@moretea-labs/forge 1.8.0 → 1.8.1

package/src/cli/commands/recovery.ts

@@ -19,8 +19,7 @@ import {
 } from '../repositories/controller-home';
 import { FORGE_VERSION } from '../../version';
 import {
-  RECOVERY_GATEWAY_LABEL,
-  RECOVERY_WATCHDOG_LABEL,
+  RECOVERY_DAEMON_LABEL,
   inspectRecoveryTunnelLaunchdContract,
   installStandaloneRecovery,
   recoveryLaunchdPid,
@@ -37,6 +36,7 @@ import {
   activateRuntimeRelease,
   defaultPrimaryRuntimeServiceConfig,
   loadRecoveryConfig,
+  normalizeRecoveryInstallProfile,
   recoverPrimaryRuntime,
   recoveryMachineIdentity,
   restartPrimaryConnector,
@@ -149,12 +149,57 @@ export type { RecoveryControllerHomeMigrationPreflight };
 export interface RecoveryConnectorDependencies {
   platform?: NodeJS.Platform;
   pathExists?: (path: string) => boolean;
-  launchdPid?: (role: 'gateway' | 'watchdog') => number | undefined;
-  systemdPid?: (role: 'gateway' | 'watchdog') => number | undefined;
+  launchdPid?: (role: 'daemon') => number | undefined;
+  systemdPid?: (role: 'daemon') => number | undefined;
   tunnelLaunchdPid?: (label: string) => number | undefined;
   tunnelSystemdPid?: (unitName: string) => number | undefined;
   openAiTunnelStatus?: (service: OpenAiSecureTunnelServiceConfig) => OpenAiSecureTunnelRuntimeObservation;
   processAlive?: (pid: number) => boolean;
+  processParentPid?: (pid: number) => number | undefined;
+}
+
+function recoveryProcessParentPid(pid: number): number | undefined {
+  if (process.platform === 'win32' || !Number.isInteger(pid) || pid <= 1) return undefined;
+  const result = spawnSync('ps', ['-o', 'ppid=', '-p', String(pid)], {
+    encoding: 'utf8',
+    timeout: 2_000,
+    maxBuffer: 8 * 1024,
+  });
+  if (result.status !== 0) return undefined;
+  const parent = Number.parseInt((result.stdout ?? '').trim(), 10);
+  return Number.isInteger(parent) && parent > 0 ? parent : undefined;
+}
+
+/**
+ * launchd may own a tiny wrapper (/usr/bin/env) while Recovery records the
+ * compiled child PID in its runtime identity. Treat only that bounded process
+ * lineage as the same managed service; unrelated live PIDs still fail closed.
+ */
+export function recoveryManagedServiceOwnsRuntimeProcess(
+  managedPid: number | undefined,
+  runtimePid: number | undefined,
+  dependencies: {
+    processAlive?: (pid: number) => boolean;
+    processParentPid?: (pid: number) => number | undefined;
+    maxDepth?: number;
+  } = {},
+): boolean {
+  if (!managedPid || !runtimePid || managedPid <= 0 || runtimePid <= 0) return false;
+  const processAlive = dependencies.processAlive ?? isProcessAlive;
+  if (!processAlive(managedPid) || !processAlive(runtimePid)) return false;
+  if (managedPid === runtimePid) return true;
+  const parentPid = dependencies.processParentPid ?? recoveryProcessParentPid;
+  const maxDepth = Math.max(1, Math.min(Math.trunc(dependencies.maxDepth ?? 8), 32));
+  const visited = new Set<number>([runtimePid]);
+  let current = runtimePid;
+  for (let depth = 0; depth < maxDepth; depth += 1) {
+    const parent = parentPid(current);
+    if (!parent || parent <= 0 || visited.has(parent)) return false;
+    if (parent === managedPid) return true;
+    visited.add(parent);
+    current = parent;
+  }
+  return false;
 }
 
