@moretea-labs/forge 1.8.0 → 1.8.2

package/scripts/forge-local-recovery-helper.mjs

@@ -4,15 +4,46 @@ import { existsSync, readFileSync } from 'fs';
 import { isAbsolute, join, resolve } from 'path';
 import { pathToFileURL } from 'url';
 import { resolveControllerHome } from '../src/cli/repositories/controller-home.ts';
-import { findRegisteredRepositoryByCheckoutRoot } from '../src/cli/repositories/registry.ts';
+import { findRegisteredRepositoryByCheckoutRoot, getRepository } from '../src/cli/repositories/registry.ts';
 import { createRecoveryConfig, gatewayToken, loadRecoveryConfig } from '../src/runtime/standalone-recovery/core.ts';
 
 export const PLUGIN_ID = 'local_recovery';
 export const PLUGIN_VERSION = '0.1.0';
 export const PROTOCOL_VERSION = 1;
 export const CAPABILITIES = ['forge.local_recovery.transport.v1'];
-export const ACTIONS = ['runtime_status', 'list_releases', 'stage_and_activate_runtime_release'];
-const MUTATING_ACTIONS = new Set(['stage_and_activate_runtime_release']);
+export const ACTIONS = [
+  'runtime_status',
+  'list_releases',
+  'verify_stable_runtime',
+  'stage_and_activate_runtime_release',
+  'release_session_status',
+  'advance_runtime_release_session',
+  'verify_runtime_release_session_static',
+  'verify_runtime_release_session_candidate',
+  'cutover_runtime_release_session',
+  'cancel_runtime_release_session',
+  'rollback_runtime_release_session',
+  'promote_runtime_release_session_known_good',
+];
+const RELEASE_SESSION_ACTIONS = new Set([
+  'release_session_status',
+  'verify_runtime_release_session_static',
+  'verify_runtime_release_session_candidate',
+  'cutover_runtime_release_session',
+  'cancel_runtime_release_session',
+  'rollback_runtime_release_session',
+  'promote_runtime_release_session_known_good',
+]);
+const MUTATING_ACTIONS = new Set([
+  'stage_and_activate_runtime_release',
+  'advance_runtime_release_session',
+  'verify_runtime_release_session_static',
+  'verify_runtime_release_session_candidate',
+  'cutover_runtime_release_session',
+  'cancel_runtime_release_session',
+  'rollback_runtime_release_session',
+  'promote_runtime_release_session_known_good',
+]);
 const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '::1']);
 
 function providerError(code, message, retryable = false, details) {
@@ -91,8 +122,7 @@ export async function callRecoveryTool(controllerHome, toolName, args = {}, inje
       protocolVersion: '2025-06-18', capabilities: {}, clientInfo: { name: 'forge-local-recovery-provider', version: PLUGIN_VERSION },
     },
   });
-  const sessionId = initialized.response.headers.get('mcp-session-id');
-  if (!sessionId) throw providerError('LOCAL_RECOVERY_MCP_SESSION_MISSING', 'Recovery MCP initialize did not return a session id.');
+  const sessionId = initialized.response.headers.get('mcp-session-id') || undefined;
   try {
     await postRpc(fetchImpl, endpoint, token, { jsonrpc: '2.0', method: 'notifications/initialized' }, sessionId);
     const called = await postRpc(fetchImpl, endpoint, token, {
@@ -101,15 +131,21 @@ export async function callRecoveryTool(controllerHome, toolName, args = {}, inje
     if (called.payload?.error) throw providerError('LOCAL_RECOVERY_TOOL_FAILED', String(called.payload.error?.message ?? 'Recovery tool failed.'), false);
     const content = called.payload?.result?.content;
     const text = Array.isArray(content) ? content.find((entry) => entry?.type === 'text' && typeof entry.text === 'string')?.text : undefined;
+    if (called.payload?.result?.isError === true) {
+      const message = typeof text === 'string' && text.trim() ? text.trim().slice(0, 4000) : 'Recovery tool failed.';
+      throw providerError('LOCAL_RECOVERY_TOOL_FAILED', message, false);
+    }
     if (text) return parseJson(text, 'LOCAL_RECOVERY_TOOL_RESULT_INVALID');
     return called.payload?.result ?? {};
   } finally {
-    try {
-      await fetchImpl(endpoint, {
-        method: 'DELETE',
-        headers: { authorization: `Bearer ${token}`, accept: 'application/json, text/event-stream', 'mcp-session-id': sessionId },
-      });
-    } catch { /* Session cleanup is best effort; Recovery owns mutation transaction durability. */ }
+    if (sessionId) {
+      try {
+        await fetchImpl(endpoint, {
+          method: 'DELETE',
+          headers: { authorization: `Bearer ${token}`, accept: 'application/json, text/event-stream', 'mcp-session-id': sessionId },
+        });
+      } catch { /* Session cleanup is best effort; ReleaseSession durability is independent from this transport session. */ }
+    }
   }
 }
 
