agent-exec

agent-exec is the host process execution provider for the agent system.

It is not a filesystem provider, package manager, terminal emulator, SSH adapter, or ambient shell backdoor.

Purpose

agent-exec owns tightly bounded local process execution after agent-core-system admission:

• argv-based command execution
• explicitly admitted shell execution, if enabled by policy
• cwd/env/stdin/stdout/stderr/time/resource bounds
• process audit and redaction
• cancellation/timeout behavior

Authority boundaries

• agent-core-system owns action admission, approval, policy, executable envelopes, and audit correlation.
• rpc-plugin-system owns plugin runtime, transport, lifecycle, identity/generation, and supervision.
• agent-filesystem owns scoped file operations; it must not run commands.
• agent-exec owns process-spawn mechanics and local process safety checks only.

Process reachability is not authorization. A command string is not authority. Environment variables, cwd, inherited UID, PATH, shell startup files, and prior successful executions never expand authority.

Provider diagnostics

Exec provider diagnostics are structured, redacted observability facts emitted from the plugin service seams for argv, shell, cancel, status, command, session, and PTY operations. They may report provider/plugin generation, capability, operation, correlation IDs, bounded status, coarse error/side-effect classes, and counts.

They must not contain argv, commands, environment, stdin/stdout/stderr, output text, pids, fds, PTY refs, session refs, sockets, raw authority_use_ref values, handles, provider-private paths, URLs, credentials, tokens, upstream bodies, or reusable refs. Diagnostics are ignored on sink failure and must not affect admission, execution, cancellation, or response surfaces.

Toolchain baseline

This repository uses a Go module rooted at go.mod with source packages under src/.

Baseline verification commands:

go test ./...
python3 scripts/workflow-check.py
git diff --check

The baseline package layout is intentionally behavior-free. It exists to make later Go verification meaningful before contracts, authority validation, runner behavior, RPC wiring, or tool-skills are implemented.

Provider-bundle contract v1.0.0

The declared provider bundle now consumes the exact released agent-provider-bundle-contracts v1.0.0 contract. The normative release is the signed tag object b8335dc4abb0bb093951a4ded1dcbc0710051202, peeled commit f3e237888f59c639e9677cfd17c43853ce62109d, tree e49a864b471f6bc964f80d016cf7adf49950bac5, at https://git.dannyhunn.com/agents/agent-provider-bundle-contracts/releases/tag/v1.0.0.

The provider-bundle.v1 manifest uses globally unique operation ids, singular request_schema_ref and result_schema_ref roles, exact reciprocal authority applicability, and compatibility.provider_bundle_contract 1.0.0. Lua remains proposal-only and rejects caller-supplied authority refs. V3 privileged execution remains a separately sealed, high-risk-confirmed runtime path and is deliberately not advertised by this bundle; the migration does not widen capability.

Run python3 scripts/verify-provider-bundle-v1.py and python3 scripts/check-tool-skills.py for the offline contract and proposal checks. The exact upstream semantic verifier and vectors are vendored byte-for-byte under scripts/vendor and testdata for offline reproducibility.

Current release blocker

Canonical Execute/ExecuteSession forwarder targets exist and are unit-tested, but the current rpc-plugin-system authenticated ServeWithConfig wrapper does not register them. Live socket execution remains intentionally blocked until the substrate owner adds authenticated forwarding and an end-to-end socket proof. Descriptors remain inert advertisement; this repository does not bypass the substrate wrapper.