diff --git a/Cargo.lock b/Cargo.lock
index 94070ebc..bca2031c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1112,6 +1112,7 @@ dependencies = [
  "axum",
  "backon",
  "base64",
+ "bstr",
  "bytes",
  "chrono",
  "clap",
@@ -1161,7 +1162,6 @@ dependencies = [
  "url",
  "uuid",
  "webbrowser",
- "which 6.0.3",
  "wiremock",
 ]
 
@@ -1257,6 +1257,7 @@ version = "0.0.0-dev"
 dependencies = [
  "anyhow",
  "async-trait",
+ "bstr",
  "chrono",
  "derive_more",
  "include_dir",
@@ -1266,11 +1267,12 @@ dependencies = [
  "serde",
  "serde_json",
  "tempfile",
+ "thiserror 2.0.18",
  "tokio",
  "tracing",
  "unicode-segmentation",
  "unicode-width",
- "which 7.0.3",
+ "which",
 ]
 
 [[package]]
@@ -1295,6 +1297,7 @@ dependencies = [
  "anyhow",
  "async-trait",
  "derive_more",
+ "hm-common",
  "include_dir",
  "rstest",
  "serde",
@@ -1302,7 +1305,6 @@ dependencies = [
  "tempfile",
  "tokio",
  "tracing",
- "which 7.0.3",
 ]
 
 [[package]]
@@ -1438,15 +1440,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "home"
-version = "0.5.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
-dependencies = [
- "windows-sys 0.61.2",
-]
-
 [[package]]
 name = "http"
 version = "1.4.0"
@@ -1961,12 +1954,6 @@ dependencies = [
  "vcpkg",
 ]
 
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
-
 [[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
@@ -2735,19 +2722,6 @@ dependencies = [
  "semver",
 ]
 
-[[package]]
-name = "rustix"
-version = "0.38.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
-dependencies = [
- "bitflags",
- "errno",
- "libc",
- "linux-raw-sys 0.4.15",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "rustix"
 version = "1.1.4"
@@ -2757,7 +2731,7 @@ dependencies = [
  "bitflags",
  "errno",
  "libc",
- "linux-raw-sys 0.12.1",
+ "linux-raw-sys",
  "windows-sys 0.61.2",
 ]
 
@@ -3256,7 +3230,7 @@ dependencies = [
  "fastrand",
  "getrandom 0.4.2",
  "once_cell",
- "rustix 1.1.4",
+ "rustix",
  "windows-sys 0.61.2",
 ]
 
@@ -3266,7 +3240,7 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874"
 dependencies = [
- "rustix 1.1.4",
+ "rustix",
  "windows-sys 0.61.2",
 ]
 
@@ -3992,18 +3966,6 @@ dependencies = [
  "rustls-pki-types",
 ]
 
-[[package]]
-name = "which"
-version = "6.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4ee928febd44d98f2f459a4a79bd4d928591333a494a10a868418ac1b39cf1f"
-dependencies = [
- "either",
- "home",
- "rustix 0.38.44",
- "winsafe",
-]
-
 [[package]]
 name = "which"
 version = "7.0.3"
@@ -4012,7 +3974,7 @@ checksum = "24d643ce3fd3e5b54854602a080f34fb10ab75e0b813ee32d00ca2b44fa74762"
 dependencies = [
  "either",
  "env_home",
- "rustix 1.1.4",
+ "rustix",
  "winsafe",
 ]
 
@@ -4402,7 +4364,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
 dependencies = [
  "libc",
- "rustix 1.1.4",
+ "rustix",
 ]
 
 [[package]]
diff --git a/crates/hm-common/Cargo.toml b/crates/hm-common/Cargo.toml
index 2d2e0bc0..618b1f57 100644
--- a/crates/hm-common/Cargo.toml
+++ b/crates/hm-common/Cargo.toml
@@ -11,6 +11,9 @@ categories = ["command-line-utilities"]
 [lib]
 path = "src/lib.rs"
 
+[features]
+app-runtime = []
+
 [dependencies]
 anyhow      = { workspace = true }
 async-trait = { workspace = true }
@@ -18,6 +21,8 @@ chrono      = { workspace = true }
 derive_more = { workspace = true }
 serde       = { workspace = true }
 serde_json  = { workspace = true }
+thiserror   = { workspace = true }
+bstr        = "1"
 include_dir = "0.7"
 num-traits  = { workspace = true }
 tempfile    = "3"
@@ -30,7 +35,6 @@ which       = "7"
 [dev-dependencies]
 tempfile    = "3"
 tokio       = { version = "1", features = ["macros", "rt-multi-thread"] }
-which       = "7"
 rstest      = { workspace = true }
 proptest    = { workspace = true }
 
