@clear-capabilities/agentic-security-scanner 0.163.1 → 0.165.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-ce6a06e07ced6e9bc14c71c7025f5bd9d50e91b9fffafcde1cf2ea54125a5654  agentic-security.mjs
+5a4520f3bff6f1e77c0bb2bfaa0346b11c1447eb3a8433bc1661d2f58c03537a  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.163.1",
+  "version": "0.165.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -68,7 +68,7 @@
     "test:extras": "AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js && node --experimental-test-module-mocks --test test/fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection-k8s-admission.test.js && node --experimental-test-module-mocks --test test/lineage-fault-injection.test.js && npm run test:python",
     "loop": "node ../scripts/loop-engineering/run.mjs",
     "test:loop-real-prd": "node --test ../scripts/loop-engineering/test/loop-real-prd.test.js",
-    "test:loop": "node --test --test-concurrency=1 ../scripts/loop-engineering/test/loop-manifest.test.js ../scripts/loop-engineering/test/loop-watchdog.test.js ../scripts/loop-engineering/test/loop-background.test.js ../scripts/loop-engineering/test/loop-dashboard.test.js ../scripts/loop-engineering/test/loop-evidence.test.js ../scripts/loop-engineering/test/loop-recovery.test.js ../scripts/loop-engineering/test/loop-remote.test.js ../scripts/loop-engineering/test/loop-runbook.test.js ../scripts/loop-engineering/test/loop-assurance-profile.test.js ../scripts/loop-engineering/test/loop-assurance-runtime.test.js",
+    "test:loop": "node --test --test-concurrency=1 ../scripts/loop-engineering/test/loop-manifest.test.js ../scripts/loop-engineering/test/loop-watchdog.test.js ../scripts/loop-engineering/test/loop-background.test.js ../scripts/loop-engineering/test/loop-dashboard.test.js ../scripts/loop-engineering/test/loop-evidence.test.js ../scripts/loop-engineering/test/loop-recovery.test.js ../scripts/loop-engineering/test/loop-remote.test.js ../scripts/loop-engineering/test/loop-runbook.test.js ../scripts/loop-engineering/test/loop-assurance-profile.test.js ../scripts/loop-engineering/test/loop-assurance-runtime.test.js ../scripts/loop-engineering/test/loop-bounds.test.js ../scripts/loop-engineering/test/loop-spend.test.js",
     "test:python": "node ../scripts/run-python-tests.mjs",
     "test:smoke": "node --test test/smoke.test.js test/demo-app.test.js",
     "test:ollama-e2e": "AGENTIC_SECURITY_OLLAMA_E2E=1 node --test test/ollama-e2e.test.js",
@@ -106,11 +106,11 @@
     "evaluation": "node ../scripts/evaluation.mjs",
     "evaluation:synthetic": "node ../scripts/evaluation.mjs synthetic",
     "test:routing": "node --test test/routing/outcomes.test.js test/routing/economics.test.js test/routing/adapter.test.js test/routing/calibration.test.js test/routing/decide.test.js test/routing/unchanged-when-off.test.js test/routing/shadow.test.js test/routing/promotion.test.js test/routing/drift.test.js test/routing/canary.test.js test/routing/feedback.test.js test/routing/report.test.js",
-    "test:release-closure": "node --test test/release-closure/closure-plan.test.js test/release-closure/closure-record.test.js test/release-closure/compatibility.test.js test/release-closure/rollout-stages.test.js test/release-closure/migration-readers.test.js test/release-closure/rollback.test.js test/release-closure/wrappers.test.js test/release-closure/final-closure.test.js test/release-closure/final-closure-controller.test.js test/release-closure/runner-hardening.test.js",
+    "test:release-closure": "node --test test/release-closure/closure-plan.test.js test/release-closure/closure-record.test.js test/release-closure/compatibility.test.js test/release-closure/rollout-stages.test.js test/release-closure/migration-readers.test.js test/release-closure/rollback.test.js test/release-closure/wrappers.test.js test/release-closure/final-closure.test.js test/release-closure/final-closure-controller.test.js test/release-closure/runner-hardening.test.js test/release-closure/remote-attestation.test.js",
     "release:closure:check": "node ../scripts/release-closure.mjs --run",
     "release:closure:static": "node ../scripts/release-closure.mjs --static",
     "test:documentation": "node --test test/documentation/drift-check.test.js test/documentation/generated-pages.test.js test/documentation/scope-and-examples.test.js test/documentation/policy-cards.test.js test/documentation/operations-and-review.test.js",
-    "test:capabilities": "node --test test/capabilities/manifest.test.js test/capabilities/filesystem.test.js test/capabilities/exec.test.js test/capabilities/network.test.js test/capabilities/canary.test.js test/capabilities/tools.test.js test/capabilities/recovery.test.js test/capabilities/receipts.test.js test/capabilities/adversarial.test.js",
+    "test:capabilities": "node --test test/capabilities/manifest.test.js test/capabilities/filesystem.test.js test/capabilities/exec.test.js test/capabilities/network.test.js test/capabilities/canary.test.js test/capabilities/tools.test.js test/capabilities/recovery.test.js test/capabilities/receipts.test.js test/capabilities/adversarial.test.js test/capabilities/linux-enforcement.test.js",
     "test:verification": "node --test test/verification/verification-record.test.js test/verification/oracle-adapters.test.js test/verification/replay-manifest.test.js test/verification/patch-negative.test.js test/verification/non-taint-classes.test.js test/verification/interface-equivalence.test.js test/verification/advisory-gating.test.js test/verification/oracle-conformance.test.js",
     "test:deployment": "node --test test/deployment/boundary-graph.test.js test/deployment/config-adapters.test.js test/deployment/trace-correlation.test.js test/deployment/cross-repo.test.js test/deployment/attack-paths.test.js test/deployment/drift.test.js test/deployment/boundary-presentation.test.js test/deployment/differentiation-ablation.test.js test/deployment/boundaries-cli.test.js",
     "test:portfolio": "node --test test/portfolio/manifest.test.js test/portfolio/bundle.test.js test/portfolio/signing.test.js test/portfolio/work-units.test.js test/portfolio/resume.test.js test/portfolio/scheduler.test.js test/portfolio/progress.test.js test/portfolio/retention.test.js test/portfolio/backend.test.js",

