@moretea-labs/forge 1.8.0 → 1.8.2

package/scripts/smoke-mcp-http-runtime.ts

@@ -6,13 +6,12 @@ import { join } from 'path';
 import { registerRepository } from '../src/cli/repositories/registry';
 import { readForgeRuntimeStatus } from '../src/runtime/control-plane/runtime-status-client';
 import { FORGE_TOOL_SURFACE } from '../src/cli/controller/runtime-config';
-import { CORE_CONTROLLER_TOOL_NAMES } from '../src/cli/mcp/toolset';
+import { controllerExposureSnapshot } from '../adapters/mcp/toolset';
 import { writeMcpServiceLocalConfig } from '../adapters/mcp/auth';
-import { buildMcpToolDefinitions } from '../src/cli/mcp/tools';
-import { runtimePolicy } from '../src/cli/mcp/multi-repository';
-import { resolveControllerToolsetSelection } from '../src/cli/mcp/toolset-selection';
+import { buildMcpToolDefinitions } from '../adapters/mcp/tool-mapping/tools';
+import { runtimePolicy } from '../adapters/mcp/multi-repository';
 import { RUNTIME_WRITE_CLAIM_ENV } from '../src/runtime/root/write-fence';
-import { createMcpToolContext, readCanonicalRuntimeToolSchema } from '../src/cli/mcp/server';
+import { createMcpToolContext, readCanonicalRuntimeToolSchema } from '../adapters/mcp/server';
 
 const root = mkdtempSync(join(tmpdir(), 'forge-mcp-http-smoke-'));
 const repoRoot = join(root, 'repo');
@@ -148,6 +147,11 @@ try {
     throw new Error(`GATEWAY_START_FAILED: ${error instanceof Error ? error.message : String(error)} ${stderr}`);
   }
   if (health.status !== 200 || health.body.status !== 'ok') throw new Error(`HEALTH_FAILED: ${JSON.stringify(health)} ${stderr}`);
+  const initialTransportEvidence = health.body.transportEvidence as Record<string, unknown> | undefined;
+  if (initialTransportEvidence?.current !== 'healthy') throw new Error(`TRANSPORT_CURRENT_HEALTH_MISSING: ${JSON.stringify(initialTransportEvidence)}`);
+  if (!['stable', 'recovering', 'recovered'].includes(String(initialTransportEvidence?.recentStatus))) {
+    throw new Error(`TRANSPORT_RECENT_STATUS_INVALID: ${JSON.stringify(initialTransportEvidence)}`);
+  }
   const expectedPolicy = runtimePolicy(repoRoot, {
     repo: repoRoot,
     controllerHome,
@@ -155,8 +159,8 @@ try {
     enableDevRunner: true,
     devRunnerAgents: 'codex,claude',
   });
-  // Unmarked Controller startup intentionally preserves the Advanced compatibility label.
-  const expectedToolset = resolveControllerToolsetSelection(null).toolset;
+  // Every Controller session exposes the same complete capability registry.
+  const expectedToolset = 'full';
   if (health.body.toolset !== expectedToolset) throw new Error(`TOOLSET_CHANGED: ${String(health.body.toolset)}`);
   if (health.body.toolSurface !== FORGE_TOOL_SURFACE) throw new Error(`TOOL_SURFACE_CHANGED: ${String(health.body.toolSurface)}`);
   const expectedCompatibilityToolCount = buildMcpToolDefinitions(expectedPolicy).length;
@@ -179,7 +183,7 @@ try {
     devRunnerAgents: 'codex,claude',
   });
   const runtimeSchema = await readCanonicalRuntimeToolSchema(runtimeContext);
-  const expectedRuntimeNames = [...CORE_CONTROLLER_TOOL_NAMES].sort();
+  const expectedRuntimeNames = [...controllerExposureSnapshot(runtimeContext).actualToolNames].sort();
   if (JSON.stringify(runtimeSchema.toolNames) !== JSON.stringify(expectedRuntimeNames)) {
     throw new Error(`RUNTIME_TOOL_SCHEMA_CHANGED: ${JSON.stringify(runtimeSchema.toolNames)}`);
   }

