feat(orchestration): renderer→main run/taskCreate preload binding (#15)

[zaridan]

What

Exposes the already-registered orchestration.run and orchestration.taskCreate RPC methods to the renderer through a new window.api.orchestration preload binding. Today these are CLI-only (the sole caller is src/cli/handlers/orchestration.ts) and there is no window.api.orchestration binding — this is F4 (#15), the plumbing that lets a recipe director (and any renderer-side trigger) start a coordinator run or create a task from the app.

How

• Shared contract — new src/shared/orchestration-binding.ts defines the renderer-facing param/return types (OrchestrationRunParams/Result, OrchestrationTaskCreateParams/Result, OrchestrationTask) plus the RPC method-name constants. It mirrors the RPC shapes — including F1's worktree/target-key handling and slice-1's worktreeBacked/workerAgent options — and passes them through verbatim (the semantics live in the main handler). Lives in shared so preload, renderer, and any future client share one contract without importing main internals across the layer boundary.
• Type surface — orchestration: OrchestrationPreloadApi added to PreloadApi in src/preload/api-types.ts.
• Desktop preload (src/preload/index.ts) — orchestration methods are runtime RPC methods (not dedicated IPC channels), so the binding forwards through the existing runtime:call envelope and unwraps it. No new main-process handler.
• Web preload (src/renderer/src/web/web-preload-api.ts) — reuses callRuntimeResult, the same unwrap path every other runtime-backed namespace uses.

Routing through runtime.call means the binding is SSH/remote-safe (the renderer talks to main/host over the same channel for local and paired runtimes alike).

Scope / safety

• Additive only — no existing behavior changes; nothing in the UI calls it yet (that's the recipe backend, RecipeDirectorBackend: compile recipe -> task DAG -> orchestration.run, no LLM in worktree #9).
• Pure plumbing with no UI affordance, so no experimentalOrchestrators gate is needed.
• Stays in its lane — does not touch coordinator.ts or the orchestration DB (F2 slice 2 owns those). .ts, not .d.ts.

Test evidence

New web orchestration preload API block in web-preload-api.test.ts (mocks the IPC/runtime boundary):

• orchestration.run forwards all params (incl. worktree/worktreeBacked/workerAgent) verbatim and unwraps { runId, status }.
• orchestration.taskCreate forwards all params (incl. callerTerminalHandle) verbatim and unwraps { task }.
• Runtime ok: false surfaces as a rejected promise.

Gates run locally, all green:

• pnpm run typecheck (node + cli + web) ✓
• vitest run web-preload-api.test.ts → 54 passed (3 new) ✓
• vitest run orchestration RPC registry → 99 passed ✓ (asserts no behavior change)
• oxlint on changed files ✓
• pnpm run build:electron-vite ✓

(One pre-existing switch-exhaustiveness error in task-page-github-work-item-status.ts — unrelated, not in this diff.)

🤖 Generated with Claude Code

[zaridan]

Review panel verdict — nits-only (ship it)

Three independent adversarial lenses (type-faithfulness · lane/IPC/SSH · test-honesty) + synthesis. 0 blockers, 0 should-fixes, 9 nits. Core contract verified correct on both preload surfaces: verbatim param pass-through, RuntimeRpcResponse unwrap, additive-only PreloadApi extension, .ts per AGENTS.md, F1 target-key + slice-1 options forwarded faithfully. Confirmed lane-clean — no coordinator.ts/DB touch (so no conflict with the parallel slice-2 branch).

Nits (optional, cheap)

1. Desktop preload binding (callOrchestrationRpc, src/preload/index.ts) has no direct test — only the web path (web-preload-api.test.ts) is covered; the desktop path is a structurally-distinct inline unwrap. tsc-verified + type-parity today, but the primary Electron surface rides on indirect coverage.
2. Shared mirror types (src/shared/orchestration-binding.ts) have no compile-time link to TaskRow/Zod params → future-drift risk (field-exact today).
3. RPC-method-name constants not asserted against the registry (cheap: have the registry test import them).
4. taskCreate rejection path untested (only run has one).

Over-flagged + dropped on review: the status union widening (justified forward-compat), and a clean-bill note miscounted as a finding.

Recommendation: approve. Optionally fold in the desktop-preload test (#1) + the two trivial test hardenings (#3, #4) first.