refactor(cli): consume the assembled product runtime

[limityan]

Summary

• Route local TUI, exec, management, session, and usage paths through one invocation-scoped CLI product runtime assembled from DeliveryProfile::Cli, typed runtime services, and the Agent Runtime SDK.
• Keep execution and persistence ownership in Core while replacing CLI-side service lookups and duplicated event/approval state with narrow runtime adapters.
• Align automation behavior with familiar agent CLI conventions: interactive approval, safe non-interactive defaults, explicit --auto, one-result json, and existing-envelope stream-json.
• Harden only the Core invariants required by this cutover: exact session/turn ownership, serialized scheduling and mutation, safe deletion for the new SDK/CLI path, precise usage lineage, and bounded-but-authoritative event delivery.

User-visible contract

Area	Contract
Interactive TUI	Protected tools ask with Allow once, runtime-scoped Allow always, or Reject; no global configuration is rewritten.
exec permissions	Reject by default; --auto approves for this invocation only; hidden legacy --confirm maps to the safe default.
Human input	Non-interactive exec does not expose AskUserQuestion. The existing user_input_available fact follows Task, SessionMessage, and automated reply turns so child agents cannot wait for a missing input handler.
json	Writes one final result object with status, result, available session/turn identity, turn usage, and optional Patch facts.
stream-json	Writes the existing AgenticEventEnvelope as JSONL; no CLI-specific event schema, schema version, or second taxonomy is introduced.
Patch output	Keeps structured stdout valid, includes staged/unstaged/untracked state, excludes the explicit output artifact, and treats capture/write failure as an error.
Cancellation/errors	Ctrl+C, unsuccessful terminal events, event lag/closure, and session-correlated system errors settle as explicit non-success outcomes.

Scope boundary

• Peer Host, Relay, Desktop, remote-connect, terminal transcript, Web Peer, and peer-device-mode.md are byte-equivalent to main in the effective diff. They remain the second PR.
• Existing lifecycle selection is preserved: interactive mode starts Peer Host and MCP, execution starts MCP only, and management starts neither.
• This is not a runtime owner migration. Core remains the compatibility owner where Agent Runtime SDK v1 has no stable port.
• Agent definitions, prompts, AI adapters, provider selection, and tool manifests are unchanged. ACP keeps its existing transport-specific approval behavior and remains a separate cutover.
• DialogSubmissionPolicy retains its existing three-field wire shape; CLI confirmation is derived and no requireToolConfirmation field is serialized.
• The existing Agent Runtime v1 confirmation facts/resolver remain source-compatible. The three-state invocation policy API is additive and used only by the new Core path.
• Two MiniApp customization files only migrate newly generated transient session IDs to a portable format. Core validation remains product-agnostic and still accepts existing non-traversing Unix component IDs.
• No standalone implementation specification is included; durable decisions are folded into existing architecture and CLI documents.

Adversarial review

Independent architecture and product reviews were repeated against the final effective diff. Final result: P0 = 0, P1 = 0, necessary P2 = 0.

Review-driven fixes include:

• Preserve ACP confirmation semantics while deriving local CLI confirmation without a redundant serialized field.
• Hide/fail AskUserQuestion immediately for non-interactive execution and preserve that fact across child and reply turns.
• Restore queued-start error propagation so accepted work cannot remain stuck without a running turn.
• Scope usage records by exact (session_id, turn_id) lineage, including explicit child links, and report unverifiable legacy coverage as partial.
• Size the broadcast channel to at least the existing queue capacity (10,000 by default), retain explicit lag failure, and cover bursts above the former 1,024 limit.
• Reclaim keyed locks and empty scheduler queues without registry-wide O(N) scans on every acquisition.
• Reject session path traversal while preserving historical single-component IDs; generate portable MiniApp IDs going forward.
• Preserve the public Agent Runtime v1 confirmation API and add the invocation-policy resolver without forcing downstream rewrites.

Regression evidence

Functionality and compatibility

• cargo +nightly test -p bitfun-cli — 94 passed
• cargo +nightly test -p bitfun-agent-runtime — 209 unit tests plus all contract/doc tests passed
• cargo +nightly test -p bitfun-core — full suite passed
• cargo +nightly test -p bitfun-core-types -p bitfun-runtime-ports -p bitfun-services-core — full suites passed
• pnpm --dir src/web-ui run test:run — 248 files / 1,525 tests passed
• pnpm run type-check:web — passed
• pnpm run lint:web — 0 errors; 11 existing non-blocking warnings
• cargo +nightly check --workspace — passed on Windows
• node scripts/check-core-boundaries.mjs — passed
• changed-Rust cargo +nightly fmt --check, git diff --check — passed

An earlier workspace-wide test run encountered one unchanged HTTP integration flake. The exact test passed 20/20 reruns and its package passed 286/286 serially; no production or test code was changed for it.

Startup regression check

Debug binaries were measured with isolated storage and 200 interleaved warm samples per binary. This is a relative regression check, not a production benchmark.

Command	main median / p95	Candidate median / p95	Median delta
--help	25.54 / 27.87 ms	25.72 / 27.66 ms	+0.18 ms (+0.7%)
doctor	39.55 / 42.18 ms	39.80 / 43.19 ms	+0.25 ms (+0.6%)

Debug binary size changed from 124,908,544 to 125,838,336 bytes (+0.74%). The measured deltas are within process-start noise; no material startup regression was observed.

Agent-effect boundary

The effective diff contains no agent definition, prompt, AI adapter, provider, or tool-manifest changes. The CLI SDK path delegates to the same Core coordinator, scheduler, registry, and tool pipeline, and non-interactive child turns now preserve the same input-availability fact.

These static and contract checks do not prove statistical equivalence of real-model answers, tool-choice probability, round count, token use, or provider latency. Repeated credentialed model evaluation and PTY flows remain follow-up validation, not claims made by this PR.

Follow-up PR

The second PR owns the coordinated Peer/Relay/Desktop/Web cutover and its protocol, controller-generation, reconnect, and mixed-version release risks. None of those changes are part of this PR.