@@ -119,6 +155,17 @@ function assertEmptyInput(input) {
   }
 }
 
+function releaseSessionInput(input) {
+  if (!input || typeof input !== 'object' || Array.isArray(input) || Object.keys(input).length !== 1 || typeof input.session_id !== 'string') {
+    throw providerError('LOCAL_RECOVERY_RELEASE_SESSION_ARGUMENTS_INVALID', 'ReleaseSession actions accept only session_id.');
+  }
+  const sessionId = input.session_id.trim();
+  if (sessionId.length < 8 || sessionId.length > 120) {
+    throw providerError('LOCAL_RECOVERY_RELEASE_SESSION_ID_INVALID', 'ReleaseSession session_id must be 8 to 120 characters.');
+  }
+  return { session_id: sessionId };
+}
+
 function mutationRequestId(requestId) {
   return `local-recovery:${createHash('sha256').update(String(requestId)).digest('hex').slice(0, 32)}`;
 }
@@ -127,9 +174,36 @@ export function ensureSourceRepositoryProvenance(controllerHome, injected = {})
   const loadConfig = injected.loadRecoveryConfig ?? loadRecoveryConfig;
   const persistConfig = injected.createRecoveryConfig ?? createRecoveryConfig;
   const findRepository = injected.findRegisteredRepositoryByCheckoutRoot ?? findRegisteredRepositoryByCheckoutRoot;
+  const readRepository = injected.getRepository ?? getRepository;
   const recoveryConfig = loadConfig(controllerHome);
-  if (typeof recoveryConfig.primaryRuntimeSourceRepositoryId === 'string' && recoveryConfig.primaryRuntimeSourceRepositoryId.trim()) return recoveryConfig;
+  const repositoryId = typeof recoveryConfig.primaryRuntimeSourceRepositoryId === 'string'
+    ? recoveryConfig.primaryRuntimeSourceRepositoryId.trim()
+    : '';
   const sourceRoot = typeof recoveryConfig.primaryRuntimeSourceRoot === 'string' ? recoveryConfig.primaryRuntimeSourceRoot.trim() : '';
+
+  if (repositoryId) {
+    let repository;
+    try {
+      repository = readRepository(repositoryId, controllerHome);
+    } catch {
+      throw providerError('LOCAL_RECOVERY_SOURCE_REPOSITORY_UNRESOLVED', 'Configured primary Runtime source repository id is not one enabled registered repository.');
+    }
+    if (!repository || repository.repoId !== repositoryId || repository.enabled === false || repository.removedAt) {
+      throw providerError('LOCAL_RECOVERY_SOURCE_REPOSITORY_UNRESOLVED', 'Configured primary Runtime source repository id is not one enabled registered repository.');
+    }
+    const canonicalRoot = typeof repository.canonicalRoot === 'string' && repository.canonicalRoot.trim()
+      ? resolve(repository.canonicalRoot.trim())
+      : '';
+    if (!canonicalRoot || !isAbsolute(canonicalRoot) || !existsSync(canonicalRoot)) {
+      throw providerError('LOCAL_RECOVERY_SOURCE_CANONICAL_ROOT_UNAVAILABLE', 'Configured primary Runtime source repository canonical root is unavailable.');
+    }
+    if (sourceRoot && resolve(sourceRoot) === canonicalRoot) return recoveryConfig;
+    return persistConfig(controllerHome, {
+      primaryRuntimeSourceRoot: canonicalRoot,
+      primaryRuntimeSourceRepositoryId: repositoryId,
+    });
+  }
+
   if (!sourceRoot) throw providerError('LOCAL_RECOVERY_SOURCE_ROOT_UNAVAILABLE', 'Installed Recovery config does not identify the primary Runtime source root.');
   const repository = findRepository(sourceRoot, controllerHome);
   if (!repository?.repoId) throw providerError('LOCAL_RECOVERY_SOURCE_REPOSITORY_UNRESOLVED', 'Configured primary Runtime source root is not owned by one registered repository.');
@@ -142,10 +216,14 @@ export function ensureSourceRepositoryProvenance(controllerHome, injected = {})
 export async function executeAction(actionId, input, providerConfig, injected = {}) {
   const config = validateProviderConfig(providerConfig);
   if (!ACTIONS.includes(actionId)) throw providerError('LOCAL_RECOVERY_ACTION_UNSUPPORTED', 'Unsupported Local Recovery action.');
-  assertEmptyInput(input);
+  const sessionArgs = RELEASE_SESSION_ACTIONS.has(actionId) ? releaseSessionInput(input) : undefined;
+  if (!sessionArgs) assertEmptyInput(input);
   const callTool = injected.callRecoveryTool ?? callRecoveryTool;
-  if (actionId === 'stage_and_activate_runtime_release') ensureSourceRepositoryProvenance(config.controllerHome, injected);
-  const args = MUTATING_ACTIONS.has(actionId) ? { request_id: mutationRequestId(injected.requestId ?? actionId) } : {};
+  if (actionId === 'stage_and_activate_runtime_release' || actionId === 'advance_runtime_release_session') ensureSourceRepositoryProvenance(config.controllerHome, injected);
+  const args = {
+    ...(sessionArgs ?? {}),
+    ...(MUTATING_ACTIONS.has(actionId) ? { request_id: mutationRequestId(injected.requestId ?? actionId) } : {}),
+  };
   return await callTool(config.controllerHome, actionId, args, injected);
 }
 

