first commit

openspec/changes/implement-run-worker-real-execution/proposal.md

@@ -0,0 +1,28 @@
+## Why
+
+The run executor currently returns metadata-only success for lifecycle assignments. The platform can queue and claim jobs, but no daemon loop performs hello, heartbeat, claim, ack, progress, result, cancel, reconcile, process supervision, log collection, or artifact worker coordination. Operators need real local execution before server management can be considered operational.
+
+## What Changes
+
+- Add a run worker loop for registration, heartbeat, job polling, acknowledgement, progress, results, cancel polling, and reconcile.
+- Replace metadata-only lifecycle execution with scoped install/start/stop process orchestration.
+- Enforce workspace scoping, command allowlists, redaction, and channel separation.
+- Connect process output to log spool and lifecycle result refs to artifact upload hooks.
+- Add configuration, tests, and integration-style verification with a platform test server.
+
+## Capabilities
+
+### New Capabilities
+
+- `run-worker-real-execution`: Real run-side worker loop and scoped lifecycle process execution.
+
+### Modified Capabilities
+
+- `server-management-workflows`: Lifecycle jobs become executable by run instead of metadata-only.
+- `run-job-channel`: The run client is used by a persistent worker loop.
+
+## Impact
+
+- Affects `run/` config, command, runtime, protocol usage, spool integration, artifact hooks, docs, and tests.
+- Affects `platform/` tests where integration-style job flow coverage is needed.
+- Does not expose host paths, raw credentials, direct sockets, unrestricted shell execution, billing, or cloud host workflows.