feat(lua): support process entry security

api/process/process.go

@@ -14,6 +14,7 @@ import (
 	"github.com/wippyai/runtime/api/registry"
 	"github.com/wippyai/runtime/api/relay"
 	"github.com/wippyai/runtime/api/runtime"
+	"github.com/wippyai/runtime/api/security"
 )
 
 // System identifies the process system in the event bus.
@@ -38,7 +39,8 @@ const (
 type (
 	// Meta contains metadata about a process type.
 	Meta struct {
-		Method string
+		Security *security.Config
+		Method   string
 	}
 
 	// Start contains the configuration needed to start a new process.

api/process/process_test.go

@@ -16,6 +16,7 @@ import (
 	"github.com/wippyai/runtime/api/pid"
 	"github.com/wippyai/runtime/api/registry"
 	"github.com/wippyai/runtime/api/runtime"
+	"github.com/wippyai/runtime/api/security"
 )
 
 func TestStepOutput_Result(t *testing.T) {
@@ -331,8 +332,10 @@ func TestStart(t *testing.T) {
 }
 
 func TestMeta(t *testing.T) {
-	meta := Meta{Method: "handler"}
+	securityConfig := &security.Config{Actor: security.Actor{ID: "process:runner"}}
+	meta := Meta{Method: "handler", Security: securityConfig}
 	assert.Equal(t, "handler", meta.Method)
+	assert.Same(t, securityConfig, meta.Security)
 }
 
 func TestFactoryEntry(t *testing.T) {

api/runtime/lua/config.go

@@ -79,11 +79,12 @@ type (
 
 	// ProcessConfig defines the configuration for a Lua processes.
 	ProcessConfig struct {
-		Meta    attrs.Bag              `json:"meta"`               // Metadata for the terminal
-		Source  string                 `json:"source" resolve:"-"` // Lua source code
-		Method  string                 `json:"method"`             // Alias of the Lua method to execute
-		Imports map[string]registry.ID `json:"imports,omitempty"`  // Imports aliases for the library
-		Modules []string               `json:"modules,omitempty"`  // Shortcut for importing modules
+		Meta     attrs.Bag              `json:"meta"` // Metadata for the terminal
+		Security *security.Config       `json:"security,omitempty" yaml:"security,omitempty"`
+		Source   string                 `json:"source" resolve:"-"` // Lua source code
+		Method   string                 `json:"method"`             // Alias of the Lua method to execute
+		Imports  map[string]registry.ID `json:"imports,omitempty"`  // Imports aliases for the library
+		Modules  []string               `json:"modules,omitempty"`  // Shortcut for importing modules
 	}
 
 	// WorkflowConfig defines the configuration for a Lua workflow.
@@ -131,13 +132,14 @@ type (
 
 	// BytecodeProcessConfig defines configuration for a precompiled Lua process.
 	BytecodeProcessConfig struct {
-		Imports map[string]registry.ID `json:"imports,omitempty"`
-		Meta    attrs.Bag              `json:"meta,omitempty"`
-		FS      string                 `json:"fs"`
-		Path    string                 `json:"path"`
-		Hash    string                 `json:"hash"`
-		Method  string                 `json:"method"`
-		Modules []string               `json:"modules,omitempty"`
+		Imports  map[string]registry.ID `json:"imports,omitempty"`
+		Meta     attrs.Bag              `json:"meta,omitempty"`
+		Security *security.Config       `json:"security,omitempty" yaml:"security,omitempty"`
+		FS       string                 `json:"fs"`
+		Path     string                 `json:"path"`
+		Hash     string                 `json:"hash"`
+		Method   string                 `json:"method"`
+		Modules  []string               `json:"modules,omitempty"`
 	}
 
 	// BytecodeWorkflowConfig defines configuration for a precompiled Lua workflow.

cmd/wippy/cmd/publish.go

@@ -11,6 +11,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"time"
 
@@ -55,6 +56,7 @@ func init() {
 
 	publishCmd.Flags().String("version", "", "version to publish (overrides wippy.yaml)")
 	publishCmd.Flags().Bool("dry-run", false, "pack only, don't upload")
+	publishCmd.Flags().String("output", "", "keep the dry-run pack at this path")
 	publishCmd.Flags().String("label", "", "publish as mutable label instead of version")
 	publishCmd.Flags().String("release-notes", "", "release notes text")
 	publishCmd.Flags().Bool("protected", false, "mark version as protected")
@@ -72,6 +74,7 @@ func runPublish(cmd *cobra.Command, _ []string) error {
 
 	configDir, _ := cmd.Flags().GetString("config")
 	dryRun, _ := cmd.Flags().GetBool("dry-run")
+	outputFlag, _ := cmd.Flags().GetString("output")
 	versionFlag, _ := cmd.Flags().GetString("version")
 	label, _ := cmd.Flags().GetString("label")
 	releaseNotes, _ := cmd.Flags().GetString("release-notes")
@@ -157,8 +160,13 @@ func runPublish(cmd *cobra.Command, _ []string) error {
 		return NewInitAppError(err)
 	}
 