package/scripts/smoke-mcp-tool-surface.ts

@@ -3,27 +3,34 @@
  * Focused smoke: local MCP tool surface + connector freshness semantics.
  * Does not require a live ChatGPT connector session.
  */
-import { getMcpPolicy } from '../src/cli/mcp/policy';
-import { controllerExpectedToolNames } from '../src/cli/mcp/legacy-tool-service';
+import { getMcpPolicy } from '../adapters/mcp/policy';
 import {
-  ADVANCED_CONTROLLER_TOOL_NAMES,
-  DEFAULT_CONTROLLER_TOOL_NAMES,
+  PREFERRED_CONTROLLER_TOOL_NAMES,
   PREFERRED_FACADE_TOOL_NAMES,
   exposedControllerToolDefinitions,
-} from '../src/cli/mcp/toolset';
+} from '../adapters/mcp/toolset';
 import {
   EXPECTED_FACADE_TOOLS,
   OPTIONAL_INTERACTIVE_DEVELOPMENT_TOOLS,
   evaluateConnectorFreshness,
 } from '../src/cli/local-bridge/connector-freshness';
-import type { MultiRepositoryMcpToolContext } from '../src/cli/mcp/multi-repository';
+import type { MultiRepositoryMcpToolContext } from '../adapters/mcp/multi-repository';
 
 function assert(condition: unknown, message: string): asserts condition {
   if (!condition) throw new Error(`SMOKE_FAIL: ${message}`);
 }
 
 const policy = getMcpPolicy('controller');
-const expected = controllerExpectedToolNames(policy);
+const fullCtx = {
+  policy,
+  toolset: 'full' as const,
+  controllerHome: process.cwd(),
+  repoRoot: process.cwd(),
+  enableChatgptBrowser: false,
+  audit: () => undefined,
+} as unknown as MultiRepositoryMcpToolContext;
+const fullExposed = exposedControllerToolDefinitions(fullCtx).map((tool) => tool.name);
+const expected = fullExposed;
 
 assert(
   JSON.stringify([...PREFERRED_FACADE_TOOL_NAMES]) === JSON.stringify([...EXPECTED_FACADE_TOOLS]),
@@ -32,7 +39,7 @@ assert(
 
 for (const name of EXPECTED_FACADE_TOOLS) {
   assert(
-    (DEFAULT_CONTROLLER_TOOL_NAMES as readonly string[]).includes(name),
+    (PREFERRED_CONTROLLER_TOOL_NAMES as readonly string[]).includes(name),
     `default exposure missing ${name}`,
   );
   assert(expected.includes(name), `expectedTools missing ${name}`);
@@ -40,41 +47,21 @@ for (const name of EXPECTED_FACADE_TOOLS) {
 
 for (const name of OPTIONAL_INTERACTIVE_DEVELOPMENT_TOOLS) {
   assert(
-    (ADVANCED_CONTROLLER_TOOL_NAMES as readonly string[]).includes(name),
-    `interactive tool ${name} missing from ADVANCED_CONTROLLER_TOOL_NAMES`,
+    (PREFERRED_CONTROLLER_TOOL_NAMES as readonly string[]).includes(name),
+    `interactive tool ${name} missing from the preferred capability list`,
   );
   assert(
-    (DEFAULT_CONTROLLER_TOOL_NAMES as readonly string[]).includes(name),
-    `interactive tool ${name} missing from the stable default tools/list`,
+    (PREFERRED_CONTROLLER_TOOL_NAMES as readonly string[]).includes(name),
+    `interactive tool ${name} missing from the preferred routing list`,
   );
 }
 