 export interface RecoveryConnectorDescriptor {
@@ -174,8 +219,7 @@ export interface RecoveryConnectorDescriptor {
   };
   healthUrl: string;
   services: {
-    gateway: { label: string; platform: 'launchd' | 'systemd-user'; serviceInstalled: boolean; plistInstalled: boolean; running: boolean; pid?: number };
-    watchdog: { label: string; platform: 'launchd' | 'systemd-user'; serviceInstalled: boolean; plistInstalled: boolean; running: boolean; pid?: number };
+    recovery: { label: string; platform: 'launchd' | 'systemd-user'; serviceInstalled: boolean; plistInstalled: boolean; running: boolean; pid?: number };
     tunnel: {
       configured: boolean;
       platform?: 'launchd' | 'systemd-user' | 'openai-secure-tunnel';
@@ -208,15 +252,19 @@ export function recoveryConnectorDescriptor(
   const url = configuredUrl ?? `${localOrigin}/recovery/mcp`;
   const origin = new URL(url).origin;
   const passphraseConfigured = Boolean(readMcpServiceOAuthPassphrase(home));
-  const gatewayIdentity = readRecoveryRuntimeIdentity(home, 'gateway');
-  const watchdogIdentity = readRecoveryRuntimeIdentity(home, 'watchdog');
+  const recoveryIdentity = readRecoveryRuntimeIdentity(home, 'daemon');
   const platform = dependencies.platform ?? process.platform;
   const servicePlatform: 'launchd' | 'systemd-user' = platform === 'linux' ? 'systemd-user' : 'launchd';
   const pathExists = dependencies.pathExists ?? existsSync;
   const launchdPid = dependencies.launchdPid ?? recoveryLaunchdPid;
-  const systemdPid = dependencies.systemdPid ?? ((role: 'gateway' | 'watchdog') => systemdUserServicePid(role === 'gateway' ? RECOVERY_GATEWAY_LABEL : RECOVERY_WATCHDOG_LABEL));
-  const managedPid = (role: 'gateway' | 'watchdog') => servicePlatform === 'systemd-user' ? systemdPid(role) : launchdPid(role);
+  const systemdPid = dependencies.systemdPid ?? ((_role: 'daemon') => systemdUserServicePid(RECOVERY_DAEMON_LABEL));
+  const managedPid = () => servicePlatform === 'systemd-user' ? systemdPid('daemon') : launchdPid('daemon');
   const processAlive = dependencies.processAlive ?? isProcessAlive;
+  const serviceOwnsRuntimeProcess = (managedPid: number | undefined, runtimePid: number | undefined) =>
+    recoveryManagedServiceOwnsRuntimeProcess(managedPid, runtimePid, {
+      processAlive,
+      processParentPid: dependencies.processParentPid,
+    });
   const configuredTunnel = config.recoveryTunnelService;
   const tunnelService = configuredTunnel?.platform === 'launchd' ? configuredTunnel : undefined;
   const systemdTunnelService = configuredTunnel?.platform === 'systemd-user' ? configuredTunnel : undefined;
@@ -256,40 +304,24 @@ export function recoveryConnectorDescriptor(
       : Boolean(tunnelLaunchdPid && processAlive(tunnelLaunchdPid));
   const tunnelHealthy = openAiTunnelService ? openAiTunnelStatus?.healthy === true : tunnelRunning;
   const tunnelReady = openAiTunnelService ? openAiTunnelStatus?.ok === true : tunnelRestartSafe && tunnelRunning;
-  const gatewayPlistInstalled = pathExists(authority.gatewayLaunchAgent);
-  const watchdogPlistInstalled = pathExists(authority.watchdogLaunchAgent);
-  const gatewayServiceInstalled = servicePlatform === 'systemd-user'
-    ? pathExists(systemdUserUnitPath(RECOVERY_GATEWAY_LABEL))
-    : gatewayPlistInstalled;
-  const watchdogServiceInstalled = servicePlatform === 'systemd-user'
-    ? pathExists(systemdUserUnitPath(RECOVERY_WATCHDOG_LABEL))
-    : watchdogPlistInstalled;
-  const gatewayManagedPid = managedPid('gateway');
-  const watchdogManagedPid = managedPid('watchdog');
-  const gatewayRunning = Boolean(
-    gatewayIdentity
-    && gatewayManagedPid
-    && gatewayIdentity.pid === gatewayManagedPid
-    && processAlive(gatewayIdentity.pid)
+  const recoveryPlistInstalled = pathExists(authority.daemonLaunchAgent);
+  const recoveryServiceInstalled = servicePlatform === 'systemd-user'
+    ? pathExists(systemdUserUnitPath(RECOVERY_DAEMON_LABEL))
+    : recoveryPlistInstalled;
+  const recoveryManagedPid = managedPid();
+  const recoveryRunning = Boolean(
+    recoveryIdentity
+    && serviceOwnsRuntimeProcess(recoveryManagedPid, recoveryIdentity.pid)
     && authority.current
-    && gatewayIdentity.releaseRevision === authority.current.releaseRevision
-    && gatewayIdentity.manifestSha256 === authority.current.manifestSha256,
+    && recoveryIdentity.releaseRevision === authority.current.releaseRevision
+    && recoveryIdentity.manifestSha256 === authority.current.manifestSha256,
   );
-  const watchdogRunning = Boolean(
-    watchdogIdentity
-    && watchdogManagedPid
-    && watchdogIdentity.pid === watchdogManagedPid
-    && processAlive(watchdogIdentity.pid)
-    && authority.current
-    && watchdogIdentity.releaseRevision === authority.current.releaseRevision
-    && watchdogIdentity.manifestSha256 === authority.current.manifestSha256,
-  );
-  const installed = Boolean(authority.current && gatewayServiceInstalled && watchdogServiceInstalled);
+  const installed = Boolean(authority.current && recoveryServiceInstalled);
   const publicEndpoint = Boolean(configuredUrl?.startsWith('https://'));
   const warnings: string[] = [];
   if (!authority.current) warnings.push('No current immutable Forge Recovery release is installed. Run forge recovery install.');
-  if (!gatewayServiceInstalled || !watchdogServiceInstalled) warnings.push(`Forge Recovery ${servicePlatform} services are not fully installed. Run forge recovery install.`);
-  if (!gatewayRunning || !watchdogRunning) warnings.push('Forge Recovery Gateway or Watchdog is not running on the current Recovery release.');
+  if (!recoveryServiceInstalled) warnings.push(`Forge Recovery ${servicePlatform} service is not installed. Run forge recovery install.`);
+  if (!recoveryRunning) warnings.push('Forge Recovery service is not running on the current Recovery release.');
   if (!configuredTunnel) warnings.push('Recovery is loopback-only. Configure a dedicated OpenAI Secure MCP Tunnel or an HTTPS tunnel service before adding it to ChatGPT.');
   else if (openAiTunnelService) {
     if (!tunnelRestartSafe) warnings.push('The dedicated OpenAI Recovery tunnel must use a valid alias, tunnel id, loopback MCP endpoint, and env:/file: runtime API key reference.');
@@ -310,7 +342,7 @@ export function recoveryConnectorDescriptor(
     transport: 'streamable_http',
     url,
     public: publicEndpoint,
-    readyForChatGPT: installed && gatewayRunning && watchdogRunning && tunnelReady && (openAiTunnelService ? true : publicEndpoint) && passphraseConfigured,
+    readyForChatGPT: installed && recoveryRunning && tunnelReady && (openAiTunnelService ? true : publicEndpoint) && passphraseConfigured,
     installed,
     currentRelease: authority.current?.releaseRevision,
     previousRelease: authority.previous?.releaseRevision,
@@ -321,21 +353,13 @@ export function recoveryConnectorDescriptor(
     },
     healthUrl: `${origin}/recovery/health`,
     services: {
-      gateway: {
-        label: RECOVERY_GATEWAY_LABEL,
-        platform: servicePlatform,
-        serviceInstalled: gatewayServiceInstalled,
-        plistInstalled: gatewayPlistInstalled,
-        running: gatewayRunning,
-        ...(gatewayIdentity ? { pid: gatewayIdentity.pid } : {}),
-      },
-      watchdog: {
-        label: RECOVERY_WATCHDOG_LABEL,
+      recovery: {
+        label: RECOVERY_DAEMON_LABEL,
         platform: servicePlatform,
-        serviceInstalled: watchdogServiceInstalled,
-        plistInstalled: watchdogPlistInstalled,
-        running: watchdogRunning,
-        ...(watchdogIdentity ? { pid: watchdogIdentity.pid } : {}),
+        serviceInstalled: recoveryServiceInstalled,
+        plistInstalled: recoveryPlistInstalled,
+        running: recoveryRunning,
+        ...(recoveryIdentity ? { pid: recoveryIdentity.pid } : {}),
       },
       tunnel: {
         configured: Boolean(configuredTunnel),
@@ -603,7 +627,6 @@ export async function verifyRecoveryConnector(
         credentialRetirement: 'shared_recovery_token_not_individually_revocable',
       };
 