package/scripts/init-project.sh

@@ -373,60 +373,14 @@ install_dev_tools() {
     echo -e "${GREEN}Dev tools installed!${NC}"
 }
 
-# Write version stamp into the generated project
-write_version_stamp() {
-    local skill_version_file="$SCRIPT_DIR/../assets/skill-version.json"
-    local stamp_dir=".claude"
-    local stamp_file="$stamp_dir/.skill-version"
-    local sv_version="unknown"
-    local sv_template_version="unknown"
-
-    if [ -f "$skill_version_file" ] && command_exists bun; then
-        sv_version=$(bun -e "console.log(JSON.parse(require('fs').readFileSync('$skill_version_file','utf-8')).version)")
-        sv_template_version=$(bun -e "console.log(JSON.parse(require('fs').readFileSync('$skill_version_file','utf-8')).templateVersion)")
-    elif [ -f "$skill_version_file" ] && command_exists node; then
-        sv_version=$(node -e "console.log(JSON.parse(require('fs').readFileSync('$skill_version_file','utf-8')).version)")
-        sv_template_version=$(node -e "console.log(JSON.parse(require('fs').readFileSync('$skill_version_file','utf-8')).templateVersion)")
-    fi
-
-    mkdir -p "$stamp_dir"
-    cat > "$stamp_file" << STAMP_EOF
-skill_version=$sv_version
-template_version=$sv_template_version
-generated_at=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
-plan_type=${STACK}
-STAMP_EOF
-    echo -e "${GREEN}Version stamp written to $stamp_file${NC}"
-}
-
-# Run a skill lifecycle hook (if bun is available)
-run_skill_hook() {
-    local event="$1"
-    local hook_script="$SCRIPT_DIR/run-skill-hook.ts"
-
-    if command_exists bun && [ -f "$hook_script" ]; then
-        bun "$hook_script" "$event" --context "{\"projectName\":\"$PROJECT_NAME\",\"stack\":\"$STACK\"}" 2>&1 || {
-            if [[ "$event" == pre-* ]]; then
-                echo -e "${RED}Pre-hook $event failed, aborting.${NC}"
-                return 1
-            else
-                echo -e "${YELLOW}Post-hook $event warning (non-fatal).${NC}"
-            fi
-        }
-    fi
-}
-
 # Main execution
 main() {
-    run_skill_hook "pre-init" || exit 1
 
     check_package_manager
     create_project
     create_structure
     install_dev_tools
-    write_version_stamp
 
-    run_skill_hook "post-init"
 
     echo ""
     echo -e "${GREEN}=== Project initialized successfully! ===${NC}"

