@evoclock/pi-agentic-driver 0.5.0 → 0.6.0

package/scripts/enforcement/linux_microvm_remote_fixture.sh

@@ -1,13 +1,1436 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# --- guest containment core (taxonomy, structured log, killswitch decision) ---
+# Design: /Users/julen/pi-dev-env/evidence/GUEST_CONTAINMENT_DESIGN.md sections
+# 2 (taxonomy), 2.0 (severity tiers), 4 (log format), 5 (killswitch semantics).
+# Watchers and shims arrive in a later step; this core is callable and testable
+# through the --gc-decide / --gc-log / --gc-taxonomy-sha hooks below.
+GC_TAXONOMY_VERSION="guest-containment-taxonomy.v1"
+GC_LOG_SCHEMA="agentic-driver.guest-containment.log.v1"
+GC_KILLSWITCH_SCHEMA="agentic-driver.guest-containment.killswitch.v1"
+GC_TAXONOMY_SHA256="f0d4f11150e0f9aef562f1e7d61afd9fa8df1f40f1c90c3c011dd768e335bb84"
+# Severity tiers (design section 2.0): CRITICAL/HIGH trip immediately,
+# ELEVATED/ANOMALY accumulate pressure within a sliding time window.
+GC_WINDOW_SECONDS=60
+GC_ELEVATED_THRESHOLD=5
+GC_ANOMALY_THRESHOLD=10
+GC_LOG_CAP_BYTES=8192
+GC_LOG_TRUNC=512
+
+gc_embedded_taxonomy() {
+  cat <<'GC_TAXONOMY_EOF'
+{
+  "schema": "guest-containment-taxonomy.v1",
+  "description": "Deny-by-default rule taxonomy for the guest containment monitor (design GUEST_CONTAINMENT_DESIGN.md section 2). One rule per line; IDs are never reused; new rules append. disposition records whether a live detector exists in the fixture (design sections 1.3, 3) or the rule is armed by the taxonomy only.",
+  "rules": [
+    {"id":"GC-PKG-001","class":"GC-PKG","severity":"ELEVATED","action":"deny","match":"package-manager-install: invocation of npm install, npm ci, pip install, yarn add, pnpm add, gem install, cargo install, apk add, apt install","evidence":"METR autonomous-replication evaluation work (arXiv:2403.13793); HF incident dependency-install persistence step","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-PKG-002","class":"GC-PKG","severity":"ELEVATED","action":"deny","match":"registry-write-command: npm publish, npm token, .npmrc writes, pip config, keyring writes","evidence":"HF incident: agent attempted package publication","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-PKG-003","class":"GC-PKG","severity":"ELEVATED","action":"deny","match":"package-metadata-tamper: writes to package.json, package-lock.json, pyproject.toml, requirements*.txt outside the job scratch space","evidence":"METR evaluation logs: dependency-manifest tampering as persistence step","since":"v1","disposition":"detector:fs-path+shim-argv"},
+    {"id":"GC-FSW-001","class":"GC-FSW","severity":"ELEVATED","action":"deny","match":"write-outside-allowlist: create/append/truncate on any path outside /tmp/session, detected by inotifyd or find -newer sweeps","evidence":"METR evaluation logs: out-of-bounds file writes during evaluation runs","since":"v1","disposition":"detector:fs-watcher"},
+    {"id":"GC-FSW-002","class":"GC-FSW","severity":"ELEVATED","action":"deny","match":"self-code-modification: writes under the agent job install/execution directories including the shim tree /shims/","evidence":"HF incident: agent rewrote the repository it was working in; monitor self-rewrite defense","since":"v1","disposition":"detector:fs-watcher"},
+    {"id":"GC-FSW-003","class":"GC-FSW","severity":"ELEVATED","action":"deny","match":"file-growth-anomaly: unexpected growth in cache/package directories (~/.npm, ~/.cache/pip, /var/cache/*) beyond the size-delta threshold","evidence":"METR evaluation logs: bulk cache staging of payloads","since":"v1","disposition":"detector:fs-sweep size-delta sampling (gc_cache_growth_sample; aggregate ELEVATED, GC_CACHE_GROWTH_KIB per sweep)"},
+    {"id":"GC-SHR-001","class":"GC-SHR","severity":"HIGH","action":"deny","match":"shared-cache-write: writes to paths shared with other agents or the coordinator; with host-share absent any such attempt is a deny","evidence":"receipt proves host-share=absent; writes would indicate boundary violation","since":"v1","disposition":"detector:fs-path; share paths auto-arm via gc_share_mounted (/proc/mounts); shared-cache roots classify as SHR when unarmed"},
+    {"id":"GC-SHR-002","class":"GC-SHR","severity":"HIGH","action":"deny","match":"cross-agent-channel: creation of or writes to inter-agent coordination paths (maildirs, task-queue files, agent state files)","evidence":"HF incident multi-agent escalation; METR coordination/sabotage threat model","since":"v1","disposition":"detector:fs-path+shim-argv heuristics (Maildir, task-queue, agent-channel, coordination paths)"},