diff --git a/crates/hm-common/src/app_runtime.rs b/crates/hm-common/src/app_runtime.rs
new file mode 100644
index 00000000..8844ff4f
--- /dev/null
+++ b/crates/hm-common/src/app_runtime.rs
@@ -0,0 +1,143 @@
+//! Application runtime context.
+
+use std::path::{Path, PathBuf};
+use std::sync::OnceLock;
+
+use crate::git::Git;
+use crate::process::{ExecutableNotFound, pathbin};
+use crate::python::Python;
+
+/// Failure to initialize the [`AppRuntime`].
+#[derive(Debug, thiserror::Error)]
+pub enum InitError {
+    /// A required executable was missing from `PATH`.
+    #[error(transparent)]
+    Executables(#[from] ExecutableNotFound),
+    /// The current directory could not be read.
+    #[error("reading the current directory")]
+    Cwd(#[source] std::io::Error),
+}
+
+// TODO: This is a process-wide singleton (a global `OnceLock`), which is
+// convenient but couples every caller to hidden global state. Consider
+// threading an explicit `AppRuntime` handle through the application instead,
+// so dependencies are visible in signatures and tests can inject their own.
+/// Process-wide runtime context, resolved once at startup.
+///
+/// Install it with [`init`](Self::init), then read it from anywhere through the
+/// associated accessors — no threading required.
+#[derive(Debug)]
+pub struct AppRuntime {
+    git: PathBuf,
+    python3: PathBuf,
+    cwd: PathBuf,
+}
+
+static RUNTIME: OnceLock<AppRuntime> = OnceLock::new();
+
+impl AppRuntime {
+    /// Resolve the runtime and install it as the process-wide singleton.
+    ///
+    /// Call once, early in `main`, before any accessor. A later call is ignored.
+    ///
+    /// # Errors
+    /// [`InitError`] if a required executable is missing from `PATH` or the
+    /// current directory cannot be read.
+    pub fn init() -> Result<(), InitError> {
+        let runtime = Self::resolve()?;
+        let _ = RUNTIME.set(runtime);
+        Ok(())
+    }
+
+    fn resolve() -> Result<Self, InitError> {
+        Ok(Self {
+            git: pathbin("git")?,
+            python3: pathbin("python3")?,
+            cwd: std::env::current_dir().map_err(InitError::Cwd)?,
+        })
+    }
+
+    #[allow(
+        clippy::expect_used,
+        reason = "accessing the runtime before init is a startup bug, not a runtime error"
+    )]
+    fn get() -> &'static Self {
+        RUNTIME
+            .get()
+            .expect("AppRuntime::init must be called before the runtime is accessed")
+    }
+
+    /// The absolute working directory captured at initialization.
+    ///
+    /// # Panics
+    /// If [`init`](Self::init) has not been called.
+    #[must_use]
+    pub fn cwd() -> &'static Path {
+        &Self::get().cwd
+    }
+
+    /// The system `git`, bound to a [`Git`] handle.
+    ///
+    /// # Panics
+    /// If [`init`](Self::init) has not been called.
+    #[must_use]
+    pub fn git() -> Git<'static> {
+        Git::new(&Self::get().git)
+    }
+
+    /// The system `python3`, bound to a [`Python`] handle.
+    ///
+    /// # Panics
+    /// If [`init`](Self::init) has not been called.
+    #[must_use]
+    pub fn python() -> Python<'static> {
+        Python::new(&Self::get().python3)
+    }
+}
+
+#[cfg(test)]
+#[allow(
+    clippy::unwrap_used,
+    clippy::print_stderr,
+    reason = "test setup, assertions, and skip diagnostics"
+)]
+mod tests {
+    use super::*;
+    use rstest::rstest;
+
+    #[rstest]
+    fn resolve_reports_toolchain_availability() {
+        assert_eq!(
+            AppRuntime::resolve().is_ok(),
+            pathbin("python3").is_ok() && pathbin("git").is_ok()
+        );
+    }
+
+    #[rstest]
+    fn resolve_captures_an_absolute_cwd() {
+        let Ok(runtime) = AppRuntime::resolve() else {
+            eprintln!("skipping: toolchain unavailable");
+            return;
+        };
+        assert!(runtime.cwd.is_absolute(), "cwd was {:?}", runtime.cwd);
+    }
+
+    #[rstest]
+    fn init_installs_a_globally_accessible_runtime() {
+        if AppRuntime::resolve().is_err() {
+            eprintln!("skipping: toolchain unavailable");
+            return;
+        }
+        AppRuntime::init().unwrap();
+        assert!(AppRuntime::cwd().is_absolute());
+        // git() binds the resolved git; a fresh temp dir is not a repo.
+        let dir = tempfile::tempdir().unwrap();
+        assert!(AppRuntime::git().repo(dir.path()).is_err());
+    }
+
+    #[rstest]
+    fn init_error_wraps_a_missing_executable() {
+        let err: InitError = pathbin("hm-common-no-such-binary-xyz").unwrap_err().into();
+        assert!(matches!(err, InitError::Executables(_)));
+    }
+}
diff --git a/crates/hm-common/src/git.rs b/crates/hm-common/src/git.rs
new file mode 100644
index 00000000..d4f021e4
--- /dev/null
+++ b/crates/hm-common/src/git.rs
@@ -0,0 +1,275 @@
+//! Running git.
+
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+use bstr::{BStr, BString, ByteSlice};
+
+use crate::process::{CapturedStreams as _, CommandExt as _};
+
+/// A path that is not a git repository.
+#[derive(Debug, thiserror::Error)]
+#[error("`{path}` is not a git repository")]
+pub struct InvalidRepoError {
+    path: PathBuf,
+}
+
+/// A resolved `git` executable.
+#[derive(Debug, Clone, Copy)]
+pub struct Git<'bin> {
+    bin: &'bin Path,
+}
+
+impl<'bin> Git<'bin> {
+    /// Wrap a `git` executable, typically via `AppRuntime::git()`.
+    #[must_use]
+    pub const fn new(bin: &'bin Path) -> Self {
+        Self { bin }
+    }
+
+    /// Bind to the git work tree at `repo`.
+    ///
+    /// # Errors
+    /// [`InvalidRepoError`] if `repo` is not inside a git work tree.
+    #[tracing::instrument(skip(self))]
+    pub fn repo<'g>(&'g self, repo: &'g Path) -> Result<GitRepo<'g, 'bin>, InvalidRepoError> {
+        let bound = GitRepo { git: self, repo };
+        if bound.run(&["rev-parse", "--git-dir"]).is_some() {
+            Ok(bound)
+        } else {
+            Err(InvalidRepoError {
+                path: repo.to_path_buf(),
+            })
+        }
+    }
+}
+
+/// A git work tree, bound to a [`Git`] and a repository path.
+#[derive(Debug, Clone, Copy)]
+pub struct GitRepo<'g, 'bin> {
+    git: &'g Git<'bin>,
+    repo: &'g Path,
+}
+
+impl<'g, 'bin> GitRepo<'g, 'bin> {
+    /// Run `git -C <repo> <args>`, returning trimmed stdout on a zero exit.
+    /// `None` on spawn failure, a non-zero exit, or empty output.
+    fn run(&self, args: &[&str]) -> Option<BString> {
+        let mut cmd = Command::new(self.git.bin);
+        cmd.arg("-C").arg(self.repo).args(args);
+        let out = cmd.captured().ok()?.success().ok()?;
+        let trimmed = out.stdout().trim();
+        (!trimmed.is_empty()).then(|| BString::from(trimmed))
+    }
+
+    /// The checked-out branch (`HEAD` when detached). `None` if git fails.
+    #[tracing::instrument(skip(self))]
+    pub fn current_branch(&self) -> Option<GitBranch<'_, 'g, 'bin>> {
+        let name = self.run(&["rev-parse", "--abbrev-ref", "HEAD"])?;
+        Some(GitBranch { repo: self, name })
+    }
+
+    /// The named remote, or `None` when it is not configured.
+    #[tracing::instrument(skip(self))]
+    pub fn remote(&self, name: &str) -> Option<GitRemote<'_, 'g, 'bin>> {
+        let url = self.run(&["config", "--get", &format!("remote.{name}.url")])?;
+        Some(GitRemote {
+            repo: self,
+            name: name.to_owned(),
+            url,
+        })
+    }
+}
+
