feat(cli): implement runtime rule execution - #50

Groups 2-3 of runtime-rule-execution. Implement the local harness that
evaluates a runtime rule, plus the bundled tsx loader it runs check.ts under.

- narrow.ts: run a rule's capture rules as ONE ast-grep scan (anchor
  --json=stream, broad --files-with-matches) and normalize matches to the
  contract shape (0-indexed -> 1-indexed, ruleId -> model name, captures from
  metaVariables). Uses a temp --config rules dir so multiple captures + full
  ast-grep config run in a single scan.
- invoke.ts: run check.ts's default export (root, matches) via a pinned tsx
  resolved at runtime (no repo toolchain). An embedded ESM runner writes the
  returned Finding[] to an out-file; a throw, non-zero exit, or timeout is
  isolated to an error result. Default 10s bound, overridable.
- harness.ts: narrow -> gate-on-matches -> invoke -> map Finding to CheckResult
  (source: taskless-runtime); process-per-check, sequential.
- Add tsx to the CLI dependencies (externalized from the Vite bundle).

Verified end-to-end against a temp-dir fixture: discovery, narrow (correct
line normalization + rule attribution), tsx invocation, and finding mapping.

Refs TSKL-245
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…d rules

Group 4 of runtime-rule-execution. Add the runtime reconcile-set: sign each
rule's check.ts (only) for reconciliation, select the rules the server blessed,
and materialize them for read-hash-execute.

- src/rules/runtime/run-set.ts: signRuntimeChecks (check.ts only — capture *.yml
  are inert), reportRuntimeChecks -> { file, signature }, selectBlessedRuntimeRules
  (content-join: a rule runs iff its check.ts signature is in the run set; the
  rest are withheld/advisory), and materializeRuntimeRules (copy blessed rule
  dirs into .taskless/.run/runtime-rules/ and re-discover so execution uses the
  blessed bytes; .run/ stays gitignored).
- discover.ts: extract discoverRuntimeRulesIn(root) so materialized rules can be
  re-discovered from .run/.
- narrow.ts: copy the original capture *.yml bytes into the temp config instead
  of re-serializing the parsed object — a YAML round-trip can alter an exotic
  ast-grep config.

Verified end-to-end: report only check.ts, bless on signature match, materialize
to .run/, execute the materialized copy; empty run set withholds the rule.

Refs TSKL-245
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…ile gating

Group 5 of runtime-rule-execution. Rewire `taskless check` around the two rule
classes and complete the cutover to signing only untrusted code.

- Static ast-grep rules under .taskless/rules/ always run (trusted, no network).
- Runtime rules run only on a validated path: planRuntime resolves the mode from
  auth state + flags — authed reconcile runs blessed rules and withholds the rest
  (advisory); logged-out / --anonymous / no-remote / reconcile-unavailable skip
  runtime with a notice; --dangerously-run-scripts runs all runtime rules with no
  network behind a loud warning.
- Add --dangerously-run-scripts and --timeout <seconds>; runtime findings merge
  into the same results and exit-code logic; --json gains an additive optional
  `skipped` array (schema updated), warnings/notices stay stderr-only.
- Fix a Finding->CheckResult off-by-one: findings are 1-indexed, CheckResult.range
  is 0-indexed (display/json add 1).

Cutover: remove the stacked-under static-reconcile gating — delete
src/rules/run-set.ts and the now-obsolete test/reconcile-check.test.ts +
test/run-set.test.ts (runtime-dispatch tests land in Group 7). Static rules are
no longer signed or gated; only runtime check.ts is.

Verified end-to-end via the built CLI: static-only-runs (runtime skipped +
notice), --dangerously-run-scripts (both run), and --json (skipped array,
warnings suppressed). Full CLI suite green (326 tests).

Refs TSKL-245
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Groups 6-7 of runtime-rule-execution.

