feat(rpf): let the runtime run declared configured gates

[jiunbae]

Problem

The rpf runtime hard-coded every RPF_CONFIGURED_GATE as not-run-unavailable, and convergence requires UNAVAILABLE_CHECKS=none. A repository that declared a gate could never reach converged, even when the controller had run the gate. Real runs show this: gates ran, and status stayed blocked or limit-reached.

Change

• run_configured_gate() runs one exact, non-prohibited declared gate:
  • It runs without a shell, inline code (-c/-e), or env-dump executables.
  • It runs in a worktree whose tracked files are the committed GATE_HEAD_SHA. That commit must carry the approved fence bytes, and the fence base must be one of its ancestors.
  • Its environment has only PATH, HOME, TMPDIR, USER, LOGNAME and DEVELOPER_DIR, plus a fixed locale and CI=1.
  • A timeout kills the gate's whole process session, and the gate is recorded as failed.
  • The run is rejected if the gate changes tracked files or moves HEAD.
  • The output tail is kept only when it contains no restricted content.
• The result is a process-sealed GateReceipt. capture_authority(gate_receipts=...) accepts passed/failed only with the exact receipt for that gate, command and fence. The receipt is threaded through publish, create_if_absent and captured_authority_valid.
• Docs: SKILL.md (phase 0, PHASE 4, convergence), runtime-contract.md and concurrency.md.
• Leftover wording: "This repository has no external provider trust root" now reads "The bundled RPF runtime has no …".

Tests

python3 -m unittest discover -s tests in agents/rpf: 81 pass (74 existing + 7 new). The new tests cover:

• the pass and fail paths
• a timeout
• a passed row without a receipt, a mismatched classification, and a forged receipt
• an undeclared gate, a prohibited gate, env, bash -c and python3 -c
• a stale HEAD and a tracked-file change
• leftover untracked build output, which is allowed
• a gate that mutates the snapshot
• environment secrets being dropped

🤖 Generated with Claude Code