalView,
-    daemon,
-    durableScheduler: {
-      status: runtimeHealth.components.scheduler.ready ? 'ready' : daemon.status === 'ready' ? 'degraded' : 'not_ready',
-      loopStartedAt: scheduler.loopStartedAt,
-      lastTickAt: scheduler.lastTickAt,
-      lastDispatchAt: scheduler.lastDispatchAt,
-      lastReconcileAt: scheduler.lastReconcileAt,
-      heartbeatAgeMs: schedulerHeartbeatAgeMs,
-      dispatchHeartbeatAgeMs,
-    },
-    workerLoop: {
-      status: projection?.runningWorkers ? 'running' : projection?.queueDepth ? 'idle' : 'ready',
-      queueDepth: projection?.queueDepth ?? 0,
-      runningWorkers: projection?.runningWorkers ?? 0,
-      activeLeases: projection?.activeLeases ?? 0,
-      activeAttentionCount: projection?.currentAttention.length ?? 0,
-      consuming: (projection?.queueDepth ?? 0) === 0 || (projection?.runningWorkers ?? 0) > 0,
-    },
-    localBridge: repository ? {
-      running: Boolean(localBridgeSurface?.enabled)
-        && runtimeHealth.components.localBridge.ready
-        && (!shouldProbeLocalBridge || (localBridgeEndpointReachable && localBridgeExpectedSurface)),
-      endpoint: localBridgeEndpoint,
-      error: localBridgeSurface?.error,
-      inferredPid: localBridgeSurface?.pid,
-      statusSource: localBridgeSurface?.source ?? 'none',
-      health: runtimeHealth.components.localBridge,
-    } : undefined,
-    projection,
-    projectionSnapshot,
-    taskLedger,
-    projectionReconciliation,
-    semantics: classifyRuntimeReadinessSemantics(runtimeHealth),
-  };
-}
-
-export function runtimeSourceSnapshotStatus(
-  active: RuntimeSourceIdentity | undefined,
-  currentRuntimeRoot?: string,
-) {
-  const drift = evaluateActiveRuntimeSourceDrift(active, {
-    currentRuntimeRoot,
-  });
-  return {
-    current: drift.current,
-    restartRequired: drift.restartRequired,
-    reasons: drift.reasons,
-    code: drift.code,
-  };
-}
-
 export function repositoryExecutionReadiness(
   repoRoot: string,
   availableChecks: ReturnType<typeof listControllerChecks>,
@@ -406,21 +223,35 @@ export async function callStatusInboxAdapter(
   ports: StatusInboxAdapterPorts,
 ): Promise<CallToolResult | undefined> {
   if (name === 'rh_status') {
-      const repository = selected(ctx, args);
+      const repository = selectedOptional(ctx, args);
       const operation = String(args.operation ?? 'get');
       if (!allowedFacadeOperations('rh_status').includes(operation)) {
         return invalidFacadeOperation('rh_status', operation);
       }
-      const store = {
-        controllerHome: ctx.controllerHome,
-        repoId: repository.repoId,
-        revisionContains: (ancestorRevision: string, descendantRevision: string) =>
-          repositoryRevisionContains(repository.canonicalRoot, ancestorRevision, descendantRevision),
-      };
+      // Instance-level status stays available with zero (or several) registered
+      // repositories: only the repository-derived sections need a target.
+      const store = repository
+        ? {
+            controllerHome: ctx.controllerHome,
+            repoId: repository.repoId,
+            revisionContains: (ancestorRevision: string, descendantRevision: string) =>
+              repositoryRevisionContains(repository.canonicalRoot, ancestorRevision, descendantRevision),
+          }
+        : undefined;
       if (operation === 'repair') {
+        if (!repository) {
+          return result(buildFacadeResult({
+            status: 'blocked',
+            summary: 'REPOSITORY_CONTEXT_REQUIRED_FOR_REPAIR: rh_status repair needs an explicit repository target.',
+            data: { operation, repositoryContext: null },
+          }) as unknown as Record<string, unknown>, true);
+        }
         return await ports.repair(ctx, repository, args);
       }
-      const detailLevel = args.detail_level === 'detail' ? 'detail' : 'summary';
+      const requestedDetailLevel = args.detail_level === 'detail' ? 'detail' : 'summary';
+      // Repository detail needs a repository; the instance-level summary remains
+      // available and reports the downgrade explicitly instead of failing.
