diff --git a/.env.example b/.env.example
index d65d729..5e6a842 100644
--- a/.env.example
+++ b/.env.example
@@ -17,7 +17,9 @@ DAEMON_NAME=Local MacBook
 DAEMON_VERSION=0.0.0
 DAEMON_HEARTBEAT_MS=15000
 DAEMON_COMMAND_LEASE_MS=60000
-# RIVET_ENDPOINT=http://localhost:6420
+RIVET_ENDPOINT=http://localhost:6420
+RIVET_PUBLIC_ENDPOINT=http://localhost:6420
+RIVET_WORKSPACE_TOKEN=replace-with-a-long-random-workspace-token
 
 # Flue persistence adapter
 FLUE_DB_TOKEN=replace-with-a-long-random-token
diff --git a/apps/web/src/components/slice-one/slice-one-page.tsx b/apps/web/src/components/slice-one/slice-one-page.tsx
index 9729f88..019ce87 100644
--- a/apps/web/src/components/slice-one/slice-one-page.tsx
+++ b/apps/web/src/components/slice-one/slice-one-page.tsx
@@ -5,8 +5,10 @@ import {
 } from "@code/ui/components/ai-elements/conversation";
 import { Button } from "@code/ui/components/button";
 import {
+  AlertTriangle,
   ChevronRight,
   Check,
+  FileCode2,
   FolderGit2,
   Hammer,
   LoaderCircle,
@@ -15,6 +17,7 @@ import {
   ImagePlus,
   Play,
   RotateCcw,
+  ScrollText,
   Send,
   Sparkles,
   Settings,
@@ -36,6 +39,28 @@ import {
 type SliceWork = NonNullable<ReturnType<typeof useSliceOne>["works"]>[number];
 const EMPTY_WORKS: readonly SliceWork[] = [];
 
+type SliceArtifact = NonNullable<
+  NonNullable<SliceWork["runs"][number]["artifacts"]>[number]
+>;
+
+interface ArtifactMetadata {
+  readonly changedFiles?: readonly string[];
+}
+
+const parseArtifactMetadata = (artifact: SliceArtifact): ArtifactMetadata => {
+  if (!artifact.metadataJson) {
+    return {};
+  }
+  try {
+    return JSON.parse(artifact.metadataJson) as ArtifactMetadata;
+  } catch {
+    return {};
+  }
+};
+
+const changedFilesFor = (artifact: SliceArtifact): readonly string[] =>
+  parseArtifactMetadata(artifact).changedFiles ?? [];
+
 interface WorkCardProps {
   readonly onSourceSelect: (rawText: string) => void;
   readonly work: SliceWork;
@@ -96,6 +121,7 @@ const starterDesign = (work: SliceWork) => ({
 const WorkCard = ({ onSourceSelect, work, slice }: WorkCardProps) => {
   const [sourcesOpen, setSourcesOpen] = useState(false);
   const [expanded, setExpanded] = useState(false);
+  const [logsOpen, setLogsOpen] = useState(false);
   const sources = work.signals.flatMap((signal) => signal.sources);
   const { definition } = work;
   const { design } = work;
@@ -258,6 +284,22 @@ const WorkCard = ({ onSourceSelect, work, slice }: WorkCardProps) => {
             <p className="font-semibold uppercase tracking-wide text-[#65713a]">
               Build
             </p>
+            {slice.operationError ? (
+              <p className="mt-2 flex items-start gap-1.5 border border-red-300 bg-red-50 px-2 py-1.5 text-red-800">
+                <AlertTriangle className="mt-0.5 size-3.5 shrink-0" />
+                <span className="min-w-0 flex-1 leading-5">
+                  {slice.operationError.message}
+                </span>
+                <button
+                  aria-label="Dismiss error"
+                  className="shrink-0"
+                  onClick={() => slice.clearOperationError()}
+                  type="button"
+                >
+                  <X className="size-3.5" />
+                </button>
+              </p>
+            ) : null}
             {latestRun ? (
               <div className="mt-1 space-y-2 text-[#626057]">
                 <p className="leading-5">
@@ -269,31 +311,75 @@ const WorkCard = ({ onSourceSelect, work, slice }: WorkCardProps) => {
                     latestRun.terminalClassification ??
                     "activity is still arriving"}
                 </p>
-                {latestRun.attemptEvents?.slice(-5).map((item) => (
-                  <p
-                    className="border-l-2 border-[#b8c760] pl-2"
-                    key={item._id}
-                  >
-                    {item.message}
-                  </p>
-                ))}
                 {latestRun.baseRevision ? (
                   <p className="font-mono text-[10px] text-[#747168]">
                     {latestRun.baseRevision.slice(0, 8)} →{" "}
                     {latestRun.candidateRevision?.slice(0, 8) ?? "working"}
                   </p>
                 ) : null}
-                {latestRun.artifacts?.map((artifact) => (
-                  <a
-                    className="block font-medium underline"
-                    href={artifact.uri}
-                    key={artifact._id}
-                    rel="noreferrer"
-                    target="_blank"
-                  >
-                    {artifact.title}
-                  </a>
-                ))}
+                {latestRun.artifacts?.map((artifact) => {
+                  const changedFiles = changedFilesFor(artifact);
+                  return (
+                    <div key={artifact._id} className="space-y-1">
+                      {artifact.uri ? (
+                        <a
+                          className="block font-medium underline"
+                          href={artifact.uri}
+                          rel="noreferrer"
+                          target="_blank"
+                        >
+                          {artifact.title}
+                        </a>
+                      ) : (
+                        <p className="font-medium">{artifact.title}</p>
+                      )}
+                      {changedFiles.length > 0 ? (
+                        <ul className="space-y-0.5">
+                          {changedFiles.map((file) => (
+                            <li
+                              className="flex items-start gap-1.5 font-mono text-[11px] leading-5 text-[#747168]"
+                              key={file}
+                            >
+                              <FileCode2 className="mt-0.5 size-3 shrink-0 text-[#9a985f]" />
+                              <span className="min-w-0 break-all">{file}</span>
+                            </li>
+                          ))}
+                        </ul>
+                      ) : null}
+                    </div>
+                  );
+                })}
+                {latestRun.attemptEvents &&
+                latestRun.attemptEvents.length > 0 ? (
+                  <div className="space-y-1">
+                    {(logsOpen
+                      ? latestRun.attemptEvents
+                      : latestRun.attemptEvents.slice(-3)
+                    ).map((item) => (
+                      <p
+                        className="border-l-2 border-[#b8c760] pl-2 leading-5"
+                        key={item._id}
+                      >
+                        {item.message}
+                      </p>
+                    ))}
+                    {latestRun.attemptEvents.length > 3 ? (
+                      <button
+                        className="flex items-center gap-1 font-medium text-[#65713a] hover:underline"
+                        onClick={() => setLogsOpen((open) => !open)}
+                        type="button"
+                      >
+                        <ScrollText className="size-3.5" />
+                        {logsOpen
+                          ? "Show recent activity"
+                          : `Show full activity log (${latestRun.attemptEvents.length})`}
+                        <ChevronRight
+                          className={`size-3.5 transition-transform ${logsOpen ? "rotate-90" : ""}`}
+                        />
+                      </button>
+                    ) : null}
+                  </div>
+                ) : null}
               </div>
             ) : (
               <p className="mt-1 text-[#747168]">No implementation Run yet.</p>
@@ -303,9 +389,7 @@ const WorkCard = ({ onSourceSelect, work, slice }: WorkCardProps) => {
                 <Button
                   size="sm"
                   disabled={!slice.projectGitConnection}
-                  onClick={() =>
-                    void slice.startExecution(work._id, design?.slices?.[0]?.id)
-                  }
+                  onClick={() => void slice.startExecution(work._id)}
                 >
                   <Play className="size-3.5" /> Run
                 </Button>
@@ -315,11 +399,7 @@ const WorkCard = ({ onSourceSelect, work, slice }: WorkCardProps) => {
                   size="sm"
                   variant="outline"
                   onClick={() =>
-                    void slice.startSimulation(
-                      work._id,
-                      "success",
-                      design?.slices?.[0]?.id
-                    )
+                    void slice.startSimulation(work._id, "success")
                   }
                 >
                   <Play className="size-3.5" /> Simulate
@@ -338,7 +418,8 @@ const WorkCard = ({ onSourceSelect, work, slice }: WorkCardProps) => {
                   <X className="size-3.5" /> Cancel
                 </Button>
               ) : null}
-              {latestRun?.status === "terminal" &&
+              {latestRun?.executionKind !== "real" &&
+              latestRun?.status === "terminal" &&
               latestRun.terminalClassification === "RetryableFailure" ? (
                 <Button
                   size="sm"
@@ -428,6 +509,7 @@ const ConnectProject = ({ slice }: { slice: SliceOneState }) => (
   </main>
 );
 
