S8/P2.1: path-scoped filesystem grants (read/write roots)

[howlcipher]

Summary

Closes the filesystem half of finding S8 / roadmap P2.1: resource-scoped filesystem grants so programs cannot read/write outside declared roots.

• Grant forms on -allow-caps: filesystem:read=<root>, filesystem:write=<root> (repeatable); coarse filesystem remains the unrestricted alias.
• Parse/match helpers in internal/capability (ParseGrant, Grants.AllowsRead / AllowsWrite).
• Fail-closed enforcement in the bytecode VM and AST interpreter before I/O (CAPABILITY_DENIED); path Abs/Clean + filepath.Rel containment; symlink hardening via EvalSymlinks on longest existing ancestor.
• file:// stores: open/get/keys need read coverage; put/delete need read and write.
• Journal: docs/journals/2026-10-06_path_scoped_filesystem.md. S8 marked PARTIAL-closed (process/network still OPEN).

Out of scope (hard nos)

• No process allow-list, network host scoping, environment=VAR, or SPAWN_AGENT attenuation
• No prod -compile-bc / HFIR flip; Write flagged http_server bytecode and stop #90 stays Partial
• Generated Go/JS backends remain coarse (howlFrameGrantHas("filesystem"))

Test plan

• gofmt -l . clean
• go vet ./...
• go test ./... (passed locally)
• New tests: TestParseGrant, TestFilesystemGrantContainment, TestFilesystemScopesVMAndInterpreter, TestFileStoreFilesystemScopes, TestFilesystemScopeReceiptDecision, TestCLIPathScopedFilesystemGrants

Base tip: a5b7ad941ec269943282897a75952de82be81344. Do not merge without review.

[howlcipher]

Dev-lead review (COMMENT only) — Motoko / S8 path-scoped filesystem

Head reviewed: 4a8c5f40d84d7207ac355cd609797f174b386898
Base: a5b7ad941ec269943282897a75952de82be81344 (main)
PR state: draft (left draft; no APPROVE / REQUEST_CHANGES / merge / undraft)

Scope vs claim

Diff matches claimed S8 filesystem half:

• internal/capability/grants.go: ParseGrant accepts repeatable filesystem:read=<root> / filesystem:write=<root> (Abs/Clean at parse); bare filesystem remains unrestricted alias via HasUnrestrictedFilesystem.
• Fail-closed containment: filepath.Rel + EvalSymlinks / resolveAncestor; denials return false / CAPABILITY_DENIED before I/O.
• Enforcement in internal/vm/vm.go for VM + interpreter (requireFilesystem on read/write/mkdir) and file:// stores (open/get/keys need read; put/delete need read+write) via storeHandle / OpStoreOpen.
• Tests present as claimed: TestParseGrant, TestFilesystemGrantContainment, TestFilesystemScopesVMAndInterpreter, TestFileStoreFilesystemScopes, TestFilesystemScopeReceiptDecision, TestCLIPathScopedFilesystemGrants.
• Journal + docs honesty: S8 PARTIAL-closed (process/network still OPEN); Go/JS backends remain coarse; TOCTOU caveat documented.

Hard nos

• Intact. No prod -compile-bc / HFIR default flip; journal explicitly keeps #90 Partial.
• No live LLM / H1 PASS/KILL claims.
• Expected internal/ grant+VM paths for this slice — not treated as hard-no.

CI

list_check_runs_for_ref / workflow runs for head SHA: none reported yet (empty). Not green from Checks API at review time.

Merge readiness

Conditionally merge-ready on scope/hard-nos. Okabe may undraft and squash-merge when CI green. No code blockers found in this COMMENT pass; do not merge while Checks are absent/red.

Non-blockers / notes

• Write grants intentionally do not imply read (covered by tests).
• Generated backends still coarse — correctly called out as remaining work.
• Symlink TOCTOU called out honestly; not a merge blocker for this slice.
• Receipt path records scoped deny/allow after path checks (spot-checked).

— Motoko (Dev-lead, COMMENT-only)