-const coreCtx = {
-  policy,
-  toolset: 'core' as const,
-  enableChatgptBrowser: false,
-  audit: () => undefined,
-} as unknown as MultiRepositoryMcpToolContext;
-const advancedCtx = { ...coreCtx, toolset: 'advanced' as const };
-
-const coreExposed = exposedControllerToolDefinitions(coreCtx).map((tool) => tool.name);
-const advancedExposed = exposedControllerToolDefinitions(advancedCtx).map((tool) => tool.name);
-for (const name of EXPECTED_FACADE_TOOLS) {
-  assert(coreExposed.includes(name), `exposed core tools missing ${name}`);
-}
-assert(coreExposed.includes('repository_list'), 'default surface missing repository_list');
-assert(!coreExposed.includes('repository_bootstrap_local_project'), 'default stable surface must not expose legacy bootstrap tool');
-assert(!advancedExposed.includes('repository_bootstrap_local_project'), 'advanced stable alias must not expose legacy bootstrap tool');
-assert(coreExposed.length === DEFAULT_CONTROLLER_TOOL_NAMES.length, `core stable tool count changed: ${coreExposed.length}`);
-assert(advancedExposed.length === DEFAULT_CONTROLLER_TOOL_NAMES.length, `advanced stable tool count changed: ${advancedExposed.length}`);
-assert(
-  JSON.stringify(coreExposed) === JSON.stringify(advancedExposed),
-  'Core and Advanced must remain schema-stable aliases of the same bounded tool surface',
-);
-for (const name of OPTIONAL_INTERACTIVE_DEVELOPMENT_TOOLS) {
-  assert(coreExposed.includes(name), `stable surface missing interactive ${name}`);
-  assert(advancedExposed.includes(name), `advanced alias missing interactive ${name}`);
+for (const name of PREFERRED_CONTROLLER_TOOL_NAMES) {
+  assert(fullExposed.includes(name), `complete registry missing preferred capability ${name}`);
 }
+assert(fullExposed.includes('repository_bootstrap_local_project'), 'complete registry missing repository bootstrap');
+assert(fullExposed.includes('git_commit_paths'), 'complete registry missing canonical Git operation');
+assert(fullExposed.length > PREFERRED_CONTROLLER_TOOL_NAMES.length, 'complete registry must include every registered operation');
 
 const unable = evaluateConnectorFreshness({ localToolNames: expected });
 assert(unable.status === 'unable_to_verify_chatgpt_snapshot', `expected unable_to_verify, got ${unable.status}`);
@@ -103,11 +90,10 @@ console.log(JSON.stringify({
   ok: true,
   expectedFacadeTools: EXPECTED_FACADE_TOOLS,
   preferredTools: PREFERRED_FACADE_TOOL_NAMES,
-  defaultToolCount: coreExposed.length,
-  advancedToolCount: advancedExposed.length,
+  exposedToolCount: fullExposed.length,
+  preferredToolCount: PREFERRED_CONTROLLER_TOOL_NAMES.length,
   expectedToolsHasFacade: EXPECTED_FACADE_TOOLS.every((name) => expected.includes(name)),
-  advancedHasInteractive: OPTIONAL_INTERACTIVE_DEVELOPMENT_TOOLS.every((name) =>
-    (ADVANCED_CONTROLLER_TOOL_NAMES as readonly string[]).includes(name)),
+  fullHasInteractive: OPTIONAL_INTERACTIVE_DEVELOPMENT_TOOLS.every((name) => fullExposed.includes(name)),
   states: {
     unable: unable.status,
     missingSnap: missingSnap.status,