+// oxlint-disable-next-line complexity -- this page coordinates the existing mobile shell without owning domain logic.
 export const SliceOnePage = () => {
   const slice = useSliceOne();
   const viewportStyle = useVisualViewportStyle();
@@ -553,6 +635,22 @@ export const SliceOnePage = () => {
                   ? `${slice.projectGitConnection.provider} · ${slice.projectGitConnection.serverUrl}`
                   : "No Git credentials attached"}
               </p>
+              {slice.operationError ? (
+                <p className="mt-2 flex items-start gap-1.5 border border-red-300 bg-red-50 px-2 py-1.5 text-xs text-red-800">
+                  <AlertTriangle className="mt-0.5 size-3.5 shrink-0" />
+                  <span className="min-w-0 flex-1 leading-5">
+                    {slice.operationError.message}
+                  </span>
+                  <button
+                    aria-label="Dismiss error"
+                    className="shrink-0"
+                    onClick={() => slice.clearOperationError()}
+                    type="button"
+                  >
+                    <X className="size-3.5" />
+                  </button>
+                </p>
+              ) : null}
               <div className="mt-4 flex gap-2">
                 <Button
                   size="sm"
diff --git a/apps/web/src/hooks/slice-one/use-slice-one.ts b/apps/web/src/hooks/slice-one/use-slice-one.ts
index 92072cd..d74bd3b 100644
--- a/apps/web/src/hooks/slice-one/use-slice-one.ts
+++ b/apps/web/src/hooks/slice-one/use-slice-one.ts
@@ -40,7 +40,9 @@ interface WorkRecord {
       _id: string;
       kind: string;
       message: string;
+      metadataJson: string;
       occurredAt: number;
+      sequence: number;
     }[];
     readonly baseRevision?: string;
     readonly candidateRevision?: string;
@@ -179,6 +181,20 @@ export const useSliceOne = () => {
   const [repository, setRepository] = useState("");
   const [pending, setPending] = useState(false);
   const [error, setError] = useState<Error>();
+  const [operationError, setOperationError] = useState<Error>();
+  const captureOperationError =
+    <TArgs extends unknown[], TResult>(
+      operation: (...args: TArgs) => Promise<TResult>
+    ) =>
+    async (...args: TArgs): Promise<TResult> => {
+      setOperationError(undefined);
+      try {
+        return await operation(...args);
+      } catch (caughtError) {
+        setOperationError(toError(caughtError));
+        throw caughtError;
+      }
+    };
   const selectedProjectStillExists = projects?.some(
     (project) => project.id === (selectedProjectId as unknown as string)
   );
@@ -262,15 +278,18 @@ export const useSliceOne = () => {
       | "permanent-failure"
       | "cancelled",
     sliceId?: string
-  ) => startSimulationMutation({ scenario, sliceId, workId });
+  ) =>
+    captureOperationError(() =>
+      startSimulationMutation({ scenario, sliceId, workId })
+    )();
   const cancelSimulation = (runId: Id<"workRuns">) =>
-    cancelSimulationMutation({ runId });
+    captureOperationError(() => cancelSimulationMutation({ runId }))();
   const retrySimulation = (runId: Id<"workRuns">) =>
-    retrySimulationMutation({ runId });
+    captureOperationError(() => retrySimulationMutation({ runId }))();
   const startExecution = (workId: Id<"works">, sliceId?: string) =>
-    startExecutionMutation({ sliceId, workId });
+    captureOperationError(() => startExecutionMutation({ sliceId, workId }))();
   const cancelExecution = (runId: Id<"workRuns">) =>
-    cancelExecutionMutation({ runId });
+    captureOperationError(() => cancelExecutionMutation({ runId }))();
   const attachConnection = async (connectionId: Id<"gitConnections">) => {
     if (!activeProjectId) {
       throw new Error("Select a project first");
@@ -280,18 +299,16 @@ export const useSliceOne = () => {
       projectId: activeProjectId,
     });
   };
-  const connectGitea = async (input: {
-    serverUrl: string;
-    token: string;
-    username?: string;
-  }) => {
-    const result = await connectGiteaAction(input);
-    await attachConnection(result.connectionId);
-  };
-  const connectLinkedGithub = async () => {
+  const connectGitea = captureOperationError(
+    async (input: { serverUrl: string; token: string; username?: string }) => {
+      const result = await connectGiteaAction(input);
+      await attachConnection(result.connectionId);
+    }
+  );
+  const connectLinkedGithub = captureOperationError(async () => {
     const result = await connectGithubAction({});
     await attachConnection(result.connectionId);
-  };
+  });
 
   return {
     agent,
@@ -300,11 +317,13 @@ export const useSliceOne = () => {
     authorizeGithub,
     cancelExecution,
     cancelSimulation,
+    clearOperationError: () => setOperationError(undefined),
     connectGitea,
     connectLinkedGithub,
     connectRepository,
     error,
     gitConnections,
+    operationError,
     pending,
     projectGitConnection,
     projects,
diff --git a/bun.lock b/bun.lock
index 82a4093..ac2a09f 100644
--- a/bun.lock
+++ b/bun.lock
@@ -155,7 +155,6 @@
       "version": "0.0.0",
       "dependencies": {
         "@agentos-software/codex": "0.2.7",
-        "@agentos-software/codex-cli": "0.3.4",
         "@agentos-software/git": "0.3.3",
         "@rivet-dev/agentos": "catalog:",
         "effect": "catalog:",
diff --git a/deploy/zopu-runtime/.env.template b/deploy/zopu-runtime/.env.template
index 27cb39e..1a0a780 100644
--- a/deploy/zopu-runtime/.env.template
+++ b/deploy/zopu-runtime/.env.template
@@ -44,21 +44,22 @@ AGENT_MODEL_CONTEXT_WINDOW=262000
 AGENT_MODEL_MAX_TOKENS=131072
 
 # ---------------------------------------------------------------------------
-# 4. AgentOS / RivetKit — OPTIONAL (defaults shown)
-#    registry.start() in the daemon boots an in-process RivetKit engine
-#    (envoy mode) backed by a native Rust sidecar. createClient() connects
-#    back to RIVET_ENDPOINT. No separate Rivet Engine process is required
-#    for single-node operation. Leave RIVET_ENDPOINT unset to use the
-#    library default (http://localhost:6420).
+# 4. AgentOS / Rivet Engine — REQUIRED for the execution runner
+#    The agent service and runner connect through the public engine endpoint.
+#    RIVET_WORKSPACE_TOKEN authenticates every workspace actor connection.
+#    RIVET_ENVOY_VERSION must change for each runner deployment.
 # ---------------------------------------------------------------------------
-#RIVET_ENDPOINT=http://localhost:6420
-
+RIVET_ENDPOINT=https://default:@rivet.example.com
+RIVET_PUBLIC_ENDPOINT=https://default@rivet.example.com
+RIVET_ENVOY_VERSION=1
+RIVET_WORKSPACE_TOKEN=replace-with-a-long-random-workspace-token
 # ---------------------------------------------------------------------------
 # 5. Zopu agent service (Flue)
 #    FLUE_DB_TOKEN authenticates the Flue persistence adapter.
 #    zopu-agent.service pins the Flue Node server to port 3583.
 # ---------------------------------------------------------------------------
 FLUE_DB_TOKEN=replace-with-long-random-token
+AGENT_BACKEND_URL=https://zopu-agent.example.com
 
 # ---------------------------------------------------------------------------
 # 6. Daemon identity
diff --git a/deploy/zopu-runtime/runner/docker-compose.yml b/deploy/zopu-runtime/runner/docker-compose.yml
index 72283c8..2a08b63 100644
--- a/deploy/zopu-runtime/runner/docker-compose.yml
+++ b/deploy/zopu-runtime/runner/docker-compose.yml
@@ -4,8 +4,19 @@ services:
       context: ../../..
       dockerfile: deploy/zopu-runtime/runner/Dockerfile
     environment:
+      AGENT_MODEL_API: ${AGENT_MODEL_API}
+      AGENT_MODEL_API_KEY: ${AGENT_MODEL_API_KEY}
+      AGENT_MODEL_BASE_URL: ${AGENT_MODEL_BASE_URL}
+      AGENT_MODEL_CONTEXT_WINDOW: ${AGENT_MODEL_CONTEXT_WINDOW}
+      AGENT_MODEL_MAX_TOKENS: ${AGENT_MODEL_MAX_TOKENS}
+      AGENT_MODEL_NAME: ${AGENT_MODEL_NAME}
+      AGENT_MODEL_PROVIDER: ${AGENT_MODEL_PROVIDER}
+      CONVEX_URL: ${CONVEX_URL}
+      DAEMON_ID: zopu-agentos-runner
+      FLUE_DB_TOKEN: ${FLUE_DB_TOKEN}
       RIVET_ENDPOINT: ${RIVET_ENDPOINT}
       RIVET_PUBLIC_ENDPOINT: ${RIVET_PUBLIC_ENDPOINT}
       RIVET_ENVOY_VERSION: ${RIVET_ENVOY_VERSION}
+      RIVET_WORKSPACE_TOKEN: ${RIVET_WORKSPACE_TOKEN}
       RIVET_POOL: default
     restart: unless-stopped
diff --git a/packages/agents/src/app.ts b/packages/agents/src/app.ts
index a8c101b..ad2fdcd 100644
--- a/packages/agents/src/app.ts
+++ b/packages/agents/src/app.ts
@@ -1,4 +1,5 @@
 import { parseAgentEnv } from "@code/env/agent";
+import { WorkAttemptExecutionError } from "@code/primitives/execution-runtime";
 import { registerProvider } from "@flue/runtime";
 import type { Fetchable } from "@flue/runtime/routing";
 import { flue } from "@flue/runtime/routing";
@@ -42,8 +43,23 @@ app.post("/internal/work-attempts/execute", async (context) => {
   try {
     return context.json(await executeAgentOsAttempt(await context.req.json()));
   } catch (error) {
+    const failure =
+      error instanceof WorkAttemptExecutionError
+        ? error
+        : new WorkAttemptExecutionError({
+            message:
+              error instanceof Error ? error.message : "Execution failed",
+            reason: "HarnessFailed",
+            retryable: false,
+          });
     return context.json(
-      { error: error instanceof Error ? error.message : "Execution failed" },
+      {
+        error: {
+          message: failure.message,
+          reason: failure.reason,
+          retryable: failure.retryable,
+        },
+      },
       500
     );
   }
@@ -55,7 +71,11 @@ app.post("/internal/work-attempts/:workspaceKey/cancel", async (context) => {
   ) {
     return context.json({ error: "Unauthorized" }, 401);
   }
-  await cancelAgentOsAttempt(context.req.param("workspaceKey"));
+  const body = (await context.req.json()) as { attemptId?: unknown };
+  if (typeof body.attemptId !== "string" || body.attemptId.length === 0) {
+    return context.json({ error: "attemptId is required" }, 400);
+  }
+  await cancelAgentOsAttempt(context.req.param("workspaceKey"), body.attemptId);
   return context.json({ cancelled: true });
 });
 
