feat: harden orchestrator execution runtime

services/orchestrator/executor-gateway.test.mjs

@@ -6,6 +6,7 @@ import {
   createExecutorGateway,
   createInMemoryExecutorJobStore,
   createPhase3ExecutorAdapterRegistry,
+  createPhase5ExecutorAdapterRegistry,
   normalizeExecutorJobRequest,
 } from './executor-gateway.mjs';
 
@@ -107,14 +108,15 @@ test('Executor Gateway records a blocked idempotent job without calling an adapt
   assert.equal(preview.fallbackRegistered, true);
   assert.equal(preview.fallbackAvailable, false);
   assert.equal(preview.dispatchAllowed, false);
-  assert.equal(preview.gates.implementation, false);
+  assert.equal(preview.gates.implementation, true);
+  assert.equal(preview.gates.serviceEnabled, false);
   assert.equal(preview.gates.adapterEnabled, false);
 
   const first = await gateway.createJob(request());
   assert.equal(first.created, true);
   assert.equal(first.job.status, 'blocked');
   assert.equal(first.job.attempts, 0);
-  assert.equal(first.job.reason, 'executor_dispatch_not_implemented');
+  assert.equal(first.job.reason, 'executor_execution_disabled');
 
   now = 2000;
   const repeated = await gateway.createJob(request());
@@ -160,10 +162,31 @@ test('Executor Gateway cancellation is idempotent and never invokes a disabled a
   assert.equal(await gateway.listEvents('missing-job'), null);
 });
 
-test('Executor Gateway status remains hard-disabled with a non-durable reference store', () => {
+test('Executor Gateway reports implemented capability while execution remains disabled', () => {
   const status = createExecutorGateway().status();
   assert.equal(status.version, 'executor-gateway-status-v1');
-  assert.equal(status.dispatchImplemented, false);
+  assert.equal(status.dispatchImplemented, true);
   assert.equal(status.executionEnabled, false);
   assert.deepEqual(status.store, { kind: 'memory', durable: false });
 });
+
+test('Executor Gateway queues only explicitly enabled and authorized worker jobs', async () => {
+  const gateway = createExecutorGateway({
+    registry: createPhase5ExecutorAdapterRegistry({ enabledExecutors: ['aider'] }),
+    executionEnabled: true,
+  });
+  const created = await gateway.createJob(request());
+  assert.equal(created.job.status, 'queued');
+  assert.equal(created.job.reason, 'queued_for_worker');
+  assert.equal(created.job.dispatchAllowed, true);
+  assert.equal(created.job.maxAttempts, 3);
+  assert.equal(created.job.request.task.instruction, 'Fix the login form validation');
+
+  const projected = await gateway.getJob('job-1');
+  assert.equal('request' in projected, false);
+  assert.equal('requestFingerprint' in projected, false);
+  assert.deepEqual(
+    (await gateway.listEvents('job-1')).events.map((event) => event.type),
+    ['executor_job_queued'],
+  );
+});