Outcome

Implements the first restartable rGi runtime foundation across 49 files. AGI is the research direction, not a demonstrated capability.

Runtime

• SQLite WAL supervisor, single owner lease, bounded queue and observation history, database capacity guard, durable stop, checkpoints, deterministic action IDs and conflict rejection.
• Exact capability admission and budget reservation before dispatch. Unknown outcomes preserve reservations and require reconciliation; no automatic replay of ambiguous external effects.
• Rust policy kernel with napi-rs and wasm-bindgen wrappers, plus a host TypeScript guard that plugin policies cannot widen.
• Source grounded AgenticOW memory, MetaHarness tool, Autogenous/RuField and rvCSI observation adapters; explicitly labeled constant velocity world model baseline.
• Bounded scalar online learning and a conservative independent evidence predicate, not unrestricted live model mutation.

Verification

All 12 local strict harness checks pass. 32 TypeScript tests; 11 Rust tests including 1,296 budget oracle combinations; 52 executable native/WASM parity cases plus native guarded supervisor execution. npm/Cargo advisory checks pass. Pinned Ruflo 3.25.6 deep scan and source secrets scan reported no findings. Advisory feed freshness is not independently established.

Final durable no-op benchmark: 1,345 actions/second, median 0.355ms, p95 2.437ms over 1,000 actions on a shared host. This excludes models, networking and physical actuation. Earlier runs varied from 476 to 2,165 actions/second.

Reproduce: npm ci --ignore-scripts, install the documented Rust/wasm-bindgen/cargo-audit versions, then npm run harness. Evidence contains exact evaluated source hashes. The GitHub tree matches the tested local tree.

Boundaries

Trusted in-process plugins are not sandboxed. External provider billing limits, authentication, sensor hardware, live upstream package compatibility, tenant isolation and archival need deployment-specific validation. No daemon was left running, no packages published, no physical actuation enabled. Package publication is disabled pending license/release choices.

Five ADRs, operations, threat model, integration provenance and acceptance specification are included. CI is separately configured with pinned actions and read-only permissions. This PR is not auto-merged.