FE-1111: Reconcile executor agent runner

[kostandinang]

Stack Context

Part of the orchestrator-cutover stack after FE-1109 executor sandbox.

What

Reconciles execute_agent_result to the executor agent-runner path.

This PR wires AgentRunnerPort, threads Pi model context into the runner, and adds a sealed worker background agent with bounded read + write_worktree_file authority over the sandbox worktree. It proves the default app-composed runner path and adds executor-agent-runner-witness, a portable faux-provider witness probe that exercises the sealed worker tool call and captures request/result/proof artifacts.

Runner failures fail closed without advancing run metadata.

Verification

npm run verify

[kostandinang]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• FE-1118: Reconcile host executor promotion #282
• FE-1112: Reconcile run-local executor promotion #279
• FE-1111: Reconcile executor agent runner #278 👈 (View in Graphite)
• FE-1109: Reconcile executor sandbox worktrees and test runner ports #275
• FE-1089: Reconcile executor with alpha branch #274
• next

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

PR Summary

Medium Risk
Introduces the orchestrator-cutover LLM execution layer and write-capable subagent tooling; boundaries are tested and fail-closed, but mistakes in grant or path scoping could widen sandbox write authority.

Overview
execute_agent_result no longer ingests prewritten result.json files. It invokes an injected AgentRunnerPort, passes Pi model context from the tool execution context, and only advances run metadata when the runner completes successfully (runner failure → agent_run_failed, no side effects).

The app layer adds createAgentRunnerPort, which launches a registry-owned sealed worker subagent over the sandbox worktree (not elicit-delegatable). The worker gets a new bounded write_worktree_file tool (path-scoped to the worktree cwd) plus read; shell and nesting stay out of the grant.

Pi composition wires the default runner when subagent deps exist; CODE mode loads subagent definitions for executor runs even without dev subagent tooling. Build ships worker.md; SPEC/PLAN mark FE-1111 done and point executor-promotion as next.

Tests and executor-agent-runner-witness prove the port contract, default composition, and faux-provider worktree writes with portable artifacts.

^{Reviewed by Cursor Bugbot for commit 2777558. Bugbot is set up for automated code reviews on this repo. Configure here.}

[lunelson]

The sealed worker boundary is clear: bounded worktree tools, no shell, no nested agents, and failure does not advance run metadata.

One follow-up worth tracking: the persisted success result is mostly the worker's final text summary. For later recovery and promotion review, it may help to persist a more inspectable execution record, such as files written or tool-call evidence, alongside the summary. Not blocking this PR, since the authority boundary is already narrow.

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e7de782. Configure here.}

[cursor]

Symlink bypasses worktree write bounds

Medium Severity

write_worktree_file checks paths with lexical resolve only, then writes with writeFile. A relative path under a symlink inside the worktree can still resolve under the worktree root while the write follows the link and lands outside the sandbox.

 

^{Reviewed by Cursor Bugbot for commit e7de782. Configure here.}

[cursor]

Result write failure leaves dirty worktree

Medium Severity

After a successful worker run, a failure while writing result.json throws out of AgentRunnerPort.run. ingestAgentResult then does not advance metadata, but worktree file changes from the worker may already be present, so a retry can re-run the slice on a mutated tree.

 

^{Reviewed by Cursor Bugbot for commit e7de782. Configure here.}