-      let mcpSessionId: string | undefined;
       const rpc = async (id: number | undefined, method: string, params?: Record<string, unknown>) => {
         const response = await request(connector.url, {
           method: 'POST',
@@ -612,10 +635,12 @@ export async function verifyRecoveryConnector(
             accept: 'application/json, text/event-stream',
             'content-type': 'application/json',
             'mcp-protocol-version': '2025-06-18',
-            ...(mcpSessionId ? { 'mcp-session-id': mcpSessionId } : {}),
           },
           body: JSON.stringify({ jsonrpc: '2.0', ...(id === undefined ? {} : { id }), method, ...(params ? { params } : {}) }),
         });
+        if (response.headers.get('mcp-session-id')?.trim()) {
+          throw new Error(`${method} unexpectedly established transport session state`);
+        }
         if (method === 'notifications/initialized') {
           if (response.status !== 202) throw new Error(`${method} HTTP ${response.status}`);
           return { response, result: {} as Record<string, unknown> };
@@ -625,71 +650,44 @@ export async function verifyRecoveryConnector(
         if (response.status !== 200 || Object.keys(rpcError).length > 0) {
           throw new Error(`${method} HTTP ${response.status}${typeof rpcError.message === 'string' ? `: ${rpcError.message}` : ''}`);
         }
-        if (method === 'initialize') {
-          const returnedSessionId = response.headers.get('mcp-session-id')?.trim();
-          if (!returnedSessionId) throw new Error('initialize HTTP 200: Mcp-Session-Id missing');
-          mcpSessionId = returnedSessionId;
-        }
         return { response, result: jsonObject(body.result) };
       };
-      const closeMcpSession = async (): Promise<void> => {
-        const sessionId = mcpSessionId;
-        if (!sessionId) return;
-        mcpSessionId = undefined;
-        try {
-          await request(connector.url, {
-            method: 'DELETE',
-            headers: {
-              authorization: `Bearer ${accessToken}`,
-              accept: 'application/json, text/event-stream',
-              'mcp-protocol-version': '2025-06-18',
-              'mcp-session-id': sessionId,
-            },
-          });
-        } catch {
-          // Session cleanup is best-effort and must not hide the verifier result.
-        }
-      };
 
