拆分 Agent Host 运行职责

将 durable 取消、失败收口、审批决议和外部结果对账迁入 RuntimeService

把 Host 工具、MCP、Skill 与外部 backend 桥接拆为私有模块并保持公开 API

补充 Runtime 控制测试、依赖反向门禁和架构验收文档

rust/scripts/check-dependencies.sh

@@ -54,6 +54,16 @@ for forbidden in tokio reqwest rusqlite mcp codex agent-mcp agent-codex; do
   fi
 done
 
+# Engine 只编排 Core 中立端口，不能反向依赖持久化控制面或具体适配器。
+# 检查完整 normal 依赖树，避免通过中间 crate 间接带入这些职责。
+engine_tree="$(cargo tree --locked --manifest-path "$workspace_manifest" --edges normal -p agent-runtime-engine)"
+for forbidden in rusqlite agent-storage-sqlite agent-runtime agent-runtime-contracts agent-runtime-sqlite agent-host agent-app agent-cli agent-provider-openai agent-provider-fake agent-mcp agent-skills agent-codex; do
+    if grep -Eq "(^|[[:space:]])${forbidden}([[:space:]]|$)" <<<"$engine_tree"; then
+        echo "agent-runtime-engine unexpectedly depends on ${forbidden}" >&2
+        exit 1
+    fi
+done
+
 # Durable command/view contracts must remain database and transport neutral too.
 # The portable runtime facade now shares that boundary; SQLite-specific service
 # assembly lives in the sibling agent-runtime-sqlite crate.
@@ -70,7 +80,8 @@ done
 # prevents workspace feature unification from hiding an accidental dependency.
 portable_runtime_tree="$(cargo tree --locked --manifest-path "$workspace_manifest" \
     --no-default-features --edges normal -p agent-runtime)"
-for forbidden in rusqlite agent-storage-sqlite; do
+# Runtime 接受中立命令；Engine 执行和 Provider/MCP/Skill/Codex 装配留在 Host。
+for forbidden in rusqlite agent-storage-sqlite agent-runtime-sqlite agent-runtime-engine agent-host agent-app agent-cli agent-provider-openai agent-provider-fake agent-mcp agent-skills agent-codex; do
     if grep -Eq "(^|[[:space:]])${forbidden}([[:space:]]|$)" <<<"$portable_runtime_tree"; then
         echo "agent-runtime portable facade unexpectedly depends on ${forbidden}" >&2
         exit 1
@@ -89,6 +100,14 @@ for required in agent-runtime agent-storage-sqlite; do
     fi
 done
 
+# SQLite 层可以依赖存储实现，但不能借拆分 Host 把执行器和外部适配器搬进来。
+for forbidden in agent-runtime-engine agent-host agent-app agent-cli agent-provider-openai agent-provider-fake agent-mcp agent-skills agent-codex; do
+    if grep -Eq "(^|[[:space:]])${forbidden}([[:space:]]|$)" <<<"$sqlite_runtime_tree"; then
+        echo "agent-runtime-sqlite unexpectedly depends on ${forbidden}" >&2
+        exit 1
+    fi
+done
+
 # The generic program configuration layer must remain below Host/Runtime.  It
 # may depend on concrete protocol configuration types, but it must not acquire
 # durable state, worker lifecycle or the CLI's application backend by accident.