docs(work): close walking-skeleton story 04 (runner clone/install)

docs/work/_system/_state.json

@@ -1,5 +1,5 @@
 {
-  "updated_at": "2026-07-12T20:37:41.771Z",
+  "updated_at": "2026-07-12T20:55:19.905Z",
   "epics": {
     "platform-retrofit": {
       "status": "done",
@@ -139,10 +139,10 @@
           "blocks": []
         },
         "04-runner-app-protocol-clone-install": {
-          "status": "todo",
+          "status": "done",
           "title": "runner app — protocol server, clone stage, install stage",
           "ac_total": 3,
-          "ac_completed": 0,
+          "ac_completed": 3,
           "depends_on": [
             "01-vite-kitchen-fixture",
             "02-core-runner-protocol"
@@ -238,8 +238,13 @@
   "ready": [
     {
       "epic": "walking-skeleton",
-      "story": "04-runner-app-protocol-clone-install",
-      "title": "runner app — protocol server, clone stage, install stage"
+      "story": "05-runner-scan-and-preview-adapter",
+      "title": "runner scan stage + embedded-Vite preview adapter + canvas agent v0"
+    },
+    {
+      "epic": "walking-skeleton",
+      "story": "06-runner-provisioner-port",
+      "title": "IRunnerProvisioner port + local-process and single-host Docker implementations"
     },
     {
       "epic": "walking-skeleton",
@@ -253,22 +258,6 @@
     }
   ],
   "blocked": [
-    {
-      "epic": "walking-skeleton",
-      "story": "05-runner-scan-and-preview-adapter",
-      "title": "runner scan stage + embedded-Vite preview adapter + canvas agent v0",
-      "waiting_on": [
-        "walking-skeleton/04-runner-app-protocol-clone-install"
-      ]
-    },
-    {
-      "epic": "walking-skeleton",
-      "story": "06-runner-provisioner-port",
-      "title": "IRunnerProvisioner port + local-process and single-host Docker implementations",
-      "waiting_on": [
-        "walking-skeleton/04-runner-app-protocol-clone-install"
-      ]
-    },
     {
       "epic": "walking-skeleton",
       "story": "08-discovery-feature",

docs/work/epics/walking-skeleton/04-runner-app-protocol-clone-install/_story.md

@@ -3,11 +3,12 @@ id: 04-runner-app-protocol-clone-install
 epic: walking-skeleton
 title: runner app — protocol server, clone stage, install stage
 type: technical-story
-status: todo
+status: done
 feature: runner
 depends-on: [01-vite-kitchen-fixture, 02-core-runner-protocol]
 blocks: [05-runner-scan-and-preview-adapter, 06-runner-provisioner-port]
 created: 2026-07-12T10:24:14Z
+updated: 2026-07-12T20:55:19.369Z
 ---
 
 ## Goal
@@ -44,6 +45,8 @@ The runner ↔ repo-toolchain seam is one of the three risks this epic exists to
 
 ## Tasks
 
-- [ ] Scaffold `apps/runner`: WS server speaking `@repo/core-runner-protocol` (every message zod-parsed), hello/ready handshake gated on the workspace-scoped auth token, status/error event emission; integration test spawns the real runner and completes the handshake over real WS.
-- [ ] Add the clone stage: git clone of the requested repo with the PAT delivered via an ephemeral credential helper (spec §6 verbatim — never in URLs, argv, logs, or `.git/config`), staged progress events; integration test clones the `git daemon`-served `vite-kitchen`, asserts credential-leak absence (grep argv/logs/`.git/config`), and asserts named failure events for bad URL / bad token.
-- [ ] Add the install stage: package-manager detection + install with staged progress events; integration test asserts install completes on the fixture and a named failure event is emitted on install error.
+- [x] Scaffold `apps/runner`: WS server speaking `@repo/core-runner-protocol` (every message zod-parsed), hello/ready handshake gated on the workspace-scoped auth token, status/error event emission; integration test spawns the real runner and completes the handshake over real WS.
+- [x] Add the clone stage: git clone of the requested repo with the PAT delivered via an ephemeral credential helper (spec §6 verbatim — never in URLs, argv, logs, or `.git/config`), staged progress events; integration test clones the `git daemon`-served `vite-kitchen`, asserts credential-leak absence (grep argv/logs/`.git/config`), and asserts named failure events for bad URL / bad token.
+- [x] Add the install stage: package-manager detection + install with staged progress events; integration test asserts install completes on the fixture and a named failure event is emitted on install error.
+
+_Landed: b090e26 + 750ab44 + ec7bf94 (cherry-picks), two independent adversarial reviews approved — credential-leak surface airtight (blank-then-veect helper, PAT via child env only, proven by unit builder + integration grep of logs/.git/config/.git surface + spawn-suite whole-child-output grep). Auth proven via a Basic-auth dumb-HTTP git fixture (real 401→helper→retry, asserts exact x-access-token:PAT). 98 tests, 96.6% coverage. Honest boundary: real smart-HTTP/GitHub deferred to later PRDs (documented in apps/runner/AGENTS.md)._