Opt-in runtime reasoning node: admit an acknowledged non-deterministic AI step (second fenced carve-out beside RFC #223) #694

What

An opted-in way for an app to include one node whose output comes from AI reasoning at run time, alongside the existing single carve-out (vision.extract, RFC #223). Today check_node_agents (cli/src/validate.rs, ~L1245) rejects every other model in the run path with E_APP_RUNTIME_MODEL_FORBIDDEN.

Why

FloLess owner ruling (2026-10-12): a person may use an Agent (a named, scoped AI responsibility in FloLess) as a step in a workflow, provided they confirm they understand that step's output is not deterministic. "Build once, run forever" still holds: the app is compiled and approved once and runs unchanged; only that node's output varies. FloLess runs the reasoning through the person's own AI provider (Claude Code / Codex); AWARE stays model-free and only needs to admit, mark and label the node.

Proposed shape (for discussion, mirrors the RFC #223 fence)

• Structural opt-in, not name-keyed: a curated command flagged e.g. model-reasoning: true on an agent declaring capabilities.runtime-model-reasoning: true. Every other path still gets E_APP_RUNTIME_MODEL_FORBIDDEN.
• App-level acknowledgement in the source, e.g. nondeterministic-output: acknowledged (who/when supplied by the front door). Validate rejects a reasoning node without it, with a clear message.
• The lock records it: the compiled node carries runtime-model: reasoning (distinct from extraction), and the lock carries an app-level nondeterministic-output: true marker so every front door can label results honestly. The node's instructions/config stay part of the source hash, so the .lock drift gate still pins the step, not its answer.
• Run output is labelled: the run record marks that node's output as AI-produced / non-deterministic. No content-hash replay claim of determinism.
• Same constraints as extraction where they still make sense: cannot be an assert: evaluator; open question whether it may feed control flow (FloLess leans: yes, if labelled), and whether a downstream host write must sit behind approve: (FloLess leans: yes by default).

Acceptance

• aware app validate admits the opted-in node only with the capability + acknowledgement, rejects all other model paths as today.
• aware app compile writes the markers; aware app run records the node output as non-deterministic.
• Tests mirroring the existing rejects_* / admits suite for RFC [RFC] vision.extract — a curated, schema-bound, approve-gated runtime extraction agent (principled exception to decalog #9) #223.

Related: RFC #223 (vision.extract carve-out), decalog #9. FloLess tracking epic: pawellisowski/floless.app (to be linked).