agent-exec

agent-exec is the host process execution provider for the agent system.

It is not a filesystem provider, package manager, terminal emulator, SSH adapter, or ambient shell backdoor.

Purpose

agent-exec owns tightly bounded local process execution after agent-core-system admission:

• argv-based command execution
• explicitly admitted shell execution, if enabled by policy
• cwd/env/stdin/stdout/stderr/time/resource bounds
• process audit and redaction
• cancellation/timeout behavior

Authority boundaries

• agent-core-system owns action admission, approval, policy, executable envelopes, and audit correlation.
• rpc-plugin-system owns plugin runtime, transport, lifecycle, identity/generation, and supervision.
• agent-filesystem owns scoped file operations; it must not run commands.
• agent-exec owns process-spawn mechanics and local process safety checks only.

Process reachability is not authorization. A command string is not authority. Environment variables, cwd, inherited UID, PATH, shell startup files, and prior successful executions never expand authority.

Provider diagnostics

Exec provider diagnostics are structured, redacted observability facts emitted from the plugin service seams for argv, shell, cancel, status, command, session, and PTY operations. They may report provider/plugin generation, capability, operation, correlation IDs, bounded status, coarse error/side-effect classes, and counts.

They must not contain argv, commands, environment, stdin/stdout/stderr, output text, pids, fds, PTY refs, session refs, sockets, raw authority_use_ref values, handles, provider-private paths, URLs, credentials, tokens, upstream bodies, or reusable refs. Diagnostics are ignored on sink failure and must not affect admission, execution, cancellation, or response surfaces.

Toolchain baseline

This repository uses a Go module rooted at go.mod with source packages under src/.

Baseline verification commands:

go test ./...
python3 scripts/workflow-check.py
git diff --check

The baseline package layout is intentionally behavior-free. It exists to make later Go verification meaningful before contracts, authority validation, runner behavior, RPC wiring, or tool-skills are implemented.