+/// A branch in a [`GitRepo`].
+#[derive(Debug, Clone)]
+pub struct GitBranch<'r, 'g, 'bin> {
+    repo: &'r GitRepo<'g, 'bin>,
+    name: BString,
+}
+
+impl<'r, 'g, 'bin> GitBranch<'r, 'g, 'bin> {
+    /// The branch name (e.g. `main`, or `HEAD` when detached).
+    #[must_use]
+    pub fn name(&self) -> &BStr {
+        self.name.as_bstr()
+    }
+
+    /// The commit the branch points at, as a hex object id. `None` if git fails.
+    #[tracing::instrument(skip(self))]
+    pub fn head_commit(&self) -> Option<BString> {
+        let name = self.name.to_str().ok()?;
+        self.repo.run(&["rev-parse", name])
+    }
+}
+
+/// A remote of a [`GitRepo`].
+#[derive(Debug, Clone)]
+pub struct GitRemote<'r, 'g, 'bin> {
+    repo: &'r GitRepo<'g, 'bin>,
+    name: String,
+    url: BString,
+}
+
+impl<'r, 'g, 'bin> GitRemote<'r, 'g, 'bin> {
+    /// The remote's name (e.g. `origin`).
+    #[must_use]
+    pub fn name(&self) -> &str {
+        &self.name
+    }
+
+    /// The remote's configured URL.
+    #[must_use]
+    pub fn url(&self) -> &BStr {
+        self.url.as_bstr()
+    }
+
+    /// `owner/repo` parsed from the remote URL, mirroring the backend's
+    /// `Harmont.Pipelines.RepoName`. `None` when fewer than two path segments
+    /// remain.
+    #[must_use]
+    pub fn gh_repo_name(&self) -> Option<BString> {
+        parse_gh_repo_name(self.url.as_bstr())
+    }
+
+    /// The remote's default branch, from its `HEAD` symbolic ref. `None` when
+    /// `<remote>/HEAD` is unset (common on fresh clones).
+    #[tracing::instrument(skip(self))]
+    pub fn default_branch(&self) -> Option<GitBranch<'r, 'g, 'bin>> {
+        let line = self
+            .repo
+            .run(&["symbolic-ref", &format!("refs/remotes/{}/HEAD", self.name)])?;
+        let name = parse_default_branch(line.as_bstr(), &self.name)?;
+        Some(GitBranch {
+            repo: self.repo,
+            name,
+        })
+    }
+}
+
+/// Extract `owner/repo` from a remote URL: drop scheme/host and a trailing
+/// `.git`, then take the last two non-empty path segments.
+fn parse_gh_repo_name(url: &BStr) -> Option<BString> {
+    let url = url.to_str().ok()?.trim();
+    let path = if let Some((_, rest)) = url.split_once("://") {
+        rest.split_once('/').map_or(rest, |(_, p)| p)
+    } else if url.contains('@') && url.contains(':') {
+        let after_at = url.split_once('@').map_or(url, |(_, r)| r);
+        after_at.split_once(':').map_or(after_at, |(_, p)| p)
+    } else {
+        url.split_once('/').map_or(url, |(_, p)| p)
+    };
+    let path = path.trim_end_matches('/');
+    let path = path.strip_suffix(".git").unwrap_or(path);
+    let segs: Vec<&str> = path.split('/').filter(|s| !s.is_empty()).collect();
+    if segs.len() < 2 {
+        return None;
+    }
+    Some(BString::from(segs[segs.len() - 2..].join("/")))
+}
+
+/// Extract the branch name from a `symbolic-ref refs/remotes/<remote>/HEAD`
+/// result (e.g. `refs/remotes/origin/main` → `main`).
+fn parse_default_branch(line: &BStr, remote: &str) -> Option<BString> {
+    let line = line.to_str().ok()?.trim();
+    let branch = line.strip_prefix(&format!("refs/remotes/{remote}/"))?;
+    (!branch.is_empty()).then(|| BString::from(branch))
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used, reason = "test setup and assertions")]
+mod tests {
+    use super::*;
+    use rstest::rstest;
+
+    #[rstest]
+    #[case::https("https://github.com/acme/web.git", Some("acme/web"))]
+    #[case::https_no_suffix("https://github.com/acme/web", Some("acme/web"))]
+    #[case::scp("git@github.com:acme/web.git", Some("acme/web"))]
+    #[case::ssh("ssh://git@github.com/acme/web", Some("acme/web"))]
+    #[case::trailing_slash("https://github.com/acme/web/", Some("acme/web"))]
+    #[case::nested("https://gitlab.com/group/sub/web.git", Some("sub/web"))]
+    #[case::deep_path("https://example.com/a/b/c/repo", Some("c/repo"))]
+    #[case::too_short("https://github.com/web", None)]
+    #[case::empty("", None)]
+    #[case::not_a_url("not-a-url", None)]
+    fn parses_gh_repo_name(#[case] url: &str, #[case] expected: Option<&str>) {
+        let got = parse_gh_repo_name(url.into());
+        assert_eq!(got, expected.map(BString::from));
+    }
+
+    #[rstest]
+    #[case::main("refs/remotes/origin/main", "origin", Some("main"))]
+    #[case::trailing_newline("refs/remotes/origin/main\n", "origin", Some("main"))]
+    #[case::slash("refs/remotes/origin/feature/x", "origin", Some("feature/x"))]
+    #[case::other_remote("refs/remotes/upstream/dev", "upstream", Some("dev"))]
+    #[case::wrong_prefix("refs/heads/main", "origin", None)]
+    #[case::trailing_slash("refs/remotes/origin/", "origin", None)]
+    #[case::empty("", "origin", None)]
+    fn parses_default_branch(#[case] line: &str, #[case] remote: &str, #[case] expected: Option<&str>) {
+        let got = parse_default_branch(line.into(), remote);
+        assert_eq!(got, expected.map(BString::from));
+    }
+
+    /// A throwaway git repo with one commit and an `origin` remote.
+    fn temp_repo() -> tempfile::TempDir {
+        let dir = tempfile::tempdir().unwrap();
+        let git = |args: &[&str]| {
+            let ok = Command::new("git")
+                .arg("-C")
+                .arg(dir.path())
+                .args(args)
+                .captured()
+                .unwrap()
+                .success();
+            assert!(ok.is_ok(), "git {args:?} failed");
+        };
+        git(&["init", "-q", "-b", "main"]);
+        git(&["config", "user.email", "t@t.dev"]);
+        git(&["config", "user.name", "t"]);
+        git(&["commit", "-q", "--allow-empty", "-m", "init"]);
+        git(&["remote", "add", "origin", "git@github.com:acme/web.git"]);
+        dir
+    }
+
+    #[rstest]
+    fn repo_rejects_a_non_repo_dir() {
+        let dir = tempfile::tempdir().unwrap();
+        let git = Git::new(Path::new("git"));
+        assert!(git.repo(dir.path()).is_err());
+    }
+
+    #[rstest]
+    fn reads_branch_commit_and_remote() {
+        let dir = temp_repo();
+        let git = Git::new(Path::new("git"));
+        let repo = git.repo(dir.path()).unwrap();
+
+        let branch = repo.current_branch().unwrap();
+        assert_eq!(branch.name(), "main");
+        assert_eq!(branch.head_commit().unwrap().len(), 40);
+
+        let remote = repo.remote("origin").unwrap();
+        assert_eq!(remote.name(), "origin");
+        assert_eq!(remote.gh_repo_name(), Some(BString::from("acme/web")));
+    }
+
+    #[rstest]
+    fn default_branch_reads_origin_head() {
+        let dir = temp_repo();
+        let git = Git::new(Path::new("git"));
+        let repo = git.repo(dir.path()).unwrap();
+        // Point origin/HEAD at a fabricated remote-tracking ref.
+        Command::new("git")
+            .arg("-C")
+            .arg(dir.path())
+            .args(["symbolic-ref", "refs/remotes/origin/HEAD", "refs/remotes/origin/main"])
+            .captured()
+            .unwrap()
+            .success()
+            .unwrap();
+
+        let branch = repo.remote("origin").unwrap().default_branch().unwrap();
+        assert_eq!(branch.name(), "main");
+    }
+}
diff --git a/crates/hm-common/src/lib.rs b/crates/hm-common/src/lib.rs
index 93372701..b0c5fb15 100644
--- a/crates/hm-common/src/lib.rs
+++ b/crates/hm-common/src/lib.rs
@@ -1,6 +1,11 @@
 //! Harmont common utilities shared across the `hm` workspace.
 
