Epic: Runtime-versioned automation — operator-managed workers, tasks, and triggers

[rickylabs]

Summary

Implementation umbrella for the accepted RFC 0002 — Runtime-Versioned Automation (operator-managed workers, tasks, and triggers). The RFC stabilizes the runtime-defined worker/task/trigger capability around immutable revisions, atomic activation-set epochs, snapshot convergence, execution history, policy-enforced execution boundaries, and plugin-extensible management surfaces.

RFC

• Acceptance PR: docs(rfc): runtime-versioned workers/tasks & triggers — production architecture RFC #1446
• Canonical document: rfcs/0002-runtime-versioned-automation.md
• Design/evidence record: .llm/runs/docs-rfc-runtime-versioned-automation--supervisor/

Implementation children (RFC §12, PR-sized; formal sub-issues of this umbrella)

Foundation — milestone 0.0.8

• [runtime-automation A0] automation-core contracts — family envelope, task@1/trigger@1 schemas, management oRPC contract #1503 — A0 automation-core contracts (family envelope, task@1/trigger@1, management oRPC contract)
• [runtime-automation A1a] automation-runtime ports + Postgres store adapter + epoch transaction + conformance suite #1504 — A1a runtime ports + Postgres adapter + epoch transaction + conformance suite
• [runtime-automation A1b] narrowed dev-KV store adapter — single-writer subset, explicit fleet-feature refusal #1505 — A1b narrowed dev-KV adapter (single-writer subset)
• [runtime-automation A1c] snapshot builder + client — epoch ordering, last-good, revision cache, outage tests #1506 — A1c snapshot builder + client (epoch ordering, last-good, revision cache, outage tests)
• [runtime-automation A2a] plugins/automation connector skeleton — manifest, management composition, Aspire + TM9 loader gate #1507 — A2a plugins/automation connector skeleton + Aspire + TM9 loader gate
• [runtime-automation A2b] lifecycle engine end-to-end — draft/validate/publish/activate/rollback #1508 — A2b lifecycle engine end-to-end (draft/validate/publish/activate/rollback)
• [runtime-automation A2d] change feed (SSE + poll) + leased fleet registration/admission/convergence + outage tests + BG-1 #1509 — A2d change feed + leased fleet registration/admission/convergence + BG-1
• [runtime-automation A2c] netscript automation CLI command group over the management contract #1510 — A2c netscript automation CLI command group
• [runtime-automation A3a] workers snapshot wiring + revision-pinned per-dispatch resolution + BG-2 #1511 — A3a workers snapshot wiring + revision-pinned dispatch + BG-2
• [runtime-automation A3b] execution history store + OTel attributes; KV job CRUD narrowed to read/enable/disable #1512 — A3b execution history store + OTel; KV job CRUD narrowed

Completion — milestone 0.0.10

• [runtime-automation A4a] triggers reload port + snapshot-driven definitions + durable scheduled/file-watch event path #1513 — A4a triggers reload port + snapshot-driven definitions + durable event path
• [runtime-automation A4b] management fire/test through the real processor; enabled-state folded into revision lifecycle #1514 — A4b management fire/test through the real processor; enabled-state in revision lifecycle
• [runtime-automation A5a] T1 execution boundary — deny-by-default grants, confinement, kill-tree, cgroup caps + negative tests + BG-5 #1515 — A5a T1 execution boundary (deny-by-default, confinement, negative tests, BG-5)
• [runtime-automation A5b] secrets-by-name resolution + bounded output redaction + management dry-run executions #1516 — A5b secrets-by-name + bounded redaction + management dry-run
• [runtime-automation A6a] §10 purge, package/CLI half — runtime-config pkg, override group, duplicate CLI, dual task models #1517 — A6a §10 purge, package/CLI half
• [runtime-automation A6b] §10 purge, scaffold/deploy half — runtime-tree emissions, glue stubs, generated boot paths, env emitters #1518 — A6b §10 purge, scaffold/deploy half
• [runtime-automation A6c] §10 docs half — READMEs + doc-site pages rewritten to shipped reality #1519 — A6c §10 docs half
• [runtime-automation A8] §13 E2E acceptance suite + BG-1/BG-4 measurements selected into e2e:cli + release-gate registration #1521 — A8 §13 E2E acceptance suite + benchmark gates into e2e:cli

