# Modular Runtime Production Front Door 01

Date: 2026-08-01

Status: direct front-door slice accepted deterministically; autonomous graph intake and live model smoke remain open

## Why this slice exists

Phase 5 comparison evidence proved the modular engine as a library and canary runtime. It did not prove that the installed Nyx process could boot that engine, accept a project, expose durable status, recover pending work, or stop its model processes. The previous terminal audit incorrectly collapsed that missing boundary into “install a selector.” A selector without a target daemon would not be a migration.

## Implemented boundary

| Concern | Implementation | Verified behavior |
|---|---|---|
| Native API | `/vnext/projects`, `/vnext/projects/:id`, `/events`, `/start`, `/status` | exact request validation, Git-root and commit preflight, durable first event before 202, queryable replay |
| Existing CLI compatibility | `POST /core/products`, `GET /core/status`, `GET /core/products/:id` | current CLI response ID preserved; legacy intake maps to the versioned unattended `ProjectRequest` |
| Runtime health | `GET /health` | authority, mode, build SHA, provider route, database, queue, active workspaces, and bounded faults are explicit |
| Safe/full lifecycle | `startModularRuntime` | safe mode never launches work; full mode proves subscription auth before listening and resumes nonterminal durable projects |
| Execution construction | `DirectProjectExecutorFactory` | real Sol/high planner, Luna/xhigh worker, trusted candidate inspector, verifier, and Git integrator share one durable store |
| Cross-project safety | globally unique direct attempt IDs plus workspace-aware project queue | different workspaces may overlap; the same workspace never has two direct implementations active |
| Process ownership | `ProcessFamilyRunner.stopAll` | shutdown reaps every recorded active family, rejects new launches, waits for project promises, releases listener ownership, and closes SQLite |
| Migration selector | `NYX_RUNTIME_AUTHORITY=legacy|modular` | absent value is legacy, modular is explicit, unknown values fail closed, rollback changes one pointer |
| State separation | `modular-builder.sqlite` | legacy and modular SQLite files cannot be silently confused |

## Evidence run on the implementation revision

- modular package: 242 deterministic tests passed across 50 active suites; 20 gated live tests skipped;
- moderator and legacy compatibility boundary: 238 tests passed across 42 suites;
- both package TypeScript builds passed without diagnostics;
- real network boot smoke bound a hardened localhost listener, accepted one native request, queried its durable event, removed the lock and port advertisement, rejected post-shutdown fetch, and reopened SQLite with `integrity_check=ok`;
- compiled self-test passed with the selector explicitly set to `legacy` and explicitly set to `modular`;
- source shape: 74 modular runtime files, average 182 logical lines, maximum 494; the new moderator production adapter is three files totaling 558 lines.

Key deterministic tests:

- `packages/modular-builder-core/test/project-runtime-service.test.ts`
- `packages/modular-builder-core/test/process-runner.test.ts`
- `packages/modular-builder-core/test/direct-controller.test.ts`
- `apps/moderator/src/modular/__tests__/app.test.ts`
- `apps/moderator/src/modular/__tests__/runtime.test.ts`
- `apps/moderator/src/modular/__tests__/boot-smoke.test.ts`
- `apps/moderator/src/__tests__/runtime-authority.test.ts`

## Authority result

Legacy remains the default and actual production authority. No running production process, database, state directory, Cloudflare runtime, or deployment configuration was switched. The selector is transition preparation, not authorization.

## Explicitly not proved

1. No real Sol/Luna task has yet entered through this HTTP boundary. Existing live direct canaries prove the same executor components, but not the assembled daemon/API path.
2. The production executor currently selects the direct factory. It does not yet turn an arbitrary large goal into an initial durable graph and recipe plan.
3. Existing graph, resource, long-build, visual, batching, compaction, and release canaries remain valid component evidence; they are not evidence for a missing general graph intake.
4. No post-switch production smoke or automatic selector rollback has occurred.

## Next accepted slice

Add one typed Sol graph-proposal boundary and a deterministic admission/recipe selector. Reuse the existing event-driven project queue, graph coordinator, resource broker, recipe modules, and integration queue. Do not add a polling scheduler, graph database, workflow DSL, supervisor tree, or second state writer. Then exercise a real direct and graph request through an isolated full-mode front door before any production authority decision.