@tomflow/proflow-platform-host 0.1.22 → 0.1.23

package/dist/src/index.js

@@ -4,14 +4,15 @@ import { appendFile, chmod, mkdir, readFile, stat, writeFile, } from "node:fs/pr
 import { createServer } from "node:http";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { createAgentRuntime } from "@tomflow/proflow-agent-runtime";
-import { executionCapabilityIds, executionCapabilityInputJsonSchemas, } from "@tomflow/proflow-execution-contracts";
+import { createLocalToolBridgeHostClient, LocalToolBridgeError, } from "@tomflow/proflow-execution-browser-extension/local-tool-bridge";
 import { applyMigrations } from "@tomflow/proflow-task-migration-runner";
 import { createTaskServices, publicOperationNames, } from "@tomflow/proflow-task-orchestration";
 import { SqliteTaskStore } from "@tomflow/proflow-task-store-sqlite";
 import { taskMigrations } from "@tomflow/proflow-task-store-sqlite/migrations";
 import { z } from "zod";
 import { classifyBrowserPermission, } from "./browser-permission-policy.js";
-import { roleOperations, rolePackageRefs, } from "./role-operations.js";
+import { createReconciliationCoordinator } from "./reconciliation-coordinator.js";
+import { directToolActionIds, roleAllowsDirectToolOperation, roleOperations, rolePackageRefs, } from "./role-operations.js";
 const loopbackHosts = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
 // Business owner calls are Promise-driven. This is only a last-resort transport
 // watchdog for a hung local call, not a normal workflow deadline.
@@ -67,16 +68,6 @@ const browserStructuredLogSchema = z
     tabId: z.number().int().nonnegative().optional(),
 })
     .strict();
-const taskDiagnosticReasonResultSchema = z
-    .object({
-    finding: z.string().min(1).max(1_000),
-    probableCause: z.string().min(1).max(1_000),
-    confidence: z.number().min(0).max(1),
-    recommendedNextObservation: z.string().min(1).max(1_000),
-    recommendedRecoveryAction: z.string().min(1).max(1_000),
-    needsHumanAttention: z.boolean(),
-})
-    .strict();
 const taskDocumentFileSchema = z.object({
     taskId: z.string().min(1),
     documentType: z.string().min(1),
@@ -102,6 +93,40 @@ function fileBridgeOutputForTaskResult(result) {
     };
     return output;
 }
+const directToolPlatformIdentityFields = new Set([
+    "actorRef",
+    "authenticatedRoleRef",
+    "callerRef",
+    "roleRef",
+    "taskId",
+    "nodeId",
+    "runNo",
+    "workerRef",
+    "executionRef",
+    "workspaceRoot",
+    "deadlineAt",
+    "commandId",
+    "commandDigest",
+    "generation",
+    "extensionId",
+    "extensionInstanceId",
+]);
+function assertNoDirectToolPlatformIdentity(value) {
+    if (Array.isArray(value)) {
+        for (const item of value)
+            assertNoDirectToolPlatformIdentity(item);
+        return;
+    }
+    if (typeof value !== "object" || value === null)
+        return;
+    for (const [key, item] of Object.entries(value)) {
+        if (directToolPlatformIdentityFields.has(key))
+            throw Object.assign(new Error("DIRECT_TOOL_IDENTITY_FIELD_DENIED"), {
+                httpStatus: 400,
+            });
+        assertNoDirectToolPlatformIdentity(item);
+    }
+}
 const loopbackUrl = z
     .url()
     .transform((value) => new URL(value))
@@ -113,9 +138,9 @@ const configSchema = z
     workspaceRoot: z.string().min(1),
     host: z.string().min(1).default("127.0.0.1"),
     port: z.number().int().min(0).max(65_535).default(0),
-    executionBaseUrl: loopbackUrl,
+    executionBaseUrl: loopbackUrl.optional(),
     executionTransportCredentialFile: z.string().min(1).optional(),
-    modelBaseUrl: loopbackUrl,
+    modelBaseUrl: loopbackUrl.optional(),
     modelTransportCredentialFile: z.string().min(1).optional(),
     gatewayTransportCredentialFile: z.string().min(1).optional(),
     roles: z
@@ -208,10 +233,21 @@ async function responseJson(response) {
         });
     return value;
 }
-function createOwnerHttpClient(owner, baseUrl, credential) {
+function createOwnerHttpClient(owner, baseUrl, credential, resolveConnection) {
+    const connection = async () => {
+        const resolved = resolveConnection
+            ? await resolveConnection(owner)
+            : baseUrl
+                ? { baseUrl, credential }
+                : undefined;
+        if (!resolved)
+            throw new Error(`${owner.toUpperCase()}_SERVICE_UNAVAILABLE`);
+        return { ...resolved, baseUrl: loopbackUrl.parse(resolved.baseUrl) };
+    };
     return Object.freeze({
         async readiness() {
             try {
+                const { baseUrl, credential } = await connection();
                 const response = await fetch(`${baseUrl}/ready`, {
                     headers: credential ? { authorization: `Bearer ${credential}` } : {},
                     signal: AbortSignal.timeout(2_000),
@@ -235,6 +271,7 @@ function createOwnerHttpClient(owner, baseUrl, credential) {
             }
         },
         async invoke(operationId, input) {
+            const { baseUrl, credential } = await connection();