-	outputFile := filepath.Join(os.TempDir(), cfg.OutputFileName())
-	defer os.Remove(outputFile)
+	outputFile, removeOutput, err := publishOutputPath(dryRun, outputFlag, filepath.Join(os.TempDir(), cfg.OutputFileName()))
+	if err != nil {
+		return err
+	}
+	if removeOutput {
+		defer os.Remove(outputFile)
+	}
 
 	printStatus("Packing module...")
 
@@ -482,13 +490,17 @@ func packModule(ctx context.Context, app *appinit.Context, cfg *config.ModuleCon
 
 	resources := stages.GetResources(ctx)
 
+	packedAt, err := publishPackedAt()
+	if err != nil {
+		return nil, err
+	}
 	metadata := attrs.Bag{
 		"name":          cfg.ModuleName,
 		"namespace":     cfg.Namespace(),
 		"version":       cfg.Version,
 		"wippy_version": version.Version,
 		"wippy_commit":  version.Commit,
-		"packed_at":     time.Now().UTC().Format(time.RFC3339),
+		"packed_at":     packedAt,
 		"entry_count":   len(srcEntries),
 	}
 
@@ -571,6 +583,28 @@ func packModule(ctx context.Context, app *appinit.Context, cfg *config.ModuleCon
 	}, nil
 }
 
+func publishOutputPath(dryRun bool, outputPath, defaultPath string) (string, bool, error) {
+	if outputPath == "" {
+		return defaultPath, true, nil
+	}
+	if !dryRun {
+		return "", false, fmt.Errorf("--output requires --dry-run")
+	}
+	return outputPath, false, nil
+}
+
+func publishPackedAt() (string, error) {
+	epoch := os.Getenv("SOURCE_DATE_EPOCH")
+	if epoch == "" {
+		return time.Now().UTC().Format(time.RFC3339), nil
+	}
+	seconds, err := strconv.ParseInt(epoch, 10, 64)
+	if err != nil || seconds < 0 {
+		return "", fmt.Errorf("invalid SOURCE_DATE_EPOCH %q", epoch)
+	}
+	return time.Unix(seconds, 0).UTC().Format(time.RFC3339), nil
+}
+
 func computeFileDigest(path string) (string, error) {
 	f, err := os.Open(path)
 	if err != nil {

cmd/wippy/cmd/publish_test.go

@@ -14,6 +14,50 @@ import (
 	"github.com/wippyai/runtime/boot/deps/hub"
 )
 
+func TestPublishOutputPath(t *testing.T) {
+	tests := []struct {
+		name        string
+		output      string
+		wantPath    string
+		dryRun      bool
+		wantCleanup bool
+		wantError   bool
+	}{
+		{name: "default", wantPath: "default.wapp", wantCleanup: true},
+		{name: "dry-run output", dryRun: true, output: "release.wapp", wantPath: "release.wapp"},
+		{name: "upload output", output: "release.wapp", wantError: true},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actualPath, cleanup, err := publishOutputPath(test.dryRun, test.output, "default.wapp")
+			if (err != nil) != test.wantError {
+				t.Fatalf("publishOutputPath() error = %v", err)
+			}
+			if err == nil && (actualPath != test.wantPath || cleanup != test.wantCleanup) {
+				t.Fatalf("publishOutputPath() = (%q, %t), want (%q, %t)", actualPath, cleanup, test.wantPath, test.wantCleanup)
+			}
+		})
+	}
+}
+
+func TestPublishPackedAt_SourceDateEpoch(t *testing.T) {
+	t.Setenv("SOURCE_DATE_EPOCH", "1749513600")
+	actual, err := publishPackedAt()
+	if err != nil {
+		t.Fatalf("publishPackedAt() error = %v", err)
+	}
+	if actual != "2025-06-10T00:00:00Z" {
+		t.Fatalf("publishPackedAt() = %q", actual)
+	}
+}
+
+func TestPublishPackedAt_InvalidSourceDateEpoch(t *testing.T) {
+	t.Setenv("SOURCE_DATE_EPOCH", "invalid")
+	if _, err := publishPackedAt(); err == nil {
+		t.Fatal("publishPackedAt() error = nil")
+	}
+}
+
 func TestPublishViaHubOrLegacy_LabelUploadKeepsVersionHeader(t *testing.T) {
 	tmpDir := t.TempDir()
 	wappPath := filepath.Join(tmpDir, "module.wapp")

