# Modular Runtime — Terminal Completion Audit

Date: 2026-08-01

Status: partial; library and canary gates pass, the direct production front door and inactive selector now pass, but autonomous goal-to-graph production execution and the authority transition remain open

## Requirement-by-requirement result

| Terminal condition | Authoritative evidence | Result |
|---|---|---|
| Direct lane passes its canaries | Phase 1 five-canary gate plus the Phase 5 matched direct comparison | proved |
| Graph dependency, conflict, concurrency, and recovery pass | Phase 2 gate, Phase 4 batch/reopen canaries, and combined system gate | proved |
| Six initial recipes are implemented or explicitly removed | Recipe contracts and gate matrix below | proved |
| Real UI vertical slice satisfies the product-design standard | Phase 3 cooperative and competitive running-product captures and fresh Sol reviews | proved |
| Long build resumes across interruption | Phase 4 long-build, automatic-batch, and combined system canaries | proved |
| Architecture/control-plane site reflects tested reality | Static contract plus local and production desktop/mobile browser verification | proved |
| Cloudflare points to the exact tested build | Canonical and immutable bytes match the local `dist` for page, scripts, graph data, goal, gate, and raw comparison evidence | proved |
| Mechanism inventory demonstrates material reduction | Phase 0 baseline plus current source inventory below | proved |
| No critical outcome depends on Hermes | All accepted canaries use direct controller/queryable SQLite evidence; Hermes remains absent | proved |
| Production front door accepts, queries, reopens, and stops direct work | Native and CLI-compatible APIs, real network boot smoke, safe/full reopen, cross-project identities, workspace serialization, and shutdown tests | proved deterministically; live model smoke still pending |
| One accepted goal can select and execute direct or graph work through that front door | The default production executor constructs the real direct lane; no general Sol goal-to-graph planner/recipe selector is connected to the API yet | **remaining** |
| One atomic runtime selector defaults to legacy and rolls back without call-site edits | `runtime-authority.ts`, entrypoint self-tests, and four selector tests | proved; deliberately inactive |
| Legacy switches only after comparative and production-entry evidence | Comparative evidence exists, but graph-entry smoke, transition authorization, and the switch itself remain absent | **remaining** |

The goal must remain active. Passing comparison evidence is not equivalent to changing production authority.

## Six-recipe disposition

| Recipe | Implementation | Live or integrated evidence | Result |
|---|---|---|---|
| `direct_fix` | `DirectController` | Phase 1 and matched direct shadow | retained and justified |
| `backend_feature` | `BackendFeatureModule` | Phase 3 backend canary and Phase 4 core nodes | retained and justified |
| `ui_change` | `UiChangeModule` / `UiModule` | accepted Helios caregiver UI states | retained and justified |
| `ui_foundation` | `UiFoundationModule` / competitive foundation module | two real candidates, serialized Chrome, fresh Sol selection | retained and justified |
| `long_build` | `LongBuildModule` | two horizons, batching, compaction, cache, and reopen | retained and justified |
| `release` | `ReleaseModule` | exact frozen-commit release, rollback, and receipt replay | retained and justified |

No seventh recipe, graph database, distributed scheduler, workflow DSL, nested supervisor, per-module lifecycle authority, or parallel integration queue was added.

## Mechanism reduction

The Phase 0 inventory measured the historic baseline at 85,603 reachable executable runtime lines, 496 runtime files, 43 interval loops, 94 process-launch sites, 308 SQL mutation statements, and more than 80 persistent-writer files. The already-reduced legacy Core still measured 18,655 reachable executable lines and retained separate stage, dispatch, reconciliation, and model-owned integration mechanisms.

The current modular package has 74 runtime files averaging 182 logical lines, with a 494-line maximum and no local import cycle. A consistent current-worktree nonblank-source count separates it as follows:

- authority-bearing kernel—graph, resources, runtime, store, integration, acceptance, cache, comparison, and public entry point: 5,816 lines;
- typed contracts: 2,295 lines;
- six recipe/module implementations: 2,150 lines;
- provider/platform adapters: 3,216 lines;
- complete modular runtime package: 13,477 lines.

