feat(lifecycle): opt into built-in host process supervision

.github/workflows/ci.yml

@@ -744,6 +744,22 @@ jobs:
           HACK_E2E_COMPOSE_PLUGIN_SHA256="$(sha256sum "$HACK_E2E_COMPOSE_PLUGIN_PATH" | cut -d ' ' -f1)"
           export HACK_E2E_DOCKER_HOST HACK_E2E_NETWORK_SOURCE_REVISION HACK_E2E_NETWORK_CLI_SHA256 HACK_E2E_NETWORK_COMPILER_SHA256 HACK_E2E_COMPOSE_PLUGIN_PATH HACK_E2E_COMPOSE_PLUGIN_SHA256
           HACK_E2E_REQUIRE_DOCKER=1 HACK_E2E_REQUIRE_TMUX=1 bun run test:e2e:local:docker --shard="$HACK_E2E_SHARD"
+      - name: Setup supervisor toolchain
+        if: matrix.shard == 4
+        uses: dtolnay/rust-toolchain@1.97.1
+      - name: Qualify lifecycle scenarios with the supervisor runner
+        if: matrix.shard == 4
+        env:
+          HACK_DAEMON_AUTOSTART_DISABLE: '1'
+          HACK_LIFECYCLE_RUNNER: supervisor
+          HACK_LIFECYCLE_SUPERVISOR_BINARY: ${{ github.workspace }}/dist/hack-lifecycle-supervisor
+          HACK_E2E_REQUIRE_DOCKER: '1'
+          HACK_E2E_DOCKER: '1'
+          HACK_E2E_CLI_BIN: ${{ github.workspace }}/dist/hack
+        run: |
+          cargo +1.97.1 build --locked --release --manifest-path packages/lifecycle-supervisor/Cargo.toml --target-dir .hack-local/target/lifecycle-supervisor
+          cp .hack-local/target/lifecycle-supervisor/release/hack-lifecycle-supervisor dist/hack-lifecycle-supervisor
+          bun tests/e2e/run.ts --only=lifecycle-host-process,lifecycle-session-recovery
       - name: Preserve process-policy capsule and startup diagnostic
         # Closed fixed-field JSON only (counts, enums, booleans); the gh log viewer truncates it inline.
         if: failure()

.github/workflows/lifecycle-supervisor.yml

@@ -4,11 +4,47 @@ on:
   pull_request:
     paths:
       - packages/lifecycle-supervisor/**
+      - src/lib/lifecycle-supervisor.ts
+      - src/lib/project-lifecycle-supervisor.ts
+      - src/lib/project-lifecycle-controller.ts
+      - src/lib/lifecycle-runtime.ts
+      - tests/lifecycle-supervisor-controller.test.ts
+      - tests/lifecycle-supervisor-observers.test.ts
+      - tests/lifecycle-state-publication.test.ts
+      - tests/lifecycle-runner-config.test.ts
+      - tests/e2e/scenarios/lifecycle-*.ts
+      - src/lib/project-lifecycle-hygiene.ts
+      - src/lib/lifecycle-runner.ts
+      - src/lib/runtime-projects.ts
+      - src/lib/private-file.ts
+      - src/lib/projects-registry-lock.ts
+      - src/lib/child-environment.ts
+      - src/commands/host-ps.ts
+      - src/commands/project.ts
+      - src/commands/doctor.ts
       - .github/workflows/lifecycle-supervisor.yml
   push:
     branches: [next, main]
     paths:
       - packages/lifecycle-supervisor/**
+      - src/lib/lifecycle-supervisor.ts
+      - src/lib/project-lifecycle-supervisor.ts
+      - src/lib/project-lifecycle-controller.ts
+      - src/lib/lifecycle-runtime.ts
+      - tests/lifecycle-supervisor-controller.test.ts
+      - tests/lifecycle-supervisor-observers.test.ts
+      - tests/lifecycle-state-publication.test.ts
+      - tests/lifecycle-runner-config.test.ts
+      - tests/e2e/scenarios/lifecycle-*.ts
+      - src/lib/project-lifecycle-hygiene.ts
+      - src/lib/lifecycle-runner.ts
+      - src/lib/runtime-projects.ts
+      - src/lib/private-file.ts
+      - src/lib/projects-registry-lock.ts
+      - src/lib/child-environment.ts
+      - src/commands/host-ps.ts
+      - src/commands/project.ts
+      - src/commands/doctor.ts
       - .github/workflows/lifecycle-supervisor.yml
   workflow_dispatch:
 
@@ -42,5 +78,17 @@ jobs:
         run: cargo clippy --locked --manifest-path packages/lifecycle-supervisor/Cargo.toml --all-targets -- -D warnings
       - name: Test standalone supervisor with private fake callers
         run: cargo test --locked --manifest-path packages/lifecycle-supervisor/Cargo.toml -- --test-threads=4
+      - name: Test deterministic guard crash windows (qualification build only)
+        run: cargo test --locked --manifest-path packages/lifecycle-supervisor/Cargo.toml --features test-hooks guard_killed_after_ -- --test-threads=1
       - name: Build standalone release executable
         run: cargo build --locked --release --manifest-path packages/lifecycle-supervisor/Cargo.toml
+      - uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: "1.4.4"
+      - name: Install locked CLI test dependencies
+        run: bun install --frozen-lockfile
+      - name: Test current-source CLI controller against native supervisor
+        env:
+          HACK_TEST_REQUIRE_SUPERVISOR: '1'
+          HACK_TEST_SUPERVISOR_BINARY: ${{ env.CARGO_TARGET_DIR }}/release/hack-lifecycle-supervisor
+        run: bun test tests/lifecycle-supervisor-controller.test.ts tests/lifecycle-runner-config.test.ts tests/lifecycle-state-publication.test.ts tests/lifecycle-supervisor-observers.test.ts

docs/diagrams/lifecycle-controller.mmd

@@ -0,0 +1,31 @@
+---
+title: Lifecycle controller · launch receipts and adoption
+---
+stateDiagram-v2
+  direction TB
+  [*] --> Idle
+  Idle --> Starting : Begin
+  Starting --> AwaitReply : Launch [pending published]
+  AwaitReply --> Ready : Accept
+  AwaitReply --> InspectLate : LoseReply
+  InspectLate --> LatePublished : PublishLate [native live]
+  LatePublished --> Failed : FailUnknown
+  Ready --> Adopted : Adopt [native live]
+  Failed --> Adopted : Adopt [native live]
+  Adopted --> AwaitReply : Add [not stopped]
+  Ready --> Aborted : Abort [epoch matches]
+  Failed --> Aborted : Abort [epoch matches]
+  Ready --> Stopped : Stop [absence confirmed]
+  Adopted --> Stopped : Stop [absence confirmed]
+  Failed --> Stopped : Stop [absence confirmed]
+  note right of Starting
+    INV ownership precedes launch
+  end note
+  note right of Adopted
+    INV old cleanup cannot stop
+    Token stable, epoch changes
+  end note
+  note right of Failed
+    Unknown is not absence
+    Verified late effect retained
+  end note