feat: harden orchestrator execution runtime

services/orchestrator/execution-adapter.test.mjs

@@ -73,8 +73,8 @@ test('workflow execution adapter records a LangGraph candidate but keeps Native
   assert.equal(decision.handoffAllowed, false);
   assert.equal(decision.candidateReason, 'user_allowlist');
   assert.deepEqual(decision.gates, {
-    implementation: false,
-    routingSelected: true,
+    implementation: true,
+    routingSelected: false,
     engineRegistered: true,
     idempotencyKeyPresent: true,
     executionAuthorized: true,
@@ -88,6 +88,42 @@ test('workflow execution adapter records a LangGraph candidate but keeps Native
   );
 });
 
+test('workflow execution adapter dispatches a selected and authorized LangGraph engine', async () => {
+  let started = null;
+  const registry = createWorkflowEngineRegistry([
+    engine('native'),
+    {
+      ...engine('langgraph'),
+      start(spec) {
+        started = spec;
+        return { runId: spec.runId, status: 'waiting' };
+      },
+    },
+  ]);
+  const adapter = createWorkflowExecutionAdapter({
+    engineRegistry: registry,
+    configService: {
+      async selectEngine() {
+        return {
+          engine: 'langgraph',
+          candidateEngine: 'langgraph',
+          fallbackEngine: 'native',
+          mode: 'canary',
+          reason: 'user_allowlist',
+          candidateReason: 'user_allowlist',
+          configVersion: 5,
+        };
+      },
+    },
+  });
+  const result = await adapter.start(executionRequest());
+  assert.equal(result.dispatched, true);
+  assert.equal(result.engine, 'langgraph');
+  assert.equal(result.decision.handoffAllowed, true);
+  assert.equal(result.decision.dryRun, false);
+  assert.equal(started.runId, 'run-1');
+});
+
 test('workflow execution adapter leaves native dispatch under Portal ownership', async () => {
   const registry = createWorkflowEngineRegistry([engine('native')]);
   const adapter = createWorkflowExecutionAdapter({