diff --git a/packages/agents/src/runtime/agent-os.ts b/packages/agents/src/runtime/agent-os.ts
index 2b0177b..c182e5e 100644
--- a/packages/agents/src/runtime/agent-os.ts
+++ b/packages/agents/src/runtime/agent-os.ts
@@ -7,13 +7,24 @@ import {
   codexSessionEnv,
   makeCodexAgentOsConfig,
 } from "../../../primitives/src/agent-os";
-import { decodeWorkAttemptExecutionInput } from "../../../primitives/src/execution-runtime";
+import {
+  decodeWorkAttemptExecutionInput,
+  WorkAttemptExecutionError,
+} from "../../../primitives/src/execution-runtime";
 import type {
   ExecutionEvent,
   WorkAttemptExecutionResult,
 } from "../../../primitives/src/execution-runtime";
 
-const workspace = agentOS(makeCodexAgentOsConfig() as never);
+const codexConfig = makeCodexAgentOsConfig();
+const workspace = agentOS<undefined, { token: string }>({
+  onBeforeConnect: (_context, params) => {
+    if (params.token !== process.env.RIVET_WORKSPACE_TOKEN) {
+      throw new Error("Unauthorized workspace connection");
+    }
+  },
+  software: codexConfig.software,
+});
 
 export const runtimeRegistry = setup({ use: { workspace } });
 
@@ -43,6 +54,32 @@ const requireSuccess = (
   return result.stdout.trim();
 };
 
+const executionError = (
+  message: string,
+  reason: WorkAttemptExecutionError["reason"],
+  retryable: boolean
+) => new WorkAttemptExecutionError({ message, reason, retryable });
+
+const classifyRuntimeFailure = (cause: unknown): WorkAttemptExecutionError => {
+  if (cause instanceof WorkAttemptExecutionError) {
+    return cause;
+  }
+  const message = cause instanceof Error ? cause.message : "Execution failed";
+  if (/auth|credential|401|403/iu.test(message)) {
+    return executionError(message, "Authentication", false);
+  }
+  if (/clone|checkout|repository|git /iu.test(message)) {
+    return executionError(message, "RepositoryFailed", false);
+  }
+  if (/timeout|timed out/iu.test(message)) {
+    return executionError(message, "Timeout", true);
+  }
+  if (/connect|network|unavailable|502|503|504/iu.test(message)) {
+    return executionError(message, "ProviderUnavailable", true);
+  }
+  return executionError(message, "HarnessFailed", false);
+};
+
 const gitAuthEnv = (username: string, credential: string) => ({
   GIT_CONFIG_COUNT: "1",
   GIT_CONFIG_KEY_0: "http.extraHeader",
@@ -52,162 +89,189 @@ const gitAuthEnv = (username: string, credential: string) => ({
 export const executeAgentOsAttempt = async (
   rawInput: unknown
 ): Promise<WorkAttemptExecutionResult> => {
-  const input = await Effect.runPromise(
-    decodeWorkAttemptExecutionInput(rawInput)
-  );
-  const env = parseAgentEnv(process.env);
-  const client = createClient<typeof runtimeRegistry>({
-    endpoint: env.RIVET_PUBLIC_ENDPOINT ?? env.RIVET_ENDPOINT,
-  });
-  const vm = client.workspace.getOrCreate([input.workspaceKey]);
-  const events: ExecutionEvent[] = [
-    event(0, "runtime.preparing", "AgentOS workspace selected", {
-      workspaceKey: input.workspaceKey,
-    }),
-  ];
-  const authEnv = gitAuthEnv(
-    input.auth.username ??
-      (input.auth.provider === "github" ? "x-access-token" : "git"),
-    input.auth.credential
-  );
-
-  await vm.mkdir("/workspace", { recursive: true });
-  if (!(await vm.exists("/workspace/repository/.git"))) {
-    events.push(event(1, "repository.cloning", "Cloning project repository"));
-    const clone = await vm.execArgv(
-      "git",
-      ["clone", input.repositoryUrl, "/workspace/repository"],
-      {
-        cwd: "/workspace",
-        env: authEnv,
-      }
+  try {
+    const input = await Effect.runPromise(
+      decodeWorkAttemptExecutionInput(rawInput)
     );
-    requireSuccess(clone, "Repository clone");
-  }
-
-  const checkout = await vm.exec(
-    `git fetch origin ${shellQuote(input.baseBranch)} && git checkout -B ${shellQuote(`zopu/${input.runId}`)} ${shellQuote(`origin/${input.baseBranch}`)}`,
-    { cwd: "/workspace/repository", env: authEnv }
-  );
-  requireSuccess(checkout, "Repository checkout");
-  const baseRevision = requireSuccess(
-    await vm.execArgv("git", ["rev-parse", "HEAD"], {
-      cwd: "/workspace/repository",
-    }),
-    "Base revision lookup"
-  );
-  events.push(
-    event(2, "repository.ready", "Repository checkout is ready", {
-      baseRevision,
-    })
-  );
-
-  const sessionId = `codex-${input.attemptId}`;
-  await vm.openSession({
-    additionalInstructions:
-      "Work only inside /workspace/repository. Do not reveal credentials. Make the requested change and run focused verification. Do not push or open a pull request.",
-    agent: "codex",
-    cwd: "/workspace/repository",
-    env: codexSessionEnv({
-      apiKey: env.AGENT_MODEL_API_KEY,
-      baseUrl: env.AGENT_MODEL_BASE_URL,
-      model: env.AGENT_MODEL_NAME,
-    }),
-    permissionPolicy: "allow_all",
-    sessionId,
-  });
-  events.push(
-    event(3, "harness.started", "Codex implementation session started")
-  );
-  const promptResult = await vm.prompt({
-    content: [{ text: input.prompt, type: "text" }],
-    idempotencyKey: input.attemptId,
-    sessionId,
-  });
-  events.push(
-    event(4, "harness.progress", "Codex implementation turn completed", {
-      stopReason: String(promptResult.stopReason),
-    })
-  );
-
-  const status = requireSuccess(
-    await vm.execArgv("git", ["status", "--porcelain"], {
-      cwd: "/workspace/repository",
-    }),
-    "Changed file lookup"
-  );
-  const diff = requireSuccess(
-    await vm.execArgv("git", ["diff", "--binary", "HEAD"], {
-      cwd: "/workspace/repository",
-    }),
-    "Diff collection"
-  );
-  const changedFiles = status
-    .split("\n")
-    .filter(Boolean)
-    .map((line) => line.slice(3).trim());
-  let candidateRevision = baseRevision;
-  if (changedFiles.length > 0) {
-    requireSuccess(
-      await vm.execArgv("git", ["add", "-A"], { cwd: "/workspace/repository" }),
-      "Candidate staging"
+    const env = parseAgentEnv(process.env);
+    const client = createClient<typeof runtimeRegistry>({
+      disableMetadataLookup: true,
+      endpoint: env.RIVET_PUBLIC_ENDPOINT ?? env.RIVET_ENDPOINT,
+    });
+    const vm = client.workspace.getOrCreate([input.workspaceKey], {
+      params: { token: env.RIVET_WORKSPACE_TOKEN },
+    });
+    const events: ExecutionEvent[] = [
+      event(0, "runtime.preparing", "AgentOS workspace selected", {
+        workspaceKey: input.workspaceKey,
+      }),
+    ];
+    const authEnv = gitAuthEnv(
+      input.auth.username ??
+        (input.auth.provider === "github" ? "x-access-token" : "git"),
+      input.auth.credential
     );
-    const tree = requireSuccess(
-      await vm.execArgv("git", ["write-tree"], {
+
+    await vm.mkdir("/workspace", { recursive: true });
+    if (!(await vm.exists("/workspace/repository/.git"))) {
+      events.push(event(1, "repository.cloning", "Cloning project repository"));
+      const clone = await vm.execArgv(
+        "git",
+        ["clone", input.repositoryUrl, "/workspace/repository"],
+        {
+          cwd: "/workspace",
+          env: authEnv,
+        }
+      );
+      requireSuccess(clone, "Repository clone");
+    }
+
+    const checkout = await vm.exec(
+      `git fetch origin ${shellQuote(input.baseBranch)} && git checkout -B ${shellQuote(`zopu/${input.runId}`)} ${shellQuote(`origin/${input.baseBranch}`)}`,
+      { cwd: "/workspace/repository", env: authEnv }
+    );
+    requireSuccess(checkout, "Repository checkout");
+    const baseRevision = requireSuccess(
+      await vm.execArgv("git", ["rev-parse", "HEAD"], {
         cwd: "/workspace/repository",
       }),
-      "Candidate tree creation"
+      "Base revision lookup"
     );
-    candidateRevision = requireSuccess(
-      await vm.exec(
-        `printf %s ${shellQuote(`Zopu candidate for ${input.attemptId}`)} | git commit-tree ${shellQuote(tree)} -p ${shellQuote(baseRevision)}`,
-        {
+    events.push(
+      event(2, "repository.ready", "Repository checkout is ready", {
+        baseRevision,
+      })
+    );
+
+    const sessionId = `codex-${input.attemptId}`;
+    await vm.openSession({
+      additionalInstructions:
+        "Work only inside /workspace/repository. Do not reveal credentials. Make the requested change and run focused verification. Do not push or open a pull request.",
+      agent: "codex",
+      cwd: "/workspace/repository",
+      env: codexSessionEnv({
+        apiKey: env.AGENT_MODEL_API_KEY,
+        baseUrl: env.AGENT_MODEL_BASE_URL,
+        model: env.AGENT_MODEL_NAME,
+      }),
+      permissionPolicy: "allow_all",
+      sessionId,
+    });
+    events.push(
+      event(3, "harness.started", "Codex implementation session started")
+    );
+    const promptResult = await vm.prompt({
+      content: [{ text: input.prompt, type: "text" }],
+      idempotencyKey: input.attemptId,
+      sessionId,
+    });
+    if (promptResult.stopReason !== "end_turn") {
+      const reason =
+        promptResult.stopReason === "cancelled" ? "Cancelled" : "HarnessFailed";
+      throw executionError(
+        `Codex stopped with ${promptResult.stopReason}`,
+        reason,
+        promptResult.stopReason === "max_tokens" ||
+          promptResult.stopReason === "max_turn_requests"
+      );
+    }
+    events.push(
+      event(4, "harness.progress", "Codex implementation turn completed", {
+        stopReason: promptResult.stopReason,
+      })
+    );
+
+    const status = requireSuccess(
+      await vm.execArgv("git", ["status", "--porcelain"], {
+        cwd: "/workspace/repository",
+      }),
+      "Changed file lookup"
+    );
+    const diff = requireSuccess(
+      await vm.execArgv("git", ["diff", "--binary", "HEAD"], {
+        cwd: "/workspace/repository",
+      }),
+      "Diff collection"
+    );
+    const changedFiles = status
+      .split("\n")
+      .filter(Boolean)
+      .map((line) => line.slice(3).trim());
+    let candidateRevision = baseRevision;
+    if (changedFiles.length > 0) {
+      requireSuccess(
+        await vm.execArgv("git", ["add", "-A"], {
           cwd: "/workspace/repository",
-          env: {
-            GIT_AUTHOR_EMAIL: "agent@zopu.dev",
-            GIT_AUTHOR_NAME: "Zopu Agent",
-            GIT_COMMITTER_EMAIL: "agent@zopu.dev",
-            GIT_COMMITTER_NAME: "Zopu Agent",
-          },
+        }),
+        "Candidate staging"
+      );
+      const tree = requireSuccess(
+        await vm.execArgv("git", ["write-tree"], {
+          cwd: "/workspace/repository",
+        }),
+        "Candidate tree creation"
+      );
+      candidateRevision = requireSuccess(
+        await vm.exec(
+          `printf %s ${shellQuote(`Zopu candidate for ${input.attemptId}`)} | git commit-tree ${shellQuote(tree)} -p ${shellQuote(baseRevision)}`,
+          {
+            cwd: "/workspace/repository",
+            env: {
+              GIT_AUTHOR_EMAIL: "agent@zopu.dev",
+              GIT_AUTHOR_NAME: "Zopu Agent",
+              GIT_COMMITTER_EMAIL: "agent@zopu.dev",
+              GIT_COMMITTER_NAME: "Zopu Agent",
+            },
+          }
+        ),
+        "Candidate revision creation"
+      );
+      requireSuccess(
+        await vm.execArgv("git", ["reset"], { cwd: "/workspace/repository" }),
+        "Candidate index reset"
+      );
+    }
+    events.push(
+      event(
+        5,
+        "repository.changed",
+        `${changedFiles.length} changed file(s) collected`,
+        {
+          candidateRevision,
         }
       ),
-      "Candidate revision creation"
+      event(6, "runtime.completed", "AgentOS execution completed")
     );
-    requireSuccess(
-      await vm.execArgv("git", ["reset"], { cwd: "/workspace/repository" }),
-      "Candidate index reset"
-    );
-  }
-  events.push(
-    event(
-      5,
-      "repository.changed",
-      `${changedFiles.length} changed file(s) collected`,
-      {
-        candidateRevision,
-      }
-    ),
-    event(6, "runtime.completed", "AgentOS execution completed")
-  );
 