package/scripts/smoke-runtime-recovery.ts

@@ -9,11 +9,8 @@ import {
   getWorkContract,
   getWorkContractByRequestId,
   recordWorkCompletionReceipt,
-  recordWorkImplementationReview,
-  requestWorkImplementationReview,
-  transitionWorkContractPhase,
 } from '../src/runtime/control-plane/facade/work-contract-store';
-import { implementationReviewChangedPathDigest } from '../src/runtime/control-plane/facade/work-implementation-review';
+import { reviseWorkSemanticContext } from '../packages/kernel/work/api/index';
 import {
   claimControllerSession,
   getControllerSession,
@@ -70,6 +67,7 @@ try {
     semanticKey: operation.semanticKey,
     operation,
     objective: 'Verify WorkContract and Process Runtime recovery without ExecutionJobs',
+    workKind: 'completed_no_change' as const,
     checks: [],
   };
   const accepted = acceptSubmittedWorkContract(controllerHome, request);
@@ -89,13 +87,6 @@ try {
     sessionId: 'session-recovery-a',
     leaseMs: 60_000,
   });
-  // Recovery smoke follows the same Work-only phase API enforced in production.
-  transitionWorkContractPhase({ controllerHome, repoId: repository.repoId }, accepted.contract.workId, {
-    phase: 'implementation',
-    status: 'running',
-    state: 'active',
-    summary: 'Process Runtime recovery smoke started implementation.',
-  });
   const handle = await spawnManagedProcess({
     controllerHome,
     repoId: repository.repoId,
@@ -135,42 +126,13 @@ try {
   assert(getControllerSession({ controllerHome, repoId: repository.repoId }, accepted.contract.workId)?.sessionId === 'session-recovery-b', 'replacement Controller session missing');
   const completionRecordedAt = new Date().toISOString();
   const completionRevision = String(spawnSync('git', ['-C', repoRoot, 'rev-parse', 'HEAD'], { encoding: 'utf8' }).stdout).trim();
-  transitionWorkContractPhase({ controllerHome, repoId: repository.repoId }, accepted.contract.workId, {
-    phase: 'verification',
-    status: 'running',
-    state: 'satisfied',
-    summary: 'Recovered Process completed successfully for the exact no-change candidate.',
-  });
-  requestWorkImplementationReview(
-    { controllerHome, repoId: repository.repoId },
-    accepted.contract.workId,
-    'Recovery smoke verification completed; implementation review is required before completion.',
-  );
-  recordWorkImplementationReview({ controllerHome, repoId: repository.repoId }, accepted.contract.workId, {
-    schemaVersion: 1,
-    reviewId: `REV-smoke-${accepted.contract.workId}`,
-    workId: accepted.contract.workId,
-    reviewerPrincipalId: replacement.principalId ?? replacement.controllerId,
-    reviewerControllerSessionId: replacement.sessionId,
-    decision: 'approved',
-    rationale: 'Recovery smoke reviewed the exact recovered no-change candidate before terminal completion.',
-    findings: [],
-    sourceRevision: completionRevision,
-    workspaceFingerprint: 'runtime-recovery-smoke-no-change-content',
-    verificationWorkspaceFingerprint: 'runtime-recovery-smoke-no-change-verification',
-    changedPaths: [],
-    changedPathDigest: implementationReviewChangedPathDigest([]),
-    acceptanceCriteriaSummary: 'Managed Process recovery, Controller reclaim, and no-change Work completion remain coherent.',
-    verificationEvidence: [],
-    architectureEvidence: [],
-    recordedAt: completionRecordedAt,
-  });
+  const completionReceiptId = `REC-smoke-${accepted.contract.workId}`;
   recordWorkCompletionReceipt(
     { controllerHome, repoId: repository.repoId },
     accepted.contract.workId,
     {
       schemaVersion: 1,
-      receiptId: `REC-smoke-${accepted.contract.workId}`,
+      receiptId: completionReceiptId,
       source: 'direct_edit',
       issueId: 'ISS-runtime-recovery-smoke',
       taskId: 'T1',
@@ -186,7 +148,14 @@ try {
     'completed_no_change',
     'completed_no_change',
   );
-  assert(getWorkContract({ controllerHome, repoId: repository.repoId }, accepted.contract.workId)?.status === 'completed', 'completed WorkContract was not persisted');
+  const delivered = getWorkContract({ controllerHome, repoId: repository.repoId }, accepted.contract.workId);
+  assert(delivered?.semanticState !== 'completed', 'delivery receipt must not implicitly complete semantic Work');
+  reviseWorkSemanticContext(
+    { controllerHome, repoId: repository.repoId },
+    accepted.contract.workId,
+    { expectedRevision: Number(delivered?.semanticRevision ?? 1), state: 'completed', resultRefs: [`receipt:${completionReceiptId}`] },
+  );
+  assert(getWorkContract({ controllerHome, repoId: repository.repoId }, accepted.contract.workId)?.semanticState === 'completed', 'explicit semantic Work completion was not persisted');
   assert(listExecutionJobs(controllerHome, repository.repoId, 20).length === 0, 'runtime recovery created an ExecutionJob');
 
