Infrastructure: Add scoped runner grants and drain-confirmed desktop controller handoff #4448

Current status - 2026-11-07

Blocked for generic handoff by F2 #4442 (in #4463); F1 is already merged. New input-lane selection in #4464 does not provide controller ownership transfer.

Remaining behavior: agent-served mode and ordinary WDIO still exclude each other; implement bounded busy/relinquish/operator-authorized preemption, stop new work, await cancellation/settlement and session DELETE, invalidate old references/cursors/proofs/artifact links, and only then grant the runner a session. Worker-crash drain and credential confinement remain acceptance requirements.

F9 #4449 gates only the Storybook phase. F10-M #4446 / F10-W #4447 gate only opt-in retained supervisor-owned applications; attach-only handoff does not need them. Cross-MCP-connection resume and automatic replay are not supported by this PR.

Goal

Agent-served mode (serve --agent) and WDIO runs currently exclude one another, so moving between MCP control and suite execution requires restarting services. Add scoped runner grants and a handoff that waits for the previous controller to drain before a runner opens its own session.

Part of #4435 (plan item F11).

Scope

• Owner: WDIO and CSF runner integration.
• Paths (under packages/agentic/): desktop-test/src/wdio/*, the driver's grant transport and drain contracts, and storybook-desktop/src/testing/{runWdioTests,worker}.ts.
• Default to a bounded busy result. An explicit relinquish or operator-authorized preempt stops new work, cancels and awaits settlement, confirms session deletion, invalidates references, cursors, proofs, and artifact links, and only then authorizes a new runner session. Grant revocation callbacks are not a drain barrier.
• Keep the documented CSF exception, where the runner owns the session and an isolated Node worker borrows it, unless it is deliberately migrated.

Dependencies

• Blocked by: F2 Infrastructure: Implement settled desktop lifecycle supervision and fenced ownership records #4442 for the generic handoff; F1 Infrastructure: Unify desktop driver-service composition and wire durable recovery #4436 is delivered by Unify desktop driver-service composition and wire durable recovery #4455.
• Phased prerequisites: Storybook integration requires F9 Infrastructure: Convert Storybook lifecycle takeover into desktop-test resource contributions #4449. Retaining a supervisor-launched app across handoff requires F10-M Infrastructure: Implement neutral macOS desktop application ownership and identity recovery #4446 or F10-W Infrastructure: Implement neutral Windows desktop application ownership and containment #4447 and an explicit ownership option. Attached-app handoff needs neither.
• Unblocks: F13 Infrastructure: Add the generalized desktop-mcp management facet #4450.
• Parallel with: F3 Infrastructure: Add owned-process lifelines and typed desktop service readiness #4444, F6 Infrastructure: Tighten Storybook manifest provenance and native helper trust handoff #4445, F10-M, and F10-W.

Acceptance

• MCP and WDIO cannot control the same reserved target concurrently.
• A worker crash drains its session.
• Stale references, cursors, and artifact links fail after handoff.
• Credentials never enter capabilities, generated config, logs, or model output.

Validation

• Iterate with focused yarn test <name> in each changed package, then run its yarn format, yarn lint, yarn build, and yarn test. Finish with yarn clean-lage-cache then yarn lage buildci; run yarn lage test-links --verbose --grouped after markdown changes.
• Add a patch changeset for each changed published package. Update the owning references/current-status.md rows (done, work in progress, unsupported) and affected README/AGENTS guidance in the same change.
• Native, provider, or process-topology changes need matching-OS native contracts and the affected consumer lane. JavaScript tests and bundles do not qualify native behavior; hosted capability skips are not passes. Report each check as passed, failed, skipped, not run, or unsupported.

Evidence

• Current state: "MCP/WDIO handoff" and "Standalone WDIO/Jasmine execution" in packages/agentic/desktop-test/references/current-status.md.
• Retired plan: driver-next.md at 0569e1b86, sections 6 (cancellation, handoff, and recovery) and 8 (F11).