package/src/capabilities/CLAUDE.md

@@ -67,15 +67,25 @@ report says so. Without the opt-in an isolation-required task is `unsupported`
 (`platform-unsupported`). A control that is not proved BLOCKS the run (typed
 `blocked`, `missing-execution-backend`, the target never executes).
 
-**Linux is `unverified`.** The namespace backend does not implement read
-confinement to declared roots, several write roots, mediated network or
-supervised tree termination, so every Linux run is currently blocked with the
-missing control named. Nothing here asserts a Linux outcome that has not been
-executed; the `sandbox-linux` job is where it will be exercised. Process-count
-caps are never asserted on any backend (per-user and system-wide on macOS; they
-did not refuse on the hosted Linux runner in a previous release and the cause was
-never established); `maxProcesses` is carried and reported `unverified`, memory
-caps are carried and reported `not-enforced`.
+**Linux is `partially-verified`**, and only by the hosted `sandbox-linux` job. Its
+active probes proved write confinement, read denial, environment scrubbing, the
+no-network default, tree termination, the file-size limit, read confinement to
+declared roots and multi-root writes on the namespace backend (a pivoted tmpfs
+root; protected paths absent or masked; a PID namespace the kernel tears down).
+NOT verified: **mediated network** is not implemented on Linux (an empty network
+namespace has no path to a proxy), so a task that declares a destination is
+`blocked` there with `network-mediation is unsupported`, never allowed. The
+**process-count cap** IS proved on Linux (the `sandbox-linux` job's `process-cap`
+probe): the resource prelude runs under dash, whose `ulimit` has no `-u`, so the
+namespace backend applies the cap with `prlimit --nproc` to the task's command
+after the confinement is built, and `maxProcesses` in a manifest is passed through
+and reported `enforced` when the run is at the `enforced` level (on macOS it stays
+`unverified`: the cap is per-user and system-wide there). Memory caps are
+`not-enforced`. The capability, trust-boundary and corpus suites RUN on the Linux
+backend and assert Linux semantics (an undeclared path has no name, so a refusal
+is ENOENT or EROFS rather than `denied`; liveness is judged by heartbeat, not host
+pid; a declared network destination blocks the task); `sandbox-linux` fails if any
+of them skips.
 
