forked from mosaicstack/stack
ms-lead-reviewerandClaude Opus 4.8
763cecc381
Adds a real activation-capability probe so a downstream install-ordering guard (C2, out of scope here) can refuse to wire lease-broker enforcement (PreToolUse/Stop hooks) on a host that cannot actually activate it — the root cause of #828's version-skew brick, where the published CLI tarball lagged the enforcement reseed and every tool call denied with GATE_UNAVAILABLE. - LEASE_ACTIVATION_CAPABILITY {name, version}: versioned signal owned by the activation half (execLeaseGatedRuntime), independent of npm semver. - Hidden `mosaic __lease-capability` subcommand: prints that capability from the actually-resolvable built CLI artifact, not source-tree presence. - leaseEnforcementActivatable(): pure predicate, true iff a compatible capability is advertised AND the broker supervisor (launcher + daemon.py artifacts, socket path) resolves. Detection only — never starts the broker. Both inputs are injectable for testing. - C-REGRESS: added a vitest spec that runs the two test-locked fail-closed gate cases in runtime_tools_unittest.py directly, proving the gate's fail-closed-on-absent-identity behavior is unchanged by this card. Part of #869 (Point-1 C1). Co-Authored-By: Claude Opus 4.8 <[email protected]>