+#[cfg(feature = "app-runtime")]
+pub mod app_runtime;
 pub mod format;
 pub mod fs;
+pub mod git;
+pub mod process;
+pub mod python;
 pub mod string;
 pub mod time;
diff --git a/crates/hm-common/src/process/capture.rs b/crates/hm-common/src/process/capture.rs
new file mode 100644
index 00000000..abf0f496
--- /dev/null
+++ b/crates/hm-common/src/process/capture.rs
@@ -0,0 +1,292 @@
+//! Spawn a command and capture its output, with a typed success/failure split.
+
+use std::borrow::Cow;
+use std::future::Future;
+use std::io;
+use std::process::ExitStatus;
+use std::str::Utf8Error;
+
+mod sealed {
+    pub trait Sealed {}
+    impl Sealed for std::process::Command {}
+    impl Sealed for tokio::process::Command {}
+    impl Sealed for super::CapturedOk {}
+    impl Sealed for super::CapturedError {}
+}
+
+/// A finished process: its captured stdout/stderr and exit status.
+///
+/// The output bytes are only readable after resolving the exit status with
+/// [`success`](Captured::success).
+#[derive(Debug, Clone)]
+pub struct Captured {
+    program: String,
+    stdout: Vec<u8>,
+    stderr: Vec<u8>,
+    status: ExitStatus,
+}
+
+impl Captured {
+    /// Split on the exit status: `Ok` if the process exited 0, else `Err`.
+    pub fn success(self) -> Result<CapturedOk, CapturedError> {
+        if self.status.success() {
+            Ok(CapturedOk(self))
+        } else {
+            Err(CapturedError(self))
+        }
+    }
+
+    /// The raw exit status.
+    #[must_use]
+    pub const fn status(&self) -> ExitStatus {
+        self.status
+    }
+
+    /// The exit code, or `None` if the process was killed by a signal.
+    #[must_use]
+    pub fn code(&self) -> Option<i32> {
+        self.status.code()
+    }
+}
+
+/// A process that exited successfully (status 0). Read output via [`CapturedStreams`].
+#[derive(Debug, Clone)]
+pub struct CapturedOk(Captured);
+
+/// A process that exited non-zero.
+#[derive(Debug, Clone, thiserror::Error)]
+#[error("{}", render_capture_error(.0))]
+pub struct CapturedError(Captured);
+
+fn describe_status(status: ExitStatus) -> String {
+    status.code().map_or_else(
+        || "terminated by signal".to_string(),
+        |code| format!("exited with status {code}"),
+    )
+}
+
+fn render_capture_error(c: &Captured) -> String {
+    use std::fmt::Write as _;
+
+    let mut msg = format!("`{}` {}", c.program, describe_status(c.status));
+    let stderr = String::from_utf8_lossy(&c.stderr);
+    let stderr = stderr.trim();
+    if !stderr.is_empty() {
+        const MAX: usize = 2000;
+        let snippet: String = stderr.chars().take(MAX).collect();
+        let ellipsis = if snippet.len() < stderr.len() { "…" } else { "" };
+        let _ = write!(msg, ": {snippet}{ellipsis}");
+    }
+    msg
+}
+
+/// Accessors over a captured process's output, implemented by [`CapturedOk`] and
+/// [`CapturedError`].
+pub trait CapturedStreams: sealed::Sealed {
+    /// Raw stdout bytes.
+    fn stdout(&self) -> &[u8];
+    /// Raw stderr bytes.
+    fn stderr(&self) -> &[u8];
+    /// The exit status.
+    fn status(&self) -> ExitStatus;
+
+    /// The exit code, or `None` if killed by a signal.
+    fn code(&self) -> Option<i32> {
+        self.status().code()
+    }
+
+    /// stdout as UTF-8, borrowed.
+    fn stdout_str(&self) -> Result<&str, Utf8Error> {
+        std::str::from_utf8(self.stdout())
+    }
+    /// stderr as UTF-8, borrowed.
+    fn stderr_str(&self) -> Result<&str, Utf8Error> {
+        std::str::from_utf8(self.stderr())
+    }
+
+    /// stdout as an owned UTF-8 `String`.
+    fn stdout_string(&self) -> Result<String, Utf8Error> {
+        self.stdout_str().map(str::to_owned)
+    }
+    /// stderr as an owned UTF-8 `String`.
+    fn stderr_string(&self) -> Result<String, Utf8Error> {
+        self.stderr_str().map(str::to_owned)
+    }
+
+    /// stdout as `&str`, **panicking** if not valid UTF-8.
+    #[allow(clippy::expect_used, reason = "callers opt into panic-on-invalid by calling _unwrap")]
+    fn stdout_str_unwrap(&self) -> &str {
+        self.stdout_str().expect("stdout was not valid UTF-8")
+    }
+    /// stderr as `&str`, **panicking** if not valid UTF-8.
+    #[allow(clippy::expect_used, reason = "callers opt into panic-on-invalid by calling _unwrap")]
+    fn stderr_str_unwrap(&self) -> &str {
+        self.stderr_str().expect("stderr was not valid UTF-8")
+    }
+
+    /// stdout as an owned `String`, **panicking** if not valid UTF-8.
+    #[allow(clippy::expect_used, reason = "callers opt into panic-on-invalid by calling _unwrap")]
+    fn stdout_string_unwrap(&self) -> String {
+        self.stdout_string().expect("stdout was not valid UTF-8")
+    }
+    /// stderr as an owned `String`, **panicking** if not valid UTF-8.
+    #[allow(clippy::expect_used, reason = "callers opt into panic-on-invalid by calling _unwrap")]
+    fn stderr_string_unwrap(&self) -> String {
+        self.stderr_string().expect("stderr was not valid UTF-8")
+    }
+
+    /// stdout decoded lossily (invalid sequences become U+FFFD). Never fails.
+    fn stdout_lossy(&self) -> Cow<'_, str> {
+        String::from_utf8_lossy(self.stdout())
+    }
+    /// stderr decoded lossily (invalid sequences become U+FFFD). Never fails.
+    fn stderr_lossy(&self) -> Cow<'_, str> {
+        String::from_utf8_lossy(self.stderr())
+    }
+}
+
+impl CapturedStreams for CapturedOk {
+    fn stdout(&self) -> &[u8] {
+        &self.0.stdout
+    }
+    fn stderr(&self) -> &[u8] {
+        &self.0.stderr
+    }
+    fn status(&self) -> ExitStatus {
+        self.0.status
+    }
+}
+
+impl CapturedStreams for CapturedError {
+    fn stdout(&self) -> &[u8] {
+        &self.0.stdout
+    }
+    fn stderr(&self) -> &[u8] {
+        &self.0.stderr
+    }
+    fn status(&self) -> ExitStatus {
+        self.0.status
+    }
+}
+
+/// Adds [`captured`](CommandExt::captured) to [`std::process::Command`].
+pub trait CommandExt: sealed::Sealed {
+    /// Spawn, wait for completion, and capture stdout/stderr and exit status.
+    fn captured(&mut self) -> io::Result<Captured>;
+}
+
+impl CommandExt for std::process::Command {
+    #[tracing::instrument(skip(self), fields(program = %self.get_program().to_string_lossy()))]
+    fn captured(&mut self) -> io::Result<Captured> {
+        let program = self.get_program().to_string_lossy().into_owned();
+        let out = self.output()?;
+        Ok(Captured {
+            program,
+            stdout: out.stdout,
+            stderr: out.stderr,
+            status: out.status,
+        })
+    }
+}
+
+/// Adds [`captured`](AsyncCommandExt::captured) to [`tokio::process::Command`].
+pub trait AsyncCommandExt: sealed::Sealed {
+    /// Spawn, await completion, and capture stdout/stderr and exit status.
+    fn captured(&mut self) -> impl Future<Output = io::Result<Captured>>;
+}
+
+impl AsyncCommandExt for tokio::process::Command {
+    #[tracing::instrument(skip(self), fields(program = %self.as_std().get_program().to_string_lossy()))]
+    async fn captured(&mut self) -> io::Result<Captured> {
+        let program = self.as_std().get_program().to_string_lossy().into_owned();
+        let out = self.output().await?;
+        Ok(Captured {
+            program,
+            stdout: out.stdout,
+            stderr: out.stderr,
+            status: out.status,
+        })
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used, reason = "test setup and assertions")]
+mod tests {
+    use super::*;
+    use rstest::rstest;
+
+    /// `sh -c <script>` — portable across this repo's unix CI targets.
+    fn sh(script: &str) -> std::process::Command {
+        let mut cmd = std::process::Command::new("sh");
+        cmd.arg("-c").arg(script);
+        cmd
+    }
+
+    #[rstest]
+    #[case::plain("printf hello", "hello")]
+    #[case::trailing_newline("echo hi", "hi\n")]
+    #[case::multiline("printf 'a\\nb'", "a\nb")]
+    #[case::empty("true", "")]
+    fn captures_stdout_on_success(#[case] script: &str, #[case] expected: &str) {
+        let ok = sh(script).captured().unwrap().success().unwrap();
+        assert_eq!(ok.stdout_string().unwrap(), expected);
+    }
+
+    #[rstest]
+    #[case::exit_1("exit 1", 1)]
+    #[case::exit_3("exit 3", 3)]
+    #[case::false_builtin("false", 1)]
+    fn nonzero_exit_is_error_carrying_the_code(#[case] script: &str, #[case] code: i32) {
+        let err = sh(script).captured().unwrap().success().unwrap_err();
+        assert_eq!(err.code(), Some(code));
+    }
+
+    #[rstest]
+    fn error_display_names_program_status_and_stderr() {
+        let err = sh("echo boom 1>&2; exit 2")
+            .captured()
+            .unwrap()
+            .success()
+            .unwrap_err();
+        let msg = err.to_string();
+        assert!(msg.contains("sh"), "program missing: {msg}");
+        assert!(msg.contains("status 2"), "status missing: {msg}");
+        assert!(msg.contains("boom"), "stderr missing: {msg}");
+    }
+
+    #[rstest]
+    fn stderr_is_captured_on_success() {
+        let ok = sh("echo note 1>&2").captured().unwrap().success().unwrap();
+        assert_eq!(ok.stderr_string().unwrap().trim(), "note");
+    }
+
+    #[rstest]
+    fn spawn_failure_is_an_io_error() {
+        let result = std::process::Command::new("hm-common-no-such-binary-xyz").captured();
+        assert!(result.is_err());
+    }
+
+    #[rstest]
+    fn non_utf8_stdout_reads_as_bytes_and_lossy() {
+        let ok = sh(r"printf '\377'").captured().unwrap().success().unwrap();
+        assert_eq!(ok.stdout(), b"\xff");
+        assert!(ok.stdout_str().is_err());
+        assert!(ok.stdout_lossy().contains('\u{FFFD}'));
+    }
+
+    #[rstest]
+    #[should_panic(expected = "not valid UTF-8")]
+    fn string_unwrap_panics_on_invalid_utf8() {
+        let ok = sh(r"printf '\377'").captured().unwrap().success().unwrap();
+        let _ = ok.stdout_string_unwrap();
+    }
+
+    #[rstest]
+    #[tokio::test]
+    async fn async_captured_reads_stdout() {
+        let mut cmd = tokio::process::Command::new("sh");
+        cmd.arg("-c").arg("printf async-hi");
+        let ok = cmd.captured().await.unwrap().success().unwrap();
+        assert_eq!(ok.stdout_string().unwrap(), "async-hi");
+    }
+}
diff --git a/crates/hm-common/src/process/mod.rs b/crates/hm-common/src/process/mod.rs
new file mode 100644
index 00000000..0aa90a80
--- /dev/null
+++ b/crates/hm-common/src/process/mod.rs
@@ -0,0 +1,9 @@
+//! Subprocess utilities.
+
+pub mod capture;
+pub mod which;
+
+pub use capture::{
+    AsyncCommandExt, Captured, CapturedError, CapturedOk, CapturedStreams, CommandExt,
+};
+pub use which::{ExecutableNotFound, pathbin};
diff --git a/crates/hm-common/src/process/which.rs b/crates/hm-common/src/process/which.rs
new file mode 100644
index 00000000..3f44d250
--- /dev/null
+++ b/crates/hm-common/src/process/which.rs
@@ -0,0 +1,51 @@
+//! Locating executables on `PATH`.
+
+use std::ffi::OsStr;
+use std::path::PathBuf;
+
+/// The requested program was not found on `PATH`.
+#[derive(Debug, thiserror::Error)]
+#[error("`{program}` was not found on PATH")]
+pub struct ExecutableNotFound {
+    program: String,
+}
+
+/// Resolve `program` to its absolute path on `PATH`.
+///
+/// For a presence check, call `pathbin(program).is_ok()`.
+#[tracing::instrument(skip_all, fields(program = %program.as_ref().to_string_lossy()))]
+pub fn pathbin(program: impl AsRef<OsStr>) -> Result<PathBuf, ExecutableNotFound> {
+    let program = program.as_ref();
+    which::which(program).map_err(|_| ExecutableNotFound {