 ## Known limits (also in `REPORT_LIMITATIONS`)
 
@@ -107,8 +117,5 @@ attempts were stopped on this backend in this run; it does not show the sandbox
 ### What is still not claimed
 
 Tool and delegation checks are policy at the tool boundary (the tool then runs in the server process): the
-runner remains the only enforcement layer. Linux stays `unverified` in every report, receipt and coverage
-record, and no Linux outcome is asserted. No process-count cap is asserted. The corpus is not wired into the
-`sandbox-linux` CI job: it would need execution cases that skip loudly (never silently pass) on Linux, and that
-has not been shown from this workspace. The enforced-mode release gate (`enforcedModeReleaseGate`) is a library
+runner remains the only enforcement layer. Linux is `partially-verified` in the platform statement (the controls listed there, on the hosted job only) and the attack-coverage record keeps `platforms.linux: 'unverified'` as a standing statement even though the corpus now runs on the hosted Linux runner inside the capabilities suite: turning that into a verified claim is a decision for the owners, not a side effect of the suite passing. The enforced-mode release gate (`enforcedModeReleaseGate`) is a library
 function used by the suite; it is not yet called from `scripts/release-check.mjs`.

package/src/capabilities/attack-coverage.js

@@ -34,7 +34,7 @@ export const KNOWN_LIMITS = Object.freeze([
   'HTTPS to a declared destination is an opaque tunnel: its payload is not inspected.',
   'The mediation proxy accepts connections from any local process, and forwards only to the declared destinations.',
   'Tool and delegation checks are policy at the tool boundary (in-process); only the runner enforces.',
-  'Process-count caps are not asserted on any backend.',
+  'A process-count cap is claimed only on the Linux namespace backend, where an active probe proved it on the hosted job; it is not claimed on macOS.',
 ]);
 
 /**

package/src/capabilities/manifest.js

@@ -44,8 +44,8 @@ const MANIFEST_REQUIRED = ['schema', 'schemaVersion', 'taskId', 'repository', 'p
 
 // Resource limits a manifest can carry. The first three come straight from the
 // assurance config (same ranges), the file-size cap is enforced by the sandbox
-// prelude, and the last two are CARRIED but never claimed enforced: see
-// `RESOURCE_ENFORCEMENT` in runner.js.
+// prelude, the process-count cap is enforced on the Linux namespace backend only (prlimit, proved by an
+// active probe), and the memory cap is CARRIED but never claimed enforced.
 export const RESOURCE_RANGES = Object.freeze({
   timeoutMs: { min: LIMITS.timeoutMs.min, max: LIMITS.timeoutMs.max },
   maxOutputBytes: { min: LIMITS.maxOutputBytes.min, max: LIMITS.maxOutputBytes.max },

package/src/capabilities/probes.js

@@ -48,15 +48,18 @@ function mk(prefix) { return fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(
 function rm(p) { try { fs.rmSync(p, { recursive: true, force: true }); } catch { /* best effort */ } }
 const token = (p) => `${p}-${crypto.randomBytes(8).toString('hex')}`;
 