runtime/lua/component/process/manager.go

@@ -13,6 +13,7 @@ import (
 	"github.com/wippyai/runtime/api/process"
 	"github.com/wippyai/runtime/api/registry"
 	api "github.com/wippyai/runtime/api/runtime/lua"
+	"github.com/wippyai/runtime/api/security"
 	runtimelua "github.com/wippyai/runtime/runtime/lua"
 	"github.com/wippyai/runtime/runtime/lua/code"
 	"github.com/wippyai/runtime/runtime/lua/component"
@@ -25,6 +26,7 @@ import (
 type configEntry struct {
 	source   *api.ProcessConfig
 	bytecode *api.BytecodeProcessConfig
+	security *security.Config
 	method   string
 }
 
@@ -115,7 +117,7 @@ func (m *Manager) Invalidate(ctx context.Context, ids []registry.ID) error {
 			}
 		}
 
-		if err := m.registerFactory(ctx, id, cfg.method); err != nil {
+		if err := m.registerFactory(ctx, id, cfg.method, cfg.security); err != nil {
 			m.log.Error("failed to invalidate process", zap.Error(err))
 			errs = append(errs, err)
 			continue
@@ -166,9 +168,9 @@ func (m *Manager) addSource(ctx context.Context, entry registry.Entry) error {
 		return runtimelua.NewAddNodeError("process", err)
 	}
 
-	m.configs.Store(entry.ID, &configEntry{method: cfg.Method, source: cfg})
+	m.configs.Store(entry.ID, &configEntry{method: cfg.Method, source: cfg, security: cfg.Security})
 
-	if err := m.registerFactory(ctx, entry.ID, cfg.Method); err != nil {
+	if err := m.registerFactory(ctx, entry.ID, cfg.Method, cfg.Security); err != nil {
 		_ = m.code.DeleteNode(ctx, entry.ID)
 		m.configs.Delete(entry.ID)
 		return runtimelua.NewRegisterFactoryError(err)
@@ -200,9 +202,9 @@ func (m *Manager) addBytecode(ctx context.Context, entry registry.Entry) error {
 		return runtimelua.NewAddNodeError("process", err)
 	}
 
-	m.configs.Store(entry.ID, &configEntry{method: cfg.Method, bytecode: cfg})
+	m.configs.Store(entry.ID, &configEntry{method: cfg.Method, bytecode: cfg, security: cfg.Security})
 
-	if err := m.registerFactory(ctx, entry.ID, cfg.Method); err != nil {
+	if err := m.registerFactory(ctx, entry.ID, cfg.Method, cfg.Security); err != nil {
 		_ = m.code.DeleteNode(ctx, entry.ID)
 		m.configs.Delete(entry.ID)
 		return runtimelua.NewRegisterFactoryError(err)
@@ -234,9 +236,9 @@ func (m *Manager) updateSource(ctx context.Context, entry registry.Entry) error
 		return runtimelua.NewUpdateNodeError("process", err)
 	}
 
-	m.configs.Store(entry.ID, &configEntry{method: cfg.Method, source: cfg})
+	m.configs.Store(entry.ID, &configEntry{method: cfg.Method, source: cfg, security: cfg.Security})
 
-	if err := m.registerFactory(ctx, entry.ID, cfg.Method); err != nil {
+	if err := m.registerFactory(ctx, entry.ID, cfg.Method, cfg.Security); err != nil {
 		return runtimelua.NewUpdateFactoryError(err)
 	}
 
@@ -266,9 +268,9 @@ func (m *Manager) updateBytecode(ctx context.Context, entry registry.Entry) erro
 		return runtimelua.NewUpdateNodeError("process", err)
 	}
 
-	m.configs.Store(entry.ID, &configEntry{method: cfg.Method, bytecode: cfg})
+	m.configs.Store(entry.ID, &configEntry{method: cfg.Method, bytecode: cfg, security: cfg.Security})
 
-	if err := m.registerFactory(ctx, entry.ID, cfg.Method); err != nil {
+	if err := m.registerFactory(ctx, entry.ID, cfg.Method, cfg.Security); err != nil {
 		return runtimelua.NewUpdateFactoryError(err)
 	}
 
@@ -277,7 +279,7 @@ func (m *Manager) updateBytecode(ctx context.Context, entry registry.Entry) erro
 }
 
