relay-flow 0.2.4-alpha → 0.2.6-alpha

package/cmd/relay-flow/serve.go

@@ -21,6 +21,8 @@ import (
 
 	"github.com/rajpopat27/relay-flow/internal/config"
 	"github.com/rajpopat27/relay-flow/internal/execution/goworkflows"
+	"github.com/rajpopat27/relay-flow/internal/execution/projection"
+	temporalexec "github.com/rajpopat27/relay-flow/internal/execution/temporal"
 	"github.com/rajpopat27/relay-flow/internal/harness"
 	"github.com/rajpopat27/relay-flow/internal/paths"
 	recoverpkg "github.com/rajpopat27/relay-flow/internal/recover"
@@ -179,13 +181,35 @@ func serveRoot(ctx context.Context, p paths.Paths, recover bool) error {
 	//       provably empty database, and Engine.Start has no prior history
 	//       to resume.
 	if recover {
-		stamp := time.Now().UTC().Format("20060102T150405Z")
-		for _, suffix := range []string{"", "-wal", "-shm"} {
+		// Validate the existing installation identity before moving any state
+		// aside. A changed executor/address/namespace must fail closed; only a
+		// genuinely missing database may be initialized by recovery.
+		if _, statErr := os.Stat(p.Database); statErr == nil {
+			expected := projection.ExecutorIdentity{ExecutorPlugin: cfg.ExecutorPlugin}
+			if cfg.ExecutorPlugin == executorTemporal {
+				expected.TemporalAddress = cfg.TemporalAddress
+				expected.TemporalNamespace = cfg.TemporalNamespace
+			}
+			if err := verifyExecutorIdentity(p.Database, expected); err != nil && !errors.Is(err, ErrProjectionUnusable) {
+				return fmt.Errorf("recover: verify executor identity before backup: %w", err)
+			}
+		} else if !os.IsNotExist(statErr) {
+			return fmt.Errorf("recover: stat database %s: %w", p.Database, statErr)
+		}
+		stamp := time.Now().UTC().Format("20060102T150405.000000000Z")
+		suffixes := []string{"", "-wal", "-shm"}
+		backupStem, err := recoveryBackupStem(p.Database, stamp, suffixes)
+		if err != nil {
+			return err
+		}
+		for _, suffix := range suffixes {
 			src := p.Database + suffix
 			if _, err := os.Stat(src); os.IsNotExist(err) {
 				continue
+			} else if err != nil {
+				return fmt.Errorf("inspect stale database %s: %w", src, err)
 			}
-			dst := fmt.Sprintf("%s.recover-%s.bak%s", p.Database, stamp, suffix)
+			dst := backupStem + ".bak" + suffix
 			if err := os.Rename(src, dst); err != nil {
 				return fmt.Errorf("preserve stale database %s as %s: %w", src, dst, err)
 			}
@@ -201,21 +225,32 @@ func serveRoot(ctx context.Context, p paths.Paths, recover bool) error {
 		}
 	}
 
-	// Open the go-workflows SQLite engine (migrates relay_runs; does not
-	// yet start workers).
-	engine, err := goworkflows.New(p.Database, goworkflows.Dependencies{
-		Repos:         repoReg,
-		Runner:        rnr,
-		Harness:       hrn,
-		TaskSystem:    cfg.TaskPlugin,
-		RetentionDays: cfg.CompletedRunRetentionDays,
-		Runtime: &runsvc.RuntimePolicy{
-			KeepTerminalsAlive: cfg.KeepTerminalsAlive,
-			KeepSessionsAlive:  cfg.KeepSessionsAlive,
-		},
-	})
+	// Open exactly the configured durable executor. The machine config and
+	// projection identity have already selected/fenced this backend; there is
+	// deliberately no probe-and-fallback path.
+	var engine durableEngine
+	runtimePolicy := &runsvc.RuntimePolicy{
+		KeepTerminalsAlive: cfg.KeepTerminalsAlive,
+		KeepSessionsAlive:  cfg.KeepSessionsAlive,
+	}
+	switch cfg.ExecutorPlugin {
+	case "goworkflows":
+		engine, err = goworkflows.New(p.Database, goworkflows.Dependencies{
+			Repos: repoReg, Runner: rnr, Harness: hrn, TaskSystem: cfg.TaskPlugin,
+			RetentionDays: cfg.CompletedRunRetentionDays, Runtime: runtimePolicy,
+		})
+	case "temporal":
+		engine, err = temporalexec.New(p.Database, temporalexec.Dependencies{
+			Repos: repoReg, Runner: rnr, Harness: hrn, TaskSystem: cfg.TaskPlugin,
+			RetentionDays: cfg.CompletedRunRetentionDays, Runtime: runtimePolicy,
+			TemporalAddress: cfg.TemporalAddress, TemporalNamespace: cfg.TemporalNamespace,
+			Recover: recover,
+		})
+	default:
+		err = fmt.Errorf("unknown executor plugin %q (want goworkflows or temporal)", cfg.ExecutorPlugin)
+	}
 	if err != nil {
-		return fmt.Errorf("open engine: %w", err)
+		return fmt.Errorf("open %s engine: %w", cfg.ExecutorPlugin, err)
 	}
 