-  return {
-    baseRevision,
-    candidateRevision,
-    changedFiles,
-    diff,
-    environmentId: input.workspaceKey,
-    events,
-    summary:
-      changedFiles.length > 0
-        ? `Codex changed ${changedFiles.length} file(s)`
-        : "Codex completed without repository changes",
-  };
+    return {
+      baseRevision,
+      candidateRevision,
+      changedFiles,
+      diff,
+      environmentId: input.workspaceKey,
+      events,
+      summary:
+        changedFiles.length > 0
+          ? `Codex changed ${changedFiles.length} file(s)`
+          : "Codex completed without repository changes",
+    };
+  } catch (error) {
+    throw classifyRuntimeFailure(error);
+  }
 };
 
-export const cancelAgentOsAttempt = async (workspaceKey: string) => {
+export const cancelAgentOsAttempt = async (
+  workspaceKey: string,
+  attemptId: string
+) => {
   const env = parseAgentEnv(process.env);
   const client = createClient<typeof runtimeRegistry>({
+    disableMetadataLookup: true,
     endpoint: env.RIVET_PUBLIC_ENDPOINT ?? env.RIVET_ENDPOINT,
   });
-  await client.workspace.getOrCreate([workspaceKey]).cancelPrompt({});
+  await client.workspace
+    .getOrCreate([workspaceKey], {
+      params: { token: env.RIVET_WORKSPACE_TOKEN },
+    })
+    .cancelPrompt({ sessionId: `codex-${attemptId}` });
 };
diff --git a/packages/backend/convex/gitConnectionData.ts b/packages/backend/convex/gitConnectionData.ts
index bd3fd9a..b161111 100644
--- a/packages/backend/convex/gitConnectionData.ts
+++ b/packages/backend/convex/gitConnectionData.ts
@@ -3,6 +3,21 @@ import { ConvexError, v } from "convex/values";
 import { internalMutation, mutation, query } from "./_generated/server";
 import { requireCurrentOrganization, requireProjectMember } from "./authz";
 
+// Provider ("forge") that owns a repository host. A project's source must be
+// served by the same forge whose credentials are attached, so a Gitea token is
+// never offered to GitHub and vice versa. Unknown hosts return null, leaving
+// the caller free to attach without a forge constraint.
+export const forgeForHost = (host: string): "github" | "gitea" | null => {
+  const normalized = host.toLowerCase();
+  if (normalized === "github.com" || normalized.endsWith(".githost.com")) {
+    return "github";
+  }
+  if (normalized === "git.openputer.com") {
+    return "gitea";
+  }
+  return null;
+};
+
 export const persist = internalMutation({
   args: {
     credentialCiphertext: v.string(),
@@ -110,6 +125,15 @@ export const attachToProject = mutation({
     if (!connection || connection.organizationId !== organizationId) {
       throw new ConvexError("Git connection not found");
     }
+    const project = await ctx.db.get(args.projectId);
+    if (project) {
+      const expected = forgeForHost(project.sourceHost);
+      if (expected && connection.provider !== expected) {
+        throw new ConvexError(
+          `Git credential provider (${connection.provider}) does not match this project's forge (${expected})`
+        );
+      }
+    }
     await ctx.db.patch(args.projectId, {
       gitConnectionId: connection._id,
       updatedAt: Date.now(),
diff --git a/packages/backend/convex/schema.ts b/packages/backend/convex/schema.ts
index d0395bf..7fc2f24 100644
--- a/packages/backend/convex/schema.ts
+++ b/packages/backend/convex/schema.ts
@@ -368,6 +368,17 @@ export default defineSchema({
   workAttempts: defineTable({
     classification: v.optional(attemptClassification),
     endedAt: v.optional(v.number()),
+    failureReason: v.optional(
+      v.union(
+        v.literal("Authentication"),
+        v.literal("Cancelled"),
+        v.literal("HarnessFailed"),
+        v.literal("InvalidInput"),
+        v.literal("ProviderUnavailable"),
+        v.literal("RepositoryFailed"),
+        v.literal("Timeout")
+      )
+    ),
     leaseExpiresAt: v.optional(v.number()),
     leaseOwner: v.optional(v.string()),
     number: v.number(),
diff --git a/packages/backend/convex/workExecutionAgent.ts b/packages/backend/convex/workExecutionAgent.ts
index f198c51..ffd0774 100644
--- a/packages/backend/convex/workExecutionAgent.ts
+++ b/packages/backend/convex/workExecutionAgent.ts
@@ -1,7 +1,11 @@
 "use node";
 
 import { env } from "@code/env/convex";
-import { decodeWorkAttemptExecutionResult } from "@code/primitives/execution-runtime";
+import {
+  WorkAttemptExecutionError,
+  decodeWorkAttemptExecutionFailure,
+  decodeWorkAttemptExecutionResult,
+} from "@code/primitives/execution-runtime";
 import { ConvexError, v } from "convex/values";
 import { Effect } from "effect";
 
