[wstein]

Implement a bounded executable shell-policy port for follow-up to #81: future new-session launchers can obtain deterministic toolbox-last PATH, toolbox-first XDG data directories, guarded interactive bash/zsh snippets, and complete shortcuts opt-out. Every plan forces BDOCK_STARSHIP=0, including inherited enablement and absent attachment. The port performs no effects and grants no artifact execution or attachment trust.

Draft dependency: this branch builds on unmerged installable-pilot 832dd63000257bad01656154b639251d643f2a2d. The main-target diff includes that prerequisite history; review this slice using pilot baseline…policy head. Owner-merged design #82 is retained. No existing T009 provider/schema/mount admission or accepted feature tasks are widened. The current main comparison conflicts with this unmerged prerequisite history, so no synthetic main-merge CI is available. Promote the prerequisite through its own owner-reviewed route, then restack the owned policy commits and refresh exact-head review/checks; accepted pilot history is not rewritten here.

Validation: failure-first behavior cases observed before implementation; focused Go tests/vet and formatting pass; Bash and manual zsh interactive/noninteractive checks use harmless surrogate fixtures. Independent Sol design review CLEAR; independent Sol code review CLEAR at exact head ea8d5b4a04392ff6440df52287f92935ac5967b8. Acceptance inventory pins all 23 parent/subcase identities without changing prior requirements. Repository structure, inventory schema and whitespace checks pass; final pinned Linux canonical CI passed: 850 Python outcomes with zero raw failures/errors, 464 host-agent Go, 162 API-client Go, 1 CLI Go and 187 ExUnit outcomes; all required IDs present. The PR stays draft for the prerequisite/main-conflict gate. Native make check was attempted and failed under the unintended system Python 3.9/toolchain and sandbox; those raw failures are retained and are not reported passing.

Contract, proposed Feature 007, and evidence/gaps distinguish this tested planning slice from missing resolver/attacher/new-session launcher adoption. Actual Linux read-only mounts, immutable artifact verification, image rc order, all-four-shell vendor behavior and prompt-rendering sentinels remain unverified. The historical issue was auto-closed by #82; this PR does not claim full workspace integration, choose shared-HOME prompt trust, or activate anything.

Refs #81.

[wstein]

Restacked (H51:b): this PR now builds on the pilot PR instead of carrying it. It holds only the 5 shell-policy commits for spec 007 (refs #81).

• The earlier merge of main into this branch is gone, so history is linear.
• That merge had resolved a conflict by keeping both versions of a paragraph in docs/papers/bundledock-workspace-shell.md. The rebase drops the duplicated lines.

Not yet: independent review of this exact head. Draft until the pilot PR merges.

🤖 Generated with Claude Code

[wstein]

Review CLEAR on c4792e8 (Opus 5.5). Restacked onto pilot 75526bb (CI boundary fix); git range-diff shows every commit identical, so the review carries over. make check on this head: pending.

[wstein]

Rebased onto main 54a002f after #95 merged; git range-diff shows every patch identical (for #83 only one context line in docs/index.md differs), so the review carries to 6f36269. make check on this head: pending.

[wstein]

Ready per owner: review CLEAR on this head; local make check replaced by one final check on main after the stack merges (owner rule).

[wstein]

Restacked onto pilot 866e46c; git range-diff identical, review carries to this head.

[wstein]

Restacked onto main e82167b after #96/#91 merged; range-diff identical, review carries to 013c58b.