diff --git a/docs/open-collection-gap-analysis/AGENT_PROGRESS.md b/docs/open-collection-gap-analysis/AGENT_PROGRESS.md
index 97dba6b..856ce58 100644
--- a/docs/open-collection-gap-analysis/AGENT_PROGRESS.md
+++ b/docs/open-collection-gap-analysis/AGENT_PROGRESS.md
@@ -68,7 +68,7 @@ Use full branch names for stacking existing branches with `but move <child-branc
 | OC-080 | Runtime lifecycle for WebSocket and unary gRPC | Done | Codex | supervisor/add-runtime-authoring-ux-task (ho); implementation commit `ea7383b`; completion/ledger commit `251408f`; supervisor cleanup commit `878063b`; supervisor review ledger is the top `ho` commit | Satisfied by `test/webSocketSupport.test.ts`, `test/grpcSupport.test.ts`, `test/sendRequestTool.test.ts`, and `test/responseProvider.test.ts`: WebSocket and unary gRPC before/after runtime lifecycle order, before-script header/metadata/body mutation, after-response scripts/tests/assertions/actions, runtime variable mutation, sandbox-denial security diagnostics, failure-path response preservation, cancellation/cleanup, response provider rendering, Copilot tool output, and schema-valid local demo WebSocket/gRPC runtime fixtures. | `npx vitest run test/webSocketSupport.test.ts test/grpcSupport.test.ts test/sendRequestTool.test.ts test/responseProvider.test.ts` passed 4 files/50 tests; `npm run compile` passed; `node scripts/validate-collection.js examples/demo-api` passed 44/44 files; live local WebSocket/gRPC runtime smoke passed with `LIVE_WS_RUNTIME_SMOKE ok` and `LIVE_GRPC_RUNTIME_SMOKE ok`; `npm test` passed 22 files/428 tests; `npm run build` passed; VSIX packaged and installed as `missio.missio@0.7.7`. | 2026-06-15 01:42 NZT | Supervisor review found no blocking OC-080 issues; GitButler `zz` is clean and the extension is installed from the reviewed stack. |
 | OC-090 | gRPC streaming | Done | Codex | feature/oc-090-grpc-streaming (am), stacked on applied OC-030 unary/protobuf work; implementation commits `84cf254` and `c462d51` | Implemented method-type-aware unary, server-streaming, client-streaming, and bidirectional-streaming gRPC execution with schema-native ordered message sequences, proto method-type validation, cancellation cleanup, partial stream error retention, response stream summaries, local demo streaming proto/server/routes, and regression tests for unary dispatch, validation, round-trip safety, failure paths, and cleanup. | `npm run compile` passed; `npx vitest run test/grpcSupport.test.ts test/schemaRoundTrip.test.ts test/validationService.test.ts test/responseProvider.test.ts test/sendRequestTool.test.ts` passed 5 files/33 tests; `node scripts\validate-collection.js examples\demo-api` passed 42/42 files; `npm test` passed 21 files/405 tests; `npm run build` passed. Live hidden `node examples/demo-api/grpc-server.js` smoke verified server/client/bidi/error streams. | 2026-06-15 00:21 NZT | OC-090 complete in the verified worktree. Preserve remaining unassigned parallel/change-routing IDs called out in the OC-090 log; do not commit them to unrelated branches. |
 | OC-100 | Request type UX | Done | Codex | feature/oc-100-request-type-ux (g0 after restack), stacked on supervisor/add-request-type-ux-task; implementation commit `5cb05a3` | Satisfied by `test/requestTypeUx.test.ts`: schema-valid HTTP/GraphQL/WebSocket/gRPC starter templates, actual `missio.newRequest` protocol picker/write/open flow, YAML and editor-model round-trip safety, no stale protocol roots, gRPC same-protocol editor guard, and read-only protocol chip shell. Shared regressions cover HTTP/GraphQL/WebSocket/gRPC editor, validation, command/tool, and protocol behavior. Switcher/conversion helpers are intentionally out of scope because the benchmarked tools emphasize protocol choice at creation and Postman locks saved request protocols. | `npx vitest run test/requestTypeUx.test.ts test/schemaRoundTrip.test.ts test/openCollectionFoundation.test.ts test/validationService.test.ts` passed 4 files/25 tests; targeted protocol suite passed 8 files/68 tests; `npm run compile` passed; `npm test` passed 21 files/405 tests; `node scripts/validate-collection.js examples/demo-api` passed 42/42 files; `npm run build` passed. | 2026-06-15 00:15 NZT | OC-100 complete; no saved-request switcher was added by product decision and benchmark alignment. Remaining unassigned changes are parallel OC-050/OC-090 work, not OC-100. |
-| OC-110 | Runtime authoring UX | Unclaimed | - | - | - | - | - | Start after OC-070 settles request editor surface churn; coordinate with OC-080 if non-HTTP runtime response shapes affect authoring examples. |
+| OC-110 | Runtime authoring UX | Done | Codex | feature/oc-110-runtime-authoring-ux (g0), stacked on supervisor/add-runtime-authoring-ux-task; implementation commit `fe0ad14`; supervisor follow-up commit `1e6db05`; supervisor acceptance recorded | Satisfied by `test/runtimeAuthoringUx.test.ts`, `test/runtimeExecutionService.test.ts`, `test/validationService.test.ts`, and shared schema/protocol regressions: visual editor can author supported runtime scripts/tests/assertions/actions, no longer offers non-executing `hooks` scripts or unsupported persisted scopes for new rows, preserves schema-valid existing `hooks`/persisted-scope YAML with diagnostics, and runtime actions diagnose unsupported scopes instead of silently writing runtime variables. | `npm run compile` passed; focused `npx vitest run test/runtimeAuthoringUx.test.ts test/runtimeExecutionService.test.ts test/validationService.test.ts test/schemaRoundTrip.test.ts test/requestTypeUx.test.ts test/webSocketSupport.test.ts test/grpcSupport.test.ts` passed 7 files/69 tests; `node scripts\validate-collection.js examples\demo-api` passed 44/44 files; `npm test` passed 23 files/437 tests; `npm run build` passed. | 2026-06-15 09:51 NZT | Supervisor review accepted OC-110 rework; no remaining blocking findings. |
 
 ## Dependency Map
 
@@ -339,7 +339,45 @@ Record cross-cutting decisions here so parallel agents do not rediscover them.
 
 ### OC-110 Runtime Authoring UX
 
-No updates yet.
+- 2026-06-15 09:15 NZT - Codex: Claimed OC-110 and recorded the coverage plan before implementation.
+  GitButler: `feature/oc-110-runtime-authoring-ux` (m0); `but status -fv` showed clean `zz` and the OC-110 task page available on `supervisor/add-runtime-authoring-ux-task`.
+  Coverage: planned automated request editor/model/webview tests for add/edit/disable/reorder/remove runtime scripts, tests, assertions, and `set-variable` actions; schema round-trip and validation regressions for runtime preservation, disabled entries, unknown schema-valid fields, and protocol-neutral HTTP/GraphQL/WebSocket/gRPC saves; demo/docs verification guidance; compile, targeted protocol/editor suites, demo collection validation, full suite, and build.
+  Changed: `docs/open-collection-gap-analysis/AGENT_PROGRESS.md`.
+  Verified: `but status -fv`, OC-110 task page, and current progress ledger reviewed; implementation tests not run yet.
+  Next: audit request editor serializer/webview, runtime schema/types, runtime fixtures, and existing tests before adding OC-110 coverage and implementation.
+
+- 2026-06-15 09:28 NZT - Codex: Completed OC-110 runtime authoring UX with schema-valid visual editing for scripts, tests, assertions, and set-variable actions across HTTP, GraphQL, WebSocket, and gRPC requests.
+  GitButler: `feature/oc-110-runtime-authoring-ux` (g0), stacked on `supervisor/add-runtime-authoring-ux-task`; implementation commit `fe0ad14` (`Add OC-110 runtime authoring UX`). `but status -fv` after the implementation commit shows only this ledger file as unassigned. A temporary README guidance hunk was removed from this slice because README is owned by the separate OC-070 stack; user-verifiable guidance remains in the committed demo request descriptions.
+  Coverage: implemented `test/runtimeAuthoringUx.test.ts` for editor model/UI shell create/edit/disable/reorder/remove behavior, runtime YAML preservation, disabled entries, structured description preservation, no stale protocol roots, and gRPC-safe runtime edits; expanded runtime execution coverage for disabled scripts; expanded validation coverage for disabled scripts across protocol requests; re-ran shared schema, request type, WebSocket, and gRPC regressions.
+  Changed: `src/models/schemaRoundTrip.ts`, `src/models/types.ts`, `src/panels/requestPanel.ts`, `src/webview/requestPanel.ts`, `src/webview/requestPanel.css`, `src/services/runtimeExecutionService.ts`, `schema/missio-extensions.json`, `schema/opencollectionschema.json`, runtime/demo request guidance files under `examples/demo-api`, `test/runtimeAuthoringUx.test.ts`, `test/runtimeExecutionService.test.ts`, `test/validationService.test.ts`, and this ledger.
+  Verified: focused `npx vitest run test/runtimeAuthoringUx.test.ts test/runtimeExecutionService.test.ts test/validationService.test.ts test/schemaRoundTrip.test.ts test/requestTypeUx.test.ts test/webSocketSupport.test.ts test/grpcSupport.test.ts` passed 7 files/66 tests; `npm run compile` passed; `node scripts\validate-collection.js examples\demo-api` passed 44/44 files; `npm test` passed 23 files/434 tests; `npm run build` passed.
+  Next: commit this ledger update to `feature/oc-110-runtime-authoring-ux`; OC-110 is ready for review from `fe0ad14` plus the ledger commit.
+
+- 2026-06-15 09:36 NZT - Codex Supervisor: Reviewed OC-110, built, packaged, and installed the extension.
+  GitButler: `feature/oc-110-runtime-authoring-ux` (g0) remains stacked on `supervisor/add-runtime-authoring-ux-task`; `but status -fv` was clean after package/install. Build-regenerated `schema/opencollectionschema.json` produced no content diff and was discarded as line-ending churn before packaging.
+  Findings: `src/webview/requestPanel.ts` exposes `hooks` in the runtime script editor although `RuntimeExecutionService` only invokes `before-request`, `after-response`, and `tests` scripts. The same editor exposes `folder`, `collection`, and `environment` action scopes although the current runtime stores every non-`request` mutation in runtime variables while reporting the selected scope. These need either runtime support or guarded UX/diagnostics before final OC-110 acceptance.
+  Verified: `npm run compile` passed; focused `npx vitest run test/runtimeAuthoringUx.test.ts test/runtimeExecutionService.test.ts test/validationService.test.ts test/schemaRoundTrip.test.ts test/requestTypeUx.test.ts test/webSocketSupport.test.ts test/grpcSupport.test.ts` passed 7 files/66 tests; `node scripts\validate-collection.js examples\demo-api` passed 44/44 files; `npm test` passed 23 files/434 tests; `npm run build` passed; `npx @vscode/vsce package --out $env:TEMP\missio-0.7.7-oc110-supervisor.vsix` passed; `code.cmd --install-extension $env:TEMP\missio-0.7.7-oc110-supervisor.vsix --force` installed `missio.missio@0.7.7`.
+  Next: Address the two UX/runtime findings, then re-run the same verification suite and update this ledger.
+
+- 2026-06-15 09:41 NZT - Codex: Claimed the OC-110 supervisor follow-up for non-executing hook scripts and unsupported persisted action scopes.
+  GitButler: continuing on `feature/oc-110-runtime-authoring-ux` (g0); `but status -fv` showed clean `zz` before this ledger update.
+  Coverage: add OC-110 UI/source and round-trip regressions proving new rows cannot choose `hooks` or folder/collection/environment scopes, existing schema-valid unsupported rows are preserved with editor diagnostics, and runtime `set-variable` actions diagnose unsupported scopes instead of silently writing runtime variables.
+  Changed: `docs/open-collection-gap-analysis/AGENT_PROGRESS.md`.
+  Verified: planning/status only; implementation tests not run yet.
+  Next: patch the request runtime editor, runtime action diagnostics, and focused tests, then re-run the OC-110 verification matrix.
+
+- 2026-06-15 09:45 NZT - Codex: Addressed both OC-110 supervisor findings.
+  GitButler: implementation/test follow-up committed to `feature/oc-110-runtime-authoring-ux` as `1e6db05` (`Address OC-110 runtime authoring review`); `but status -fv` after that commit showed only this ledger file as unassigned.
+  Coverage: removed `hooks` from new runtime script choices while preserving existing schema-valid hook rows with a disabled diagnostic option and visible warning; limited new `set-variable` action scopes to `runtime` and `request` while preserving existing folder/collection/environment YAML with diagnostics; runtime now returns a failed action diagnostic for unsupported persisted scopes instead of silently mutating runtime variables.
+  Changed: `src/webview/requestPanel.ts`, `src/webview/requestPanel.css`, `src/services/runtimeExecutionService.ts`, `test/runtimeAuthoringUx.test.ts`, `test/runtimeExecutionService.test.ts`, and this ledger.
+  Verified: `npx vitest run test/runtimeAuthoringUx.test.ts test/runtimeExecutionService.test.ts` passed 2 files/15 tests; `npm run compile` passed; focused `npx vitest run test/runtimeAuthoringUx.test.ts test/runtimeExecutionService.test.ts test/validationService.test.ts test/schemaRoundTrip.test.ts test/requestTypeUx.test.ts test/webSocketSupport.test.ts test/grpcSupport.test.ts` passed 7 files/69 tests; `node scripts\validate-collection.js examples\demo-api` passed 44/44 files; `npm test` passed 23 files/437 tests; `npm run build` passed.
+  Next: commit this ledger update to `feature/oc-110-runtime-authoring-ux`; OC-110 is ready for final supervisor acceptance.
+
+- 2026-06-15 09:51 NZT - Codex Supervisor: Reviewed OC-110 follow-up commit `1e6db05` and found no remaining blocking issues.
+  GitButler: `feature/oc-110-runtime-authoring-ux` (g0) remains stacked on `supervisor/add-runtime-authoring-ux-task`; `but status -fv` showed clean `zz` after build verification.
+  Findings: none. The previous findings are addressed: new runtime script rows no longer offer `hooks`, new set-variable rows no longer offer folder/collection/environment scopes, existing schema-valid unsupported rows are preserved with visual diagnostics, and runtime execution reports unsupported persisted scopes instead of silently writing runtime variables.
+  Verified: `npm run compile` passed; focused `npx vitest run test/runtimeAuthoringUx.test.ts test/runtimeExecutionService.test.ts test/validationService.test.ts test/schemaRoundTrip.test.ts test/requestTypeUx.test.ts test/webSocketSupport.test.ts test/grpcSupport.test.ts` passed 7 files/69 tests; `node scripts\validate-collection.js examples\demo-api` passed 44/44 files; `npm test` passed 23 files/437 tests; `npm run build` passed.
+  Next: OC-110 is accepted; no follow-up rework required from this review.
 