 	// 5.2 fail-fast preflight: before workers/pollers start, validate
@@ -278,7 +313,7 @@ func serveRoot(ctx context.Context, p paths.Paths, recover bool) error {
 	// recovered runs exist before any poll cycle observes them. Mailbox
 	// specs come from the engine so the recover path builds the same
 	// description content as normal run execution.
-	if recover {
+	if recover && cfg.ExecutorPlugin == "goworkflows" {
 		specsFor := func(sys task.System, work runsvc.Work, wf *workflow.Workflow) ([]task.MailboxSpec, error) {
 			return goworkflows.RenderMailboxSpecs(sys, work, wf)
 		}
@@ -362,6 +397,18 @@ func serveRoot(ctx context.Context, p paths.Paths, recover bool) error {
 	// single cleanup path.
 	stopCtx, stopServe := context.WithCancel(context.Background())
 	defer stopServe()
+	if fatalEngine, ok := engine.(interface{ FatalErrors() <-chan error }); ok {
+		go func() {
+			select {
+			case fatalErr := <-fatalEngine.FatalErrors():
+				if fatalErr != nil {
+					slog.Error("durable executor worker failed", "error", fatalErr)
+				}
+				stopServe()
+			case <-stopCtx.Done():
+			}
+		}()
+	}
 
 	deps := &serveDeps{
 		wf:         wfSvc,
@@ -402,6 +449,29 @@ func serveRoot(ctx context.Context, p paths.Paths, recover bool) error {
 	return serveResult
 }
 
+func recoveryBackupStem(database, stamp string, suffixes []string) (string, error) {
+	for attempt := 0; attempt < 1000; attempt++ {
+		candidateStamp := stamp
+		if attempt > 0 {
+			candidateStamp = fmt.Sprintf("%s-%d", stamp, attempt)
+		}
+		stem := fmt.Sprintf("%s.recover-%s", database, candidateStamp)
+		collision := false
+		for _, suffix := range suffixes {
+			if _, err := os.Stat(stem + ".bak" + suffix); err == nil {
+				collision = true
+				break
+			} else if !os.IsNotExist(err) {
+				return "", fmt.Errorf("inspect recovery backup %s: %w", stem+".bak"+suffix, err)
+			}
+		}
+		if !collision {
+			return stem, nil
+		}
+	}
+	return "", fmt.Errorf("unable to allocate unique recovery backup for %s", database)
+}
+
 func workflowConfigValidator(repoReg *repo.Registry) func(context.Context, *workflow.Workflow) error {
 	return func(ctx context.Context, wf *workflow.Workflow) error {
 		nodeCfgs := map[string]config.RawValues{}
@@ -431,10 +501,19 @@ func (r repoExists) Exists(name string) bool {
 
