[P0][Concurrency] Replace the global RuntimeBridge lock with bounded per-workspace sessions

[wesleysimplicio]

Objective

Allow independent workspaces and safe read-only calls to use Runtime concurrently while preserving strict ordering for conflicting effects within one workspace.

RuntimeBridge currently owns one global re-entrant lock around process selection and tool calls. This serializes unrelated workspaces and prevents the Loop Hub from realizing bounded multi-task throughput.

Required concurrency model

• One lazy Runtime MCP session per canonical workspace identity.
• Per-workspace lifecycle lock for start/reconnect/shutdown.
• Per-resource effect leases for writes.
• Concurrent reads only when advertised safe by Runtime capabilities.
• Global governor only for configured CPU/RAM/process ceilings, not for all calls.
• Fair bounded queues, deadlines, cancellation and backpressure.

Implementation steps

1. Define WorkspaceSession state machine: absent, starting, ready, draining, reconnecting, failed, closed.
2. Canonicalize workspace identity safely and reject symlink/path replacement attacks.
3. Replace the bridge-wide call lock with a concurrent session registry plus per-session locks.
4. Add bounded inflight and queue limits per workspace and globally.
5. Classify tools as read, write, process or exclusive from the Runtime capability manifest.
6. Route conflicting write sets through leases/fencing; permit safe non-conflicting reads.
7. Implement request correlation so out-of-order MCP responses are matched correctly.
8. Add cancellation at safe boundaries and deterministic timeout results.
9. Reconnect with session generation IDs; never replay uncertain writes automatically.
10. Drain and close sessions without orphan processes.
11. Publish queue depth, wait time, inflight count, reconnects and throttling receipts.
12. Benchmark one workspace serial safety and multiple workspace parallel throughput.

Failure tests

• Two simultaneous writes to the same path.
• Reads during a write.
• Independent workspaces under load.
• Runtime crash with queued and inflight calls.
• Timeout followed by late response.
• Cancellation during process execution.
• Workspace deletion/replacement.
• Queue saturation and fairness.
• Shutdown while requests are pending.
• Duplicate idempotency keys across reconnect.

Acceptance criteria

• Independent workspaces execute concurrently up to configured bounds.
• Conflicting effects inside one workspace remain serialized/fenced.
• No response can be delivered to the wrong request.
• Queueing and backpressure are observable and bounded.
• Reconnect does not duplicate uncertain effects.
• Shutdown leaves zero owned Runtime processes.
• p50/p95 throughput and RSS are measured against the current global-lock baseline.
• Quality/evidence coverage does not regress.
• Tests run locally/containerized without paid GitHub Actions.

Relations

• Runtime build/resource leases: wesleysimplicio/simplicio-runtime#3035
• Runtime warm serve: wesleysimplicio/simplicio-runtime#2983

[wesleysimplicio]

Progress receipt: PR #708 merged as 6e32f81. Local evidence: py_compile, git diff --check, and 2 focused per-workspace session concurrency tests passed. Issue remains open for full session limits, cancellation/recovery, and installed Runtime evidence.

[wesleysimplicio]

Progress receipt: PR #717 merged to main as 3beb80be4a0490c125e5c25c2d2a7ab7bd656c83.

Implemented slice:

• bounded FIFO per-workspace queue plus bounded global inflight/queue admission and status receipts;
• same-workspace exclusive ordering with explicitly allowlisted safe-read sharing;
• queued cancellation, deterministic deadlines, JSON-RPC request-id correlation;
• generation-based recovery after transport timeout/failure, with recovery_unknown and no automatic replay of the uncertain call;
• process/session tests and local benchmark.

Local evidence from the merged commit:

• python -m pytest --noconftest -q tests/test_runtime_bridge_workspace_sessions.py tests/test_runtime_bridge_process.py tests/test_runtime_effect_adapter.py: 24 passed;
• coverage for simplicio_loop/runtime_bridge.py: 90%;
• benchmark: serial 264.127 ms, bounded parallel 62.437 ms, 4.230x speedup, p50 3.028 ms, p95 3.142 ms, peak tracemalloc 47,850 bytes;
• py_compile and git diff --check: passed;
• simplicio runtime smoke --json --repo .: Runtime 3.5.2 smoke passed.

Remaining acceptance criteria: installed Runtime capability/tool-manifest evidence (simplicio_status is not advertised and tools/list did not answer in this host), full Hub/system E2E on Windows (existing Unix transport test is blocked by missing asyncio.start_unix_server and SQLite lock cleanup), per-resource effect leases, and broader production throughput/RSS comparison. Issue intentionally remains open.