             let path;
             let method = "POST";
             let callerContext;
@@ -377,7 +414,7 @@ async function readDeploymentOwnerSummary(stateRoot) {
         return undefined;
     }
 }
-async function constructGraph(config, executionCredential, modelCredential) {
+async function constructGraph(config, executionCredential, modelCredential, resolveConnection, resolveLocalToolConnection) {
     const databasePath = join(config.stateRoot, "state", "task.sqlite");
     const migration = applyMigrations({
         databasePath,
@@ -444,8 +481,9 @@ async function constructGraph(config, executionCredential, modelCredential) {
         taskStore.close();
         throw error;
     }
-    const execution = createOwnerHttpClient("execution", config.executionBaseUrl, executionCredential);
-    const model = createOwnerHttpClient("model", config.modelBaseUrl, modelCredential);
+    const execution = createOwnerHttpClient("execution", config.executionBaseUrl, executionCredential, resolveConnection);
+    const model = createOwnerHttpClient("model", config.modelBaseUrl, modelCredential, resolveConnection);
+    let reconciliationCoordinator;
     const boundedSystemView = async (view) => {
         if (view === "task") {
             const tasks = unwrap(task.queries.listTasks({})).tasks;
@@ -615,56 +653,6 @@ async function constructGraph(config, executionCredential, modelCredential) {
             });
         return binding.workerRef;
     };
-    const admitExecutionRead = async (authenticatedRoleRef, rawRecord) => {
-        const record = object(rawRecord, "execution read record");
-        if (record.callerRef !== authenticatedRoleRef)
-            throw Object.assign(new Error("EXECUTION_CALLER_MISMATCH"), {
-                httpStatus: 403,
-            });
-        if (typeof record.taskId === "string") {
-            if (record.roleRef !== authenticatedRoleRef)
-                throw Object.assign(new Error("EXECUTION_ROLE_SCOPE_MISMATCH"), {
-                    httpStatus: 403,
-                });
-            if (typeof record.workerRef !== "string")
-                throw Object.assign(new Error("EXECUTION_WORKER_SCOPE_REQUIRED"), {
-                    httpStatus: 403,
-                });
-            await admitTaskParticipant(record.taskId, authenticatedRoleRef, record.workerRef);
-        }
-        return rawRecord;
-    };
-    const admissionError = (code, httpStatus = 403) => {
-        throw Object.assign(new Error(code), { httpStatus });
-    };
-    const admitExactNodeExecution = async (input, authenticatedRoleRef) => {
-        const taskId = string(input.taskId, "taskId");
-        const nodeId = string(input.nodeId, "nodeId");
-        const runNo = positiveInteger(input.runNo, "runNo");
-        const workerRef = await admitTaskParticipant(taskId, authenticatedRoleRef);
-        await agent.validateWorker({ authenticatedRoleRef, taskId, workerRef });
-        const taskFact = taskFacts(taskId);
-        const nodeContext = unwrap(task.queries.getNodeContext({ taskId, nodeId }));
-        if (taskFact.status !== "ACTIVE")
-            admissionError("EXECUTION_TASK_NOT_ACTIVE");
-        if (taskFact.currentNodeId !== nodeId)
-            admissionError("EXECUTION_NODE_NOT_CURRENT");
-        if (nodeContext.node.status !== "IN_PROGRESS")
-            admissionError("EXECUTION_NODE_NOT_RUNNING");
-        if (nodeContext.node.runNo !== runNo)
-            admissionError("EXECUTION_GENERATION_MISMATCH");
-        const nodeBinding = taskFact.roleBindings.find((binding) => binding.agentPackageRef === nodeContext.node.requiredAgentPackageRef);
-        if (!nodeBinding)
-            throw Object.assign(new Error("TASK_ROLE_BINDING_REQUIRED"), {
-                httpStatus: 403,
-            });
-        if (nodeBinding.roleRef !== authenticatedRoleRef)
-            admissionError("EXECUTION_ROLE_SCOPE_MISMATCH");
-        if (nodeBinding.workerRef !== workerRef ||
-            nodeContext.node.workerRef !== workerRef)
-            admissionError("EXECUTION_WORKER_SCOPE_MISMATCH");
-        return { taskId, nodeId, runNo, workerRef };
-    };
     const route = async (operationId, authenticatedRoleRef, rawInput, context) => {
         const role = agent.getRegisteredRole(authenticatedRoleRef);
         if (!roleOperations[role.agentPackageRef]?.has(operationId))
@@ -676,6 +664,63 @@ async function constructGraph(config, executionCredential, modelCredential) {
             return agent.askPeer({ ...input, authenticatedRoleRef });
         if (operationId === "replyPeer")
             return agent.replyPeer({ ...input, authenticatedRoleRef });
+        if (directToolActionIds.includes(operationId)) {
+            const tool = operationId;
+            const keys = Object.keys(input).sort();
+            if (keys.length !== 2 || keys[0] !== "input" || keys[1] !== "operation")
+                throw Object.assign(new Error("DIRECT_TOOL_INPUT_INVALID"), {
+                    httpStatus: 400,
+                });
+            const toolOperation = string(input.operation, "operation");
