feat(decopilot): unified per-run projection workflow (consume step + hosted child harness)

[tlgimenes]

Summary

Replaces the standalone decopilot projector with a per-run consume step folded into the dispatch workflow, and unifies hosted and desktop runs so they take the same path. One workflow owns each run end-to-end; NATS is a pure transport; projection is reliable and the terminal status has a single writer.

New flow (identical for both topologies): parent dispatch workflow = dispatch (start a producer that streams to NATS) → consume.

• Desktop publishes a work item to the daemon (as before).
• Hosted enqueues a fire-and-forget DBOS child workflow (hostedHarnessWorkflow, HOSTED_HARNESS_QUEUE) that runs the agent loop. No longer runs inline.
• The consume step (consume-run-projection.ts) binds a per-run durable NATS consumer, projects incrementally (checkpoints) + terminally ({done}) by reusing the existing fold engine, and is the sole terminal-status writer, mapping finish-reason → completed | requires_action | failed.

Key changes

• Run-claim (fence mint + setRunFence) hoisted to the gate for both topologies, so run_fence_token is written before the consumer reads it.
• Early terminal-status write in run-reactor.ts handleTerminalStatus deleted → consume is the only writer of completed/requires_action (SSE/metrics kept). This makes the simple if terminal → return entry guard correct.
• markRunRequiresAction runtime method added; finish-reason → status via existing resolveThreadStatus.
• Standalone projector (consumer + projectRunWorkflow/projectCheckpointWorkflow + startup) deleted.
• Queues: PROJECTOR_QUEUE removed; HOSTED_HARNESS_QUEUE added to initDbos (partition by threadId, concurrency 1) and RUN_QUEUES — both parent and child run on worker pods.
• DBOS_WORKFLOW_VERSION bumped to "2" (parent step sequence changed + new registered workflow).

Design + plan: docs/superpowers/specs/2026-06-26-decopilot-projection-single-workflow-design.md, docs/superpowers/plans/2026-06-26-decopilot-projection-single-workflow.md.

Testing

• tsc typecheck green across the branch; pure-logic unit tests pass (consume-run-projection.test.ts 7/7); each task's relevant unit/integration tests passed at implementation time.
• E2E (packages/e2e/tests/decopilot-projection.spec.ts) could not run locally (no Postgres/NATS/dev-server in the dev sandbox) — please ensure CI runs the full e2e stack. 3 live cases (desktop happy-path, entry-guard, hosted gated on E2E_ANTHROPIC_KEY); 5 cases test.skip with precise TODOs naming the missing test-injection hooks.
• A known Bun 1.3.14 segfault when batching the whole decopilot dir — tests were run per-file.

Affected areas

apps/mesh dispatch-queue (thread-gate + new hosted-harness workflow), decopilot projection (consume step, projector-workflow primitives), run-reactor, storage/threads, app.ts DBOS wiring, index.ts RUN_QUEUES.

Follow-ups (non-blocking)

• Hosted-failure purge/consume race: RUN_FAILED purges the stream while consume may project the same in-band-error run. Bounded + self-correcting (DB already failed, markRunFailed idempotent); worst case is truncated failed-run parts or a consume idle-timeout holding the per-thread slot up to 30 min. Not a regression (old poll cap was 1h). Fix: pass an abort signal to consumeRunProjection on terminal-failure and/or defer the RUN_FAILED purge to consume's purgeRun.
• Extract a shared types-only module for 3 duplicated workflow types (currently duplicated to break a DBOS register-at-import cycle).
• Wire the 5 skipped e2e cases (need an idleTimeoutMs override, a raw-publish dedup bypass, and multi-pod kill controls).

🤖 Generated with Claude Code

---

Summary by cubic

Unifies decopilot runs behind a per-run consume step that drains NATS and writes the terminal status. Hosted and desktop now share the same path via a hosted child workflow; the standalone projector is removed.

• New Features

  • Added consume-run-projection.ts to the dispatch workflow: per-run durable JetStream consumer, incremental checkpoints, final projection, and the only writer of completed | requires_action | failed (with pure helpers isTerminalStatus, consumeDurableName, classifyDrainMessage and retry-safe consumer add).
  • Hosted runs now execute in a DBOS child workflow (hostedHarnessWorkflow) on HOSTED_HARNESS_QUEUE (partitioned by threadId, concurrency 1); the parent enqueues the child, starts the producer, then runs the consume step. Cancel routes best-effort cancel the child (cancelHostedHarness).
  • Hoisted run-claim to the thread gate and threaded runFenceToken into prepareRun.
  • Removed standalone projector consumer/workflows and PROJECTOR_QUEUE; kept projection primitives.
  • Removed early terminal-status write from run-reactor.ts (reactor now emits SSE only).
  • Mapped finish-reason to completed | requires_action | failed; when finishReason is absent (desktop/relay), default to completed. Added markRunRequiresAction (keeps run_owner_pod on pause).
  • E2E: relay-ingest tests now drive real dispatch to exercise the consume step; desktop happy-path coverage moved to link-ingest.spec.ts.

• Migration

  • Update workers to dequeue HOSTED_HARNESS_QUEUE and remove PROJECTOR_QUEUE from RUN_QUEUES.
  • Deploy with DBOS_WORKFLOW_VERSION set to "2".
  • Ensure CI/e2e runs Postgres + NATS; set E2E_ANTHROPIC_KEY to run hosted-path tests (optional).
  • Automation runs now create v2 threads so the consume step can project them (no manual action required).

^{Written for commit d8c4100. Summary will update on new commits.}