@moretea-labs/forge 1.8.0 → 1.8.2

package/src/runtime/root/package-runtime-service.ts

@@ -1,10 +1,12 @@
+import { writeAtomicTextFile } from '../shared/atomic-text-file';
 import { randomUUID } from 'crypto';
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'fs';
+import { existsSync, readFileSync, rmSync } from 'fs';
 import { setTimeout as sleep } from 'timers/promises';
 import { dirname, join, resolve } from 'path';
 import { resolveControllerHome } from '../../cli/repositories/controller-home';
 import { createPlatformServiceManagerHost, probeSystemdUserAvailable, type PlatformServiceManagerHost, type PlatformServiceManagerKind, type SystemdUserUnitInput } from '../platform/service-manager';
-import { RUNTIME_WRITE_CLAIM_ENV } from './write-fence';
+import { reconcileRetiredForgePersistentServices, type ForgeRetiredServiceReconciliation } from '../platform/service-inventory';
+import { runtimeAuthorityFreeEnvironment } from '../shared/process-environment';
 import {
   activeRuntimeEntrypoint,
   activeRuntimeLaunchSpec,
@@ -19,6 +21,7 @@ import { materializePackageRuntimeRelease, type PackageRuntimeRelease } from './
 import { readRuntimeReleaseAuthority, revertInitialRuntimeReleasePublication, rollbackRuntimeRelease } from './release-store';
 import { loadMcpServiceLocalConfig } from '../../../adapters/mcp/auth';
 import { ensurePackageConnectorService, type PackageConnectorServiceResult } from './package-connector-service';
+import { normalizeRuntimeDeploymentTopology, type RuntimeDeploymentTopology } from './deployment-topology';
 
 export type PackageRuntimeServiceMode = PlatformServiceManagerKind;
 
@@ -74,6 +77,7 @@ export interface PackageRuntimeServiceInstallResult {
   pid?: number;
   warnings: string[];
   connector?: PackageConnectorServiceResult;
+  retiredServices?: ForgeRetiredServiceReconciliation[];
   activation?: {
     operationId: string;
     status: 'activation_scheduled';
@@ -89,11 +93,11 @@ export interface PackageRuntimeServiceOptions {
   host?: string;
   port?: number;
   authTokenFile: string;
-  exclusiveWorkId?: string;
   platform?: NodeJS.Platform;
   env?: NodeJS.ProcessEnv;
   forcePortable?: boolean;
   refreshConnector?: boolean;
+  topology?: RuntimeDeploymentTopology;
 }
 
 export interface PackageRuntimeServiceDependencies {
@@ -101,6 +105,7 @@ export interface PackageRuntimeServiceDependencies {
   ensureConnectorService?: typeof ensurePackageConnectorService;
   scheduleDarwinActivation?: (request: PackageRuntimeActivationRequest) => Promise<{ label: string; servicePath: string }>;
   activationMode?: 'detached' | 'inline';
+  reconcileRetiredServices?: typeof reconcileRetiredForgePersistentServices;
 }
 
 export interface PackageRuntimeActivationDependencies {
@@ -110,13 +115,6 @@ export interface PackageRuntimeActivationDependencies {
   cleanupActivationHelper?: (request: PackageRuntimeActivationRequest) => Promise<void>;
 }
 
-function atomicWrite(path: string, content: string, mode = 0o600): void {
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-  const temporary = `${path}.${process.pid}.tmp`;
-  writeFileSync(temporary, content, { encoding: 'utf8', mode });
-  renameSync(temporary, path);
-}
-
 export function renderForgeRuntimeSystemdUserUnit(input: {
   description?: string;
   executable: string;
@@ -131,14 +129,10 @@ export function systemdUserAvailable(env: NodeJS.ProcessEnv = process.env): bool
 }
 
 function cleanRuntimeInstallerEnvironment(env: NodeJS.ProcessEnv, releaseEnvironment: Record<string, string>): NodeJS.ProcessEnv {
-  const next = { ...env };
-  for (const key of Object.values(RUNTIME_WRITE_CLAIM_ENV)) delete next[key];
-  delete next.FORGE_CONTROLLER_LIFECYCLE_OWNER;
-  delete next.FORGE_RELEASE_PATH;
-  delete next.FORGE_RELEASE_REVISION;
-  delete next.FORGE_RELEASE_SOURCE_COMMIT;
-  delete next.FORGE_RELEASE_CLEAN_WORKSPACE;
-  return { ...next, ...releaseEnvironment };
+  // The selected immutable release is the only authority reintroduced below.
+  // Do not carry an installer, host Runtime or Supervisor writer claim across
+  // this service boundary.
+  return { ...runtimeAuthorityFreeEnvironment(env), ...releaseEnvironment };
 }
 
