feat(runtime): fence managed shell external effects

[zhiiw]

Summary

• freeze one ShellRun-specific external-effect fence before T1
• bind the fence to the exact accepted workspace head and a fixed execution profile
• execute the effect only through a one-shot Runtime capability over an authority-owned disposable tree
• fail closed before T1 when admission is unavailable; never advertise remote exactly-once semantics

Primary invariant

After an external-effect T1 exists, the operation may run only once inside the owner-issued ShellRun fence. The live result remains Runtime-owned, the local process claim remains ShellRun-owned, and no generic unfenced Bash fallback is permitted.

Atomic boundary and failure states

The admission owner validates arguments, observes the accepted head, materializes the exact accepted tree, and issues the linear capability before T1. Missing claims can later settle as command-not-started; active or orphaned claims park; terminal ShellRuns are adopted by their exact source-operation identity. This slice does not expose managed Bash to Desktop/CLI yet.

Validation

• Core, Runtime, and Runtime Host builds
• 83 focused tests passed
• modified-file formatting and git diff --check

Stack

Base: codex/m5-managed-node-transform-product-v1 (PR #84)

中文说明

摘要

• 在 T1 前冻结一个 ShellRun 专用的外部副作用围栏；
• 将围栏绑定到 exact accepted workspace head 与固定 execution profile；
• 只允许通过一次性 Runtime capability 在 authority-owned disposable tree 中执行；
• admission 不可用时在 T1 前 fail closed，不把本地 operation id 伪装成远端 exactly-once。

主要不变量

外部副作用 T1 一旦存在，operation 只能在 owner 签发的 ShellRun fence 内执行一次。实时结果归 Runtime，进程 claim 归 ShellRun authority，禁止回落到普通未围栏 Bash。

原子边界与失败状态

Admission owner 在 T1 前完成参数校验、accepted head 读取、exact tree 物化和线性 capability 签发。之后无 claim 可证明 command-not-started；active/orphaned 必须 park；terminal ShellRun 只能按 exact source-operation identity 采用。本切片尚不向 Desktop/CLI 开放 managed Bash。

验证

• Core、Runtime、Runtime Host 构建通过；
• 83 个定向测试通过；
• 修改文件格式检查与 git diff --check 通过。