feat: productionize runner pools and add Nuxt dashboard

[RedStar071]

Summary

• Add provider-neutral runner pools with quotas, lease expiry, and sandbox lifecycle controls.
• Add native OpenAI, Anthropic, Google, AI Gateway, and OpenAI-compatible model transports.
• Track model, token, latency, cost, runner, and verification evidence in stable runtime contracts.
• Replace apps/server with a frontend-only Nuxt compatibility-v5 operations dashboard.
• Add Playwright coverage for rendering, local refresh behavior, hydration, and theme persistence.

Why

Issue #10 requires production runner orchestration without coupling infrastructure providers to the
agent runtime. The runner pool remains in packages/runner, provider transports remain in
packages/models, and the dashboard owns presentation only.

This keeps repository execution behind the runner boundary while allowing composition roots to
select providers and acquire isolated runner leases.

Refs #10.

Verification

All required checks and the dashboard E2E suite pass locally.

• aube run check:repo
• aube run lint:ci
• aube run typecheck
• aube test
• aube run build
• aube run test:e2e — 3 Playwright tests passed

Safety and compatibility

• I added or updated deterministic tests for changed behavior.
• I preserved observe mode as read-only, or explained the policy change above.
• Runtime commands and target-repository writes remain inside the runner boundary.
• I did not expose secrets, tokens, personal data, or untrusted output in logs.
• I updated documentation and Agent Skills when workflows or boundaries changed.

Reviewer notes

The dashboard intentionally has no custom Nitro API routes, oRPC procedures, persistence adapter,
scheduler, or runtime-package dependencies. Nuxt still produces its normal ignored SSR build
artifact.

The embedded control-plane implementation was removed in the final follow-up, so this PR references
rather than automatically closes#10. The completed scope covers runner pools, provider support,
usage evidence, policy wiring, and the frontend dashboard.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

Confidence Score: 5/5

No blocking failure remains; the exercised runner lifecycle behavior is safe to merge.

No accepted blocking findings remain after exercising concurrent provisioning, invalid inputs, expiry, failed cleanup, and disposal races.

T-Rex Logs

What T-Rex did

• Executed a standalone TypeScript runtime harness using Node 24 with --experimental-transform-types, and all eight lifecycle assertions passed.
• Captured a same-scope before/current pair because no source modification was requested or made.
• Assessed workspace test runner availability and found that node_modules and the aube executable were missing, so the Vitest suite could not be run.
• Attached artifacts documenting the harness source and lifecycle logs for review.

_{Ran code and verified through T-Rex}

_{Reviews (6): Last reviewed commit: "fix(runner): surface and retry failed st..." | Re-trigger Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​unocss/​nuxt@​66.7.5
	@​ai-sdk/​google@​4.0.39
	@​ai-sdk/​openai@​4.0.36
	@​unocss/​webpack@​66.7.5
	@​unocss/​preset-wind4@​66.7.5
	@​ai-sdk/​anthropic@​4.0.36
	@​nuxt/​test-utils@​4.1.0
	playwright-core@​1.62.1
	webpack@​5.109.2
	@​nuxtjs/​color-mode@​4.0.1
	vue-tsc@​3.3.9
	nuxt@​4.5.2
	unocss@​66.7.5
	@​playwright/​test@​1.62.1
	@​agent-zero/​agent@​0.1.0 ⏵ 0.3.0	N/A	N/A	N/A	N/A	N/A
	@​agent-zero/​config@​0.1.0 ⏵ 0.3.0	N/A	N/A	N/A	N/A	N/A
	@​agent-zero/​models@​0.1.0 ⏵ 0.3.0	N/A	N/A	N/A	N/A	N/A
	@​agent-zero/​runner@​0.1.0 ⏵ 0.3.0	N/A	N/A	N/A	N/A	N/A
	@​agent-zero/​shared@​0.1.0 ⏵ 0.3.0	N/A	N/A	N/A	N/A	N/A

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm webpack is 90.0% likely obfuscated Confidence: 0.90 Location:Package overview From:pnpm-lock.yaml → npm/webpack@5.109.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/webpack@5.109.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report