package/scripts/install-ios-hid-toolchain.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# Install the one Controller-owned physical-iPhone HID Python toolchain.
+# Execute only with an authorized ForgeInstance host process:exec grant.
+set -euo pipefail
+
+if [[ $# -ne 1 || ! -d "$1" ]]; then
+  echo "Usage: $0 <existing-controller-home>" >&2
+  exit 2
+fi
+if [[ "$(uname -s)" != "Darwin" ]]; then
+  echo "The CoreDevice HID toolchain requires macOS." >&2
+  exit 2
+fi
+
+repo_root="$(cd "$(dirname "$0")/.." && pwd -P)"
+controller_home="$(cd "$1" && pwd -P)"
+version="11.24.0"
+# The provider source is the sole runtime version authority. Refuse a stale installer.
+if ! grep -Fq "export const IOS_HID_TOOLCHAIN_VERSION = '$version';" \
+  "$repo_root/src/runtime/plugins/ios/remote-xpc-hid.ts"; then
+  echo "Installer version no longer matches the RemoteXPC provider pin." >&2
+  exit 2
+fi
+
+toolchains="$controller_home/toolchains"
+mkdir -p "$toolchains"
+target="$toolchains/pymobiledevice3-$version"
+lock="$toolchains/.pymobiledevice3-$version-install.lock"
+if ! mkdir "$lock" 2>/dev/null; then
+  echo "The pinned HID toolchain is already being installed; no parallel writer." >&2
+  exit 1
+fi
+
+created=false
+completed=false
+cleanup() {
+  if [[ "$created" == true && "$completed" != true ]]; then
+    rm -rf -- "$target"
+  fi
+  rmdir "$lock" 2>/dev/null || true
+}
+trap cleanup EXIT
+
+verify() {
+  "$1" -c "from importlib.metadata import version; from pymobiledevice3.remote.remote_service_discovery import RemoteServiceDiscoveryService; from pymobiledevice3.remote.core_device.pasteboard_service import PasteboardService; from pymobiledevice3.remote.core_device.hid_service import UniversalHIDServiceService, touch_session; actual=version('pymobiledevice3'); assert actual == '$version', (actual, '$version'); print('pymobiledevice3 ' + actual + ' verified')"
+}
+
+if [[ -e "$target" ]]; then
+  verify "$target/bin/python"
+  completed=true
+  exit 0
+fi
+
+# A newly created target is owned by this invocation. Never alter an old toolchain.
+created=true
+python3 -m venv "$target"
+"$target/bin/python" -m pip install --disable-pip-version-check --no-input "pymobiledevice3==$version"
+verify "$target/bin/python"
+completed=true
+printf 'Installed Controller-owned HID toolchain: %s\n' "$target"

package/scripts/install-standalone-recovery.ts

@@ -2,7 +2,7 @@ import { createHash } from 'crypto';
 import { isAbsolute, join, resolve } from 'path';
 import { hostname } from 'os';
 import { systemdUserUnitName } from '../src/cli/controller/systemd-user';
-import { openAiSecureTunnelConnectArgs } from '../src/cli/mcp/openai-secure-tunnel';
+import { openAiSecureTunnelConnectArgs } from '../adapters/mcp/tunnels/openai-secure-tunnel';
 import type { OpenAiSecureTunnelServiceConfig, PrimaryConnectorServiceConfig, PublicTunnelServiceConfig, RecoveryTunnelServiceConfig } from '../src/runtime/standalone-recovery/core';
 import { installStandaloneRecovery } from '../src/runtime/standalone-recovery/installer';
 

package/scripts/lib/project-init-lib.sh

@@ -1029,7 +1029,7 @@ pi_install_helpers() {
   local target_dir="$1"
   local helpers_dir="$2"
   local mode="${3:-apply}"
-  local helper_names="${4:-new-spec.sh new-sprint.sh new-plan.sh capture-plan.sh plan-to-todo.sh contract-run.ts contract-worktree.sh ship-worktrees.sh archive-workflow.sh refresh-current-status.sh prepare-handoff.sh verify-contract.sh summarize-failures.sh verify-sprint.sh sprint-backlog.sh check-task-sync.sh check-deploy-sql-order.sh check-architecture-sync.sh check-agent-tooling.sh check-context-files.sh check-brain-manifest.sh sync-brain-docs.sh check-skill-version.ts select-agent-context-blocks.sh ensure-task-workflow.sh check-task-workflow.sh switch-plan.sh workflow-contract.ts inspect-project-state.ts migrate-workflow-docs.ts migrate-project-template.sh capability-resolver.ts architecture-event.ts capability-config.ts architecture-queue.sh context-contract-sync.sh workstream-sync.sh prepare-codex-handoff.sh codex-handoff-resume.sh}"
+  local helper_names="${4:-new-spec.sh new-sprint.sh new-plan.sh capture-plan.sh plan-to-todo.sh contract-run.ts contract-worktree.sh ship-worktrees.sh archive-workflow.sh refresh-current-status.sh prepare-handoff.sh verify-contract.sh summarize-failures.sh verify-sprint.sh sprint-backlog.sh check-task-sync.sh check-deploy-sql-order.sh check-architecture-sync.sh check-agent-tooling.sh check-context-files.sh check-brain-manifest.sh sync-brain-docs.sh select-agent-context-blocks.sh ensure-task-workflow.sh check-task-workflow.sh switch-plan.sh workflow-contract.ts inspect-project-state.ts migrate-workflow-docs.ts migrate-project-template.sh capability-resolver.ts architecture-event.ts capability-config.ts architecture-queue.sh context-contract-sync.sh workstream-sync.sh prepare-codex-handoff.sh codex-handoff-resume.sh}"
   local scripts_dir="$target_dir/scripts"
   local runtime_dir="$target_dir/.ai/harness/scripts"
   local helper_name
@@ -1283,7 +1283,7 @@ pi_external_tooling_defaults_summary() {
 - Mode: optional-enhancements
 - Detection: setup/readiness only
 - Waza/gstack/gbrain/Mermaid: optional host enhancements; never required for Forge correctness
-- CodeGraph: Forge bundled structural backend; global CLI/MCP is optional host integration
+- Code location: ripgrep lexical source search with explicit language-service definition/reference navigation; no managed graph index
 - Auto-actions: never install, upgrade, serve, sync, or enable unrelated third-party tooling automatically
 EOF_EXTERNAL_TOOLING_DEFAULTS
 }
@@ -1424,7 +1424,7 @@ pi_forge_version_for_refs() {
     printf '%s\n' "unknown"
     return 0
   fi
-  local version_file="$root_dir/assets/skill-version.json"
+  local version_file="$root_dir/package.json"
 