@@ -56,23 +60,36 @@ export const executeAttempt = internalAction({
     );
     const payload = (await response.json()) as unknown;
     if (!response.ok) {
-      throw new ConvexError(
-        typeof payload === "object" && payload && "error" in payload
-          ? String(payload.error)
-          : `Agent backend returned ${response.status}`
+      // Decode the agent's classified failure envelope and re-throw as the
+      // typed runtime error so the workflow handler maps reason/retryable to
+      // a durable attempt classification. A malformed envelope falls back to
+      // an InvalidInput failure (non-retryable).
+      const failure = await Effect.runPromise(
+        decodeWorkAttemptExecutionFailure(payload)
       );
+      throw new WorkAttemptExecutionError(failure.error);
     }
     return await Effect.runPromise(decodeWorkAttemptExecutionResult(payload));
   },
 });
 
 export const cancelAttempt = internalAction({
-  args: { workspaceKey: v.string() },
+  args: {
+    attemptId: v.string(),
+    workspaceKey: v.string(),
+  },
   handler: async (_ctx, args) => {
+    // The workspace key remains the URL path segment (workspace identity),
+    // while the body carries the attemptId so the runtime can target the
+    // codex session `codex-${attemptId}` for cancellation.
     await fetch(
       `${backendUrl()}/internal/work-attempts/${encodeURIComponent(args.workspaceKey)}/cancel`,
       {
-        headers: { authorization: `Bearer ${env.FLUE_DB_TOKEN}` },
+        body: JSON.stringify({ attemptId: args.attemptId }),
+        headers: {
+          authorization: `Bearer ${env.FLUE_DB_TOKEN}`,
+          "content-type": "application/json",
+        },
         method: "POST",
       }
     );
diff --git a/packages/backend/convex/workExecutionWorkflow.test.ts b/packages/backend/convex/workExecutionWorkflow.test.ts
index 9c604df..a9ec942 100644
--- a/packages/backend/convex/workExecutionWorkflow.test.ts
+++ b/packages/backend/convex/workExecutionWorkflow.test.ts
@@ -7,94 +7,116 @@ import schema from "./schema";
 const modules = import.meta.glob("./**/*.ts");
 const api = anyApi;
 
+type TestContext = ReturnType<typeof convexTest>;
+
+interface Seeded {
+  attemptId: string;
+  runId: string;
+  t: TestContext;
+  workId: string;
+}
+
+// Seed an in-flight real attempt so each mutation under test starts from a
+// realistic running state: Work "executing", Run "running", Attempt "running".
+const seedRunningAttempt = async (
+  overrides: {
+    attemptStatus?: "queued" | "claimed" | "running" | "terminal";
+    runStatus?: "ready" | "running" | "terminal" | "cancelled";
+  } = {}
+): Promise<Seeded> => {
+  const t = convexTest({ modules, schema });
+  const seeded = await t.run(async (ctx) => {
+    const organizationId = await ctx.db.insert("organizations", {
+      createdAt: 1,
+      createdBy: "user",
+      kind: "personal",
+      name: "Personal",
+    });
+    const projectId = await ctx.db.insert("projects", {
+      createdAt: 1,
+      name: "Zopu",
+      normalizedSourceUrl: "https://github.com/puter/zopu",
+      organizationId,
+      repositoryPath: "puter/zopu",
+      sourceHost: "github.com",
+      sourceUrl: "https://github.com/puter/zopu",
+      updatedAt: 1,
+    });
+    const workId = await ctx.db.insert("works", {
+      createdAt: 1,
+      objective: "Implement a real slice",
+      organizationId,
+      projectId,
+      status: "executing",
+      title: "Real execution",
+      updatedAt: 1,
+    });
+    const sliceRowId = await ctx.db.insert("workSlices", {
+      designVersion: 1,
+      objective: "Change the repo",
+      observableBehavior: "A diff exists",
+      ordinal: 0,
+      payloadJson: "{}",
+      sliceId: "slice-1",
+      status: "running",
+      title: "Implementation",
+      workId,
+    });
+    const runId = await ctx.db.insert("workRuns", {
+      createdAt: 1,
+      designVersion: 1,
+      executionKind: "real",
+      kitId: "coding-v0",
+      kitVersion: "1",
+      scenario: "success",
+      sliceId: "slice-1",
+      sliceRowId,
+      status: overrides.runStatus ?? "running",
+      workId,
+    });
+    const attemptId = await ctx.db.insert("workAttempts", {
+      number: 1,
+      runId,
+      status: overrides.attemptStatus ?? "running",
+      workId,
+      workspaceKey: "workspace-1",
+    });
+    return { attemptId, runId, workId };
+  });
+  return { ...seeded, t };
+};
+
+const successResult = {
+  baseRevision: "base123",
+  candidateRevision: "candidate456",
+  changedFiles: ["src/index.ts"],
+  diff: "+export const ready = true;",
+  environmentId: "workspace-1",
+  events: [
+    {
+      kind: "runtime.completed",
+      message: "completed",
+      metadata: {},
+      occurredAt: 2,
+      sequence: 0,
+    },
+  ],
+  summary: "Changed one file",
+};
+
 describe("real work execution persistence", () => {
   test("records revisions, activity, diff, and terminal state atomically", async () => {
-    const t = convexTest({ modules, schema });
-    const seeded = await t.run(async (ctx) => {
-      const organizationId = await ctx.db.insert("organizations", {
-        createdAt: 1,
-        createdBy: "user",
-        kind: "personal",
-        name: "Personal",
-      });
-      const projectId = await ctx.db.insert("projects", {
-        createdAt: 1,
-        name: "Zopu",
-        normalizedSourceUrl: "https://example.com/zopu",
-        organizationId,
-        repositoryPath: "puter/zopu",
-        sourceHost: "example.com",
-        sourceUrl: "https://example.com/zopu",
-        updatedAt: 1,
-      });
-      const workId = await ctx.db.insert("works", {
-        createdAt: 1,
-        objective: "Implement a real slice",
-        organizationId,
-        projectId,
-        status: "executing",
-        title: "Real execution",
-        updatedAt: 1,
-      });
-      const sliceRowId = await ctx.db.insert("workSlices", {
-        designVersion: 1,
-        objective: "Change the repo",
-        observableBehavior: "A diff exists",
-        ordinal: 0,
-        payloadJson: "{}",
-        sliceId: "slice-1",
-        status: "running",
-        title: "Implementation",
-        workId,
-      });
-      const runId = await ctx.db.insert("workRuns", {
-        createdAt: 1,
-        designVersion: 1,
-        executionKind: "real",
-        kitId: "coding-v0",
-        kitVersion: "1",
-        scenario: "success",
-        sliceId: "slice-1",
-        sliceRowId,
-        status: "running",
-        workId,
-      });
-      const attemptId = await ctx.db.insert("workAttempts", {
-        number: 1,
-        runId,
-        status: "running",
-        workId,
-        workspaceKey: "workspace-1",
-      });
-      return { attemptId, runId, workId };
-    });
-
+    const { t, ...seeded } = await seedRunningAttempt();
     await t.mutation(api.workExecutionWorkflow.completeAttempt, {
       attemptId: seeded.attemptId,
-      result: {
-        baseRevision: "base123",
-        candidateRevision: "candidate456",
-        changedFiles: ["src/index.ts"],
-        diff: "+export const ready = true;",
-        environmentId: "workspace-1",
-        events: [
-          {
-            kind: "runtime.completed",
-            message: "completed",
-            metadata: {},
-            occurredAt: 2,
-            sequence: 0,
-          },
-        ],
-        summary: "Changed one file",
-      },
+      result: successResult,
     });
 
