[aviggiano]

Second of the three ordered priority-8 replacements for the obsolete #165 branch.

This slice adds a non-forgeable Smithers executable capability and binds it at each buffered and streaming command boundary. The runtime verifies the exact local runner, its shebang interpreter, and the held descriptor or lexical identity before and after execution, so PATH substitution or pathname replacement cannot silently run different bytes.

This intentionally excludes control-file sealing, execution snapshots, lifecycle rewrites, Modal, evals, and CI. The third replacement slice will add the dependent control seal and its verification call sites.

Verification:

• runtime Node suite: 457 passed, 15 skipped, 0 failed
• generated agent Bun suite: 14 passed
• runtime build and typecheck
• workspace lint and formatting checks
• git diff --check

Part of #413 and the second replacement slice for #165.

Greptile Summary

The PR adds a non-forgeable capability for the pinned local Smithers executable and verifies the runner and its shebang interpreter at buffered and streaming command boundaries.

• Attests executable identities using canonical paths, device/inode metadata, size, and SHA-256 digests.
• Uses held descriptor paths where supported and a revalidated lexical fallback elsewhere.
• Integrates anchor acquisition, post-execution verification, and deterministic cleanup into Smithers command execution.
• Adds focused replacement, interpreter-substitution, descriptor-lifecycle, and shebang-validation coverage.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete correctness, security, or lifecycle failure identified in the changed paths.

The command paths retain runner and interpreter anchors through child termination, verify their identities before and after execution, and close acquired descriptors across success and failure paths.

Important Files Changed

Filename	Overview
packages/runtime/src/smithers-executable-capability.ts	Introduces runner/interpreter attestation, descriptor-backed execution anchors, lexical fallback verification, and deterministic descriptor cleanup.
packages/runtime/src/smithers.ts	Binds verified local installations and applies executable anchors consistently to buffered and streaming Smithers commands.
packages/runtime/test/smithers-executable-capability.test.ts	Covers capability forgery resistance, PATH substitution, replacement detection, descriptor lifetime, shebang validation, and cleanup.
packages/runtime/test/runtime.test.ts	Updates local-runner integration coverage to confirm execution through the attested package target.
CHANGELOG.md	Documents the new command-boundary executable identity protection.

Sequence Diagram

sequenceDiagram
  participant Runtime
  participant Capability
  participant Runner
  Runtime->>Capability: Bind verified local runner
  Capability->>Capability: Hash runner and interpreter
  Runtime->>Capability: Acquire command anchor
  Capability-->>Runtime: Interpreter and runner descriptor paths
  Runtime->>Runner: Execute command through anchor
  Runner-->>Runtime: Output and exit status
  Runtime->>Capability: Reverify identities
  Runtime->>Capability: Close held descriptors

Loading

_{Reviews (1): Last reviewed commit: "fix(runtime): anchor Smithers executable..." | Re-trigger Greptile}

Context used:

• Knowledge Base — Runtime: Run Orchestration Lifecycle
• Knowledge Base — Security