feat: Phase 4 governance/execution slice — PolicyService + ExecutionService

classifyAndGate's decision pipeline moves to core: PolicyService runs the
full gate order (classify + transport escalation, plan-first, syntax,
host-only/host-lxc, VM QGA preflight, dedup, approval-flood, window
routing) over ports.GovernanceStore; ExecutionService records and
dispatches (auto-run via ssh.CommandExecutor + TargetResolver, queue via
ExecutionRecorder) with one converged path for run/docker_exec. Gating
matrix test added (risk x window x declared risk -> outcome); pair
coverage 95.6%.

Bug fix surfaced by the matrix: the flag-space syntax regex was inverted
— it refused valid 'tail -n 3' and missed the actual 'head - n' typo.
Fixed to match dash-space-value only.

Remaining Phase 4 items tracked in the plan: ApprovalService.Decide
convergence, execlog fold, execworker poller. VERSION 0.35.0.

internal/core/ports/governance.go

@@ -95,3 +95,80 @@ type ApprovalRepository interface {
 
 	Decide(ctx context.Context, input ApprovalDecideInput) (domain.Approval, error)
 }
+
+// GovernanceStore is the policy read model: the facts the gating decision
+// needs that live outside the command text — session plan state, assent/
+// destructive windows, duplicate pending executions, and target entity
+// attributes. Implemented by the postgres adapter; faked in portstest.
+type GovernanceStore interface {
+	// SessionHasPlan reports whether the session has any non-replaced plan
+	// step (the plan-first gate). Fails open on store errors — a flake
+	// must not block otherwise-valid work.
+	SessionHasPlan(ctx context.Context, sessionID string) bool
+	// AssentWindowActive reports a live operator-assent grant for this
+	// agent+session (config_mutation auto-run scope).
+	AssentWindowActive(ctx context.Context, agentID domain.UUID, sessionID string) bool
+	// DestructiveWindowActive reports a live explicitly-confirmed
+	// destructive grant for this agent+target+session.
+	DestructiveWindowActive(ctx context.Context, agentID domain.UUID, targetSlug, sessionID string) bool
+	// PendingApprovalCount counts this session's executions stuck at
+	// pending_approval (the approval-flood gate).
+	PendingApprovalCount(ctx context.Context, sessionID string) int
+	// PendingDuplicate returns the execution id of an identical command
+	// already queued for approval on this target, if any.
+	PendingDuplicate(ctx context.Context, targetID domain.UUID, action string) (domain.UUID, bool)
+	// EntityAttributes loads one entity's attributes map (VM QEMU-guest-
+	// agent state and similar gating inputs).
+	EntityAttributes(ctx context.Context, targetID domain.UUID) (map[string]any, error)
+}
+
+// CreateRunInput records one `run` submission in the execution ledger:
+// the execution entity + row, its graph edges, the classification
+// decision, and the audit entry — one transaction. Written before the
+// route executes (auto-run or queue), exactly as the pre-service
+// classifyAndGate path did.
+type CreateRunInput struct {
+	ExecutionID    domain.UUID
+	TargetID       domain.UUID
+	TargetSlug     string
+	AgentID        domain.UUID
+	SessionID      string
+	Command        string
+	Purpose        string
+	Action         string // "run:{json params}" action column value
+	RiskClass      string
+	Route          string // "auto-act" | "escalate"
+	ClassReasoning []byte
+	CorrelationID  string
+}
+
+// QueueApprovalInput records the operator-approval ask for a gated
+// execution: the approval row, the execution status flip, and the
+// session's awaiting_input transition (with its task.status event).
+type QueueApprovalInput struct {
+	ExecutionID domain.UUID
+	TargetID    domain.UUID
+	TargetSlug  string
+	Action      string
+	Params      string
+	RiskClass   string
+	SessionID   string
+}
+
+// FinalizeExecutionInput closes an auto-run execution with full timing.
+type FinalizeExecutionInput struct {
+	ExecutionID domain.UUID
+	Status      string // "completed" | "failed"
+	Result      []byte
+	StartedAt   time.Time
+}
+
+// ExecutionRecorder persists the run-submission lifecycle. The service
+// owns ordering and the decision; the adapter owns the SQL (entity row,
+// executions row, edges, classifications, approvals, audit, events).
+type ExecutionRecorder interface {
+	CreateRun(ctx context.Context, input CreateRunInput) error
+	MarkRunning(ctx context.Context, executionID domain.UUID) error
+	Finalize(ctx context.Context, input FinalizeExecutionInput) error
+	QueueApproval(ctx context.Context, input QueueApprovalInput) error
+}