+            const toolInput = object(input.input, "input");
+            assertNoDirectToolPlatformIdentity(toolInput);
+            if (!roleAllowsDirectToolOperation(role.agentPackageRef, operationId, toolOperation, toolInput))
+                throw Object.assign(new Error("ROLE_TOOL_OPERATION_DENIED"), {
+                    httpStatus: 403,
+                });
+            const deadlineAt = context?.deadlineAt;
+            if (typeof deadlineAt !== "string" ||
+                Number.isNaN(Date.parse(deadlineAt)))
+                throw Object.assign(new Error("DIRECT_TOOL_DEADLINE_REQUIRED"), {
+                    httpStatus: 400,
+                });
+            const connection = await resolveLocalToolConnection?.();
+            if (!connection)
+                throw Object.assign(new Error("LOCAL_TOOL_BRIDGE_UNAVAILABLE"), {
+                    httpStatus: 503,
+                });
+            try {
+                return await createLocalToolBridgeHostClient({
+                    endpoint: connection.endpoint,
+                    token: connection.credential,
+                }).request({
+                    authenticatedRoleRef,
+                    workspaceRoot: config.workspaceRoot,
+                    tool,
+                    operation: toolOperation,
+                    input: toolInput,
+                    deadlineAt,
+                });
+            }
+            catch (error) {
+                const code = error instanceof LocalToolBridgeError
+                    ? error.code
+                    : "LOCAL_TOOL_BRIDGE_UNAVAILABLE";
+                const httpStatus = code === "LOCAL_TOOL_COMMAND_TIMEOUT"
+                    ? 504
+                    : code === "LOCAL_TOOL_RESULT_UNKNOWN"
+                        ? 409
+                        : code === "LOCAL_TOOL_SCOPE_DENIED"
+                            ? 403
+                            : code === "LOCAL_TOOL_OFFLINE" ||
+                                code === "LOCAL_TOOL_PROVIDER_UNAVAILABLE"
+                                ? 503
+                                : code === "LOCAL_TOOL_COMMAND_FAILED"
+                                    ? 500
+                                    : 400;
+                throw Object.assign(new Error(code), { httpStatus });
+            }
+        }
         const taskOperation = taskOperations.get(operationId);
         if (taskOperation) {
             let actorRef = authenticatedRoleRef;
@@ -722,66 +767,13 @@ async function constructGraph(config, executionCredential, modelCredential) {
             const taskResult = await taskOperation(queryOperations.has(operationId)
                 ? canonicalTaskInput
                 : { ...canonicalTaskInput, actorRef });
+            if (taskMutationOperations.has(operationId) &&
+                typeof input.taskId === "string")
+                reconciliationCoordinator?.kick(input.taskId);
             if (operationId === "getTaskDocument")
                 return fileBridgeOutputForTaskResult(taskResult);
-            if (operationId === "getNodeContext" &&
-                roleOperations[role.agentPackageRef]?.has("executeCapability")) {
-                const nodeContext = object(taskResult, "node context result");
-                const nodeContextData = object(nodeContext.data, "node context data");
-                const taskContext = object(nodeContextData.task, "node context task");
-                const executionNodeContext = object(nodeContextData.node, "node context node");
-                return {
-                    ...nodeContext,
-                    executionCapabilityIds: [...executionCapabilityIds],
-                    executionCapabilityInputSchemas: executionCapabilityInputJsonSchemas,
-                    executionRequestContext: {
-                        contract: "execution",
-                        contractVersion: "1.0.0",
-                        taskId: string(taskContext.taskId, "task.taskId"),
-                        nodeId: string(executionNodeContext.nodeId, "node.nodeId"),
-                        runNo: positiveInteger(executionNodeContext.runNo, "node.runNo"),
-                    },
-                };
-            }
             return taskResult;
         }
-        if (operationId === "executeCapability") {
-            const scope = await admitExactNodeExecution(input, authenticatedRoleRef);
-            const { workerRef: _suppliedWorkerRef, projectRoot: _suppliedProjectRoot, roleRef: _suppliedRoleRef, callerRef: _suppliedCallerRef, ...ownerInput } = input;
-            const result = await execution.invoke(operationId, {
-                ...ownerInput,
-                callerRef: authenticatedRoleRef,
-                roleRef: authenticatedRoleRef,
-                taskId: scope.taskId,
-                nodeId: scope.nodeId,
-                runNo: scope.runNo,
-                workerRef: scope.workerRef,
-            });
-            // A normal Action may complete synchronously inside the current Worker Turn.
