# Modular Runtime Phase 1 — Live Direct Canary 01

Date: 2026-07-31 (America/Phoenix)

Status: accepted as the original canary; the current Phase 1 gate is 5/5 in `MODULAR_RUNTIME_PHASE1_GATE.md`

## Scope

The canary created a disposable Git repository containing one intentionally failing `node:test` behavior. The durable request allowed repository reads, bounded product writes, and process execution; it forbade operator checkpoints, test changes, dependency changes, deployment, and unrelated work.

The observable outcome was deliberately small: normalize a supplied name, use `friend` for blank input, and make both existing tests pass by changing only `src/greeting.mjs`.

## Executed path

```text
ProjectRequest
  -> real gpt-5.6-sol/high read-only plan
  -> deterministic packet validation
  -> attempt-specific Git worktree
  -> real gpt-5.6-luna/xhigh workspace-write implementation
  -> structured unstaged ready result
  -> trusted one-commit candidate sealing
  -> independent Git-derived candidate inspection
  -> detached integrated command verification
  -> clean authoritative fast-forward
  -> durable project completion
  -> reopened-controller terminal replay
```

Git metadata remained protected from Luna. The worker ran the behavior check and returned changed paths plus hashed evidence; deterministic host code alone staged and committed the exact owned diff.

## Acceptance evidence

Command:

```sh
pnpm --filter @orchestrator/modular-builder-core test:live
```

Result:

```text
1 live suite passed
1 live test passed
end-to-end duration: 207.778 seconds
```

The live test independently asserted:

- Sol used `gpt-5.6-sol` at `high` in a read-only, approval-free, ephemeral run;
- Luna used `gpt-5.6-luna` at `xhigh` in an approval-free, ephemeral `workspace-write` run;
- the packet and worker result passed strict structured-output and runtime contracts;
- the candidate contained exactly one deterministic commit above the pinned base;
- the committed diff contained only the owned source path;
- integrated `node --test` passed against a detached candidate worktree;
- authority advanced only after verification and remained clean;
- the recorded worker process finished with exit zero, no signal, and its process family reaped;
- the event sequence contained no human checkpoint, retry, duplicate candidate, or duplicate integration event;
- reopening the SQLite controller database returned the completed state without invoking Sol, Luna, inspection, or integration again.

## Failures converted into contracts

Pre-acceptance probes found three real boundary defects:

1. Generic JSON Schema features exceeded the provider's strict structured-output subset. The schemas now declare explicit types, require every property, and leave uniqueness enforcement to runtime parsers.
2. The resource-name schema was looser than the kernel parser. The structured schema now enforces the canonical resource grammar.
3. Sol initially assigned Git commit proof to Luna. The planner now validates commands and worker-owned requirements, may revise one rejected packet autonomously, and reserves Git authority for deterministic candidate sealing and integration.

These were not waived. Each defect received a code-owned contract and regression coverage before the accepted rerun.

## Subsequent Phase 1 gate work

The four representative canaries that remained after this original run are now accepted:

1. a bounded multi-file behavior change;
2. a new-file ownership change;
3. a verification failure followed by an autonomous clean retry;
4. a forced live worker interruption followed by durable cleanup and recovery.

The five-canary gate is now satisfied. Graph and resource work is authorized under Phase 2, while lease brokering and parallel execution remain unimplemented until their own slices pass.