 // serveDeps adapts composition-root services to server.Deps. Thin forwarder;
 // no logic. Signatures match docs/structs-methods-interfaces.md Client.
+type durableEngine interface {
+	runsvc.Executor
+	runsvc.RunQueries
+	Start(context.Context) error
+	Shutdown(context.Context) error
+	HasProcessedReport(context.Context, runsvc.ID, string) (bool, error)
+	RegisterNodeSession(context.Context, runsvc.NodeRuntimeRegistration) (runsvc.NodeRuntimeRegistrationAck, error)
+}
+
 type serveDeps struct {
 	wf             *workflow.Service
 	repos          *repo.Service
-	engine         *goworkflows.Engine
+	engine         durableEngine
 	runManager     *runsvc.RunManager
 	onReposChanged func()
 	shutdown       func(context.Context) error

package/cmd/relay-flow/serve_recovery_test.go

@@ -0,0 +1,100 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/rajpopat27/relay-flow/internal/config"
+	"github.com/rajpopat27/relay-flow/internal/execution/projection"
+	"github.com/rajpopat27/relay-flow/internal/paths"
+)
+
+func TestCorruptProjectionIsClassifiedUnusableForRecovery(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "state.db")
+	if err := os.WriteFile(path, []byte("not sqlite"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	err := verifyExecutorIdentity(path, projection.ExecutorIdentity{ExecutorPlugin: "temporal", TemporalAddress: "localhost:7233", TemporalNamespace: "corrupt"})
+	if !errors.Is(err, ErrProjectionUnusable) {
+		t.Fatalf("corrupt projection error = %v, want ErrProjectionUnusable", err)
+	}
+}
+
+func TestTemporalRecoveryRejectsIdentityMismatchBeforeBackup(t *testing.T) {
+	log := newScenarioLog()
+	setScenarioFactoryAdapters(newScenarioTaskSystem(log), newScenarioRunner(log), newScenarioHarness(log))
+	root := filepath.Join(t.TempDir(), ".relay-flow")
+	p := pathsForRoot(root)
+	if err := paths.Ensure(p); err != nil {
+		t.Fatal(err)
+	}
+	if err := config.SaveMachine(p.Config, &config.Machine{
+		TaskPlugin: scenarioTaskPlugin, RunnerPlugin: scenarioRunnerPlugin, HarnessPlugin: scenarioHarnessPlugin,
+		ExecutorPlugin: "temporal", TemporalAddress: "localhost:7233", TemporalNamespace: "identity-recovery",
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := projection.InitDatabaseWithIdentity(p.Database, projection.ExecutorIdentity{
+		ExecutorPlugin: "temporal", TemporalAddress: "other-host:7233", TemporalNamespace: "identity-recovery",
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := serveRoot(context.Background(), p, true); !errors.Is(err, projection.ErrIdentityMismatch) {
+		t.Fatalf("recovery identity mismatch error = %v", err)
+	}
+	if _, err := os.Stat(p.Database); err != nil {
+		t.Fatalf("identity mismatch moved database before failing: %v", err)
+	}
+	backups, err := filepath.Glob(p.Database + ".recover-*.bak")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(backups) != 0 {
+		t.Fatalf("identity mismatch created recovery backups: %v", backups)
+	}
+}
+
+func TestTemporalRecoveryRejectsMarkerlessExistingDatabase(t *testing.T) {
+	log := newScenarioLog()
+	setScenarioFactoryAdapters(newScenarioTaskSystem(log), newScenarioRunner(log), newScenarioHarness(log))
+	root := filepath.Join(t.TempDir(), ".relay-flow")
+	p := pathsForRoot(root)
+	if err := paths.Ensure(p); err != nil {
+		t.Fatal(err)
+	}
+	if err := config.SaveMachine(p.Config, &config.Machine{
+		TaskPlugin: scenarioTaskPlugin, RunnerPlugin: scenarioRunnerPlugin, HarnessPlugin: scenarioHarnessPlugin,
+		ExecutorPlugin: "temporal", TemporalAddress: "localhost:7233", TemporalNamespace: "markerless-recovery",
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := projection.InitDatabase(p.Database); err != nil {
+		t.Fatal(err)
+	}
+	if err := serveRoot(context.Background(), p, true); !errors.Is(err, projection.ErrIdentityMissing) {
+		t.Fatalf("markerless Temporal recovery error = %v", err)
+	}
+	if _, err := os.Stat(p.Database); err != nil {
+		t.Fatalf("markerless database moved before failing: %v", err)
+	}
+}
+
+func TestRecoveryBackupPathAvoidsSameTimestampCollision(t *testing.T) {
+	database := filepath.Join(t.TempDir(), "state.db")
+	stamp := "20260905T010203.000000000Z"
+	first := database + ".recover-" + stamp + ".bak"
+	if err := os.WriteFile(first, []byte("existing"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	stem, err := recoveryBackupStem(database, stamp, []string{"", "-wal", "-shm"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(stem, ".recover-"+stamp+"-1") {
+		t.Fatalf("collision-safe backup stem = %q, want alternate", stem)
+	}
+}