+      const detailLevel = repository ? requestedDetailLevel : 'summary';
       if (detailLevel === 'summary') {
         const startedAt = performance.now();
         let summaryTimingMark = startedAt;
@@ -435,8 +266,8 @@ export async function callStatusInboxAdapter(
         // Summary answers only whether this repository can work now. Reuse one
         // porcelain-v2 sample for branch/HEAD/dirty and avoid the full Git
         // status/diff-stat, access-policy, and inventory construction paths.
-        const repositoryIdentity = cachedGitIdentity(repository.canonicalRoot);
-        const repositoryIdentityAgeMs = Math.max(0, Date.now() - repositoryIdentity.sampledAt);
+        const repositoryIdentity = repository ? cachedGitIdentity(repository.canonicalRoot) : undefined;
+        const repositoryIdentityAgeMs = repositoryIdentity ? Math.max(0, Date.now() - repositoryIdentity.sampledAt) : undefined;
         markSummaryPhase('git');
         const runtimeGeneration = readRuntimeGeneration(ctx.controllerHome);
         const runtimeSource = runtimeSourceSnapshotStatus(
@@ -457,29 +288,39 @@ export async function callStatusInboxAdapter(
             : 'RUNTIME_SOURCE_SNAPSHOT_STALE');
         const runtimeReadiness = observation.snapshot?.readiness;
         const releaseDiagnostic = runtimeReadiness?.diagnostics.releaseCoherence;
-        const activeWorkProjection = readActiveWorkCandidates({ ...store, limit: 3 });
+        const activeWorkProjection = repository && store
+          ? readActiveWorkCandidates({ ...store, limit: 3 })
+          : { contracts: [], invalid: [] };
         const activeWorkSnapshot = activeWorkProjection.contracts.map((entry) => ({
           workId: entry.workId,
-          status: entry.status,
-          mode: entry.mode,
+          state: entry.semanticState,
           objective: entry.objective.slice(0, 160),
           semantics: buildWorkContinuationSnapshot(entry).semantics,
           nextSafeAction: buildWorkContinuationSnapshot(entry).nextSafeAction,
         }));
-        const activePlanSnapshot = listPlanContracts({ ...store, status: 'active', limit: 3 }).map(summarizePlanContract);
-        const pendingHandoffAttention = listHandoffAttentionItems(store, 100);
+        // Plans are authored semantic context: without a repository target the
+        // instance-level semantic scope carries them.
+        const activePlanSnapshot = (repository && store
+          ? listPlanContracts({ ...store, status: 'active', limit: 3 })
+          : listPlanContracts({ controllerHome: ctx.controllerHome, scopeKey: SEMANTIC_SCOPE_KEY, status: 'active', limit: 3 })
+        ).map(summarizePlanContract);
+        const pendingHandoffAttention = store ? listHandoffAttentionItems(store, 100) : [];
         const pendingHandoffSnapshot = pendingHandoffAttention.slice(0, 4);
         const pendingHandoffCount = pendingHandoffAttention.length;
         markSummaryPhase('controller_state');
-        const preferredFacadeTools = ['rh_access', 'rh_status', 'rh_inbox', 'rh_context', 'rh_work'] as const;
+        const preferredFacadeTools = ['rh_access', 'rh_status', 'rh_inbox', 'rh_context', 'rh_work', 'capability_execute'] as const;
         const facade = buildFacadeResult({
           status: ready ? 'ok' : 'blocked',
           summary: ready ? 'Controller and MCP tool surface are ready for bounded work.' : 'Controller or MCP tool surface needs attention before work.',
           data: {
             operation,
-            repoId: repository.repoId,
+            ...(repository ? { repoId: repository.repoId } : {}),
+            /** Null means this answer is ForgeInstance-scoped, not repository-scoped. */
+            repositoryContext: repository ? { repoId: repository.repoId, checkoutId: repository.activeCheckoutId } : null,
+            requestedDetailLevel,
             readiness: {
               ready,
+              readyFor: 'bounded_execution',
               reasonCodes: [...new Set(reasonCodes)],
               diagnostics: {
                 runtime: { ready: observation.ready },
@@ -503,6 +344,11 @@ export async function callStatusInboxAdapter(
                 },
                 semantics: {
                   executionReady: observation.ready,
+                  // Summary is intentionally the cheap Runtime snapshot path. It
+                  // reports bounded execution readiness without pretending that the
+                  // full scheduler/worker diagnostics for unattended continuation ran.