-            // Do not manufacture a Browser RESUME for every terminal Execution record.
-            // Only a future explicit async-completion signal may emit EXECUTION_RESULT_READY.
-            return result;
-        }
-        if (operationId === "getExecution") {
-            const record = await execution.invoke(operationId, {
-                ...input,
-                callerRef: authenticatedRoleRef,
-            });
-            return admitExecutionRead(authenticatedRoleRef, record);
-        }
-        if (operationId === "readExecutionOutput") {
-            const record = await execution.invoke("getExecution", {
-                contract: "execution",
-                contractVersion: "1.0.0",
-                executionRef: string(input.executionRef, "executionRef"),
-                callerRef: authenticatedRoleRef,
-            });
-            await admitExecutionRead(authenticatedRoleRef, record);
-            return execution.invoke(operationId, {
-                ...input,
-                callerRef: authenticatedRoleRef,
-            });
-        }
         throw new Error("OPERATION_NOT_ROUTED");
     };
     const browserOwnerPorts = Object.freeze({
@@ -814,6 +806,7 @@ async function constructGraph(config, executionCredential, modelCredential) {
                     actorRef: "platform-host:worker-provisioning",
                     idempotencyKey: `browser-bind:${binding.taskId}:${binding.roleRef}:${binding.workerRef}`,
                 }));
+                reconciliationCoordinator?.kick(binding.taskId);
             },
         }),
         agent: Object.freeze({
@@ -862,7 +855,7 @@ async function constructGraph(config, executionCredential, modelCredential) {
                 request.capability === "worker.wake" ||
                 request.capability === "collaboration.deliver";
             const internalBrowserCaller = request.callerRef === "platform-host:carrier-controller" ||
-                request.callerRef === "extension:task-observer" ||
+                request.callerRef === "platform-host:task-reconciliation" ||
                 request.callerRef === "extension:collaboration-carrier";
             if (!internalBrowserCaller)
                 agent.getRegisteredRole(request.callerRef);
@@ -1132,7 +1125,7 @@ async function constructGraph(config, executionCredential, modelCredential) {
         // Dispatch all three fixed Workers concurrently. When `waitFor` names a
         // subset of roleRefs (the J1 Product path), only those results gate the
         // return; the remaining Worker creation is a durable, idempotent Execution
-        // effect whose completion the ensureWorkers recovery reconciles from the
+        // effect whose completion backend reconciliation recovers from the
         // durable Task binding facts — never a bare in-memory promise.
         const waitFor = new Set(options?.waitFor ?? []);
         const shouldWait = (agentPackageRef) => waitFor.size === 0 ||
@@ -1146,7 +1139,7 @@ async function constructGraph(config, executionCredential, modelCredential) {
         for (const entry of deferred) {
             entry.promise.catch(() => {
                 // Deferred Worker creation failure is recoverable: the durable
-                // binding stays unset, so a later ensureWorkers pass re-provisions
+                // binding stays unset, so a later backend reconciliation pass re-provisions
                 // only the missing role.