 ### OC-090 gRPC Streaming
 
diff --git a/examples/demo-api/GraphQL/graphql-health.yml b/examples/demo-api/GraphQL/graphql-health.yml
index 14887e3..8762ca1 100644
--- a/examples/demo-api/GraphQL/graphql-health.yml
+++ b/examples/demo-api/GraphQL/graphql-health.yml
@@ -2,7 +2,7 @@ info:
   name: GraphQL Health
   type: graphql
   seq: 1
-  description: Run node examples/demo-api/server.js first, then send this health query to the local GraphQL fixture.
+  description: Run node examples/demo-api/server.js first, optionally edit assertions in the request Runtime tab, then send this health query.
 graphql:
   method: POST
   url: "{{baseUrl}}/graphql"
diff --git a/examples/demo-api/Runtime/folder.yml b/examples/demo-api/Runtime/folder.yml
index 95397ec..efcf985 100644
--- a/examples/demo-api/Runtime/folder.yml
+++ b/examples/demo-api/Runtime/folder.yml
@@ -1,7 +1,7 @@
 info:
   name: Runtime
   type: folder
-  description: Run `node examples/demo-api/server.js` before sending these runtime demo requests.
+  description: Run `node examples/demo-api/server.js`, then open a request's Runtime tab to edit scripts, tests, assertions, and set-variable actions before sending.
 request:
   headers:
     - name: X-Demo-Folder
diff --git a/examples/demo-api/Runtime/intentional-failure.yml b/examples/demo-api/Runtime/intentional-failure.yml
index 020f013..0a8ff70 100644
--- a/examples/demo-api/Runtime/intentional-failure.yml
+++ b/examples/demo-api/Runtime/intentional-failure.yml
@@ -2,7 +2,7 @@ info:
   name: Runtime Intentional Failure
   type: http
   seq: 3
-  description: Run `node examples/demo-api/server.js`, then send this request to see failing assertions and tests surfaced in the Runtime tab and tool output.
+  description: Run `node examples/demo-api/server.js`, adjust the request Runtime tab, then send to see failing assertions and tests in the response Runtime tab and tool output.
 http:
   method: GET
   url: "{{baseUrl}}/runtime/assert-fail"
diff --git a/examples/demo-api/Runtime/lifecycle-token.yml b/examples/demo-api/Runtime/lifecycle-token.yml
index 8a8a60f..5168a17 100644
--- a/examples/demo-api/Runtime/lifecycle-token.yml
+++ b/examples/demo-api/Runtime/lifecycle-token.yml
@@ -2,7 +2,7 @@ info:
   name: Runtime Lifecycle Token
   type: http
   seq: 1
-  description: Run `node examples/demo-api/server.js`, then send this request to see passing scripts, tests, assertions, logs, and a set-variable action.
+  description: Run `node examples/demo-api/server.js`, edit scripts/assertions/actions in the request Runtime tab if desired, then send to see passing runtime output.
 http:
   method: POST
   url: "{{baseUrl}}/runtime/token"
@@ -34,6 +34,10 @@ runtime:
       code: |-
         pm.test("status is 200", () => pm.expect(pm.response.code).to.eql(200));
         test("token action source exists", () => assert(response.json().nested.owner === "script-owner"));
+    - type: tests
+      disabled: true
+      code: |-
+        test("disabled test is preserved", () => assert(false));
   assertions:
     - expression: res.status
       operator: equals
diff --git a/examples/demo-api/Runtime/scripted-echo.yml b/examples/demo-api/Runtime/scripted-echo.yml
index eaaa8d2..7e16e7c 100644
--- a/examples/demo-api/Runtime/scripted-echo.yml
+++ b/examples/demo-api/Runtime/scripted-echo.yml
@@ -2,7 +2,7 @@ info:
   name: Runtime Scripted Echo
   type: http
   seq: 2
-  description: Run `node examples/demo-api/server.js`, then send this request to verify before-request scripts can set headers and runtime variables before HTTP execution.
+  description: Run `node examples/demo-api/server.js`, edit the before-request script from the request Runtime tab, then send to verify script-authored headers and variables.
 http:
   method: POST
   url: "{{baseUrl}}/runtime/echo"
diff --git a/examples/demo-api/WebSocket/runtime-lifecycle.yml b/examples/demo-api/WebSocket/runtime-lifecycle.yml
index 949dc2f..bbb2a13 100644
--- a/examples/demo-api/WebSocket/runtime-lifecycle.yml
+++ b/examples/demo-api/WebSocket/runtime-lifecycle.yml
@@ -48,4 +48,4 @@ runtime:
       variable:
         scope: runtime
         name: runtimeSocketMessages
-docs: Run `node examples/demo-api/server.js`, select the LOCAL environment, then send this request to see WebSocket before/after scripts, assertions, tests, and set-variable actions.
+docs: Run `node examples/demo-api/server.js`, select the LOCAL environment, optionally edit the request Runtime tab, then send to see WebSocket scripts, assertions, tests, and set-variable actions.
diff --git a/examples/demo-api/gRPC/runtime-unary-lifecycle.yml b/examples/demo-api/gRPC/runtime-unary-lifecycle.yml
index 5b22959..4bd2950 100644
--- a/examples/demo-api/gRPC/runtime-unary-lifecycle.yml
+++ b/examples/demo-api/gRPC/runtime-unary-lifecycle.yml
@@ -59,4 +59,4 @@ runtime:
       variable:
         scope: runtime
         name: grpcRuntimeRequestId
-docs: Run `node examples/demo-api/grpc-server.js`, select the LOCAL environment, then send this request to see unary gRPC metadata/message mutation plus runtime tests, assertions, logs, and set-variable actions.
+docs: Run `node examples/demo-api/grpc-server.js`, select the LOCAL environment, optionally edit the request Runtime tab, then send to see unary gRPC metadata/message mutation plus runtime tests, assertions, logs, and set-variable actions.
diff --git a/schema/missio-extensions.json b/schema/missio-extensions.json
index ca28e8a..5098076 100644
--- a/schema/missio-extensions.json
+++ b/schema/missio-extensions.json
@@ -24,6 +24,10 @@
     {
       "extension": "non-HTTP runtime actions and WebSocket assertions",
       "reason": "Missio runs the same scripts, assertions, tests, and set-variable actions across supported protocol executors. The upstream schema omits some runtime lifecycle fields from WebSocket and gRPC runtime objects, so Missio extends them for protocol parity."
+    },
+    {
+      "extension": "disabled runtime scripts",
+      "reason": "Missio's visual request editor can toggle runtime scripts without deleting them. The disabled flag keeps authored scripts present in YAML while letting the runtime skip them."
     }
   ],
   "definitions": {
@@ -190,6 +194,16 @@
         }
       }
     },
+    {
+      "description": "Allow runtime scripts to be disabled without deleting them",
+      "target": "$defs/Script/properties",
+      "properties": {
+        "disabled": {
+          "type": "boolean",
+          "description": "Whether the runtime script is disabled"
+        }
+      }
+    },
     {
       "description": "Allow runtime actions on gRPC requests",
       "target": "$defs/GrpcRequestRuntime/properties",
diff --git a/schema/opencollectionschema.json b/schema/opencollectionschema.json
index 6dc71ea..e748742 100644
--- a/schema/opencollectionschema.json
+++ b/schema/opencollectionschema.json
@@ -2508,6 +2508,10 @@
         "code": {
           "type": "string",
           "description": "The script code"
+        },
+        "disabled": {
+          "type": "boolean",
+          "description": "Whether the runtime script is disabled"
         }
       },
       "required": [
diff --git a/src/models/schemaRoundTrip.ts b/src/models/schemaRoundTrip.ts
index 02d3cf4..26acaba 100644
--- a/src/models/schemaRoundTrip.ts
+++ b/src/models/schemaRoundTrip.ts
@@ -20,6 +20,40 @@ export interface FormFieldEditorRow extends KeyValueEditorRow {
   partType?: string;
 }
 