 export function systemdRuntimeInstallCommands(unitName: string): string[][] {
@@ -189,7 +183,7 @@ function startPortableRuntime(controllerHome: string, env: NodeJS.ProcessEnv, ho
     stderrPath: paths.stderrPath,
     errorCode: 'FORGE_PORTABLE_RUNTIME_START_FAILED',
   });
-  atomicWrite(join(paths.serviceRoot, 'portable.json'), `${JSON.stringify({ schemaVersion: 1, pid, startedAt: new Date().toISOString() }, null, 2)}\n`);
+  writeAtomicTextFile(join(paths.serviceRoot, 'portable.json'), `${JSON.stringify({ schemaVersion: 1, pid, startedAt: new Date().toISOString() }, null, 2)}\n`);
   return pid;
 }
 
@@ -208,7 +202,7 @@ function activationPaths(controllerHome: string, operationId: string): { request
 }
 
 function writeActivationRequest(request: PackageRuntimeActivationRequest): void {
-  atomicWrite(request.requestPath, `${JSON.stringify(request, null, 2)}\n`);
+  writeAtomicTextFile(request.requestPath, `${JSON.stringify(request, null, 2)}\n`);
 }
 
 function writeActivationReceipt(
@@ -232,7 +226,7 @@ function writeActivationReceipt(
     helperLabel: request.helperLabel,
     ...extra,
   };
-  atomicWrite(request.receiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
+  writeAtomicTextFile(request.receiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
   return receipt;
 }
 
@@ -299,7 +293,7 @@ export function renderPackageRuntimeActivationLaunchAgent(request: PackageRuntim
 async function scheduleDarwinPackageRuntimeActivation(request: PackageRuntimeActivationRequest): Promise<{ label: string; servicePath: string }> {
   if (process.platform !== 'darwin') throw new Error('FORGE_PACKAGE_RUNTIME_ACTIVATION_HELPER_PLATFORM_UNSUPPORTED');
   const host = createPlatformServiceManagerHost({ platform: 'darwin' });
-  atomicWrite(request.helperSourcePlistPath, renderPackageRuntimeActivationLaunchAgent(request), 0o600);
+  writeAtomicTextFile(request.helperSourcePlistPath, renderPackageRuntimeActivationLaunchAgent(request), 0o600);
   host.installLaunchd(request.helperSourcePlistPath, request.helperLabel);
   const result = await host.bootstrapLaunchd({ label: request.helperLabel, plistPath: request.helperInstalledPlistPath });
   if (!result.ok) throw new Error(`FORGE_PACKAGE_RUNTIME_ACTIVATION_HELPER_BOOTSTRAP_FAILED: ${result.diagnostics.join('; ')}`);
@@ -351,7 +345,7 @@ async function rollbackPackageRuntimeActivation(
   }
   try {
     if (request.priorConfigBytes === undefined) rmSync(servicePaths.configPath, { force: true });
-    else atomicWrite(servicePaths.configPath, request.priorConfigBytes);
+    else writeAtomicTextFile(servicePaths.configPath, request.priorConfigBytes);
     syncForgeRuntimeActiveEntrypoint(request.controllerHome);
   } catch (error) {
     errors.push(error instanceof Error ? error.message : String(error));
@@ -471,7 +465,7 @@ export async function installPackageRuntimeService(
     host: options.host ?? '127.0.0.1',
     port: options.port ?? 8765,
     authTokenFile: options.authTokenFile,
-    ...(options.exclusiveWorkId?.trim() ? { exclusiveWorkId: options.exclusiveWorkId.trim() } : {}),
+    topology: normalizeRuntimeDeploymentTopology(options.topology),
   };
   writeForgeRuntimeServiceConfig(config);
   syncForgeRuntimeActiveEntrypoint(controllerHome);
@@ -479,6 +473,11 @@ export async function installPackageRuntimeService(
   const env = options.env ?? process.env;
   const serviceHost = createPlatformServiceManagerHost({ platform, env, forcePortable: options.forcePortable });
   const serviceManager = serviceHost.selection;
+  const retiredServices = await (dependencies.reconcileRetiredServices ?? reconcileRetiredForgePersistentServices)({
+    host: serviceHost,
+    env,
+    accountHome: env.HOME,
+  });
   const installDarwinService = dependencies.installDarwinService ?? installForgeRuntimeService;
   const explicitInjectedInline = Boolean(dependencies.installDarwinService && !dependencies.scheduleDarwinActivation && !dependencies.activationMode);
   const activationMode = dependencies.activationMode ?? (explicitInjectedInline ? 'inline' : 'detached');
@@ -592,6 +591,7 @@ export async function installPackageRuntimeService(
     }
   }
 