             });
         }
@@ -1156,6 +1149,67 @@ async function constructGraph(config, executionCredential, modelCredential) {
             throw failure.reason;
         return unwrap(task.queries.getTask({ taskId }));
     };
+    const requestTaskWake = async (input) => {
+        const underlyingRef = input.underlyingRef ?? "none";
+        const wakeExecution = object(await execution.invoke("executeCapability", {
+            contract: "execution",
+            contractVersion: "1.0.0",
+            idempotencyKey: `task-reconciliation-wake:${input.taskId}:${input.nodeId}:${input.runNo}:${input.trigger}:${underlyingRef}`,
+            callerRef: "platform-host:task-reconciliation",
+            correlationId: `task-reconciliation:${input.taskId}:${input.nodeId}:${input.runNo}`,
+            taskId: input.taskId,
+            nodeId: input.nodeId,
+            runNo: input.runNo,
+            roleRef: input.roleRef,
+            workerRef: input.workerRef,
+            capability: "worker.wake",
+            input: {
+                roleRef: input.roleRef,
+                workerRef: input.workerRef,
+                taskId: input.taskId,
+                nodeId: input.nodeId,
+                runNo: input.runNo,
+                trigger: input.trigger,
+                fingerprint: `wake:${input.taskId}:${input.nodeId}:${input.runNo}:${input.trigger}:${underlyingRef}`,
+            },
+        }), "task reconciliation wake execution");
+        if (wakeExecution.status !== "SUCCEEDED" ||
+            wakeExecution.sideEffectState !== "APPLIED")
+            throw new Error(`TASK_WAKE_NOT_CONFIRMED:${String(wakeExecution.status)}:${String(wakeExecution.sideEffectState)}`);
+        return wakeExecution;
+    };
+    reconciliationCoordinator = createReconciliationCoordinator({
+        async listTaskPage(input) {
+            return taskStore.listReconciliationTaskIds({
+                statuses: [
+                    "PENDING",
+                    "READY",
+                    "ACTIVE",
+                    "WAITING",
+                    "FAILED",
+                    "PAUSED",
+                ],
+                ...input,
+            });
+        },
+        async listExecutionSignals() {
+            const batch = object(await execution.invoke("listExecutionObserverSignals", {
+                limit: 100,
+                consumer: "task-reconciliation",
+            }), "execution observer signals");
+            return Array.isArray(batch.signals) ? batch.signals : [];
+        },
+        async acknowledgeExecutionSignal(signalRef) {
+            await execution.invoke("acknowledgeExecutionObserverSignal", {
+                signalRef,
+            });
+        },
+        async ensureWorkers(taskId) {
+            await ensureTaskWorkers(taskId);
+        },
+        getProjection: (taskId) => taskDriverPorts.getTaskDriveProjection(taskId),
+        requestWake: requestTaskWake,
+    });
     const taskApplication = Object.freeze({
         async invoke(operation, rawInput) {
             const value = object(rawInput, "task application input");
@@ -1186,12 +1240,12 @@ async function constructGraph(config, executionCredential, modelCredential) {
                 // J1: return once the Product Worker is durably bound; Dev/Test
                 // continue as recoverable durable effects without blocking Product
                 // requirement discussion.
-                return ensureTaskWorkers(created.taskId, {
+                const provisioned = await ensureTaskWorkers(created.taskId, {
                     waitFor: [roleForPackage("@tomflow/proflow-agent-product").roleRef],
                 });
+                reconciliationCoordinator?.kick(created.taskId);
+                return provisioned;
             }
-            if (operation === "task.ensureWorkers")
-                return ensureTaskWorkers(string(value.taskId, "taskId"));
             if (operation === "task.list")
                 return unwrap(task.queries.listTasks({
                     ...(Array.isArray(value.statuses)
@@ -1200,13 +1254,17 @@ async function constructGraph(config, executionCredential, modelCredential) {
                 }));
             if (operation === "task.get")
                 return unwrap(task.queries.getTask({ taskId: string(value.taskId, "taskId") }));
-            if (operation === "task.start")
-                return unwrap(task.commands.startTask({
-                    taskId: string(value.taskId, "taskId"),
+            if (operation === "task.start") {
+                const taskId = string(value.taskId, "taskId");
+                const result = unwrap(task.commands.startTask({
+                    taskId,
                     expectedTaskVersion: Number(value.expectedTaskVersion),
                     actorRef: "extension:human",
                     idempotencyKey: string(value.idempotencyKey, "idempotencyKey"),
                 }));
+                reconciliationCoordinator?.kick(taskId);
+                return result;
+            }
             if (operation === "message.acknowledge")
                 return unwrap(task.commands.acknowledgeMessage({
                     messageId: string(value.messageId, "messageId"),
@@ -1216,25 +1274,62 @@ async function constructGraph(config, executionCredential, modelCredential) {
                     actorRef: "extension:human",
                     idempotencyKey: string(value.idempotencyKey, "idempotencyKey"),
                 }));