+                  autonomousContinuationReady: null,
+                  autonomousContinuationBlockers: null,
                   maintenanceHealthy: null,
                   maintenanceCandidateCount: 0,
                   releaseReady: releaseDiagnostic?.outcome === 'pass',
@@ -513,21 +359,23 @@ export async function callStatusInboxAdapter(
               },
               observedAt: observation.observedAt,
             },
-            repositoryState: {
-              branch: repositoryIdentity.branch,
-              head: repositoryIdentity.head,
-              dirty: repositoryIdentity.dirty,
-              observedAt: new Date(repositoryIdentity.sampledAt).toISOString(),
-              observationAgeMs: repositoryIdentityAgeMs,
-              observationMaxAgeMs: GIT_IDENTITY_SAMPLE_TTL_MS,
-              observationPolicy: 'bounded_sample_with_mutation_invalidation',
-              sourceSnapshotAgeMs: runtimeGeneration?.source.observedAt
-                ? Math.max(0, Date.now() - Date.parse(runtimeGeneration.source.observedAt))
-                : undefined,
-              sourceSnapshotStale,
-              sourceSnapshotReasons: runtimeSource.reasons,
-              runtimeSourceDirty: runtimeSource.current?.dirty === true,
-            },
+            repositoryState: repositoryIdentity
+              ? {
+                  branch: repositoryIdentity.branch,
+                  head: repositoryIdentity.head,
+                  dirty: repositoryIdentity.dirty,
+                  observedAt: new Date(repositoryIdentity.sampledAt).toISOString(),
+                  observationAgeMs: repositoryIdentityAgeMs,
+                  observationMaxAgeMs: GIT_IDENTITY_SAMPLE_TTL_MS,
+                  observationPolicy: 'bounded_sample_with_mutation_invalidation',
+                  sourceSnapshotAgeMs: runtimeGeneration?.source.observedAt
+                    ? Math.max(0, Date.now() - Date.parse(runtimeGeneration.source.observedAt))
+                    : undefined,
+                  sourceSnapshotStale,
+                  sourceSnapshotReasons: runtimeSource.reasons,
+                  runtimeSourceDirty: runtimeSource.current?.dirty === true,
+                }
+              : null,
             toolArchitecture: {
               facadeTools: [...preferredFacadeTools],
               domainSchemaLoading: 'status_summary_runtime_snapshot',
@@ -581,6 +429,15 @@ export async function callStatusInboxAdapter(
         (payload.responseMeta as { structuredPayloadBytes: number }).structuredPayloadBytes = Buffer.byteLength(JSON.stringify(payload), 'utf8');
         return result(payload, facade.status !== 'ok');
       }
+      // Detail is repository-derived; without a repository target the requested
+      // detail level was already downgraded to the instance-level summary above.