+  base = { ...base, retiredServices };
   if (!connectorEndpoint || base.status === 'activation_scheduled') return base;
   const ensureConnectorService = dependencies.ensureConnectorService ?? ensurePackageConnectorService;
   const connector = await ensureConnectorService({

package/src/runtime/root/release-execution-canary.ts

@@ -1,12 +1,15 @@
+import { readFileSync } from 'fs';
+import { join } from 'path';
 import { runProcess } from '../../effects/process-runner';
 import { PROCESS_RUNTIME_RELEASE_CANARY_ARG } from '../execution/process-runtime/canary';
+import { resolveBunExecutable } from '../shared/process-environment';
 import {
   assertRuntimeReleaseExecutionSurface,
   type RuntimeReleaseExecutionSurface,
 } from './release-manifest';
 
 export interface RuntimeReleaseExecutionCanaryCommand {
-  name: RuntimeReleaseExecutionSurface['entries'][number]['name'];
+  name: RuntimeReleaseExecutionSurface['entries'][number]['name'] | 'connector_cli';
   executable: string;
   args: string[];
 }
@@ -22,8 +25,10 @@ export interface RuntimeReleaseExecutionCanaryDependencies {
 
 /**
  * Release execution canaries deliberately do not inherit developer-tool PATH
- * entries. A manifest-owned executable that only works because Homebrew, Bun,
- * nvm, etc. happens to be present is not an immutable Runtime artifact.
+ * entries. Standalone-binary artifacts must execute without Homebrew, Bun, nvm,
+ * or similar PATH dependencies. Legacy source scripts are probed through the
+ * same explicitly resolved Bun executable that their Process Runtime uses in
+ * production, while executable shebangs remain the artifact's own launch contract.
  */
 export function runtimeReleaseCanaryEnvironment(
   env: NodeJS.ProcessEnv = process.env,
@@ -39,7 +44,23 @@ export function runtimeReleaseCanaryEnvironment(
   return { ...env, PATH: '/usr/bin:/bin:/usr/sbin:/sbin' };
 }
 
-/** Execute the exact manifest-owned Process/Check Runner artifacts in bounded no-op mode. */
+/**
+ * Execute legacy JavaScript/TypeScript through the resolved Bun runtime only
+ * when the artifact does not declare a different executable shebang.
+ */
+function releaseScriptRequiresBun(entryPath: string): boolean {
+  const firstLine = readFileSync(entryPath, 'utf8').split(/\r?\n/, 1)[0]?.trim() ?? '';
+  if (!firstLine.startsWith('#!')) return true;
+  const shebangTokens = firstLine.slice(2).trim().split(/\s+/).filter(Boolean);
+  return shebangTokens.some((token) => /(?:^|\/)bun(?:\.exe)?$/i.test(token));
+}
+
+/**
+ * Execute the minimum immutable Runtime execution surface plus the package
+ * Connector CLI import graph. The latter is intentionally a help-only command:
+ * it loads the exact CLI dependency closure used by the persistent Connector
+ * without opening a listener or mutating Runtime authority.
+ */
 export function assertRuntimeReleaseExecutionCanaries(
   manifestPath: string,
   controllerHome: string,
@@ -52,20 +73,44 @@ export function assertRuntimeReleaseExecutionCanaries(
     {
       cwd: surface.releaseRoot,
       env: runtimeReleaseCanaryEnvironment(),
-      timeoutMs: 10_000,
+      timeoutMs: 30_000,
       maxOutputBytes: 64 * 1024,
     },
   ));
-  for (const entry of surface.entries) {
-    const canary: RuntimeReleaseExecutionCanaryCommand = {
-      name: entry.name,
-      executable: entry.path,
-      args: [PROCESS_RUNTIME_RELEASE_CANARY_ARG],
-    };
+  const assertCanary = (canary: RuntimeReleaseExecutionCanaryCommand): void => {
     const result = runExecutionEntryCanary(canary);
     if (!result.ok) {
-      throw new Error(`RUNTIME_RELEASE_EXECUTION_CANARY_FAILED: ${canary.name}: ${result.stderr || result.stdout || result.error || 'unknown failure'}`.slice(0, 2_000));
+      const detail = result.stderr || result.stdout || result.error || 'unknown failure';
+      const legacyCheckRunnerUsageProbe = surface.manifest.executionMode !== 'standalone-binary'
+        && canary.name === 'check_runner'
+        && detail.trim() === 'PERSISTED_CHECK_USAGE: missing --repo';
+      if (legacyCheckRunnerUsageProbe) return;
+      throw new Error(`RUNTIME_RELEASE_EXECUTION_CANARY_FAILED: ${canary.name}: ${detail}`.slice(0, 2_000));
     }
+  };
+
+  for (const entry of surface.entries) {
+    const args = entry.canary === 'runtime_interpreter' ? ['--version'] : [PROCESS_RUNTIME_RELEASE_CANARY_ARG];
+    const legacyScript = surface.manifest.executionMode !== 'standalone-binary'
+      && /\.(?:[cm]?js|tsx?)$/i.test(entry.path);
+    const usesExplicitBun = legacyScript && releaseScriptRequiresBun(entry.path);
+    assertCanary({
+      name: entry.name,
+      executable: usesExplicitBun ? resolveBunExecutable(process.execPath, process.env) : entry.path,
+      args: usesExplicitBun ? [entry.path, ...args] : args,
+    });
   }
+
+  // Package launcher releases execute source-backed CLI code from their own
+  // immutable snapshot. Compiled standalone releases have a different closed
+  // artifact surface and therefore do not use this source CLI probe.
+  if (surface.manifest.executionMode !== 'standalone-binary' && surface.manifest.packageRoot) {
+    assertCanary({
+      name: 'connector_cli',
+      executable: resolveBunExecutable(process.execPath, process.env),
+      args: [join(surface.releaseRoot, 'package', 'src', 'cli', 'index.ts'), 'mcp', 'serve', '--help'],
+    });
+  }
+
   return surface;
 }