-            if (operation === "task.resume")
-                return unwrap(task.commands.resumeTask({
-                    taskId: string(value.taskId, "taskId"),
+            if (operation === "task.resume") {
+                const taskId = string(value.taskId, "taskId");
+                const result = unwrap(task.commands.resumeTask({
+                    taskId,
                     expectedTaskVersion: positiveInteger(value.expectedTaskVersion, "expectedTaskVersion"),
                     actorRef: "extension:human",
                     idempotencyKey: string(value.idempotencyKey, "idempotencyKey"),
                 }));
-            if (operation === "node.reopen")
-                return unwrap(task.commands.reopenNode({
-                    taskId: string(value.taskId, "taskId"),
+                reconciliationCoordinator?.kick(taskId);
+                return result;
+            }
+            if (operation === "node.reopen") {
+                const taskId = string(value.taskId, "taskId");
+                const result = unwrap(task.commands.reopenNode({
+                    taskId,
                     nodeId: string(value.nodeId, "nodeId"),
                     reason: string(value.reason, "reason"),
                     expectedTaskVersion: Number(value.expectedTaskVersion),
                     actorRef: "extension:human",
                     idempotencyKey: string(value.idempotencyKey, "idempotencyKey"),
                 }));
+                reconciliationCoordinator?.kick(taskId);
+                return result;
+            }
             throw new Error("UNSUPPORTED_TASK_APPLICATION_OPERATION");
         },
     });
+    async function approvalExecutionContext(approvalRef) {
+        const approval = object(await execution.invoke("getExecutionApproval", { approvalRef }), "approval fact");
+        const executionFact = object(await execution.invoke("getExecution", {
+            executionRef: string(approval.executionRef, "executionRef"),
+            callerRef: string(approval.callerRef, "callerRef"),
+        }), "execution fact");
+        const runNo = Number(executionFact.runNo);
+        if (!Number.isInteger(runNo) || runNo <= 0)
+            throw new Error("EXECUTION_RUN_GENERATION_REQUIRED");
+        return {
+            executionRef: string(executionFact.executionRef, "executionRef"),
+            taskId: string(executionFact.taskId, "taskId"),
+            nodeId: string(executionFact.nodeId, "nodeId"),
+            runNo,
+            roleRef: string(executionFact.roleRef, "roleRef"),
+            workerRef: string(executionFact.workerRef, "workerRef"),
+        };
+    }
+    const reconcileApproval = async (approvalRef) => {
+        const context = await approvalExecutionContext(approvalRef);
+        reconciliationCoordinator?.kick(context.taskId, {
+            trigger: "RECOVERY_RESUME",
+            ref: approvalRef,
+            targetWorkerRef: context.workerRef,
+            nodeId: context.nodeId,
+            runNo: context.runNo,
+        });
+        return context;
+    };
     const approvalApplication = Object.freeze({
         async invoke(operation, rawInput) {
             const value = object(rawInput, "approval application input");
@@ -1249,52 +1344,42 @@ async function constructGraph(config, executionCredential, modelCredential) {
                     ...value,
                     actorRef: "extension:human",
                 });
-            if (operation === "approval.allow" || operation === "approval.deny")
-                return execution.invoke("decideExecutionApproval", {
+            if (operation === "approval.allow" || operation === "approval.deny") {
+                const approvalRef = string(value.approvalRef, "approvalRef");
+                const result = await execution.invoke("decideExecutionApproval", {
                     contract: "execution.approval",
                     contractVersion: "1.0.0",
-                    approvalRef: string(value.approvalRef, "approvalRef"),
+                    approvalRef,
                     actorRef: "extension:human",
                     expectedVersion: Number(value.expectedVersion),
                     decision: operation === "approval.allow" ? "ALLOW" : "DENY",
                     ...(typeof value.reason === "string" ? { reason: value.reason } : {}),
                 });
-            if (operation === "approval.revoke")
-                return execution.invoke("revokeExecutionApproval", {
+                await reconcileApproval(approvalRef);
+                return result;
+            }
+            if (operation === "approval.revoke") {
+                const approvalRef = string(value.approvalRef, "approvalRef");
+                const result = await execution.invoke("revokeExecutionApproval", {
                     contract: "execution.approval",
                     contractVersion: "1.0.0",
-                    approvalRef: string(value.approvalRef, "approvalRef"),
+                    approvalRef,
                     actorRef: "extension:human",
                     expectedVersion: Number(value.expectedVersion),
                     reason: string(value.reason, "reason"),
                 });
+                await reconcileApproval(approvalRef);
+                return result;
+            }
             throw new Error("UNSUPPORTED_APPROVAL_APPLICATION_OPERATION");
         },
     });
     const observerApplication = Object.freeze({
         async invoke(operation, rawInput) {