   if [[ -f "$version_file" ]]; then
     sed -n 's/^[[:space:]]*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$version_file" | head -n 1
@@ -1825,6 +1825,9 @@ This is the root routing contract for Claude Code and Codex.
 - Keep root context concise; route durable human-authored detail into product, architecture, research, or intentional project documents.
 - Treat `_ref/` as ignored external reference material and `_ops/` as ignored local operations residue.
 - Use Controller Home for mutable workflow state instead of recreating repo-local task/workstream/session projections.
+- For architecture migrations, use one bounded Delivery Transaction: batch discovery -> architecture/root-cause decision -> freeze scope -> coherent implementation -> whole-diff review -> focused validation wave -> canonical gates -> one delivery/cleanup.
+- Do not create sibling Work, per-file commits, repeated broad validation, or release/canary cycles for same-root-cause discoveries while the current candidate is still moving.
+- Treat release as a source-complete candidate boundary. Defer workflow/lifecycle machinery improvements to a post-release Plan when they are not required to converge the current version safely.
 EOF_ROOT_CONTEXT
 }
 

package/scripts/migrate-windows-wsl-controller-home.ts

@@ -12,6 +12,7 @@ import {
 import { homedir } from 'os';
 import { basename, dirname, join, resolve } from 'path';
 import { spawnSync } from 'child_process';
+import { assertRuntimeReleaseExecutionCanaries } from '../src/runtime/root/release-execution-canary';
 import { stageRuntimeRelease } from '../src/runtime/root/release-materialize';
 import { publishRuntimeRelease } from '../src/runtime/root/release-store';
 
@@ -254,6 +255,7 @@ try {
   // the clean source checkout before any canonical unit starts.
   preserveLegacyReleaseAuthority(destination, timestamp);
   const stagedRelease = stageRuntimeRelease({ controllerHome: destination, sourceRoot });
+  assertRuntimeReleaseExecutionCanaries(stagedRelease.manifestPath, destination);
   publishRuntimeRelease(destination, stagedRelease.manifestPath, `windows-wsl-controller-home-migration-${timestamp}`);
   const release = readActiveRelease(destination);
   atomicWrite(unitPath(units.canonicalRuntime), renderRuntimeUnit(destination, units.canonicalRuntime, release), 0o644);

package/scripts/open-source-audit-allowlist.txt

@@ -17,7 +17,6 @@ tests/readme-dx.test.ts
 
 # Runtime proxy bypass intentionally includes Tailscale's standardized CGNAT CIDR.
 adapters/mcp/proxy-env.ts
-src/cli/mcp/proxy-env.ts
 
 # Scanner / redaction implementations intentionally embed pattern samples.
 scripts/public-release.ts
@@ -45,8 +44,6 @@ tests/runtime/target-architecture.test.ts
 # and installation locations to prove discovery and identity fencing.
 scripts/portability-bindings.mjs
 tests/runtime/browser-product-discovery.test.ts
-tests/runtime/chatgpt-work-continuation.test.ts
-tests/runtime/frozen-tool-contract-abi.test.ts
 tests/runtime/windows-host-discovery.test.ts
 tests/runtime/standalone-recovery.test.ts
 # Secret-marker rejection tests use non-secret synthetic values by design.
@@ -55,3 +52,4 @@ tests/runtime/context-plane.test.ts
 # Supervisor service unit tests use synthetic homeDir placeholders for PATH assembly.
 # Local monitor bridge defaults may reference a development repository id.
 scripts/run-mobile-monitor-bridge.ts
+tests/runtime/browser-session-authority.test.ts # Intentional placeholder user profile used to prove foreign Chrome profiles are never reclaimed.