The moderator-side HTTP, Git-preflight, and process-lifecycle adapter adds 558 source lines in three files; the atomic selector is a separate 25-line migration boundary. These are reported rather than hidden inside the adapter category.

The authority-bearing control plane is therefore inside the declared 3,000–6,000-line kernel target and is 68.8% smaller than the already-reduced 18,655-line Core runtime. Even the complete package including all schemas, recipes, and adapters is 27.8% smaller than that reduced Core and 84.3% smaller than the historic 85,603-line baseline. More importantly, it replaces multiple writers and loops with one SQLite authority, one controller path, one resource broker, one retry owner, and one integration queue.

These categories are reported separately so contracts and recipe logic cannot be hidden by calling them adapters.

## Named canary coverage

The initial verification list is covered by accepted evidence for contained fixes, backend work, UI change, competitive visual foundation, two simultaneous projects, overlapping-writer serialization, worker termination/restart, long-build resume, and frozen-commit release.

The browser-shell milestone is deliberately deferred, not claimed. Phase 0 already delayed a custom BrowserHarness until a proven product consumer exists, and the operator clarified that a web browser was an example of the intended horizon rather than the first product to build. Current trusted Chrome capture proves serialized running-product verification, not URL tabs or browser-session persistence. A real browser-product request must reinstate that canary before browser-specific capability is claimed.

## Production-front-door correction

The earlier audit incorrectly described an authority selector as the only remaining implementation. Direct inspection showed that the modular engine was a tested library with no daemon/API equivalent to legacy `startCoreRuntime`. That claim is withdrawn.

The current revision adds the smallest useful production boundary:

- `GET /health`, native `/vnext` submit/query/event routes, and CLI-compatible `POST /core/products`, `GET /core/status`, and `GET /core/products/:id`;
- exact Git-root/base-commit preflight before HTTP acceptance;
- one durable event before HTTP 202, idempotent replay, safe-mode intake, full-mode automatic reopen, bounded workspace-aware dispatch, structured faults, and clean process-family shutdown;
- globally unique direct attempt identities across projects;
- one `NYX_RUNTIME_AUTHORITY=legacy|modular` selector that defaults to legacy and rejects unknown values;
- separate modular SQLite state and compiled self-tests for both authority values.

This front door currently constructs `DirectProjectExecutorFactory`. The graph modules remain real and accepted through their canaries, but the production request path cannot yet ask Sol to create the initial durable graph and select/execute its recipe modules from an arbitrary goal. A static or test-authored graph is not a substitute for that missing production intake.

Evidence: [`MODULAR_RUNTIME_PRODUCTION_FRONT_DOOR_01.md`](./MODULAR_RUNTIME_PRODUCTION_FRONT_DOOR_01.md).

## Current verified regression

- 242 modular-package deterministic tests passed across 50 active suites;
- 238 moderator/legacy-boundary tests passed across 42 suites;
- 20 gated live tests skipped in the deterministic lane;
- TypeScript passed without diagnostics;
- runtime source shape and dependency-cycle checks passed;
- site source shape and static artifact/link checks passed;
- `git diff --check` passed;
- direct, complex, release, aggregate-evidence, desktop, mobile, canonical, and immutable checks are recorded in their Phase 5 audits and deployment output.

## Remaining completion contract

The remaining work has two ordered parts; switching first would point complex requests at an incomplete production path:

1. implement one bounded Sol goal-to-graph proposal contract and deterministic lane/recipe admission;
2. connect the existing graph coordinator, resource broker, recipe modules, integration path, and resumable horizons behind the production API without another scheduler;
3. run one real direct model task and one real graph model task through the isolated modular front door, including restart recovery;
4. freeze the current legacy authority and record its exact rollback target;
5. switch only the atomic selector to modular under explicit transition authority;
6. repeat the direct and graph smoke tasks through the normal production entry point and roll back automatically if either fails;
7. retain legacy source and evidence read-only; delete nothing;
8. only then mark Phase 5 and the replacement goal complete.

The selector is installed but remains at its default legacy value. No production authority, daemon, database, deployment, or legacy lifecycle was changed. Permanent naming remains an operator product decision but does not prevent technical completion. Hermes remains future scope and is not a completion dependency.