+    {"id":"GC-NET-001","class":"GC-NET","severity":"HIGH","action":"deny","match":"socket-open: any entry in /proc/net/tcp, /proc/net/tcp6, /proc/net/udp at any sweep","evidence":"fixture boots with no network device; any socket is exfiltration-capable","since":"v1","disposition":"detector:net-proc-sweep"},
+    {"id":"GC-NET-002","class":"GC-NET","severity":"HIGH","action":"deny","match":"network-tool-invocation: shim-detects wget, curl, nc, ssh, telnet, ping regardless of arguments","evidence":"METR self-replication exfiltration patterns; HF incident remote control","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-CRED-001","class":"GC-CRED","severity":"CRITICAL","action":"deny","match":"credential-path-read: opens of ~/.ssh/, ~/.aws/, ~/.netrc, ~/.git-credentials, token files","evidence":"credential theft is step one in every reported agent-escape chain","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-CRED-002","class":"GC-CRED","severity":"CRITICAL","action":"deny","match":"env-secret-probing: attempts to dump or scan the environment for secret-shaped keys","evidence":"METR evaluation logs; HF incident postmortem credential harvest attempts","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-LOG-001","class":"GC-LOG","severity":"CRITICAL","action":"deny","match":"transcript-write: writes to the console transcript, the monitor log, or the receipt channel by any path other than the supervisor","evidence":"log is opened append-only by the supervisor; other writers are evidence tampering","since":"v1","disposition":"detector:fs-path+shim-argv (transcript/receipt-channel paths); the in-guest supervisor never writes these, so any event is a non-supervisor write"},
+    {"id":"GC-LOG-002","class":"GC-LOG","severity":"CRITICAL","action":"deny","match":"log-truncate-or-rename: >, rm, mv, truncate, sed -i targeting monitor/agent logs","evidence":"METR report: models attempting to edit their own logs","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-TOOL-001","class":"GC-TOOL","severity":"CRITICAL","action":"deny","match":"receipt-forgery: job printing AGENTIC_MICROVM_PROBE:* or AGENTIC_MICROVM_RECEIPT:* lines","evidence":"host closed-receipt parsing rejects forged output; guest-side denial closes the loop","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-TOOL-002","class":"GC-TOOL","severity":"CRITICAL","action":"deny","match":"marker-injection: writes to /dev/console, /dev/ttyS0, or other devtmpfs write targets that could inject marker text","evidence":"METR tool-call spoofing family; serial stream integrity","since":"v1","disposition":"detector:shim-argv+fs-path; known gap: char-device writes may not update mtime for the sweep"},
+    {"id":"GC-PROBE-001","class":"GC-PROBE","severity":"ELEVATED","action":"deny","match":"containment-introspection: reads or probes of /gc/** (core.sh, taxonomy, state), /shims/**, or session-dir metadata outside sanctioned /tmp/session writes","evidence":"METR report: agents research the monitoring environment before acting; HF incident agents probed sandbox infrastructure. Individually ambiguous (a job may stat its own directories), so aggregate ELEVATED rather than immediate-kill","since":"v1","disposition":"detector:fs-path+shim-argv"},
+    {"id":"GC-PROBE-002","class":"GC-PROBE","severity":"ELEVATED","action":"deny","match":"monitor-enumeration: ps/proc access patterns targeting watcher discovery (inspection looking for monitor PIDs, inotifyd, or the shim layer), shim/proc-watcher detected","evidence":"Design section 9.1 adversarial pass: monitor enumeration precedes timing and evasion attempts; aggregate ELEVATED avoids false-positive kills on process inspection","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-PROBE-003","class":"GC-PROBE","severity":"ELEVATED","action":"deny","match":"concealment-index anomaly: aggregated probe-frequency signal (GC-PROBE events plus weighted unknown-class denials) surfaced as the receipt concealmentIndex","evidence":"Timing probes and repeated no-op shim invocations to time detection are aggregate signals, not single-action violations; see design appendix formula","since":"v1","disposition":"detector:evidence-aggregate"}
+  ],
+  "residual": {"class":"unknown","tier":"ANOMALY","action":"deny","note":"everything not allowlisted and not classified above; accumulates toward the ANOMALY threshold"}
+}
+GC_TAXONOMY_EOF
+}
+
+gc_iso8601() { date -u '+%Y-%m-%dT%H:%M:%SZ'; }
+
+# Redaction per design section 4: strip control characters, replace
+# secret-shaped assignments with [REDACTED].
