Select the execution architecture and reusable components

[Brad-Edwards]

Select how the shared runtime implements the accepted operation lifecycle without rebuilding mature execution machinery unnecessarily.

Acceptance criteria

• Compare applicable workflow/durable-execution, robotics/action, simulation, and actor/event-loop patterns against the operation semantics. Evaluate reusable implementations at the specific seams where they fit.
• Document state and worker ownership, supervision, scheduling, persistence, backend integration, deployment dependencies, and failure isolation. Identify what is reused and what RAE must implement.
• Use bounded technical experiments for uncertain claims about blocked calls, cancellation, crash recovery, and duplicate effects. State the guarantee and limitation of each candidate; retries and persistence do not establish physical interruption.
• Publish one accepted architecture decision and component/interface diagram, with canonical requirement traceability. Neither a robotics stack nor a durable-execution engine is preselected.

Prerequisites: #1348.

References: Research and primary sources, Diagnosis.

Requirements

• API-404 — Secure, Durable, And Idempotent Control-Plane Semantics

[Brad-Edwards]

🛠️ Picked up by /implement - driver codex, branch 1350-execution-architecture, 2026-09-23T04:47:23.550Z.

[Brad-Edwards]

gc workflow phase recorded: preflight (issue #1350). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

[Brad-Edwards]

gc workflow phase recorded: preflight (issue #1350). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

[Brad-Edwards]

gc workflow phase recorded: plan (issue #1350). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

Publish the execution architecture decision for #1350, preserving #1348 and Hub #3 responsibilities.

• AC1 (Path D): finish docs/research/execution-architecture/candidate-comparison.md across durable execution (Temporal, DBOS, task queues), ROS actions, simulation, actors/event loops and behavior trees. Compare complete compositions, free-software licenses, deployment cost and retained RAE work. Cover ordinary CTFs, OT twins, AI security/sandboxes, product testing and mixed IT/OT disaster recovery. Do not mistake the earlier scale scenario for measured capacity.
• AC2 (Path D): add ADR-113 selecting self-hosted Temporal/Python SDK/PostgreSQL for distributed execution and existing library/SQLite machinery for local profiles. Include a component/interface diagram, one semantic writer, explicit engine/ledger reconciliation, invocation authorization, control capacity, federation/partition behavior, timing, upgrade and restore rules. Preserve RAE's semantic admission, scheduling decisions, supervision and settlement; preserve backend product responsibilities. No paid service is required.
• AC3 (retained executable research): preserve the thirteen source-hashed experiment files and original evidence; retain this run's bounded local recheck separately. Existing witness tests and probe assertions exercise real request/effect separation, cancellation, blocked capacity, worker crash, duplicate effects and atomic publication. Their original red/green witness record is retained; no new production behavior or artificial prose tests are introduced.
• AC4 (Path D): register and pin one accepted ADR, link it from the architecture index, replace the pending discussion with a traceability/disposition record, and update API-404 with DOCUMENTS links. API-404 C1-C4 remain ACTIVE with existing IMPLEMENTS/TESTS coverage; no profile, runtime support or P3 guarantee is newly fulfilled. Other referenced requirements and all DRAFT statuses stay unchanged.

Reuse and boundaries: build on RuntimeMutationAuthority, ControlPlaneStore/commit adapter, existing admission/registry/profile checks, backend input/result validation, workflow/time/attempt/cleanup authorities, participant scheduling/reservations and redacted Diagnostic/AuditEvent envelopes. Framework-specific types remain outside portable contracts. Worker credentials and admission must be authenticated across process boundaries; do not serialize planner trust, resolvers or secrets. Cover history/search attributes/heartbeats as disclosure sinks, OS/process isolation and backend-owned containment. Typed configuration and versioned capability seams keep later backends extensible without duplicate scenario interpreters.

Verification: set RAES_REQUIREMENT_UID=API-404. Use targeted file-local repository policy before/after, ADR pin/index and requirement-governance checks, local-link/whitespace validation, existing supervision/profile tests and bounded experiment assertions. The 41 supervision tests and three witness tests already pass; local AnyIO, SimPy, DBOS, Temporal and SQLite probes have completed successfully. Full suites remain CI-only. The retained executable fixtures mean the entire diff is not claimed as a prose-only TDD carve-out. No schema, production dependency, runtime code, version or changelog changes are planned.

After traceability reconciliation, run the required review, publish the PR, monitor hosted checks and record readiness. #1360/#1362 remain the governed protocol/implementation work; this PR delivers the architecture selection and evidence.

Author clarification: the architecture must preserve explicit author choice between never repeating an effect, bounded safe retries (including idempotent effects), and ending the attempt/trial followed by a separately admitted fresh trial. Specify scenario-wide defaults, nested scope defaults and nearest explicit overrides using the existing recursive-scope approach; defaults provide convenience, not authority to bypass safety or broaden an admitted contract. Record resolution provenance and materialize the effective policy before execution. Separate engine redelivery, effect invocation, authored workflow retry and trial allocation. This is an architecture/semantic design obligation; current schemas do not yet expose the general inherited surface, and #1360/#1362 must deliver and verify it before support is claimed.

