Slice 7 — Wedge tracer: assign Issue to Agent → fake-but-real PR appears

[safayavatsal]

What to build

This is the tracer bullet for the entire wedge. Validate that web → platform-api → EventBus → agent-orchestrator → SandboxProvider → platform-api → PR works end-to-end, with the Agent itself stubbed: instead of calling a real model, the orchestrator runs a hardcoded "edit" (e.g., append a line to README.md) and opens a PR.

The point is to flush every seam from ADR-0007 with code, before slice 8 introduces real model calls. If the seams break, the bug is on the platform, not in the prompt.

This slice is HITL — the Run state machine, event schemas, and cross-service contracts are designed here and will be inherited by every slice after.

• Web UI: on an Issue detail page, an "Assign to Agent" button. After clicking, the Issue shows a Run badge ("queued" → "running" → "succeeded" → links to the PR).
• platform-api: POST /issues/:id/assign-agent creates a Run row in agent.runs, publishes run.requested. Endpoint to fetch Run status: GET /runs/:id.
• agent-orchestrator: consumes run.requested, transitions through RunStateMachine (queued → running → succeeded|failed|cancelled), acquires a Sandbox via SandboxProvider (E2B at MVP per ADR-0005), runs the stub edit, calls platform-api to create a branch and open a PR, transitions to succeeded.
• RunStateMachine is implemented as a pure module (no I/O) and unit tested independently.
• SandboxProvider interface and an E2B-backed implementation land in this slice.
• The orchestrator authenticates to platform-api using a service-to-service JWT.

Decisions to nail in this slice

• Run event schema (versioned).
• The Run-to-PR back-reference (PR carries created_by_run_id).
• Cancellation semantics (cooperative: cancel request → orchestrator releases sandbox at next checkpoint).
• Sandbox acquisition timeout and failure handling.

Acceptance criteria

• Clicking "Assign to Agent" creates a Run and the badge updates from queued → running → succeeded within the expected time bounds for the stub.
• The succeeded Run links to a real PR opened against the Repository.
• The PR's commit was actually authored by the orchestrator (the README change is present after merge).
• Cancelling a running Run releases the Sandbox and transitions the Run to cancelled cleanly.
• RunStateMachine has unit tests covering happy path, mid-Run cancel, sandbox-acquire failure, and unknown event handling — no I/O involved.
• An in-memory SandboxProvider fake exists and is used by tests.
• If the orchestrator crashes mid-Run, the Run is observable as failed (not stuck in running) within a bounded time.

Blocked by

• Slice 5 — User can open a PR from a branch and merge it from the web UI #5
• Slice 6 — User can create, list, and view Issues on a Repository #6