+        program: program.to_string_lossy().into_owned(),
+    })
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used, reason = "test setup and assertions")]
+mod tests {
+    use super::*;
+    use rstest::rstest;
+
+    #[rstest]
+    #[case::present("sh", true)]
+    #[case::absent("hm-common-no-such-binary-xyz", false)]
+    fn pathbin_reports_resolvability(#[case] program: &str, #[case] resolvable: bool) {
+        assert_eq!(pathbin(program).is_ok(), resolvable);
+    }
+
+    #[rstest]
+    fn pathbin_resolves_to_an_absolute_path() {
+        let path = pathbin("sh").unwrap();
+        assert!(path.is_absolute(), "expected absolute path, got {path:?}");
+        assert_eq!(path.file_name(), Some(OsStr::new("sh")));
+    }
+
+    #[rstest]
+    fn error_names_the_missing_program() {
+        let err = pathbin("hm-common-no-such-binary-xyz").unwrap_err();
+        let msg = err.to_string();
+        assert!(msg.contains("hm-common-no-such-binary-xyz"), "program: {msg}");
+        assert!(msg.contains("not found on PATH"), "phrasing: {msg}");
+    }
+}
diff --git a/crates/hm-common/src/python.rs b/crates/hm-common/src/python.rs
new file mode 100644
index 00000000..f0b6b9a8
--- /dev/null
+++ b/crates/hm-common/src/python.rs
@@ -0,0 +1,315 @@
+//! Running python3.
+
+use std::ffi::OsStr;
+use std::ops::{Deref, DerefMut};
+use std::path::{Path, PathBuf};
+
+use serde::de::DeserializeOwned;
+
+use crate::process::{AsyncCommandExt as _, CapturedError, CapturedOk, CapturedStreams as _};
+
+/// A resolved `python3` interpreter.
+#[derive(Debug, Clone, Copy)]
+pub struct Python<'bin> {
+    bin: &'bin Path,
+}
+
+impl<'bin> Python<'bin> {
+    /// Wrap a `python3` executable, typically via `AppRuntime::python()`.
+    #[must_use]
+    pub const fn new(bin: &'bin Path) -> Self {
+        Self { bin }
+    }
+
+    /// An inline program: `python3 -c <script>`. Trailing [`arg`](PyCommand)s
+    /// become `sys.argv[1:]`.
+    pub fn program(&self, script: impl AsRef<OsStr>) -> PyCommand {
+        let mut cmd = tokio::process::Command::new(self.bin);
+        cmd.arg("-c").arg(script);
+        PyCommand::wrap(cmd)
+    }
+
+    /// A module run: `python3 -m <module>`.
+    pub fn module(&self, module: impl AsRef<OsStr>) -> PyCommand {
+        let mut cmd = tokio::process::Command::new(self.bin);
+        cmd.arg("-m").arg(module);
+        PyCommand::wrap(cmd)
+    }
+
+    /// A script file: `python3 <path>`.
+    pub fn script(&self, path: impl AsRef<Path>) -> PyCommand {
+        let mut cmd = tokio::process::Command::new(self.bin);
+        cmd.arg(path.as_ref());
+        PyCommand::wrap(cmd)
+    }
+}
+
+/// A `python3` invocation. Derefs to [`tokio::process::Command`].
+#[derive(Debug)]
+#[must_use = "a PyCommand does nothing until run"]
+pub struct PyCommand {
+    cmd: tokio::process::Command,
+}
+
+impl PyCommand {
+    fn wrap(mut cmd: tokio::process::Command) -> Self {
+        cmd.env("PYTHONDONTWRITEBYTECODE", "1");
+        Self { cmd }
+    }
+
+    /// Append a `PYTHONPATH` entry.
+    pub fn pythonpath(&mut self, path: impl AsRef<Path>) -> &mut Self {
+        let mut entries: Vec<PathBuf> = self
+            .cmd
+            .as_std()
+            .get_envs()
+            .find(|(key, _)| *key == OsStr::new("PYTHONPATH"))
+            .and_then(|(_, value)| value)
+            .map(|value| std::env::split_paths(value).collect())
+            .unwrap_or_default();
+        entries.push(path.as_ref().to_path_buf());
+        if let Ok(joined) = std::env::join_paths(entries) {
+            self.cmd.env("PYTHONPATH", joined);
+        }
+        self
+    }
+
+    /// Run to completion.
+    ///
+    /// # Errors
+    /// [`PyError::Spawn`] if `python3` cannot be spawned; [`PyError::Failed`]
+    /// if it exits non-zero.
+    pub async fn run(&mut self) -> Result<PyOutput, PyError> {
+        let ok = self
+            .cmd
+            .captured()
+            .await
+            .map_err(PyError::Spawn)?
+            .success()
+            .map_err(PyError::Failed)?;
+        Ok(PyOutput(ok))
+    }
+}
+
+impl Deref for PyCommand {
+    type Target = tokio::process::Command;
+    fn deref(&self) -> &Self::Target {
+        &self.cmd
+    }
+}
+
+impl DerefMut for PyCommand {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.cmd
+    }
+}
+
+/// A successful `python3` run: [`CapturedOk`] plus JSON decoding of stdout.
+#[derive(Debug)]
+pub struct PyOutput(CapturedOk);
+
+impl PyOutput {
+    /// Deserialize stdout as JSON.
+    ///
+    /// # Errors
+    /// If stdout is not valid JSON for `T`.
+    pub fn json<T: DeserializeOwned>(&self) -> Result<T, serde_json::Error> {
+        serde_json::from_slice(self.0.stdout())
+    }
+
+    /// The underlying captured output.
+    #[must_use]
+    pub fn into_inner(self) -> CapturedOk {
+        self.0
+    }
+}
+
+impl Deref for PyOutput {
+    type Target = CapturedOk;
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+/// A `python3` invocation that produced no output.
+#[derive(Debug, thiserror::Error)]
+pub enum PyError {
+    /// `python3` could not be spawned.
+    #[error("spawning `python3`")]
+    Spawn(#[source] std::io::Error),
+    /// `python3` exited non-zero.
+    #[error(transparent)]
+    Failed(#[from] CapturedError),
+}
+
+#[cfg(test)]
+#[allow(
+    clippy::unwrap_used,
+    clippy::print_stderr,
+    clippy::panic,
+    reason = "test setup, assertions, and skip diagnostics"
+)]
+mod tests {
+    use super::*;
+    use rstest::rstest;
+
+    /// The system `python3`, or `None` to skip on hosts without it.
+    fn python3() -> Option<PathBuf> {
+        crate::process::pathbin("python3").ok()
+    }
+
+    #[rstest]
+    #[case::print("print('hello')", "hello\n")]
+    #[case::no_newline("import sys; sys.stdout.write('hi')", "hi")]
+    #[case::empty("pass", "")]
+    #[tokio::test]
+    async fn program_captures_stdout(#[case] script: &str, #[case] expected: &str) {
+        let Some(bin) = python3() else {
+            eprintln!("skipping: python3 not on PATH");
+            return;
+        };
+        let out = Python::new(&bin).program(script).run().await.unwrap();
+        assert_eq!(out.stdout_string().unwrap(), expected);
+    }
+
+    #[rstest]
+    #[tokio::test]
+    async fn nonzero_exit_is_failed_carrying_stderr() {
+        let Some(bin) = python3() else {
+            eprintln!("skipping: python3 not on PATH");
+            return;
+        };
+        let err = Python::new(&bin)
+            .program("import sys; sys.stderr.write('boom'); sys.exit(3)")
+            .run()
+            .await
+            .unwrap_err();
+        match err {
+            PyError::Failed(e) => {
+                assert_eq!(e.code(), Some(3));
+                assert!(e.stderr_string().unwrap().contains("boom"));
+            }
+            PyError::Spawn(e) => panic!("expected Failed, got Spawn({e:?})"),
+        }
+    }
+
+    #[rstest]
+    #[tokio::test]
+    async fn missing_interpreter_is_a_spawn_error() {
+        let bin = PathBuf::from("hm-common-no-such-python-xyz");
+        let err = Python::new(&bin)
+            .program("print(1)")
+            .run()
+            .await
+            .unwrap_err();
+        assert!(matches!(err, PyError::Spawn(_)));
+    }
+
+    #[rstest]
+    #[tokio::test]
+    async fn json_decodes_stdout() {
+        let Some(bin) = python3() else {
+            eprintln!("skipping: python3 not on PATH");
+            return;
+        };
+        let out = Python::new(&bin)
+            .program("import json; print(json.dumps({'a': 1, 'b': [2, 3]}))")
+            .run()
+            .await
+            .unwrap();
+        let value: serde_json::Value = out.json().unwrap();
+        assert_eq!(value["a"], 1);
+        assert_eq!(value["b"][1], 3);
+    }
+
+    #[rstest]
+    #[tokio::test]
+    async fn positional_args_become_sys_argv() {
+        let Some(bin) = python3() else {
+            eprintln!("skipping: python3 not on PATH");
+            return;
+        };
+        let mut py = Python::new(&bin).program("import sys; print(' '.join(sys.argv[1:]))");
+        py.args(["one", "two"]);
+        let out = py.run().await.unwrap();
+        assert_eq!(out.stdout_string().unwrap(), "one two\n");
+    }
+
+    #[rstest]
+    #[tokio::test]
+    async fn current_dir_sets_the_working_directory() {
+        let Some(bin) = python3() else {
+            eprintln!("skipping: python3 not on PATH");
+            return;
+        };
+        let dir = tempfile::tempdir().unwrap();
+        let mut py = Python::new(&bin).program("import os; print(os.getcwd())");
+        py.current_dir(dir.path());
+        let out = py.run().await.unwrap();
+        let got = std::fs::canonicalize(out.stdout_string().unwrap().trim()).unwrap();
+        let want = std::fs::canonicalize(dir.path()).unwrap();
+        assert_eq!(got, want);
+    }
+
+    #[rstest]
+    #[tokio::test]
+    async fn pythonpath_makes_a_module_importable() {
+        let Some(bin) = python3() else {
+            eprintln!("skipping: python3 not on PATH");
+            return;
+        };
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(dir.path().join("mymod.py"), "VALUE = 42\n").unwrap();
+        let mut py = Python::new(&bin).program("import mymod; print(mymod.VALUE)");
+        py.pythonpath(dir.path());
+        let out = py.run().await.unwrap();
+        assert_eq!(out.stdout_string().unwrap().trim(), "42");
+    }
+
+    #[rstest]
+    #[tokio::test]
+    async fn pythonpath_appends_across_calls() {
+        let Some(bin) = python3() else {
+            eprintln!("skipping: python3 not on PATH");
+            return;
+        };
+        let a = tempfile::tempdir().unwrap();
+        let b = tempfile::tempdir().unwrap();
+        std::fs::write(a.path().join("mod_a.py"), "A = 1\n").unwrap();
+        std::fs::write(b.path().join("mod_b.py"), "B = 2\n").unwrap();
+        let mut py = Python::new(&bin).program("import mod_a, mod_b; print(mod_a.A + mod_b.B)");
+        py.pythonpath(a.path());
+        py.pythonpath(b.path());
+        let out = py.run().await.unwrap();
+        assert_eq!(out.stdout_string().unwrap().trim(), "3");
+    }
+
+    #[rstest]
+    #[tokio::test]
+    async fn module_form_runs_a_module() {
+        let Some(bin) = python3() else {
+            eprintln!("skipping: python3 not on PATH");
+            return;
+        };
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(dir.path().join("mymod.py"), "print('from module')\n").unwrap();
+        let mut py = Python::new(&bin).module("mymod");
+        py.pythonpath(dir.path());
+        let out = py.run().await.unwrap();
+        assert_eq!(out.stdout_string().unwrap(), "from module\n");
+    }
+
+    #[rstest]
+    #[tokio::test]
+    async fn script_form_runs_a_file() {
+        let Some(bin) = python3() else {
+            eprintln!("skipping: python3 not on PATH");
+            return;
+        };
+        let dir = tempfile::tempdir().unwrap();
+        let script = dir.path().join("s.py");
+        std::fs::write(&script, "print('from file')\n").unwrap();
+        let out = Python::new(&bin).script(&script).run().await.unwrap();
+        assert_eq!(out.stdout_string().unwrap(), "from file\n");
+    }
+}
diff --git a/crates/hm-dsl-engine/Cargo.toml b/crates/hm-dsl-engine/Cargo.toml
index 91a0dd62..db718a23 100644
--- a/crates/hm-dsl-engine/Cargo.toml
+++ b/crates/hm-dsl-engine/Cargo.toml
@@ -12,6 +12,7 @@ categories = ["command-line-utilities"]
 path = "src/lib.rs"
 