+export interface RuntimeScriptEditorRow {
+  type: string;
+  code: string;
+  disabled?: boolean;
+  originalIndex?: number;
+}
+
+export interface RuntimeAssertionEditorRow {
+  expression: string;
+  operator: string;
+  value?: string;
+  disabled?: boolean;
+  description?: string;
+  originalIndex?: number;
+}
+
+export interface RuntimeActionEditorRow {
+  type: string;
+  phase?: string;
+  selectorMethod?: string;
+  selectorExpression?: string;
+  variableScope?: string;
+  variableName?: string;
+  disabled?: boolean;
+  description?: string;
+  originalIndex?: number;
+}
+
+export interface RuntimeEditorModel {
+  scripts?: RuntimeScriptEditorRow[];
+  assertions?: RuntimeAssertionEditorRow[];
+  actions?: RuntimeActionEditorRow[];
+}
+
 export type RequestEditorBodyModel =
   | { kind: 'none'; bodyVariantIndex?: number }
   | { kind: 'raw'; rawType: string; data: string; bodyVariantIndex?: number }
@@ -35,6 +69,7 @@ export interface RequestEditorModel {
   headers?: KeyValueEditorRow[];
   body?: RequestEditorBodyModel;
   auth?: unknown;
+  runtime?: RuntimeEditorModel;
   settings?: Record<string, unknown>;
 }
 
@@ -154,7 +189,7 @@ export function isWebSocketVisualEditableRequest(data: unknown): boolean {
 
 export function isVisualEditableRequest(data: unknown): boolean {
   const protocol = detectRequestProtocol(data);
-  return (protocol === undefined || protocol === 'http' || protocol === 'graphql' || protocol === 'websocket') && !isScriptDocument(data);
+  return (protocol === undefined || protocol === 'http' || protocol === 'graphql' || protocol === 'websocket' || protocol === 'grpc') && !isScriptDocument(data);
 }
 
 function withOptionalDisabled<T extends Record<string, unknown>>(
@@ -182,6 +217,11 @@ function getByOriginalIndex<T>(items: T[] | undefined, row: { originalIndex?: nu
   return items[index];
 }
 
+function getByExplicitOriginalIndex<T>(items: T[] | undefined, row: { originalIndex?: number }): T | undefined {
+  if (!items || row.originalIndex === undefined) return undefined;
+  return items[row.originalIndex];
+}
+
 function mergeHeaders(previous: unknown[] | undefined, rows: KeyValueEditorRow[] | undefined): unknown[] | undefined {
   if (!rows) return undefined;
   if (rows.length === 0) return Array.isArray(previous) ? [] : undefined;
@@ -259,6 +299,17 @@ function selectedWebSocketMessage(message: unknown): { message: unknown; index?:
   };
 }
 
+function selectedGrpcMessage(message: unknown): { message: unknown; index?: number } {
+  if (!Array.isArray(message)) return { message };
+  const selectedIndex = message.findIndex(variant => isObject(variant) && variant.selected === true);
+  const index = selectedIndex >= 0 ? selectedIndex : 0;
+  const variant = message[index];
+  return {
+    message: isObject(variant) && typeof variant.message === 'string' ? variant.message : undefined,
+    index,
+  };
+}
+
 function selectedFileVariant(body: unknown): { variant: unknown; index?: number } {
   if (!isObject(body) || !Array.isArray(body.data)) return { variant: undefined };
   const selectedIndex = body.data.findIndex(variant => isObject(variant) && variant.selected === true);
@@ -283,6 +334,79 @@ function formRowsFromBody(body: Record<string, unknown>): FormFieldEditorRow[] {
   });
 }
 
+function descriptionToText(description: unknown): string | undefined {
+  if (typeof description === 'string') return description;
+  if (isObject(description) && typeof description.content === 'string') return description.content;
+  return undefined;
+}
+
+function mergeDescription(output: Record<string, unknown>, prior: unknown, description: string | undefined): void {
+  const priorDescription = isObject(prior) ? prior.description : undefined;
+  if (description === undefined) return;
+  if (description) {
+    if (description === descriptionToText(priorDescription)) {
+      output.description = cloneJson(priorDescription);
+    } else if (isObject(priorDescription) && typeof priorDescription.content === 'string') {
+      output.description = {
+        ...cloneJson(priorDescription),
+        content: description,
+      };
+    } else {
+      output.description = description;
+    }
+  } else if (hasOwn(prior, 'description')) {
+    delete output.description;
+  }
+}
+
+function createRuntimeEditorModel(runtime: unknown): RuntimeEditorModel {
+  const source = isObject(runtime) ? runtime : {};
+  return {
+    scripts: Array.isArray(source.scripts)
+      ? source.scripts.map((script, index) => {
+          const row = isObject(script) ? script : {};
+          return {
+            type: typeof row.type === 'string' ? row.type : 'before-request',
+            code: typeof row.code === 'string' ? row.code : '',
+            disabled: row.disabled === true,
+            originalIndex: index,
+          };
+        })
+      : [],
+    assertions: Array.isArray(source.assertions)
+      ? source.assertions.map((assertion, index) => {
+          const row = isObject(assertion) ? assertion : {};
+          return {
+            expression: typeof row.expression === 'string' ? row.expression : '',
+            operator: typeof row.operator === 'string' ? row.operator : 'equals',
+            value: typeof row.value === 'string' ? row.value : row.value === undefined ? undefined : displayValue(row.value),
+            disabled: row.disabled === true,
+            description: descriptionToText(row.description),
+            originalIndex: index,
+          };
+        })
+      : [],
+    actions: Array.isArray(source.actions)
+      ? source.actions.map((action, index) => {
+          const row = isObject(action) ? action : {};
+          const selector = isObject(row.selector) ? row.selector : {};
+          const variable = isObject(row.variable) ? row.variable : {};
+          return {
+            type: typeof row.type === 'string' ? row.type : 'set-variable',
+            phase: typeof row.phase === 'string' ? row.phase : 'after-response',
+            selectorMethod: typeof selector.method === 'string' ? selector.method : 'jsonq',
+            selectorExpression: typeof selector.expression === 'string' ? selector.expression : '',
+            variableScope: typeof variable.scope === 'string' ? variable.scope : 'runtime',
+            variableName: typeof variable.name === 'string' ? variable.name : '',
+            disabled: row.disabled === true,
+            description: descriptionToText(row.description),
+            originalIndex: index,
+          };
+        })
+      : [],
+  };
+}
+
 export function createRequestEditorModelFromRequest(request: unknown): RequestEditorModel {
   const protocol = detectRequestProtocol(request) ?? 'http';
   const source = isObject(request) ? request : {};
@@ -327,6 +451,7 @@ export function createRequestEditorModelFromRequest(request: unknown): RequestEd
         bodyVariantIndex,
       },
       auth: runtime.auth,
+      runtime: createRuntimeEditorModel(runtime),
       settings: isObject(source.settings) ? cloneJson(source.settings) : {},
     };
   }
@@ -363,6 +488,34 @@ export function createRequestEditorModelFromRequest(request: unknown): RequestEd
           }
         : { kind: 'none', bodyVariantIndex: messageVariantIndex },
       auth: runtime.auth,
+      runtime: createRuntimeEditorModel(runtime),
+    };
+  }
+
+  if (protocol === 'grpc') {
+    const grpc = isObject(source.grpc) ? source.grpc : {};
+    const runtime = isObject(source.runtime) ? source.runtime : {};
+    const { message, index: messageIndex } = selectedGrpcMessage(grpc.message);
+
+    return {
+      protocol,
+      url: typeof grpc.url === 'string' ? grpc.url : '',
+      headers: Array.isArray(grpc.metadata)
+        ? grpc.metadata.map((metadata, index) => {
+            const row = isObject(metadata) ? metadata : {};
+            return {
+              name: typeof row.name === 'string' ? row.name : '',
+              value: typeof row.value === 'string' ? row.value : '',
+              disabled: row.disabled === true,
+              originalIndex: index,
+            };
+          })
+        : [],
+      body: typeof message === 'string'
+        ? { kind: 'raw', rawType: 'json', data: message, bodyVariantIndex: messageIndex }
+        : { kind: 'none', bodyVariantIndex: messageIndex },
+      auth: runtime.auth,
+      runtime: createRuntimeEditorModel(runtime),
     };
   }
 
@@ -432,6 +585,7 @@ export function createRequestEditorModelFromRequest(request: unknown): RequestEd
       : [],
     body: bodyModel,
     auth: runtime.auth,
+    runtime: createRuntimeEditorModel(runtime),
     settings: isObject(source.settings) ? cloneJson(source.settings) : {},
   };
 }
@@ -597,6 +751,124 @@ function buildWebSocketMessageFromEditor(originalMessage: unknown, model: Reques
   return variants;
 }
 