 // registerFactory registers a process factory with the factory registry and waits for confirmation.
-func (m *Manager) registerFactory(ctx context.Context, id registry.ID, method string) error {
+func (m *Manager) registerFactory(ctx context.Context, id registry.ID, method string, securityConfig *security.Config) error {
 	// Create factory using ProcessFactory
 	factoryFn, err := m.factory.CreateFactory(id, engine.WithModules(component.ExecutableAmbientModules()...))
 	if err != nil {
@@ -308,7 +310,8 @@ func (m *Manager) registerFactory(ctx context.Context, id registry.ID, method st
 		Data: &process.FactoryEntry{
 			Factory: factoryFn,
 			Meta: process.Meta{
-				Method: method,
+				Method:   method,
+				Security: securityConfig,
 			},
 		},
 	})

runtime/lua/component/process/manager_test.go

@@ -17,6 +17,7 @@ import (
 	processapi "github.com/wippyai/runtime/api/process"
 	"github.com/wippyai/runtime/api/registry"
 	api "github.com/wippyai/runtime/api/runtime/lua"
+	"github.com/wippyai/runtime/api/security"
 	"github.com/wippyai/runtime/runtime/lua/code"
 	"github.com/wippyai/runtime/runtime/lua/engine"
 	systempayload "github.com/wippyai/runtime/system/payload"
@@ -193,6 +194,27 @@ func TestManager_Invalidate(_ *testing.T) {
 	manager.Invalidate(context.Background(), ids)
 }
 
+func TestManager_registerFactoryCarriesSecurity(t *testing.T) {
+	log := zap.NewNop()
+	codeManager := &code.Manager{}
+	bus := &mockEventBus{}
+	fsReg := &mockFSRegistry{}
+	factory := &mockCompiledFactory{}
+	manager := NewManager(log, codeManager, bus, fsReg, factory)
+	securityConfig := &security.Config{Actor: security.Actor{ID: "process:runner"}}
+	awaitSvc := &mockPrepareAwaitService{result: event.AwaitResult{Accepted: true}}
+	ctx := event.WithAwaitService(ctxapi.NewRootContext(), awaitSvc)
+
+	err := manager.registerFactory(ctx, registry.NewID("app.test", "process"), "", securityConfig)
+
+	require.NoError(t, err)
+	require.Len(t, bus.events, 1)
+	entry, ok := bus.events[0].Data.(*processapi.FactoryEntry)
+	require.True(t, ok)
+	assert.Equal(t, "main", entry.Meta.Method)
+	assert.Same(t, securityConfig, entry.Meta.Security)
+}
+
 func TestManager_registerFactory_PreparesBeforeSend(t *testing.T) {
 	log := zap.NewNop()
 	codeManager := &code.Manager{}
@@ -212,7 +234,7 @@ func TestManager_registerFactory_PreparesBeforeSend(t *testing.T) {
 	}
 
 	ctx := event.WithAwaitService(ctxapi.NewRootContext(), awaitSvc)
-	err := manager.registerFactory(ctx, registry.NewID("app.test", "process"), "main")
+	err := manager.registerFactory(ctx, registry.NewID("app.test", "process"), "main", nil)
 	require.NoError(t, err)
 	assert.False(t, sendBeforePrepare, "factory register was sent before await prepare")
 }

service/exec/native/native_test.go

@@ -456,8 +456,7 @@ func TestExecutor_Stderr(t *testing.T) {
 	// Use a cross-platform way to generate stderr output
 	var command string
 	if runtime.GOOS == "windows" {
-		// On Windows, use PowerShell for reliable stderr redirection
-		command = "powershell -Command \"[Console]::Error.WriteLine('error message')\""
+		command = "cmd /c \"echo error message 1>&2\""
 	} else {
 		// On Unix systems - use sh instead of bash for better compatibility
 		command = "sh -c 'echo error message >&2'"

service/host/host.go

@@ -18,6 +18,7 @@ import (
 	hostapi "github.com/wippyai/runtime/api/service/host"
 	"github.com/wippyai/runtime/api/topology"
 	"github.com/wippyai/runtime/system/scheduler/actor"
+	securitysys "github.com/wippyai/runtime/system/security"
 	"go.uber.org/zap"
 )
 
@@ -98,6 +99,9 @@ func (h *Host) Run(ctx context.Context, start *process.Start) (pid.PID, error) {
 
 	processID := h.preparePID(ctx, start)
 	frameCtx := h.prepareContext(ctx, processID, start)
+	if meta != nil && meta.Security != nil {
+		frameCtx = securitysys.ApplyProcessSecurityConfig(frameCtx, meta.Security)
+	}
 
 	method := "main"
 	if meta != nil && meta.Method != "" {