-      try {
-        const initialized = await rpc(11, 'initialize', {
-          protocolVersion: '2025-06-18',
-          capabilities: {},
-          clientInfo: { name: 'forge-recovery-verifier', version: FORGE_VERSION },
-        });
-        const initializedNotification = await rpc(undefined, 'notifications/initialized');
-        const listed = await rpc(12, 'tools/list');
-        const tools = Array.isArray(listed.result.tools)
-          ? listed.result.tools.map((tool) => jsonObject(tool).name).filter((name): name is string => typeof name === 'string')
-          : [];
-        const expectedTools = RECOVERY_TOOLS.map((tool) => tool.name);
-        const runtimeStatusCall = await rpc(13, 'tools/call', { name: 'runtime_status', arguments: {} });
-        const listReleasesCall = await rpc(14, 'tools/call', { name: 'list_releases', arguments: {} });
-        const initializedResult = initialized.result;
-        const serverInfo = jsonObject(initializedResult.serverInfo);
-        const mcpOk = initialized.response.status === 200
-          && initializedNotification.response.status === 202
-          && initializedResult.protocolVersion === '2025-06-18'
-          && serverInfo.name === 'forge-standalone-recovery'
-          && serverInfo.version === FORGE_VERSION
-          && JSON.stringify(tools) === JSON.stringify(expectedTools)
-          && runtimeStatusCall.response.status === 200
-          && listReleasesCall.response.status === 200;
-        probes.mcp = {
-          ok: mcpOk,
-          initializeStatus: initialized.response.status,
-          initializedNotificationStatus: initializedNotification.response.status,
-          protocolVersion: typeof initializedResult.protocolVersion === 'string' ? initializedResult.protocolVersion : undefined,
-          serverName: typeof serverInfo.name === 'string' ? serverInfo.name : undefined,
-          serverVersion: typeof serverInfo.version === 'string' ? serverInfo.version : undefined,
-          tools,
-          runtimeStatusCall: runtimeStatusCall.response.status === 200,
-          listReleasesCall: listReleasesCall.response.status === 200,
-        };
-        if (!mcpOk) failures.push('mcp: initialize, Forge version, tool surface, or read-only calls did not match the Recovery contract.');
-      } finally {
-        await closeMcpSession();
-      }
+      const initialized = await rpc(11, 'initialize', {
+        protocolVersion: '2025-06-18',
+        capabilities: {},
+        clientInfo: { name: 'forge-recovery-verifier', version: FORGE_VERSION },
+      });
+      const initializedNotification = await rpc(undefined, 'notifications/initialized');
+      const listed = await rpc(12, 'tools/list');
+      const tools = Array.isArray(listed.result.tools)
+        ? listed.result.tools.map((tool) => jsonObject(tool).name).filter((name): name is string => typeof name === 'string')
+        : [];
+      const expectedTools = RECOVERY_TOOLS.map((tool) => tool.name);
+      const runtimeStatusCall = await rpc(13, 'tools/call', { name: 'runtime_status', arguments: {} });
+      const listReleasesCall = await rpc(14, 'tools/call', { name: 'list_releases', arguments: {} });
+      const initializedResult = initialized.result;
+      const serverInfo = jsonObject(initializedResult.serverInfo);
+      const mcpOk = initialized.response.status === 200
+        && initializedNotification.response.status === 202
+        && initializedResult.protocolVersion === '2025-06-18'
+        && serverInfo.name === 'forge-standalone-recovery'
+        && serverInfo.version === FORGE_VERSION
+        && JSON.stringify(tools) === JSON.stringify(expectedTools)
+        && runtimeStatusCall.response.status === 200
+        && listReleasesCall.response.status === 200;
+      probes.mcp = {
+        ok: mcpOk,
+        initializeStatus: initialized.response.status,
+        initializedNotificationStatus: initializedNotification.response.status,
+        protocolVersion: typeof initializedResult.protocolVersion === 'string' ? initializedResult.protocolVersion : undefined,
+        serverName: typeof serverInfo.name === 'string' ? serverInfo.name : undefined,
+        serverVersion: typeof serverInfo.version === 'string' ? serverInfo.version : undefined,
+        tools,
+        runtimeStatusCall: runtimeStatusCall.response.status === 200,
+        listReleasesCall: listReleasesCall.response.status === 200,
+      };
+      if (!mcpOk) failures.push('mcp: stateless initialize, Forge version, tool surface, or read-only calls did not match the Recovery contract.');
     } catch (error) {
       failures.push(`oauthPkce/mcp: ${error instanceof Error ? error.message : String(error)}`);
     }
@@ -761,6 +759,10 @@ export function buildRecoveryCommand(): Command {
     }) => {
       const home = resolveControllerHome(opts.controllerHome);
       const repoRoot = resolve(opts.repo);
+      const primaryRuntimeSourceRepository = findRegisteredRepositoryByCheckoutRoot(repoRoot, home);
+      if (!primaryRuntimeSourceRepository) {
+        throw new Error(`RECOVERY_PRIMARY_RUNTIME_SOURCE_REPOSITORY_NOT_REGISTERED: ${repoRoot}`);
+      }
       const current = loadRecoveryConfig(home);
       const primaryConnectorBase = launchdService(
         opts.primaryConnectorServiceLabel,
@@ -774,6 +776,7 @@ export function buildRecoveryCommand(): Command {
       const installed = await installStandaloneRecovery({
         controllerHome: home,
         repoRoot,
+        primaryRuntimeSourceRepositoryId: primaryRuntimeSourceRepository.repoId,
         port: current.gateway?.port ?? 8787,
         publicMcpUrl: current.publicMcpUrl,
         recoveryPublicUrl: current.recoveryPublicUrl,
@@ -781,6 +784,7 @@ export function buildRecoveryCommand(): Command {
         primaryPublicTunnelService: current.primaryPublicTunnelService,
         primaryRuntimeService: current.primaryRuntimeService ?? defaultPrimaryRuntimeServiceConfig(),
         primaryConnectorService,
+        profile: 'self-healing',
       });
       const refreshed = loadRecoveryConfig(home);
       const runtime = await stageAndActivateConfiguredRuntimeRelease(refreshed);
@@ -952,8 +956,9 @@ export function buildRecoveryCommand(): Command {
     });
 