   const scheduleInput = {

package/scripts/smoke-schedule-engine.ts

@@ -71,8 +71,8 @@ try {
     manualOccurrence?.status === 'skipped'
       && manualOccurrence.decision === 'operation_blocked'
       && manualOccurrence.decisionId
-      && manualOccurrence.handoffId,
-    'manual semantic Schedule did not create an external-controller handoff',
+      && !manualOccurrence.handoffId,
+    'manual semantic Schedule manufactured a human blocker instead of recording a trigger',
   );
   assert(
     getScheduleDecision(controllerHome, repository.repoId, manualOccurrence.decisionId)?.decision === 'operation_blocked',
@@ -105,7 +105,7 @@ try {
     { source: 'repository-event', eventName: 'git.push', eventId: 'evt-1' },
   );
   assert(eventA?.occurrenceId === eventB?.occurrenceId, 'repository event was not idempotent');
-  assert(eventA?.handoffId === eventB?.handoffId, 'repository event created duplicate handoffs');
+  assert(eventA?.decisionId === eventB?.decisionId, 'repository event created a duplicate occurrence decision');
 
   const missingDependency = createSchedule(controllerHome, {
     ...semanticBase,
@@ -132,8 +132,8 @@ try {
   assert(
     conditionOccurrence?.status === 'skipped'
       && conditionOccurrence.decision === 'operation_blocked'
-      && conditionOccurrence.handoffId,
-    'condition Schedule did not create an external-controller handoff',
+      && !conditionOccurrence.handoffId,
+    'condition Schedule manufactured a human blocker instead of recording a trigger',
   );
 
   const cron = createSchedule(controllerHome, {
@@ -143,7 +143,7 @@ try {
     trigger: { type: 'cron', cronExpression: '* * * * *' },
   });
   const cronOccurrence = await evaluateSchedule(controllerHome, cron);
-  assert(cronOccurrence?.decision === 'operation_blocked' && cronOccurrence.handoffId, 'cron Schedule did not hand off');
+  assert(cronOccurrence?.decision === 'operation_blocked' && !cronOccurrence.handoffId, 'cron Schedule did not record a bounded trigger');
 
   const calendar = createSchedule(controllerHome, {
     ...semanticBase,
@@ -153,8 +153,8 @@ try {
   });
   const calendarOccurrence = await evaluateSchedule(controllerHome, calendar);
   assert(
-    calendarOccurrence?.decision === 'operation_blocked' && calendarOccurrence.handoffId,
-    'calendar Schedule did not hand off',
+    calendarOccurrence?.decision === 'operation_blocked' && !calendarOccurrence.handoffId,
+    'calendar Schedule did not record a bounded trigger',
   );
 
   const staleJobPath = writeLocalJob('JOB-stale', {
@@ -231,9 +231,9 @@ try {
   assert(
     blockedOccurrence?.status === 'skipped'
       && blockedOccurrence.decision === 'maintenance_not_ready'
-      && blockedOccurrence.handoffId
+      && !blockedOccurrence.handoffId
       && !blockedOccurrence.jobId,
-    'unsafe maintenance candidate did not create a bounded handoff',
+    'retryable maintenance blocker was incorrectly promoted to a human handoff',
   );
   assert(readFileSync(brokenJobPath, 'utf8') === brokenBefore, 'blocked maintenance modified an unreadable candidate');
   const backedOff = getSchedule(controllerHome, repository.repoId, blockedMaintenance.scheduleId);
@@ -243,17 +243,25 @@ try {
   );
 