package/cmd/relay-flow/temporal_init.go

@@ -0,0 +1,170 @@
+package main
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/charmbracelet/huh"
+	"github.com/rajpopat27/relay-flow/internal/execution/projection"
+	"go.temporal.io/api/serviceerror"
+	workflowservice "go.temporal.io/api/workflowservice/v1"
+	"go.temporal.io/sdk/client"
+	"google.golang.org/protobuf/types/known/durationpb"
+)
+
+var ErrProjectionUnusable = errors.New("relay projection is unusable")
+
+const (
+	executorGoworkflows      = "goworkflows"
+	executorTemporal         = "temporal"
+	defaultTemporalAddr      = "localhost:7233"
+	minimumTemporalRetention = 30 * 24 * time.Hour
+)
+
+// executorSelectField is the exact interactive executor selection required by
+// the Temporal MVP. The first option deliberately remains the embedded default.
+func executorSelectField(value *string) (huh.Field, error) {
+	if value == nil {
+		return nil, fmt.Errorf("executor selection requires a destination")
+	}
+	return huh.NewSelect[string]().
+		Title("Select executor").
+		Options(huh.NewOptions(executorGoworkflows, executorTemporal)...).
+		Value(value), nil
+}
+
+func temporalAddressField(value *string) (huh.Field, error) {
+	if value == nil {
+		return nil, fmt.Errorf("Temporal address requires a destination")
+	}
+	if *value == "" {
+		*value = defaultTemporalAddr
+	}
+	return huh.NewInput().
+		Title("Temporal server address").
+		Value(value), nil
+}
+
+func temporalNamespaceField(value *string) (huh.Field, error) {
+	if value == nil {
+		return nil, fmt.Errorf("Temporal namespace requires a destination")
+	}
+	return huh.NewInput().
+		Title("Temporal namespace/team name").
+		Value(value), nil
+}
+
+func promptTemporalSettings(address, namespace string) (string, string, error) {
+	groups := make([]*huh.Group, 0, 2)
+	if address == "" {
+		field, err := temporalAddressField(&address)
+		if err != nil {
+			return "", "", err
+		}
+		groups = append(groups, huh.NewGroup(field))
+	}
+	if namespace == "" {
+		field, err := temporalNamespaceField(&namespace)
+		if err != nil {
+			return "", "", err
+		}
+		groups = append(groups, huh.NewGroup(field))
+	}
+	if len(groups) > 0 {
+		if err := huh.NewForm(groups...).Run(); err != nil {
+			return "", "", err
+		}
+	}
+	return strings.TrimSpace(address), strings.TrimSpace(namespace), nil
+}
+
+func requiredTemporalRetention(days int) time.Duration {
+	retention := minimumTemporalRetention
+	if days > 0 && time.Duration(days)*24*time.Hour > retention {
+		retention = time.Duration(days) * 24 * time.Hour
+	}
+	return retention
+}
+
+// ensureTemporalNamespace creates a missing namespace or verifies an existing
+// one through the public SDK. Existing retention is never lowered or silently
+// changed by relay-flow.
+func verifyExecutorIdentity(path string, expected projection.ExecutorIdentity) error {
+	db, err := sql.Open("sqlite", path)
+	if err != nil {
+		return fmt.Errorf("open executor identity %s: %w", path, err)
