chore(bootstrap): extract stateless command transport - #47

Linked issue

Refs #15 (nonclosing; approved issue). This is only the U5b-1 transport slice, not completion of #15.

PR type

• Maintenance/tooling — type:chore

Summary

• Extract the existing synchronous command transport into command-transport.mjs, preserving the real resolver, native production default, bootstrap exports, and CLI behavior.
• Add createCommandRunner(execute = execFileSync), an independent trusted synchronous backend closure per runner, without singleton setters, environment hooks, injected resolvers, or new CLI/config options.
• Add ten contract tests and colocated delivery/safety documentation. 390 lines = 315 additions + 75 deletions, with moved lines counted twice; no size exception.

Changes

Test plan and observed evidence

• Meaningful injection RED: importable scaffold ignores the supplied backend; the first test observes harmless native Node output instead of injected output. This is an assertion failure, not a missing-module/import failure. Independent focused witness reproduces it; pure extraction is characterization, not an invented bug RED.
• Owned commonjs TMPDIR, Node 24.20.0/Linux: node scripts/run-tests.mjs 181 pass / 0 fail / 0 skipped, preserving the 171 baseline cases. Independent physical-CRLF source copy: 181/181/0/0. All ten new cases execute. Parent rerun confirms final 181.
• Active parent LSP: all three changed MJS paths clean, 0 diagnostics, 0 inconclusive. An earlier unused-parameter hint was fixed as _cmd; no runtime effect or line-count reduction.
• Approved Gitleaks 8.30.1 and actionlint 1.7.12: GL4 and AL4 each 4 pass / 0 skip. Normal workflow inventory/lint pass for LF and CRLF, including inert assets, without new exemptions. Shellcheck is disabled in that harness and is not claimed successful; no shell source is modified.
• Strict Gitleaks scan: full intended source62 and reachable pre-commit HEAD history33, external default-rules config, empty ignore and ignored inline allow directives, redact100: 0 leaks. Delivery history including the new commit: 34 reachable commits, 0 leaks, checked before push.
• Clean offline npm12 package from explicit intended regular files: 62 entries, no cache/probes/logs, every byte equals source; independent repack matches SHA256 1975aafd9c572e31bad1d28bfe68c3c63c4ba11a289a9f0dfbf382f80f328826.
• Frozen source manifest SHA256 0e7bc4bb497f2f55877c4ecf07307f9a8e13bb0397a52717beb4f6d7fc8124f7: 3 added, 2 changed, 57 unchanged, 0 removed versus source59 main.
• Independent verifier: 0 blockers. ASSESS was unassessable/high because the unstaged candidate included untracked files; writer self-verification and independent verification were completed without staging as a workaround. No native closure/receipt is claimed.
• Hosted Node20 / Windows / macOS are pending automatic PR CI at creation, not inferred from local evidence. Skill installation/loading/trust and LLM behavior are not demonstrated by these tests.

Boundaries, incidents and environment

This is transport only: existing CLI helpers use the native factory default, but none accepts an injected non-default runner. U5b-2 orchestration, 15 full pending project scenarios plus S05 adapter and three lifecycle obligations, remain open. No new schema/default/runtime workflows/installer/protection behavior, activation, credentials/API calls, issue closure, version (still 1.1.0), tag or release.

The backend is trusted programmatic code, not a sandbox. The existing resolver rejects batch paths that it actually detects before executing a callback; this is not a universal command-name filter or filesystem-alias guarantee. Diagnostic behavior, including the last two stderr lines, is preserved and does not become a global secret-redaction feature.

Local ambient /tmp/package.json has type:module, breaking one pre-existing extensionless fake-gh fixture: the pre-change baseline was 170 pass/1 fail with default temp. Scoped owned commonjs TMPDIR yields all 181 passing; the foreign file was not modified, and post-change ambient default-temp success is not claimed. Probes/caches/scratch are retained and excluded from the explicit payload, not deleted or ignored through repository-policy changes.

Writer used cat/sed and log/diff head/tail for some reads despite the required read-tool rule; the incident is recorded without retroauthorization or replay. No manual scratch cleanup or Root edits occurred. A reported Root hash discrepancy was a Git SHA1 blob hash versus raw porcelain SHA256, not actual drift: the authorized Root SHA256 remained 07f840c38b5977062cf17f2bdf2037b2095758181b5b9699bf3d1a249ddbefc2 throughout.

Contributor checklist

• Approved Verify package completeness, migration, and release readiness #15 linked with nonclosing Refs.
• Scope and all moved/helper/test/doc lines counted under 400.
• Local functional/security/physical-CRLF checks and independent review completed.
• Documentation updated with code; existing CLI compatibility preserved.
• Conventional commit, no Co-Authored-By trailer.
• Automatic hosted CI required aggregate test successful (pending at creation).
• Skill loaded/tested in an actual agent runtime (not established; no claim).

Draft only. No assistant ready/merge, activation, dispatch/rerun, issue edits/closure, release or cleanup authorization.