   command.command('install')
-    .description('Build and activate the independent Forge Recovery Gateway and Watchdog release')
+    .description('Build Forge Recovery artifacts and activate only the explicitly selected persistent Recovery profile')
     .requiredOption('--controller-home <path>', 'Explicit Controller Home')
+    .option('--profile <profile>', 'Recovery install profile: manual, gateway, or self-healing', 'manual')
     .option('--port <port>', 'Loopback Recovery Gateway port', '8787')
     .option('--public-mcp-url <url>', 'Primary Forge MCP public URL')
     .option('--recovery-public-url <url>', 'Dedicated Forge Recovery MCP public URL')
@@ -978,7 +983,7 @@ export function buildRecoveryCommand(): Command {
     .option('--primary-openai-profile-dir <path>', 'Optional absolute tunnel-client profile directory for primary Forge')
     .option('--primary-openai-admin-profile <profile>', 'Optional tunnel-client admin profile used for primary runtime connect')
     .option('--primary-runtime-source-root <path>', 'Stable canonical/package source used by Recovery for future Runtime staging')
-    .option('--stage-only', 'Build and canary the Recovery release without activating services')
+    .option('--stage-only', 'Compatibility alias: build/canary only and do not mutate installed Recovery config or services')
     .action(async (opts: {
       controllerHome: string;
       port: string;
@@ -1005,9 +1010,12 @@ export function buildRecoveryCommand(): Command {
       primaryOpenaiProfileDir?: string;
       primaryOpenaiAdminProfile?: string;
       primaryRuntimeSourceRoot?: string;
+      profile: string;
       stageOnly?: boolean;
     }) => {
       const home = resolveControllerHome(opts.controllerHome);
+      const profile = normalizeRecoveryInstallProfile(opts.stageOnly ? 'manual' : opts.profile, 'manual');
+      if (opts.stageOnly && opts.profile !== 'manual') throw new Error('RECOVERY_STAGE_ONLY_PROFILE_CONFLICT');
       const port = Number(opts.port);
       if (!Number.isInteger(port) || port < 1024 || port > 65535) throw new Error('RECOVERY_PORT_INVALID');
       const recoveryLaunchdTunnel = launchdService(opts.recoveryTunnelServiceLabel, opts.recoveryTunnelServicePlist, 'RECOVERY_TUNNEL') as PublicTunnelServiceConfig | undefined;
@@ -1063,6 +1071,7 @@ export function buildRecoveryCommand(): Command {
       assertDistinctRecoveryOpenAiTunnelIdentity(recoveryTunnelService, primaryPublicTunnelService);
 
