feat: framework refactor — Phases 1-9 + ASR MVP + risk-rated gateway

Evolves the incident orchestrator into a generic agent-orchestration
framework with ASR (autonomous SRE) as the flagship example app, plus
code-review as a second example proving genericity.

Phase 1 — Domain extraction
  - src/orchestrator → src/runtime + repository split
  - examples/incident_management/ + examples/code_review/

Phase 2 — Memory + extensible state + checkpointer
  - Generic Session base; IncidentState subclasses it
  - SessionStore[StateT] with extra_fields JSON tunnel
  - AsyncSqliteSaver / AsyncPostgresSaver via make_checkpointer

Phase 3 — Multi-session OrchestratorService
  - Long-lived asyncio loop on a daemon thread
  - submit_async helper avoids deadlocks on httpx ASGITransport
  - SessionCapExceeded backpressure

Phase 4 — Risk-rated tool gateway + prod-HITL
  - low/medium/high risk tiers, prod-overrides applied first
  - _GatedToolMarker idempotence guard prevents wrap-of-wrap
  - P4-I: pending-approval timeout watchdog (configurable seconds)

Phase 5 — Trigger registry
  - api / webhook / schedule / plugin transports + idempotency

Phase 6 — Agent kinds (responsive / supervisor / monitor)
  - Skill.kind discriminator with per-kind validators

Phase 7 — Two-stage dedup pipeline
  - Embedding similarity → LLM Pydantic-typed structured output
  - parent_session_id + dedup_rationale on Session
  - parse-failure observability via structured warnings + counter

Phase 8 — Code-review example app proving genericity

Phase 9 — ASR MVP supervisor framework hook (P9-9h)
  - Skill.runner dotted-path with fail-fast YAML resolution
  - default_supervisor_runner wires hydrate_and_gate
  - FS-backed memory (KG, releases, playbooks); seeds at examples/.../seeds/

Framework hardening
  - FrameworkAppConfig refactor closes 4 framework→app leaks
  - Generic StateT bound, app-overridable id_format + to_agent_input
  - SessionStartBody.submitter dict (replaces reporter_id/reporter_team)
  - start_session(state_overrides=...) (replaces environment kwarg)
  - Genericity ratchet (scripts/check_genericity.py) at baseline 139

Build / ops
  - Single-file bundle: dist/app.py + dist/apps/{incident-management,code-review}.py
  - SQLite WAL + BEGIN IMMEDIATE + busy_timeout=30000 across stores
  - APScheduler in-process, optional [postgres] extra for air-gapped deploys

Tests: 754 passed, 3 skipped.

Author: aksOps

ASR.md

@@ -43,7 +43,7 @@ mcp:
   servers:
   - name: local_inc
     transport: in_process
-    module: orchestrator.mcp_servers.incident
+    module: examples.incident_management.mcp_server
     category: incident_management
   - name: local_observability
     transport: in_process
@@ -64,23 +64,44 @@ mcp:
       Authorization: Bearer ${EXT_TOKEN}
     category: ticketing
     enabled: false
-environments:
-- production
-- staging
-- dev
-- local
-incidents:
-  store_path: incidents
-  similarity_threshold: 0.2
-  similarity_method: keyword
 paths:
-  skills_dir: config/skills
+  skills_dir: examples/incident_management/skills
   incidents_dir: incidents
-intervention:
-  confidence_threshold: 0.75
-  escalation_teams:
-  - platform-oncall
-  - data-oncall
-  - security-oncall
 orchestrator:
-  entry_agent: intake
+  # P9-9h: ASR investigation supervisor is the entry agent. It hydrates
+  # L2/L5/L7 memory and applies the single-active-investigation gate
+  # before dispatching to ``triage``.
+  entry_agent: asr_supervisor
+runtime:
+  # Wires the orchestrator and storage layer to the incident-management
+  # domain state class (see examples/incident_management/state.py).
+  # Apps swapping in a different state class point this at their own
+  # ``Session`` subclass.
+  state_class: examples.incident_management.state.IncidentState
+  # Cross-cutting framework knobs (confidence threshold, escalation
+  # roster, severity aliases, dedup prompt) come from a no-arg
+  # provider the example app exposes. Lets the runtime read them
+  # without ever importing IncidentAppConfig.
+  framework_app_config_path: examples.incident_management.config:framework_app_config_provider
+  # Two-stage dedup pipeline shape. The provider returns ``None`` when
+  # the bundled example app's YAML disables it.
+  dedup_config_path: examples.incident_management.config:dedup_config_provider
+  # Environments roster surfaced on GET /environments.
+  environments_provider_path: examples.incident_management.config:environments_provider
+  # P9-9k: Risk-rated tool gateway with prod-HITL override.
+  # ``policy`` declares per-tool risk tiers; tools absent default to ``low``.
+  # ``prod_overrides`` forces ``require-approval`` regardless of the tier
+  # whenever the live session's environment is in ``prod_environments``
+  # AND the tool matches a ``resolution_trigger_tools`` glob. The override
+  # only TIGHTENS — it can never relax a higher-risk tool to ``auto``.
+  gateway:
+    policy:
+      update_incident: medium
+      "remediation:restart_service": high
+      "remediation:rollback": high
+    prod_overrides:
+      prod_environments:
+        - production
+      resolution_trigger_tools:
+        - update_incident
+        - "remediation:*"