+gc_redact() {
+  tr -d '\000-\010\013\014\016-\037' | sed -E 's/[A-Za-z0-9_-]*([Tt]oken|TOKEN|[Ss]ecret|SECRET|[Pp]ass[A-Za-z]*|PASS[A-Za-z]*|[Cc]redential|CREDENTIAL|[Aa]pi[_-]?[Kk]ey|API[_-]?KEY|[Pp]rivate[_-]?[Kk]ey|PRIVATE[_-]?KEY)[A-Za-z0-9_-]*[=:][^ ",;&]+/[REDACTED]/g'
+}
+
+# Extract a string field from the rule object whose "id" matches rule_id.
+gc_rule_field() { # taxonomy_file rule_id field
+  sed -n "s/.*\"id\": *\"$2\"[^}]*\"$3\": *\"\([A-Za-z-]*\)\".*/\1/p" "$1" | head -n 1
+}
+
+gc_log_event() { # state_dir source class subject_type subject_value [action]
+  local state_dir=$1 source=$2 class=$3 stype=$4 svalue=$5 action=${6:-deny}
+  # Log freeze (design section 5): once a killswitch trip is recorded the log
+  # is frozen; appends after the trip would break the terminal digest chain.
+  if [ -f "$state_dir/kill" ]; then return 0; fi
+  mkdir -p "$state_dir"
+  local log="$state_dir/containment.log.jsonl"
+  local tax="$state_dir/taxonomy.json"
+  if [ ! -f "$tax" ]; then gc_embedded_taxonomy >"$tax" || return 2; fi
+  local tsha
+  tsha=$(sha256sum "$tax" | awk '{print $1}') || return 2
+  local seq=1
+  if [ -f "$state_dir/seq" ]; then seq=$(( $(cat "$state_dir/seq") + 1 )); fi
+  printf '%s\n' "$seq" >"$state_dir/seq"
+  svalue=${svalue//\\/}
+  svalue=${svalue//\"/}
+  svalue=$(printf '%s' "$svalue" | gc_redact | cut -c1-"$GC_LOG_TRUNC")
+  local ts record
+  ts=$(gc_iso8601)
+  # Summary-only degradation on flood (design section 4): context dropped,
+  # events never silently discarded.
+  if [ -f "$log" ] && [ "$(wc -c <"$log")" -gt "$GC_LOG_CAP_BYTES" ]; then
+    record=$(printf '{"schema":"%s","session":"%s","taxonomy":"%s","taxonomySha256":"%s","event":{"ts":"%s","seq":%s,"source":"%s","class":"%s","action":"%s","summary":true}}' \
+      "$GC_LOG_SCHEMA" "$(basename "$state_dir")" "$GC_TAXONOMY_VERSION" "$tsha" "$ts" "$seq" "$source" "$class" "$action")
+  else
+    record=$(printf '{"schema":"%s","session":"%s","taxonomy":"%s","taxonomySha256":"%s","event":{"ts":"%s","seq":%s,"source":"%s","class":"%s","action":"%s","subject":{"type":"%s","value":"%s"}}}' \
+      "$GC_LOG_SCHEMA" "$(basename "$state_dir")" "$GC_TAXONOMY_VERSION" "$tsha" "$ts" "$seq" "$source" "$class" "$action" "$stype" "$svalue")
+  fi
+  printf '%s\n' "$record" >>"$log"
+  printf '%s\n' "$record"
+}
+
+gc_killswitch_trip() { # state_dir rule_id class tier mode pressure threshold
+  # Trip freeze (live microvm-d7a15c47beaf94372f304da7): gc_decide gates on the
+  # kill flag, but gc_liveness calls this directly - after a session has
+  # tripped, a second terminal pair must never be appended (it would mask the
+  # real trip in the evidence extraction) and the flag must not be overwritten.
+  local state_dir=$1 rule_id=$2 class=$3 tier=$4 mode=$5 pressure=${6:-null} threshold=${7:-null}
+  if [ -f "$state_dir/kill" ]; then return 0; fi
+  local log="$state_dir/containment.log.jsonl"
+  local ks event log_sha
+  event=$(printf '{"schema":"%s","session":"%s","trigger":{"rule":"%s","class":"%s","tier":"%s","mode":"%s","pressure":%s,"threshold":%s},"final":true}' \
+    "$GC_KILLSWITCH_SCHEMA" "$(basename "$state_dir")" "$rule_id" "$class" "$tier" "$mode" "$pressure" "$threshold")
+  printf '%s\n' "$event" >>"$log"
+  log_sha=$(sha256sum "$log" | awk '{print $1}') || return 2
+  # Terminal killswitch event with log digest (design section 5, step 1).