       const recoveryPublicUrl = endpoint(opts.recoveryPublicUrl, 'RECOVERY_PUBLIC_URL');
+      if (profile === 'manual' && (recoveryTunnelService || recoveryPublicUrl)) throw new Error('RECOVERY_PROFILE_GATEWAY_REQUIRED');
       if (recoveryOpenAiTunnel && recoveryPublicUrl) throw new Error('RECOVERY_OPENAI_TUNNEL_PUBLIC_URL_CONFLICT');
       if ((recoveryLaunchdTunnel || recoverySystemdTunnel) && !recoveryPublicUrl) throw new Error('RECOVERY_PUBLIC_URL_AND_TUNNEL_SERVICE_MUST_BE_CONFIGURED_TOGETHER');
       if (!recoveryTunnelService && recoveryPublicUrl) throw new Error('RECOVERY_PUBLIC_URL_AND_TUNNEL_SERVICE_MUST_BE_CONFIGURED_TOGETHER');
@@ -1080,8 +1089,12 @@ export function buildRecoveryCommand(): Command {
         controllerHome: home,
         repoRoot: primaryRuntimeSourceRoot,
         ...(primaryRuntimeSourceRepository ? { primaryRuntimeSourceRepositoryId: primaryRuntimeSourceRepository.repoId } : {}),
-        sourceRoot: packageRoot,
+        // The package root is only the CLI's location. A package installation
+        // is not a Git checkout, while the explicitly registered primary
+        // Runtime source is the immutable Recovery release's provenance.
+        sourceRoot: primaryRuntimeSourceRoot,
         port,
+        profile,
         stageOnly: opts.stageOnly === true,
         primaryRuntimeService: defaultPrimaryRuntimeServiceConfig(),
         publicMcpUrl: endpoint(opts.publicMcpUrl, 'PUBLIC_MCP_URL'),
@@ -1092,6 +1105,7 @@ export function buildRecoveryCommand(): Command {
       });
       output({
         status: opts.stageOnly ? 'staged' : 'installed',
+        profile: result.profile,
         staged: result.staged.release,
         activation: result.activated,
         connector: recoveryConnectorDescriptor(home),

package/src/cli/commands/runtime.ts

@@ -12,6 +12,7 @@ import { listOccurrences, listSchedules } from '../../../packages/kernel/schedul
 import { observeRuntimeStatus } from '../../runtime/root/status';
 import { readMcpServiceBearerToken } from '../../../adapters/mcp/auth';
 import { createSetupBootstrapControlApi } from './bootstrap-control';
+import { readSetupProfile, runtimeDeploymentTopologyForSetupProfile } from './setup-profile';
 import { publishRuntimeRelease } from '../../runtime/root/release-store';
 import { installForgeRuntimeService } from '../../runtime/root/service';
 import { activateScheduledPackageRuntimeServiceFromPath, installPackageRuntimeService, readPackageRuntimeActivationReceipt } from '../../runtime/root/package-runtime-service';
@@ -73,12 +74,14 @@ export function buildRuntimeCommand(): Command {
         writeFileSync(tokenPath, `${token}\n`, { mode: 0o600 });
       }
       const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
+      const setupProfile = readSetupProfile();
       const result = await installPackageRuntimeService({
         controllerHome: home,
         packageRoot,
         host: opts.host,
         port,
         authTokenFile: tokenPath,
+        ...(setupProfile ? { topology: runtimeDeploymentTopologyForSetupProfile(setupProfile) } : {}),
         forcePortable: opts.portable === true,
         refreshConnector: opts.refreshConnector === true,
       });
@@ -116,7 +119,6 @@ export function buildRuntimeCommand(): Command {
     .option('--port <port>', 'MCP listener port', '8765')
     .option('--stage-only', 'Build and validate the immutable Runtime release without publishing or activating it')
     .option('--auth-token-file <path>', 'Raw bearer token file (defaults to controllerHome/mcp/runtime-token, created from the MCP bearer token when missing)')
-    .option('--exclusive-work-id <id>', 'Persistently admit only this P0 Work while migration is active')
     .option('--node-executable <path>', 'Executable launchd uses to run the Forge Runtime service runner', process.execPath)
     .option('--runner-path <path>', 'Forge Runtime service runner entry', join(resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', '..'), 'bin', 'forge-runtime-service.mjs'))
     .action(async (opts: {
@@ -125,7 +127,6 @@ export function buildRuntimeCommand(): Command {
       host: string;
       port: string;
       authTokenFile?: string;
-      exclusiveWorkId?: string;
       nodeExecutable: string;
       runnerPath: string;
       stageOnly?: boolean;
@@ -171,7 +172,6 @@ export function buildRuntimeCommand(): Command {
           host: opts.host,
           port,
           authTokenFile: tokenPath,
-          ...(opts.exclusiveWorkId?.trim() ? { exclusiveWorkId: opts.exclusiveWorkId.trim() } : {}),
         },
         runnerPath: resolve(opts.runnerPath),
         nodeExecutable: resolve(opts.nodeExecutable),