+      if (!repository || !store) {
+        return result(buildFacadeResult({
+          status: 'blocked',
+          summary: 'REPOSITORY_CONTEXT_REQUIRED_FOR_DETAIL: rh_status detail needs an explicit repository target.',
+          data: { operation, repositoryContext: null },
+        }) as unknown as Record<string, unknown>, true);
+      }
       const detailTimingStartedAt = performance.now();
       let detailTimingMark = detailTimingStartedAt;
       const detailPhaseTimingsMs: Record<string, number> = {};
@@ -647,8 +504,77 @@ export async function callStatusInboxAdapter(
         });
       }
       const toolSurfaceComputed = exposure.expectedToolNames.length > 0 || exposure.actualToolNames.length > 0 || toolSurfaceReady;
+      const activeReleaseAuthority = readRuntimeReleaseAuthority(ctx.controllerHome);
+      let autonomousContinuationProof: Awaited<ReturnType<typeof getWorkflowSupervisorContinuationProof>>;
+      let autonomousContinuationProofObservation: 'proven' | 'missing' | 'unavailable' = 'missing';
+      if (activeReleaseAuthority?.committedAt) {
+        try {
+          autonomousContinuationProof = await getWorkflowSupervisorContinuationProof(
+            resolveWorkflowSupervisorForgeHome(ctx.controllerHome),
+            {
+              repoId: repository.repoId,
+              activeReleaseId: activeReleaseAuthority.active.releaseId,
+              notBefore: activeReleaseAuthority.committedAt,
+            },
+          );
+          autonomousContinuationProofObservation = autonomousContinuationProof ? 'proven' : 'missing';
+        } catch {
+          autonomousContinuationProofObservation = 'unavailable';
+        }
+      }
+      let autonomousContinuationConsumerStatus: Awaited<ReturnType<typeof getWorkflowSupervisorConsumerStatus>> | undefined;
+      let autonomousContinuationConsumerObservation: 'observed' | 'unavailable' = 'unavailable';
+      try {
+        autonomousContinuationConsumerStatus = await getWorkflowSupervisorConsumerStatus(
+          resolveWorkflowSupervisorForgeHome(ctx.controllerHome),
+        );
+        autonomousContinuationConsumerObservation = 'observed';
+      } catch {
+        autonomousContinuationConsumerObservation = 'unavailable';
+      }
+      const dueConsumerFailure = Boolean(
+        autonomousContinuationConsumerStatus?.dueCommand
+        && autonomousContinuationConsumerStatus.lastFailure
+        && (!autonomousContinuationConsumerStatus.lastFailure.effectId
+          || autonomousContinuationConsumerStatus.lastFailure.effectId === autonomousContinuationConsumerStatus.dueCommand.effectId),
+      );
+      const autonomousContinuationConsumerReady = autonomousContinuationConsumerObservation === 'observed'
+        && autonomousContinuationConsumerStatus?.enabled === true
+        && autonomousContinuationConsumerStatus.running === true
+        && autonomousContinuationConsumerStatus.lastTickStartedAt !== undefined
+        && autonomousContinuationConsumerStatus.stalled === false
+        && !dueConsumerFailure;
+      const autonomousContinuationReady = readiness.ready
+        && toolSurfaceReady
+        && !sourceSnapshotStale
+        && autonomousContinuationProofObservation === 'proven'
+        && autonomousContinuationConsumerReady;
+      const autonomousContinuationBlockers = [...new Set([
+        ...readinessReasons
+          .map((reason) => reason.code)
+          .filter((code): code is string => typeof code === 'string' && code.length > 0),
+        ...(autonomousContinuationProofObservation === 'proven'
+          ? []
+          : [autonomousContinuationProofObservation === 'unavailable'
+              ? 'AUTONOMOUS_CONTINUATION_LIVE_PROOF_UNAVAILABLE'
+              : 'AUTONOMOUS_CONTINUATION_LIVE_PROOF_MISSING']),
+        ...(autonomousContinuationConsumerObservation === 'unavailable'
+          ? ['AUTONOMOUS_CONTINUATION_CONSUMER_STATUS_UNAVAILABLE']
