Workbench: resolve exact compiled executable from manifest; fail-closed preflight (no flight probing)

[ScriptedAlchemy]

Priority and scope

P1 — developer execution correctness. Follow-up to #600, #629, #643, #604, and capability selection in #679.

Audited commit: b435f7b9179271cbff81d3e40d14ee342cbd65dd.

Origin: owner-requested deep-dive, 2026-09-06. Expanded with the complete residual findings and regression criteria from that review.

Evidence level: source inspection establishes candidate probing and permissive missing-preparation branches. The reviewer has not reproduced end-to-end bypass or duplicate execution. This concerns the authenticated developer execution surface, not unauthenticated remote access.

Verified residual

route-invocation-production.ts still:

• scans bin/ and *-flight.mjs files;
• imports candidate bins to identify invocation entries;
• constructs host hook-wrapper filenames in eventWrapperPath();
• returns original input when the event wrapper or its prepareRouteInvocation export is absent;
• selects between worker candidates using missingRouteWorkerError() message substrings.

route-invocation-service.ts already rejects a hostless production event submission with declared preflight (AB8255). Do not repeat that fix. The missing boundary is a supplied host that is globally recognized but not an eligible emitted projection of this operation. Global host/event support is not operation-specific eligibility.

entry-shell.ts executes the selected generated event route; it does not independently run preparation that the Workbench skipped.

Required correction

Resolve canonical operation + selected surface + host into one exact executable and preparation binding from the leased artifact manifest before importing or starting application code.

Reject ineligible bindings and missing required preparation. Never fall back to direct handler execution because a wrapper could not be selected. Remove filename discovery, trial imports, and error-string-based executable selection. An application error remains an error of the selected operation, not a reason to try another executable.

Retain the explicit distinction between production execution and intentionally isolated unit-render mode.

Acceptance

• Carry the exact manifest-owned execution/preparation binding into the production child request; no second registry or discovery graph.
• A Claude-only event with deny/continue preflight, submitted with a globally valid Codex host selection, fails before handler/provider import or state writes. Use an isolated sentinel fixture to reproduce the candidate path.
• Missing wrapper or required preparation export fails with an actionable diagnostic rather than continuing with raw input.
• Valid continue/deny gates never reach the handler; execute forwards preflight data and invokes the intended handler once.
• A multi-server/multi-bin fixture imports and executes only the selected binding; an unrelated candidate's import-time sentinel stays untouched.
• Handler/preparation errors, including messages matching the former lookup-error substrings, are surfaced once and never cause another candidate executable to run.
• Preserve canonical operation versus selected CLI/MCP/event surface semantics, generated CLI input mapping/confirmation/exit codes, MCP input validation, and observed outcomes.
• Preserve queue revision checks, pinned artifact leases, cancellation, and cleanup.
• Verify the implementation against feat(manifest): authoritative agent-bundle.manifest.json v2 — consumers read the composite root through the manifest (#592 step 3, #555 W2/S3) #604's manifest contract and feat: select event routes by capability #679's operation eligibility, not just conventional filenames.

Test owners

Extend packages/agent-bundle/tests/route-invocation-service.test.ts and packages/agent-bundle/tests/route-invocation-dev-server.test.ts with actual compiled artifacts and negative sentinels.

Boundaries

No new compiler, independent execution registry, arbitrary-source production fallback, general middleware framework, host permission bypass, or plugin-domain policy. Production Flight streaming is #686; retention bounds are #681. Do not duplicate those fixes here.