+function buildGrpcMessageFromEditor(originalMessage: unknown, model: RequestEditorBodyModel): unknown | undefined {
+  if (model.kind === 'none') return undefined;
+  if (model.kind !== 'raw') return selectedGrpcMessage(originalMessage).message;
+
+  if (!Array.isArray(originalMessage)) {
+    return originalMessage === undefined && model.data === '' ? undefined : model.data;
+  }
+
+  const messages = cloneJson(originalMessage);
+  const index = model.bodyVariantIndex ?? messages.findIndex(variant => isObject(variant) && variant.selected === true);
+  const resolvedIndex = index >= 0 ? index : 0;
+  const previousEntry = isObject(messages[resolvedIndex]) ? messages[resolvedIndex] as Record<string, unknown> : {};
+  messages[resolvedIndex] = {
+    ...previousEntry,
+    message: model.data,
+  };
+  return messages;
+}
+
+function mergeRuntimeScripts(previous: unknown[] | undefined, rows: RuntimeScriptEditorRow[] | undefined): unknown[] | undefined {
+  if (!rows) return undefined;
+  if (rows.length === 0) return Array.isArray(previous) ? [] : undefined;
+  return rows
+    .filter(row => row.type && row.code !== undefined)
+    .map((row) => {
+      const prior = getByExplicitOriginalIndex(previous, row);
+      const output: Record<string, unknown> = isObject(prior) ? cloneJson(prior) : {};
+      output.type = row.type;
+      output.code = row.code;
+      return withOptionalDisabled(output, prior, row.disabled);
+    });
+}
+
+function mergeRuntimeAssertions(previous: unknown[] | undefined, rows: RuntimeAssertionEditorRow[] | undefined): unknown[] | undefined {
+  if (!rows) return undefined;
+  if (rows.length === 0) return Array.isArray(previous) ? [] : undefined;
+  const assertions: unknown[] = [];
+  for (const row of rows) {
+    const prior = getByExplicitOriginalIndex(previous, row);
+    if (!row.expression || !row.operator) {
+      if (isObject(prior)) assertions.push(cloneJson(prior));
+      continue;
+    }
+    const output: Record<string, unknown> = isObject(prior) ? cloneJson(prior) : {};
+    output.expression = row.expression;
+    output.operator = row.operator;
+    if (row.value || hasOwn(prior, 'value')) output.value = row.value ?? '';
+    else delete output.value;
+    mergeDescription(output, prior, row.description);
+    assertions.push(withOptionalDisabled(output, prior, row.disabled));
+  }
+  return assertions;
+}
+
+function mergeRuntimeActions(previous: unknown[] | undefined, rows: RuntimeActionEditorRow[] | undefined): unknown[] | undefined {
+  if (!rows) return undefined;
+  if (rows.length === 0) return Array.isArray(previous) ? [] : undefined;
+  const actions: unknown[] = [];
+  for (const row of rows) {
+    const prior = getByExplicitOriginalIndex(previous, row);
+    if (row.type !== 'set-variable' || !row.selectorExpression || !row.variableName) {
+      if (isObject(prior)) actions.push(cloneJson(prior));
+      continue;
+    }
+    const output: Record<string, unknown> = isObject(prior) ? cloneJson(prior) : {};
+    output.type = 'set-variable';
+    if (row.phase || hasOwn(prior, 'phase')) output.phase = row.phase || 'after-response';
+    else delete output.phase;
+    output.selector = {
+      ...(isObject(output.selector) ? output.selector : {}),
+      method: row.selectorMethod || 'jsonq',
+      expression: row.selectorExpression,
+    };
+    output.variable = {
+      ...(isObject(output.variable) ? output.variable : {}),
+      scope: row.variableScope || 'runtime',
+      name: row.variableName,
+    };
+    mergeDescription(output, prior, row.description);
+    actions.push(withOptionalDisabled(output, prior, row.disabled));
+  }
+  return actions;
+}
+
+function mergeRuntime(
+  previous: unknown,
+  auth: unknown,
+  authProvided: boolean,
+  runtimeModel: RuntimeEditorModel | undefined,
+): Record<string, unknown> | undefined {
+  const runtime: Record<string, unknown> = isObject(previous) ? cloneJson(previous) : {};
+
+  if (authProvided) {
+    if (auth !== undefined) runtime.auth = cloneJson(auth);
+    else delete runtime.auth;
+  }
+
+  if (runtimeModel) {
+    if (hasOwn(runtimeModel, 'scripts')) {
+      const scripts = mergeRuntimeScripts(Array.isArray(runtime.scripts) ? runtime.scripts : undefined, runtimeModel.scripts);
+      if (scripts) runtime.scripts = scripts;
+      else delete runtime.scripts;
+    }
+    if (hasOwn(runtimeModel, 'assertions')) {
+      const assertions = mergeRuntimeAssertions(Array.isArray(runtime.assertions) ? runtime.assertions : undefined, runtimeModel.assertions);
+      if (assertions) runtime.assertions = assertions;
+      else delete runtime.assertions;
+    }
+    if (hasOwn(runtimeModel, 'actions')) {
+      const actions = mergeRuntimeActions(Array.isArray(runtime.actions) ? runtime.actions : undefined, runtimeModel.actions);
+      if (actions) runtime.actions = actions;
+      else delete runtime.actions;
+    }
+  }
+
+  return isEmptyObject(runtime) ? undefined : runtime;
+}
+
 function mergeSettings(previous: unknown, settings: Record<string, unknown> | undefined): Record<string, unknown> | undefined {
   if (!settings) return isObject(previous) ? cloneJson(previous) : undefined;
   const output: Record<string, unknown> = isObject(previous) ? cloneJson(previous) : {};
@@ -614,7 +886,7 @@ function mergeSettings(previous: unknown, settings: Record<string, unknown> | un
 }
 
 export function applyRequestEditorModel(original: unknown, model: RequestEditorModel): unknown {
-  if (!isVisualEditableRequest(original) || (model.protocol && model.protocol !== 'http' && model.protocol !== 'graphql' && model.protocol !== 'websocket')) {
+  if (!isVisualEditableRequest(original) || (model.protocol && model.protocol !== 'http' && model.protocol !== 'graphql' && model.protocol !== 'websocket' && model.protocol !== 'grpc')) {
     return cloneJson(original);
   }
 
@@ -648,13 +920,9 @@ export function applyRequestEditorModel(original: unknown, model: RequestEditorM
       else graphql.body = body;
     }
 
-    if (model.auth !== undefined || isObject(request.runtime)) {
-      const runtime: Record<string, unknown> = isObject(request.runtime) ? cloneJson(request.runtime) : {};
-      if (model.auth !== undefined) runtime.auth = cloneJson(model.auth);
-      else delete runtime.auth;
-      if (isEmptyObject(runtime)) delete request.runtime;
-      else request.runtime = runtime;
-    }
+    const runtime = mergeRuntime(request.runtime, model.auth, hasOwn(model, 'auth'), model.runtime);
+    if (runtime) request.runtime = runtime;
+    else delete request.runtime;
 
     const settings = mergeSettings(request.settings, model.settings);
     if (settings) request.settings = settings;
@@ -685,14 +953,40 @@ export function applyRequestEditorModel(original: unknown, model: RequestEditorM
       else websocket.message = message;
     }
 
-    if (model.auth !== undefined || isObject(request.runtime)) {
-      const runtime: Record<string, unknown> = isObject(request.runtime) ? cloneJson(request.runtime) : {};
-      if (model.auth !== undefined) runtime.auth = cloneJson(model.auth);
-      else delete runtime.auth;
-      if (isEmptyObject(runtime)) delete request.runtime;
-      else request.runtime = runtime;
+    const runtime = mergeRuntime(request.runtime, model.auth, hasOwn(model, 'auth'), model.runtime);
+    if (runtime) request.runtime = runtime;
+    else delete request.runtime;
+
+    return request;
+  }
+
+  if (targetProtocol === 'grpc') {
+    const source = isObject(original) ? original : {};
+    const request: Record<string, unknown> = cloneJson(source);
+    if (!isObject(request.info)) request.info = { type: 'grpc' };
+    else (request.info as Record<string, unknown>).type = 'grpc';
+    if (!isObject(request.grpc)) request.grpc = {};
+    delete request.http;
+    delete request.graphql;
+    delete request.websocket;
+
+    const grpc = request.grpc as Record<string, unknown>;
+    if (model.url !== undefined) grpc.url = model.url;
+    if (model.headers !== undefined) {
+      const merged = mergeMetadata(Array.isArray(grpc.metadata) ? grpc.metadata : undefined, model.headers);
+      if (merged) grpc.metadata = merged;
+      else delete grpc.metadata;
+    }
+    if (model.body !== undefined) {
+      const message = buildGrpcMessageFromEditor(grpc.message, model.body);
+      if (message === undefined) delete grpc.message;
+      else grpc.message = message;
     }
 
+    const runtime = mergeRuntime(request.runtime, model.auth, hasOwn(model, 'auth'), model.runtime);
+    if (runtime) request.runtime = runtime;
+    else delete request.runtime;
+
     return request;
   }
 
@@ -720,13 +1014,9 @@ export function applyRequestEditorModel(original: unknown, model: RequestEditorM
     else http.body = body;
   }
 
-  if (model.auth !== undefined || isObject(request.runtime)) {
-    const runtime: Record<string, unknown> = isObject(request.runtime) ? cloneJson(request.runtime) : {};
-    if (model.auth !== undefined) runtime.auth = cloneJson(model.auth);
-    else delete runtime.auth;
-    if (isEmptyObject(runtime)) delete request.runtime;
-    else request.runtime = runtime;
-  }
+  const runtime = mergeRuntime(request.runtime, model.auth, hasOwn(model, 'auth'), model.runtime);
+  if (runtime) request.runtime = runtime;
+  else delete request.runtime;
 
   const settings = mergeSettings(request.settings, model.settings);
   if (settings) request.settings = settings;
diff --git a/src/models/types.ts b/src/models/types.ts
index fc8856a..0fa4400 100644
--- a/src/models/types.ts
+++ b/src/models/types.ts
@@ -69,6 +69,7 @@ export type ScriptType = 'before-request' | 'after-response' | 'tests' | 'hooks'
 export interface Script {
   type: ScriptType;
   code: string;
+  disabled?: boolean;
 }
 
 export type Scripts = Script[];
diff --git a/src/panels/requestPanel.ts b/src/panels/requestPanel.ts
index 99fabd8..74f4eb5 100644
--- a/src/panels/requestPanel.ts
+++ b/src/panels/requestPanel.ts
@@ -839,6 +839,7 @@ export class RequestEditorProvider extends BaseEditorProvider {
         <div class="tab" data-tab="auth">Auth</div>
         <div class="tab" data-tab="headers">Headers <span class="badge" id="headersBadge">0</span></div>
         <div class="tab" data-tab="params">Params <span class="badge" id="paramsBadge">0</span></div>
+        <div class="tab" data-tab="runtime">Runtime <span class="badge" id="runtimeBadge">0</span></div>
         <div class="tab" data-tab="settings">Settings</div>
         <div class="tab" data-tab="export">Export</div>
       </div>
@@ -947,6 +948,35 @@ export class RequestEditorProvider extends BaseEditorProvider {
             </div>
           </div>
         </div>
+        <!-- Runtime -->
+        <div class="tab-panel" id="panel-runtime">
+          <div class="runtime-authoring">
+            <section class="runtime-authoring-section">
+              <div class="runtime-authoring-header">
+                <h3>Scripts</h3>
+                <div class="runtime-authoring-actions">
+                  <button class="btn btn-secondary" id="addRuntimeScriptBtn" type="button">Add Script</button>
+                  <button class="btn btn-secondary" id="addRuntimeTestBtn" type="button">Add Test</button>
+                </div>
+              </div>
+              <div class="runtime-list" id="runtimeScriptsList"></div>
+            </section>
+            <section class="runtime-authoring-section">
+              <div class="runtime-authoring-header">
+                <h3>Assertions</h3>
+                <button class="btn btn-secondary" id="addRuntimeAssertionBtn" type="button">Add Assertion</button>
+              </div>
+              <div class="runtime-list" id="runtimeAssertionsList"></div>
+            </section>
+            <section class="runtime-authoring-section">
+              <div class="runtime-authoring-header">
+                <h3>Actions</h3>
+                <button class="btn btn-secondary" id="addRuntimeActionBtn" type="button">Add Action</button>
+              </div>
+              <div class="runtime-list" id="runtimeActionsList"></div>
+            </section>
+          </div>
+        </div>
         <!-- Export -->
         <div class="tab-panel" id="panel-export">
           <div class="export-toolbar">
diff --git a/src/services/runtimeExecutionService.ts b/src/services/runtimeExecutionService.ts
index c7336b7..13177cb 100644
--- a/src/services/runtimeExecutionService.ts
+++ b/src/services/runtimeExecutionService.ts
@@ -364,6 +364,16 @@ export class RuntimeExecutionService {
       };
     }
 