+	}
+	defer db.Close()
+	db.SetMaxOpenConns(1)
+	if _, err := db.Exec(`PRAGMA schema_version`); err != nil {
+		return fmt.Errorf("%w: inspect executor identity %s: %v", ErrProjectionUnusable, path, err)
+	}
+	// Legacy databases predate the identity table. Migrate only the shared
+	// relay projection before verification so an embedded legacy home can be
+	// adopted without touching its engine history.
+	proj := &projection.RunProjection{DB: db}
+	if err := proj.Migrate(); err != nil {
+		return fmt.Errorf("%w: migrate relay projection %s: %v", ErrProjectionUnusable, path, err)
+	}
+	if err := proj.VerifyIdentity(context.Background(), expected); err != nil {
+		if errors.Is(err, projection.ErrIdentityMismatch) || errors.Is(err, projection.ErrIdentityMissing) {
+			return err
+		}
+		return fmt.Errorf("%w: verify executor identity %s: %v", ErrProjectionUnusable, path, err)
+	}
+	return nil
+}
+
+func ensureTemporalNamespace(ctx context.Context, address, namespace string, retentionDays int) error {
+	address = strings.TrimSpace(address)
+	namespace = strings.TrimSpace(namespace)
+	if address == "" {
+		address = defaultTemporalAddr
+	}
+	if namespace == "" {
+		return fmt.Errorf("Temporal namespace is required")
+	}
+	if namespace == client.DefaultNamespace {
+		return fmt.Errorf("Temporal namespace must be a dedicated named namespace, not %q", client.DefaultNamespace)
+	}
+	manager, err := client.NewNamespaceClient(client.Options{HostPort: address})
+	if err != nil {
+		return fmt.Errorf("connect to Temporal namespace manager at %s: %w", address, err)
+	}
+	defer manager.Close()
+
+	required := requiredTemporalRetention(retentionDays)
+	description, err := manager.Describe(ctx, namespace)
+	if err != nil {
+		var notFound *serviceerror.NamespaceNotFound
+		if !errors.As(err, &notFound) {
+			return fmt.Errorf("describe Temporal namespace %q: %w", namespace, err)
+		}
+		if err := manager.Register(ctx, &workflowservice.RegisterNamespaceRequest{
+			Namespace:                        namespace,
+			Description:                      "relay-flow durable executor",
+			WorkflowExecutionRetentionPeriod: durationpb.New(required),
+		}); err != nil {
+			var alreadyExists *serviceerror.NamespaceAlreadyExists
+			if !errors.As(err, &alreadyExists) {
+				return fmt.Errorf("register Temporal namespace %q: %w", namespace, err)
+			}
+		}
+		description, err = manager.Describe(ctx, namespace)
+		if err != nil {
+			return fmt.Errorf("verify registered Temporal namespace %q: %w", namespace, err)
+		}
+	}
+	if description.Config == nil || description.Config.WorkflowExecutionRetentionTtl == nil {
+		return fmt.Errorf("Temporal namespace %q has no workflow retention configuration", namespace)
+	}
+	actual := description.Config.WorkflowExecutionRetentionTtl.AsDuration()
+	if actual < required {
+		return fmt.Errorf("Temporal namespace %q retention is %s, need at least %s", namespace, actual, required)
+	}
+	return nil
+}

