release(main): promote accepted Run 95 Stage candidate

.github/workflows/build-binaries.yml

@@ -327,8 +327,9 @@ jobs:
             exit 1
           fi
           git fetch --no-tags origin "+refs/heads/${REQUIRED_PRIVATE_BRANCH}:refs/remotes/origin/${REQUIRED_PRIVATE_BRANCH}"
-          if ! git merge-base --is-ancestor "$RELEASE_PRIVATE_SHA" "origin/$REQUIRED_PRIVATE_BRANCH"; then
-            echo "Private revision must be promoted through role-model-internal/$REQUIRED_PRIVATE_BRANCH before $ROLE_MODEL_BUILD_CHANNEL packaging."
+          required_private_head="$(git rev-parse "origin/$REQUIRED_PRIVATE_BRANCH")"
+          if [[ "$RELEASE_PRIVATE_SHA" != "$required_private_head" ]]; then
+            echo "Paired private revision must equal the current role-model-internal/$REQUIRED_PRIVATE_BRANCH head before $ROLE_MODEL_BUILD_CHANNEL packaging."
             exit 1
           fi
 

role-model-router/apps/runtime-host-bridge/src/cli.ts

@@ -1012,10 +1012,9 @@ export async function main(): Promise<void> {
     // available at runtime.
     const currentPostObservationOperations = (): ReturnType<typeof createTrackBOperations> | null =>
       postObservationOperations;
-    const drainPostObservationOutbox = async (
-      runtime: Awaited<ReturnType<typeof createProductionExtensionRuntime>>,
-    ) =>
-      postObservationOutbox.drain((observation) => {
+    const postObservationHandler =
+      (runtime: Awaited<ReturnType<typeof createProductionExtensionRuntime>>) =>
+      (observation: Parameters<typeof runTrackBPostObservation>[1]) => {
         const processingInput = {
           scope: options.scopeId,
           channel: packagedProfile?.channel ?? "development",
@@ -1036,7 +1035,10 @@ export async function main(): Promise<void> {
               (aggregate) => operations.recordContributionAggregate(aggregate),
             )
           : runTrackBPostObservation(runtime, observation, processingInput);
-      });
+      };
+    const drainPostObservationOutbox = async (
+      runtime: Awaited<ReturnType<typeof createProductionExtensionRuntime>>,
+    ) => postObservationOutbox.drain(postObservationHandler(runtime));
     const createBackend = async (
       trackBOperationsEndpoint?: string,
       trackBOperationsToken?: string,
@@ -1097,14 +1099,17 @@ export async function main(): Promise<void> {
         readTrackBExtensionReadback: async (body) => {
           const requestId = String(body.requestId ?? "").trim();
           if (!requestId) throw new Error("Track B extension readback requestId is required");
-          const receipt = await postObservationOutbox.readReceipt(requestId);
+          const runtime = extensionRuntimeRef.current;
+          if (!runtime) throw new Error("Track B extension runtime is unavailable");
+          const receipt = await postObservationOutbox.drainUntilReceipt(
+            requestId,
+            postObservationHandler(runtime),
+          );
           if (!receipt) throw new Error(`Track B observation receipt not found: ${requestId}`);
           const result = receipt.result as Record<string, unknown>;
           const closure = result.extensionClosure as TrackBExtensionClosure | undefined;
           if (!closure)
             throw new Error(`Track B observation has no extension closure: ${requestId}`);
-          const runtime = extensionRuntimeRef.current;
-          if (!runtime) throw new Error("Track B extension runtime is unavailable");
           return verifyTrackBExtensionClosureAfterRestart(runtime, closure, {
             channel: packagedProfile?.channel ?? "development",
             scope: options.scopeId,

