[Tracking] Runtime Host M4 Desktop-first client adapters

[M4n5ter]

English

Status

M4 implementation is complete. The closure change is #2419; merging it closes this tracker.

#853 remains authoritative for Runtime Host ownership, lifecycle, protocol semantics, and the atomic M5 production cutover. M4 prepared every existing interactive product surface to operate through typed Runtime Host adapters while preserving one production owner.

Delivery boundary

The Host owns Interactive execution, durable Runtime facts, recovery, schedulers, Runtime Policy, credentials, canonical projections, and Runtime Resources.

Clients own presentation and native surfaces: Electron IPC and windows, terminal rendering and key bindings, Bot transport and conversation mapping, file pickers, notifications, and native capability implementations.

A Host adapter does not open Interactive writer Stores, perform startup recovery, construct an embedded Runtime owner, or maintain a second canonical source of truth. Client Capability providers remain open-world, connection-scoped, explicitly bound, and fail explicitly when their provider disappears.

Completed delivery map

Stage	Status	Delivered boundary
0 — Host-client prerequisites	Complete (#2134, #2140, #2194)	canonical transcript continuity, atomic initial/live observation, connect-or-spawn lifecycle, Host compatibility and epoch checks
1 — Desktop adapter	Complete (#2134, #2140, #2143, #2149, #2164, #2194, #2216)	Electron main Host lifecycle plus Session, Turn, Interaction, context action, Runtime-domain, projection, reconnect, and shutdown adapters
2 — Native capabilities and dependents	Complete (#2178, #2192, #2233, #2254)	generic Desktop Browser/Computer Use providers and a Bot Session contract without Runtime or Store capture
3 — Desktop readiness	Complete (#2194, #2216)	production-shaped Host journeys and a dependency path that cannot reach embedded Interactive owners or writers
4 — CLI/TUI adapters	Complete (#2308, #2337, #1895)	Host-backed TUI, maka run, and kind-bound live inspection with typed cancellation and stable Session semantics
5 — M4 closure	Complete (#2419)	cross-client PTY continuity, real Host Automation execution, finite durable fire failure, owner-neutral presentation contracts, and default-deny production dependency gates

M4 acceptance evidence

• Desktop, TUI, maka run, inspect, and Bot have production-shaped Host adapter coverage.
• Canonical transcript and live Turn continuity are Host-owned and reconnectable across clients.
• A Host-owned PTY survives Desktop disconnect; TUI can acquire control and continue reading, writing, resizing, and stopping it through the real protocol.
• Heartbeat and cron execute once through the production Host root authority. An admitted fire that cannot re-enter Runtime now accumulates durable deferrals and becomes a visible failed Automation after the retry window instead of remaining pending forever.
• Runtime Host TUI, maka run, and live inspect dependency graphs default-deny embedded Runtime owners, writer Stores, Host server/candidate entrypoints, self-imports, hidden dynamic loaders, workspace-package escapes, absolute paths, and executable URL imports.
• Runtime Host adapters contain no embedded fallback and do not activate a second production writer.
• Real OpenRouter Free CLI and tmux/PTY TUI smokes passed against the active XDG home.

Cutover boundary

M4 deliberately does not switch production ownership. Desktop and CLI production entrypoints keep the single embedded owner until M5 performs one atomic switch and deletes the legacy production path. There is no supported state where embedded Runtime and Runtime Host can both become writers.

#2262 is an independent Desktop queue/steering presentation follow-up. It is explicitly deferred and does not block M4 closure or reopen Host authority design.

Verification

• @maka/runtime: 3306 passed, 3 platform skips
• @maka/runtime-host: 738 passed
• CLI: 516 passed
• full repository TypeScript typecheck
• full repository Biome lint and format check
• Windows test inventory current at 68 declarations

Next milestone

M5 is the atomic production migration defined by #853: activate Runtime Host for every interactive surface, remove embedded production ownership and its feature switches, delete dead composition paths, and retain only clean client presentation/native boundaries.