package/src/cli/commands/setup-profile.ts

@@ -8,6 +8,7 @@ import { dirname, join, resolve } from 'path';
 import { openAiSecureTunnelStatusArgs, parseOpenAiSecureTunnelRuntimeStatus, tunnelRuntimeProfileTargetsEndpoint } from '../../../adapters/mcp/tunnels/openai-secure-tunnel';
 import { discoverExecutable, type ExecutableDiscoveryResult } from '../../runtime/platform/executable-discovery';
 import { resolvePlatformServiceManager, type PlatformServiceManagerKind } from '../../runtime/platform/service-manager';
+import { deriveRuntimeDeploymentTopology, type RuntimeDeploymentTopology } from '../../runtime/root/deployment-topology';
 
 export type SetupControllerKind = 'chatgpt' | 'codex' | 'claude' | 'mcp';
 export type SetupTunnelProvider = 'auto' | 'openai' | 'cloudflare' | 'tailscale' | 'existing' | 'none';
@@ -187,6 +188,13 @@ export function setupNeedsRemoteAccess(profile: SetupProfile | undefined): boole
   return Boolean(profile?.controllers.some((entry) => entry === 'chatgpt' || entry === 'mcp'));
 }
 
+export function runtimeDeploymentTopologyForSetupProfile(profile: SetupProfile): RuntimeDeploymentTopology {
+  return deriveRuntimeDeploymentTopology({
+    controllers: profile.controllers,
+    capabilityIntents: profile.capabilityIntents,
+  });
+}
+
 export type SetupConnectorAuthMode = 'oauth' | 'none';
 
 export function setupConnectorAuthMode(profile: SetupProfile | undefined): SetupConnectorAuthMode {

package/src/cli/controller/check-runner.ts

@@ -280,8 +280,19 @@ function inferredPackageCheckEffects(name: string): ControllerCheckEffects | und
     // and persist only content-bound receipts/caches outside repository source.
     return { reads: ['.'], cache: 'write', temp: 'isolated', git: 'read' };
   }
-  const staticAnalysis = /(?:^|:)(?:type|typecheck|lint|format:check|runtime-architecture|mcp-compatibility|forge-runtime)$/.test(normalized);
-  if (staticAnalysis) return { reads: ['.'], cache: 'write' };
+  if (normalized === 'check:type' || normalized === 'check:runtime-architecture') {
+    // These canonical gates are source readers: TypeScript runs with --noEmit,
+    // while runtime-architecture only inspects source/AST structure. Neither
+    // owns the shared repository build cache.
+    return { reads: ['.'] };
+  }
+  if (normalized === 'check:architecture-sync') {
+    // Architecture sync runs the queue in --check mode and inspects Git state.
+    // Its scratch space is check-local; it never mutates repository source.
+    return { reads: ['.'], temp: 'isolated', git: 'read' };
+  }
+  const cachedStaticAnalysis = /(?:^|:)(?:typecheck|lint|format:check|mcp-compatibility|forge-runtime)$/.test(normalized);
+  if (cachedStaticAnalysis) return { reads: ['.'], cache: 'write' };
   const isolatedReadOnlyCheck = /(?:^|:)(?:quality-harness|evaluation-framework|background-check-overlap|typescript-navigation|check-scheduling|bootstrap-files)$/.test(normalized);
   if (isolatedReadOnlyCheck) return { reads: ['.'], temp: 'isolated', git: 'read' };
   const browserLive = /(?:^|:)browser-live$/.test(normalized);

package/src/cli/controller/completion-backlog.ts

@@ -145,11 +145,11 @@ function classifyTask(repoRoot: string, issue: ControllerIssue, task: Controller
   }
 
   if (run && FINISHABLE_RUN_STATUSES.has(run.status)) {
-    if (policy.requiresHumanAcceptance) {
+    if (task.acceptanceCriteria.length > 0) {
       return {
         ...base,
         action: 'needs_human_review',
-        reason: `${policy.executionClass} requires explicit review before finishing ${run.runId}.`,
+        reason: `Task declares acceptance criteria that require an explicit acceptance decision before finishing ${run.runId}.`,
         canAutoFinish: false,
         suggestedDecision: 'approve_and_finish',
       };
@@ -157,7 +157,7 @@ function classifyTask(repoRoot: string, issue: ControllerIssue, task: Controller
     return {
       ...base,
       action: 'auto_finish',
-      reason: `Run ${run.runId} is ${run.status} and policy allows automatic finish.`,
+      reason: `Run ${run.runId} is ${run.status} and the Task declares no semantic acceptance criteria, so automatic finish may proceed.`,
       canAutoFinish: true,
       suggestedDecision: 'auto',
     };