package/scripts/run-bounded-command.mjs

@@ -49,6 +49,11 @@ if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || commandArgs.length === 0) {
   });
   child.once('close', (code) => {
     clearTimeout(timeout);
+    // The direct child can exit on SIGTERM while a stubborn descendant remains
+    // alive in its detached process group. Before dropping the escalation timer,
+    // synchronously send SIGKILL to that process group once more so timeout
+    // completion cannot orphan compiler/test descendants.
+    if (timedOut && process.platform !== 'win32') stop('SIGKILL');
     if (escalation) clearTimeout(escalation);
     process.exitCode = launchFailed ? 1 : (timedOut ? 124 : code ?? 1);
   });

package/scripts/run-governed-gate.ts

@@ -22,12 +22,13 @@ export function stepsFor(gate: Gate): Step[] {
     { label: 'repository hygiene', command: 'node', args: ['scripts/check-repository-hygiene.mjs'], timeoutMs: 2 * 60_000 },
     { label: 'generated authority', command: 'node', args: ['scripts/sync-generated-authority.mjs', '--check'], timeoutMs: 2 * 60_000 },
     { label: 'source duplication', command: 'node', args: ['scripts/check-source-duplication.mjs'], timeoutMs: 2 * 60_000 },
-    { label: 'controller UI bundle', command: 'bun', args: ['run', 'check:controller-ui'], timeoutMs: 5 * 60_000 },
     { label: 'test manifest', command: 'bun', args: ['run', 'check:test-governance'], timeoutMs: 5 * 60_000 },
     { label: 'affected tests', command: 'bun', args: ['run', 'test'], timeoutMs: 30 * 60_000 },
   ];
   if (gate === 'main') return [
     { label: 'focused task receipt', gate: 'task' },
+    { label: 'frozen MCP tool contract', command: 'bun', args: ['run', 'check:mcp-compatibility'], timeoutMs: 2 * 60_000 },
+    { label: 'quality harness benchmark', command: 'bun', args: ['run', 'check:quality-harness'], timeoutMs: 2 * 60_000 },
     { label: 'core regression', command: 'bun', args: ['run', 'test:core'], timeoutMs: 20 * 60_000 },
     { label: 'runtime smoke', command: 'bun', args: ['run', 'check:smoke'], timeoutMs: 10 * 60_000 },
   ];

package/scripts/run-mobile-monitor-bridge.ts

@@ -49,7 +49,6 @@ const handle = await startLocalBridgeServer({
   defaultRepoId,
   host,
   port,
-  openBrowser: false,
   allowLanMobileIntents: true,
   mode: 'standalone',
 });