   const handoffs = listHandoffItems({ controllerHome, repoId: repository.repoId, status: 'all' });
-  assert(handoffs.length >= 6, 'expected external-controller and maintenance handoffs were not persisted');
+  // Semantic Schedule triggers are continuation input, not human blockers. Only
+  // a real authorization/judgement boundary may persist a Handoff projection.
+  assert(
+    !manualOccurrence.handoffId && !conditionOccurrence.handoffId && !cronOccurrence.handoffId && !calendarOccurrence.handoffId,
+    'semantic Schedule triggers manufactured human blockers',
+  );
+  assert(
+    !blockedOccurrence.handoffId && handoffs.length === 0,
+    'retryable mechanical maintenance failure manufactured a human blocker',
+  );
   assert(listExecutionJobs(controllerHome, repository.repoId, 100).length === 0, 'Schedule smoke created an ExecutionJob');
 
   console.log(JSON.stringify({
     status: 'ok',
-    manualHandoff: manualOccurrence.handoffId,
+    manualTriggerRecorded: manualOccurrence.decisionId,
     repositoryEventIdempotent: eventA?.occurrenceId === eventB?.occurrenceId,
     missingDependencySuppressed: true,
-    conditionHandoff: conditionOccurrence.handoffId,
-    cronHandoff: cronOccurrence.handoffId,
-    calendarHandoff: calendarOccurrence.handoffId,
+    semanticScheduleHandoffs: 0,
+    maintenanceMechanicalBlockerHasHandoff: Boolean(blockedOccurrence.handoffId),
     maintenance: maintenanceOccurrence.status,
     maintenanceBackoffUntil: backedOff.nextEligibleAt,
     handoffCount: handoffs.length,

