FE-875: App runtime probe — boot, probe, classify

[kostandinang]

Stacks on FE-872. Fifth Arc-1 frontier -- the concrete reachability mechanism behind integration-oracle (without it, "reachable" collapses to "a test imports the module"). Slices 1 + 2 both land here.

What?

Boot the host app from the cook worktree and exercise it over the wire -- the app-execution analogue of test-runner.ts.

• Slice 1 -- probe (runProbe, app-probe.ts): boot -> poll readiness -> hit one HTTP feature endpoint -> classify, always tearing the process down. reachable (< 400), not-reachable (booted but endpoint absent/erroring -- the FE-800 orphan), infra (never booted). A spawn error bails fast instead of polling to timeout.
• Slice 2 -- spec resolution (buildProbeSpec, app-probe.ts): resolve a ProbeTarget (boot argv + paths) into a runnable ProbeSpec by allocating a free port and assembling the ready/feature URLs. The boot test's hand-rolled port dance becomes the production primitive it now dogfoods.

Why?

Verification today only runs the test runner in the worktree, so "reachable" degrades to "a test imports the module" and the FE-800 orphan survives. The harness owns the deterministic, unshortcuttable check; the boot argv + paths are inputs (cook-time grounding supplies them later) -- no per-stack boot engine. The port can't be hardcoded: under parallel cook each slice boots its own app and a fixed port collides, so port->URL binding is the one harness-owned piece (best-effort ephemeral, loopback-only, acknowledged TOCTOU window -- no retry framework).

Tests

Real seeded node:http apps in tmp worktrees, no mocks: reachable; booted-but-404 -> orphan; immediate-exit / missing-binary -> infra; teardown leaves no process. Plus buildProbeSpec: port allocated + URLs assembled, caller env layered under PORT, distinct ports across 8 concurrent allocations. (Also hardens the FE-743 wall-clock timing test, which flaked under the CPU contention real-process tests add -- tolerance now scales with serialMs.)

Deferred

Mode-awareness + where the ProbeTarget argv/paths come from (architect intent + cook grounding) = integration-oracle (#6).

Co-authored-by: Amp amp@ampcode.com

[kostandinang]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• FE-864: Raise pi-action timeout to 600s #224
• FE-878: Brunch serve — one-shot plan-then-cook capstone #222
• FE-877: Brownfield promotion — commit the cook result onto cook/<runId> #221
• FE-876: Integration oracle — reachability gate + grounding seam #220
• FE-875: App runtime probe — boot, probe, classify #219 👈 (View in Graphite)
• FE-872: Install-failure classification — infra-vs-test split #218
• FE-871: Brunch toolchain detection — detect + plan-emitter wiring #214
• FE-867: Agent extension host — dual-mode pi-harness contract #213
• FE-864: Plan orchestrator brownfield enhancements #212 : 1 other dependent PR (#223 )
• FE-843: Toolchain profile expansion — TS runtimes + live profile selection #198
• FE-841: Embed pi as an in-process SDK to drop the external pi CLI dependency #194 : 1 other dependent PR (#211 )
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

PR Summary

Low Risk
New isolated orchestrator module and tests only; no cook-net or promotion path changes yet. Residual risk is flaky port allocation (acknowledged TOCTOU) and timing-sensitive contract tests, mitigated by loopback ephemeral ports and scaled timing tolerance.

Overview
Adds the app runtime probe (Arc 1 / FE-875): harness-owned reachability checks over real HTTP, intended for future integration-oracle gating—not wired into the cook net yet.

runProbe boots a child from a worktree ProbeSpec, polls a readiness URL, hits one feature URL, and returns reachable (<400), not-reachable (up but wrong/missing route—the orphan case), or infra (boot/probe failure), mirroring FE-872’s infra vs test split. Boot processes are always torn down (SIGTERM → SIGKILL). Readiness and feature fetch calls use AbortSignal.timeout so hung servers cannot block the cook loop.

buildProbeSpec turns a ProbeTarget (boot argv + paths) into a full spec by picking a loopback ephemeral PORT and assembling ready/feature URLs—so parallel slices do not collide on a hardcoded port.

New types live in types.ts (ProbeSpec, ProbeTarget, ProbeResult, ProbeOutcomeKind). app-probe.test.ts exercises real node:http sandboxes (reachable, 404 orphan, boot fail, hang/timeouts, teardown, concurrent port allocation). engine-contract.test.ts relaxes the parallel-vs-serial wall-clock assertion to scale with serialMs so real-process probe tests do not flake under CPU contention. memory/PLAN.md records slices 1–2 landed and remaining integration-oracle / mode work.

^{Reviewed by Cursor Bugbot for commit a188d00. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 56fa05d. Configure here.}