+    if (!isSupportedVariableMutationScope(action.variable.scope)) {
+      return {
+        type: action.type,
+        phase,
+        passed: false,
+        target: `${action.variable.scope}.${action.variable.name}`,
+        message: unsupportedVariableScopeMessage(action.variable.scope),
+      };
+    }
+
     const value = evaluateJsonSelector(action.selector.expression, state);
     if (value === undefined) {
       return {
@@ -444,7 +454,7 @@ function lifecycleScripts(
     ...(collectionScripts ?? []),
     ...(folderScripts ?? []),
     ...(requestScripts ?? []),
-  ].filter(script => script.type === type);
+  ].filter(script => !script.disabled && script.type === type);
 }
 
 function cloneJson<T>(value: T): T {
@@ -516,7 +526,8 @@ function makeVariablesApi(state: RuntimeState): Record<string, unknown> {
     },
     unset: (name: string, scope: ActionVariableScope = 'runtime') => {
       if (scope === 'request') state.variables.request.delete(String(name));
-      else state.variables.runtime.delete(String(name));
+      else if (scope === 'runtime') state.variables.runtime.delete(String(name));
+      else throw new Error(unsupportedVariableScopeMessage(scope));
     },
     toObject: () => Object.fromEntries(buildVisibleVariables(state.variables)),
   });
@@ -931,10 +942,19 @@ function setRuntimeVariable(
   source: RuntimeVariableMutation['source'],
 ): void {
   if (scope === 'request') state.variables.request.set(name, value);
-  else state.variables.runtime.set(name, value);
+  else if (scope === 'runtime') state.variables.runtime.set(name, value);
+  else throw new Error(unsupportedVariableScopeMessage(scope));
   state.result.variableMutations.push({ scope, name, value, source });
 }
 
+function isSupportedVariableMutationScope(scope: ActionVariableScope): boolean {
+  return scope === 'runtime' || scope === 'request';
+}
+
+function unsupportedVariableScopeMessage(scope: ActionVariableScope): string {
+  return `Unsupported variable scope: ${String(scope)}. Missio currently supports runtime and request set-variable scopes.`;
+}
+
 function evaluateJsonSelector(expression: string, state: RuntimeState): unknown {
   const root = state.response
     ? parseMaybeJson(state.response.body)
diff --git a/src/webview/requestPanel.css b/src/webview/requestPanel.css
index 9b0f815..39b09e0 100644
--- a/src/webview/requestPanel.css
+++ b/src/webview/requestPanel.css
@@ -464,6 +464,160 @@ body {
 .tab-panel { display: none; height: 100%; }
 .tab-panel.active { display: flex; flex-direction: column; }
 
+/* Runtime Authoring */
+.runtime-authoring {
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+  min-height: 0;
+  padding-bottom: 8px;
+}
+.runtime-authoring-section {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+.runtime-authoring-header {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  min-height: 28px;
+}
+.runtime-authoring-header h3 {
+  font-size: 11px;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.5px;
+  color: var(--m-fg-muted);
+  flex: 1;
+}
+.runtime-authoring-actions {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  flex-wrap: wrap;
+}
+.runtime-list {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+.runtime-list:empty::before {
+  content: 'No entries';
+  border: 1px dashed var(--border);
+  border-radius: 4px;
+  color: var(--m-fg-dim);
+  font-size: 12px;
+  padding: 10px 12px;
+}
+.runtime-editor-row {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  border: 1px solid var(--border);
+  border-radius: 4px;
+  padding: 8px;
+  background: var(--vscode-editor-background, var(--bg));
+}
+.runtime-row-toolbar {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  min-width: 0;
+  flex-wrap: wrap;
+}
+.runtime-enabled {
+  margin-right: 2px;
+}
+.runtime-select,
+.runtime-input,
+.runtime-code {
+  background: var(--input-bg);
+  color: var(--input-fg);
+  border: 1px solid var(--input-border);
+  border-radius: 4px;
+  font-size: 12px;
+  font-family: var(--vscode-editor-font-family, monospace);
+  outline: none;
+}
+.runtime-select {
+  min-width: 132px;
+  padding: 4px 8px;
+}
+.runtime-input {
+  min-width: 120px;
+  flex: 1 1 160px;
+  padding: 5px 8px;
+}
+.runtime-description {
+  flex-basis: 100%;
+}
+.rt-assertion-expression,
+.rt-action-selector {
+  flex-basis: 220px;
+}
+.rt-action-name {
+  flex-basis: 140px;
+}
+.runtime-code {
+  width: 100%;
+  min-height: 86px;
+  resize: vertical;
+  padding: 8px 10px;
+  line-height: 1.45;
+}
+.runtime-select:focus,
+.runtime-input:focus,
+.runtime-code:focus {
+  border-color: var(--btn-bg);
+  outline: 1px solid var(--btn-bg);
+}
+.runtime-action-type {
+  color: var(--m-fg-muted);
+  border: 1px solid var(--border);
+  border-radius: 4px;
+  padding: 4px 8px;
+  font-family: var(--vscode-editor-font-family, monospace);
+  font-size: 12px;
+  white-space: nowrap;
+}
+.runtime-unsupported-row {
+  border-color: var(--vscode-inputValidation-warningBorder, #cca700);
+}
+.runtime-unsupported-note {
+  color: var(--vscode-inputValidation-warningForeground, var(--fg));
+  background: var(--vscode-inputValidation-warningBackground, rgba(204, 167, 0, 0.16));
+  border: 1px solid var(--vscode-inputValidation-warningBorder, #cca700);
+  border-radius: 4px;
+  padding: 4px 8px;
+  font-size: 12px;
+  white-space: nowrap;
+}
+.runtime-row-actions {
+  display: flex;
+  gap: 4px;
+  margin-left: auto;
+}
+.runtime-icon-btn {
+  width: 28px;
+  height: 28px;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  border: 1px solid var(--input-border);
+  border-radius: 4px;
+  background: transparent;
+  color: var(--fg);
+  cursor: pointer;
+  font-family: inherit;
+  font-size: 14px;
+  line-height: 1;
+}
+.runtime-icon-btn:hover {
+  border-color: var(--btn-bg);
+  background: var(--vscode-toolbar-hoverBackground, rgba(90, 93, 94, 0.31));
+}
+
 /* ── Resizable Divider ───────────────────── */
 .divider {
   height: 4px;
diff --git a/src/webview/requestPanel.ts b/src/webview/requestPanel.ts
index 902bfb0..6c76541 100644
--- a/src/webview/requestPanel.ts
+++ b/src/webview/requestPanel.ts
@@ -84,6 +84,7 @@ import {
   type KeyValueEditorRow,
   type RequestEditorBodyModel,
   type RequestEditorModel,
+  type RuntimeEditorModel,
 } from '../models/schemaRoundTrip';
 
 // ── Document update scheduling ───────────────────
@@ -102,7 +103,7 @@ function scheduleDocumentUpdate(): void {
 }
 
 // ── Tab switching ──────────────────────────────
-const reqPanelIds = ['body', 'auth', 'headers', 'params', 'settings', 'export'];
+const reqPanelIds = ['body', 'auth', 'headers', 'params', 'runtime', 'settings', 'export'];
 const respPanelIds = ['resp-body', 'resp-headers', 'resp-runtime', 'resp-preview'];
 
 function updateBodyFormatterState(): void {
@@ -568,11 +569,204 @@ function addFormField(name = '', value: unknown = '', disabled = false, partType
   tbody.appendChild(tr);
 }
 