package/src/runtime/root/release-loader.ts

@@ -1,13 +1,18 @@
+import { spawn } from 'child_process';
 import { createHash } from 'crypto';
-import { readFileSync } from 'fs';
+import { lstatSync, readFileSync } from 'fs';
 import { dirname, join, resolve } from 'path';
-import { pathToFileURL } from 'url';
 
 export const RUNTIME_BUNDLE_ENTRYPOINT = 'forge-runtime-bundle.js' as const;
+export const RUNTIME_INTERPRETER_ENTRYPOINT = process.platform === 'win32'
+  ? 'forge-runtime-bun.exe' as const
+  : 'forge-runtime-bun' as const;
 
 interface RuntimeBundleManifestRecord {
   runtimeBundleEntrypoint?: unknown;
   runtimeBundleArtifactIdentity?: unknown;
+  runtimeInterpreterEntrypoint?: unknown;
+  runtimeInterpreterArtifactIdentity?: unknown;
 }
 
 function releaseManifestPath(argv: readonly string[]): string {
@@ -21,6 +26,8 @@ export function resolveCompiledRuntimeBundle(argv: readonly string[] = process.a
   manifestPath: string;
   bundlePath: string;
   artifactIdentity: string;
+  interpreterPath: string;
+  interpreterArtifactIdentity: string;
 } {
   const manifestPath = releaseManifestPath(argv);
   let manifest: RuntimeBundleManifestRecord;
@@ -38,9 +45,14 @@ export function resolveCompiledRuntimeBundle(argv: readonly string[] = process.a
   if (!/^sha256:[a-f0-9]{64}$/.test(artifactIdentity)) {
     throw new Error('RUNTIME_RELEASE_BUNDLE_IDENTITY_INVALID');
   }
-  const bundlePath = join(dirname(manifestPath), RUNTIME_BUNDLE_ENTRYPOINT);
+  const releaseRoot = dirname(manifestPath);
+  const bundlePath = join(releaseRoot, RUNTIME_BUNDLE_ENTRYPOINT);
   let actualIdentity: string;
   try {
+    const status = lstatSync(bundlePath);
+    if (status.isSymbolicLink() || !status.isFile()) {
+      throw new Error('bundle must be a regular file');
+    }
     actualIdentity = `sha256:${createHash('sha256').update(readFileSync(bundlePath)).digest('hex')}`;
   } catch (error) {
     throw new Error(`RUNTIME_RELEASE_BUNDLE_READ_FAILED: ${error instanceof Error ? error.message : String(error)}`);
@@ -48,16 +60,86 @@ export function resolveCompiledRuntimeBundle(argv: readonly string[] = process.a
   if (actualIdentity !== artifactIdentity) {
     throw new Error('RUNTIME_RELEASE_BUNDLE_ARTIFACT_IDENTITY_MISMATCH');
   }
-  return { manifestPath, bundlePath, artifactIdentity };
+  if (manifest.runtimeInterpreterEntrypoint !== RUNTIME_INTERPRETER_ENTRYPOINT) {
+    throw new Error(`RUNTIME_RELEASE_INTERPRETER_ENTRYPOINT_INVALID: expected ${RUNTIME_INTERPRETER_ENTRYPOINT}`);
+  }
+  const interpreterArtifactIdentity = typeof manifest.runtimeInterpreterArtifactIdentity === 'string'
+    ? manifest.runtimeInterpreterArtifactIdentity.trim().toLowerCase()
+    : '';
+  if (!/^sha256:[a-f0-9]{64}$/.test(interpreterArtifactIdentity)) {
+    throw new Error('RUNTIME_RELEASE_INTERPRETER_IDENTITY_INVALID');
+  }
+  const interpreterPath = join(releaseRoot, RUNTIME_INTERPRETER_ENTRYPOINT);
+  let actualInterpreterIdentity: string;
+  try {
+    const status = lstatSync(interpreterPath);
+    if (status.isSymbolicLink() || !status.isFile() || (status.mode & 0o111) === 0) {
+      throw new Error('interpreter must be a regular executable file');
+    }
+    actualInterpreterIdentity = `sha256:${createHash('sha256').update(readFileSync(interpreterPath)).digest('hex')}`;
+  } catch (error) {
+    throw new Error(`RUNTIME_RELEASE_INTERPRETER_READ_FAILED: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (actualInterpreterIdentity !== interpreterArtifactIdentity) {
+    throw new Error('RUNTIME_RELEASE_INTERPRETER_ARTIFACT_IDENTITY_MISMATCH');
+  }
+  return { manifestPath, bundlePath, artifactIdentity, interpreterPath, interpreterArtifactIdentity };
+}
+
+function runtimeChildArgs(argv: readonly string[]): string[] {
+  const firstRuntimeArgument = argv.findIndex((argument) => argument.startsWith('--'));
+  if (firstRuntimeArgument < 0 || !argv.includes('--controller-home')) {
+    throw new Error('RUNTIME_CONTROLLER_HOME_ARGUMENT_REQUIRED');
+  }
+  return argv.slice(firstRuntimeArgument);
 }
 