-async function probeFsRead(backend) {
-  if (backend !== 'userspace') return unsupported(`read confinement to declared roots is not implemented on the ${backend} backend`);
+// `run` is a seam so a test can hand the probe a runner that is deliberately
+// wrong (a read root left too wide, a root left writable) and see the probe say
+// so: a probe that cannot fail proves nothing.
+export async function probeFsRead(backend, runner = runConfinedSupervised) {
+  if (backend !== 'userspace' && backend !== 'namespace') return unsupported(`read confinement to declared roots is not implemented on the ${backend} backend`);
   const root = mk('agsec-cap-r-'); const ro = mk('agsec-cap-ro-'); const outside = mk('agsec-cap-out-');
   try {
     const okTok = token('READABLE'); const secTok = token('SEALED');
     fs.writeFileSync(path.join(ro, 'r.txt'), okTok);
     fs.writeFileSync(path.join(outside, 's.txt'), secTok);
     fs.symlinkSync(path.join(outside, 's.txt'), path.join(ro, 'link'));
-    const run = (script, readRoots) => runConfinedSupervised(['/bin/sh', '-c', script], { root, readRoots, timeoutMs: 8000, graceMs: 300 });
+    const run = (script, readRoots) => runner(['/bin/sh', '-c', script], { root, readRoots, timeoutMs: 8000, graceMs: 300 });
     const pos = await run(`cat '${ro}/r.txt'`, [ro]);
     if (!pos.stdout.includes(okTok)) return notProved(`positive control failed: a file inside a declared root was not readable (${pos.status})`);
     const open = await run(`cat '${outside}/s.txt'`, [ro, outside]);
@@ -75,13 +78,13 @@ async function probeFsRead(backend) {
   } finally { rm(root); rm(ro); rm(outside); }
 }
 
-async function probeMultiWrite(backend) {
-  if (backend !== 'userspace') return unsupported(`several declared write roots are not implemented on the ${backend} backend`);
+export async function probeMultiWrite(backend, runner = runConfinedSupervised) {
+  if (backend !== 'userspace' && backend !== 'namespace') return unsupported(`several declared write roots are not implemented on the ${backend} backend`);
   const root = mk('agsec-cap-w-'); const w1 = mk('agsec-cap-w1-'); const w2 = mk('agsec-cap-w2-');
   const ro = mk('agsec-cap-wro-'); const outside = mk('agsec-cap-wout-');
   try {
     const script = [`echo a > '${w1}/f'`, `echo b > '${w2}/f'`, `echo c > '${ro}/f'`, `echo d > '${outside}/f'`, 'true'].join('; ');
-    await runConfinedSupervised(['/bin/sh', '-c', script], { root, readRoots: [ro], writeRoots: [w1, w2], timeoutMs: 8000, graceMs: 300 });
+    await runner(['/bin/sh', '-c', script], { root, readRoots: [ro], writeRoots: [w1, w2], timeoutMs: 8000, graceMs: 300 });
     if (!fs.existsSync(path.join(w1, 'f')) || !fs.existsSync(path.join(w2, 'f'))) return notProved('positive control failed: a declared write root was not writable');
     if (fs.existsSync(path.join(ro, 'f'))) return notProved('a root declared read-only was writable');
     if (fs.existsSync(path.join(outside, 'f'))) return notProved('an undeclared directory was writable');
@@ -197,8 +200,19 @@ export function isAdvertisedBackend(backend, platform = process.platform) {
 export function platformStatements() {
   return Object.freeze({
     linux: {
-      backend: 'namespace', status: 'unverified',
-      note: 'advertised for enforced mode, but the control probes in this module have not run on a Linux host from this workspace. Several controls are not implemented on the namespace backend (read confinement to declared roots, several write roots, mediated network, supervised tree termination), so enforced mode is blocked there until they are implemented and the sandbox-linux job shows them proved. Process-count caps are never claimed.',
+      backend: 'namespace', status: 'partially-verified',
+      // Evidence is the hosted sandbox-linux CI job (ubuntu-latest, x86_64), whose active probes
+      // (attack plus positive control, with fault-injection counterparts) proved these controls.
+      // Anything not listed here is not claimed: a verified control is verified on that runner image
+      // and kernel, not on every Linux host, which is why the job runs on every push.
+      evidence: 'sandbox-linux CI job (hosted ubuntu-latest, x86_64); scripts/sandbox-linux-verify.mjs',
+      verifiedControls: Object.freeze([
+        'write-confinement', 'read-denial', 'env-scrub', 'network', 'tree-termination', 'file-size-limit',
+        'fs-read-confinement', 'fs-multi-root-write', 'process-cap',
+      ]),
+      unsupportedControls: Object.freeze(['network-mediation']),
+      unassertedControls: Object.freeze([]),
+      note: 'advertised for enforced mode. Proved by active probes on the hosted Linux runner (not on every Linux host): write-confinement, read-denial, env-scrub, network, tree-termination, file-size-limit, fs-read-confinement, fs-multi-root-write, process-cap (a per-user-namespace process-count cap applied with prlimit after the confinement is built; the shell ulimit it replaces does not exist in dash). Mediated network is NOT implemented on the namespace backend (an empty network namespace has no path to a proxy), so a task that declares a network destination is blocked on Linux, never allowed. Process-count caps are claimed on Linux only, and only as that probe shows them; memory caps are not enforced. The attack corpus is not run in the sandbox-linux job, so corpus coverage stays unverified on Linux.',
     },
     darwin: {
       backend: 'userspace', status: 'host-proved-not-advertised',