+          : autonomousContinuationConsumerStatus?.enabled !== true
+            ? ['AUTONOMOUS_CONTINUATION_CONSUMER_DISABLED']
+            : autonomousContinuationConsumerStatus.running !== true
+              ? ['AUTONOMOUS_CONTINUATION_CONSUMER_NOT_RUNNING']
+              : autonomousContinuationConsumerStatus.lastTickStartedAt === undefined
+                ? ['AUTONOMOUS_CONTINUATION_CONSUMER_NOT_OBSERVED']
+                : autonomousContinuationConsumerStatus.stalled
+                  ? ['AUTONOMOUS_CONTINUATION_CONSUMER_STALLED']
+                  : dueConsumerFailure
+                    ? ['AUTONOMOUS_CONTINUATION_CONSUMER_DEGRADED']
+                    : []),
+      ])];
       const readinessWithToolSurface = {
         ready: effectiveReady,
+        readyFor: 'bounded_execution' as const,
         reasonCodes: [...new Set(
           readinessReasons
             .map((reason) => reason.code)
@@ -672,6 +598,22 @@ export async function callStatusInboxAdapter(
           },
           semantics: {
             executionReady,
+            // Runtime/tool health is necessary but not sufficient. Thin acceptance
+            // requires a fresh exact-active-release Supervisor ledger proof of
+            // CONTINUE -> CONTINUE -> DONE spanning at least one Runtime reconnect.
+            autonomousContinuationReady,
+            autonomousContinuationBlockers,
+            autonomousContinuationConsumer: {
+              observation: autonomousContinuationConsumerObservation,
+              ...(autonomousContinuationConsumerStatus ? { status: autonomousContinuationConsumerStatus } : {}),
+            },
+            autonomousContinuationProof: {
+              observation: autonomousContinuationProofObservation,
+              activeReleaseId: activeReleaseAuthority?.active.releaseId,
+              activeReleaseAuthorityRevision: activeReleaseAuthority?.revision,
+              activeReleaseCommittedAt: activeReleaseAuthority?.committedAt,
+              ...(autonomousContinuationProof ? { proof: autonomousContinuationProof } : {}),
+            },
             maintenanceHealthy,
             maintenanceCandidateCount,
             maintenanceObservation,
@@ -712,14 +654,62 @@ export async function callStatusInboxAdapter(
         .map((processId) => getProcessRecord(ctx.controllerHome, repository.repoId, processId))
         .filter((process): process is NonNullable<typeof process> => Boolean(process && isManagedProcessActive(process)));
       markDetailPhase('process_state');
-      const activeProcessWorkIds = new Set(activeProcessRecords.map((process) => process.workId).filter((workId): workId is string => Boolean(workId)));
-      const activeControllerWorkIds = new Set(activePrimaryWork.filter((contract) => Boolean(getControllerSession({ controllerHome: ctx.controllerHome, repoId: repository.repoId }, contract.workId))).map((contract) => contract.workId));
-      const executingPrimaryWorkIds = new Set([...activeProcessWorkIds, ...activeControllerWorkIds].filter((workId) => activePrimaryWork.some((contract) => contract.workId === workId)));
+      const activePrimaryWorkIds = new Set(activePrimaryWork.map((contract) => contract.workId));
+      const activeProcessWorkIds = new Set(
+        activeProcessRecords
+          .map((process) => process.workId)
+          .filter((workId): workId is string => Boolean(workId && activePrimaryWorkIds.has(workId))),
+      );
+      const activeControllerWorkIds = new Set(
+        activePrimaryWork
+          .filter((contract) => Boolean(getControllerSession({ controllerHome: ctx.controllerHome, repoId: repository.repoId }, contract.workId)))
+          .map((contract) => contract.workId),
+      );
+      const runningPrimaryWorkIds = new Set([...activeProcessWorkIds, ...activeControllerWorkIds]);
       markDetailPhase('controller_sessions');
-      const preferredFacadeTools = ['rh_access', 'rh_status', 'rh_inbox', 'rh_context', 'rh_work'] as const;
+