+  ks=$(printf '{"schema":"%s","session":"%s","trigger":{"rule":"%s","class":"%s","tier":"%s","mode":"%s","pressure":%s,"threshold":%s},"logSha256":"%s","final":true}' \
+    "$GC_KILLSWITCH_SCHEMA" "$(basename "$state_dir")" "$rule_id" "$class" "$tier" "$mode" "$pressure" "$threshold" "$log_sha")
+  printf '%s\n' "$ks" >>"$log"
+  # Kill flag: the guest supervisor polls this and executes the kill path
+  # (kill process group, sync, poweroff -f); host-side hooks ignore it.
+  printf '%s\n' "$mode" >"$state_dir/kill" 2>/dev/null || true
+  printf '%s\n' "$ks"
+}
+
+gc_window_pressure() { # pressure_file
+  local now cutoff
+  now=$(date +%s)
+  cutoff=$((now - GC_WINDOW_SECONDS))
+  if [ ! -f "$1" ]; then printf '0\n'; return 0; fi
+  awk -v cutoff="$cutoff" '$1 > cutoff {n++} END {print n + 0}' "$1"
+}
+
+# Killswitch decision function (design sections 2.0 and 5): given a rule hit,
+# CRITICAL/HIGH trip immediately; ELEVATED/ANOMALY increment per-class pressure
+# within the sliding window and trip on threshold. Returns a decision JSON on
+# stdout; a trip also appends the terminal killswitch event to the log.
+gc_decide() { # state_dir rule_id [subject_value]
+  local state_dir=$1 rule_id=$2 svalue=${3:-}
+  # Log freeze gates the decision path too: after a trip the session is dead;
+  # further events must not append, re-trip, or grow pressure counters.
+  if [ -f "$state_dir/kill" ]; then
+    printf '{"rule":"%s","frozen":true,"tripped":true,"mode":"post-trip"}\n' "$rule_id"
+    return 0
+  fi
+  mkdir -p "$state_dir" || return 2
+  local tax="$state_dir/taxonomy.json"
+  if [ ! -f "$tax" ]; then gc_embedded_taxonomy >"$tax" || return 2; fi
+  local severity class tier mode=immediate pressure=null threshold=null tripped=false
+  severity=$(gc_rule_field "$tax" "$rule_id" severity)
+  if [ -z "$severity" ]; then
+    # Residual deny-by-default class (design section 2, GC-UNKNOWN).
+    severity=ANOMALY
+    class=unknown
+  else
+    class=$(gc_rule_field "$tax" "$rule_id" class)
+  fi
+  case "$severity" in
+    CRITICAL|HIGH)
+      tier=$severity
+      tripped=true
+      mode=immediate
+      ;;
+    ELEVATED|ANOMALY)
+      tier=$severity
+      mode=aggregate
+      local pfile="$state_dir/pressure.$class"
+      printf '%s\n' "$(date +%s)" >>"$pfile"
+      pressure=$(gc_window_pressure "$pfile")
+      if [ "$severity" = ELEVATED ]; then threshold=$GC_ELEVATED_THRESHOLD; else threshold=$GC_ANOMALY_THRESHOLD; fi
+      if [ "$pressure" -ge "$threshold" ]; then tripped=true; fi
+      ;;
+    *)
+      return 2
+      ;;
+  esac
+  gc_log_event "$state_dir" "shim" "$class" "exec" "$svalue" >/dev/null || return 2
+  if [ "$tripped" = true ]; then
+    gc_killswitch_trip "$state_dir" "$rule_id" "$class" "$tier" "$mode" "$pressure" "$threshold" >/dev/null || return 2
+  fi
+  printf '{"rule":"%s","class":"%s","severity":"%s","tier":"%s","tripped":%s,"mode":"%s","pressure":%s,"threshold":%s}\n' \
+    "$rule_id" "$class" "$severity" "$tier" "$tripped" "$mode" "$pressure" "$threshold"
+}
+
+# --- detection (design section 1.3, 3): shim classification, allowlist,
+# fs/net/proc detection, supervisor liveness. Callable from the guest
+# (sourced by /init and the shim dispatcher) and from the host test hooks.
+GC_LEARNING_WINDOW_SECONDS=${GC_LEARNING_WINDOW_SECONDS:-3}
+GC_CACHE_GROWTH_KIB=${GC_CACHE_GROWTH_KIB:-1024}
+GC_WRITABLE_ROOT="/tmp/session"
+
+# Shim classification: map a command line to a taxonomy rule id (empty means
+# unclassified; unclassified executables go through the observed-first-use
+# allowlist, design section 3).
