Very neat.
In the Runta example, wouldn't read/write/edit also need to target the runtime filesystem? Otherwise the model could edit one tree and run against another.
Also, bash is currently described to the model as running in the current working directory, which would no longer necessarily be true. Is the intent for a tool slot to own its schema/description as well as its implementation?