 [dependencies]
+hm-common   = { workspace = true, features = ["app-runtime"] }
 anyhow      = { workspace = true }
 async-trait = { workspace = true }
 derive_more = { workspace = true }
@@ -21,13 +22,11 @@ include_dir = "0.7"
 tempfile    = "3"
 tokio       = { version = "1", features = ["process", "fs"] }
 tracing     = "0.1"
-which       = "7"
 
 [dev-dependencies]
 rstest      = { workspace = true }
 tempfile    = "3"
 tokio       = { version = "1", features = ["macros", "rt-multi-thread"] }
-which       = "7"
 
 [lints]
 workspace = true
diff --git a/crates/hm-dsl-engine/src/lib.rs b/crates/hm-dsl-engine/src/lib.rs
index 6430b520..4a1eb54b 100644
--- a/crates/hm-dsl-engine/src/lib.rs
+++ b/crates/hm-dsl-engine/src/lib.rs
@@ -6,7 +6,7 @@ use serde::Deserialize;
 pub mod detect;
 mod python_engine;
 
-pub use python_engine::{SubprocessPythonEngine, engine as python_engine};
+pub use python_engine::SubprocessPythonEngine;
 
 mod bundled_sources;
 
diff --git a/crates/hm-dsl-engine/src/python_engine.rs b/crates/hm-dsl-engine/src/python_engine.rs
index 6c386320..9980898a 100644
--- a/crates/hm-dsl-engine/src/python_engine.rs
+++ b/crates/hm-dsl-engine/src/python_engine.rs
@@ -1,8 +1,9 @@
 use std::path::Path;
-use std::process::Stdio;
 
-use anyhow::{Context, Result, bail};
+use anyhow::{Context, Result};
 use async_trait::async_trait;
+use hm_common::app_runtime::AppRuntime;
+use hm_common::process::CapturedStreams as _;
 use tracing::debug;
 
 use crate::bundled_sources;
@@ -58,21 +59,15 @@ if match is None:
 print(json.dumps(match['definition']))
 ";
 
-#[derive(Debug)]
-pub struct SubprocessPythonEngine {
-    python_bin: std::path::PathBuf,
-}
+#[derive(Debug, Default)]
+pub struct SubprocessPythonEngine;
 
 impl SubprocessPythonEngine {
-    /// Create engine, verifying `python3` is available on PATH.
-    ///
-    /// # Errors
-    ///
-    /// Returns an error if `python3` is not found on `PATH`.
-    pub fn new() -> Result<Self> {
-        let python_bin =
-            which::which("python3").context("python3 not found on PATH — install Python 3.11+")?;
-        Ok(Self { python_bin })
+    /// Create the engine. It runs `python3` through [`AppRuntime::python`], so
+    /// [`AppRuntime::init`] must have been called first.
+    #[must_use]
+    pub const fn new() -> Self {
+        Self
     }
 
     async fn run_script(
@@ -85,28 +80,13 @@ impl SubprocessPythonEngine {
         let harmont_pkg = tmp.path().join("harmont");
         bundled_sources::extract_to(&bundled_sources::HARMONT_PY, &harmont_pkg)?;
 
-        let mut cmd = tokio::process::Command::new(&self.python_bin);
-        cmd.arg("-c")
-            .arg(script)
-            .args(extra_args)
-            .current_dir(project_dir)
-            .env("PYTHONPATH", tmp.path())
-            .env("PYTHONDONTWRITEBYTECODE", "1")
-            .stdin(Stdio::null())
-            .stdout(Stdio::piped())
-            .stderr(Stdio::piped());
-
-        debug!(?cmd, "running python3 subprocess");
-
-        let output = cmd.output().await.context("spawning python3")?;
+        let mut py = AppRuntime::python().program(script);
+        py.args(extra_args).current_dir(project_dir);
+        py.pythonpath(tmp.path());
 
-        if !output.status.success() {
-            let stderr = String::from_utf8_lossy(&output.stderr);
-            let code = output.status.code().unwrap_or(-1);
-            bail!("python3 exited with code {code}:\n{stderr}");
-        }
+        debug!(?py, "running python3 subprocess");
 
-        String::from_utf8(output.stdout).context("python3 stdout is not valid UTF-8")
+        Ok(py.run().await?.stdout_string()?)
     }
 }
 
@@ -135,14 +115,3 @@ impl DslEngine for SubprocessPythonEngine {
             .context("dumping pipeline registry via python3")
     }
 }
-
-/// Instanciates a python engine.
-/// Shorthand for [`SubprocessPythonEngine`].
-///
-/// # Errors
-///
-/// Returns an error if `python3` is not found on `PATH`.
-#[inline]
-pub fn engine() -> Result<SubprocessPythonEngine> {
-    SubprocessPythonEngine::new()
-}
diff --git a/crates/hm-dsl-engine/tests/python_engine_test.rs b/crates/hm-dsl-engine/tests/python_engine_test.rs
index 81c29184..76b37cc5 100644
--- a/crates/hm-dsl-engine/tests/python_engine_test.rs
+++ b/crates/hm-dsl-engine/tests/python_engine_test.rs
@@ -9,9 +9,9 @@ use hm_dsl_engine::DslEngine;
 
 #[tokio::test]
 async fn python_roundtrip() {
-    // Skip if python3 not available or harmont deps missing
-    if which::which("python3").is_err() {
-        eprintln!("skipping: python3 not on PATH");
+    // Skip if the toolchain (python3 + git) is unavailable.
+    if hm_common::app_runtime::AppRuntime::init().is_err() {
+        eprintln!("skipping: build toolchain unavailable");
         return;
     }
 
@@ -31,7 +31,7 @@ def ci() -> hm.Step:
 
     hm_dsl_engine::detect::check_python(dir.path()).unwrap();
 
-    let engine = hm_dsl_engine::python_engine().unwrap();
+    let engine = hm_dsl_engine::SubprocessPythonEngine::new();
     let metas = engine.list_pipelines(dir.path()).await.unwrap();
     assert_eq!(metas.len(), 1);
     assert_eq!(metas[0].slug, "ci");
@@ -43,8 +43,8 @@ def ci() -> hm.Step:
 
 #[tokio::test]
 async fn python_registry_json_carries_triggers_and_allow_manual() {
-    if which::which("python3").is_err() {
-        eprintln!("skipping: python3 not on PATH");
+    if hm_common::app_runtime::AppRuntime::init().is_err() {
+        eprintln!("skipping: build toolchain unavailable");
         return;
     }
 
@@ -62,7 +62,7 @@ def ci() -> hm.Step:
     )
     .unwrap();
 