role-model-router/apps/runtime-host-bridge/src/index.ts

@@ -24070,6 +24070,7 @@ export async function createRuntimeBridgeBackend(
         | { readonly scopeId: string; readonly artifactId: string; readonly contentHash: string }
         | undefined;
       let routeCapture: Record<string, unknown> | undefined;
+      let routeCaptureDegradationReason: string | undefined;
       try {
         if (localGraphStore) {
           const content = JSON.stringify(bundle);
@@ -24116,10 +24117,25 @@ export async function createRuntimeBridgeBackend(
             };
           }
         }
-      } catch {
+      } catch (error) {
         // Capture remains non-routing-critical before graph-primary cutover.
         // Run 94 (SP2): without a graph artifact reference the SQLite row must still be
         // bounded — persist the compact degradation stub instead of the full bundle.
+        // Keep the operator receipt actionable without copying a private-boundary
+        // message, which may include untrusted capture content.
+        const status =
+          error &&
+          typeof error === "object" &&
+          "status" in error &&
+          typeof error.status === "number" &&
+          Number.isInteger(error.status)
+            ? error.status
+            : undefined;
+        routeCaptureDegradationReason =
+          status && status >= 100 && status <= 599
+            ? `track-b-capture-boundary-http-${status}`
+            : "track-b-capture-boundary-unavailable";
+        console.error("Track B route capture failed", routeCaptureDegradationReason);
       }
       const graphEvidence = routeCapture
         ? {
@@ -24160,9 +24176,11 @@ export async function createRuntimeBridgeBackend(
           schemaVersion: "role-model.degradation-receipt.v1",
           degraded: true,
           capability: "runtime-observation-persist",
-          reason: String(
-            error instanceof Error ? error.message : "runtime observation persist failed",
-          ).slice(0, 256),
+          reason:
+            routeCaptureDegradationReason ??
+            String(
+              error instanceof Error ? error.message : "runtime observation persist failed",
+            ).slice(0, 256),
           routingContinues: true,
           atMs: Date.now(),
         };
@@ -29191,10 +29209,6 @@ export function resolveBridgeServerOptions(input: {
   const packagedProfile = readPackagedRuntimeProfile(input.executablePath);
   const profile = packagedProfile ?? resolveRuntimeChannelProfile("production");
   const statePath = resolveBridgePathApi([input.localAppData], process.env.LOCALAPPDATA);
-  const runtimeStatePath = resolveBridgePathApi(
-    [input.runtimeStateRoot, input.localAppData],
-    process.env.LOCALAPPDATA,
-  );
   const inferredRepoRoot = input.executablePath
     ? (() => {
         const executableDir = repoPath.dirname(repoPath.resolve(input.executablePath));
@@ -29226,6 +29240,13 @@ export function resolveBridgeServerOptions(input: {
     statePath.join(os.homedir(), ".local", "state");
   const runtimeStateRoot =
     input.runtimeStateRoot?.trim() || statePath.join(platformStateBase, profile.state_root_name);
+  const explicitUnifiedRuntimeConfigPath = input.unifiedRuntimeConfigPath?.trim();
+  const stateRootUnifiedRuntimeConfigPath = statePath.join(runtimeStateRoot, "runtime-config.yaml");
+  const legacyUnifiedRuntimeConfigPath = statePath.join(
+    runtimeStateRoot,
+    "state",
+    "runtime-config.yaml",
+  );
 
   return {
     host: input.host?.trim() || profile.host,
@@ -29240,7 +29261,9 @@ export function resolveBridgeServerOptions(input: {
       preferRepoRootBuild: Boolean(input.repoRoot?.trim()) || Boolean(packagedProfile),
     }),
     unifiedRuntimeConfigPath:
-      input.unifiedRuntimeConfigPath?.trim() ||
-      runtimeStatePath.join(runtimeStateRoot, "state", "runtime-config.yaml"),
+      explicitUnifiedRuntimeConfigPath ||
+      (existsSync(stateRootUnifiedRuntimeConfigPath)
+        ? stateRootUnifiedRuntimeConfigPath
+        : legacyUnifiedRuntimeConfigPath),
   };
 }