 export async function runCompiledRuntimeLoader(argv: string[] = process.argv): Promise<void> {
   const bundle = resolveCompiledRuntimeBundle(argv);
-  const loaded = await import(pathToFileURL(bundle.bundlePath).href) as { runCanonicalRuntimeCli?: (argv?: string[]) => Promise<void> };
-  if (typeof loaded.runCanonicalRuntimeCli !== 'function') {
-    throw new Error('RUNTIME_RELEASE_BUNDLE_ENTRY_EXPORT_MISSING');
+  const child = spawn(bundle.interpreterPath, [bundle.bundlePath, ...runtimeChildArgs(argv)], {
+    cwd: dirname(bundle.manifestPath),
+    stdio: 'inherit',
+    env: process.env,
+  });
+  let childExited = false;
+  const forwardSignal = (signal: NodeJS.Signals): void => {
+    if (childExited) return;
+    try { child.kill(signal); } catch { /* child lifecycle reconciliation owns terminal state */ }
+  };
+  const terminateChildOnLauncherExit = (): void => {
+    if (childExited) return;
+    try { child.kill('SIGTERM'); } catch { /* launcher is already exiting */ }
+  };
+  const forwardedSignals: NodeJS.Signals[] = process.platform === 'win32'
+    ? ['SIGINT', 'SIGTERM']
+    : ['SIGINT', 'SIGTERM', 'SIGUSR1', 'SIGUSR2'];
+  const signalHandlers = new Map<NodeJS.Signals, () => void>();
+  for (const signal of forwardedSignals) {
+    const handler = () => forwardSignal(signal);
+    signalHandlers.set(signal, handler);
+    process.on(signal, handler);
+  }
+  process.once('exit', terminateChildOnLauncherExit);
+  try {
+    const outcome = await new Promise<{ code: number | null; signal: NodeJS.Signals | null }>((resolveChild, rejectChild) => {
+      child.once('error', rejectChild);
+      child.once('exit', (code, signal) => {
+        childExited = true;
+        resolveChild({ code, signal });
+      });
+    });
+    if (outcome.signal) {
+      for (const [signal, handler] of signalHandlers) process.off(signal, handler);
+      signalHandlers.clear();
+      process.off('exit', terminateChildOnLauncherExit);
+      process.kill(process.pid, outcome.signal);
+      return;
+    }
+    if (outcome.code !== 0) process.exitCode = outcome.code ?? 1;
+  } finally {
+    for (const [signal, handler] of signalHandlers) process.off(signal, handler);
+    process.off('exit', terminateChildOnLauncherExit);
   }
-  await loaded.runCanonicalRuntimeCli(argv);
 }
 