-    let engine = hm_dsl_engine::python_engine().unwrap();
+    let engine = hm_dsl_engine::SubprocessPythonEngine::new();
     let json = engine.registry_json(dir.path()).await.unwrap();
     let v: serde_json::Value = serde_json::from_str(&json).unwrap();
 
diff --git a/crates/hm/Cargo.toml b/crates/hm/Cargo.toml
index a51d4f9b..0e718dad 100644
--- a/crates/hm/Cargo.toml
+++ b/crates/hm/Cargo.toml
@@ -53,13 +53,13 @@ webbrowser = "1"
 rand = "0.8"
 uuid = { version = "1", features = ["serde"] }
 bytes = "1"
+bstr = "1"
 human-units = { workspace = true }
 futures = "0.3"
 futures-util = "0.3"
-which = "6"
 hm-pipeline-ir     = { workspace = true }
 hm-plugin-protocol = { workspace = true }
-hm-common = { workspace = true }
+hm-common = { workspace = true, features = ["app-runtime"] }
 hm-util = { workspace = true }
 hm-config = { workspace = true }
 hm-plugin-cloud = { workspace = true }
@@ -87,7 +87,6 @@ assert_cmd = "2"
 predicates = "3"
 assert_fs = "1"
 tempfile = "3"
-which = "6"
 rstest = { workspace = true }
 
 [lints]
diff --git a/crates/hm/src/cli/pipelines.rs b/crates/hm/src/cli/pipelines.rs
index 5ee250ee..3f94d018 100644
--- a/crates/hm/src/cli/pipelines.rs
+++ b/crates/hm/src/cli/pipelines.rs
@@ -2,7 +2,7 @@ use std::path::PathBuf;
 
 use anyhow::{Context, Result};
 use clap::Parser;
-use hm_dsl_engine::{DslEngine, detect, python_engine};
+use hm_dsl_engine::{DslEngine, SubprocessPythonEngine, detect};
 
 #[derive(Debug, Clone, Parser)]
 pub struct PipelinesArgs {
@@ -39,7 +39,7 @@ pub async fn run(args: PipelinesArgs) -> Result<()> {
     }
 
     detect::check_python(&repo_root).context("detecting pipeline language")?;
-    let engine = python_engine().context("initializing DSL engine")?;
+    let engine = SubprocessPythonEngine::new();
     let json = engine
         .registry_json(&repo_root)
         .await
diff --git a/crates/hm/src/cli/render.rs b/crates/hm/src/cli/render.rs
index cc10ca99..ca907647 100644
--- a/crates/hm/src/cli/render.rs
+++ b/crates/hm/src/cli/render.rs
@@ -2,7 +2,7 @@ use std::path::PathBuf;
 
 use anyhow::{Context, Result};
 use clap::Parser;
-use hm_dsl_engine::{DslEngine, detect, python_engine};
+use hm_dsl_engine::{DslEngine, SubprocessPythonEngine, detect};
 
 #[derive(Debug, Clone, Parser)]
 pub struct RenderArgs {
@@ -32,7 +32,7 @@ pub async fn run(args: RenderArgs) -> Result<()> {
     };
 
     detect::check_python(&repo_root).context("detecting pipeline language")?;
-    let engine = python_engine().context("initializing DSL engine")?;
+    let engine = SubprocessPythonEngine::new();
     let json = engine
         .render_pipeline_json(&repo_root, &args.slug)
         .await
diff --git a/crates/hm/src/commands/run/mod.rs b/crates/hm/src/commands/run/mod.rs
index ba541cc1..ce2ef283 100644
--- a/crates/hm/src/commands/run/mod.rs
+++ b/crates/hm/src/commands/run/mod.rs
@@ -2,6 +2,9 @@ use std::collections::HashMap;
 
 use anyhow::{Context, Result};
 
+use bstr::ByteSlice as _;
+use hm_common::app_runtime::AppRuntime;
+use hm_common::git::{GitBranch, GitRemote, GitRepo};
 use hm_dsl_engine::{DslEngine, detect};
 use human_units::FormatSize as _;
 
@@ -127,9 +130,46 @@ pub async fn handle(args: RunArgs, ctx: RunContext) -> Result<i32> {
         );
     }
 
-    // 7. Assemble the run request.
-    let (branch, commit) = git_metadata(&repo_root, args.branch.clone());
-    let repo_name = git_remote_repo_name(&repo_root);
+    // 7. Assemble the run request. Open the worktree's repo and its `origin`
+    // remote once, and read every git-derived field from that single pair of
+    // handles — all best-effort. An explicit `--branch` wins; a missing branch
+    // or commit falls back to `HEAD` / the zero SHA. The block yields owned
+    // strings so `repo_root` can move into the request, and the cloud paths
+    // below reuse `remote_url` / `default_branch` instead of re-shelling to git.
+    let (branch, commit, repo_name, remote_url, default_branch) = {
+        let git = AppRuntime::git();
+        let repo = git.repo(&repo_root).ok();
+        let head = repo.as_ref().and_then(GitRepo::current_branch);
+        let remote = repo.as_ref().and_then(|r| r.remote("origin"));
+
+        let branch = args
+            .branch
+            .clone()
+            .or_else(|| head.as_ref().map(|b| b.name().to_str_lossy().into_owned()))
+            .filter(|s| !s.is_empty())
+            .unwrap_or_else(|| "HEAD".to_string());
+        let commit = head
+            .as_ref()
+            .and_then(GitBranch::head_commit)
+            .map(|c| c.to_str_lossy().into_owned())
+            .filter(|s| !s.is_empty())
+            .unwrap_or_else(|| "0".repeat(40));
+        let repo_name = remote
+            .as_ref()
+            .and_then(GitRemote::gh_repo_name)
+            .map(|n| n.to_str_lossy().into_owned());
+        let remote_url = remote
+            .as_ref()
+            .map(|r| r.url().to_str_lossy().into_owned())
+            .filter(|u| !u.is_empty());
+        // `origin/HEAD`; `None` when unset (fresh clones without `set-head`).
+        let default_branch = remote
+            .as_ref()
+            .and_then(GitRemote::default_branch)
+            .map(|b| b.name().to_str_lossy().into_owned());
+
+        (branch, commit, repo_name, remote_url, default_branch)
+    };
     let mut req = hm_exec::RunRequest {
         plan,
         repo_root,
@@ -158,8 +198,9 @@ pub async fn handle(args: RunArgs, ctx: RunContext) -> Result<i32> {
         if let Some(slug) = ctx.config.cloud.pipeline.clone() {
             req.cloud_pipeline_slug = Some(slug);
         } else if req.source.repo_name.is_none() {
-            let default_branch =
-                git_default_branch(&req.repo_root).unwrap_or_else(|| req.source.branch.clone());
+            let default_branch = default_branch
+                .clone()
+                .unwrap_or_else(|| req.source.branch.clone());
             let slug = register_remoteless_pipeline(
                 client,
                 org,
@@ -172,17 +213,16 @@ pub async fn handle(args: RunArgs, ctx: RunContext) -> Result<i32> {
         }
     }
 
-    // Cloud-only auto-create context. Borrow `req` here (before it's moved into
-    // `start`): the repository URL and default branch come from the worktree's
-    // git remote; the pipeline name is the in-repo source slug.
+    // Cloud-only auto-create context, from the git fields read in step 7: the
+    // `origin` remote URL is the pipeline's `repository`, `default_branch` falls
+    // back to the run's branch, and the pipeline name is the in-repo source slug.
     let autocreate = autocreate_client.map(|(client, org)| AutoCreate {
         client,
         org,
         repo_name: req.source.repo_name.clone(),
-        repository: git_remote_url(&req.repo_root),
+        repository: remote_url,
         name: req.pipeline_slug.clone(),
-        default_branch: git_default_branch(&req.repo_root)
-            .unwrap_or_else(|| req.source.branch.clone()),
+        default_branch: default_branch.unwrap_or_else(|| req.source.branch.clone()),
     });
 
     // 8. Start, drive events, own Ctrl-C, await the outcome.
@@ -238,93 +278,6 @@ fn parse_env(pairs: &[String]) -> HashMap<String, String> {
         .collect()
 }
 