package/src/capabilities/report.js

@@ -13,8 +13,9 @@
 //
 // A capability that only an in-process check covers (tools, delegation) says so
 // and is never `enforced`; that check explains a decision, it does not stop the
-// task. Process-count caps are carried and reported `unverified`, on every
-// backend.
+// task. A process-count cap is `enforced` only on a run whose process-cap probe
+// proved it (the Linux namespace backend); on the macOS backend it is carried and
+// reported `unverified`.
 import { platformStatements } from './probes.js';
 
 const FS_READ = ['fs-read-confinement', 'read-denial'];
@@ -28,7 +29,7 @@ export const REPORT_LIMITATIONS = Object.freeze([
   'HTTPS is an opaque tunnel to a declared destination: its payload is not inspected. Plaintext HTTP is filtered for secrets before it is forwarded.',
   'The mediation proxy accepts connections from any local process. It only forwards to declared destinations, so the exposure is the declared set.',
   'A process that double-forks and calls setsid between two supervisor sweeps can outlive the task; only a PID namespace or cgroup closes that gap.',
-  'Process-count caps are per-user and system-wide on the host and did not refuse on a hosted Linux runner in a previous release; none is claimed enforced on any backend.',
+  'A process-count cap is enforced only on the Linux namespace backend, where it is applied by prlimit after the confinement is built and was proved by an active probe; on macOS it is per-user and system-wide on the host, a soft brake that is carried and not claimed.',
   'Address-space (memory) caps are not enforceable on macOS and are carried, not enforced.',
 ]);
 
@@ -73,7 +74,7 @@ export function buildCapabilityReport({ bound, probeReport, level, required }) {
       timeoutMs: { requested: m.resources.timeoutMs ?? null, enforced: level === 'enforced', by: 'supervisor deadline with process-tree termination' },
       maxOutputBytes: { requested: m.resources.maxOutputBytes ?? null, enforced: level === 'enforced', by: 'supervisor output cap with process-tree termination' },
       maxFileSizeKb: { requested: m.resources.maxFileSizeKb ?? null, enforced: level === 'enforced' && fileLimitProved, state: c['file-size-limit']?.state ?? 'not-probed' },
-      maxProcesses: { requested: m.resources.maxProcesses ?? null, enforced: false, state: 'unverified' },
+      maxProcesses: { requested: m.resources.maxProcesses ?? null, enforced: m.resources.maxProcesses != null && level === 'enforced' && c['process-cap']?.state === 'proved', state: c['process-cap']?.state === 'proved' ? 'proved' : 'unverified' },
       maxMemoryMiB: { requested: m.resources.maxMemoryMiB ?? null, enforced: false, state: 'not-enforced' },
     },
     limitations: [...REPORT_LIMITATIONS],

package/src/capabilities/runner.js

@@ -190,7 +190,12 @@ export async function runCapabilityTask(bound, request, opts = {}) {
       denyReadPaths: protectedPaths,
       env: taskEnv, networkProxyPort: proxy ? proxy.port : null,
       timeoutMs, graceMs: 1000, maxOutputBytes, signal, force,
-      limits: m.resources.maxFileSizeKb ? { maxFileSizeKb: m.resources.maxFileSizeKb } : {},
+      limits: {
+        ...(m.resources.maxFileSizeKb ? { maxFileSizeKb: m.resources.maxFileSizeKb } : {}),
+        // Only the namespace backend applies it (prlimit, after the confinement is built). The macOS backend keeps its own ambient-relative
+        // default: a requested cap there would be per-user and system-wide, which is not what the manifest asked for.
+        ...(m.resources.maxProcesses && backend === 'namespace' ? { maxProcs: m.resources.maxProcesses } : {}),
+      },
     });
     const executed = r.supervised === true;
     if (!executed) {

