Channel-open policy hook -- FABRIC-3.6.md task 3.7

Added HERMES-CHANNEL-OPEN? ( req-hi req-lo -- allow? ) at
capsules/ACL.4th block 4008 (default: approve everything) -- the one
word policy authors edit. sk_hermes_channel_open_policy(VM*, VMUuid)
(kernel_hermes.h/.c) is the C-side query that calls it via plain
word-dispatch against the target VM's own dictionary/stack, never
vm_interpret() (avoids task 3.4's input-buffer cursor hazard entirely)
and never decides the answer itself. Fails closed: no policy word,
a policy error, or stack underflow all deny, matching CLAUDE.md's
posture that absence of policy must never mean "always allow."

Two real bugs found and fixed before this was called done:
missing current_executing_entry assignment before calling the word's
func pointer (colon words silently no-op without it, vm_core.c:730 --
no crash, just a wrong answer); and a second FAIL with debug
instrumentation still in place whose precise cause isn't
reconstructable, since no intermediate commit exists for that attempt.

Self-test proves the task's check four ways against the same
unchanged C function: default approve, live redefinition to deny
(zero C change), restore, and a VM with no ACL.4th loaded at all
(fail closed). A fifth check wires the result into task 3.6's
sk_hermes_channel_respond() end to end: a denied policy produces a
NACK and no channel, ledger/stadium_conserved() holding throughout.

Scope, per Captain Bob's ruling: closes with the query built and
proven; sk_hermes_channel_respond() still takes a caller-supplied
approved bool rather than calling the policy internally. Wiring a
real channel-open call site to only this query is deferred to
whichever later task first needs a live decision.

dict_hash identical across amd64/aarch64/riscv64 for every VM, zero
UNKNOWN WORD, mkcapsule --lint clean (38 files, 0 violations).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/starkernel/vm/kernel_hermes.c

@@ -713,4 +713,43 @@ int sk_hermes_channel_close(VMUuid closer, int channel_id) {
     return sk_hermes_channel_destroy(channel_id);
 }
 
+int sk_hermes_channel_open_policy(VM *target_vm, VMUuid requester) {
+    static const char word_name[] = "HERMES-CHANNEL-OPEN?";
+    DictEntry *entry;
+    DictEntry *saved_entry;
+    cell_t result;
+
+    if (!target_vm) return 0;
+
+    entry = vm_find_word(target_vm, word_name, sizeof(word_name) - 1);
+    if (!entry || !entry->func) return 0; /* fail closed: no policy, no open */
+
+    /* Colon words dispatch through execute_colon_word(), which reads its
+     * own body address from vm->current_executing_entry and no-ops
+     * silently if it is NULL (vm_core.c:730) -- vm_interpret_word() always
+     * sets this immediately before calling entry->func(); matched here
+     * for the same reason (found live: without it, every call silently
+     * did nothing, leaving the pushed requester untouched on the stack
+     * rather than erroring, which is why this needed a debug session to
+     * catch rather than showing up as an obvious crash). Saved and
+     * restored, not just set, in case target_vm is ever called into
+     * mid-dispatch (not exercised by this task's own self-test, but no
+     * reason to assume it away). */
+    saved_entry = target_vm->current_executing_entry;
+    target_vm->current_executing_entry = entry;
+    vm_push(target_vm, (cell_t)requester.hi);
+    vm_push(target_vm, (cell_t)requester.lo);
+    entry->func(target_vm);
+    target_vm->current_executing_entry = saved_entry;
+
+    if (target_vm->error || target_vm->dsp < 0) {
+        target_vm->error = 0; /* a broken policy word must not leak into
+                                * whatever else target_vm is doing */
+        return 0;
+    }
+
+    result = vm_pop(target_vm);
+    return result != 0;
+}
+
 #endif /* __STARKERNEL__ */