Module stdio 

Stdio transport: a child-process Context Graph Protocol provider spoken to over its stdin/stdout (SPEC.md §3 “local providers: child processes over stdio”).

Two layers:

• RawStdioConnection — the low-level framed pipe. Public because conformance tooling needs byte-level control (e.g. injecting a malformed line to probe provider robustness, SPEC.md §11). It owns the child, spawns it under the Context Graph Protocol isolation contract, and guarantees the process group dies on drop/shutdown.
• StdioProvider — a ContextProvider built on the connection: it handshakes once, caches the provider’s identity + capabilities, and then splits the pipe into independently-lockable halves. A dedicated reader task demultiplexes replies on their correlation id, and the write half is locked only for the length of one line — so a provider that negotiated correlation can have several queries in flight at once (a slow one no longer head-of-line blocks the rest), while a non-correlating provider and every verify stay strictly lock-step, behaving exactly as the original single-mutex transport did (ADR 0002).

Isolation (SPEC.md §4 and §10, SPEC.md §7)

The child is spawned with a scrubbed environment — env_clear() then an allowlist of only PATH (so the program resolves) and HOME. No inherited credentials, no ambient secrets: a provider sees exactly the query payload and whatever it indexed through its own declared inputs, nothing the host holds. On Unix the child leads its own process group so the whole subtree is signalled at once and can never outlive the host.

Structs

RawStdioConnection

A raw, framed connection to a child-process Context Graph Protocol provider. The low-level primitive StdioProvider is built on; public so conformance tools can drive the wire directly.

StdioProvider

A ContextProvider backed by a child process over stdio.