Docs (Group 6):
- check.txt (topic v2): static rules always run; runtime check.ts runs only when
  server-verified; the mode table, --dangerously-run-scripts, --timeout, and the
  --json skipped array.
- ci.txt: unauthenticated CI runs static rules and skips runtime; the
  TASKLESS_TOKEN backstop is the enforcement point for runtime check.ts.

Tests (Group 7):
- runtime-harness.test.ts: discovery, gate-on-zero-matches (check never invoked),
  match normalization + Finding->CheckResult indexing, throwing-check isolation,
  timeout -> error finding.
- runtime-check.test.ts: end-to-end dispatch via the built CLI with a mock
  reconcile server + git origin — authed-blessed, empty-run withheld, logged-out
  and --anonymous skip + report, reconcile-unavailable skips, dangerously-run-
  scripts runs offline; asserts static always runs and only check.ts is reported.

Also fix a real timeout bug found by the harness test: tsx re-execs node as a
grandchild, so spawn detached and SIGKILL the whole process group — otherwise a
runaway check keeps running past the timeout. Full suite green (338 tests).

Refs TSKL-245
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…ntation

Verification (opsx:verify) caught a spec-vs-impl divergence: the narrow
requirement, proposal, and design named `--inline-rules --json=stream`, but the
harness assembles the capture rules into a temp `--config` (--inline-rules
carries only one rule; a runtime rule has multiple capture rules + full ast-grep
config). Reworded to "one scan per mode" via a generated config so the spec that
gets synced to canonical on archive matches reality.

Refs TSKL-245
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Sync the runtime-rule-execution delta specs into the canonical specs and archive
the change (verify → sync → archive).

- cli-runtime-rule-execution: new canonical spec (the runtime harness contract).
- cli-check: static-vs-runtime dispatch, the validated-path rule, skip+report,
  and --dangerously-run-scripts added; auth-state/reconcile/degrade requirements
  updated for the cutover; the now-obsolete 'warns on reconciliation mismatches'
  and 'exits cleanly when the run set is empty' requirements removed (their
  static-reconcile behavior was deleted in the cutover — the delta records the
  removal with reasons).
- cli-rule-reconciliation: reporting + run-set requirements rescoped to each
  runtime rule's check.ts.

Change archived to openspec/changes/archive/2026-07-03-runtime-rule-execution/;
no unarchived changes remain, so the tip's check-openspec-archived job passes.

Refs TSKL-245
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Six fixes from Copilot's review of #50, plus the canonical-spec twin of the #49
doc fix:

- invoke.ts: on Windows, kill the check via taskkill /T (negative PIDs aren't
  supported), so a timeout actually terminates the tsx+node tree.
- discover.ts: pin the check file to check.ts inside the rule dir; do not resolve
  metadata.taskless.check as a path (prevents escaping the dir via ../).
- run-set.ts: signRuntimeChecks is now per-rule resilient (returns unreadable
  rules instead of throwing); reported reconcile paths are POSIX-normalized so
  Windows backslashes don't defeat the server-side path match.
- check.ts: a missing/unreadable check.ts is reported as skipped and
  materialization errors degrade to a runtime-skip — a malformed runtime rule no
  longer aborts the whole check (static keeps running).
- narrow.ts: run one broad scan per broad capture rule so matches are attributed
  to the right rule (was mislabeling all broad matches as the first rule); treat
  a signal-killed narrow (null exit code) as a failure instead of success.
- specs/cli-runtime-rule-execution: fix the materialize requirement's live-tree
  path (.taskless/rules/ -> .taskless/runtime-rules/) to match #49.

Add an integration test: a runtime rule missing check.ts is skipped (not fatal)
and static rules still run. Full suite green (339).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…xecution-impl

Propagate the #49 review-comment fixes into the canonical specs (the archived
change copy came via merge):

- cli-check: degrade --json scenario allows the additive skipped array;
  --dangerously-run-scripts described as 'without server validation'.
- cli-rule-reconciliation: heading renamed to 'Reconcile reports every runtime
  rule's check.ts'.
- cli-runtime-rule-execution: per-capture match mode; broad matches are
  path-only (line/column 1, empty text/captures).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>