Skip to content

feat(runtime-host): complete M5 production cutover - #2420

Merged
M4n5ter merged 26 commits into
mainfrom
feat/runtime-host-m5-cutover
Aug 8, 2026
Merged

feat(runtime-host): complete M5 production cutover#2420
M4n5ter merged 26 commits into
mainfrom
feat/runtime-host-m5-cutover

Conversation

@M4n5ter

@M4n5terM4n5ter commented Aug 7, 2026

Copy link
Copy Markdown
Member
English

Summary

  • make Runtime Host the only production Interactive owner for Desktop, CLI TUI, maka run, activation, and Bot
  • remove embedded production fallbacks, duplicate writers and schedulers, and the Desktop/CLI embedded composition graphs
  • migrate existing Desktop and CLI state through a resumable journal, while bootstrapping fresh profiles with the current defaults
  • move canonical execution, recovery, Sessions, Goals, Automations, runtime resources, policy, credentials, models, Subagents, and Skills behind Host operations
  • commit onboarding credentials and the final preflighted catalog as one recoverable roll-forward transaction, and broadcast committed configuration revisions across clients
  • keep Browser, Computer Use, Rive, OAuth presentation, notifications, MCP process management, and other OS integrations as explicit Desktop Client Capabilities
  • close recovery gaps for Side Chat and Revision copies, rich steering messages, Skill admission, renderer failure, reconnects, and cross-client Session observation
  • complete Desktop/TUI parity for projects, external sessions, shell runs, and PTY control, including Windows Host and release-verifier lifecycle handling

This cutover changes 421 files, adds 11,838 lines, and removes 36,858 lines. Most of the deletion is obsolete ownership, compatibility, and test scaffolding that no longer exists after the atomic switch.

Ownership boundaries

  • one canonical data root has one Interactive owner and writer
  • production clients cannot construct an embedded Interactive Runtime or writer Store
  • client disconnect does not transfer Runtime ownership or select a fallback
  • durable mutations remain committed when a downstream projection or notification fails
  • Desktop-native behavior remains client-owned; Headless TaskRun remains a separate control loop
  • production candidates cannot infer E2E behavior from inherited environment variables
  • Desktop: complete Runtime Host message queue parity #2262 remains out of scope

Validation

  • repository format, lint, typecheck, and build checks
  • full Storage, Runtime, Runtime Host, Desktop, CLI, Core, and Headless test suites
  • required GitHub alignment, audit, workspace, Runtime Host, Headless, Storybook, Desktop E2E, Windows baseline, and Windows package checks

Implements #853. M4 tracker #2010 was completed by #2419. Fixes#2439.

简体中文

概要

  • 让 Runtime Host 成为 Desktop、CLI TUI、maka run、activation 与 Bot 的唯一 production Interactive owner
  • 删除 embedded production fallback、重复 writer 与 scheduler,以及 Desktop/CLI embedded composition graph
  • 通过可恢复 journal 迁移现有 Desktop 与 CLI 状态,并使用当前默认值初始化新 profile
  • 将 canonical execution、recovery、Session、Goal、Automation、runtime resource、policy、credential、model、Subagent 与 Skill 统一收敛到 Host operation
  • 通过同一个可恢复 roll-forward transaction 提交 onboarding credential 与完成预检的最终 catalog,并跨 Client 广播已提交的 configuration revision
  • Browser、Computer Use、Rive、OAuth presentation、notification、MCP process management 与其他 OS integration 继续作为显式 Desktop Client Capability
  • 收口 Side Chat/Revision copy、rich steering message、Skill admission、renderer failure、reconnect 与跨 Client Session observation 的恢复缺口
  • 完成 Desktop/TUI 在 project、external session、shell run 与 PTY control 上的对齐,包括 Windows Host 与 release verifier lifecycle

本次切换涉及 421 个文件,新增 11,838 行,删除 36,858 行。删除内容主要是原子切换后不再存在的旧 ownership、compatibility 与测试脚手架。

Ownership 边界

  • 每个 canonical data root 只有一个 Interactive owner 与 writer
  • production Client 无法构造 embedded Interactive Runtime 或 writer Store
  • Client 断开不会转移 Runtime ownership,也不会选择 fallback
  • durable mutation 不会因为下游 projection 或 notification 失败而回滚
  • Desktop-native 行为继续由 Client 持有;Headless TaskRun 继续保持独立 control loop
  • production candidate 无法从继承的环境变量推断 E2E behavior
  • Desktop: complete Runtime Host message queue parity #2262 不在本次范围内