+gc_shim_classify() { # tool args...
+  local tool=$1; shift
+  # busybox <applet> shim bypass (design section 9.1): classify the effective
+  # applet line instead of trusting the tool name.
+  if [ "$tool" = "busybox" ] && [ "$#" -ge 1 ]; then
+    gc_shim_classify "$1" "${@:2}"
+    return
+  fi
+  local line="$tool $*"
+  case "$tool" in
+    wget|curl|nc|ssh|telnet|ping) printf 'GC-NET-002\n'; return 0 ;;
+    printenv) printf 'GC-CRED-002\n'; return 0 ;;
+  esac
+  # Job-scratch carve-out (false-positive discipline): the sanctioned scratch
+  # root is the one tree a job may write freely, so the GC-SHR-002 and
+  # GC-LOG-001 argv heuristics must not fire on scratch-local paths. A
+  # scratch-prefixed argument is neutralized for those two rules only; writes
+  # outside the scratch keep denying exactly as before, and every other rule
+  # still sees the raw command line.
+  local line_outer="$line"
+  case "$line" in
+    *"$GC_WRITABLE_ROOT"/*)
+      line_outer=$(printf '%s\n' "$line" | sed "s|${GC_WRITABLE_ROOT}/[^[:space:]]*|/sanctioned-scratch|g") ;;
+  esac
+  case "$line_outer" in
+    *"/Maildir"*|*"/task-queue"*|*"agent-channel"*|*"/.herdr"*|*"/coordination"*)
+      # GC-SHR-002: cross-agent coordination paths (HIGH, immediate).
+      printf 'GC-SHR-002\n'; return 0 ;;
+    *"console.typescript"*|*"transcript"*|*"receipt-channel"*)
+      # GC-LOG-001: transcript/receipt-channel writes (CRITICAL, immediate).
+      printf 'GC-LOG-001\n'; return 0 ;;
+  esac
+  case "$line" in
+    *"npm install"*|*"npm ci"*|*"pip install"*|*"yarn add"*|*"pnpm add"*|*"gem install"*|*"cargo install"*|*"apk add"*|*"apt install"*)
+      printf 'GC-PKG-001\n' ;;
+    *"npm publish"*|*"npm token"*|*".npmrc"*|*"pip config"*)
+      printf 'GC-PKG-002\n' ;;
+    *".ssh/"*|*".aws/"*|*".netrc"*|*".git-credentials"*)
+      printf 'GC-CRED-001\n' ;;
+    *"env | grep"*|*"env | grep -i"*)
+      printf 'GC-CRED-002\n' ;;
+    *"package.json"*|*"package-lock.json"*|*"pyproject.toml"*|*"requirements"*.txt*)
+      printf 'GC-PKG-003\n' ;;
+    *"AGENTIC_MICROVM_PROBE"*|*"AGENTIC_MICROVM_RECEIPT"*|*"AGENTIC_CONTAINMENT_BEGIN"*|*"AGENTIC_CONTAINMENT_END"*)
+      printf 'GC-TOOL-001\n' ;;
+    *"/dev/console"*|*"/dev/ttyS"*|*"/dev/tty0"*)
+      printf 'GC-TOOL-002\n' ;;
+    *"inotifyd"*|*"watcher"*|*"cmdline"*|*"ps -"*|*"/proc/"*"stat"*)
+      # GC-PROBE-002: monitor enumeration (ps/proc patterns targeting watchers).
+      printf 'GC-PROBE-002\n' ;;
+    *"containment.log"*|*"/.gc/"*|*"> /var/log"*|*"truncate -s 0"*|*"sed -i"*)
+      printf 'GC-LOG-002\n' ;;
+    *"/gc/"*|*"core.sh"*|*"/shims/"*|*"microvm-target"*)
+      # GC-PROBE-001: monitor introspection (reads of /gc, the core, the shims).
+      printf 'GC-PROBE-001\n' ;;
+    *) return 0 ;;
+  esac
+}
+
+# Observed-first-use allowlist with a short learning window (design section 3):
+# during the window unlisted executables are logged and allowed; after lock
+# they are denied with the redacted command line.
