Connect personal Muse through secure native execution and Vault OAuth (#16448)

Add company-scoped Muse native control, OAuth, wake receiver and recovery.

Recheck current authority after waits and before effects or receipt replay. Preserve task-read scope, assignment expiry, independent holds, nonblocking reassignment and truthful cleanup provenance.

Retain source trust on progress comments and verify current Muse V8 authority through real signed-JWT HTTP requests. Preserve the upstream trimmed ordinary authentication lookup.

Refs #16448.

Preserve captured canonical queue recovery and concurrent environment preparation while retaining the scoped Muse V8 exclusion. Normal migration 0354 and existing Muse SQL remain unchanged. Fresh current-head Greptile review is 5/5 with the project-write finding addressed. Required CI and independent technical review gate the merge; maintainer override is reserved for formal approval rules.

Recheck current Muse project-write authority after all receipt/task/run/admission waits, before creation or replay. Real PostgreSQL regressions reproduce four late effects/replays on the old route; the repaired three-file treatment passes 354 cases with no skips, and the scoped server typecheck passes. Ordinary/Dot behavior is preserved.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/services/native-runtime/runtime-mode.ts

@@ -51,7 +51,9 @@ export type NativeRuntimeResolution =
           | "claude_managed_agents_api"
           | "aws_agentcore_harness_api"
           | "acpx_runtime"
-          | "openai_dot_mcp" | "grok_bot_mcp";
+          | "openai_dot_mcp"
+          | "grok_bot_mcp"
+          | "muse_external";
         protocolVersion: 1;
       };
       authorityDecision: NativeStatusDecision;
@@ -97,6 +99,7 @@ function ineligible(
 
 export function resolveNativeRuntimeMode(input: {
   enabled: boolean;
+  museEnabled?: boolean;
   dotEnabled?: boolean;
   grokEnabled?: boolean;
   runtimeConfig: unknown;
@@ -127,7 +130,11 @@ export function resolveNativeRuntimeMode(input: {
     }
     throw error;
   }
-  if (runnerProfile.provider === "openai_dot") {
+  // Dot has its own rollout; enabling it does not opt in other Runner providers.
+  if (runnerProfile.provider === "muse") {
+    if (!input.enabled) throw ineligible("paperclip_runner_rollout_disabled", "Paperclip Runner is experimental and disabled on this instance.");
+    if (input.museEnabled !== true) throw ineligible("paperclip_runner_muse_disabled", "Enable Muse personal-agent connections in experimental settings before assigning new work.");
+  } else if (runnerProfile.provider === "openai_dot") {
     if (input.dotEnabled !== true) throw ineligible("paperclip_runner_dot_disabled", "Enable OpenAI Dot and Assistant connections (MCP) in experimental settings before assigning new work.");
   } else if (runnerProfile.provider === "grok_bot" && (input.grokEnabled !== true || !input.enabled)) {
     throw ineligible("paperclip_runner_grok_disabled", "Enable Grok Bot, Paperclip Runner, and Assistant connections (MCP) before assigning new work.");
@@ -188,6 +195,7 @@ export function resolveHeartbeatRuntimeMode(input: {
     runtimeModeResolvedAt: Date | null;
   };
   enabled: boolean;
+  museEnabled?: boolean;
   dotEnabled?: boolean;
   grokEnabled?: boolean;
   adapterType: string | null;
@@ -216,6 +224,7 @@ export function resolveHeartbeatRuntimeMode(input: {
   try {
     resolution = resolveNativeRuntimeMode({
       enabled: input.enabled,
+      museEnabled: input.museEnabled,
       dotEnabled: input.dotEnabled,
       grokEnabled: input.grokEnabled,
       runtimeConfig: {},
@@ -253,6 +262,7 @@ export function resolveHeartbeatRuntimeMode(input: {
         ? "claude_managed"
         : resolution.profile.backend === "aws_agentcore_harness_api"
           ? "aws_agentcore"
+      : resolution.profile.backend === "muse_external" ? "muse"
       : resolution.profile.backend === "grok_bot_mcp" ? "grok_bot"
       : resolution.profile.backend === "openai_dot_mcp" ? "openai_dot"
       : resolution.profile.backend === "acpx_runtime"
@@ -274,6 +284,7 @@ export function resolveHeartbeatNativeRuntimeMode(input: {
     driverKind?: string | null;
   };
   enabled: boolean;
+  museEnabled?: boolean;
   dotEnabled?: boolean;
   grokEnabled?: boolean;
   runtimeConfig: unknown;
@@ -307,6 +318,7 @@ export function resolveHeartbeatNativeRuntimeMode(input: {
           ? "claude_managed_agents_api"
           : driverKind === "aws_agentcore_harness_api"
             ? "aws_agentcore_harness_api"
+        : driverKind === "muse_external" ? "muse_external"
         : driverKind === "grok_bot_mcp" ? "grok_bot_mcp"
         : driverKind === "openai_dot_mcp" ? "openai_dot_mcp"
         : driverKind === "acpx_runtime"