+      const waitingForUserPrimaryWorkIds = new Set(
+        pendingHandoffAttention
+          .map((item) => item.workId?.trim())
+          .filter((workId): workId is string => Boolean(workId && activePrimaryWorkIds.has(workId))),
+      );
+      const schedules = listSchedules(ctx.controllerHome, repository.repoId);
+      const activeOccurrenceScheduleIds = new Set(
+        listActiveOccurrences(ctx.controllerHome, repository.repoId).map((occurrence) => occurrence.scheduleId),
+      );
+      const scheduledPrimaryWorkIds = new Set<string>();
+      for (const schedule of schedules) {
+        if (!schedule.enabled && !activeOccurrenceScheduleIds.has(schedule.scheduleId)) continue;
+        for (const workId of activePrimaryWorkIds) {
+          if (scheduleOwnsWork(schedule, workId)) scheduledPrimaryWorkIds.add(workId);
+        }
+      }
+      const primaryWorkActivities = activePrimaryWork.map((contract) => ({
+        workId: contract.workId,
+        activity: primaryWorkRuntimeActivity({
+          running: runningPrimaryWorkIds.has(contract.workId),
+          waitingForUser: waitingForUserPrimaryWorkIds.has(contract.workId),
+          scheduled: scheduledPrimaryWorkIds.has(contract.workId),
+          needsReconciliation: buildWorkContinuationSnapshot(contract).reconciliationRequired,
+        }),
+      }));
+      const primaryWorkActivityCounts: Record<PrimaryWorkRuntimeActivity, number> = {
+        running: 0,
+        waiting_for_user: 0,
+        scheduled: 0,
+        recoverable: 0,
+        needs_reconciliation: 0,
+      };
+      for (const projection of primaryWorkActivities) primaryWorkActivityCounts[projection.activity] += 1;
+      markDetailPhase('work_activity');
+      const preferredFacadeTools = ['rh_access', 'rh_status', 'rh_inbox', 'rh_context', 'rh_work', 'capability_execute'] as const;
       const facade = buildFacadeResult({
         status: effectiveReady ? 'ok' : 'blocked',
-        summary: effectiveReady ? 'Controller and MCP tool surface are ready for bounded work.' : 'Controller or MCP tool surface needs attention before work.',
+        summary: effectiveReady
+          ? autonomousContinuationReady
+            ? 'Controller and MCP tool surface are ready for bounded work and autonomous continuation.'
+            : 'Controller and MCP tool surface are ready for bounded work; autonomous continuation needs attention.'
+          : 'Controller or MCP tool surface needs attention before bounded work.',
         data: {
           operation,
           repoId: repository.repoId,
@@ -750,8 +740,8 @@ export async function callStatusInboxAdapter(
           activePrimaryWorkCount: activePrimaryWork.length,
           activeExecutionChildCount: activeExecutionChildren.length,
           activeProcessCount: activeProcessRecords.length,
-          executingPrimaryWorkCount: executingPrimaryWorkIds.size,
-          waitingPrimaryWorkCount: Math.max(0, activePrimaryWork.length - executingPrimaryWorkIds.size),
+          primaryWorkActivityCounts,
+          primaryWorkActivities,
           activeContractCount: activeContracts.length,
           invalidActiveContractCount: activeWorkProjection.invalid.length,
           invalidActiveContracts: activeWorkProjection.invalid.slice(0, 10).map(summarizeInvalidActiveWorkCandidate),
@@ -792,10 +782,118 @@ export async function callStatusInboxAdapter(
   return undefined;
 }
 
+function summarizeUserRequest(request: UserRequest) {
+  return {
+    requestId: request.requestId,
+    kind: request.kind,
+    title: request.title,
+    summary: request.summary,
+    actionRequired: request.actionRequired,
+    status: request.status,
+    targetScope: request.targetScope,
+    resolution: request.resolution,
+    updatedAt: request.updatedAt,
+  };
+}
+
+// `request_id` is Process Runtime idempotency/correlation only. UserRequest
+// selection stays on `handoff_id` so retry identity can never change Inbox semantics.
