Module tool 

Digest/version admission and bounded execution of explicit Unix host tools.

Consumers own pins, arguments, credentials, environment and trusted executable directories. Execution is not a sandbox or process-tree supervisor. Calls execute once, including on timeout or ambiguous completion; no retry occurs.

Structs

AdmittedTool

An executable whose exact bytes and version were admitted by a consumer.

ExecutionContext

Explicit process context. The child’s inherited environment is cleared.

ExecutionError

A failed invocation with bounded output and direct-child cleanup evidence.

ExecutionEvidence

Bounded evidence from one invocation, including interrupted invocations.

OutputLimits

Caller-selected stdout/stderr storage bounds and capture deadline.

ToolSpec

Exact executable and version authority selected by a consumer.

Enums

ExecutionFailure

Why an invocation failed, independently of its retained output.

ExecutionOperation

Process or pipe operation that produced an IO failure.

InvalidInvocation

An invalid invocation was rejected before a child was spawned.

OutputStream

A captured output stream.

ResolutionError

Executable selection failed before any admission or execution.

ToolError

Executable admission or execution failed.

Functions

resolve_executable

Resolve one executable candidate without reading ambient PATH or running it.