[Brad-Edwards]

gc workflow phase recorded: plan (issue #1350). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

Publish the execution architecture decision for #1350, preserving #1348 and Hub #3 responsibilities.

• AC1 (Path D): finish docs/research/execution-architecture/candidate-comparison.md across durable execution (Temporal, DBOS, task queues), ROS actions, simulation, actors/event loops and behavior trees. Compare complete compositions, free-software licenses, deployment cost and retained RAE work. Cover ordinary CTFs, OT twins, AI security/sandboxes, product testing and mixed IT/OT disaster recovery. Do not mistake the earlier scale scenario for measured capacity.
• AC2 (Path D): add ADR-113 selecting self-hosted Temporal/Python SDK/PostgreSQL for distributed execution and existing library/SQLite machinery for local profiles. Include a component/interface diagram, one semantic writer, explicit engine/ledger reconciliation, invocation authorization, control capacity, federation/partition behavior, timing, upgrade and restore rules. Preserve RAE's semantic admission, scheduling decisions, supervision and settlement; preserve backend product responsibilities. No paid service is required.
• AC3 (retained executable research): preserve the thirteen source-hashed experiment files and original evidence; retain this run's bounded local recheck separately. Existing witness tests and probe assertions exercise real request/effect separation, cancellation, blocked capacity, worker crash, duplicate effects and atomic publication. Their original red/green witness record is retained; no new production behavior or artificial prose tests are introduced.
• AC4 (Path D): register and pin one accepted ADR, link it from the architecture index, replace the pending discussion with a traceability/disposition record, and update API-404 with DOCUMENTS links. API-404 C1-C4 remain ACTIVE with existing IMPLEMENTS/TESTS coverage; no profile, runtime support or P3 guarantee is newly fulfilled. Other referenced requirements and all DRAFT statuses stay unchanged.

Reuse and boundaries: build on RuntimeMutationAuthority, ControlPlaneStore/commit adapter, existing admission/registry/profile checks, backend input/result validation, workflow/time/attempt/cleanup authorities, participant scheduling/reservations and redacted Diagnostic/AuditEvent envelopes. Framework-specific types remain outside portable contracts. Worker credentials and admission must be authenticated across process boundaries; do not serialize planner trust, resolvers or secrets. Cover history/search attributes/heartbeats as disclosure sinks, OS/process isolation and backend-owned containment. Typed configuration and versioned capability seams keep later backends extensible without duplicate scenario interpreters.

Verification: set RAES_REQUIREMENT_UID=API-404. Use targeted file-local repository policy before/after, ADR pin/index and requirement-governance checks, local-link/whitespace validation, existing supervision/profile tests and bounded experiment assertions. The 41 supervision tests and three witness tests already pass; local AnyIO, SimPy, DBOS, Temporal and SQLite probes have completed successfully. Full suites remain CI-only. The retained executable fixtures mean the entire diff is not claimed as a prose-only TDD carve-out. No schema, production dependency, runtime code, version or changelog changes are planned.

After traceability reconciliation, run the required review, publish the PR, monitor hosted checks and record readiness. #1360/#1362 remain the governed protocol/implementation work; this PR delivers the architecture selection and evidence.

Author clarification: the architecture must preserve explicit author choice between never repeating an effect, bounded safe retries (including idempotent effects), and ending the attempt/trial followed by a separately admitted fresh trial. Specify scenario-wide defaults, nested scope defaults and nearest explicit overrides using the existing recursive-scope approach; defaults provide convenience, not authority to bypass safety or broaden an admitted contract. Record resolution provenance and materialize the effective policy before execution. Separate engine redelivery, effect invocation, authored workflow retry and trial allocation. This is an architecture/semantic design obligation; current schemas do not yet expose the general inherited surface, and #1360/#1362 must deliver and verify it before support is claimed.

Further author clarification: retries are one part of contextual failure-response semantics. Experiment validity, twin state/time fidelity, physical OT safety/continuity and stateful or disposable IT recovery cannot share a blanket handler. The accepted design will specify explicit context policies, per-scope choices, cross-scope compatibility checks, deliberate-fault preservation and evidence/validity consequences, without treating an IT/OT label as sufficient authorization.

[Brad-Edwards]

gc_codex_review — sanitized deferred publication for issue #1350, cycle 1 of 1
Reviewed revision: 3eaf67f1700e1d8567c38d1ebae43e2989805f696079755cfbdd38ec189ffdab

Architectural read

The architecture retains RAE semantic and state authority, separates engine history from operation outcomes, preserves local profiles and contextual author policy, and explicitly leaves P3/distributed conformance unclaimed. Review covered all 29 files; no blocking findings or concrete security regression were identified.

Verdict: ship

Notes

• Improve the Temporal experiment to assert terminal status as well as effect counts. Its outcome collector can absorb a timeout, and zero effects alone does not establish cooperative cancellation. This verification improvement will be fixed with a negative-control regression and a fresh probe run before publishing.

Findings

• (none)

[Brad-Edwards]

gc_codex_review pre-push cycle 1 of 1 complete for issue #1350 on branch '1350-execution-architecture'. Posted by the MCP server to enforce the pre-push hard-cap-1 contract (issues #796, #804, #906). Do not edit or delete — used by the next gc_codex_review (uncommitted) invocation to count cycles.