package/cmd/relay-flow/temporal_init_test.go

@@ -0,0 +1,217 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/rajpopat27/relay-flow/internal/config"
+	"github.com/rajpopat27/relay-flow/internal/execution/projection"
+	"github.com/rajpopat27/relay-flow/internal/paths"
+	_ "modernc.org/sqlite"
+)
+
+func TestInitExecutorSelectionFieldUsesExactTitleAndEmbeddedDefault(t *testing.T) {
+	var selected string
+	field, err := executorSelectField(&selected)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if field == nil {
+		t.Fatal("executor selection field is nil")
+	}
+	var out bytes.Buffer
+	if err := field.RunAccessible(&out, strings.NewReader("1\n")); err != nil {
+		t.Fatal(err)
+	}
+	if selected != "goworkflows" {
+		t.Fatalf("default executor selection = %q, want goworkflows", selected)
+	}
+	if !strings.Contains(out.String(), "Select executor") {
+		t.Fatalf("executor selection output %q missing exact title", out.String())
+	}
+}
+
+func TestTemporalSettingsFieldsUseApprovedTitlesAndAddressDefault(t *testing.T) {
+	address := ""
+	field, err := temporalAddressField(&address)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var out bytes.Buffer
+	if err := field.RunAccessible(&out, strings.NewReader("\n")); err != nil {
+		t.Fatal(err)
+	}
+	if address != defaultTemporalAddr || !strings.Contains(out.String(), "Temporal server address") {
+		t.Fatalf("address field = %q, output %q", address, out.String())
+	}
+	namespace := ""
+	field, err = temporalNamespaceField(&namespace)
+	if err != nil {
+		t.Fatal(err)
+	}
+	out.Reset()
+	if err := field.RunAccessible(&out, strings.NewReader("relay-flow-team\n")); err != nil {
+		t.Fatal(err)
+	}
+	if namespace != "relay-flow-team" || !strings.Contains(out.String(), "Temporal namespace/team name") {
+		t.Fatalf("namespace field = %q, output %q", namespace, out.String())
+	}
+}
+
+func TestInitRejectsTemporalOnlyFlagsForEmbeddedExecutor(t *testing.T) {
+	home := t.TempDir()
+	code := cli(t, home, "", "init",
+		"--task-plugin", "jira", "--runner-plugin", "orca", "--harness-plugin", "opencode",
+		"--executor-plugin", "goworkflows", "--temporal-address", "localhost:7233",
+	)
+	if code == 0 {
+		t.Fatal("embedded init accepted Temporal-only flags")
+	}
+	if _, err := os.Stat(filepath.Join(home, ".relay-flow", "config.yaml")); !os.IsNotExist(err) {
+		t.Fatalf("rejected embedded init wrote config: %v", err)
+	}
+}
+
+func TestInitTemporalFailureDoesNotWritePartialConfiguration(t *testing.T) {
+	home := t.TempDir()
+	code := cli(t, home, "", "init",
+		"--task-plugin", "jira", "--runner-plugin", "orca", "--harness-plugin", "opencode",
+		"--executor-plugin", "temporal", "--temporal-address", "127.0.0.1:1", "--temporal-namespace", "relay-flow-failure",
+	)
+	if code == 0 {
+		t.Fatal("Temporal init unexpectedly succeeded against unavailable server")
+	}
+	root := filepath.Join(home, ".relay-flow")
+	for _, name := range []string{"config.yaml", "state.db"} {
+		if _, err := os.Stat(filepath.Join(root, name)); !os.IsNotExist(err) {
+			t.Fatalf("failed Temporal init wrote %s: %v", name, err)
+		}
+	}
+}
+
+func TestTemporalInitLiveCreatesNamedNamespaceAndIdentity(t *testing.T) {
+	if os.Getenv("RELAY_FLOW_TEMPORAL_LIVE") != "1" {
+		t.Skip("set RELAY_FLOW_TEMPORAL_LIVE=1 to run Temporal init against the local server")
+	}
+	home := t.TempDir()
+	namespace := fmt.Sprintf("relay-flow-init-%d", time.Now().UnixNano())
+	code := cli(t, home, "", "init",
+		"--task-plugin", "jira", "--runner-plugin", "orca", "--harness-plugin", "opencode",
+		"--executor-plugin", "temporal", "--temporal-address", "localhost:7233", "--temporal-namespace", namespace,
+	)
+	if code != 0 {
+		t.Fatalf("Temporal init exit = %d, want 0", code)
+	}
+	root := filepath.Join(home, ".relay-flow")
+	cfg, err := config.LoadMachine(filepath.Join(root, "config.yaml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.ExecutorPlugin != "temporal" || cfg.TemporalAddress != "localhost:7233" || cfg.TemporalNamespace != namespace {
+		t.Fatalf("Temporal config = %+v", cfg)
+	}
+	db, err := sql.Open("sqlite", filepath.Join(root, "state.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	var plugin, address, persistedNamespace string
+	if err := db.QueryRowContext(context.Background(), `SELECT executor_plugin, temporal_address, temporal_namespace FROM relay_executor_identity WHERE singleton = 1`).Scan(&plugin, &address, &persistedNamespace); err != nil {