package/scripts/smoke-control-plane-failure-domain.ts

@@ -0,0 +1,94 @@
+import { strict as assert } from 'node:assert';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import {
+  FORGE_RECOVERY_DAEMON_LABEL,
+  FORGE_RECOVERY_GATEWAY_LABEL,
+  forgeConnectorPersistentServiceLabel,
+  forgeRuntimePersistentServiceLabel,
+} from '../src/runtime/platform/service-inventory';
+import {
+  classifyRecoveryMcpRequest,
+  recoveryRuntimeRoleFromExecutable,
+} from '../src/runtime/standalone-recovery/entry';
+import { recentMcpTransportEvidence } from '../adapters/mcp/transports/http-observation';
+import { recordMcpTransportEvent, readRecentMcpTransportEvents } from '../src/runtime/diagnostics/mcp-timing';
+
+const controllerHome = mkdtempSync(join(tmpdir(), 'forge-control-plane-failure-domain-'));
+try {
+  // Main Runtime/MCP and Recovery must have distinct service identities. A
+  // restart or crash fence for one must not name the other lifecycle owner.
+  const runtimeLabel = forgeRuntimePersistentServiceLabel(controllerHome);
+  const connectorLabel = forgeConnectorPersistentServiceLabel(controllerHome);
+  assert.notEqual(runtimeLabel, FORGE_RECOVERY_DAEMON_LABEL);
+  assert.notEqual(runtimeLabel, FORGE_RECOVERY_GATEWAY_LABEL);
+  assert.notEqual(connectorLabel, FORGE_RECOVERY_DAEMON_LABEL);
+  assert.notEqual(connectorLabel, FORGE_RECOVERY_GATEWAY_LABEL);
+  assert.notEqual(FORGE_RECOVERY_DAEMON_LABEL, FORGE_RECOVERY_GATEWAY_LABEL);
+  assert.equal(recoveryRuntimeRoleFromExecutable('/tmp/forge-recovery-gateway'), 'gateway');
+  assert.equal(recoveryRuntimeRoleFromExecutable('/tmp/forge-recovery-watchdog'), 'watchdog');
+
+  // Recovery owns its own MCP route. Main MCP being unavailable must not turn a
+  // valid Recovery request into a route-level 404; authorization is evaluated
+  // by the Recovery gateway itself.
+  assert.equal(classifyRecoveryMcpRequest({
+    method: 'POST',
+    url: '/recovery/mcp',
+    headers: { authorization: 'Bearer recovery-token' },
+  } as any, 'recovery-token'), 'mcp');
+  assert.equal(classifyRecoveryMcpRequest({
+    method: 'POST',
+    url: '/recovery/mcp',
+    headers: {},
+  } as any, 'recovery-token'), 'auth_required');
+  assert.equal(classifyRecoveryMcpRequest({
+    method: 'POST',
+    url: '/main/mcp',
+    headers: { authorization: 'Bearer recovery-token' },
+  } as any, 'recovery-token'), 'not_mcp');
+
+  // Current health and recent incident evidence are separate dimensions. A
+  // successful reconnect does not erase the interruption that immediately
+  // preceded it, and a later health probe may still truthfully be green.
+  const interruptedAt = '2026-09-22T12:00:00.000Z';
+  const recoveredAt = '2026-09-22T12:00:05.000Z';
+  recordMcpTransportEvent(controllerHome, {
+    kind: 'interruption',
+    sessionId: 'mcp-before-outage',
+    connectionId: 'connection-before-outage',
+    route: '/mcp',
+    principalId: 'chatgpt-controller',
+    reason: 'transport_close',
+    at: interruptedAt,
+  });
+  recordMcpTransportEvent(controllerHome, {
+    kind: 'session_initialized',
+    sessionId: 'mcp-after-outage',
+    connectionId: 'connection-after-outage',
+    route: '/mcp',
+    principalId: 'chatgpt-controller',
+    at: recoveredAt,
+  });
+  const evidence = recentMcpTransportEvidence(
+    readRecentMcpTransportEvents(controllerHome),
+    '2026-09-22T11:00:00.000Z',
+    Date.parse('2026-09-22T12:01:00.000Z'),
+  );
+  assert.equal(evidence.current, 'healthy');
+  assert.equal(evidence.recentStatus, 'recovered');
+  assert.equal(evidence.lastInterruption?.at, interruptedAt);
+  assert.equal(evidence.lastRecoveryAt, recoveredAt);
+
+  console.log(JSON.stringify({
+    status: 'ok',
+    mainRuntimeLabel: runtimeLabel,
+    mainConnectorLabel: connectorLabel,
+    recoveryDaemonLabel: FORGE_RECOVERY_DAEMON_LABEL,
+    recoveryGatewayLabel: FORGE_RECOVERY_GATEWAY_LABEL,
+    recoveryRouteIndependent: true,
+    health: evidence,
+  }, null, 2));
+} finally {
+  rmSync(controllerHome, { recursive: true, force: true });
+}

package/scripts/smoke-ios-physical-device.ts

@@ -1,6 +1,7 @@
-import { existsSync } from 'fs';
+import { existsSync, readFileSync } from 'fs';
+import { createHash } from 'crypto';
 import { spawnSync } from 'child_process';
-import { executeIosPluginAction } from '../src/runtime/plugins/ios-adapter';
+import { computerPluginAdapter } from '../src/runtime/plugins/computer-registration';
 import { resolveRepoPreferredControllerHome } from '../src/cli/repositories/controller-home';
 
 const repoRoot = process.cwd();
@@ -29,12 +30,12 @@ const common = {
   controllerHome,
   repoId,
   repoRoot,
-  pluginId: 'ios',
+  pluginId: 'computer',
   origin: { surface: 'local-ui' as const, actor: 'physical-ios-live-smoke' },
 };
 
 async function invoke(actionId: string, args: Record<string, unknown>) {
-  return executeIosPluginAction({
+  return computerPluginAdapter.executeAction({
     ...common,
     actionId,
     args,
@@ -43,6 +44,7 @@ async function invoke(actionId: string, args: Record<string, unknown>) {
 }
 