 if (import.meta.main) {

package/src/runtime/root/release-manifest.ts

@@ -53,20 +53,19 @@ function optionalRuntimeComponent<
 export const COMPILED_RUNTIME_RELEASE_COMPONENT_FIELDS = [
   'executionMode',
   'runtimeBundleEntrypoint', 'runtimeBundleArtifactIdentity',
+  'runtimeInterpreterEntrypoint', 'runtimeInterpreterArtifactIdentity',
   'diagnosticEntrypoint', 'diagnosticArtifactIdentity',
+  'connectorEntrypoint', 'connectorArtifactIdentity',
   'browserNodeBridgeEntrypoint', 'browserNodeBridgeArtifactIdentity',
   'browserHandoffEntrypoint', 'browserHandoffArtifactIdentity',
+  'workflowSupervisorNativeHostEntrypoint', 'workflowSupervisorNativeHostArtifactIdentity',
   'processRunnerEntrypoint', 'processRunnerArtifactIdentity',
   'checkRunnerEntrypoint', 'checkRunnerArtifactIdentity',
   'schedulerWorkerEntrypoint', 'schedulerWorkerArtifactIdentity',
   'periodicCleanupEntrypoint', 'periodicCleanupArtifactIdentity',
   'pluginActionSidecarEntrypoint', 'pluginActionSidecarArtifactIdentity',
   'externalPluginProbeEntrypoint', 'externalPluginProbeArtifactIdentity',
-  'codeGraphNodeEntrypoint', 'codeGraphNodeArtifactIdentity',
-  'codeGraphSidecarEntrypoint', 'codeGraphSidecarArtifactIdentity',
-  'codeGraphLibraryRoot', 'codeGraphLibraryArtifactIdentity',
   'packageRoot', 'packageArtifactIdentity',
-  'controllerUiRoot', 'controllerUiArtifactIdentity',
 ] as const satisfies readonly (keyof RuntimeReleaseManifest)[];
 
 /**
@@ -120,12 +119,32 @@ export function loadRuntimeReleaseManifest(
     identityField: 'runtimeBundleArtifactIdentity',
     canonicalEntry: 'forge-runtime-bundle.js',
   });
+  const runtimeInterpreter = optionalRuntimeComponent({
+    value,
+    entryField: 'runtimeInterpreterEntrypoint',
+    identityField: 'runtimeInterpreterArtifactIdentity',
+    canonicalEntry: (process.platform === 'win32' ? 'forge-runtime-bun.exe' : 'forge-runtime-bun') as RuntimeReleaseManifest['runtimeInterpreterEntrypoint'],
+  });
   if (value.configurationSchemaVersion !== 1) {
     throw new Error('RELEASE_MANIFEST_INVALID: configurationSchemaVersion must be 1');
   }
-  const controllerHome = resolve(requireString(value.controllerHome, 'controllerHome'));
-  if (canonicalExistingPathIdentity(controllerHome) !== canonicalExistingPathIdentity(expectedControllerHome)) {
-    throw new Error('RELEASE_MANIFEST_CONTROLLER_HOME_MISMATCH');
+  // Pre-scope compiled releases were portable and omitted both fields. Legacy
+  // package releases always persisted controllerHome, so preserve that binding
+  // while accepting the immutable compiled artifact format already in use.
+  const deploymentScope = value.deploymentScope === undefined
+    ? (value.controllerHome === undefined ? 'portable' : 'controller-home')
+    : requireString(value.deploymentScope, 'deploymentScope');
+  if (deploymentScope !== 'controller-home' && deploymentScope !== 'portable') {
+    throw new Error(`RELEASE_MANIFEST_INVALID: deploymentScope must be portable when present, got ${deploymentScope}`);
+  }
+  let controllerHome: string | undefined;
+  if (deploymentScope === 'controller-home') {
+    controllerHome = resolve(requireString(value.controllerHome, 'controllerHome'));
+    if (canonicalExistingPathIdentity(controllerHome) !== canonicalExistingPathIdentity(expectedControllerHome)) {
+      throw new Error('RELEASE_MANIFEST_CONTROLLER_HOME_MISMATCH');
+    }
+  } else if (value.controllerHome !== undefined) {
+    throw new Error('RELEASE_MANIFEST_INVALID: portable release must not embed controllerHome');
   }
   const compatibility = value.databaseSchemaCompatibility as Record<string, unknown> | undefined;
   const minimum = Number(compatibility?.minimum);
@@ -144,6 +163,12 @@ export function loadRuntimeReleaseManifest(
     identityField: 'diagnosticArtifactIdentity',
     canonicalEntry: 'forge-cli',
   });
+  const connector = optionalRuntimeComponent({
+    value,
+    entryField: 'connectorEntrypoint',
+    identityField: 'connectorArtifactIdentity',
+    canonicalEntry: 'forge-mcp-gateway',
+  });
   const browserNodeBridge = optionalRuntimeComponent({
     value,
     entryField: 'browserNodeBridgeEntrypoint',
@@ -156,6 +181,12 @@ export function loadRuntimeReleaseManifest(
     identityField: 'browserHandoffArtifactIdentity',
     canonicalEntry: 'browser-handoff-host.js',
   });
+  const workflowSupervisorNativeHost = optionalRuntimeComponent({
+    value,
+    entryField: 'workflowSupervisorNativeHostEntrypoint',
+    identityField: 'workflowSupervisorNativeHostArtifactIdentity',
+    canonicalEntry: 'forge-workflow-supervisor-native-host',
+  });
   const processRunner = optionalRuntimeComponent({
     value,
     entryField: 'processRunnerEntrypoint',
@@ -168,6 +199,18 @@ export function loadRuntimeReleaseManifest(
     identityField: 'checkRunnerArtifactIdentity',
     canonicalEntry: 'forge-check-runner',
   });
+  const typescriptNavigation = optionalRuntimeComponent({
+    value,
+    entryField: 'typescriptNavigationEntrypoint',
+    identityField: 'typescriptNavigationArtifactIdentity',
+    canonicalEntry: 'forge-typescript-navigation',
+  });
+  const contextPack = optionalRuntimeComponent({
+    value,
+    entryField: 'contextPackEntrypoint',
+    identityField: 'contextPackArtifactIdentity',
+    canonicalEntry: 'forge-context-pack',
+  });
   const schedulerWorker = optionalRuntimeComponent({
     value,
     entryField: 'schedulerWorkerEntrypoint',
@@ -232,36 +275,6 @@ export function loadRuntimeReleaseManifest(
     };
   }
 
