# Modular Runtime Phase 1 — Direct Golden Loop Gate

Date: 2026-07-31 (America/Phoenix)

Status: accepted; Phase 1 gate progress 5/5

## Gate decision

The direct lane is accepted for the five representative behaviors required by the build goal. Phase 2 graph-and-resource work is now authorized. This does not claim that graph scheduling, leases, parallel projects, product modules, long builds, releases, or Hermes are implemented.

Every accepted canary used a disposable Git repository and the same current runtime source boundary. Sol ran through real `gpt-5.6-sol`/high read-only execution. Luna ran through real `gpt-5.6-luna`/xhigh `workspace-write` execution. The deterministic host alone sealed candidates, inspected Git-derived facts, reran acceptance against detached commits, and fast-forwarded authority.

## Accepted canaries

| Canary | Required proof | Current-revision result |
|---|---|---:|
| 01 | Single-file behavior, clean integration, completed-controller replay | passed in 153.681s |
| 02 | One bounded behavior spanning exactly two owned source files | passed in 187.256s |
| 03 | Exactly one newly owned source file with existing product code untouched | passed in 235.697s |
| 04 | Independent candidate rejection, bounded failure feedback, separate clean retry | passed in 309.255s |
| 05 | Running-process recovery after controller reopen, family reap, no replan, clean retry | passed in 186.528s |

Accepted live execution time: 1,072.417 seconds. Canary 01 ran separately; canaries 02–05 passed together in one 918.96-second Vitest process.

## Shared assertions

All five canaries proved:

- no operator question, approval, or human event;
- a pinned repository base and exact durable request;
- one Sol packet and no full-plan reopen during implementation;
- one primary logical write claim;
- attempt-specific Git worktrees;
- protected Git metadata during Luna execution;
- a schema-valid unstaged worker result with hashed command evidence;
- trusted one-commit sealing of only the owned product paths;
- independent Git-derived candidate inspection;
- detached acceptance-command replay before authority moved;
- one clean fast-forward on the authoritative repository;
- terminal process-family ownership and no orphaned worker;
- a clean authoritative worktree after completion.

## Retry and recovery proof

Canary 04 deliberately changed the first independent inspection fact to `clean=false` only after Luna had returned and the host had sealed a real candidate. The controller recorded `candidate_rejected`, scheduled exactly one retry, passed that bounded failure record to Luna, and prepared attempt 02 from the pinned base in a different empty worktree. Attempt 02 passed and was the only candidate integrated.

Canary 05 durably recorded a real Luna process against attempt 01 and then resumed through a newly opened `ProjectStore` and controller. The reopened controller did not call Sol. It reaped every recorded process group, recorded attempt 01 as `reaped`, rejected the interrupted transport, scheduled attempt 02, and completed in a separate worktree. Attempt 02 ended `finished` with exit zero, no signal, and `processTreeReaped=true`.

## Defect converted into a contract

A current-revision canary 01 pre-acceptance run stopped before Luna because both bounded Sol packet attempts violated the exactly-one-write-claim rule. Nothing was waived. The planning prompt now states that `exclusive` never substitutes for product-write ownership, and deterministic correction feedback reports the actual write-claim count. A focused regression test covers the zero-write correction path; the accepted canary rerun then passed.

The host also now derives the one-or-two-attempt ceiling from durable budgets. Two attempts are permitted only when the request funds at least four total model calls and at least two declared worker windows plus a 20-minute planning reserve. A clean retry receives prior failure records as bounded repair evidence; it never inherits rejected edits.

## Deterministic evidence

```text
18 fast suites passed; 1 live suite gated
96 fast tests passed; 5 live tests gated
TypeScript passed
27 runtime source files
average 137 logical lines
maximum 459 logical lines
no runtime source file above 500 logical lines
```

Current live commands:

```sh
RUN_LIVE_CODEX=1 pnpm --filter @orchestrator/modular-builder-core exec vitest run test/live-direct-canary.test.ts -t "canary 01" --reporter=verbose
RUN_LIVE_CODEX=1 pnpm --filter @orchestrator/modular-builder-core exec vitest run test/live-direct-canary.test.ts -t "canary 0[2-5]" --reporter=verbose
```

## Next authorized slice

Phase 2 begins with a persisted WorkGraph value layer: node and edge contracts, cycle rejection, deterministic ready-node calculation, and affected-node invalidation. Resource leasing and concurrent execution remain out of that first slice and must be added only after the graph state transitions pass focused tests.