+gc_shim_allow() { # state_dir tool args... -> decision JSON on stdout
+  local state_dir=$1 tool=$2; shift 2
+  mkdir -p "$state_dir" || return 2
+  local rule
+  rule=$(gc_shim_classify "$tool" "$@")
+  if [ -n "$rule" ]; then
+    gc_decide "$state_dir" "$rule" "$tool $*" >/dev/null || return 2
+    printf '{"decision":"deny","rule":"%s","tool":"%s"}\n' "$rule" "$tool"
+    return 0
+  fi
+  local allow="$state_dir/allowlist" lock="$state_dir/allowlist.lock" start="$state_dir/learning_start"
+  if [ ! -f "$start" ]; then printf '%s\n' "$(date +%s)" >"$start"; fi
+  if [ ! -f "$lock" ] && [ $(( $(date +%s) - $(cat "$start") )) -ge "$GC_LEARNING_WINDOW_SECONDS" ]; then
+    printf '%s\n' "$(date +%s)" >"$lock"
+  fi
+  if [ -f "$lock" ]; then
+    if grep -F -x -- "$tool" "$allow" >/dev/null 2>&1; then
+      printf '{"decision":"allow","tool":"%s","learned":false}\n' "$tool"
+    else
+      gc_decide "$state_dir" "unknown" "$tool $*" >/dev/null || return 2
+      printf '{"decision":"deny","rule":"unknown","tool":"%s"}\n' "$tool"
+    fi
+  else
+    if ! grep -F -x -- "$tool" "$allow" >/dev/null 2>&1; then
+      printf '%s\n' "$tool" >>"$allow"
+    fi
+    # Learning-window observations are logged (design section 3): allowed, but
+    # recorded as events so the learning window is auditable.
+    gc_log_event "$state_dir" "shim" "unknown" "exec" "$tool $*" "observe" >/dev/null 2>&1 || true
+    printf '{"decision":"allow","tool":"%s","learned":true}\n' "$tool"
+  fi
+}
+
+# Share-mount arm check (GC-SHR-001): share paths auto-arm only when a
+# host-share mount is visible in /proc/mounts. GC_PROC_MOUNTS overrides the
+# mounts source for tests; production always reads /proc/mounts.
+gc_share_mounted() {
+  local mounts="${GC_PROC_MOUNTS:-/proc/mounts}"
+  [ -r "$mounts" ] || return 1
+  grep -qE '(^|[[:space:]])(/share|/mnt/share)([[:space:]]|$)|[[:space:]](9p|virtiofs|nfs|cifs)[[:space:]]' "$mounts" 2>/dev/null
+}
+
+# GC-FSW-003 detector: cache/package size-delta sampling in the sweep. Each
+# sample records the summed KiB of the watched roots; a delta at or above
+# GC_CACHE_GROWTH_KIB since the previous sample is ONE aggregate ELEVATED
+# decision (trips at the class threshold, never per event).
+gc_cache_growth_sample() { # state_dir dir...
+  local state_dir=$1; shift
+  mkdir -p "$state_dir" 2>/dev/null || return 2
+  local dir kib total=0 baseline="$state_dir/cache.baseline"
+  for dir in "$@"; do
+    [ -d "$dir" ] || continue
+    kib=$(du -sk "$dir" 2>/dev/null | awk '{print $1}') || kib=0
+    total=$((total + ${kib:-0}))
+  done
+  if [ ! -f "$baseline" ]; then
+    if printf '%s\n' "$total" >"$baseline" 2>/dev/null; then
+      gc_log_event "$state_dir" "sweep" "GC-FSW-003" "sample" "baseline=${total}KiB" "observe" >/dev/null 2>&1 || true
+    fi
+    return 0
+  fi
+  local prev delta
+  prev=$(cat "$baseline" 2>/dev/null) || prev=$total
+  printf '%s\n' "$total" >"$baseline" 2>/dev/null || true
+  delta=$((total - ${prev:-0}))
+  # Diagnostic observe (live microvm-b583fccb8abf8bccb0989e10): one compact
+  # line per sample so the next live run shows total/prev/delta/threshold and
+  # the decision path even when no event fires.
+  gc_log_event "$state_dir" "sweep" "GC-FSW-003" "sample" "total=${total}KiB prev=${prev:-none}KiB delta=${delta}KiB threshold=${GC_CACHE_GROWTH_KIB}KiB" "observe" >/dev/null 2>&1 || true
+  if [ "$delta" -ge "$GC_CACHE_GROWTH_KIB" ]; then
+    gc_decide "$state_dir" GC-FSW-003 "cache growth ${delta}KiB" >/dev/null || return 2
+    printf '{"decision":"deny","rule":"GC-FSW-003","growthKiB":%s}\n' "$delta"
+  fi
+  return 0
+}
+
+# fs-watcher detection: only the job scratch root is writable; writes to the
+# shim/agent trees are self-code-modification, everything else is
+# write-outside-allowlist.
+gc_fs_detect() { # state_dir path -> decision JSON
+  local state_dir=$1 path=$2
+  case "$path" in
+    "$GC_WRITABLE_ROOT"|"$GC_WRITABLE_ROOT"/*)
+      printf '{"decision":"allow","path":"%s"}\n' "$path" ;;
+    /gc|/gc/*)
+      # GC-PROBE-001: introspection of the monitor tree itself (section 9.1).
