feat(runtime-host): bind dependency snapshots to managed commands

[zhiiw]

Outcome

ManagedNodeRun can now import packages from the same owner-issued immutable dependency snapshot already used by ManagedNodeTest. The dependency identity is frozen in T1 before the command starts, and the sandbox consumes the opaque lease without exposing its path to Runtime callers.

This does not bundle or download npm, install dependencies, run package scripts, grant PATH, enable network access, or allow child processes. If the source has no admissible node_modules, T1 records dependency.kind = none.

Primary invariant

One managed Node command reads JavaScript only from one accepted Git tree and, optionally, one exact immutable dependency snapshot whose identity was persisted before T1. It never falls back to the attached checkout or an ambient dependency tree.

Ownership and atomic boundary

• ManagedDependencySnapshotAuthority publishes, verifies, leases, and releases dependency artifacts.
• ManagedNodeDependencyOwnerInternal derives a snapshot only from accepted package.json / package-lock.json plus the source's existing node_modules.
• ManagedNodeCommandAdmissionOwnerInternal freezes accepted head, entrypoint, argv, toolchain, and dependency identity before T1.
• ManagedCommandSandboxOwnerInternal is the only consumer that can resolve the opaque lease to a read-only sandbox input.
• Runtime adopts the exact durable observation after Host recovery; it does not replay a completed command.

Failure states and rollback

• Metadata, accepted tree, receipt, or runtime identity mismatch: fail closed before T1.
• Forged, released, or wrong-owner lease: reject before helper spawn.
• Failure before T1: release dependency lease and disposable roots.
• Host exit after durable outcome: continuation adopts the committed result without rerunning the command.
• No compatible enforcing sandbox: the managed profile remains unavailable; there is no fallback.

Verification

• Core, Storage, Runtime, and Runtime Host builds.
• Focused protocol / durable-boundary / admission / sandbox tests: 94 passed.
• Production-shaped Linux Runtime Host kill/restart matrix: 4 passed, including a Node command importing a package from the immutable snapshot and exact replay adoption.
• Biome and git diff --check pass.

Stack

Base: codex/m5-managed-shell-product-v1.

中文说明

结果

ManagedNodeRun 现在可以读取与 ManagedNodeTest 相同的、由 owner 签发的不可变依赖快照。依赖身份会在命令执行前写入 T1；sandbox 只消费 opaque lease，不把真实依赖路径暴露给 Runtime caller。

本 PR 不会捆绑或下载 npm，不会安装依赖、运行 package scripts、授予 PATH、开放网络或允许子进程。若 source 没有可接受的 node_modules，T1 会明确记录 dependency.kind = none。

主要不变量

一次 managed Node command 只能从一个 accepted Git tree 和至多一个 T1 前持久化身份的不可变依赖快照读取 JavaScript；禁止回退到 attached checkout 或环境中的依赖目录。

Owner 与原子边界

• ManagedDependencySnapshotAuthority 发布、验证、租用和释放 dependency artifact。
• ManagedNodeDependencyOwnerInternal 只根据 accepted package.json / package-lock.json 与 source 中已经存在的 node_modules 生成快照。
• ManagedNodeCommandAdmissionOwnerInternal 在 T1 前冻结 accepted head、entrypoint、argv、toolchain 与 dependency identity。
• ManagedCommandSandboxOwnerInternal 是唯一能把 opaque lease 解析成只读 sandbox input 的 consumer。
• Host 恢复后 Runtime 采用 exact durable observation，不重跑已经完成的 command。

失败与回滚

• metadata、accepted tree、receipt 或 runtime identity 不匹配：T1 前 fail closed。
• lease 伪造、已释放或 owner 不匹配：helper spawn 前拒绝。
• T1 前失败：释放 dependency lease 与 disposable roots。
• durable outcome 之后 Host 退出：continuation 直接采用已提交结果，不重跑命令。
• 平台缺少 enforcing sandbox：整个 managed profile unavailable，禁止降级。

验证

• Core、Storage、Runtime、Runtime Host 构建通过。
• protocol / durable-boundary / admission / sandbox 定向测试：94 个通过。
• Linux production-shaped Runtime Host kill/restart：4 个场景通过；其中 Node command 从 immutable snapshot 导入真实 package，并验证恢复时采用 exact result。
• Biome 与 git diff --check 通过。