docs: the runtime-control wave — reserved names, in-process modules, operator and shell callers

[dlipicar]

Brings the developer guide and the caller-identity tutorial in line with the runtime-control wave, per the tutorial sync rule. The wave: core_service embedded in liblogos, capability_module as the single token authority running in-process, in-process hosting of plain modules, and named shells.

Stacked on #93 (codex/qt-remote-plain-tutorial), the qt_remote_plain chain's docs. The code it describes is in draft PRs:

• feat: bootstrap policy table, bundled directories and reserved names logos-liblogos#225, #226, #227;
• feat: the daemon runs liblogos' embedded core_service instead of its own logos-logoscore-cli#145;
• feat: capability_module as the single token authority (plain transport, engine interface, store of record) logos-capability-module#33;
• feat: plain modules export only logos_module_*, stamped in-process eligible logos-module-builder#261;
• feat: Basecamp is the "basecamp" shell of its runtime logos-basecamp#436.

Developer guide

• Metadata reference.
  • The runtime's reserved names, compared without case: core_service, capability_module, modules_state, package_manager, package_downloader, logos_* and the shell names. They load only from bundled directories.
  • New in_process row.
  • host_services go only to the bundled capability_module.
• §6.1 logoscore.
  • A logoscore call or watch reaches a module as Operator{name}, named after the client's token (auto locally). Forwarded calls to capability_module and core_service are refused.
  • Bundled plain modules can run in the daemon's process (--bundled-modules-dir, --placement), and module-info shows the placement.
• §7.2 Basecamp.
  • Ships both hosts and runs its own modules in-process.
  • Loads modules through core_service as the basecamp shell, so modules see Module{name: "basecamp"}.
• Caller identity.
  • Host is the runtime alone.
  • Shells and UI plugins are modules by name, and the CLI is an Operator.
  • Includes a migration note for gates that admitted Basecamp through isHost().
• Other sections. §8.4 gains the inproc path. Standalone loading now goes through core_service. The capability troubleshooting entry and the CLI summary are updated.

Caller-identity tutorial

logoscore call calc_guarded whoIsCalling now answers operator auto, where it answered host, and the gate refuses operator auto. This was measured before editing, not assumed. The spec run against logos-logoscore-cli#145, with its modules built by the builder's master as the tutorial builds them, failed exactly those two steps with those answers. After the edit it passes 20/20:

doctest run tests/tutorial-caller-identity.test.yaml --release-for logos-logoscore-cli=feat/core-service-in-liblogos

outputs/tutorial-caller-identity.md is regenerated with doctest generate, and it matches what the verify-generation job produces.

This repo's CI runs only for PRs into master. Against today's master CLI the caller-identity spec would still answer host, which is why it belongs with the wave rather than ahead of it.

🤖 Generated with Claude Code