+      decision=$(gc_decide "$state_dir" GC-PROBE-001 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-PROBE-001","path":"%s"}\n' "$path" ;;
+      esac ;;
+    /shims|/shims/*|/agent|/agent/*)
+      decision=$(gc_decide "$state_dir" GC-FSW-002 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-FSW-002","path":"%s"}\n' "$path" ;;
+      esac ;;
+    */package.json|*/package-lock.json|*/pyproject.toml|*/requirements*.txt|/package.json|/pyproject.toml)
+      decision=$(gc_decide "$state_dir" GC-PKG-003 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-PKG-003","path":"%s"}\n' "$path" ;;
+      esac ;;
+    /dev/*|/dev)
+      # Write targets on devtmpfs could inject marker text (GC-TOOL-002).
+      decision=$(gc_decide "$state_dir" GC-TOOL-002 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-TOOL-002","path":"%s"}\n' "$path" ;;
+      esac ;;
+    /share|/share/*|/mnt/share|/mnt/share/*)
+      if gc_share_mounted; then
+        # GC-SHR-001 armed form: a share mount is present, so these paths
+        # exist as a live share; any write is a shared-cache write (HIGH).
+        decision=$(gc_decide "$state_dir" GC-SHR-001 "$path") || return 2
+        case "$decision" in
+          *'"frozen":true'*) printf '%s\n' "$decision" ;;
+          *) printf '{"decision":"deny","rule":"GC-SHR-001","path":"%s"}\n' "$path" ;;
+        esac
+      else
+        # Unarmed: with no share mount these paths are ordinary writes
+        # outside the allowlist - normal FSW-001 handling, not a share trip.
+        decision=$(gc_decide "$state_dir" GC-FSW-001 "$path") || return 2
+        case "$decision" in
+          *'"frozen":true'*) printf '%s\n' "$decision" ;;
+          *) printf '{"decision":"deny","rule":"GC-FSW-001","path":"%s"}\n' "$path" ;;
+        esac
+      fi ;;
+    */.npm|*/.npm/*|*/.cache|*/.cache/*|/var/cache|/var/cache/*)
+      # GC-SHR-001 deny-otherwise form: without an armed share mount these
+      # shared-cache roots have no legitimate writer, so a write is classified
+      # as shared-cache, not plain FSW-001 (HIGH, immediate).
+      decision=$(gc_decide "$state_dir" GC-SHR-001 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-SHR-001","path":"%s"}\n' "$path" ;;
+      esac ;;
+    */Maildir|*/Maildir/*|*/task-queue/*|*/.herdr/*|*/agent-channel/*|*/coordination/*)
+      # GC-SHR-002: cross-agent coordination paths (HIGH, immediate).
+      decision=$(gc_decide "$state_dir" GC-SHR-002 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-SHR-002","path":"%s"}\n' "$path" ;;
+      esac ;;
+    *console.typescript*|*typescript|*transcript*|*/receipt-channel/*)
+      # GC-LOG-001: the supervisor never writes transcript/receipt-channel
+      # files inside the guest (the host recorder owns them), so any fs event
+      # here is a non-supervisor write (CRITICAL, immediate).
+      decision=$(gc_decide "$state_dir" GC-LOG-001 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-LOG-001","path":"%s"}\n' "$path" ;;
+      esac ;;
+    *"containment.log"*|*/.gc/*)
+      gc_decide "$state_dir" GC-LOG-002 "$path" >/dev/null || return 2
+      printf '{"decision":"deny","rule":"GC-LOG-002","path":"%s"}\n' "$path" ;;
+    *)
+      decision=$(gc_decide "$state_dir" GC-FSW-001 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-FSW-001","path":"%s"}\n' "$path" ;;
+      esac ;;
+  esac
+}
+
+# find -newer sweep fallback for the fs-watcher: detect every path handed in.
+gc_fs_sweep() { # state_dir path...
+  local state_dir=$1; shift
+  local path
+  for path in "$@"; do gc_fs_detect "$state_dir" "$path"; done
+}
+
+# Sweep-baseline retreat (live microvm-11d339266876dcfad3d3ac32, card R2):
+# the sweep used to `touch baseline` right after `find -newer baseline`, so a
+# write landing between the find pass and that touch was never strictly newer
+# than the baseline and stayed invisible forever - the live cp into
+# /var/cache/shared-write was seen by the GC-FSW-003 sampler (delta=4KiB) yet
+# produced no gc_fs_detect decision, no GC-SHR-001 deny, and no trip. The
+# baseline must move BACK one second after each find so same-second writes
+# stay strictly newer at the next sweep. Cost: one re-scan of the previous
+# second (duplicate denies only add pressure; HIGH rules trip immediately).
