[zjncs]

Layer (b1) of the authoring platform split (#934), stacking on the merged #935. This is the first half of the split runtime layer — the second half (b2: MCP probing and the security policies, the dedicated security-review surface) stacks on this branch and is linked in #934.

What this layer adds

Runtime bindings

• RuntimeBinding per draft: agent type, config, tool allowlist — validated at save time, persisted as JSONB, managed via GET/PUT /drafts/{id}/runtime. MCP server declarations are validated structurally (name/transport/endpoint format); the SSRF policy, stdio gate and envRef allowlist arrive with (b2).

Execution

• CONFIG layer: validation.yaml spec parsing (defensive YAML) + assertion syntax checks
• BEHAVIOR layer: script tasks through the local-script adapter — inline (cleared environment, isolated workspace, interpreter allowlist, path confinement) or docker (locked container: no network, dropped capabilities, read-only root, memory/cpu/pids caps, tmpfs). The workspace permissions and uid:gid mapping keep container files readable and deletable on hardened hosts (umask 077) — found via hosted-runner CI, masked by Docker Desktop locally.
• The orchestrator keeps every piece of the upstream lifecycle hardening: one FutureTask per run, wall-clock watchdog, settle-first cancellation with worker interrupt.

Verification

• Spec-parser and assertion-evaluator suites: 20 tests
• Docker isolation against real containers: 4 tests (auto-skip without a daemon)
• The upstream ValidationRunOrchestratorTest lifecycle suite passes against the extended constructor: 5 tests
• AuthoringExecutionFlowIntegrationTest (Testcontainers PostgreSQL): script-only three-layer validation with inline execution — 40 files, +2.9k lines

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[zjncs]

Synced onto the latest main (21 commits, incl. #1006–#1008) and folded in the deployment-environment authorization hardening (thank you — the shared ScriptEnvironmentPolicy through both the validator and the adapter is exactly the right shape). Everything green on the merged head: focused suites for the execution layer, the environment authorization tests, docker isolation, and the upstream lifecycle suite.

The security layer (b2) stacked on top now merges the two policies cleanly: RuntimeBindingValidator takes the environment policy and the SSRF security policy side by side — each layer's policy stays independently testable, and your environment tests run against the combined constructor with a permissive security stub. 62 focused tests green on that head, including the full security surface. Stack state is in #934.

[zjncs]

Rebased onto the latest main again (31 commits incl. the Korean web localization and dsh 0.5.0 releases) — head is 4861213, your environment-authorization commit preserved. Focused suites green on the new head (execution flow, environment authorization, docker isolation, lifecycle, migration guardrail — 26 tests).