[18/36] Add OC-080 runtime lifecycle and OC-110 task setup

[cjohnsto-nz]

---

This is part 5 of 21 in a stack made with GitButler:

•  21  [22/36] Release 0.8.0 with packaged PDF.js preview #54
•  20  [21/36] Complete OC-070 protocol surface polish #56
•  19  [20/36] Record final OpenCollection supervisor acceptance #53
•  18  [19/36] Add OC-110 runtime authoring UX #52
•  17  [18/36] Add OC-080 runtime lifecycle and OC-110 task setup #51 <-- current
•  16  [16/36] Record OC-050 OC-090 OC-100 supervisor audit #50
•  15  [15/36] Add OC-050 auth and transport support #49
•  14  [14/36] Add OC-100 request type UX #48
•  13  [13/36] Add OC-100 request type UX task #47
•  12  [12/36] Add OC-080 and OC-090 task tracks #46
•  11  [11/36] Record OC-010 through OC-040 supervisor audit #45
•  10  [10/36] Add OC-020 WebSocket support #44
•  9  [09/36] Add OC-010 GraphQL support #43
•  8  [08/36] Require demo server fixtures for parallel tracks #42
•  7  [07/36] Record OC-000 and OC-060 supervisor audit #41
•  6  [06/36] Add OC-060 schema round-trip validation #40
•  5  [05/36] Add OC-040 runtime scripting support #39
•  4  [04/36] Add OC-090 gRPC streaming support #38
•  3  [03/36] Add OC-030 gRPC unary protobuf support #37
•  2  [02/36] Add OC-000 protocol dispatch foundation #36
•  1  [01/36] Add OpenCollection agent plan #35

[APKiwi]

Verdict: approve with nits. The runtime generalization is clean and the error-to-synthetic-response design (status 0 so after-response scripts still run, cancellations rethrown) is sensible.

• Minor: streaming gRPC runtime is silently dropped. The lifecycle wrap gates on grpcMethodType === 'unary' (requestExecutionService.ts ~227), so a streaming request carrying scripts/assertions/actions falls through to plain send with zero feedback. The schema now permits runtime on any gRPC request and the OC-110 PR exposes the Runtime authoring tab on streaming requests, so users can author runtime that silently never executes. OC-080 scoping to unary is fine, silence isn't: emit a diagnostic like the other unsupported paths. No test covers this either.
• Minor: isCancellationError string-matches /request cancelled/i on error.message (~316). Works today because both clients throw exactly that string, but any future client with different wording gets its cancellation swallowed into a status-0 response and the send resolves instead of rejecting. Use a typed sentinel error.
• Nit: buildProtocolErrorResponse copies err.message into an x-missio-error-message header, multi-line messages would be malformed as a header value. Internal-only object, harmless.

Tests: strong coverage of WS and unary gRPC lifecycles including sandbox denial before the transport opens and cancellation cleanup. The streaming-with-runtime gap is the missing case.

Deps: none added.

[cjohnsto-nz]

Fixed in 9b5ab9f57b2b383a317d386d598d308e6054f4fb.

• Streaming gRPC requests with runtime scripts, assertions, tests, actions, or runtime variables now fail before the transport opens. The diagnostic identifies OC-080, states that streaming runtime is unsupported, and explicitly states that the request was not sent. Plain streaming requests remain supported.
• WebSocket and gRPC cancellation paths now emit RequestCancelledError with the stable MISSIO_REQUEST_CANCELLED code. Runtime execution recognizes that structured sentinel rather than matching message text, so cancellation wording can change without being converted into a synthetic status-0 response.
• Added regression tests proving that streaming runtime never calls the gRPC client and that a typed cancellation with the unrelated message Stopped by caller is still rethrown.

I am not changing x-missio-error-message. buildProtocolErrorResponse constructs an internal HttpResponse object; those headers are response metadata consumed by Missio and are never serialized onto an HTTP, WebSocket, or gRPC wire. The full error, including line breaks, is intentionally preserved in the JSON body. A multi-line string therefore cannot create an outbound malformed header.

Validation:

• PR51 tree: npm run compile, all 423 tests, and npm run build pass.
• PR49 + PR51 + current rework tip composed tree: compile, all 499 tests, and production build pass.
• Final PR51→PR52 and PR51→rework merge-tree checks are both STACK_CLEAN.
• After pushing, GitHub reports PR52 MERGEABLE/CLEAN.