+export function findCanonicalUserRequest(controllerHome: string, args: Record<string, unknown>): UserRequest | undefined {
+  const handoffId = typeof args.handoff_id === 'string' ? args.handoff_id.trim() : '';
+  if (!handoffId) return undefined;
+  return getUserRequest(controllerHome, handoffId)
+    ?? listUserRequests(controllerHome, 'all').find((request) => request.presentation?.legacyHandoffId === handoffId);
+}
+
+export function shouldUseCanonicalUserRequestInbox(
+  repositoryRepoId: string | undefined,
+  operation: string,
+  request: UserRequest | undefined,
+): boolean {
+  if (!repositoryRepoId) return true;
+  if (operation === 'list' || operation === 'create') return false;
+  return Boolean(request && !request.targetScope?.repoId?.trim());
+}
+
+function callCanonicalUserRequestInbox(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>, operation: string): CallToolResult {
+  const limit = Math.max(1, Math.min(Math.trunc(typeof args.limit === 'number' ? args.limit : 50), 100));
+  if (operation === 'list') {
+    const items = listUserRequests(ctx.controllerHome, 'pending').slice(0, limit);
+    return result(buildFacadeResult({
+      summary: items.length ? `${items.length} pending UserRequest item(s).` : 'No pending UserRequest items.',
+      data: { items: items.map(summarizeUserRequest) },
+      suggestedNextActions: items.slice(0, 1).map((item) => ({ label: `Read ${item.requestId}`, tool: 'rh_inbox', operation: 'get', payload: { handoff_id: item.requestId }, risk: 'readonly' as const })),
+    }) as unknown as Record<string, unknown>);
+  }
+  if (operation === 'create') {
+    const title = typeof args.title === 'string' ? args.title.trim() : '';
+    const summary = typeof args.summary === 'string' ? args.summary.trim() : typeof args.reason === 'string' ? args.reason.trim() : '';
+    if (!title || !summary) throw new Error('USER_REQUEST_TITLE_SUMMARY_REQUIRED');
+    const workId = typeof args.work_id === 'string' ? args.work_id.trim() : '';
+    const explicitId = typeof args.handoff_id === 'string' ? args.handoff_id.trim() : '';
+    const actionRequired = (typeof args.action_required === 'string' ? args.action_required : 'product_decision') as 'login' | 'grant_permission' | 'confirm_destructive' | 'product_decision';
+    const kind = (typeof args.request_kind === 'string' ? args.request_kind : actionRequired === 'product_decision' ? 'user_decision_request' : 'user_action_request') as 'user_action_request' | 'user_decision_request';
+    const rootCauseKey = typeof args.root_cause_key === 'string' && args.root_cause_key.trim()
+      ? args.root_cause_key.trim()
+      : `rh_inbox:${explicitId || workId || title}:${summary}`;
+    const item = recordUserRequest(ctx.controllerHome, {
+      ...(explicitId ? { requestId: explicitId } : {}),
+      kind,
+      rootCauseKey,
+      title,
+      summary,
+      actionRequired,
+      ...(workId ? { targetScope: { scopeKind: 'work', scopeId: workId, workId } } : {}),
+      presentation: {
+        ...(typeof args.handoff_id === 'string' && args.handoff_id.trim() ? { legacyHandoffId: args.handoff_id.trim() } : {}),
+        ...(typeof args.reason === 'string' ? { reason: args.reason } : {}),
+        ...(typeof args.recommended_decision === 'string' ? { recommendedDecision: args.recommended_decision } : {}),
+        ...(typeof args.recommended_prompt === 'string' ? { recommendedPrompt: args.recommended_prompt } : {}),
+      },
+    });
+    return result(buildFacadeResult({ summary: `Created UserRequest ${item.requestId}.`, data: { item: summarizeUserRequest(item) } }) as unknown as Record<string, unknown>);
+  }
+  const current = findCanonicalUserRequest(ctx.controllerHome, args);