+const runtimeScriptTypes = ['before-request', 'after-response', 'tests'];
+const runtimeAssertionOperators = [
+  'equals',
+  'not-equals',
+  'contains',
+  'exists',
+  'not-exists',
+  'greater-than',
+  'greater-than-or-equal',
+  'less-than',
+  'less-than-or-equal',
+  'matches',
+];
+const runtimeActionPhases = ['before-request', 'after-response'];
+const runtimeVariableScopes = ['runtime', 'request'];
+const unsupportedRuntimeScriptTypeLabels: Record<string, string> = {
+  hooks: 'hooks (not executed)',
+};
+const unsupportedRuntimeVariableScopeLabels: Record<string, string> = {
+  folder: 'folder (not persisted)',
+  collection: 'collection (not persisted)',
+  environment: 'environment (not persisted)',
+};
+
+function unsupportedRuntimeOptionLabel(value: string, labels: Record<string, string>): string {
+  return labels[value] ?? `${value} (unsupported)`;
+}
+
+function optionsHtml(values: string[], selected: string | undefined, unsupportedLabels?: Record<string, string>): string {
+  const knownOptions = values.map(value => '<option value="' + esc(value) + '"' + (value === selected ? ' selected' : '') + '>' + esc(value) + '</option>').join('');
+  if (selected && !values.includes(selected)) {
+    return '<option value="' + esc(selected) + '" selected disabled data-runtime-unsupported="true">' + esc(unsupportedRuntimeOptionLabel(selected, unsupportedLabels ?? {})) + '</option>' + knownOptions;
+  }
+  return knownOptions;
+}
+
+function moveRuntimeRow(row: HTMLElement, direction: -1 | 1): void {
+  const sibling = direction < 0 ? row.previousElementSibling : row.nextElementSibling;
+  if (!sibling || !row.parentElement) return;
+  if (direction < 0) row.parentElement.insertBefore(row, sibling);
+  else row.parentElement.insertBefore(sibling, row);
+  scheduleDocumentUpdate();
+}
+
+function wireRuntimeRow(row: HTMLElement): void {
+  row.addEventListener('input', scheduleDocumentUpdate);
+  row.addEventListener('change', scheduleDocumentUpdate);
+  row.querySelector<HTMLButtonElement>('.runtime-move-up')?.addEventListener('click', () => moveRuntimeRow(row, -1));
+  row.querySelector<HTMLButtonElement>('.runtime-move-down')?.addEventListener('click', () => moveRuntimeRow(row, 1));
+  row.querySelector<HTMLButtonElement>('.runtime-delete')?.addEventListener('click', () => {
+    row.remove();
+    updateRuntimeBadge();
+    scheduleDocumentUpdate();
+  });
+}
+
+function addRuntimeScript(type = 'before-request', code = '', disabled = false, originalIndex?: number): void {
+  const list = $('runtimeScriptsList');
+  const row = document.createElement('div');
+  row.className = 'runtime-editor-row runtime-script-row';
+  const unsupportedType = !runtimeScriptTypes.includes(type);
+  if (unsupportedType) row.classList.add('runtime-unsupported-row');
+  if (originalIndex !== undefined) row.dataset.originalIndex = String(originalIndex);
+  row.innerHTML =
+    '<div class="runtime-row-toolbar">' +
+      '<input type="checkbox" class="runtime-enabled rt-script-enabled" title="Enabled" ' + (disabled ? '' : 'checked') + ' />' +
+      '<select class="runtime-select rt-script-type">' + optionsHtml(runtimeScriptTypes, type, unsupportedRuntimeScriptTypeLabels) + '</select>' +
+      (unsupportedType ? '<span class="runtime-unsupported-note" title="This schema-valid script type is not executed by the Missio runtime yet.">Not executed</span>' : '') +
+      '<div class="runtime-row-actions">' +
+        '<button class="runtime-icon-btn runtime-move-up" type="button" title="Move up">&#8593;</button>' +
+        '<button class="runtime-icon-btn runtime-move-down" type="button" title="Move down">&#8595;</button>' +
+        '<button class="runtime-icon-btn runtime-delete" type="button" title="Remove">&times;</button>' +
+      '</div>' +
+    '</div>' +
+    '<textarea class="runtime-code rt-script-code" spellcheck="false" placeholder="JavaScript">' + esc(code) + '</textarea>';
+  wireRuntimeRow(row);
+  list.appendChild(row);
+  updateRuntimeBadge();
+}
+
+function addRuntimeAssertion(
+  expression = 'res.status',
+  operator = 'equals',
+  value = '200',
+  disabled = false,
+  description = '',
+  originalIndex?: number,
+): void {
+  const list = $('runtimeAssertionsList');
+  const row = document.createElement('div');
+  row.className = 'runtime-editor-row runtime-assertion-row';
+  if (originalIndex !== undefined) row.dataset.originalIndex = String(originalIndex);
+  row.innerHTML =
+    '<div class="runtime-row-toolbar">' +
+      '<input type="checkbox" class="runtime-enabled rt-assertion-enabled" title="Enabled" ' + (disabled ? '' : 'checked') + ' />' +
+      '<input type="text" class="runtime-input rt-assertion-expression" value="' + esc(expression) + '" placeholder="res.status" />' +
+      '<select class="runtime-select rt-assertion-operator">' + optionsHtml(runtimeAssertionOperators, operator) + '</select>' +
+      '<input type="text" class="runtime-input rt-assertion-value" value="' + esc(value) + '" placeholder="expected" />' +
+      '<div class="runtime-row-actions">' +
+        '<button class="runtime-icon-btn runtime-move-up" type="button" title="Move up">&#8593;</button>' +
+        '<button class="runtime-icon-btn runtime-move-down" type="button" title="Move down">&#8595;</button>' +
+        '<button class="runtime-icon-btn runtime-delete" type="button" title="Remove">&times;</button>' +
+      '</div>' +
+    '</div>' +
+    '<input type="text" class="runtime-input runtime-description rt-assertion-description" value="' + esc(description) + '" placeholder="description" />';
+  wireRuntimeRow(row);
+  list.appendChild(row);
+  updateRuntimeBadge();
+}
+
+function addRuntimeAction(
+  phase = 'after-response',
+  selectorExpression = '$.token',
+  variableScope = 'runtime',
+  variableName = 'token',
+  disabled = false,
+  description = '',
+  originalIndex?: number,
+): void {
+  const list = $('runtimeActionsList');
+  const row = document.createElement('div');
+  row.className = 'runtime-editor-row runtime-action-row';
+  const unsupportedScope = !runtimeVariableScopes.includes(variableScope);
+  if (unsupportedScope) row.classList.add('runtime-unsupported-row');
+  if (originalIndex !== undefined) row.dataset.originalIndex = String(originalIndex);
+  row.innerHTML =
+    '<div class="runtime-row-toolbar">' +
+      '<input type="checkbox" class="runtime-enabled rt-action-enabled" title="Enabled" ' + (disabled ? '' : 'checked') + ' />' +
+      '<select class="runtime-select rt-action-phase">' + optionsHtml(runtimeActionPhases, phase) + '</select>' +
+      '<span class="runtime-action-type">set-variable</span>' +
+      '<input type="text" class="runtime-input rt-action-selector" value="' + esc(selectorExpression) + '" placeholder="$.token" />' +
+      '<select class="runtime-select rt-action-scope">' + optionsHtml(runtimeVariableScopes, variableScope, unsupportedRuntimeVariableScopeLabels) + '</select>' +
+      '<input type="text" class="runtime-input rt-action-name" value="' + esc(variableName) + '" placeholder="name" />' +
+      (unsupportedScope ? '<span class="runtime-unsupported-note" title="This schema-valid scope is not persisted by the Missio runtime yet.">Not persisted</span>' : '') +
+      '<div class="runtime-row-actions">' +
+        '<button class="runtime-icon-btn runtime-move-up" type="button" title="Move up">&#8593;</button>' +
+        '<button class="runtime-icon-btn runtime-move-down" type="button" title="Move down">&#8595;</button>' +
+        '<button class="runtime-icon-btn runtime-delete" type="button" title="Remove">&times;</button>' +
+      '</div>' +
+    '</div>' +
+    '<input type="text" class="runtime-input runtime-description rt-action-description" value="' + esc(description) + '" placeholder="description" />';
+  wireRuntimeRow(row);
+  list.appendChild(row);
+  updateRuntimeBadge();
+}
+
+function loadRuntimeEditor(runtime: any): void {
+  $('runtimeScriptsList').innerHTML = '';
+  $('runtimeAssertionsList').innerHTML = '';
+  $('runtimeActionsList').innerHTML = '';
+  (runtime?.scripts || []).forEach((script: any, index: number) => {
+    addRuntimeScript(script.type || 'before-request', script.code || '', script.disabled, index);
+  });
+  (runtime?.assertions || []).forEach((assertion: any, index: number) => {
+    const description = typeof assertion.description === 'string'
+      ? assertion.description
+      : assertion.description?.content || '';
+    addRuntimeAssertion(
+      assertion.expression || '',
+      assertion.operator || 'equals',
+      assertion.value ?? '',
+      assertion.disabled,
+      description,
+      index,
+    );
+  });
+  (runtime?.actions || []).forEach((action: any, index: number) => {
+    const description = typeof action.description === 'string'
+      ? action.description
+      : action.description?.content || '';
+    addRuntimeAction(
+      action.phase || 'after-response',
+      action.selector?.expression || '',
+      action.variable?.scope || 'runtime',
+      action.variable?.name || '',
+      action.disabled,
+      description,
+      index,
+    );
+  });
+  updateRuntimeBadge();
+}
+
+function updateRuntimeBadge(): void {
+  const count =
+    document.querySelectorAll('#runtimeScriptsList .runtime-editor-row').length +
+    document.querySelectorAll('#runtimeAssertionsList .runtime-editor-row').length +
+    document.querySelectorAll('#runtimeActionsList .runtime-editor-row').length;
+  const badge = document.getElementById('runtimeBadge');
+  if (badge) badge.textContent = String(count);
+}
+
 function updateBadges(): void {
   const params = document.querySelectorAll('#paramsBody tr');
   const headers = document.querySelectorAll('#headersBody tr:not(.auto-header)');
   $('paramsBadge').textContent = String(params.length);
   $('headersBadge').textContent = String(headers.length);
+  updateRuntimeBadge();
 }
 
 // ── Body Type (pills) ───────────────────────────
@@ -1128,6 +1322,47 @@ function collectBodyModel(): RequestEditorBodyModel {
   };
 }
 
+function collectRuntimeModel(): RuntimeEditorModel {
+  const scripts: RuntimeEditorModel['scripts'] = [];
+  document.querySelectorAll('#runtimeScriptsList .runtime-script-row').forEach((row) => {
+    scripts.push({
+      type: (row.querySelector('.rt-script-type') as HTMLSelectElement).value,
+      code: (row.querySelector('.rt-script-code') as HTMLTextAreaElement).value,
+      disabled: !(row.querySelector('.rt-script-enabled') as HTMLInputElement).checked,
+      originalIndex: originalIndexFrom(row),
+    });
+  });
+
+  const assertions: RuntimeEditorModel['assertions'] = [];
+  document.querySelectorAll('#runtimeAssertionsList .runtime-assertion-row').forEach((row) => {
+    assertions.push({
+      expression: (row.querySelector('.rt-assertion-expression') as HTMLInputElement).value.trim(),
+      operator: (row.querySelector('.rt-assertion-operator') as HTMLSelectElement).value,
+      value: (row.querySelector('.rt-assertion-value') as HTMLInputElement).value,
+      disabled: !(row.querySelector('.rt-assertion-enabled') as HTMLInputElement).checked,
+      description: (row.querySelector('.rt-assertion-description') as HTMLInputElement).value,
+      originalIndex: originalIndexFrom(row),
+    });
+  });
+
+  const actions: RuntimeEditorModel['actions'] = [];
+  document.querySelectorAll('#runtimeActionsList .runtime-action-row').forEach((row) => {
+    actions.push({
+      type: 'set-variable',
+      phase: (row.querySelector('.rt-action-phase') as HTMLSelectElement).value,
+      selectorMethod: 'jsonq',
+      selectorExpression: (row.querySelector('.rt-action-selector') as HTMLInputElement).value.trim(),
+      variableScope: (row.querySelector('.rt-action-scope') as HTMLSelectElement).value,
+      variableName: (row.querySelector('.rt-action-name') as HTMLInputElement).value.trim(),
+      disabled: !(row.querySelector('.rt-action-enabled') as HTMLInputElement).checked,
+      description: (row.querySelector('.rt-action-description') as HTMLInputElement).value,
+      originalIndex: originalIndexFrom(row),
+    });
+  });
+
+  return { scripts, assertions, actions };
+}
+
 function buildRequestWithSchemaMerge(): any {
   if (!isVisualEditableRequest(currentRequest)) {
     return cloneJson(currentRequest ?? {});
@@ -1136,12 +1371,13 @@ function buildRequestWithSchemaMerge(): any {
   const authType = ($('authType') as HTMLSelectElement).value;
   const model: RequestEditorModel = {
     protocol: _currentProtocol,
-    method: (methodSelect as HTMLSelectElement).value,
+    method: (_currentProtocol === 'http' || _currentProtocol === 'graphql') ? (methodSelect as HTMLSelectElement).value : undefined,
     url: getUrlText(),
-    params: collectParams(),
+    params: (_currentProtocol === 'http' || _currentProtocol === 'graphql') ? collectParams() : undefined,
     headers: collectHeaders(),
     body: collectBodyModel(),
     auth: buildAuthData(authType, 'auth'),
+    runtime: collectRuntimeModel(),
     settings: {
       timeout: parseInt($input('settingTimeout').value) || 30000,
       encodeUrl: $input('settingEncodeUrl').checked,
@@ -1234,7 +1470,8 @@ function loadRequest(req: any): void {
 
   // Headers
   $('headersBody').innerHTML = '';
-  (details.headers || []).forEach((h: any, index: number) => addHeader(h.name, h.value, h.disabled, index));
+  const headerRows = protocol === 'grpc' ? details.metadata : details.headers;
+  (headerRows || []).forEach((h: any, index: number) => addHeader(h.name, h.value, h.disabled, index));
 
   // Body
   _selectedBodyVariantIndex = undefined;
@@ -1311,6 +1548,7 @@ function loadRequest(req: any): void {
 