package/src/sandbox/CLAUDE.md

@@ -281,9 +281,9 @@ privilegeDrop`), the same mechanism `limits.js` uses for an unenforceable
 limit. It is never silently skipped, and the escape test that covers the
 rebind attack fails if it is missing rather than quietly passing.
 
-**None of the above has been executed anywhere yet.** It is asserted by
-`sandbox-escape.test.js`'s kernel-namespace suite, which skips on macOS. Until
-a CI log shows that suite `RAN`, this section describes code, not evidence.
+**Executed on a hosted Linux runner.** The `sandbox-linux` job ran the suite
+(see the verification sections below); this section describes code that has
+been exercised, on that runner image and kernel only.
 
 ## Timeout does not kill the process tree
 
@@ -297,18 +297,24 @@ inside the policy profile — their writes and egress remain confined — but th
 are still running and still consuming resources. A caller that needs a hard
 tree kill must implement it.
 
-The namespace backend is structurally better here: it runs the confined
-command under `--pid --fork`, so the direct child is pid 1 of a new PID
-namespace and killing it should take the namespace's processes with it. That
-is a reasoned expectation from the flags, **not** an executed result — it
-needs the same Linux-host verification as everything else on that backend.
+The namespace backend closes this with the kernel, not a sweep: the command
+runs under `--pid --fork --kill-child`, so when the `unshare` supervisor dies
+the namespace's init gets SIGKILL and the kernel kills every member, including
+a double-forked `setsid` descendant that no process-group or sweep logic can
+find. `--kill-child` is used only where `unshare` advertises it
+(`namespaceTreeKill`); without it supervised execution is refused. Proved by
+the `linux-probes.js` probes on the hosted runner (kill the supervisor, kill
+the init directly). Earlier text here said killing the direct child should reap
+the tree; CI showed it did not (the killed process was the supervisor, not the
+init) until `--kill-child` was added.
 