package/scripts/smoke-unattended-transport-recovery.ts

@@ -0,0 +1,223 @@
+import { strict as assert } from 'node:assert';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { createMcpHttpSessionRegistry } from '../adapters/mcp/transports/http';
+import { authenticatedFacadeControllerIdentity } from '../adapters/mcp/runtime-gateway/controller-authority-adapter';
+import { readExecutionSession, startExecutionSession } from '../src/runtime/control-plane/execution/session-store';
+import {
+  bindControllerSessionBinding,
+  claimControllerSession,
+  getControllerRoundRelay,
+  releaseControllerSession,
+  type ControllerHost,
+} from '../packages/kernel/controller/api/index';
+import { createWorkContract } from '../packages/kernel/work/api/index';
+import { upsertProcessControllerBinding } from '../adapters/controller-process/binding-store';
+import { runSchedulerAutonomousContinuationReconciliation } from '../src/runtime/control-plane/global-scheduler/autonomous-continuation';
+import { WorkflowSupervisorControlPlane } from '../supervisor/control-plane';
+import { SUPERVISOR_BLOCK_END, SUPERVISOR_BLOCK_START } from '../supervisor/protocol';
+import { WorkflowSupervisorStore } from '../supervisor/store';
+
+const root = mkdtempSync(join(tmpdir(), 'forge-unattended-transport-recovery-'));
+const controllerHome = join(root, 'controller');
+const repoId = 'repo-unattended-recovery';
+const workId = 'work-unattended-recovery';
+const oldTransportSessionId = 'mcp-transport-old';
+const newTransportSessionId = 'mcp-transport-new';
+const principalId = 'chatgpt-controller';
+
+const validators = {
+  completionContract: async () => ({ valid: true, reason: 'ok' }),
+  userBlockerPolicy: async () => ({ valid: true, reason: 'ok' }),
+};
+const supervisor = () => new WorkflowSupervisorControlPlane(new WorkflowSupervisorStore(controllerHome), validators);
+
+function block(action: 'CONTINUE' | 'DONE', effectId: string, checkpoint: string, conversationId: string, taskId: string): string {
+  return `${SUPERVISOR_BLOCK_START}\n${JSON.stringify({
+    action,
+    source_effect_id: effectId,
+    checkpoint,
+    reason: action === 'DONE' ? 'complete' : 'continue',
+    evidence: ['unattended-transport-recovery-smoke'],
+    conversation_id: conversationId,
+    task_id: taskId,
+    supervisor_state: action === 'DONE' ? 'done' : 'running',
+    active_scope: `goal:${taskId}`,
+  })}\n${SUPERVISOR_BLOCK_END}`;
+}
+
+try {
+  // 1) Durable execution is created independently of an MCP stream.
+  startExecutionSession(controllerHome, {
+    sessionId: oldTransportSessionId,
+    principalId,
+    controllerInstanceId: 'runtime-before-restart',
+  });
+
+  let transportCloseCount = 0;
+  const registry = createMcpHttpSessionRegistry<
+    { close(): void },
+    { sessionId: string; controllerHome: string }
+  >();
+  registry.register({
+    sessionId: oldTransportSessionId,
+    transport: { close: () => { transportCloseCount += 1; } },
+    toolContext: { sessionId: oldTransportSessionId, controllerHome },
+    route: '/mcp',
+    principalId,
+    connectionId: 'connection-before-disconnect',
+    clientIdentity: 'chatgpt-client',
+  });
+  await registry.close(oldTransportSessionId, 'transport_close');
+  assert.equal(transportCloseCount, 1);
+
+  // 2) Transport loss must not invalidate execution authority. Reading through a
+  // new runtime instance also exercises restart recovery of the durable session.
+  const recoveredExecution = readExecutionSession(controllerHome, {
+    sessionId: oldTransportSessionId,
+    principalId,
+    controllerInstanceId: 'runtime-after-restart',
+  });
+  assert.ok(recoveredExecution);
+  assert.equal(recoveredExecution.controllerInstanceId, 'runtime-after-restart');
+  assert.equal(recoveredExecution.invalidatedAt, undefined);
+
+  // 3) A newly authenticated transport can explicitly carry the prior session
+  // only on the bounded rollover path. The new transport remains the request
+  // binding; the old session is merely the compatibility authority carrier.
+  const rolloverIdentity = authenticatedFacadeControllerIdentity({
+    principalId,
+    sessionId: newTransportSessionId,
+    controllerInstanceId: 'runtime-after-restart',
+    controllerType: 'chatgpt',
+  } as any, {
+    session_id: oldTransportSessionId,
+  }, { allowTransportSessionRollover: true });
+  assert.equal(rolloverIdentity.sessionId, newTransportSessionId);
+  assert.equal(rolloverIdentity.transportSessionId, newTransportSessionId);
+  assert.equal(rolloverIdentity.controllerAuthorityId, oldTransportSessionId);
+  assert.equal(rolloverIdentity.authorityViaSessionCompatibility, true);
+
+  // 4) Scheduler liveness owns unattended Work wake-up. Repeated reconciliation
+  // of the same durable state must never duplicate provider dispatch.
+  createWorkContract({ controllerHome, repoId }, {