验证

  • 全仓 format、lint、typecheck 与 build 检查
  • Storage、Runtime、Runtime Host、Desktop、CLI、Core 与 Headless 全量测试
  • GitHub required alignment、audit、workspace、Runtime Host、Headless、Storybook、Desktop E2E、Windows baseline 与 Windows package check

实现 #853。M4 tracker #2010 已由 #2419 完成。修复 #2439

@M4n5ter
M4n5terforce-pushed the feat/runtime-host-m5-cutover branch 2 times, most recently from 749c03c to 11484efCompareAugust 7, 2026 13:47
@M4n5ter
M4n5ter marked this pull request as ready for review August 8, 2026 14:16
@M4n5ter
M4n5ter merged commit 6cd4c7f into mainAug 8, 2026
14 checks passed
@M4n5ter
M4n5ter deleted the feat/runtime-host-m5-cutover branch August 8, 2026 14:24
ARE404 added a commit to ARE404/maka-agent that referenced this pull request Aug 10, 2026
…had it
Reshaped on review: composition leaves `SessionTrace` entirely and lands on
`context.diagnostics.query`, the typed owner of "what is the context made
of" that `/context` (apache#1580) already consumes.
The rebase is what forced the question. apache#2420 deleted the embedded
inspector read this branch had wired, leaving only the Host's
`ExecutionInspectCoordinator` — and that path is budgeted (4096 records /
512 KiB per session trace, exceeding it throws). Measured against a real
capture, the events carrying segments are 15.7 KiB per attempt: 30
attempts is 92% of that budget and 60 is 184%. Reading them there would
not have added a breakdown to the Inspector, it would have turned a
working Inspector into "stop the Host to inspect it offline".
What this removes:
- `PromptComposition` and its validators from the core trace contract
- the `promptCompositions` input, map and per-attempt join in
`projectSessionTrace`
- any composition-specific evidence read
What it repairs in the path it moves to, both pre-existing:
- `readLatestContextDiagnostics` was an O(session ledger) scan on every
call. Both ledger types are now latest-of-type projections, so a warm
read is O(1) and the scan is a cold path that repairs the projection on
its way out. Append-time projection maintenance is skipped for subagent
runs — a subagent's request is real, but presenting it as the SESSION's
context attributes one agent's prompt to another.
- It read only the best-effort capture, so a missing latest capture
silently promoted an OLDER request to "current". The durable
`ModelCallAttempt` is now the anchor and the capture must match it by
`attemptId`: a request either explains itself or reports nothing.
Bytes cross the wire; `bytes / 4` does not. The Host reports measured
bytes and each surface makes its own labelled `≈` estimate — the CLI in
`/context`, the panel in its composition block — so one rule lives at one
layer and neither can present an estimate as a reported number (apache#1679).
Also closes the review follow-ups: the section no longer disappears when
a call reports no `contextWindow` (it never depended on the bar's
attempt), a capture -> JSON -> decode round-trip covers the seam every
hand-written fixture agreed with itself about, the unrendered
`totalBytes` pass-through is gone, a zero-byte part is dropped rather
than shown as `≈0`, and `unrecorded` has a story.
ARE404 added a commit to ARE404/maka-agent that referenced this pull request Aug 11, 2026
…had it
Reshaped on review: composition leaves `SessionTrace` entirely and lands on
`context.diagnostics.query`, the typed owner of "what is the context made
of" that `/context` (apache#1580) already consumes.
The rebase is what forced the question. apache#2420 deleted the embedded
inspector read this branch had wired, leaving only the Host's
`ExecutionInspectCoordinator` — and that path is budgeted (4096 records /
512 KiB per session trace, exceeding it throws). Measured against a real
capture, the events carrying segments are 15.7 KiB per attempt: 30
attempts is 92% of that budget and 60 is 184%. Reading them there would
not have added a breakdown to the Inspector, it would have turned a
working Inspector into "stop the Host to inspect it offline".
What this removes:
- `PromptComposition` and its validators from the core trace contract
- the `promptCompositions` input, map and per-attempt join in
`projectSessionTrace`
- any composition-specific evidence read
What it repairs in the path it moves to, both pre-existing:
- `readLatestContextDiagnostics` was an O(session ledger) scan on every
call. Both ledger types are now latest-of-type projections, so a warm
read is O(1) and the scan is a cold path that repairs the projection on
its way out. Append-time projection maintenance is skipped for subagent