internal/core/ports/portstest/fakes.go

@@ -485,3 +485,145 @@ func (r *SeedRepo) IngestKnowledge(_ context.Context, file string, content []byt
 func (r *SeedRepo) Export(_ context.Context) (map[string][]byte, error) {
 	return r.ExportFiles, r.ExportErr
 }
+
+// GovernanceStore is an in-memory ports.GovernanceStore. Every fact the
+// gating decision needs is settable per test; the fail-open/fail-closed
+// semantics of the real store's error paths are simulated via Err.
+type GovernanceStore struct {
+	mu sync.Mutex
+	// PlanSessions: sessionIDs that have a plan (plan-first gate).
+	PlanSessions map[string]bool
+	// Assent: agentID+"/"+sessionID keys with a live assent window.
+	Assent map[string]bool
+	// Destructive: agentID+"/"+targetSlug+"/"+sessionID keys with a live
+	// destructive window.
+	Destructive map[string]bool
+	// PendingApprovals counts per sessionID (flood gate).
+	PendingApprovals map[string]int
+	// Duplicates: targetID+action key → existing execution id.
+	Duplicates map[string]domain.UUID
+	// Attrs per entity id (VM guest-agent state etc.).
+	Attrs map[domain.UUID]map[string]any
+}
+
+// NewGovernanceStore builds an empty governance store.
+func NewGovernanceStore() *GovernanceStore {
+	return &GovernanceStore{
+		PlanSessions:     make(map[string]bool),
+		Assent:           make(map[string]bool),
+		Destructive:      make(map[string]bool),
+		PendingApprovals: make(map[string]int),
+		Duplicates:       make(map[string]domain.UUID),
+		Attrs:            make(map[domain.UUID]map[string]any),
+	}
+}
+
+// SessionHasPlan reports whether the session has a plan.
+func (g *GovernanceStore) SessionHasPlan(_ context.Context, sessionID string) bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	return g.PlanSessions[sessionID]
+}
+
+// AssentWindowActive reports a live assent grant.
+func (g *GovernanceStore) AssentWindowActive(_ context.Context, agentID domain.UUID, sessionID string) bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	return g.Assent[string(agentID)+"/"+sessionID]
+}
+
+// DestructiveWindowActive reports a live destructive grant.
+func (g *GovernanceStore) DestructiveWindowActive(_ context.Context, agentID domain.UUID, targetSlug, sessionID string) bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	return g.Destructive[string(agentID)+"/"+targetSlug+"/"+sessionID]
+}
+
+// PendingApprovalCount returns the session's pending-approval count.
+func (g *GovernanceStore) PendingApprovalCount(_ context.Context, sessionID string) int {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	return g.PendingApprovals[sessionID]
+}
+
+// PendingDuplicate returns the queued duplicate execution, if any.
+func (g *GovernanceStore) PendingDuplicate(_ context.Context, targetID domain.UUID, action string) (domain.UUID, bool) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	id, ok := g.Duplicates[string(targetID)+"\x00"+action]
+	return id, ok
+}
+
+// EntityAttributes returns the entity's attributes (nil when unknown).
+func (g *GovernanceStore) EntityAttributes(_ context.Context, targetID domain.UUID) (map[string]any, error) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	return g.Attrs[targetID], nil
+}
+
+// ExecutionRecorder records the submission lifecycle for assertion.
+type ExecutionRecorder struct {
+	mu        sync.Mutex
+	Created   []ports.CreateRunInput
+	Queued    []ports.QueueApprovalInput
+	Running   []domain.UUID
+	Finalized []ports.FinalizeExecutionInput
+	// ErrStubs keyed by phase: "create", "queue", "mark", "finalize".
+	ErrStubs map[string]error
+}
+
+// NewExecutionRecorder builds a fresh recorder.
+func NewExecutionRecorder() *ExecutionRecorder {
+	return &ExecutionRecorder{ErrStubs: make(map[string]error)}
+}
+
+// CreateRun records the submission.
+func (r *ExecutionRecorder) CreateRun(_ context.Context, in ports.CreateRunInput) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if err := r.ErrStubs["create"]; err != nil {
+		return err
+	}
+	r.Created = append(r.Created, in)
+	return nil
+}
+
+// MarkRunning records the running transition.
+func (r *ExecutionRecorder) MarkRunning(_ context.Context, id domain.UUID) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if err := r.ErrStubs["mark"]; err != nil {
+		return err
+	}
+	r.Running = append(r.Running, id)
+	return nil
+}
+
+// Finalize records the terminal write.
+func (r *ExecutionRecorder) Finalize(_ context.Context, in ports.FinalizeExecutionInput) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if err := r.ErrStubs["finalize"]; err != nil {
+		return err
+	}
+	r.Finalized = append(r.Finalized, in)
+	return nil
+}
+
+// QueueApproval records the approval ask.
+func (r *ExecutionRecorder) QueueApproval(_ context.Context, in ports.QueueApprovalInput) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if err := r.ErrStubs["queue"]; err != nil {
+		return err
+	}
+	r.Queued = append(r.Queued, in)
+	return nil
+}
+
+// MuLock exposes the internal mutex for tests that need to inspect state
+// racing the async dispatch goroutine.
+func (r *ExecutionRecorder) MuLock()   { r.mu.Lock() }
+
+// MuUnlock releases the internal mutex.
+func (r *ExecutionRecorder) MuUnlock() { r.mu.Unlock() }