feat(orchestration): token-free recipe director — launchRecipeDirector + implement_then_review (#9)

[zaridan]

#9 — RecipeDirectorBackend: the token-free recipe director

A director that runs a fixed recipe with ZERO director LLM tokens. The "director" is deterministic dispatch — the worker agents do all the coding. Built entirely on the merged bridge runtime (F1–F4, O1/O2); no worktree/dispatch logic is forked.

Flow — launchRecipeDirector(project, recipe)

1. Create the no-LLM director shell. The hidden director worktree-shell creation (prefix ORCASTRATOR · , 'skip' setup) is extracted from launchOrchestratorForProject into a shared createDirectorWorktreeShell. The recipe director creates that same shell but activates it with no startup payload — a blank terminal, no agent, no /orcastrate.
2. Compile the recipe → tasks. compileRecipe topo-sorts by deps, prepends the coordinator's track: spec hint, and fails fast on unknown/self/cyclic deps. The launch path then calls window.api.orchestration.taskCreate per task, resolving each dependsOn key to the previously-created task id and stamping every task to the shell worktree (see plumbing below).
3. Start the run. window.api.orchestration.run({ worktree: id:<shell>, worktreeBacked: true, workerAgent: <default coding agent> }). The merged coordinator creates per-track child worktrees (lineage parent = the director shell) and launches the real worker agents. The live Control Panel renders the DAG automatically.

The director shell runs no agent → no director LLM tokens. The only LLM cost is the worker agent(s) doing implement/review.

The one recipe this PR ships — implement_then_review

Two tasks, implement and review, on the same track → one worktree, one branch, one PR. review.dependsOn = [implement] so review runs after implement finishes — a real handoff that also satisfies the coordinator's same-track safe-ordering guard (it refuses a worktree-backed run whose same-track tasks aren't ordered by deps).

Plumbing — taskCreate targetWorktree

For run-start adoptUnownedTasks to claim a pre-created task, the task's target_key must equal the run's. The coordinator stamps target_key from the creating terminal's worktree, but the renderer recipe director has a worktree id, not a live terminal handle. So orchestration.taskCreate gains an optional targetWorktree selector that stamps target_key through the same resolveOrchestrationTargetKey that run uses for worktree. It takes precedence over callerTerminalHandle and fails closed when the selector doesn't resolve. The run's from is bound to the shell's terminal handle (best-effort, via terminal.resolveActive) so the Control Panel keys the DAG on the director pane; on a miss the run still starts.

Tests

• Compilation — implement_then_review → 2 tasks, same track, review depends on implement; topo ordering; rejects unknown/cyclic/self/duplicate deps.
• Token-free invariant — the shell is activated with no agent startup payload (no agent command, no /orcastrate).
• Launch calls — issues the right ordered taskCreate (deps wired, targetWorktree stamped) + a worktree-backed run({ worktreeBacked, workerAgent }); tasks created before the run starts; blank-agent → claude fallback; graceful shell-create / handle-resolve failure.
• RPC — taskCreate --target-worktree stamps target_key via the shared resolver and fails closed.

Full vitest + typecheck + electron-vite/web build + oxlint green.

Gating & scope

Behind experimentalOrchestrators. Per-run isolation (F1) intact; reuses the merged worktree-backed coordinator + F4 run binding.

Deferred (not this PR): the full starter-recipe set (#10), the DirectorBackend abstraction (#8), the director-type picker UI (#11), hybrid mode. Wiring the recipe name into the run-DAG recipe field (currently null) needs a coordinator-run column and is left to the abstraction work in #8/#10.

Do not merge.

🤖 Generated with Claude Code

[zaridan]

Hardening round — panel pre-merge items closed

Pushed 2a1d2b4. No behavior change to the launch flow; this tightens the seams the panel flagged.

MUST 🟠 — e2e target_key adoption (the F1 clash seam). Added an integration test that proves the binding through the real resolveOrchestrationTargetKey + real db.adoptUnownedTasks on a real in-memory OrchestrationDb — no mocked resolver returning a matched literal. Only the lowest-level filesystem worktree lookup is stubbed (id:X → worktree X). A task stamped via taskCreate({ targetWorktree: 'id:W' }) is adopted by a run on id:W (coordinator_run_id set); a negative control (task on id:OTHER) is not adopted — so the test fails the instant the two paths resolve different keys.

MUST 🟡 — token-free invariant guarded. Comment at createDirectorWorktreeShell's createWorktree call spelling out that it MUST NOT pass createdWithAgent (else activation's buildCreatedAgentReopenStartup fallback relaunches an LLM in the director pane). Plus a test on the real shell helper asserting the createdWithAgent arg stays undefined and setup is 'skip'. (The launch test already covers the other half: activation gets no startup payload.)

Nits

• Dead agent plumbing dropped from RecipeTask/CompiledRecipeTask (with a note to re-add when Starter recipes: single_worker_pr, implement_then_review, repro_fix_verify #10/Director-type picker UI (Smart / Recipe), gated by experimentalOrchestrators #11 need heterogeneous agents + a per-task taskCreate param).
• dependsOn resolution now throws on an unmapped key instead of .filter-dropping it (localizes a future compile regression here, not as a downstream same-track ordering refusal).
• Gating — doc comment on launchRecipeDirector stating the Director-type picker UI (Smart / Recipe), gated by experimentalOrchestrators #11 picker call site MUST gate on experimentalOrchestrators (kept ungated by design; no half-gate).
• Shell-handle race — documented as opportunistic: we don't await terminal readiness (a blank shell has no readiness signal), and on a miss the run derives its own coordinator handle and still works — only the cosmetic pane-anchoring is skipped.

Green: typecheck (3 projects), oxlint, electron-vite build, and vitest (new e2e + token-free tests; full orchestration + renderer-lib sweep 2152). Not merging.