     const state = await t.run(async (ctx) => ({
       artifacts: await ctx.db.query("workArtifacts").collect(),
-      attempt: await ctx.db.get(seeded.attemptId),
-      run: await ctx.db.get(seeded.runId),
-      work: await ctx.db.get(seeded.workId),
+      attempt: await ctx.db.get(seeded.attemptId as any),
+      run: await ctx.db.get(seeded.runId as any),
+      work: await ctx.db.get(seeded.workId as any),
     }));
     expect(state.attempt?.classification).toBe("Succeeded");
     expect(state.run).toMatchObject({
@@ -109,3 +131,251 @@ describe("real work execution persistence", () => {
     });
   });
 });
+
+describe("classified failure mapping", () => {
+  test("maps a transient runtime reason to a retryable classification", async () => {
+    const { t, ...seeded } = await seedRunningAttempt();
+    await t.mutation(api.workExecutionWorkflow.failAttempt, {
+      attemptId: seeded.attemptId,
+      reason: "ProviderUnavailable",
+      retryable: true,
+      summary: "model provider timed out",
+    });
+    const attempt = await t.run((ctx) => ctx.db.get(seeded.attemptId as any));
+    expect(attempt?.classification).toBe("RetryableFailure");
+    expect(attempt?.failureReason).toBe("ProviderUnavailable");
+  });
+
+  test("queues a new attempt without terminalizing a retryable run", async () => {
+    const { t, ...seeded } = await seedRunningAttempt();
+    await t.mutation(api.workExecutionWorkflow.failAttempt, {
+      attemptId: seeded.attemptId,
+      reason: "ProviderUnavailable",
+      retryable: true,
+      summary: "provider unavailable",
+    });
+    const state = await t.run(async (ctx) => ({
+      attempts: await ctx.db.query("workAttempts").collect(),
+      run: await ctx.db.get(seeded.runId as any),
+      work: await ctx.db.get(seeded.workId as any),
+    }));
+    expect(state.attempts).toHaveLength(2);
+    expect(state.attempts[1]).toMatchObject({
+      number: 2,
+      status: "queued",
+      workspaceKey: "workspace-1",
+    });
+    expect(state.run?.status).toBe("running");
+    expect(state.work?.status).toBe("executing");
+  });
+  test("maps an authentication reason to a permanent failure", async () => {
+    const { t, ...seeded } = await seedRunningAttempt();
+    await t.mutation(api.workExecutionWorkflow.failAttempt, {
+      attemptId: seeded.attemptId,
+      reason: "Authentication",
+      retryable: false,
+      summary: "token rejected",
+    });
+    const state = await t.run(async (ctx) => ({
+      attempt: await ctx.db.get(seeded.attemptId as any),
+      run: await ctx.db.get(seeded.runId as any),
+      work: await ctx.db.get(seeded.workId as any),
+    }));
+    expect(state.attempt?.classification).toBe("PermanentFailure");
+    expect(state.attempt?.failureReason).toBe("Authentication");
+    expect(state.run?.terminalClassification).toBe("PermanentFailure");
+    expect(state.work?.status).toBe("failed");
+  });
+});
+
+describe("cancellation fencing", () => {
+  test("a cancelled attempt cannot later settle success", async () => {
+    const { t, ...seeded } = await seedRunningAttempt();
+    // Simulate cancellation marking the attempt/run terminal as Cancelled.
+    await t.run(async (ctx) => {
+      await ctx.db.patch(seeded.attemptId as any, {
+        classification: "Cancelled",
+        endedAt: 5,
+        status: "terminal",
+        summary: "Execution cancelled",
+      });
+      await ctx.db.patch(seeded.runId as any, {
+        endedAt: 5,
+        status: "cancelled",
+        terminalClassification: "Cancelled",
+        terminalSummary: "Execution cancelled",
+      });
+    });
+    // A late-arriving completion must be ignored.
+    await t.mutation(api.workExecutionWorkflow.completeAttempt, {
+      attemptId: seeded.attemptId,
+      result: successResult,
+    });
+    const attempt = await t.run((ctx) => ctx.db.get(seeded.attemptId as any));
+    expect(attempt?.classification).toBe("Cancelled");
+    expect(attempt?.status).toBe("terminal");
+  });
+
+  test("a late failure does not overwrite a cancelled run", async () => {
+    const { t, ...seeded } = await seedRunningAttempt();
+    await t.run(async (ctx) => {
+      await ctx.db.patch(seeded.attemptId as any, {
+        classification: "Cancelled",
+        endedAt: 5,
+        status: "terminal",
+      });
+      await ctx.db.patch(seeded.runId as any, { status: "cancelled" });
+    });
+    await t.mutation(api.workExecutionWorkflow.failAttempt, {
+      attemptId: seeded.attemptId,
+      reason: "HarnessFailed",
+      retryable: true,
+      summary: "late failure",
+    });
+    const attempt = await t.run((ctx) => ctx.db.get(seeded.attemptId as any));
+    expect(attempt?.classification).toBe("Cancelled");
+  });
+});
+
+describe("empty-change rejection", () => {
+  test("a no-op result with no changed files fails as permanent", async () => {
+    const { t, ...seeded } = await seedRunningAttempt();
+    await t.mutation(api.workExecutionWorkflow.completeAttempt, {
+      attemptId: seeded.attemptId,
+      result: {
+        ...successResult,
+        changedFiles: [],
+        candidateRevision: "base123",
+      },
+    });
+    const state = await t.run(async (ctx) => ({
+      attempt: await ctx.db.get(seeded.attemptId as any),
+      work: await ctx.db.get(seeded.workId as any),
+    }));
+    expect(state.attempt?.classification).toBe("PermanentFailure");
+    expect(state.attempt?.failureReason).toBe("InvalidInput");
+    expect(state.work?.status).toBe("failed");
+  });
+
+  test("identical base and candidate revisions are rejected", async () => {
+    const { t, ...seeded } = await seedRunningAttempt();
+    await t.mutation(api.workExecutionWorkflow.completeAttempt, {
+      attemptId: seeded.attemptId,
+      result: {
+        ...successResult,
+        baseRevision: "same",
+        candidateRevision: "same",
+      },
+    });
+    const attempt = await t.run((ctx) => ctx.db.get(seeded.attemptId as any));
+    expect(attempt?.classification).toBe("PermanentFailure");
+  });
+});
+
+describe("attempt re-entry", () => {
+  test("markAttemptRunning re-claims an already-running attempt", async () => {
+    const { t, ...seeded } = await seedRunningAttempt();
+    // First claim (already "running" from seed) must still succeed so a
+    // workflow replay can re-enter the same live attempt.
+    const first = await t.mutation(
+      api.workExecutionWorkflow.markAttemptRunning,
+      { attemptId: seeded.attemptId }
+    );
+    expect(first).toBe(true);
+    const attempt = await t.run((ctx) => ctx.db.get(seeded.attemptId as any));
+    expect(attempt?.status).toBe("running");
+    expect(attempt?.leaseExpiresAt).toBeGreaterThan(0);
+  });
+
+  test("a terminal attempt is not re-runnable", async () => {
+    const { t, ...seeded } = await seedRunningAttempt({
+      attemptStatus: "terminal",
+    });
+    const result = await t.mutation(
+      api.workExecutionWorkflow.markAttemptRunning,
+      { attemptId: seeded.attemptId }
+    );
+    expect(result).toBe(false);
+  });
+  test("a cancelled run cannot re-enter a queued attempt", async () => {
+    const { t, ...seeded } = await seedRunningAttempt({
+      attemptStatus: "queued",
+      runStatus: "cancelled",
+    });
+    const result = await t.mutation(
+      api.workExecutionWorkflow.markAttemptRunning,
+      { attemptId: seeded.attemptId }
+    );
+    expect(result).toBe(false);
+    const attempt = await t.run((ctx) => ctx.db.get(seeded.attemptId as any));
+    expect(attempt?.status).toBe("queued");
+  });
+});
+
+describe("forge credential validation", () => {
+  const identity = { tokenIdentifier: "https://convex.test|forge-user" };
+
+  const seedForgableProject = async (
+    provider: "github" | "gitea",
+    sourceHost: string
+  ) => {
+    const t = convexTest({ modules, schema }).withIdentity(identity);
+    const ids = await t.run(async (ctx) => {
+      const organizationId = await ctx.db.insert("organizations", {
+        createdAt: 1,
+        createdBy: identity.tokenIdentifier,
+        kind: "personal",
+        name: "Personal",
+      });
+      await ctx.db.insert("organizationMembers", {
+        createdAt: 1,
+        organizationId,
+        role: "owner",
+        userId: identity.tokenIdentifier,
+      });
+      const projectId = await ctx.db.insert("projects", {
+        createdAt: 1,
+        name: "Zopu",
+        normalizedSourceUrl: `https://${sourceHost}/puter/zopu`,
+        organizationId,
+        repositoryPath: "puter/zopu",
+        sourceHost,
+        sourceUrl: `https://${sourceHost}/puter/zopu`,
+        updatedAt: 1,
+      });
+      const connectionId = await ctx.db.insert("gitConnections", {
+        connectedAt: 1,
+        credentialCiphertext: "x",
+        credentialIv: "y",
+        credentialKind: provider === "github" ? "oauth" : "token",
+        organizationId,
+        provider,
+        serverUrl: `https://${sourceHost}`,
+        updatedAt: 1,
+        username: "zopu",
+      });
+      return { connectionId, projectId };
+    });
+    return { t, ids };
+  };
+
+  test("rejects a git connection whose provider mismatches the project forge", async () => {
+    // Gitea token attached to a GitHub-hosted project.
+    const { t, ids } = await seedForgableProject("gitea", "github.com");
+    await expect(
+      t.mutation(api.gitConnectionData.attachToProject, {
+        connectionId: ids.connectionId,
+        projectId: ids.projectId,
+      })
+    ).rejects.toThrow(/does not match this project's forge/u);
+  });
+
+  test("accepts a matching provider for the project forge", async () => {
+    const { t, ids } = await seedForgableProject("github", "github.com");
+    const result = await t.mutation(api.gitConnectionData.attachToProject, {
+      connectionId: ids.connectionId,
+      projectId: ids.projectId,
+    });
+    expect(result).toMatchObject({ attached: true });
+  });
+});
diff --git a/packages/backend/convex/workExecutionWorkflow.ts b/packages/backend/convex/workExecutionWorkflow.ts
index 2ba2909..9c11810 100644
--- a/packages/backend/convex/workExecutionWorkflow.ts
+++ b/packages/backend/convex/workExecutionWorkflow.ts
@@ -1,4 +1,7 @@
-import { defaultCodingKitV0 } from "@code/primitives/resolver";
+import { WorkAttemptExecutionError } from "@code/primitives/execution-runtime";
+import type { WorkAttemptExecutionErrorReason } from "@code/primitives/execution-runtime";
+import { defaultCodingKitV0, resolveOutcome } from "@code/primitives/resolver";
+import type { AttemptClassification } from "@code/primitives/resolver";
 import { WorkflowManager } from "@convex-dev/workflow";
 import type { WorkflowId } from "@convex-dev/workflow";
 import { ConvexError, v } from "convex/values";
@@ -8,9 +11,68 @@ import type { Doc, Id } from "./_generated/dataModel";
 import { internalMutation, internalQuery, mutation } from "./_generated/server";
 import type { MutationCtx } from "./_generated/server";
 import { requireProjectMember } from "./authz";
+import { forgeForHost } from "./gitConnectionData";
 
 export const workflow = new WorkflowManager(components.workflow);
 
