Add capability-scoped executable lifecycle hook resources

[Haz3-jolt]

Outcome

Support user-installed lifecycle hooks through the public runtime API and the executable activation boundary, using one concrete hook consumer.

Current repository evidence

• packages/extensions/api/src/index.ts: Client-local lifecycle listeners exist, but daemon executable hook resources and their public activation contract do not.
• packages/kernel/src/extension-host.ts: The kernel exposes a lifecycle seam rather than a hook-resource loader or permission grant.

Acceptance criteria

• Validate hook metadata, supported event subscriptions, execution limits, and declared capabilities before activation.
• Use canonical event inputs and a documented bounded hook result contract without exposing mutable daemon or kernel objects.
• Run third-party and generated executable hooks out of process under enforced sandbox policy, with cancellation and bounded output.
• Keep policy enforcement below hooks: a hook may reject or narrow work but never grant filesystem, network, credential, or spawn authority.
• Require explicit activation approval for generated executable hooks even when a learning tier is automatic.
• Remove listeners, processes, prompt contributions, and tracked work on disable, reload, rollback, and disposal; prove behavior with a real consumer fixture.

Verification

Add focused public-contract and installed-artifact checks for the supported consumer, including disabled behavior and invalid inputs. Source inspection was performed for this audit; product tests were not run.

Coordination

This is future work tied to a concrete consumer. Posting this issue does not authorize premature scaffolding, publication, dependency additions, or activation before the required security controls.

Source

ROADMAP.md and CODE_STRUCTURE.md, using the references recorded below.

Repository audit

Audited against Axl 88944a2. Phase 6. Source inspection, not an executed behavior test. Roadmap references: L1897, L1907.

Tracking key: axl-backlog:audit.executable-lifecycle-hooks.

Issue tracking

Axl issue mirror: #376 | GitHub #376

Related issues:

• #44 (Implement the capability-scoped runtime extension API with real consumers #44)
• #47 (Activate executable extensions through a capability process host #47)
• #217 (Quarantine and approve generated workflow programs, hooks, and extensions #217)