-/// Resolve `(branch, commit)` from git at `root`, best-effort. An explicit
-/// `branch_override` wins; missing values fall back to `HEAD` / the zero SHA.
-fn git_metadata(root: &std::path::Path, branch_override: Option<String>) -> (String, String) {
-    let run = |a: &[&str]| {
-        std::process::Command::new("git")
-            .arg("-C")
-            .arg(root)
-            .args(a)
-            .output()
-            .ok()
-            .filter(|o| o.status.success())
-            .map(|o| String::from_utf8_lossy(&o.stdout).trim().to_string())
-    };
-    let branch = branch_override
-        .or_else(|| run(&["rev-parse", "--abbrev-ref", "HEAD"]))
-        .filter(|s| !s.is_empty())
-        .unwrap_or_else(|| "HEAD".to_string());
-    let commit = run(&["rev-parse", "HEAD"])
-        .filter(|s| !s.is_empty())
-        .unwrap_or_else(|| "0".repeat(40));
-    (branch, commit)
-}
-
-/// Parse `owner/repo` from a git remote URL, mirroring the backend's
-/// `Harmont.Pipelines.RepoName`: drop scheme/host and a trailing `.git`, then
-/// take the last two non-empty path segments. `None` when fewer than two
-/// segments remain.
-fn parse_repo_name(url: &str) -> Option<String> {
-    let url = url.trim();
-    let path = if let Some((_, rest)) = url.split_once("://") {
-        // scheme://host/owner/repo  → strip host
-        rest.split_once('/').map_or(rest, |(_, p)| p)
-    } else if url.contains('@') && url.contains(':') {
-        // scp-style git@host:owner/repo → strip "git@host:"
-        let after_at = url.split_once('@').map_or(url, |(_, r)| r);
-        after_at.split_once(':').map_or(after_at, |(_, p)| p)
-    } else {
-        url.split_once('/').map_or(url, |(_, p)| p)
-    };
-    let path = path.trim_end_matches('/');
-    let path = path.strip_suffix(".git").unwrap_or(path);
-    let segs: Vec<&str> = path.split('/').filter(|s| !s.is_empty()).collect();
-    if segs.len() < 2 {
-        return None;
-    }
-    Some(segs[segs.len() - 2..].join("/"))
-}
-
-/// Extract the default branch name from a `git symbolic-ref
-/// refs/remotes/origin/HEAD` result (e.g. `refs/remotes/origin/main` → `main`).
-/// `None` when the line is empty or lacks the expected prefix.
-fn parse_default_branch(symbolic_ref: &str) -> Option<String> {
-    let branch = symbolic_ref.trim().strip_prefix("refs/remotes/origin/")?;
-    (!branch.is_empty()).then(|| branch.to_string())
-}
-
-/// The worktree's raw `origin` remote URL (the pipeline's `repository`).
-fn git_remote_url(root: &std::path::Path) -> Option<String> {
-    let out = std::process::Command::new("git")
-        .arg("-C")
-        .arg(root)
-        .args(["config", "--get", "remote.origin.url"])
-        .output()
-        .ok()
-        .filter(|o| o.status.success())?;
-    let url = String::from_utf8_lossy(&out.stdout).trim().to_string();
-    (!url.is_empty()).then_some(url)
-}
-
-/// The repo's default branch, from `origin/HEAD`. `None` when `origin/HEAD`
-/// isn't set (common on fresh clones without `git remote set-head`).
-fn git_default_branch(root: &std::path::Path) -> Option<String> {
-    let out = std::process::Command::new("git")
-        .arg("-C")
-        .arg(root)
-        .args(["symbolic-ref", "refs/remotes/origin/HEAD"])
-        .output()
-        .ok()
-        .filter(|o| o.status.success())?;
-    parse_default_branch(&String::from_utf8_lossy(&out.stdout))
-}
-
-/// Best-effort `owner/repo` from the worktree's `origin` remote.
-fn git_remote_repo_name(root: &std::path::Path) -> Option<String> {
-    parse_repo_name(&git_remote_url(root)?)
-}
-
 /// Resolve repo root, detect the DSL, select the pipeline slug, and render
 /// the v0 IR JSON. Shared by local and cloud runs.
 ///
@@ -343,12 +296,11 @@ async fn render_pipeline(
 ) -> Result<(std::path::PathBuf, String, String)> {
     let repo_root = match args.dir.clone() {
         Some(p) => p,
-        None => std::env::current_dir().context("cannot determine current directory")?,
+        None => AppRuntime::cwd().to_path_buf(),
     };
 
     detect::check_python(&repo_root).map_err(|e| HmError::DslEngine(format!("{e:#}")))?;
-    let engine =
-        hm_dsl_engine::python_engine().map_err(|e| HmError::DslEngine(format!("{e:#}")))?;
+    let engine = hm_dsl_engine::SubprocessPythonEngine::new();
 
     let slug = if let Some(s) = &args.pipeline {
         s.clone()
@@ -734,36 +686,6 @@ mod tests {
         assert_eq!(is_missing_pipeline(&err), expected);
     }
 
-    #[rstest]
-    #[case::https(
-        "https://github.com/harmont-dev/harmont-cli.git",
-        Some("harmont-dev/harmont-cli")
-    )]
-    #[case::scp(
-        "git@github.com:harmont-dev/harmont-cli.git",
-        Some("harmont-dev/harmont-cli")
-    )]
-    #[case::ssh(
-        "ssh://git@github.com/harmont-dev/harmont-cli",
-        Some("harmont-dev/harmont-cli")
-    )]
-    #[case::deep_path("https://example.com/a/b/c/repo", Some("c/repo"))]
-    #[case::empty("", None)]
-    #[case::not_a_url("not-a-url", None)]
-    fn parse_repo_name_cases(#[case] url: &str, #[case] expected: Option<&str>) {
-        assert_eq!(parse_repo_name(url).as_deref(), expected);
-    }
-
-    #[rstest]
-    #[case::main_trailing_newline("refs/remotes/origin/main\n", Some("main"))]
-    #[case::master("refs/remotes/origin/master", Some("master"))]
-    #[case::empty("", None)]
-    #[case::refs_heads("refs/heads/main", None)]
-    #[case::trailing_slash("refs/remotes/origin/", None)]
-    fn parse_default_branch_cases(#[case] input: &str, #[case] expected: Option<&str>) {
-        assert_eq!(parse_default_branch(input).as_deref(), expected);
-    }
-
     #[rstest]
     fn parse_env_splits_pairs() {
         let m = parse_env(&["A=1".into(), "B=x=y".into(), "bad".into()]);
@@ -772,13 +694,6 @@ mod tests {
         assert!(!m.contains_key("bad"));
     }
 
-    #[rstest]
-    fn git_metadata_falls_back_outside_repo() {
-        let (b, c) = git_metadata(std::path::Path::new("/"), None);
-        assert!(!b.is_empty() && !c.is_empty());
-        assert_eq!(c.len(), 40); // zero-sha fallback
-    }
-
     #[rstest]
     #[case::unauthorized(E::Unauthorized, "error[auth_required]")]
     #[case::not_found(E::NotFound("x".into()), "error[not_found]")]
diff --git a/crates/hm/src/main.rs b/crates/hm/src/main.rs
index 84e9c93c..dae1a46e 100644
--- a/crates/hm/src/main.rs
+++ b/crates/hm/src/main.rs
@@ -3,7 +3,9 @@
     reason = "transitive dependency version conflicts in rand/windows-sys/thiserror chains; not fixable without upstream updates"
 )]
 
+use anyhow::Context as _;
 use clap::Parser;
+use hm_common::app_runtime::AppRuntime;
 use tracing_subscriber::EnvFilter;
 use tracing_subscriber::Layer;
 use tracing_subscriber::filter::Targets;
@@ -89,6 +91,10 @@ async fn main() {
 }
 
 async fn run(args: Cli) -> Result<i32, anyhow::Error> {
+    // Every command runs against the build toolchain (git + python3); resolve it
+    // once up front and fail fast with a clear error if anything is missing.
+    AppRuntime::init().context("resolving the build toolchain")?;
+
     let command = args.command.clone();
     let ctx = RunContext::from_cli(&args)?;
     cli::dispatch(command, ctx).await
diff --git a/crates/hm/tests/cmd_init.rs b/crates/hm/tests/cmd_init.rs
index b053419b..daa89369 100644
--- a/crates/hm/tests/cmd_init.rs
+++ b/crates/hm/tests/cmd_init.rs
@@ -193,7 +193,7 @@ fn init_all_templates_create_files(#[case] slug: &str) {
 // ── roundtrip: init → render ──────────────────────────────────
 
 fn has_python() -> bool {
-    which::which("python3").is_ok()
+    hm_common::process::pathbin("python3").is_ok()
 }
 
 #[rstest]
diff --git a/crates/hm/tests/cmd_pipelines.rs b/crates/hm/tests/cmd_pipelines.rs
index d15713d5..cce399e0 100644
--- a/crates/hm/tests/cmd_pipelines.rs
+++ b/crates/hm/tests/cmd_pipelines.rs
@@ -13,7 +13,7 @@ use rstest::rstest;
 
 #[rstest]
 fn pipelines_emits_discovery_envelope() {
-    if which::which("python3").is_err() {
+    if hm_common::process::pathbin("python3").is_err() {
         eprintln!("skipping: python3 not on PATH");
         return;
     }
diff --git a/crates/hm/tests/cmd_render.rs b/crates/hm/tests/cmd_render.rs
index dfe358b8..8c6c3bbf 100644
--- a/crates/hm/tests/cmd_render.rs
+++ b/crates/hm/tests/cmd_render.rs
@@ -28,7 +28,7 @@ def ci() -> hm.Step:
 
 #[rstest]
 fn render_emits_v0_ir_for_slug() {
-    if which::which("python3").is_err() {
+    if hm_common::process::pathbin("python3").is_err() {
         eprintln!("skipping: python3 not on PATH");
         return;
     }
@@ -58,7 +58,7 @@ fn render_emits_v0_ir_for_slug() {
 
 #[rstest]
 fn render_unknown_slug_fails_with_available_on_stderr() {
-    if which::which("python3").is_err() {
+    if hm_common::process::pathbin("python3").is_err() {
         eprintln!("skipping: python3 not on PATH");
         return;
     }