-  const codeGraphFields = [
-    value.codeGraphNodeEntrypoint,
-    value.codeGraphNodeArtifactIdentity,
-    value.codeGraphSidecarEntrypoint,
-    value.codeGraphSidecarArtifactIdentity,
-    value.codeGraphLibraryRoot,
-    value.codeGraphLibraryArtifactIdentity,
-  ];
-  const hasCodeGraphRuntime = codeGraphFields.some((entry) => entry !== undefined);
-  let codeGraphRuntime: Pick<RuntimeReleaseManifest,
-    'codeGraphNodeEntrypoint' | 'codeGraphNodeArtifactIdentity'
-    | 'codeGraphSidecarEntrypoint' | 'codeGraphSidecarArtifactIdentity'
-    | 'codeGraphLibraryRoot' | 'codeGraphLibraryArtifactIdentity'> | undefined;
-  if (hasCodeGraphRuntime) {
-    const nodeEntrypoint = requireString(value.codeGraphNodeEntrypoint, 'codeGraphNodeEntrypoint');
-    const sidecarEntrypoint = requireString(value.codeGraphSidecarEntrypoint, 'codeGraphSidecarEntrypoint');
-    const libraryRoot = requireString(value.codeGraphLibraryRoot, 'codeGraphLibraryRoot');
-    if (nodeEntrypoint !== 'codegraph-node' || sidecarEntrypoint !== 'codegraph-sidecar.cjs' || libraryRoot !== 'codegraph-lib') {
-      throw new Error('RELEASE_MANIFEST_INVALID: CodeGraph release paths must use the canonical co-located names');
-    }
-    codeGraphRuntime = {
-      codeGraphNodeEntrypoint: 'codegraph-node',
-      codeGraphNodeArtifactIdentity: requireSha256Identity(value.codeGraphNodeArtifactIdentity, 'codeGraphNodeArtifactIdentity'),
-      codeGraphSidecarEntrypoint: 'codegraph-sidecar.cjs',
-      codeGraphSidecarArtifactIdentity: requireSha256Identity(value.codeGraphSidecarArtifactIdentity, 'codeGraphSidecarArtifactIdentity'),
-      codeGraphLibraryRoot: 'codegraph-lib',
-      codeGraphLibraryArtifactIdentity: requireSha256Identity(value.codeGraphLibraryArtifactIdentity, 'codeGraphLibraryArtifactIdentity'),
-    };
-  }
-
   const argumentsValue = value.arguments;
   if (!Array.isArray(argumentsValue) || argumentsValue.some((item) => typeof item !== 'string')) {
     throw new Error('RELEASE_MANIFEST_INVALID: arguments must be a string array');
@@ -280,22 +293,26 @@ export function loadRuntimeReleaseManifest(
     entrypoint: 'forge-runtime',
     ...(executionMode ? { executionMode: 'standalone-binary' as const } : {}),
     ...(runtimeBundle ?? {}),
+    ...(runtimeInterpreter ?? {}),
     ...(diagnostic ?? {}),
+    ...(connector ?? {}),
     ...(browserNodeBridge ?? {}),
     ...(browserHandoff ?? {}),
+    ...(workflowSupervisorNativeHost ?? {}),
     ...(processRunner ?? {}),
     ...(checkRunner ?? {}),
+    ...(typescriptNavigation ?? {}),
+    ...(contextPack ?? {}),
     ...(schedulerWorker ?? {}),
     ...(periodicCleanup ?? {}),
     ...(pluginActionSidecar ?? {}),
     ...(externalPluginProbe ?? {}),
     ...(browserAutomationHelper ?? {}),
-    ...(codeGraphRuntime ?? {}),
     ...(packageSnapshot ?? {}),
     ...(controllerUi ?? {}),
     arguments: argumentsValue as string[],
     configurationSchemaVersion: 1,
-    controllerHome,
+    ...(deploymentScope === 'portable' ? { deploymentScope: 'portable' as const } : { controllerHome: controllerHome! }),
     databaseSchemaCompatibility: { minimum, maximum },
     workerProtocolVersion,
     ...(typeof value.sourceRepositoryId === 'string' && value.sourceRepositoryId.trim() ? { sourceRepositoryId: value.sourceRepositoryId.trim() } : {}),
@@ -310,9 +327,10 @@ export interface RuntimeReleaseExecutionSurface {
   manifest: RuntimeReleaseManifest;
   releaseRoot: string;
   entries: Array<{
-    name: 'process_runner' | 'check_runner' | 'scheduler_worker' | 'periodic_cleanup';
+    name: 'runtime_interpreter' | 'process_runner' | 'check_runner' | 'typescript_navigation' | 'context_pack' | 'scheduler_worker' | 'periodic_cleanup';
     path: string;
     artifactIdentity: string;
+    canary: 'runtime_interpreter' | 'process_runtime';
   }>;
 }
 