+    workId,
+    repoId,
+    objective: 'Continue without manual user wake-ups.',
+    acceptanceCriteria: ['The Work resumes from durable authority.'],
+    allowedPaths: [],
+    forbiddenPaths: [],
+    checks: [],
+    constraints: {},
+    requestedBy: 'chatgpt',
+    dispatchState: 'running',
+    baseRevision: 'abc123',
+  } as Parameters<typeof createWorkContract>[1]);
+
+  const store = { controllerHome, repoId };
+  const controllerAuthorityId = oldTransportSessionId;
+  const owner = claimControllerSession(store, {
+    workId,
+    controllerId: principalId,
+    // This section proves the generic retained-provider wake path. ChatGPT is
+    // intentionally covered by the Workflow Supervisor section below and must
+    // not silently fall back to direct provider dispatch when its daemon is down.
+    controllerType: 'claude',
+    sessionId: oldTransportSessionId,
+    authorityDigest: createHash('sha256').update(controllerAuthorityId).digest('hex'),
+    principalId,
+    controllerInstanceId: 'runtime-before-restart',
+    leaseMs: 60_000,
+  });
+  const binding = upsertProcessControllerBinding(store, {
+    workId,
+    sessionId: owner.sessionId,
+    controllerType: 'claude',
+    executable: 'claude',
+    launchArgs: [],
+  });
+  bindControllerSessionBinding(store, { workId, sessionId: owner.sessionId, binding: binding.binding });
+  releaseControllerSession(store, workId, owner.controllerId);
+
+  let providerDispatches = 0;
+  const host: ControllerHost = {
+    resume: async () => {
+      providerDispatches += 1;
+      return { accepted: true, dispatchId: `dispatch-${providerDispatches}` };
+    },
+  };
+  const schedulerInput = {
+    controllerHome,
+    nowMs: Date.parse('2026-09-22T12:00:00.000Z'),
+    repositories: [{ repoId, canonicalRoot: root, localRoot: root }],
+    dependencies: {
+      authorizeWake: () => undefined,
+      boundaryForWork: () => ({ status: 'not_eligible' as const }),
+      hostForBinding: () => host,
+    },
+  };
+  const firstWake = await runSchedulerAutonomousContinuationReconciliation(schedulerInput);
+  assert.equal(firstWake.dispatched, 1);
+  const duplicateWake = await runSchedulerAutonomousContinuationReconciliation(schedulerInput);
+  assert.equal(duplicateWake.dispatched, 0);
+  assert.equal(providerDispatches, 1);
+  assert.equal(getControllerRoundRelay(store, workId)?.status, 'dispatched');
+
+  // 5) Workflow Supervisor state is durable across process/control-plane
+  // reconstruction. Ten CONTINUE rounds publish exactly one successor each, and
+  // replaying the same completion never creates a second effect.
+  const taskId = 'unattended-transport-recovery-task';
+  const conversationId = '77777777-8888-9999-aaaa-bbbbbbbbbbbb';
+  const conversationUrl = `https://chatgpt.com/c/${conversationId}`;
+  let control = supervisor();
+  control.registerTask({
+    taskId,
+    conversationId,
+    conversationUrl,
+    objective: 'Continue autonomously across reconnects and runtime restarts.',
+    completionContract: {},
+    continuationPolicy: { active_scope: `goal:${taskId}` },
+    userBlockerPolicy: {},
+  });
+  let effect = control.reserveEnrollment(taskId);
+  control.observeEffect({ effectId: effect.effectId, observationId: 'round-0-applied', outcome: 'applied' });
+
+  for (let round = 1; round <= 10; round += 1) {
+    control = supervisor();
+    const response = block('CONTINUE', effect.effectId, `checkpoint-${round}`, conversationId, taskId);
+    const advanced = await control.browserObserveAssistant({ conversationId, conversationUrl, responseText: response });
+    assert.ok(advanced.successorEffect);
+    const replay = await control.browserObserveAssistant({ conversationId, conversationUrl, responseText: response });
+    assert.equal(replay.successorEffect?.effectId, advanced.successorEffect.effectId);
+    assert.equal(replay.deduplicated, true);
+    effect = advanced.successorEffect;
+    control.observeEffect({
+      effectId: effect.effectId,
+      observationId: `round-${round}-applied`,
+      outcome: 'applied',
+    });
+  }
+
+  control = supervisor();
+  const done = await control.browserObserveAssistant({
+    conversationId,
+    conversationUrl,
+    responseText: block('DONE', effect.effectId, 'complete', conversationId, taskId),
+  });
+  assert.equal(done.terminal, true);
+  assert.equal(control.browserTasks().length, 0);
+
+  console.log(JSON.stringify({
+    status: 'ok',
+    transportDisconnectedWithoutExecutionInvalidation: true,
+    reconnectUsedExplicitRolloverAuthority: true,
+    runtimeRestartRecoveredExecution: true,
+    schedulerProviderDispatches: providerDispatches,
+    unattendedContinuationRounds: 10,
+    duplicateSuccessorEffects: 0,
+  }, null, 2));
+} finally {
+  rmSync(root, { recursive: true, force: true });
+}