Enforce bounded operation guardrails

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f

tests/test_resolve_context_binding.py

@@ -158,3 +158,37 @@ async def test_event_payload_context_fails_when_required_envelope_missing() -> N
                 }
             ],
         )
+
+
+@pytest.mark.asyncio
+async def test_resolve_context_does_not_execute_bounded_shell_operation() -> None:
+    snapshot = await resolve_context(
+        [
+            {
+                "type": "shell",
+                "query": "forgejo_package_prune",
+                "operation": "forgejo_package_prune",
+                "params": {},
+                "bind_to": "context.prune",
+            }
+        ]
+    )
+
+    assert snapshot == {
+        "prune": {"operation": "forgejo_package_prune", "status": "pending"}
+    }
+
+
+@pytest.mark.asyncio
+async def test_resolve_context_refuses_unknown_shell_query() -> None:
+    with pytest.raises(ApplicationError, match="not registered as read-only"):
+        await resolve_context(
+            [
+                {
+                    "type": "shell",
+                    "query": "arbitrary_command",
+                    "params": {},
+                    "bind_to": "context.bad",
+                }
+            ]
+        )