   // Auth — read from runtime.auth per OpenCollection schema
   const runtime = currentRequest.runtime || {};
+  loadRuntimeEditor(runtime);
   const auth = runtime.auth;
   if (auth === 'inherit') {
     ($('authType') as HTMLSelectElement).value = 'inherit';
@@ -1871,6 +2109,10 @@ $('exportSaveBtn').addEventListener('click', () => {
 $('addParamBtn').addEventListener('click', () => { addParam(); syncUrlFromParams(); });
 $('addHeaderBtn').addEventListener('click', () => addHeader());
 $('addFormFieldBtn').addEventListener('click', () => addFormField());
+$('addRuntimeScriptBtn').addEventListener('click', () => { addRuntimeScript('before-request', 'console.log("before request");'); scheduleDocumentUpdate(); });
+$('addRuntimeTestBtn').addEventListener('click', () => { addRuntimeScript('tests', 'test("response is successful", () => assert(response.status < 400));'); scheduleDocumentUpdate(); });
+$('addRuntimeAssertionBtn').addEventListener('click', () => { addRuntimeAssertion(); scheduleDocumentUpdate(); });
+$('addRuntimeActionBtn').addEventListener('click', () => { addRuntimeAction(); scheduleDocumentUpdate(); });
  ($('authType') as HTMLSelectElement).innerHTML = authTypeOptionsHtml(true);
 $('authType').addEventListener('change', () => { onAuthTypeChange(); scheduleDocumentUpdate(); });
 $('panel-auth').addEventListener('input', scheduleDocumentUpdate);
diff --git a/src/webview/state.ts b/src/webview/state.ts
index 550df9d..b9a7ff7 100644
--- a/src/webview/state.ts
+++ b/src/webview/state.ts
@@ -37,5 +37,7 @@ export function $input(id: string): HTMLInputElement {
 export function esc(s: string): string {
   const d = document.createElement('div');
   d.textContent = s;
-  return d.innerHTML;
+  return d.innerHTML
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
 }
diff --git a/test/runtimeAuthoringRoundTripRegression.test.ts b/test/runtimeAuthoringRoundTripRegression.test.ts
new file mode 100644
index 0000000..9d4c25a
--- /dev/null
+++ b/test/runtimeAuthoringRoundTripRegression.test.ts
@@ -0,0 +1,103 @@
+import Ajv from 'ajv';
+import {
+  applyRequestEditorModel,
+  createRequestEditorModelFromRequest,
+  type RequestEditorModel,
+} from '../src/models/schemaRoundTrip';
+
+const schema = require('../schema/opencollectionschema.json');
+
+function runtimeFixture() {
+  return {
+    assertions: [{
+      expression: 'res.status',
+      operator: 'equals',
+      value: '200',
+      disabled: true,
+      description: { content: 'Status remains visible', type: 'text/markdown' },
+    }],
+    actions: [{
+      type: 'set-variable',
+      phase: 'after-response',
+      selector: { method: 'jsonq', expression: '$.token' },
+      variable: { scope: 'runtime', name: 'responseToken' },
+      disabled: true,
+      description: { content: 'Capture token', type: 'text/plain' },
+    }],
+  };
+}
+
+function httpRequest(): any {
+  return {
+    info: { name: 'HTTP runtime', type: 'http' },
+    http: { method: 'GET', url: '{{baseUrl}}/runtime/token' },
+    runtime: runtimeFixture(),
+  };
+}
+
+function grpcRequest(): any {
+  return {
+    info: { name: 'gRPC runtime', type: 'grpc' },
+    grpc: {
+      url: '{{grpcBaseUrl}}',
+      method: 'missio.demo.DemoService/EchoUnary',
+      methodType: 'unary',
+      protoFilePath: 'proto/services/missio_demo.proto',
+    },
+    runtime: runtimeFixture(),
+  };
+}
+
+function validateGrpc(data: unknown): void {
+  const ajv = new Ajv({ allErrors: true, strict: false });
+  const validate = ajv.compile({
+    $schema: schema.$schema,
+    $id: `${schema.$id}#test-runtime-authoring-regression-grpc`,
+    $ref: `${schema.$id}#/$defs/GrpcRequest`,
+    $defs: schema.$defs,
+  });
+  expect(validate(data), JSON.stringify(validate.errors, null, 2)).toBe(true);
+}
+
+describe('runtime authoring round-trip regressions', () => {
+  it('does not add an empty message to a message-less gRPC request', () => {
+    const request = grpcRequest();
+    const model = createRequestEditorModelFromRequest(request) as RequestEditorModel;
+    model.body = { kind: 'raw', rawType: 'json', data: '' };
+
+    const updated = applyRequestEditorModel(request, model) as any;
+
+    expect(updated.grpc).not.toHaveProperty('message');
+    validateGrpc(updated);
+  });
+
+  it('preserves existing runtime rows while a required field is temporarily incomplete', () => {
+    const request = httpRequest();
+    const model = createRequestEditorModelFromRequest(request) as RequestEditorModel;
+    model.runtime!.assertions![0].expression = '';
+    model.runtime!.actions![0].variableName = '';
+
+    const updated = applyRequestEditorModel(request, model) as any;
+
+    expect(updated.runtime.assertions).toEqual(request.runtime.assertions);
+    expect(updated.runtime.actions).toEqual(request.runtime.actions);
+  });
+
+  it('retains structured description metadata when runtime descriptions are edited', () => {
+    const request = httpRequest();
+    const model = createRequestEditorModelFromRequest(request) as RequestEditorModel;
+    model.runtime!.assertions![0].description = 'Updated assertion';
+    model.runtime!.actions![0].description = 'Updated action';
+
+    const updated = applyRequestEditorModel(request, model) as any;
+
+    expect(updated.runtime.assertions[0].description).toEqual({
+      content: 'Updated assertion',
+      type: 'text/markdown',
+    });
+    expect(updated.runtime.actions[0].description).toEqual({
+      content: 'Updated action',
+      type: 'text/plain',
+    });
+  });
+});
diff --git a/test/runtimeAuthoringUx.test.ts b/test/runtimeAuthoringUx.test.ts
new file mode 100644
index 0000000..a570d14
--- /dev/null
+++ b/test/runtimeAuthoringUx.test.ts
@@ -0,0 +1,304 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import Ajv from 'ajv';
+import { parse as parseYaml, stringify as stringifyYaml } from 'yaml';
+import {
+  applyRequestEditorModel,
+  createRequestEditorModelFromRequest,
+  type RequestEditorModel,
+} from '../src/models/schemaRoundTrip';
+import type { RequestProtocol } from '../src/models/types';
+import { RequestEditorProvider } from '../src/panels/requestPanel';
+
+const schema = require('../schema/opencollectionschema.json');
+
+const schemaByProtocol: Record<RequestProtocol, string> = {
+  http: 'HttpRequest',
+  graphql: 'GraphQLRequest',
+  websocket: 'WebSocketRequest',
+  grpc: 'GrpcRequest',
+};
+
+const protocolRoots: RequestProtocol[] = ['http', 'graphql', 'websocket', 'grpc'];
+
+function validateSubschema(protocol: RequestProtocol, data: unknown): void {
+  const ajv = new Ajv({ allErrors: true, strict: false });
+  const defName = schemaByProtocol[protocol];
+  const validate = ajv.compile({
+    $schema: schema.$schema,
+    $id: `${schema.$id}#test-runtime-authoring-${defName}`,
+    $ref: `${schema.$id}#/$defs/${defName}`,
+    $defs: schema.$defs,
+  });
+  expect(validate(data), JSON.stringify(validate.errors, null, 2)).toBe(true);
+}
+
+function yamlRoundTrip(data: unknown): unknown {
+  return parseYaml(stringifyYaml(data, { lineWidth: 120 }));
+}
+
+function runtimeFixture() {
+  return {
+    variables: [{ name: 'runtimeOwner', value: 'Ada' }],
+    scripts: [
+      { type: 'before-request', code: 'missio.variables.set("trace", "before");' },
+      { type: 'tests', code: 'test("ok", () => assert(response.status < 400));', disabled: true },
+    ],
+    assertions: [
+      {
+        expression: 'res.status',
+        operator: 'equals',
+        value: '200',
+        disabled: true,
+        description: { content: 'Status remains visible', type: 'text/markdown' },
+      },
+    ],
+    actions: [
+      {
+        type: 'set-variable',
+        phase: 'after-response',
+        selector: { method: 'jsonq', expression: '$.token' },
+        variable: { scope: 'runtime', name: 'responseToken' },
+        disabled: true,
+        description: { content: 'Capture token', type: 'text/plain' },
+      },
+    ],
+  };
+}
+
+function requestForProtocol(protocol: RequestProtocol): any {
+  const runtime = runtimeFixture();
+  if (protocol === 'graphql') {
+    return {
+      info: { name: 'GraphQL runtime', type: 'graphql' },
+      graphql: {
+        method: 'POST',
+        url: '{{baseUrl}}/graphql',
+        headers: [{ name: 'X-Trace', value: '{{trace}}' }],
+        body: { query: 'query Health { health { status } }', variables: '{"trace":"{{trace}}"}' },
+      },
+      runtime,
+      settings: { timeout: 5000 },
+    };
+  }
+  if (protocol === 'websocket') {
+    return {
+      info: { name: 'WebSocket runtime', type: 'websocket' },
+      websocket: {
+        url: '{{wsBaseUrl}}/ws/auth',
+        headers: [{ name: 'X-Trace', value: '{{trace}}' }],
+        message: { type: 'json', data: '{"user":"Ada"}' },
+      },
+      runtime,
+    };
+  }
+  if (protocol === 'grpc') {
+    return {
+      info: { name: 'gRPC runtime', type: 'grpc' },
+      grpc: {
+        url: '{{grpcBaseUrl}}',
+        method: 'missio.demo.DemoService/EchoUnary',
+        methodType: 'unary',
+        protoFilePath: 'proto/services/missio_demo.proto',
+        metadata: [{ name: 'x-trace-id', value: '{{trace}}' }],
+        message: '{"name":"Ada","trace":{"requestId":"{{trace}}"}}',
+      },
+      runtime,
+    };
+  }
+  return {
+    info: { name: 'HTTP runtime', type: 'http' },
+    http: {
+      method: 'POST',
+      url: '{{baseUrl}}/runtime/token',
+      headers: [{ name: 'Content-Type', value: 'application/json' }],
+      body: { type: 'json', data: '{"owner":"{{runtimeOwner}}"}' },
+    },
+    runtime,
+    settings: { timeout: 5000 },
+  };
+}
+
+describe('OC-110 runtime authoring model', () => {
+  it('round-trips runtime scripts, assertions, and actions for every request protocol', () => {
+    for (const protocol of protocolRoots) {
+      const request = requestForProtocol(protocol);
+      const model = createRequestEditorModelFromRequest(request);
+      const updated = applyRequestEditorModel(request, model);
+
+      expect(updated).toEqual(request);
+      expect(yamlRoundTrip(updated)).toEqual(request);
+      expect(protocolRoots.filter(root => Object.prototype.hasOwnProperty.call(updated as object, root))).toEqual([protocol]);
+      validateSubschema(protocol, updated);
+    }
+  });
+
+  it('preserves existing unsupported-but-schema-valid runtime rows on no-op saves', () => {
+    const request = requestForProtocol('http');
+    request.runtime.scripts.push({
+      type: 'hooks',
+      code: 'console.log("schema-valid hook");',
+      disabled: true,
+    });
+    request.runtime.actions.push({
+      type: 'set-variable',
+      phase: 'after-response',
+      selector: { method: 'jsonq', expression: '$.environmentToken' },
+      variable: { scope: 'environment', name: 'environmentToken' },
+    });
+
+    const model = createRequestEditorModelFromRequest(request) as RequestEditorModel;
+    const lastScript = model.runtime?.scripts?.[model.runtime.scripts.length - 1];
+    const lastAction = model.runtime?.actions?.[model.runtime.actions.length - 1];
+    expect(lastScript).toMatchObject({
+      type: 'hooks',
+      code: 'console.log("schema-valid hook");',
+      disabled: true,
+    });
+    expect(lastAction).toMatchObject({
+      type: 'set-variable',
+      variableScope: 'environment',
+      variableName: 'environmentToken',
+    });
+
+    const updated = applyRequestEditorModel(request, model);
+
+    expect(updated).toEqual(request);
+    validateSubschema('http', updated);
+  });
+
+  it('creates, edits, disables, reorders, and removes managed runtime entries without dropping runtime siblings', () => {
+    const request = requestForProtocol('http');
+    const model = createRequestEditorModelFromRequest(request) as RequestEditorModel;
+    model.runtime = {
+      scripts: [
+        {
+          type: 'tests',
+          code: 'test("edited", () => assert(response.status === 201));',
+          disabled: true,
+          originalIndex: 1,
+        },
+        {
+          type: 'after-response',
+          code: 'console.log("new after response");',
+        },
+      ],
+      assertions: [
+        {
+          expression: 'res.body.ok',
+          operator: 'equals',
+          value: 'true',
+          disabled: false,
+          description: 'Status remains visible',
+          originalIndex: 0,
+        },
+      ],
+      actions: [],
+    };
+
+    const updated = applyRequestEditorModel(request, model) as any;
+
+    expect(updated.runtime.variables).toEqual(request.runtime.variables);
+    expect(updated.runtime.auth).toBeUndefined();
+    expect(updated.runtime.scripts).toEqual([
+      {
+        type: 'tests',
+        code: 'test("edited", () => assert(response.status === 201));',
+        disabled: true,
+      },
+      {
+        type: 'after-response',
+        code: 'console.log("new after response");',
+      },
+    ]);
+    expect(updated.runtime.assertions).toEqual([
+      {
+        expression: 'res.body.ok',
+        operator: 'equals',
+        value: 'true',
+        disabled: false,
+        description: { content: 'Status remains visible', type: 'text/markdown' },
+      },
+    ]);
+    expect(updated.runtime.actions).toEqual([]);
+    expect(yamlRoundTrip(updated)).toEqual(updated);
+    validateSubschema('http', updated);
+  });
+
+  it('adds runtime authoring edits to gRPC requests without changing method, metadata, or protocol root', () => {
+    const request = requestForProtocol('grpc');
+    const model = createRequestEditorModelFromRequest(request) as RequestEditorModel;
+    model.runtime = {
+      scripts: [{ type: 'before-request', code: 'missio.variables.set("grpcEdited", "yes");' }],
+      assertions: [{ expression: 'res.body.name', operator: 'equals', value: 'Ada' }],
+      actions: [{
+        type: 'set-variable',
+        phase: 'after-response',
+        selectorMethod: 'jsonq',
+        selectorExpression: '$.requestId',
+        variableScope: 'runtime',
+        variableName: 'grpcRequestId',
+      }],
+    };
+
+    const updated = applyRequestEditorModel(request, model) as any;
+
+    expect(updated.http).toBeUndefined();
+    expect(updated.graphql).toBeUndefined();
+    expect(updated.websocket).toBeUndefined();
+    expect(updated.grpc.method).toBe(request.grpc.method);
+    expect(updated.grpc.metadata).toEqual(request.grpc.metadata);
+    expect(updated.runtime.scripts[0].code).toContain('grpcEdited');
+    validateSubschema('grpc', updated);
+  });
+});
+
+describe('OC-110 runtime authoring UI shell', () => {
+  it('renders request Runtime authoring controls separately from response Runtime results', () => {
+    const provider = new RequestEditorProvider(
+      { extensionUri: { fsPath: process.cwd() } } as any,
+      {} as any,
+      {} as any,
+      {} as any,
+      {} as any,
+      {} as any,
+    );
+
+    const html = (provider as any)._getBodyHtml({} as any) as string;
+
+    expect(html).toContain('data-tab="runtime"');
+    expect(html).toContain('id="runtimeBadge"');
+    expect(html).toContain('id="panel-runtime"');
+    expect(html).toContain('id="runtimeScriptsList"');
+    expect(html).toContain('id="runtimeAssertionsList"');
+    expect(html).toContain('id="runtimeActionsList"');
+    expect(html).toContain('id="addRuntimeScriptBtn"');
+    expect(html).toContain('id="addRuntimeTestBtn"');
+    expect(html).toContain('id="addRuntimeAssertionBtn"');
+    expect(html).toContain('id="addRuntimeActionBtn"');
+    expect(html).toContain('id="panel-resp-runtime"');
+  });
+
+  it('keeps runtime authoring layout classes available in the request panel stylesheet', () => {
+    const css = fs.readFileSync(path.join(process.cwd(), 'src', 'webview', 'requestPanel.css'), 'utf8');
+
+    expect(css).toContain('.runtime-authoring');
+    expect(css).toContain('.runtime-editor-row');
+    expect(css).toContain('.runtime-row-toolbar');
+    expect(css).toContain('.runtime-icon-btn');
+    expect(css).toContain('.runtime-unsupported-note');
+    expect(css).toContain('.runtime-list:empty::before');
+  });
+
+  it('offers only runtime-executable script phases and supported set-variable scopes for new rows', () => {
+    const source = fs.readFileSync(path.join(process.cwd(), 'src', 'webview', 'requestPanel.ts'), 'utf8');
+
+    expect(source).toMatch(/const runtimeScriptTypes = \['before-request', 'after-response', 'tests'\];/);
+    expect(source).not.toMatch(/const runtimeScriptTypes = \[[^\]]*hooks/);
+    expect(source).toMatch(/const runtimeVariableScopes = \['runtime', 'request'\];/);
+    expect(source).not.toMatch(/const runtimeVariableScopes = \[[^\]]*(folder|collection|environment)/);
+    expect(source).toContain('hooks (not executed)');
+    expect(source).toContain('environment (not persisted)');
+    expect(source).toContain('data-runtime-unsupported="true"');
+  });
+});
diff --git a/test/runtimeExecutionService.test.ts b/test/runtimeExecutionService.test.ts
index e4e420a..9e47001 100644
--- a/test/runtimeExecutionService.test.ts
+++ b/test/runtimeExecutionService.test.ts
@@ -164,6 +164,40 @@ describe('RuntimeExecutionService lifecycle', () => {
     expect(response.runtime?.tests[1].message).toMatch(/Code generation from strings disallowed/);
   });
 
