feat: compose accepted-world Node tests into managed coding

[zhiiw]

Summary

Introduce the versioned managed-coding-v2 Session profile and compose the already-owned accepted-world Node test capability into Runtime Host execution.

The existing managed-coding-v1 contract remains frozen. Desktop continues to create v1 tasks until packaged crash recovery and enforcing-sandbox gates are proven.

Primary invariant

A managed-coding-v2 run is admitted only when one Runtime Host owns all of the following before T1:

• the exact accepted Gitoxide workspace boundary;
• the current-process Node 24 toolchain capability;
• an enforcing command sandbox;
• a storage-root-scoped execution-root capability.

If any owner is unavailable, the run fails before provider dispatch. After T1, the observation cannot fall back to v1, an ordinary test runner, PATH, or generic outcome persistence.

Ownership and atomic boundary

• Core owns the immutable Session profile identity.
• Runtime Host owns capability composition and tool projection.
• Runtime owns the managed observation T1/T2 protocol.
• Gitoxide owns accepted-world source materialization.
• Desktop review/resume/history treat v1 and v2 as the same managed-workspace family.

Failure and rollback

• Missing Gitoxide/toolchain/sandbox authority: explicit managed_workspace_profile_unavailable before provider dispatch.
• Corrupt packaged toolchain metadata: fail Host boot; do not silently disable or fall back.
• Admission failure before T1: disposable execution roots are removed.
• Failure after T1: existing managed_observation_v1 durable reconciliation applies.
• Desktop default remains v1, so this Draft does not expand the default production permission surface.

Verification

• Core build: passed.
• Runtime Host typecheck/build: passed.
• Desktop typecheck and main build: passed.
• Hosted profile tests: 5/5 passed.
• Managed continuation v1/v2 boundary tests: 2/2 passed.
• Desktop accepted-review routing v1/v2: 2/2 passed.
• Production Host fail-closed profile test: passed and confirmed no provider request.
• Runtime typecheck has only the pre-existing Zod v3/v4 errors in archive-read-tool.ts, builtin-tools.ts, and shell-tools.ts; changed Runtime files have no TypeScript errors.

Platform gate before Desktop default

• Windows: packaged Electron + enforcing sandbox/job + Host/helper kill-reopen.
• macOS: signed app + Seatbelt + Host/helper kill-reopen.
• Linux: distribution authority + Bubblewrap + Host/helper kill-reopen.

中文说明

摘要

新增版本化的 managed-coding-v2 Session profile，把已经由 owner 管理的 accepted-world Node 测试能力接入 Runtime Host。

现有 managed-coding-v1 合同保持冻结；在 packaged crash recovery 与三平台 enforcing sandbox gate 完成前，Desktop 默认仍创建 v1 任务。

主要不变量

managed-coding-v2 只有在同一个 Runtime Host 于 T1 前同时拥有精确 Gitoxide boundary、当前 Electron/Node 24 toolchain、enforcing sandbox 与 storage-root execution-root capability 时才允许执行。任何 owner 缺失都会在 provider dispatch 前明确失败；T1 后禁止降级到 v1、普通 test runner、PATH 或 generic outcome writer。

Owner、失败与回滚

Core 拥有 Session profile identity；Runtime Host 拥有 capability composition；Runtime 拥有 observation T1/T2；Gitoxide 拥有 accepted-world materialization。T1 前失败会删除一次性 roots，T1 后沿用 durable reconciliation。Desktop 默认仍为 v1，不扩大默认权限面。

验证

Core、Runtime Host、Desktop 的相关构建/类型检查通过；profile 5/5、continuation v1/v2 2/2、Desktop review v1/v2 2/2、Host fail-closed 测试均通过。Runtime 只剩仓库既有 Zod v3/v4 类型错误，本次修改文件无新增错误。