Fix task run/build discoverability, parameterize execution DSN, document registry semantics

Three independent, verified changes (goal-scoped work, tasks #1/#4/#6):

- task build/package/build:server now echo their real output path on
  success, and task run's darwin/linux/windows tasks gained a missing
  deps: on build:native -- previously `task run` assumed a binary
  already existed and would fail on a fresh clone, despite its name and
  summary implying it's a standalone build+launch command (run:server
  already had this right; desktop run: didn't).

- internal/adapters/execution.New now takes a full DSN (databaseURL)
  instead of hardcoding "sqlite:"+dbPath internally. DBOS itself already
  accepts Postgres/CockroachDB DSNs; the scheme choice moves to the
  caller (main.go), which now reads MILL_EXECUTION_DATABASE_URL as an
  override, falling back to the existing MILL_EXECUTION_DB_PATH/default
  sqlite path unchanged. A regulated deployment needing an externally
  managed audit database gets there via config, not an adapter rewrite.

- The three ADR-0006/ADR-0015 self-registration registries
  (RegisterNodeType, RegisterTrigger, RegisterAuthStrategy) have two
  different duplicate-key behaviors (panic vs silent overwrite),
  undocumented until now. Recorded on all three functions plus a
  SPEC.md cross-reference -- not a decision, just making a real,
  previously-invisible inconsistency visible.

Verified: go vet, golangci-lint (0 issues), go test ./internal/...
-race -cover (all pass), go build for both desktop and
CGO_ENABLED=0-equivalent server tags, check-loc.sh,
check-rules-frontmatter.sh. Frontend checks skipped -- zero frontend
files touched, matching lefthook.yml's own glob scoping. Taskfile
run: fix verified via `task --dry` (confirms build:native now runs
before launch) plus one live task package run earlier in the session;
full live task run execution was blocked by resource contention with
an unrelated, pre-existing `task dev` session on this machine and
deliberately not forced.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FYwojT8GdUbYSoggbvEFft

Author: alicoding

Taskfile.yml

@@ -38,11 +38,13 @@ tasks:
     deps: [clean]
     cmds:
       - task: "{{.GOOS}}:build"
+      - 'echo "Built raw binary: {{.BIN_DIR}}/{{.APP_NAME}}{{exeExt}} -- this is NOT a launchable app bundle. Run `task package` to produce one, or `task run` to build and launch in one step."'
 
   package:
     summary: Packages a production build of the application
     cmds:
       - task: "{{.GOOS}}:package"
+      - '{{if eq .GOOS "darwin"}}echo "Packaged app: {{.BIN_DIR}}/{{.APP_NAME}}.app -- launch with: open {{.BIN_DIR}}/{{.APP_NAME}}.app"{{else if eq .GOOS "windows"}}echo "Packaged app: {{.BIN_DIR}}/{{.APP_NAME}}.exe"{{else}}echo "Packaged app: see {{.BIN_DIR}}/ for output"{{end}}'
 
   run:
     summary: Runs the application
@@ -70,6 +72,7 @@ tasks:
     deps: [clean]
     cmds:
       - task: common:build:server
+      - 'echo "Built server binary: {{.BIN_DIR}}/{{.APP_NAME}}-server{{exeExt}} -- run with: ./{{.BIN_DIR}}/{{.APP_NAME}}-server{{exeExt}}"'
 
   run:server:
     summary: Runs the application in server mode

build/darwin/Taskfile.yml

@@ -182,6 +182,11 @@ tasks:
       - 'echo "Skipping codesign (not available on {{OS}}). Sign the .app on macOS before distribution."'
 