Dependency-gated (frontend — Backlog / Triage until the #922 minimum cut lands)

• [runtime-automation A7] production/admin automation console (frontend — dependency-gated on the #922 minimum cut) #1520 — A7 production/admin automation console — blocked by epic Epic: Frontend contribution layer — plugins that ship UI #922 children [frontend-contrib S1] P1 proof: mounted sub-app command ordering #923–[frontend-contrib S10] Scaffold template wiring + HostSurfaceDescriptor + vite feed #932 + [frontend-contrib S12] Generated deny-by-default procedure gateway #934 ([frontend-contrib S11] Workers dogfood: zone panel + console route + island #933 adjacency) per RFC §8.2/§12; also A2b/A2d/A3b/A4b/A5b. DevTools surface is explicitly out of scope (staged P-6 DevTools RFC).

Staged prerequisite RFCs P-1..P-6 (RFC §11) are intentionally not filed here — each files with its own entry criteria when reached.

Complementary runtime-correctness defects (0.0.8 — independently owned, linked, NOT duplicated or superseded)

These pre-existing defects overlap the runtime surfaces this umbrella rebuilds. They stay independently owned on 0.0.8; A-slices reference them where adjacent and must not silently re-fix or close them:

• docs(orchestration-runtime): outbound webhook delivery has no recipe or template — triggers ship inbound ingress only, so every product hand-rolls signing, retry and dead-lettering #1364 — outbound webhook delivery recipe/template gap (adjacent to A4a trigger work)
• fix(plugins): every declareHealthChecks returns only the API resource — a crash-looping background child leaves the declared health surface green #1366 — declareHealthChecks green while background children crash-loop (adjacent to A2a composition + A8 acceptance)
• fix(plugins): two defects shipped as documented caveats — WORKER_CONCURRENCY never reaches the runtime, and @netscript/plugin-streams root exports always throw #1369 — WORKER_CONCURRENCY never reaches the runtime; plugin-streams root exports throw (adjacent to A3a/A5a executor work)
• fix(plugins): sagas/triggers/streams contributions and the generated browser consumer stub still publish pre-randomization ports #1370 — pre-randomization ports in sagas/triggers/streams contributions (triggers portion adjacent to A4a)
• verify(aspire): re-test the wave-6 claim that BackgroundProcessors.*.ServiceReferences is parsed but never injected #1371 — verify BackgroundProcessors ServiceReferences parsed-but-never-injected (adjacent to A2a Aspire declarations)
• test(e2e): the merge-readiness gate probes API health only — background children and streams go unverified, and a saga stuck compensating is reported COMPENSATED #1372 — merge-readiness gate probes API health only; background children unverified (adjacent to A8 suite design)

Not linked as children of this umbrella (different plugin families, independent tracks): #1365, #1368 (sagas), #1367 (streams durability).

Acceptance

• Current and legacy capability evidence recorded.
• Competitive/runtime architecture research completed.
• Separate PLAN-EVAL passed.
• Owner ratified the RFC.
• Implementation epic and A0–A8 children filed and linked (filing ledger comment below; children [runtime-automation A0] automation-core contracts — family envelope, task@1/trigger@1 schemas, management oRPC contract #1503–[runtime-automation A8] §13 E2E acceptance suite + BG-1/BG-4 measurements selected into e2e:cli + release-gate registration #1521 with formal sub-issue relationships).
• Required implementation slices shipped and verified (A0–A6, A8; A7 when its frontend prerequisites land).