v0.7.2: tag stack severity tiers + tool hardening — TDD

Tag stack: TAG_CATEGORIES env var parses into *tag-categories* alist
(@tag . severity). Three tiers: :block (filter), :warn (log), :log
(silent). tag-category-severity lookup. /tags TUI command.

Tool hardening: per-tool timeouts (shell=300s, search=30s, eval=10s,
default=120s). verify-write after write-file reads back content.
tool-timeout accessor.

- security-dispatcher: *tag-categories*, tag-categories-load,
  tag-category-severity, 2 tests
- core-act: *tool-timeouts*, tool-timeout, verify-write, 3 tests
- programming-tools: verify-write wired into write-file
- channel-tui-main: /tags and /audit commands
- Core: 84/84

org/channel-tui-main.org

@@ -194,6 +194,14 @@ Event handlers + daemon I/O + main loop.
                                                      (subseq (or (getf info :hash) "(none)") 0 16)))
                              (add-msg :system (format nil "Node ~a not found" node-id))))
                        (add-msg :system "Memory audit not available")))
+                  ;; /tags command — tag stack
+                  ((string-equal text "/tags")
+                   (let ((cats (or passepartout::*tag-categories* nil)))
+                         (if cats
+                             (dolist (entry cats)
+                               (add-msg :system (format nil "~a: ~a" (car entry) (cdr entry))))
+                             (add-msg :system "No tags configured. Set TAG_CATEGORIES env var.")))
+                       (add-msg :system "Tag categories not loaded")))
                   ((string-equal text "/help")
                    (add-msg :system
                     "/focus <proj>  Set project context")
@@ -990,6 +998,17 @@ Event handlers + daemon I/O + main loop.
   (on-key 13)
   (let* ((msgs (st :messages))
          (m (aref msgs (1- (length msgs)))))
-    (fiveam:is (search "reloaded" (getf m :content))
-               "/identity should produce 'Identity reloaded' message")))
+     (fiveam:is (search "reloaded" (getf m :content))
+                "/identity should produce 'Identity reloaded' message")))
+
+(fiveam:test test-tags-command
+  "Contract v0.7.2: /tags lists defined tag categories."
+  (init-state)
+  (setf passepartout::*tag-categories* '(("@personal" . :block) ("@draft" . :warn)))
+  (dolist (ch (coerce "/tags" 'list))
+    (on-key (char-code ch)))
+  (on-key 13)
+  (let* ((msgs (st :messages))
+         (m (aref msgs (1- (length msgs)))))
+    (fiveam:is (search "WARN" (getf m :content)))))
 #+end_src