x07-os-run

Prefer x07 run --profile os / x07 run --profile sandbox for normal execution. x07-os-runner is an internal component behind the x07 facade; its CLI is not part of the supported end-user surface.

Use this skill when you need real OS I/O (fs/net/process/time) via run-os or policy-enforced execution via run-os-sandboxed .

Canonical commands (recommended: x07 run )

Run the current project (unsandboxed):

• x07 run

• x07 run --profile os

Run a project explicitly (unsandboxed):

• x07 run --project x07.json --profile os

Run sandboxed (requires an explicit policy):

• x07 run --project x07.json --profile sandbox --policy run-os-policy.json

If your program expects CLI args via argv_v1 , pass them after -- and x07 run will encode them into input bytes:

• x07 run --profile os -- tool --help

Generate a schema-valid base policy:

• x07 policy init --template cli

• x07 policy init --template http-client

• x07 policy init --template web-service

• x07 policy init --template fs-tool

• x07 policy init --template sqlite-app

• x07 policy init --template postgres-client

• x07 policy init --template worker

• x07 policy init --template worker-parallel

Materialize a derived policy with explicit destinations (only in run-os-sandboxed):

• x07 run --profile sandbox --policy .x07/policies/base/http-client.sandbox.base.policy.json --allow-host example.com:443

• x07 run --profile sandbox --policy .x07/policies/base/http-client.sandbox.base.policy.json --deny-host example.com:*

Run a single program (when not using a project manifest):

• x07 run --program src/main.x07.json --module-root src

Expert backend (x07-os-runner )

x07-os-runner implements OS execution for x07 run / x07 bundle . Treat it as internal and prefer x07 commands above.

Policy

Policies are a starting point. Generate one from a template, then extend it deliberately for your app (roots, env, subprocess allowlists, limits). For net-enabled templates, keep net.allow_hosts empty in the base policy and use x07 run --allow-host to materialize auditable derived policies for specific destinations.

Output contract

• x07 run in run-os* worlds prints an x07-os-runner.report@... JSON report to stdout (pass-through).

• The underlying OS runner emits the same report shape.

In both cases:

• Use the process exit code for pass/fail.

• Parse the JSON for schema_version , mode , world , and base64-encoded output bytes.