+		t.Fatalf("read initialized executor identity: %v", err)
+	}
+	if plugin != "temporal" || address != "localhost:7233" || persistedNamespace != namespace {
+		t.Fatalf("persisted Temporal identity = %q/%q/%q", plugin, address, persistedNamespace)
+	}
+}
+
+func TestInitForceAdoptsLegacyMarkerlessGoworkflowsDatabase(t *testing.T) {
+	home := t.TempDir()
+	root := filepath.Join(home, ".relay-flow")
+	p := pathsForRoot(root)
+	if err := paths.Ensure(p); err != nil {
+		t.Fatal(err)
+	}
+	if err := config.SaveMachine(p.Config, &config.Machine{TaskPlugin: "jira", RunnerPlugin: "orca", HarnessPlugin: "opencode"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := projection.InitDatabase(p.Database); err != nil {
+		t.Fatal(err)
+	}
+	if code := cli(t, home, "", "init", "--force", "--task-plugin", "jira", "--runner-plugin", "orca", "--harness-plugin", "opencode", "--executor-plugin", "goworkflows"); code != 0 {
+		t.Fatalf("legacy markerless init --force exit = %d", code)
+	}
+	db, err := sql.Open("sqlite", p.Database)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	var plugin string
+	if err := db.QueryRow(`SELECT executor_plugin FROM relay_executor_identity WHERE singleton = 1`).Scan(&plugin); err != nil {
+		t.Fatal(err)
+	}
+	if plugin != "goworkflows" {
+		t.Fatalf("adopted legacy executor identity = %q", plugin)
+	}
+}
+
+func TestInitForceRejectsExecutorChange(t *testing.T) {
+	home := t.TempDir()
+	initHome(t, home)
+	before := readFile(t, filepath.Join(home, ".relay-flow", "config.yaml"))
+	if code := cli(t, home, "", "init", "--force",
+		"--task-plugin", "jira", "--runner-plugin", "orca", "--harness-plugin", "opencode",
+		"--executor-plugin", "temporal", "--temporal-namespace", "relay-flow-change"); code == 0 {
+		t.Fatal("init --force accepted an executor change")
+	}
+	if got := readFile(t, filepath.Join(home, ".relay-flow", "config.yaml")); got != before {
+		t.Fatal("rejected executor change modified config")
+	}
+}
+
+func TestTemporalInitForceRejectsDurableIdentityChangeLive(t *testing.T) {
+	if os.Getenv("RELAY_FLOW_TEMPORAL_LIVE") != "1" {
+		t.Skip("set RELAY_FLOW_TEMPORAL_LIVE=1 to run Temporal init against the local server")
+	}
+	home := t.TempDir()
+	namespace := fmt.Sprintf("relay-flow-force-%d", time.Now().UnixNano())
+	args := []string{"init", "--task-plugin", "jira", "--runner-plugin", "orca", "--harness-plugin", "opencode", "--executor-plugin", "temporal", "--temporal-address", "localhost:7233", "--temporal-namespace", namespace}
+	if code := cli(t, home, "", args...); code != 0 {
+		t.Fatalf("initial Temporal init exit = %d", code)
+	}
+	before := readFile(t, filepath.Join(home, ".relay-flow", "config.yaml"))
+	for name, changed := range map[string][]string{
+		"address":   {"init", "--force", "--task-plugin", "jira", "--runner-plugin", "orca", "--harness-plugin", "opencode", "--executor-plugin", "temporal", "--temporal-address", "localhost:7443", "--temporal-namespace", namespace},
+		"namespace": {"init", "--force", "--task-plugin", "jira", "--runner-plugin", "orca", "--harness-plugin", "opencode", "--executor-plugin", "temporal", "--temporal-address", "localhost:7233", "--temporal-namespace", namespace + "-changed"},
+		"executor":  {"init", "--force", "--task-plugin", "jira", "--runner-plugin", "orca", "--harness-plugin", "opencode", "--executor-plugin", "goworkflows"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			if code := cli(t, home, "", changed...); code == 0 {
+				t.Fatalf("init --force accepted changed Temporal %s", name)
+			}
+			if got := readFile(t, filepath.Join(home, ".relay-flow", "config.yaml")); got != before {
+				t.Fatalf("rejected init --force %s change modified config", name)
+			}
+		})
+	}
+}
+
+func TestInitTemporalNonInteractiveRequiresExplicitNamespace(t *testing.T) {
+	home := t.TempDir()
+	code := cli(t, home, "", "init",
+		"--task-plugin", "jira", "--runner-plugin", "orca", "--harness-plugin", "opencode",
+		"--executor-plugin", "temporal", "--temporal-address", "localhost:7233",
+	)
+	if code == 0 {
+		t.Fatal("non-interactive Temporal init succeeded without namespace")
+	}
+	if _, err := os.Stat(filepath.Join(home, ".relay-flow", "config.yaml")); !os.IsNotExist(err) {
+		t.Fatalf("missing-namespace init wrote config: %v", err)
+	}
+}