 let interactionId: string | undefined;
+let reusedSession = false;
 try {
   const listed = await invoke('physical_device_list', {});
   const devices = Array.isArray(listed.devices) ? listed.devices as Array<Record<string, unknown>> : [];
@@ -50,6 +52,9 @@ try {
     entry.identifier === deviceSelector || entry.udid === deviceSelector || entry.name === deviceSelector);
   if (matches.length !== 1) throw new Error(`Expected exactly one physical iPhone for selector ${deviceSelector}; found ${matches.length}.`);
   const device = matches[0]!;
+  if (device.connected !== true || device.screenshotAvailable !== true) {
+    throw new Error(`The selected iPhone ${deviceSelector} has no connected CoreDevice screenshot transport. No app inspection or activation was attempted.`);
+  }
   const info = await invoke('physical_device_info', { device: device.identifier });
   const apps = await invoke('physical_device_apps', { device: device.identifier, bundle_id: bundleId });
   const installed = Array.isArray(apps.apps) ? apps.apps as Array<Record<string, unknown>> : [];
@@ -58,11 +63,15 @@ try {
   const opened = await invoke('physical_device_open', {
     device: device.identifier,
     bundle_id: bundleId,
-    relaunch: true,
+    relaunch: false,
+    observe_after_open: true,
+    // This is a one-shot open/capture receipt; do not retain a HID worker.
+    prewarm_input: false,
   });
   const interaction = opened.interaction as Record<string, unknown> | undefined;
   interactionId = typeof interaction?.interactionId === 'string' ? interaction.interactionId : undefined;
   if (!interactionId) throw new Error('The physical provider did not return an interaction id.');
+  reusedSession = opened.reusedSession === true;
 
   const screenshot = await invoke('physical_device_screenshot', {
     interaction_id: interactionId,
@@ -71,17 +80,29 @@ try {
   const artifacts = Array.isArray(screenshot.artifactCandidates)
     ? screenshot.artifactCandidates as Array<Record<string, unknown>>
     : [];
-  const path = typeof artifacts[0]?.path === 'string' ? artifacts[0].path : '';
+  const artifact = artifacts[0];
+  const path = typeof artifact?.path === 'string' ? artifact.path : '';
   if (!path || !existsSync(path)) throw new Error('The physical provider did not create a screenshot artifact.');
+  // Bind the local evidence to this exact CoreDevice observation without
+  // claiming what App, SKU or checkout price is actually visible.
+  const observation = screenshot.observation as Record<string, unknown> | undefined;
+  const image = readFileSync(path);
+  const screenshotSha256 = createHash('sha256').update(image).digest('hex');
+  const observationId = typeof observation?.observationId === 'string' ? observation.observationId : undefined;
+  if (!observationId || artifact?.sha256 !== screenshotSha256 || artifact?.bytes !== image.length
+    || observation?.screenshotSha256 !== screenshotSha256 || observation?.screenshotBytes !== image.length) {
+    throw new Error('The screenshot file and CoreDevice observation receipts do not match.');
+  }
   const metadata = spawnSync('sips', ['-g', 'pixelWidth', '-g', 'pixelHeight', '-g', 'format', path], { encoding: 'utf8' }).stdout;
   const width = metadata.match(/pixelWidth:\s*(\d+)/)?.[1];
   const height = metadata.match(/pixelHeight:\s*(\d+)/)?.[1];
   const format = metadata.match(/format:\s*(\S+)/)?.[1];
 
-  const closed = await invoke('physical_device_close', { interaction_id: interactionId });
+  const closed = reusedSession ? undefined : await invoke('physical_device_close', { interaction_id: interactionId });
   interactionId = undefined;
   const app = installed[0]!;
   console.log(JSON.stringify({
+    verificationLevel: 'source_computer_adapter_open_and_capture_only',
     device: {
       name: device.name,
       model: device.model,
@@ -97,20 +118,27 @@ try {
       version: app.version,
     },
     launchStatus: interaction?.status,
+    reusedSession,
     controlPlane: opened.controlPlane,
     coreDeviceCapabilities: info.capabilities,
     screenViewingURLAvailable: typeof info.screenViewingURL === 'string',
     screenshot: {
       created: true,
+      path,
+      sha256: screenshotSha256,
+      bytes: image.length,
+      observationId,
+      observedAt: observation?.observedAt,
+      semanticPriceVerified: false,
       width: width ? Number(width) : undefined,
       height: height ? Number(height) : undefined,
       format,
     },
-    closeStatus: (closed.interaction as Record<string, unknown> | undefined)?.status,
-    deviceUnmodified: closed.deviceUnmodified === true,
+    closeStatus: (closed?.interaction as Record<string, unknown> | undefined)?.status,
+    deviceUnmodified: closed?.deviceUnmodified === true,
   }, null, 2));
 } finally {
-  if (interactionId) {
+  if (interactionId && !reusedSession) {
     try { await invoke('physical_device_close', { interaction_id: interactionId }); } catch {}
   }
 }