   run:
+    summary: Builds (dev-tagged) and runs the application
+    deps:
+      - task: build:native
+        vars:
+          DEV: "true"
     cmds:
       - mkdir -p "{{.BIN_DIR}}/{{.APP_NAME}}.dev.app/Contents/MacOS"
       - mkdir -p "{{.BIN_DIR}}/{{.APP_NAME}}.dev.app/Contents/Resources"

build/linux/Taskfile.yml

@@ -179,6 +179,11 @@ tasks:
       OUTPUTFILE: '{{.ROOT_DIR}}/build/linux/{{.APP_NAME}}.desktop'
 
   run:
+    summary: Builds and runs the application
+    deps:
+      - task: build:native
+        vars:
+          DEV: "true"
     cmds:
       - '{{.BIN_DIR}}/{{.APP_NAME}}'
 

build/windows/Taskfile.yml

@@ -161,6 +161,11 @@ tasks:
       - wails3 tool msix-install-tools
 
   run:
+    summary: Builds and runs the application
+    deps:
+      - task: build:native
+        vars:
+          DEV: "true"
     cmds:
       - '{{.BIN_DIR}}/{{.APP_NAME}}.exe'
 

executionchildworkflow_test.go

@@ -40,7 +40,7 @@ func TestRunChildWorkflow_TracksRealParentChildRelationship(t *testing.T) {
 	}
 
 	dbPath := filepath.Join(t.TempDir(), "exec.db")
-	exec, err := NewExecutionService(dbPath, comp)
+	exec, err := NewExecutionService("sqlite:"+dbPath, comp)
 	if err != nil {
 		t.Fatalf("NewExecutionService: %v", err)
 	}
@@ -96,7 +96,7 @@ func TestRunChildWorkflow_IdempotencyKey_PreventsDuplicateChildRuns(t *testing.T
 	}
 
 	dbPath := filepath.Join(t.TempDir(), "exec.db")
-	exec, err := NewExecutionService(dbPath, comp)
+	exec, err := NewExecutionService("sqlite:"+dbPath, comp)
 	if err != nil {
 		t.Fatalf("NewExecutionService: %v", err)
 	}

executionservice.go

@@ -127,11 +127,13 @@ type ExecutionService struct {
 }
 
 // NewExecutionService builds and launches the durable-execution runtime
-// backed by a local SQLite file at dbPath. Registration happens inside
-// execution.New, before Launch, per that function's own doc comment.
-func NewExecutionService(dbPath string, comp *CompositionService) (*ExecutionService, error) {
+// backed by databaseURL (a DBOS-native DSN -- see execution.New's own
+// doc comment for the sqlite-by-default, Postgres-by-config reasoning).
+// Registration happens inside execution.New, before Launch, per that
+// function's own doc comment.
+func NewExecutionService(databaseURL string, comp *CompositionService) (*ExecutionService, error) {
 	e := &ExecutionService{comp: comp}
-	ctx, err := execution.New("mill", dbPath, func(ctx execution.Context) {
+	ctx, err := execution.New("mill", databaseURL, func(ctx execution.Context) {
 		execution.RegisterWorkflow(ctx, e.runWorkflow, execution.WithWorkflowName(millRunWorkflowName))
 	})
 	if err != nil {

executionservice_test.go

@@ -34,7 +34,7 @@ func TestRunWorkflow_SummaryHasRealWorkflowLabelAndStepOutput(t *testing.T) {
 	workflowID := findBuiltInWorkflowID(t, comp, "Load sample HTML")
 
 	dbPath := filepath.Join(t.TempDir(), "exec.db")
-	exec, err := NewExecutionService(dbPath, comp)
+	exec, err := NewExecutionService("sqlite:"+dbPath, comp)
 	if err != nil {
 		t.Fatalf("NewExecutionService: %v", err)
 	}
@@ -89,7 +89,7 @@ func TestRedriveRun_ReturnsNewRunWithSameStepOutput(t *testing.T) {
 	workflowID := findBuiltInWorkflowID(t, comp, "Load sample HTML")
 
 	dbPath := filepath.Join(t.TempDir(), "exec.db")
-	exec, err := NewExecutionService(dbPath, comp)
+	exec, err := NewExecutionService("sqlite:"+dbPath, comp)
 	if err != nil {
 		t.Fatalf("NewExecutionService: %v", err)
 	}

internal/adapters/execution/execution.go

@@ -9,9 +9,18 @@ import (
 	_ "github.com/dbos-inc/dbos-transact-golang/dbos/driver/sqlite"
 )
 