role-model-router/apps/runtime-host-bridge/src/track-b-operations.ts

@@ -661,21 +661,37 @@ const privateRetentionRequest = async (
   token: string | undefined,
   route: string,
   init: { readonly method?: string; readonly body?: Record<string, unknown> } = {},
+  // Route captures may perform bounded durable CAS and SQLite commits after the
+  // provider response. Five seconds aborts healthy local captures on mature
+  // runtimes; retain a finite budget while allowing that proven completion path.
+  timeoutMs = 8_000,
 ): Promise<unknown | null> => {
   if (!endpoint) return null;
   if (!token || token.trim().length < 24) {
     throw new Error(
       "Track B private operations boundary requires a launcher-issued authentication token",
     );
   }
-  const response = await fetch(new URL(route, endpoint.endsWith("/") ? endpoint : `${endpoint}/`), {
-    method: init.method ?? "GET",
-    headers: {
-      ...(init.body ? { "content-type": "application/json" } : {}),
-      authorization: `Bearer ${token}`,
-    },
-    ...(init.body ? { body: JSON.stringify(init.body) } : {}),
-  });
+  let response: Response;
+  try {
+    response = await fetch(new URL(route, endpoint.endsWith("/") ? endpoint : `${endpoint}/`), {
+      method: init.method ?? "GET",
+      headers: {
+        ...(init.body ? { "content-type": "application/json" } : {}),
+        authorization: `Bearer ${token}`,
+      },
+      ...(init.body ? { body: JSON.stringify(init.body) } : {}),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (error) {
+    if (error instanceof Error && error.name === "TimeoutError") {
+      throw new TrackBPrivateOperationError(
+        504,
+        `private Track B operation timed out after ${timeoutMs}ms`,
+      );
+    }
+    throw error;
+  }
   const result = (await response.json().catch(() => ({}))) as { readonly error?: unknown };
   if (!response.ok)
     throw new TrackBPrivateOperationError(
@@ -1060,13 +1076,16 @@ export function createTrackBOperations({
   runtimeChannel = "development",
   operationsEndpoint = process.env.ROLE_MODEL_TRACK_B_OPERATIONS_URL?.trim(),
   operationsToken = process.env.ROLE_MODEL_TRACK_B_OPERATIONS_TOKEN,
+  operationsTimeoutMs = 8_000,
   extensionRuntime,
 }: {
   readonly statePath: string;
   readonly catalog: readonly Record<string, unknown>[];
   readonly runtimeChannel?: "development" | "stage" | "production";
   readonly operationsEndpoint?: string;
   readonly operationsToken?: string;
+  /** Bounds a private sidecar operation so a dashboard request cannot wait forever. */
+  readonly operationsTimeoutMs?: number;
   readonly extensionRuntime?: {
     listExtensions(): readonly unknown[] | Promise<readonly unknown[]>;
     mutateExtension(input: Record<string, unknown>): unknown | Promise<unknown>;
@@ -1075,7 +1094,8 @@ export function createTrackBOperations({
   const requestPrivate = (
     route: string,
     init?: { readonly method?: string; readonly body?: Record<string, unknown> },
-  ) => privateRetentionRequest(operationsEndpoint, operationsToken, route, init);
+  ) =>
+    privateRetentionRequest(operationsEndpoint, operationsToken, route, init, operationsTimeoutMs);
   return {
     async readGraphMigration(): Promise<unknown> {
       const remote = await requestPrivate("graph-migration");

role-model-router/apps/runtime-host-bridge/src/track-b-runtime.ts

@@ -1792,6 +1792,15 @@ export function createTrackBPostObservationOutbox({
         }
       });
     },
+    async drainUntilReceipt(
+      requestId: string,
+      handler: (observation: TrackBPostObservationWorkItem) => Promise<unknown>,
+    ): Promise<TrackBPostObservationReceipt | null> {
+      const existing = await this.readReceipt(requestId);
+      if (existing) return existing;
+      await this.drain(handler);
+      return this.readReceipt(requestId);
+    },
     async read(): Promise<{
       readonly pendingCount: number;
       readonly receiptCount: number;

role-model-router/apps/runtime-host-bridge/test/index.test.ts

@@ -23616,10 +23616,37 @@ describe("runtime-host-bridge", () => {
       runtimeStateRoot: "C:\\runtime-state",
       scopeId: "standalone-runtime",
       staticRoot: path.join(repoRoot, "role-model-router", "apps", "runtime-ui", "build", "client"),
-      unifiedRuntimeConfigPath: "C:\\runtime-state\\state\\runtime-config.yaml",
+      unifiedRuntimeConfigPath: path.join("C:\\runtime-state", "state", "runtime-config.yaml"),
     });
   });
 