+  if (operation === 'get') {
+    const facade = buildFacadeResult({
+      status: current ? 'ok' : 'not_found',
+      summary: current ? `UserRequest ${current.requestId}.` : 'UserRequest not found.',
+      data: { item: current ? summarizeUserRequest(current) : undefined },
+      suggestedNextActions: current?.status === 'pending' ? [{ label: 'Resolve request', tool: 'rh_inbox', operation: 'resolve', payload: { request_id: current.requestId }, risk: 'workspace_write' }] : [],
+    });
+    return result(facade as unknown as Record<string, unknown>, facade.status === 'not_found');
+  }
+  if (!current) throw new Error('USER_REQUEST_NOT_FOUND');
+  if (operation === 'ack' || operation === 'accept') {
+    return result(buildFacadeResult({
+      summary: `${operation === 'accept' ? 'Accepted' : 'Acknowledged'} UserRequest ${current.requestId}; semantic state remains pending until resolve/dismiss.`,
+      data: { item: summarizeUserRequest(current), compatibilityNoop: true },
+    }) as unknown as Record<string, unknown>);
+  }
+  if (operation === 'resolve' || operation === 'dismiss') {
+    const decision = operation === 'dismiss'
+      ? (typeof args.decision === 'string' && args.decision.trim() ? args.decision.trim() : 'dismissed')
+      : (typeof args.decision === 'string' ? args.decision.trim() : '');
+    if (!decision) throw new Error('USER_REQUEST_DECISION_REQUIRED');
+    const resolved = resolveUserRequest(ctx.controllerHome, {
+      requestId: current.requestId,
+      decision,
+      resolvedBy: typeof args.resolver === 'string' && args.resolver.trim() ? args.resolver.trim() : (ctx.principalId?.trim() || 'mcp-user'),
+    });
+    return result(buildFacadeResult({ summary: `Resolved UserRequest ${resolved.requestId}.`, data: { item: summarizeUserRequest(resolved) } }) as unknown as Record<string, unknown>);
+  }
+  throw new Error(`USER_REQUEST_OPERATION_UNSUPPORTED:${operation}`);
+}
+
 async function callInboxAdapter(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): Promise<CallToolResult> {
-  const repository = selected(ctx, args);
+  const repository = selectedOptional(ctx, args);
   const operation = String(args.operation ?? 'list');
   if (!allowedFacadeOperations('rh_inbox').includes(operation)) return invalidFacadeOperation('rh_inbox', operation);
+  const canonicalRequest = findCanonicalUserRequest(ctx.controllerHome, args);
+  if (shouldUseCanonicalUserRequestInbox(repository?.repoId, operation, canonicalRequest)) {
+    return callCanonicalUserRequestInbox(ctx, args, operation);
+  }
+  if (!repository) throw new Error('REPOSITORY_CONTEXT_REQUIRED_FOR_HANDOFF');
   const app = await runHandoffInboxApplication({
     operation: operation as 'get' | 'list' | 'ack' | 'accept' | 'resolve' | 'dismiss' | 'create',
     store: { controllerHome: ctx.controllerHome, repoId: repository.repoId },
@@ -814,13 +912,7 @@ async function callInboxAdapter(ctx: MultiRepositoryMcpToolContext, args: Record
     resolver: typeof args.resolver === 'string' ? args.resolver : undefined,
     controllerIdentity: { principalId: ctx.principalId, sessionId: ctx.sessionId },
   }, {
-    triggerResolvedContinuation: (item) => triggerWorkContinuationRepositoryEvent(
-      ctx.controllerHome,
-      repository.repoId,
-      handoffResolvedContinuationEventName(item.id),
-      `handoff:${item.id}:${item.updatedAt}`,
-      { workId: item.workId, data: { handoffId: item.id, status: item.status, decision: item.decision } },
-    ),
+    triggerResolvedContinuation: (item) => triggerResolvedHandoffContinuation(ctx.controllerHome, repository.repoId, item),
   });
   if (operation === 'get') {
     const item = 'item' in app ? app.item : undefined;