简体中文

状态

M4 实现已经完成，收口变更为 #2419；该 PR 合并后关闭本 tracker。

#853 继续作为 Runtime Host ownership、lifecycle、protocol semantics 与 M5 原子 production cutover 的权威来源。M4 已让所有现有 interactive product surface 具备通过 typed Runtime Host adapter 工作的条件，同时始终保持唯一 production owner。

交付边界

Host 拥有 Interactive execution、durable Runtime fact、恢复、scheduler、Runtime Policy、凭据、canonical projection 与 Runtime Resource。

Client 拥有 presentation 与 native surface：Electron IPC/窗口、终端渲染/快捷键、Bot transport/conversation mapping、文件选择器、通知与 native capability 实现。

Host adapter 不打开 Interactive writer Store、不执行 startup recovery、不构造 embedded Runtime owner，也不维护第二份 canonical source of truth。Client Capability provider 保持开放世界、connection-scoped、显式绑定，并在 provider 消失时明确失败。

已完成交付地图

阶段	状态	已交付边界
0 — Host-client 前置能力	已完成（#2134、#2140、#2194）	canonical transcript continuity、原子 initial/live observation、connect-or-spawn lifecycle、Host compatibility 与 epoch 检查
1 — Desktop adapter	已完成（#2134、#2140、#2143、#2149、#2164、#2194、#2216）	Electron main Host lifecycle，以及 Session、Turn、Interaction、context action、Runtime-domain、projection、重连与 shutdown adapter
2 — Native capability 与依赖方	已完成（#2178、#2192、#2233、#2254）	通用 Desktop Browser/Computer Use provider，以及不捕获 Runtime/Store 的 Bot Session contract
3 — Desktop readiness	已完成（#2194、#2216）	production-shaped Host journey，以及无法到达 embedded Interactive owner/writer 的 dependency path
4 — CLI/TUI adapter	已完成（#2308、#2337、#1895）	Host-backed TUI、maka run 与 kind-bound live inspection，具有 typed cancellation 和稳定 Session semantics
5 — M4 收口	已完成（#2419）	跨 Client PTY continuity、真实 Host Automation execution、有限 durable fire failure、owner-neutral presentation contract 与默认拒绝的 production dependency gate

M4 验收证据

• Desktop、TUI、maka run、inspect 与 Bot 均具有 production-shaped Host adapter 覆盖。
• canonical transcript 与 live Turn continuity 由 Host 持有，并可跨 Client 重连恢复。
• Host-owned PTY 在 Desktop 断开后继续存在；TUI 可通过真实协议取得控制权，并继续读取、输入、resize 与 stop。
• heartbeat 与 cron 通过 production Host root authority 恰好执行一次。admitted fire 无法重新进入 Runtime 时会持久累计 defer，并在 retry window 后成为可见失败，不再永久停留在 pending。
• Runtime Host TUI、maka run 与 live inspect 的依赖图默认拒绝 embedded Runtime owner、writer Store、Host server/candidate 入口、self-import、隐藏 dynamic loader、workspace package 逃逸、绝对路径与可执行 URL import。
• Runtime Host adapter 不包含 embedded fallback，也不会激活第二个 production writer。
• 使用当前 XDG Home 的真实 OpenRouter Free CLI 与 tmux/PTY TUI 冒烟测试已通过。

Cutover 边界

M4 有意不切换 production ownership。Desktop 与 CLI production entrypoint 在 M5 执行唯一一次原子切换并删除 legacy production path 前，继续使用唯一 embedded owner。不存在 embedded Runtime 与 Runtime Host 同时成为 writer 的受支持状态。

#2262 是独立的 Desktop queue/steering presentation follow-up，现明确延后；它不阻塞 M4 收口，也不重新打开 Host authority design。

验证

• @maka/runtime：3306 项通过，3 项平台跳过
• @maka/runtime-host：738 项通过
• CLI：516 项通过
• 全仓 TypeScript typecheck
• 全仓 Biome lint 与 format check
• Windows 测试清单已更新，共 68 条声明

下一阶段

M5 是 #853 定义的原子 production migration：为全部 interactive surface 激活 Runtime Host，移除 embedded production ownership 及其 feature switch，删除死亡 composition path，只保留干净的 Client presentation/native boundary。