runs — a subagent's request is real, but presenting it as the SESSION's
context attributes one agent's prompt to another.
- It read only the best-effort capture, so a missing latest capture
silently promoted an OLDER request to "current". The durable
`ModelCallAttempt` is now the anchor and the capture must match it by
`attemptId`: a request either explains itself or reports nothing.
Bytes cross the wire; `bytes / 4` does not. The Host reports measured
bytes and each surface makes its own labelled `≈` estimate — the CLI in
`/context`, the panel in its composition block — so one rule lives at one
layer and neither can present an estimate as a reported number (apache#1679).
Also closes the review follow-ups: the section no longer disappears when
a call reports no `contextWindow` (it never depended on the bar's
attempt), a capture -> JSON -> decode round-trip covers the seam every
hand-written fixture agreed with itself about, the unrendered
`totalBytes` pass-through is gone, a zero-byte part is dropped rather
than shown as `≈0`, and `unrecorded` has a story.
ARE404 added a commit to ARE404/maka-agent that referenced this pull request Aug 11, 2026
…had it
Reshaped on review: composition leaves `SessionTrace` entirely and lands on
`context.diagnostics.query`, the typed owner of "what is the context made
of" that `/context` (apache#1580) already consumes.
The rebase is what forced the question. apache#2420 deleted the embedded
inspector read this branch had wired, leaving only the Host's
`ExecutionInspectCoordinator` — and that path is budgeted (4096 records /
512 KiB per session trace, exceeding it throws). Measured against a real
capture, the events carrying segments are 15.7 KiB per attempt: 30
attempts is 92% of that budget and 60 is 184%. Reading them there would
not have added a breakdown to the Inspector, it would have turned a
working Inspector into "stop the Host to inspect it offline".
What this removes:
- `PromptComposition` and its validators from the core trace contract
- the `promptCompositions` input, map and per-attempt join in
`projectSessionTrace`
- any composition-specific evidence read
What it repairs in the path it moves to, both pre-existing:
- `readLatestContextDiagnostics` was an O(session ledger) scan on every
call. Both ledger types are now latest-of-type projections, so a warm
read is O(1) and the scan is a cold path that repairs the projection on
its way out. Append-time projection maintenance is skipped for subagent
runs — a subagent's request is real, but presenting it as the SESSION's
context attributes one agent's prompt to another.
- It read only the best-effort capture, so a missing latest capture
silently promoted an OLDER request to "current". The durable
`ModelCallAttempt` is now the anchor and the capture must match it by
`attemptId`: a request either explains itself or reports nothing.
Bytes cross the wire; `bytes / 4` does not. The Host reports measured
bytes and each surface makes its own labelled `≈` estimate — the CLI in
`/context`, the panel in its composition block — so one rule lives at one
layer and neither can present an estimate as a reported number (apache#1679).
Also closes the review follow-ups: the section no longer disappears when
a call reports no `contextWindow` (it never depended on the bar's
attempt), a capture -> JSON -> decode round-trip covers the seam every
hand-written fixture agreed with itself about, the unrendered
`totalBytes` pass-through is gone, a zero-byte part is dropped rather
than shown as `≈0`, and `unrecorded` has a story.
sunheyi6 added a commit to sunheyi6/maka-agent that referenced this pull request Aug 13, 2026
Resolves the PR conflict against the 247-commit mainline drift.
Mainline has since shipped the canonical Host submit/steering authority
(turn.message.submit via submitMessage, apache#2420) and a reworked steering
projection model (pendingSteering/leadingSteering); the PR's desktop
routing layer and steer rendering are superseded by it. This merge keeps
only what remains PR-specific on top of mainline:
- composer mid-turn queue strip (bound per-entry staged context, P2-1)
- optimistic arm rebind to the Host-named turn id (P2-2)
- optimistic steering rollback adapted to pendingSteering
- queue copy keys ported into the mainline conversation-copy
- compose with upstream's deep-path @maka/core imports
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ci(windows): tolerate transient EBUSY during release verifier cleanup

1 participant

@M4n5ter