             const value = object(rawInput, "observer application input");
-            if (operation === "task.projection")
-                return taskDriverPorts.getTaskDriveProjection(string(value.taskId, "taskId"));
-            if (operation === "approval.executionContext") {
-                const approval = object(await execution.invoke("getExecutionApproval", {
-                    approvalRef: string(value.approvalRef, "approvalRef"),
-                }), "approval fact");
-                const executionFact = object(await execution.invoke("getExecution", {
-                    executionRef: string(approval.executionRef, "executionRef"),
-                    callerRef: string(approval.callerRef, "callerRef"),
-                }), "execution fact");
-                const runNo = Number(executionFact.runNo);
-                if (!Number.isInteger(runNo) || runNo <= 0)
-                    throw new Error("EXECUTION_RUN_GENERATION_REQUIRED");
-                return {
-                    executionRef: string(executionFact.executionRef, "executionRef"),
-                    taskId: string(executionFact.taskId, "taskId"),
-                    nodeId: string(executionFact.nodeId, "nodeId"),
-                    runNo,
-                    roleRef: string(executionFact.roleRef, "roleRef"),
-                    workerRef: string(executionFact.workerRef, "workerRef"),
-                };
+            if (operation === "task.reconcileAll") {
+                void reconciliationCoordinator?.sweep();
+                return { scheduled: true };
             }
             if (operation === "browser.permission.classify") {
                 const roleRef = string(value.roleRef, "roleRef");
@@ -1379,79 +1464,6 @@ async function constructGraph(config, executionCredential, modelCredential) {
                 });
                 return { reported: true };
             }
-            if (operation === "execution.listSignals")
-                return execution.invoke("listExecutionObserverSignals", {
-                    limit: Number(value.limit ?? 50),
-                });
-            if (operation === "execution.ackSignal")
-                return execution.invoke("acknowledgeExecutionObserverSignal", {
-                    signalRef: string(value.signalRef, "signalRef"),
-                });
-            if (operation === "task.wake") {
-                const taskId = string(value.taskId, "taskId");
-                const nodeId = string(value.nodeId, "nodeId");
-                const runNo = Number(value.runNo);
-                const roleRef = string(value.roleRef, "roleRef");
-                const workerRef = string(value.workerRef, "workerRef");
-                const trigger = string(value.trigger, "trigger");
-                const underlyingRef = typeof value.underlyingRef === "string"
-                    ? value.underlyingRef
-                    : "none";
-                const wakeExecution = object(await execution.invoke("executeCapability", {
-                    contract: "execution",
-                    contractVersion: "1.0.0",
-                    idempotencyKey: `task-observer-wake:${taskId}:${nodeId}:${runNo}:${trigger}:${underlyingRef}`,
-                    callerRef: "extension:task-observer",
-                    correlationId: `task-observer:${taskId}:${nodeId}:${runNo}`,
-                    taskId,
-                    nodeId,
-                    runNo,
-                    roleRef,
-                    workerRef,
-                    capability: "worker.wake",
-                    input: {
-                        roleRef,
-                        workerRef,
-                        taskId,
-                        nodeId,
-                        runNo,
-                        trigger,
-                        fingerprint: `wake:${taskId}:${nodeId}:${runNo}:${trigger}:${underlyingRef}`,
-                    },
-                }), "task wake execution");
-                if (wakeExecution.status !== "SUCCEEDED" ||
-                    wakeExecution.sideEffectState !== "APPLIED")
-                    throw new Error(`TASK_WAKE_NOT_CONFIRMED:${String(wakeExecution.status)}:${String(wakeExecution.sideEffectState)}`);
-                return wakeExecution;
-            }
-            if (operation === "task.diagnostic") {
-                const response = object(await model.invoke("infer", {
-                    contractVersion: "1.0.0",
-                    specRef: "task.diagnostic.v1",
-                    mode: "reason",
-                    priority: "business",
-                    trace: {
-                        callerRef: "extension:task-observer",
-                        correlationId: string(value.correlationId, "correlationId"),
-                        taskId: string(value.taskId, "taskId"),
-                        nodeId: string(value.nodeId, "nodeId"),
-                    },
-                    payload: value.payload,
-                }), "task diagnostic inference");
-                if (response.status !== "SUCCEEDED") {
-                    const error = typeof response.error === "object" && response.error !== null
-                        ? response.error
-                        : {};
-                    const code = error.code === "CONTEXT_TOO_LARGE"
-                        ? "CONTEXT_TOO_LARGE"
-                        : error.code === "MODEL_UNAVAILABLE" ||
-                            error.code === "CAPABILITY_UNSUPPORTED"
