feat: delegate reviewed managed automation

[thymikee]

Summary

Delegate reviewed managed operations through exact lease authority and transport scope: iOS/Android deployment, push, clipboard and settings, plus Android screenshots. Each operation passes its actual task into admission; deep readiness validates canonical identity without recursively admitting or booting locally. Cleanup retains transport scope after fencing.

Simulator readiness captures its callback at lazy runtime binding, preserving eager-import budgets. Unsupported Android bundles fail before uninstall or bundletool dispatch. Unreviewed operations remain unavailable; Simlock owns allocation and lifecycle. Request admission wiring follows this layer.

Based on published #2311 65bcfb1696037872ff2159a19097f18153ea2731, following #2308 and #2307 on main 80997b6bf1. Scope: 18 files, 992 gross lines across the authorized managed owner and Apple/Android mechanics.

Validation

Tested commit: 9195cb7b37ba0af09a1c6b7c3b58e2a0c1545293.

The exact-head pnpm check:affected --run passed: 4,214 selected tests across 549 files, plus all runnable build, package, structural, typecheck, lint and Fallow checks. The explicit import-closure rerun passed all 420 cases.

All 456 focused checks pass, including 420 import-closure checks. Planted regressions exposed dispatch after admission, local readiness, deep clipboard boot, and unsupported deployment work. Native fixtures cover private transports, cancellation, fencing, and cleanup. Independent final contract/consumer review found no concrete issues.

Three scenarios moved unchanged to provider-integration. Both CI selectors caught a planted failure at the new path; all 12 focused instrumented tests passed.

Current-head CI, including Integration, Coverage and iOS smoke, is green. Live managed-device evidence remains blocked by later admission/publication wiring, so this is published, not merge-ready.

Docs and skills are unchanged because no public managed request path is activated.

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	4.48 MB	4.48 MB	+1.7 kB
Package (unpacked)	4.48 MB	4.48 MB	+1.7 kB
Package (download)	1.33 MB	1.33 MB	+554 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	19.0 ms	20.4 ms	+1.5 ms
CLI --help	56.3 ms	60.4 ms	+4.1 ms

[thymikee]

Sentinel review at 261b11f: Independent review confirms an actionable eager-import regression: core/simulator.ts statically imports managed-device-scope, increasing app-lifecycle-facade closure 120->121 and simulator-facade 25->26; exact-head Coverage fails both gates. Restore lazy loading at the owning invocation boundary without raising budgets and rerun Coverage. Otherwise the reviewed projection reuses allocator admission, platform mechanics and scoped transport, withholding unreviewed operations. Dependency #2311 must clear first; live managed iOS/Android evidence remains explicitly unavailable until admission/publication wiring. No additional confirmed disposal defect.

[thymikee]

Addressed the Coverage finding in e017734aa80cf3df275cd2248e9acc412317af0d. Deep simulator readiness now consumes a scoped callback installed when the lazy Apple runtime binds under canonical managed authority. The callback preserves identity/set validation, cancellation, and allocator errors; it adds no eager managed import or unconditional dynamic-import workaround.

The final #2308 contract is also integrated: the existing operation guard passes the real task to admit, with cancellation checked inside its callback. Deep readiness validates identity without recursive admission, and disposal retains transport scope after fencing. The dispatch-order regression fails for admit(noop); task() and passes for the corrected ordering.

Both closure budgets are restored without raising thresholds: all 420 eager-closure checks pass. A regression deletion reaches the fixture's native-readiness trap and fails. Focused managed/native/readiness checks and independent review pass.

The exact-head pnpm check:affected --run passed: 4,214 selected tests across 548 files, plus all runnable build, package, structural, typecheck, lint and Fallow checks. The explicit import-closure rerun passed all 420 cases. Restacked onto published #2311 65bcfb1696037872ff2159a19097f18153ea2731, rooted at main 80997b6bf1dda30ca57d74dc42036f6b447e16ad. All four commits are unchanged by range-diff. GitHub CI is pending; not waiting for it as requested.