package/src/cli/controller/completion-orchestrator.ts

@@ -11,7 +11,7 @@ import { resolveRepoPreferredControllerHome } from '../repositories/controller-h
 import { withControllerLock } from '../repositories/locks';
 import { listActiveLeases } from '../../runtime/resources/leases/store';
 import { acceptVerifiedTask, getIssue, projectIssueEffectiveView, recordTaskVerification, updateTask } from './issue-store';
-import { cleanupEvidenceResourceBlockers, completionEvidenceComplete, taskExecutionPolicy } from './execution-policy';
+import { cleanupEvidenceResourceBlockers, completionEvidenceComplete } from './execution-policy';
 import { currentCompletionTarget, resolveCompletionTargetBranch } from './completion-target';
 import { runControllerCheck } from './check-runner';
 import type { CleanupEvidence, ControllerIssue, ControllerTask, IntegrationEvidence, TaskCommandEvidence, TaskVerification } from './types';
@@ -183,7 +183,6 @@ function verificationForRun(
   reviewer: string,
   evidence: { integrationEvidence?: IntegrationEvidence; cleanupEvidence?: CleanupEvidence; completionReceipt?: CompletionReceipt; acceptanceConfirmed?: boolean } = {},
 ): TaskVerification {
-  const policy = taskExecutionPolicy(task);
   const acceptanceResults = task.acceptanceCriteria.map((criterion) => evidence.acceptanceConfirmed
     ? {
       criterion,
@@ -204,8 +203,7 @@ function verificationForRun(
     integratedRevision: evidence.integrationEvidence?.targetRevision,
     reviewedDiffHash: hashArtifact(repoRoot, run.diffArtifactPath),
     reviewer,
-    checkResults: policy.autoRunDeclaredChecks
-      ? task.checks.map((checkId) => {
+    checkResults: task.checks.map((checkId) => {
         try {
           const result = runControllerCheck(repoRoot, checkId);
           return {
@@ -218,8 +216,7 @@ function verificationForRun(
         } catch (error) {
           return { checkId, ok: false, summary: error instanceof Error ? error.message : String(error) };
         }
-      })
-      : [],
+      }),
     commandEvidence: commandEvidenceForRun(run),
     acceptanceResults,
     verifiedAt: nowIso(),
@@ -233,8 +230,7 @@ function result(repoRoot: string, input: Omit<FinishTaskRunResult, 'issue'>): Fi
 }
 
 function canAutoFinish(task: ControllerTask): boolean {
-  const policy = taskExecutionPolicy(task);
-  return policy.autoCompleteAfterSuccessfulRun && !policy.requiresHumanAcceptance;
+  return task.acceptanceCriteria.length === 0;
 }
 
 function verifyAndMaybeAccept(input: {
@@ -247,16 +243,7 @@ function verifyAndMaybeAccept(input: {
   allowCompletion?: boolean;
 }): { issue: ControllerIssue; taskStatus: string } {
   const { repoRoot, run, task, decision, reviewer } = input;
-  const policy = taskExecutionPolicy(task);
   const allowHumanAcceptance = decision === 'approve_and_finish';
-  if (policy.requiresHumanAcceptance && !allowHumanAcceptance) {
-    updateTask(repoRoot, run.issueId, run.taskId, {
-      status: task.status === 'verified' ? 'verified' : task.status,
-      note: input.note ?? `Run ${run.runId} is ready but ${policy.executionClass} requires an explicit review decision.`,
-    });
-    const waiting = getIssue(repoRoot, run.issueId);
-    return { issue: waiting, taskStatus: taskForRun(waiting, run.taskId).status };
-  }
 
   const current = getIssue(repoRoot, run.issueId);
   const currentTask = taskForRun(current, run.taskId);
@@ -438,19 +425,6 @@ function finishEditSessionUnlocked(repoRoot: string, options: FinishEditSessionO
     });
   }
 
-  const policy = taskExecutionPolicy(task);
-  if (policy.requiresHumanAcceptance && decision !== 'approve_and_finish') {
-    return editResult(repoRoot, {
-      action: 'needs_decision',
-      sessionId: initialSession.sessionId,
-      issueId: issue.id,
-      taskId: task.id,
-      decision,
-      taskStatus: task.status,
-      reason: `${policy.executionClass} requires approve_and_finish, request_changes, or discard.`,
-    });
-  }
-
   const completionTarget = currentCompletionTarget(repoRoot);
   if (!completionTarget.onTargetBranch) {
     return editResult(repoRoot, {
@@ -1165,19 +1139,6 @@ function finishTaskRunUnlocked(repoRoot: string, options: FinishTaskRunOptions):
     });
   }
 
-  const policy = taskExecutionPolicy(task);
-  if (policy.requiresHumanAcceptance && decision !== 'approve_and_finish') {
-    return result(repoRoot, {
-      action: 'needs_decision',
-      runId: run.runId,
-      issueId: issue.id,
-      taskId: task.id,
-      decision,
-      taskStatus: task.status,
-      reason: `${policy.executionClass} requires approve_and_finish, request_changes, or discard.`,
-    });
-  }
-
   const ownedAutoFinalization = run.status === 'running'
     && run.autoIntegrate === true
     && run.executionMode === 'worktree'