[vt128]

Existing execution APIs run inside the host process, so a parser fatal or
noncooperative work cannot be contained by returning from a goroutine. Add an
opt-in worker package and a command built from the same module. Each request
uses a fresh direct child with positive time/input/combined-output budgets;
cancellation or overflow kills that child, waits once, closes the parent pipe
endpoints and joins the I/O goroutines before returning.

The command accepts source and an in-memory module map, enables only its fixed
profile, sends print/log/diagnostics to stderr and a JSON completion/result to
stdout. Malformed/empty/extra protocol, script failures, incompatible JSON
results, crashes and external cancellation remain failures. Existing New/Run/
RunnerConfig production code, Go1.19, fixed ffb3f39 and released dependencies
are unchanged. This does not provide CPU/RSS, descendants, filesystem/network
or untrusted multi-tenant isolation.

Validation:

• Test-first negative controls, host Go1.27.3 and actual Go1.19.13 full race
  count2/build/vet, and the original pre-commit hook passed.
• Direct/load parser-fatal containment uses a lowered-stack child test fixture;
  production command has no debug switch. Normal successor requests pass.
• Compile-only Windows amd64/arm64 worker test and command builds, plus js/wasm
  Starbox/worker library builds passed with Go1.19.13 and Go1.27.3. These do not
  establish Windows runtime behavior or WASM OS-process support.
• Actual host/floor command artifacts and external Runner drivers pass six
  cases each, including finite-loop timeout, combined cap, normal source/load
  and print/log. Independent buildinfo readers verify compiler, fixed
  dependencies, clean source VCS revision and artifact/source hashes.
• starcli#41 main module and examples pass eight paired host/Go1.25.8 consumer legs plus
  eight real demo executions. Both temporary legs symmetrically normalize
  the existing foundation requirements to satisfy the current Starbox master;
  no public CLI dependency declaration is changed by this validation.
• All 20 profiled package pairs / 1,190 blocks match statement shape and
  hit/unhit within each compiler; module edges and actual dependency versions
  match after verifying only same-source checkout/producer path aliases.
  The new worker package is absent from both old consumer package graphs.
  Examples have no unit tests; their binary executions are reported separately.

Exact-head cloud follow-up: all six native Linux/macOS/Windows × Go1.19/1.27 jobs passed. Codacy has two nonliteral-exec audit findings at worker.go:125, still open for human review. The executable and fixed protocol arguments come only from trusted host configuration; request JSON is sent on stdin and does not select the executable, argv or environment. No shell is invoked. Absolute-path validation does not authenticate the binary; a trusted immutable artifact remains a host precondition. Both actual Codecov contexts currently fail, alongside the manual coverage HOLD below.

HOLD: producer aggregate coverage falls from the original root 749/754
(99.337%) to 972/984 (98.780%). Worker is 222/228; command 1/2. Genuine
OS/fixed-schema defensive branches and the parent-profile os.Exit statement
remain recorded. Actual standalone command execution does not manufacture
parent-profile coverage credit. No threshold or required gate is weakened.

This PR remains Draft/HOLD for the coverage decrease and exact-head cloud
gates. Refs STAR-101 and STAR-98; the full resource-isolation and
parser-governance parent work remains open.

Command and cancellation regressions

The latest supplement verifies caller configuration copying, request text carried only on stdin, a child-reported argv/environment boundary, four concurrent requests with distinct results/PIDs, cancellation after child readiness, and recovery after an invalid ModuleSet. Existing helper and real protocol-command tests cover their respective entry points. The executable trust comment explains the host configuration boundary.

Go 1.27.3 and Go 1.19.13 full race tests twice, build and vet pass. Both compilers also pass six fresh real command scenarios, with child processes reaped and pipes closed. Coverage is 973/984 (98.882%), up one covered statement from the previous candidate and below the original 99.337% baseline. Both dynamic-exec findings remain registered. Keep Draft while coverage, static analysis, current-master integration and final cloud gates are completed.

Windows coverage output isolation

The Windows Go 1.27 run exposed concurrent instrumented test children writing covmeta files to one shared directory. The helper now writes coverage output in each child’s existing private working directory. Request/result assertions and the four concurrent child calls are retained. Host/floor full tests, vet and Windows test/command cross-builds pass on this source. Fresh Windows runtime CI will verify this head. Coverage and both registered dynamic-exec findings continue to require completion.

[codacy-production]

Not up to standards ⛔

🔴 Issues 2 critical

Alerts:
⚠ 2 issues (≤ 0 issues of at least minor severity)

Results:
2 new issues

Category	Results
Security	2 critical

View in Codacy

🟢 Metrics 299 complexity · 0 duplication

Metric	Results
Complexity	299
Duplication	0

View in Codacy

🟢 Coverage 95.59% diff coverage · -0.59% coverage variation

Metric	Results
Coverage variation	✅ -0.59% coverage variation (-1.00%)
Diff coverage	✅ 95.59% diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (77c6bad)	1177	1168	99.24%
Head commit (6058b1c)	1472 (+295)	1452 (+284)	98.64% (-0.59%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#39)	295	282	95.59%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[codecov]

Codecov Report

❌ Patch coverage is 94.58333% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 98.21%. Comparing base (77c6bad) to head (6058b1c).
⚠️ Report is 2 commits behind head on master.

Files with missing lines	Patch %	Lines
worker/worker.go	92.53%	5 Missing and 5 partials ⚠️
worker/protocol.go	98.05%	1 Missing and 1 partial ⚠️
cmd/starbox-worker/main.go	66.66%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master      #39      +/-   ##
==========================================
- Coverage   98.97%   98.21%   -0.77%     
==========================================
  Files          12       15       +3     
  Lines         879     1119     +240     
==========================================
+ Hits          870     1099     +229     
- Misses          5       11       +6     
- Partials        4        9       +5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.