+// Lease window for a running real attempt. Long enough to outlast a single
+// agent turn; the workflow's own retry/lease reconciliation covers crashes.
+const LEASE_MS = 5 * 60_000;
+
+// Runtime failure reason -> durable attempt classification. The Convex
+// workflow stores classifications, not provider-specific reasons, so the
+// resolver and Work lifecycle stay forge-agnostic. `retryable` from the
+// runtime is carried alongside and consulted by the kit retry policy.
+const FAILURE_REASON_CLASSIFICATION = {
+  Authentication: "PermanentFailure",
+  Cancelled: "Cancelled",
+  HarnessFailed: "RetryableFailure",
+  InvalidInput: "PermanentFailure",
+  ProviderUnavailable: "RetryableFailure",
+  RepositoryFailed: "PermanentFailure",
+  Timeout: "RetryableFailure",
+} as const satisfies Record<
+  WorkAttemptExecutionErrorReason,
+  AttemptClassification
+>;
+
+export const classifyFailure = (
+  reason: WorkAttemptExecutionErrorReason
+): AttemptClassification => FAILURE_REASON_CLASSIFICATION[reason];
+
+// Normalize an error thrown from the agent action into the durable failure
+// triple (reason/retryable/summary). WorkAttemptExecutionError is the
+// classified runtime failure; anything else is a Convex/infrastructure error
+// treated as a transient HarnessFailed so the workflow retry policy decides.
+const toExecutionFailure = (
+  error: unknown
+): {
+  message: string;
+  reason: WorkAttemptExecutionErrorReason;
+  retryable: boolean;
+} =>
+  error instanceof WorkAttemptExecutionError
+    ? {
+        message: error.message,
+        reason: error.reason,
+        retryable: error.retryable,
+      }
+    : {
+        message: error instanceof Error ? error.message : "Execution failed",
+        reason: "HarnessFailed",
+        retryable: true,
+      };
+
+const failureReasonValues = v.union(
+  v.literal("Authentication"),
+  v.literal("Cancelled"),
+  v.literal("HarnessFailed"),
+  v.literal("InvalidInput"),
+  v.literal("ProviderUnavailable"),
+  v.literal("RepositoryFailed"),
+  v.literal("Timeout")
+);
+
 const resolveReadySlice = async (
   ctx: MutationCtx,
   work: Doc<"works">,
@@ -36,6 +98,34 @@ const resolveReadySlice = async (
   return slice;
 };
 
+// Deployment prerequisite gate for real execution. Rejects before any
+// workflow/sandbox starts when the project lacks an attached, forge-matched
+// Git connection with a cloneable source URL and default branch. Returns the
+// validated connection so the caller can pass it to the agent unchanged.
+const validateProjectDeployment = async (
+  ctx: MutationCtx,
+  work: Doc<"works">
+): Promise<Doc<"gitConnections">> => {
+  const project = await ctx.db.get(work.projectId);
+  if (!project) {
+    throw new ConvexError("Project not found");
+  }
+  if (!project.gitConnectionId) {
+    throw new ConvexError("Connect Git credentials to this project first");
+  }
+  const connection = await ctx.db.get(project.gitConnectionId);
+  if (!connection) {
+    throw new ConvexError("Git connection not found");
+  }
+  const expected = forgeForHost(project.sourceHost);
+  if (expected && connection.provider !== expected) {
+    throw new ConvexError(
+      `Git credential provider (${connection.provider}) does not match this project's forge (${expected})`
+    );
+  }
+  return connection;
+};
+
 export const execute = workflow
   .define({ args: { attemptId: v.id("workAttempts") } })
   .handler(async (step, args): Promise<void> => {
@@ -57,9 +147,12 @@ export const execute = workflow
         },
       });
     } catch (error) {
+      const failure = toExecutionFailure(error);
       await step.runMutation(internal.workExecutionWorkflow.failAttempt, {
         attemptId: args.attemptId,
-        summary: error instanceof Error ? error.message : "Execution failed",
+        reason: failure.reason,
+        retryable: failure.retryable,
+        summary: failure.message,
       });
     }
   });
@@ -91,10 +184,7 @@ export const startExecution = mutation({
     ) {
       throw new ConvexError("Execution requires exact approved versions");
     }
-    const project = await ctx.db.get(work.projectId);
-    if (!project?.gitConnectionId) {
-      throw new ConvexError("Connect Git credentials to this project first");
-    }
+    await validateProjectDeployment(ctx, work);
     const slice = await resolveReadySlice(ctx, work, args.sliceId);
     const createdAt = Date.now();
     const runId = await ctx.db.insert("workRuns", {
@@ -159,6 +249,12 @@ export const executionContext = internalQuery({
     if (!connection) {
       throw new ConvexError("Git connection not found");
     }
+    const expectedForge = forgeForHost(project.sourceHost);
+    if (expectedForge && connection.provider !== expectedForge) {
+      throw new ConvexError(
+        `Git credential provider (${connection.provider}) does not match this project's forge (${expectedForge})`
+      );
+    }
     return {
       attempt,
       connection,
@@ -179,11 +275,16 @@ export const markAttemptRunning = internalMutation({
   args: { attemptId: v.id("workAttempts") },
   handler: async (ctx, args) => {
     const attempt = await ctx.db.get(args.attemptId);
-    if (!attempt || attempt.status !== "queued") {
+    if (!attempt || attempt.status === "terminal") {
+      return false;
+    }
+    const run = await ctx.db.get(attempt.runId);
+    if (!run || run.status !== "running") {
       return false;
     }
     await ctx.db.patch(attempt._id, {
-      startedAt: Date.now(),
+      leaseExpiresAt: Date.now() + LEASE_MS,
+      startedAt: attempt.startedAt ?? Date.now(),
       status: "running",
     });
     return true;
@@ -193,7 +294,8 @@ export const markAttemptRunning = internalMutation({
 const settleSliceAndWork = async (
   ctx: MutationCtx,
   run: Doc<"workRuns">,
-  succeeded: boolean
+  succeeded: boolean,
+  workStatus: Doc<"works">["status"]
 ) => {
   if (!run.sliceRowId) {
     return;
@@ -202,12 +304,18 @@ const settleSliceAndWork = async (
   if (!slice) {
     return;
   }
-  await ctx.db.patch(slice._id, { status: succeeded ? "completed" : "ready" });
+  let sliceStatus: "blocked" | "completed" | "ready" = "ready";
+  if (succeeded) {
+    sliceStatus = "completed";
+  } else if (workStatus === "blocked") {
+    sliceStatus = "blocked";
+  }
+  await ctx.db.patch(slice._id, { status: sliceStatus });
   const work = await ctx.db.get(run.workId);
   if (!work) {
     return;
   }
-  let status: Doc<"works">["status"] = succeeded ? "completed" : "failed";
+  let status = workStatus;
   if (succeeded) {
     const slices = await ctx.db
       .query("workSlices")
@@ -249,6 +357,8 @@ export const completeAttempt = internalMutation({
   },
   handler: async (ctx, args) => {
     const attempt = await ctx.db.get(args.attemptId);
+    // Cancellation fencing: a terminal or cancelled attempt/run must never
+    // later settle success, even if the agent action raced to completion.
     if (!attempt || attempt.status === "terminal") {
       return;
     }
@@ -257,6 +367,33 @@ export const completeAttempt = internalMutation({
     if (!run || !work) {
       throw new ConvexError("Execution records not found");
     }
+    if (run.status === "terminal" || run.status === "cancelled") {
+      return;
+    }
+    // Empty-change rejection: a no-op result (no changed files, or identical
+    // base/candidate revisions) is not a successful implementation. Fail it
+    // as a permanent InvalidInput so the resolver does not mark Work done.
+    const noOp =
+      args.result.changedFiles.length === 0 ||
+      args.result.baseRevision === args.result.candidateRevision;
+    if (noOp) {
+      await ctx.db.patch(attempt._id, {
+        classification: "PermanentFailure",
+        endedAt: Date.now(),
+        failureReason: "InvalidInput",
+        leaseExpiresAt: undefined,
+        status: "terminal",
+        summary: "Execution produced no repository changes",
+      });
+      await ctx.db.patch(run._id, {
+        endedAt: Date.now(),
+        status: "terminal",
+        terminalClassification: "PermanentFailure",
+        terminalSummary: "Execution produced no repository changes",
+      });
+      await settleSliceAndWork(ctx, run, false, "failed");
+      return;
+    }
     for (const item of args.result.events) {
       await ctx.db.insert("workAttemptEvents", {
         attemptId: attempt._id,
@@ -271,6 +408,7 @@ export const completeAttempt = internalMutation({
     await ctx.db.patch(attempt._id, {
       classification: "Succeeded",
       endedAt,
+      leaseExpiresAt: undefined,
       status: "terminal",
       summary: args.result.summary,
     });
@@ -309,7 +447,7 @@ export const completeAttempt = internalMutation({
           }
         : {}),
     });
-    await settleSliceAndWork(ctx, run, true);
+    await settleSliceAndWork(ctx, run, true, "completed");
     await ctx.db.insert("workEvents", {
       createdAt: endedAt,
       idempotencyKey: `real-run-completed:${run._id}`,
@@ -321,31 +459,107 @@ export const completeAttempt = internalMutation({
   },
 });
 
