Problem
flutter_rust_bridge is not a supervisor. It is stateless function calls plus a single RustLib.init() (packages/core_native/lib/src/native_bridge.dart). Nothing owns lifecycle.
Yet airo_core already holds stateful things — open_playlist_index, initialize_relational_store — with no lifecycle owner, and Phase 1–9 adds five more engines that each need start, stop, cancellation, and resource limits.
Without a supervisor, each engine evolves its own lifecycle and cancellation semantics. Converging five independent engines later is far more expensive than establishing one now, and the divergence is invisible until two of them need to shut down in a particular order.
Expected outcome
Flutter
↓
Runtime Supervisor
↓
Vault · Replay · Sync · Projection · AI · Capture
The Supervisor owns:
- lifecycle — start, stop, restart
- cancellation — a long replay or sync must be interruptible, not merely abandonable
- dependency ordering — Vault before Replay before Projection; sync cannot start before replay reaches head
- health — which engines are up, which are degraded
- metrics — one place that knows operations/sec and memory, rather than six
- resource limits — memory ceilings and concurrency caps, enforced centrally
- graceful shutdown — no half-applied revocation, no torn projection
Why this is architectural, not operational
Two of the three council reviews have now found defects that trace to nothing owning a lifecycle:
The Supervisor and the replay engine are the two architectural centres of Airo Mind. AI, sync, workflows, and capabilities should execute within that controlled runtime rather than each managing its own lifecycle.
Relationship to the runtime API (#1295)
§11c defines what a capability may call: emit_operation, attach_content, query_projection, instantiate_context, replay, sync.
The Supervisor is the layer beneath that — it is what makes replay() and sync() cancellable and bounded rather than fire-and-forget. Same surface to capabilities; a real owner behind it.
Open question for the reviewers
Does the Supervisor live in Rust (airo_mind) with Flutter driving it over FRB, or is there a thin Dart-side coordinator? Rust is the obvious answer since that is where the engines and the state live — but FRB's stateless call model means "hold a handle across calls" needs a deliberate design, not an assumption.
Assigned to chief-architect, rust-architect, and chief-performance-officer. The performance review running now covers the resource-control half.
Blocked by
Nothing structural, and that is the argument for doing it early. Cheapest before Phase 2 adds the operation log.
Problem
flutter_rust_bridgeis not a supervisor. It is stateless function calls plus a singleRustLib.init()(packages/core_native/lib/src/native_bridge.dart). Nothing owns lifecycle.Yet
airo_corealready holds stateful things —open_playlist_index,initialize_relational_store— with no lifecycle owner, and Phase 1–9 adds five more engines that each need start, stop, cancellation, and resource limits.Without a supervisor, each engine evolves its own lifecycle and cancellation semantics. Converging five independent engines later is far more expensive than establishing one now, and the divergence is invisible until two of them need to shut down in a particular order.
Expected outcome
The Supervisor owns:
Why this is architectural, not operational
Two of the three council reviews have now found defects that trace to nothing owning a lifecycle:
DriftMeetingRepository([MIND-35] Migrate feature storage onto the runtime via a shared adapter (I4 violations) #1293) exists partly because there was no runtime to hand persistence to.The Supervisor and the replay engine are the two architectural centres of Airo Mind. AI, sync, workflows, and capabilities should execute within that controlled runtime rather than each managing its own lifecycle.
Relationship to the runtime API (#1295)
§11c defines what a capability may call:
emit_operation,attach_content,query_projection,instantiate_context,replay,sync.The Supervisor is the layer beneath that — it is what makes
replay()andsync()cancellable and bounded rather than fire-and-forget. Same surface to capabilities; a real owner behind it.Open question for the reviewers
Does the Supervisor live in Rust (
airo_mind) with Flutter driving it over FRB, or is there a thin Dart-side coordinator? Rust is the obvious answer since that is where the engines and the state live — but FRB's stateless call model means "hold a handle across calls" needs a deliberate design, not an assumption.Assigned to chief-architect, rust-architect, and chief-performance-officer. The performance review running now covers the resource-control half.
Blocked by
Nothing structural, and that is the argument for doing it early. Cheapest before Phase 2 adds the operation log.