+  test("prefers an existing state-root runtime config when a packaged launch omits the flag", async () => {
+    const runtimeStateRoot = await mkdtemp(
+      path.join(os.tmpdir(), "role-model-runtime-config-default-"),
+    );
+    try {
+      await writeFile(
+        path.join(runtimeStateRoot, "runtime-config.yaml"),
+        'version: "1.0"\n',
+        "utf8",
+      );
+      const result = (
+        bridge as {
+          resolveBridgeServerOptions: (value: {
+            repoRoot?: string;
+            runtimeStateRoot?: string;
+          }) => { unifiedRuntimeConfigPath: string };
+        }
+      ).resolveBridgeServerOptions({ repoRoot, runtimeStateRoot });
+
+      expect(result.unifiedRuntimeConfigPath).toBe(
+        path.join(runtimeStateRoot, "runtime-config.yaml"),
+      );
+    } finally {
+      await rm(runtimeStateRoot, { recursive: true, force: true });
+    }
+  });
+
   test("keeps repoRoot-derived static paths stable when runtimeStateRoot uses a different path dialect", () => {
     const result = (
       bridge as {
@@ -23654,7 +23681,7 @@ describe("runtime-host-bridge", () => {
       scopeId: "standalone-runtime",
       staticRoot:
         "/home/runner/work/role-model/role-model/role-model-router/apps/runtime-ui/build/client",
-      unifiedRuntimeConfigPath: "C:\\runtime-state\\state\\runtime-config.yaml",
+      unifiedRuntimeConfigPath: path.join("C:\\runtime-state", "state", "runtime-config.yaml"),
     });
   });
 

role-model-router/apps/runtime-host-bridge/test/run94-sp5-sp10.test.ts

@@ -76,6 +76,39 @@ test("GREEN: post-observation outbox is a normalized SQLite authority with bound
   afterDrain.close();
 });
 
+test("GREEN: a readback-driven retry drains a transiently failed pending observation without another routed request", async () => {
+  const root = await import("node:fs/promises").then(({ mkdtemp }) =>
+    mkdtemp(path.join(os.tmpdir(), "run95-readback-retry-")),
+  );
+  roots.push(root);
+  const outbox = createTrackBPostObservationOutbox({
+    filePath: path.join(root, "post-observation-outbox.sqlite"),
+    maxItems: 8,
+  });
+  await outbox.enqueue(identity("retry-without-next-route"));
+  await expect(
+    outbox.drain(async () => {
+      throw new Error("temporary private operation timeout");
+    }),
+  ).rejects.toThrow(/temporary private operation timeout/);
+  expect(await outbox.read()).toMatchObject({ pendingCount: 1, receiptCount: 0 });
+
+  const recovered = await (
+    outbox as unknown as {
+      drainUntilReceipt(
+        requestId: string,
+        handler: (item: Record<string, unknown>) => Promise<unknown>,
+      ): Promise<{ requestId: string } | null>;
+    }
+  ).drainUntilReceipt("retry-without-next-route", async (item) => ({
+    status: "recovered",
+    extensionClosure: { requestId: item.requestId },
+  }));
+
+  expect(recovered).toMatchObject({ requestId: "retry-without-next-route" });
+  expect(await outbox.read()).toMatchObject({ pendingCount: 0, receiptCount: 1 });
+});
+
 test("GREEN: imports N-1 JSON once, classifies every legacy row, and quarantines malformed rows", async () => {
   const root = await import("node:fs/promises").then(({ mkdtemp }) =>
     mkdtemp(path.join(os.tmpdir(), "run94-sp5-legacy-")),