-                            ? "REASON_UNAVAILABLE"
-                            : "REASON_FAILED";
-                    return { ok: false, errorCode: code };
-                }
-                return taskDiagnosticReasonResultSchema.parse(response.data);
-            }
             if (operation === "system.view")
                 return boundedSystemView(string(value.view, "view"));
             if (operation === "system.drilldown") {
@@ -1504,6 +1516,7 @@ async function constructGraph(config, executionCredential, modelCredential) {
             throw new Error("UNSUPPORTED_OBSERVER_APPLICATION_OPERATION");
         },
     });
+    reconciliationCoordinator.start();
     return Object.freeze({
         route,
         browserOwnerPorts,
@@ -1514,30 +1527,10 @@ async function constructGraph(config, executionCredential, modelCredential) {
         taskApplication,
         approvalApplication,
         observerApplication,
-        async lookup(operationId, authenticatedRoleRef, input) {
-            const value = object(input, "lookup input");
-            if (operationId === "executeCapability") {
-                if (value.executionRef) {
-                    const record = await execution.invoke("getExecution", {
-                        ...value,
-                        callerRef: authenticatedRoleRef,
-                    });
-                    return admitExecutionRead(authenticatedRoleRef, record);
-                }
-                const scope = await admitExactNodeExecution(value, authenticatedRoleRef);
-                const { workerRef: _suppliedWorkerRef, projectRoot: _suppliedProjectRoot, roleRef: _suppliedRoleRef, callerRef: _suppliedCallerRef, ...ownerInput } = value;
-                const record = await execution.invoke("lookupExecutionIntent", {
-                    ...ownerInput,
-                    callerRef: authenticatedRoleRef,
-                    roleRef: authenticatedRoleRef,
-                    taskId: scope.taskId,
-                    nodeId: scope.nodeId,
-                    runNo: scope.runNo,
-                    workerRef: scope.workerRef,
-                });
-                return admitExecutionRead(authenticatedRoleRef, record);
-            }
-            return route(operationId, authenticatedRoleRef, value);
+        async lookup(_operationId, _authenticatedRoleRef, _input) {
+            throw Object.assign(new Error("ACTION_RESULT_LOOKUP_UNSUPPORTED"), {
+                httpStatus: 409,
+            });
         },
         async readiness() {
             const diagnostics = taskStore.diagnostics();
@@ -1566,6 +1559,7 @@ async function constructGraph(config, executionCredential, modelCredential) {
             };
         },
         close() {
+            reconciliationCoordinator?.stop();
             agent.close();
             taskStore.close();
         },
@@ -1722,7 +1716,7 @@ export function createPlatformHost(input) {
             liveness: lifecycle === "STOPPED" ? "DOWN" : "UP",
             transport: server ? "UP" : "DOWN",
             readiness: accepting &&
-                Object.values(dependencies).every((item) => item.status === "READY")
+                [dependencies.task, dependencies.agent].every((item) => item.status === "READY")
                 ? "READY"
                 : "NOT_READY",
             accepting,
@@ -1821,8 +1815,7 @@ export function createPlatformHost(input) {
             log("DEPENDENCY_INITIALIZATION_STARTED", {
                 order: ["task", "agent", "execution-client", "model-client"],
             });
-            graph = await constructGraph(input.config, executionTransportCredential, modelTransportCredential);
-            await graph.readiness();
+            graph = await constructGraph(input.config, executionTransportCredential, modelTransportCredential, input.resolveOwnerConnection, input.resolveLocalToolConnection);
             server = createServer((request, response) => {
                 const work = (async () => {
                     const url = new URL(request.url ?? "/", "http://platform-host.local");
@@ -2044,11 +2037,16 @@ export function createPlatformHost(input) {
                         const operationId = decodeURIComponent(lookup ? suffix.slice(0, -"/result".length) : suffix);
                         const result = lookup
                             ? await graph.lookup(operationId, authenticatedRoleRef, body.input)
-                            : await graph.route(operationId, authenticatedRoleRef, body.input, body.fileMaterializationInputs === undefined
-                                ? undefined
-                                : {
-                                    fileMaterializationInputs: body.fileMaterializationInputs,
-                                });
+                            : await graph.route(operationId, authenticatedRoleRef, body.input, {
+                                ...(body.fileMaterializationInputs === undefined
+                                    ? {}
+                                    : {
+                                        fileMaterializationInputs: body.fileMaterializationInputs,
+                                    }),
+                                ...(typeof body.deadlineAt === "string"
+                                    ? { deadlineAt: body.deadlineAt }
+                                    : {}),
+                            });
                         respond(response, 200, result);
                     }
                     catch (error) {