Run commands with a cleared environment, a time limit and a bounded output tail #8

Outcome

The factory runs gh, git and gate commands the way softfac does: a known environment, a hard time limit that kills the whole process tree, and only the end of the output kept.

Acceptance criteria

• A run({ command, args, shell, cwd, env, timeoutMs, tailBytes }) function returns { exitCode, timedOut, tail }. It lives in apps/server/src/factory/t3/process.ts if it uses T3's ProcessRunner, or in apps/server/src/factory/process.ts if it uses node:child_process.
• The child sees only PATH, HOME, USER, LOGNAME, SHELL, LANG, LC_*, TMPDIR and TERM from the server's environment, plus the env passed in.
• The child runs in its own process group. On timeout the group gets SIGTERM, then SIGKILL 10 s later, and the result has timedOut: true.
• stdout and stderr are kept interleaved, and only the last tailBytes (default 16 KiB) are held in memory.
• Tests: a variable outside the list is not seen; a timeout kills a grandchild (sh -c 'sleep 100 & sleep 100'); the tail of a 1 MB output is its last tailBytes; the exit code passes through.
• factory/docs/design.md open question 2 is answered: whether ProcessRunner kills the process group and clears the environment, and which one this uses.

Depends on

• Factory skeleton: an empty FactoryLayer wired in through one seam #1

Notes

softfac: src/gate.rs, src/proc.rs.

Reference

• softfac, the Rust factory this ports, pinned at rawphp/softfac@bf273a1. Read it from a separate clone: git clone --filter=blob:none https://github.com/rawphp/softfac /tmp/softfac-ref && git -C /tmp/softfac-ref checkout bf273a1d93651992b4fc95b4dd6c111f8f3322cf. Its docs/lifecycle.md, docs/reference/ledger.md and docs/issues.md describe the behaviour; its tests pin it.
• Design: factory/docs/design.md in this repo.
• Upstream's AGENTS.md applies. Run only the tests and typechecks for the paths you touch (vp test run <path>, vp run --filter t3 typecheck), never the repo-wide checks.
• Edit no upstream file that is not listed in factory/SEAMS. A new seam needs a line in factory/SEAMS and a reason in the PR body.
• Port behaviour, not code: port the named test cases first (TypeScript, vitest / @effect/vitest), then make them pass. Exact comment and ledger wording is ported as is.