This remains dependent on #2311; live managed iOS/Android acceptance requires the later admission/publication wiring.

[thymikee]

Sentinel: no actionable code findings after coordinator + independent Terra/high review at e017734 against 65bcfb1. The previous admission-ordering blocker is resolved: actual operations execute inside task-taking admission, deep readiness remains scoped, and unsupported Android bundles fail before dispatch. Negative tests exercise the boundaries; size growth is +1.7 kB, below the scrutiny threshold. Exact-head CI is green. Still evidence-pending, not merge-ready: supply live allocator-owned device evidence through admission/publication and the delegated operation path, including lease-target transport and fencing/cleanup behavior. Land dependencies first. No readiness label; no fixes or merge performed.

[thymikee]

Addressed the reconciled review in 9195cb7b37ba0af09a1c6b7c3b58e2a0c1545293:

• Moved all three composed-runtime scenarios to test/integration/provider-scenarios/managed-runtime-automation.test.ts, with their fixture in sibling managed-runtime-automation.fixtures.ts. Scenario bodies and safety assertions are byte-for-byte unchanged. The nine fast owner/fence/dispatch tests remain colocated with the owner.
• Verified the existing Integration gate selects provider-integration and the Coverage gate selects every project except fuzz-worker. A temporary planted failure was caught by name at the relocated path by both selectors, then removed. No selection rules, timeout budgets, or coverage thresholds changed.
• Renamed the unbound inspection test to state that all inspected capabilities remain unavailable, and renamed the reviewed operation fixture to REVIEWED_MANAGED_OPERATION. Conservative inspection behavior is unchanged.

Focused instrumented owner/integration checks passed all 12 tests (97.14% owner line coverage, 100% branch coverage); the 27 gateway tests also pass. Independent read-only review: READY, no concrete findings.

The exact-head pnpm check:affected --run passed: 4,214 selected tests across 549 files and all runnable gates. The explicit closure rerun passed all 420 cases.

Dependency order is preserved. The updated published head has been handed to the admission owner for its dependent restack. CI status is a snapshot; no CI wait or merge.

[thymikee]

Sentinel follow-up at 9195cb7: coordinator and independent Terra/high review of the incremental tree diff found no actionable regression. Only five test/fixture files changed: three composed-runtime scenarios moved unchanged into provider-integration, fixture imports were relocated, and names clarified. Integration and Coverage selectors include the new path. The earlier clean code assessment carries forward; current-head CI is still running. Live allocator-owned managed-device evidence remains missing, so this is evidence-pending, not merge-ready. No readiness label or merge.

[thymikee]

Fresh sequential review at 9195cb7b37ba0af09a1c6b7c3b58e2a0c1545293, after finalizing #2311 at unchanged 65bcfb1696037872ff2159a19097f18153ea2731:

• The earlier eager-import and admission-ordering findings remain resolved. The actual operation enters task-taking admission; deep readiness avoids recursive admission, and fenced cleanup retains transport scope.
• The relocation follow-up at this exact head reports no actionable regression. The three unchanged scenarios remain selected by provider-integration and Coverage; test names accurately describe conservative unbound inspection. No unresolved inline review threads remain.
• Current-head CI is now green, including Integration, Coverage, and iOS smoke. The PR body now reflects that fresh status.
• Live allocator-owned acceptance through activated admission/publication is still missing. This layer exposes the delegated mechanics but cannot supply that activation path itself; fixtures are not a substitute for leased-target transport and fencing/cleanup acceptance.

Independent fresh read-only review agrees: no source fix is requested or justified; live activated-path evidence remains the prerequisite.

No source changes or new capabilities were warranted. The branch already contains the finalized #2311 head, so no rebase, repeat gate, or redundant push was needed. Existing exact-head local validation remains applicable. Final dependent parent remains 9195cb7b37ba0af09a1c6b7c3b58e2a0c1545293. Nothing merged; no merge-readiness claim.