 ## Known limitation, deliberately accepted: reads are not confined
 
 The userspace policy allows `(allow file-read*)` globally — that backend
 confines **writes**, network egress, and resource use, but **not reads**. (The
-kernel-namespace backend has the same cut: per the section above its mount
-tree is rebound read-only, not detached, so everything on it stays readable.)
+kernel-namespace backend has the same cut in its DEFAULT mode: its mount
+tree is rebound read-only, not detached, so everything on it stays readable.
+Its capability mode, entered with `readRoots`, does confine reads; see below.)
 A confined command can read any file on the host the OS-level
 permissions allow, including outside the sandbox root. Exfiltration of
 readable host files (writing what was read to network or to a location the
@@ -364,20 +370,37 @@ then runs supervised with protected paths read-denied.
   default protected set is the key directory, common credential directories
   under the home directory, plus caller-supplied sealed-label and evidence
   directories. A denylist is a floor, not a claim of host-wide read isolation.
-  The namespace backend does NOT implement it and returns `status:'error'`
-  without executing when asked, so on Linux the boundary is `blocked`.
+  The namespace backend implements it by masking: an empty tmpfs over a
+  protected directory, `/dev/null` over a protected file (in capability mode a
+  protected path outside every declared root is simply absent). Proved by the
+  protected-canary probes on the hosted runner.
 - **Process trees** (`supervise.js`): own process group, periodic descendant
   sweep, SIGTERM, grace, SIGKILL, then a poll that confirms no survivors; the
   same cleanup runs on a clean exit. Cancel is an `AbortSignal` (status
   `cancelled`). Output is capped. Known gap: a double-fork plus setsid between
   two sweeps escapes; only a PID namespace or cgroup closes it. Supervised
-  execution exists ONLY for the userspace backend; `namespace` is refused
-  because tree termination has not been implemented and executed there.
+  execution exists for the userspace backend and for the namespace backend
+  where `--kill-child` is available (see above).
 - **Active probes**: write confinement, read denial, env scrub, network, tree
   termination and the file-size limit each run an attack plus a positive
-  control through the real backend. `process-cap` is reported `unverified` on
-  every backend and must not be claimed enforced (per-uid and system-wide on
-  macOS, and it did not refuse on the hosted Linux runner in the last release).
+  control through the real backend. `process-cap` is `unverified` on the macOS
+  backend and must not be claimed enforced there: the cap is per-uid and
+  system-wide, a soft brake. On Linux the earlier non-refusal had a known cause:
+  the resource prelude is run by `/bin/sh`, which is dash on the hosted runner,
+  and dash's `ulimit` has no `-u` option (`ulimit: Illegal option -u` appears in
+  the `sandbox-linux` log), so the cap was never applied at all. The namespace
+  backend now applies it with `prlimit --nproc=N --` (util-linux), in the final
+  stage and to the caller's command alone (`FINAL_SCRIPT`; a cap applied earlier
+  would starve the confinement setup of processes). Inside the user namespace the
+  limit binds: the kernel waives RLIMIT_NPROC only for a process holding
+  CAP_SYS_RESOURCE or CAP_SYS_ADMIN in the INITIAL namespace, and a namespace root
+  has neither (its capability set is dropped as well). With no requested cap none
+  is applied (the old ambient-relative default never took effect on Linux), and a
+  host without `prlimit` declares `maxProcs` in `unsupported` rather than dropping
+  it. `probeProcessCap` (`control-probes.js`) is the proof: six concurrent
+  children all start under a generous cap and the kernel refuses some under a cap
+  of 3, in default and in capability mode; `linux-enforcement.test.js` runs it
+  against runners that ignore the cap and that cap everything.
   `capabilityReport()` carries the standing note that Linux enforcement is
   evidenced only where the `sandbox-linux` CI job ran the same probes.
 - **Status**: target output is returned labelled `untrusted` and is never parsed
@@ -396,7 +419,27 @@ then runs supervised with protected paths read-denied.
 - `writeRoots`: further writable subtrees (readable too). `cwd`: working directory, which must exist.
 - `networkProxyPort`: opens exactly one loopback port (`(remote ip "localhost:PORT")`); DNS, every other port and every other address stay denied.
 
-Verified by execution on macOS only (`test/capabilities/`, probes in `capabilities/probes.js`). The namespace backend implements none of these options; asked for them it ignores them, which is why the capability runner never asks it: its probes report these controls `unsupported` there and the run is blocked.
+Verified by execution on macOS only (`test/capabilities/`, probes in `capabilities/probes.js`). The namespace backend implements `readRoots`, `writeRoots`, `cwd` and
+`denyReadPaths` as **capability mode** (entered when `readRoots` is an array): a
+tmpfs root holding only the runtime baseline (`/usr`, `/bin`, `/lib*`, a few
+identity files, a fresh `/proc` and a minimal `/dev`) plus the declared roots,
+read-only for read roots and read-write for write roots, protected paths absent
+or masked, then `pivot_root` and a detached old root (`linux-rootfs.js` builds
+the plan and the setup script; `backend-namespace.js` runs it). Capability drop
+(`setpriv`, with no-new-privs) is required in this mode, not best effort.
+`networkProxyPort` is REFUSED: mediated network is not implemented on Linux, so
+a task that declares a destination is blocked there.
+
+### Linux evidence
+
+`linux-probes.js` and the generic probes in `control-probes.js` and
+`capabilities/probes.js` attack each control and pair it with a positive
+control; `test/capabilities/linux-enforcement.test.js` also runs every probe
+against a deliberately wrong runner (fault injection) and requires it to say so.
+`scripts/sandbox-linux-verify.mjs` (the `sandbox-linux` job) fails if a required
+suite skips, a required control is not proved, or a control that must stay
+unasserted claims to be proved, and uploads the evidence table. Exploratory runs
+on a local aarch64 VM are not evidence; only the hosted x86_64 job is.
 
 ## Extending this module