@@ -338,25 +356,47 @@ export function assertRuntimeReleaseExecutionSurface(
   }
   const releaseRoot = dirname(resolvedManifestPath);
   const entries: RuntimeReleaseExecutionSurface['entries'] = [
+    ...(manifest.runtimeInterpreterEntrypoint && manifest.runtimeInterpreterArtifactIdentity ? [{
+      name: 'runtime_interpreter' as const,
+      path: join(releaseRoot, manifest.runtimeInterpreterEntrypoint),
+      artifactIdentity: manifest.runtimeInterpreterArtifactIdentity,
+      canary: 'runtime_interpreter' as const,
+    }] : []),
     {
       name: 'process_runner',
       path: join(releaseRoot, manifest.processRunnerEntrypoint),
       artifactIdentity: manifest.processRunnerArtifactIdentity,
+      canary: 'process_runtime',
     },
     {
       name: 'check_runner',
       path: join(releaseRoot, manifest.checkRunnerEntrypoint),
       artifactIdentity: manifest.checkRunnerArtifactIdentity,
+      canary: 'process_runtime',
     },
+    ...(manifest.typescriptNavigationEntrypoint && manifest.typescriptNavigationArtifactIdentity ? [{
+      name: 'typescript_navigation' as const,
+      path: join(releaseRoot, manifest.typescriptNavigationEntrypoint),
+      artifactIdentity: manifest.typescriptNavigationArtifactIdentity,
+      canary: 'process_runtime' as const,
+    }] : []),
+    ...(manifest.contextPackEntrypoint && manifest.contextPackArtifactIdentity ? [{
+      name: 'context_pack' as const,
+      path: join(releaseRoot, manifest.contextPackEntrypoint),
+      artifactIdentity: manifest.contextPackArtifactIdentity,
+      canary: 'process_runtime' as const,
+    }] : []),
     ...(manifest.schedulerWorkerEntrypoint && manifest.schedulerWorkerArtifactIdentity ? [{
       name: 'scheduler_worker' as const,
       path: join(releaseRoot, manifest.schedulerWorkerEntrypoint),
       artifactIdentity: manifest.schedulerWorkerArtifactIdentity,
+      canary: 'process_runtime' as const,
     }] : []),
     ...(manifest.periodicCleanupEntrypoint && manifest.periodicCleanupArtifactIdentity ? [{
       name: 'periodic_cleanup' as const,
       path: join(releaseRoot, manifest.periodicCleanupEntrypoint),
       artifactIdentity: manifest.periodicCleanupArtifactIdentity,
+      canary: 'process_runtime' as const,
     }] : []),
   ];
   for (const entry of entries) {