+  it('skips disabled runtime scripts without deleting them from authored requests', async () => {
+    const service = new RuntimeExecutionService();
+    const request: HttpRequest = {
+      http: { method: 'GET', url: 'http://127.0.0.1/runtime' },
+      runtime: {
+        scripts: [
+          {
+            type: 'before-request',
+            disabled: true,
+            code: 'missio.request.setHeader("X-Disabled-Script", "ran");',
+          },
+          {
+            type: 'tests',
+            disabled: true,
+            code: 'test("disabled test", () => assert(false));',
+          },
+          {
+            type: 'tests',
+            code: 'test("enabled test", () => assert(response.status === 200));',
+          },
+        ],
+      },
+    };
+
+    const prepared = await service.prepareHttpRequest(request, makeCollection());
+    expect(prepared.request.runtime?.scripts).toEqual(request.runtime?.scripts);
+    expect(prepared.request.http?.headers?.find(header => header.name === 'X-Disabled-Script')).toBeUndefined();
+
+    const response = await service.completeHttpRequest(prepared, makeResponse({ ok: true }));
+
+    expect(response.runtime?.success).toBe(true);
+    expect(response.runtime?.tests.map(test => test.name)).toEqual(['enabled test']);
+  });
+
   it('records assertion and action failure diagnostics without hiding the response', async () => {
     const service = new RuntimeExecutionService();
     const request: HttpRequest = {
@@ -189,6 +223,31 @@ describe('RuntimeExecutionService lifecycle', () => {
     expect(response.runtime?.assertions.map(assertion => assertion.passed)).toEqual([false, false]);
     expect(response.runtime?.actions[0]).toMatchObject({ passed: false, message: 'Selector did not resolve: $.missing' });
   });
+
+  it('diagnoses unsupported set-variable action scopes instead of mutating runtime variables', async () => {
+    const service = new RuntimeExecutionService();
+    const request: HttpRequest = {
+      http: { method: 'GET', url: 'http://127.0.0.1/runtime' },
+      runtime: {
+        actions: [{
+          type: 'set-variable',
+          selector: { method: 'jsonq', expression: '$.token' },
+          variable: { scope: 'environment', name: 'token' },
+        }],
+      },
+    };
+
+    const prepared = await service.prepareHttpRequest(request, makeCollection());
+    const response = await service.completeHttpRequest(prepared, makeResponse({ token: 'abc123' }));
+
+    expect(response.runtime?.success).toBe(false);
+    expect(response.runtime?.actions[0]).toMatchObject({
+      passed: false,
+      target: 'environment.token',
+      message: 'Unsupported variable scope: environment. Missio currently supports runtime and request set-variable scopes.',
+    });
+    expect(response.runtime?.variableMutations).toEqual([]);
+  });
 });
 
 describe('RequestExecutionService runtime integration', () => {
diff --git a/test/validationService.test.ts b/test/validationService.test.ts
index 95c1eec..9b4ca59 100644
--- a/test/validationService.test.ts
+++ b/test/validationService.test.ts
@@ -44,6 +44,7 @@ describe('validationService', () => {
     writeYaml(rootDir, 'get-users.yml', {
       info: { name: 'Get users', type: 'http' },
       http: { method: 'GET', url: 'https://api.example.com/users' },
+      runtime: { scripts: [{ type: 'before-request', code: 'console.log("skip");', disabled: true }] },
     });
     writeYaml(rootDir, 'graphql-users.yml', {
       info: { name: 'GraphQL users', type: 'graphql' },
@@ -52,10 +53,12 @@ describe('validationService', () => {
         url: 'https://api.example.com/graphql',
         body: { query: 'query Users { users { id } }', variables: '{"limit":10}' },
       },
+      runtime: { scripts: [{ type: 'tests', code: 'test("skip", () => assert(false));', disabled: true }] },
     });
     writeYaml(rootDir, 'socket.yml', {
       info: { name: 'Socket ping', type: 'websocket' },
       websocket: { url: 'wss://api.example.com/socket', message: { type: 'text', data: 'ping' } },
+      runtime: { scripts: [{ type: 'after-response', code: 'console.log("skip");', disabled: true }] },
     });
     writeYaml(rootDir, 'grpc-user.yml', {
       info: { name: 'Get user', type: 'grpc' },
@@ -65,6 +68,7 @@ describe('validationService', () => {
         methodType: 'unary',
         message: '{"id":"42"}',
       },
+      runtime: { scripts: [{ type: 'before-request', code: 'console.log("skip");', disabled: true }] },
     });
     writeYaml(rootDir, 'grpc-upload-users.yml', {
       info: { name: 'Upload users', type: 'grpc' },
diff --git a/test/webviewState.test.ts b/test/webviewState.test.ts
new file mode 100644
index 0000000..e54c160
--- /dev/null
+++ b/test/webviewState.test.ts
@@ -0,0 +1,35 @@
+import { JSDOM } from 'jsdom';
+
+describe('webview state HTML encoding', () => {
+  let dom: JSDOM;
+
+  beforeEach(() => {
+    dom = new JSDOM('<!doctype html><html><body></body></html>');
+    Object.defineProperty(globalThis, 'window', { value: dom.window, configurable: true });
+    Object.defineProperty(globalThis, 'document', { value: dom.window.document, configurable: true });
+    Object.defineProperty(globalThis, 'acquireVsCodeApi', {
+      value: () => ({ postMessage: vi.fn(), getState: vi.fn(), setState: vi.fn() }),
+      configurable: true,
+    });
+  });
+
+  afterEach(() => {
+    dom.window.close();
+    delete (globalThis as any).window;
+    delete (globalThis as any).document;
+    delete (globalThis as any).acquireVsCodeApi;
+    vi.resetModules();
+  });
+
+  it.each([
+    'res.headers["content-type"]',
+    '{"ok":true}',
+    'A "quoted" description',
+  ])('preserves %s through a double-quoted input value attribute', async (value) => {
+    const { esc } = await import('../src/webview/state');
+    const host = document.createElement('div');
+    host.innerHTML = `<input value="${esc(value)}">`;
+
+    expect(host.querySelector('input')?.value).toBe(value);
+  });
+});