-// New builds a DBOS runtime backed by a local SQLite file at dbPath --
-// no Postgres, no separate daemon, satisfying docs/SPEC.md §1.2's
-// embeddable-in-binary hard filter (research + spike in docs/adr/0004).
+// New builds a DBOS runtime backed by databaseURL -- a DBOS-native DSN
+// string (dbos.Config's own DatabaseURL field). The default caller
+// (main.go) passes a "sqlite:"-prefixed local file path, satisfying
+// docs/SPEC.md §1.2's embeddable-in-binary hard filter with zero
+// external dependency (research + spike in docs/adr/0004) -- but DBOS
+// itself also accepts Postgres/CockroachDB DSNs (confirmed directly
+// against dbos.Config's own doc comment), so a regulated deployment
+// that needs an externally-managed audit database gets there by
+// passing a different URL, not by swapping this adapter. The scheme
+// choice deliberately isn't made in this package: it's the caller's
+// config decision, same layering this repo already uses for every
+// other adapter (.claude/rules/backend.md).
 // register runs before Launch: DBOS resolves a workflow by registered
 // function identity for crash recovery, so registration must happen
 // before the runtime starts accepting/recovering runs -- this is the
@@ -22,10 +31,10 @@ import (
 // finding #5) and only activates if ConductorAPIKey/DBOS__CLOUD is
 // set -- Config below never sets either, which is the whole guard; DBOS
 // itself exposes no separate flag to assert this at runtime.
-func New(appName, dbPath string, register func(Context)) (Context, error) {
+func New(appName, databaseURL string, register func(Context)) (Context, error) {
 	ctx, err := dbos.NewContext(context.Background(), dbos.Config{
 		AppName:     appName,
-		DatabaseURL: "sqlite:" + dbPath,
+		DatabaseURL: databaseURL,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("execution: new context: %w", err)

internal/adapters/execution/execution_test.go

@@ -51,7 +51,7 @@ func TestResumeAfterFailure_DoesNotReExecuteCheckpointedStep(t *testing.T) {
 		return a + "+" + b, nil
 	}
 
-	runtime, err := New("mill-execution-test", dbPath, func(ctx Context) {
+	runtime, err := New("mill-execution-test", "sqlite:"+dbPath, func(ctx Context) {
 		RegisterWorkflow(ctx, workflow)
 	})
 	if err != nil {
@@ -125,7 +125,7 @@ func TestResumeAfterFailure_DoesNotReExecuteCheckpointedStep(t *testing.T) {
 // document that reasoning as executable, not to probe DBOS's internals.
 func TestNew_NeverConfiguresConductor(t *testing.T) {
 	dbPath := filepath.Join(t.TempDir(), "phonehome.db")
-	runtime, err := New("mill-phonehome-test", dbPath, func(Context) {})
+	runtime, err := New("mill-phonehome-test", "sqlite:"+dbPath, func(Context) {})
 	if err != nil {
 		t.Fatalf("New: %v", err)
 	}

internal/domain/composition/integration.go

@@ -58,6 +58,17 @@ var authStrategies = map[httprequest.AuthType]AuthStrategy{}
 // Triggers -- each AuthType's strategy lives in its own small file,
 // registered via init(), so adding a new AuthType (mTLS included) is a
 // pure addition, never a change to an existing strategy's file.
+//
+// Documented divergence from its two siblings (RegisterNodeType,
+// RegisterTrigger): this map assignment silently overwrites on a
+// duplicate AuthType instead of panicking -- neither behavior was a
+// deliberate choice recorded anywhere before this comment, it's simply
+// what a bare map write does. Not a bug fix, since nothing depends on
+// either behavior today (every AuthType strategy registers exactly
+// once, from this repo's own init() files) -- but a future extension
+// point that wants a registry to support intentional substitution
+// should decide that on purpose, not inherit whichever of these two
+// shapes it happened to copy from.
 func RegisterAuthStrategy(t httprequest.AuthType, fn AuthStrategy) {
 	authStrategies[t] = fn
 }