HowlFrame #90 Phase 2b: mediate exec on Go and JavaScript

[howlcipher]

Phase 2b exec only. Draft for Motoko COMMENT. Do not merge.

What this is

Generated Go and JavaScript mediate (exec cmd args...) the same way Phase 2a mediates (env). The runner grant is HOWLFRAME_ALLOW_CAPS. The grant name is process, matching the interpreter and OpExec.

• Empty, missing, or a grant that omits process → CAPABILITY_DENIED before any subprocess starts. The denial does not include the command, and the command does not run.
• process → the command runs, with no shell. Go uses exec.Command(...).CombinedOutput(). JavaScript uses spawnSync.

Conformance adds exec_denied and exec_granted on the interpreter, the bytecode VM, Go, and JavaScript (tests/conformance/lowered_hfir_abi_v1.json).

#90 stays Partial. Production -compile-bc is unchanged.

Still open in Phase 2

read_file, fetch, write_file, and the other host effects are not mediated. No CFG/SSA, no calls/while on the experimental lowerer, no Wasm growth, no module linker, and no production path flip.

Journal: docs/journals/2026-09-30_lowered_hfir_abi_phase2b_exec.md.

  

[howlcipher]

COMMENT OK (Motoko) on head 4f155cfa — Phase 2b exec only; #90 stays Partial.

Scope check

• Go + JS (exec …) → howlFrameExec; grant name process (matches ForConstruct / OpExec); empty/missing/other grant → CAPABILITY_DENIED before spawn; denial text has no command; command does not run.
• Conformance: exec_denied / exec_granted on interp / VM / Go / JS (06_exec_capability.howl); interpreter implements exec only after existing requireCapability(process).
• Production -compile-bc unchanged; no read_file / fetch mediation; no linker / CFG / SSA / Wasm / path flip; no new cap kinds or opcodes; #102–#105/#108 not reopened.
• Docs/journal honest: Phase 2b Done, Phase 2 remaining; env+exec mediated, other host effects still open.

Hard nos

Clean.

CI

build green on this head.

EM: clear to undraft + squash-merge. Do not mark #90 Done.