-export const failAttempt = internalMutation({
-  args: { attemptId: v.id("workAttempts"), summary: v.string() },
+export const launchAttemptWorkflow = internalMutation({
+  args: { attemptId: v.id("workAttempts") },
   handler: async (ctx, args) => {
     const attempt = await ctx.db.get(args.attemptId);
     if (!attempt || attempt.status === "terminal") {
       return;
     }
     const run = await ctx.db.get(attempt.runId);
-    if (!run) {
+    if (!run || run.status !== "running") {
       return;
     }
+    const workflowId: WorkflowId = await workflow.start(
+      ctx,
+      internal.workExecutionWorkflow.execute,
+      args
+    );
+    await ctx.db.patch(run._id, { workflowId });
+  },
+});
+
+export const failAttempt = internalMutation({
+  args: {
+    attemptId: v.id("workAttempts"),
+    reason: failureReasonValues,
+    retryable: v.boolean(),
+    summary: v.string(),
+  },
+  handler: async (ctx, args) => {
+    const attempt = await ctx.db.get(args.attemptId);
+    // Cancellation fencing: once an attempt or run is terminal/cancelled, a
+    // late failure from the workflow catch block must not overwrite the
+    // settled state. This also prevents a cancelled attempt from settling
+    // as a different classification after cancelExecution ran.
+    if (!attempt || attempt.status === "terminal") {
+      return;
+    }
+    const run = await ctx.db.get(attempt.runId);
+    if (!run || run.status === "terminal" || run.status === "cancelled") {
+      return;
+    }
+    const classification = classifyFailure(args.reason);
     const endedAt = Date.now();
     await ctx.db.patch(attempt._id, {
-      classification: "PermanentFailure",
+      classification,
       endedAt,
+      failureReason: args.reason,
+      leaseExpiresAt: undefined,
       status: "terminal",
       summary: args.summary,
     });
+    const outcome = resolveOutcome(
+      { classification, retryable: args.retryable, summary: args.summary },
+      attempt.number,
+      defaultCodingKitV0.retryPolicy
+    );
+    await ctx.db.insert("resolverDecisions", {
+      attemptId: attempt._id,
+      attemptNumber: attempt.number,
+      classification,
+      createdAt: endedAt,
+      decision: outcome.kind,
+      ...(outcome.kind === "terminal"
+        ? { resultingWorkStatus: outcome.workStatus }
+        : {}),
+      runId: run._id,
+      summary: args.summary,
+      workId: attempt.workId,
+    });
+    if (outcome.kind === "retry") {
+      const nextAttemptId = await ctx.db.insert("workAttempts", {
+        number: attempt.number + 1,
+        runId: run._id,
+        status: "queued",
+        workId: attempt.workId,
+        workspaceKey: attempt.workspaceKey,
+      });
+      await ctx.scheduler.runAfter(
+        0,
+        internal.workExecutionWorkflow.launchAttemptWorkflow,
+        { attemptId: nextAttemptId }
+      );
+      return;
+    }
     await ctx.db.patch(run._id, {
       endedAt,
       status: "terminal",
-      terminalClassification: "PermanentFailure",
+      terminalClassification: classification,
       terminalSummary: args.summary,
     });
-    await settleSliceAndWork(ctx, run, false);
+    await settleSliceAndWork(ctx, run, false, outcome.workStatus);
+    const work = await ctx.db.get(run.workId);
+    if (work) {
+      await ctx.db.insert("workEvents", {
+        createdAt: endedAt,
+        idempotencyKey: `real-run-failed:${run._id}`,
+        kind: "run.completed",
+        payloadJson: JSON.stringify({ classification }),
+        referenceId: String(run._id),
+        workId: work._id,
+      });
+    }
   },
 });
 
@@ -375,15 +589,30 @@ export const cancelExecution = mutation({
         0,
         internal.workExecutionAgent.cancelAttempt,
         {
+          attemptId: String(attempt._id),
           workspaceKey: attempt.workspaceKey,
         }
       );
+      const cancelledAt = Date.now();
       await ctx.db.patch(attempt._id, {
         classification: "Cancelled",
-        endedAt: Date.now(),
+        endedAt: cancelledAt,
+        failureReason: "Cancelled",
+        leaseExpiresAt: undefined,
         status: "terminal",
         summary: "Execution cancelled",
       });
+      await ctx.db.insert("resolverDecisions", {
+        attemptId: attempt._id,
+        attemptNumber: attempt.number,
+        classification: "Cancelled",
+        createdAt: cancelledAt,
+        decision: "terminal",
+        resultingWorkStatus: "ready",
+        runId: run._id,
+        summary: "Execution cancelled",
+        workId: run.workId,
+      });
     }
     await ctx.db.patch(run._id, {
       endedAt: Date.now(),
diff --git a/packages/env/src/agent.ts b/packages/env/src/agent.ts
index 2d39051..434b1f8 100644
--- a/packages/env/src/agent.ts
+++ b/packages/env/src/agent.ts
@@ -16,6 +16,7 @@ const agentEnvSchema = z.object({
   OPENROUTER_API_KEY: z.string().min(1).optional(),
   RIVET_ENDPOINT: z.url(),
   RIVET_PUBLIC_ENDPOINT: z.url().optional(),
+  RIVET_WORKSPACE_TOKEN: z.string().min(32),
 });
 
 export type AgentEnv = z.infer<typeof agentEnvSchema>;
diff --git a/packages/primitives/package.json b/packages/primitives/package.json
index b1a4a7f..e628079 100644
--- a/packages/primitives/package.json
+++ b/packages/primitives/package.json
@@ -31,7 +31,6 @@
   },
   "dependencies": {
     "@agentos-software/codex": "0.2.7",
-    "@agentos-software/codex-cli": "0.3.4",
     "@agentos-software/git": "0.3.3",
     "@rivet-dev/agentos": "catalog:",
     "effect": "catalog:"
diff --git a/packages/primitives/src/agent-os.ts b/packages/primitives/src/agent-os.ts
index cc6473a..176941f 100644
--- a/packages/primitives/src/agent-os.ts
+++ b/packages/primitives/src/agent-os.ts
@@ -1,5 +1,5 @@
 /* eslint-disable max-classes-per-file -- the AgentOS service and its tagged error form one adapter contract. */
-import codex from "@agentos-software/codex-cli";
+import codex from "@agentos-software/codex";
 import { agentOS as createAgentOsActor } from "@rivet-dev/agentos";
 import type { AgentOSConfigInput } from "@rivet-dev/agentos";
 import { Context, Effect, Layer, Schema } from "effect";
@@ -99,6 +99,7 @@ export const codexSessionEnv = (
   model: CodexModelEnv,
   extra: Readonly<Record<string, string>> = {}
 ): Record<string, string> => ({
+  CODEX_MODEL: model.model,
   OPENAI_API_KEY: model.apiKey,
   OPENAI_BASE_URL: model.baseUrl,
   ...extra,
diff --git a/packages/primitives/src/execution-runtime.ts b/packages/primitives/src/execution-runtime.ts
index e724517..4cb06fa 100644
--- a/packages/primitives/src/execution-runtime.ts
+++ b/packages/primitives/src/execution-runtime.ts
@@ -121,6 +121,16 @@ export class WorkAttemptExecutionError extends Schema.TaggedErrorClass<WorkAttem
   }
 ) {}
 
+export const WorkAttemptExecutionFailure = Schema.Struct({
+  error: Schema.Struct({
+    message: Text,
+    reason: WorkAttemptExecutionErrorReason,
+    retryable: Schema.Boolean,
+  }),
+});
+export type WorkAttemptExecutionFailure =
+  typeof WorkAttemptExecutionFailure.Type;
+
 const invalidInput = (message: string) =>
   new WorkAttemptExecutionError({
     message,
@@ -143,6 +153,11 @@ export const decodeWorkAttemptExecutionResult = (input: unknown) =>
     Effect.mapError((cause) => invalidInput(cause.message))
   );
 
+export const decodeWorkAttemptExecutionFailure = (input: unknown) =>
+  Schema.decodeUnknownEffect(WorkAttemptExecutionFailure)(input).pipe(
+    Effect.mapError((cause) => invalidInput(cause.message))
+  );
+
 export interface SandboxRuntime {
   readonly name: string;
   readonly execute: (
@@ -150,6 +165,7 @@ export interface SandboxRuntime {
     signal?: AbortSignal
   ) => Effect.Effect<WorkAttemptExecutionResult, WorkAttemptExecutionError>;
   readonly cancel: (
-    workspaceKey: string
+    workspaceKey: string,
+    attemptId: string
   ) => Effect.Effect<void, WorkAttemptExecutionError>;
 }