FE-1166: Add executor run policy

[kostandinang]

Why

Greenfield executor runs must not inherit the host repo, host package.json, or host git history by default.

This PR also fixes the failure mode caught by run-mrbs97w9: an empty_dir worktree nested under Brunch could still let npm test walk up to the host package and promotion/preflight resolve against the host git root.

What

• Adds substrate: "empty_dir" for isolated greenfield run directories.
• Adds bounded verifyProfile support, currently including npm_test.
• Preserves run environment policy across superseding replan runs.
• Initializes empty_dir worktrees as isolated git repos with an empty base commit.
• Runs npm verification with npm --prefix <worktreeDir> ....
• Makes run-local promotion and host-promotion preflight/apply fail closed unless the git root is exactly the run worktree.
• Uses an explicit git identity for run-local promotion commits.

How To Test

• npx vitest run src/executor/__tests__/worktree.test.ts src/app/__tests__/test-runner-port.test.ts src/app/__tests__/git-land-port.test.ts src/app/__tests__/git-host-promotion-port.test.ts src/executor/__tests__/promotion.test.ts src/executor/__tests__/host-promotion.test.ts src/executor/__tests__/orchestrate.test.ts src/.pi/extensions/__tests__/registry.test.ts
• npm test

TUI smoke path:

• Reach execute_launch: ready.
• Run execute_run_create { runId: "run-empty-1", substrate: "empty_dir", verifyProfile: "npm_test" }.
• Run execute_orchestrate { runId: "run-empty-1" }.
• Expect worktree creation to use an isolated empty-dir git repo, not git_worktree_add against the host.
• Expect verify stream to say npm test started, but execute via npm --prefix <run worktree> test.
• Expect promotion/preflight to fail closed if git resolves to the host repo instead of the run worktree.

[kostandinang]

• FE-1141: Add readable run evidence and graph traceability #303
• FE-1166: Add executor run policy #302 👈 (View in Graphite)
• FE-1114: Add executor replanning guards #300
• next

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

PR Summary

Medium Risk
Changes executor worktree creation, verify invocation, and promotion/preflight git checks—areas where mistakes could touch the host repo or run wrong tests; defaults preserve brownfield behavior and tests assert fail-closed isolation.

Overview
Greenfield executor runs can now declare run environment policy separately from source-copy: substrate: "empty_dir" plus optional verifyProfile (e.g. npm_test) are persisted in run.json via execute_run_create, forwarded through superseding replan runs, and documented for Execute-mode agents.

Worktree creation branches on substrate: default git_worktree is unchanged; empty_dir skips GitWorktreePort, clears/repairs stale paths, and initializes an isolated git repo with an empty base commit so promotion still has a local history without checking out Brunch.

Verification reads verifyTarget from run metadata into ingestTestResult; createTestRunnerPort honors run overrides and runs npm with --prefix <worktreeDir> so nested worktrees cannot walk up to the host package.json.

Safety on git boundaries: createGitLandPort and createGitHostPromotionPort require the worktree’s git root to canonical-match the run directory (fail closed if resolution points at the host); run-local commits use an explicit brunch git identity. Topology, PLAN, and a scoped card capture the frontier; focused tests cover substrate, verify, and isolation. The web runs UI drops replan metadata rows (supersedes / abandon reason) from list and detail.

^{Reviewed by Cursor Bugbot for commit e300f58. Bugbot is set up for automated code reviews on this repo. Configure here.}

[lunelson]

This is the right direction for isolating greenfield runs, and I like that the default path remains compatible.

One boundary concern before this lands: src/executor/worktree.ts now shells out to git init / git commit directly for the empty_dir substrate, while src/executor/TOPOLOGY.md still says executor core does not own subprocess/git effects and that real capabilities enter through app-layer ports. That changes the executor/app port boundary in a way future slices will likely copy.

Can we either move this run-local git initialization behind an injected port, or update the topology/decision to explicitly name this as the allowed exception and why it is not part of the app-layer git capability surface?

[kostandinang]

Fixed: removed the web run-policy/replanning metadata from the FE-1166 sidecar surface. Focused run route tests pass.

[graphite-app]

Merge activity

• Jul 8, 1:28 PM UTC: Graphite rebased this pull request, because this pull request is set to merge when ready.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e300f58. Configure here.}

[cursor]

Empty dir idempotency stalls orchestration

Medium Severity

For substrate: "empty_dir", when run.json still has status: "created" but already records a valid isolated worktreeDir, createWorktree returns already_created without advancing metadata to worktree_created. drive() treats unchanged runStatus as a halt on worktree_create, so re-orchestration after resetting only status (while keeping worktreeDir) wedges the run.

 

^{Reviewed by Cursor Bugbot for commit e300f58. Configure here.}