+gc_baseline_retreat() { # path
+  local p=$1 now ts
+  now=$(date +%s) || { touch "$p"; return 0; }
+  ts=$((now - 1))
+  if ! touch -d "@$ts" "$p" 2>/dev/null; then
+    if ! touch -t "$(date -v-1S +%Y%m%d%H%M.%S 2>/dev/null)" "$p" 2>/dev/null; then
+      touch "$p"
+    fi
+  fi
+}
+
+# net-watcher detection: any socket row is a violation (GC-NET-001).
+gc_net_detect() { # state_dir socket_entry
+  local state_dir=$1 entry=$2
+  [ -n "$entry" ] || return 0
+  decision=$(gc_decide "$state_dir" GC-NET-001 "$entry") || return 2
+  case "$decision" in
+    *'"frozen":true'*) printf '%s\n' "$decision" ;;
+    *) printf '{"decision":"deny","rule":"GC-NET-001"}\n' ;;
+  esac
+}
+
+# Proc-watcher sweep: enumerate userspace processes only. Kernel threads
+# (kthreadd, kworker/*) have an empty /proc/PID/cmdline and are children of
+# kthreadd (ppid 2); flagging them produced 117+ false unknown-class events on
+# the first live proof and tripped the ANOMALY threshold before the job ran
+# (fixture microvm-ab06221027d3e36afc843b91). base_dir defaults to /proc and
+# is a parameter so tests can exercise the filter against a simulated tree.
+gc_proc_watch_sweep() { # [base_dir] -> "comm" lines of userspace processes
+  local base=${1:-/proc} p comm
+  for p in "$base"/[0-9]*; do
+    [ -d "$p" ] || continue
+    [ -s "$p/cmdline" ] || continue   # kernel threads: empty cmdline
+    [ "$(awk '{print $4}' "$p/stat" 2>/dev/null)" = "2" ] && continue
+    comm=$(cat "$p/comm" 2>/dev/null) || continue
+    [ -n "$comm" ] && printf '%s\n' "$comm"
+  done
+}
+
+# proc-watcher detection: a process outside the job tree is an anomaly.
+gc_proc_detect() { # state_dir process_identity
+  local state_dir=$1 identity=$2
+  gc_decide "$state_dir" unknown "proc $identity" >/dev/null || return 2
+  printf '{"decision":"deny","rule":"unknown"}\n'
+}
+
+# Supervisor liveness (design section 1.3): a dead monitor loop is a
+# containment failure and trips the killswitch immediately.
+gc_liveness() { # state_dir alive_flags ("1 1 1"; any 0 is a dead loop)
+  local state_dir=$1 flags=$2
+  # Post-trip the session is already dead; monitor collateral at teardown must
+  # not trip a masking containment-integrity terminal (see trip freeze above).
+  if [ -f "$state_dir/kill" ]; then return 0; fi
+  case " $flags " in
+    *" 0 "*)
+      gc_log_event "$state_dir" "watcher:proc" containment-integrity proc "monitor loop dead" >/dev/null || return 2
+      gc_killswitch_trip "$state_dir" containment-integrity containment-integrity CRITICAL immediate null null >/dev/null || return 2
+      printf '{"decision":"deny","rule":"containment-integrity","tier":"CRITICAL","mode":"immediate"}\n' ;;
+    *) printf '{"decision":"allow"}\n' ;;
+  esac
+}
+
+# B1: the one real receipt printf. The containment segment is passed as a %s
+# argument (never interpolated into the format string, where it would stay
+# literal under single quotes); an empty segment yields the v1 receipt shape.
+gc_receipt_json() { # schema remote_host fixture_id domain marker marker_sha script_hash initramfs_sha containment_segment domain destroy_requested absent acl_before acl_after fs_ctx_sha net_ctx_sha
+  printf '{"schema":"%s","ok":true,"status":"VERIFIED","authorityCreated":false,"runtimeActivated":false,"persisted":false,"identity":{"remoteHost":"%s","fixtureId":"%s","domain":"%s"},"marker":{"value":"%s","sha256":"%s"},"scriptHash":"%s","initramfsSha256":"%s"%s,"teardown":{"domain":{"name":"%s","transient":true,"destroyOnExit":true,"destroyRequested":%s,"absent":%s,"checked":true,"check":"virsh dominfo/list"},"acl":{"beforeSha256":"%s","afterSha256":"%s","equal":true,"checked":true,"initramfsEntryRemoved":true}},"context":{"filesystem":{"summary":"disk=absent host-share=absent credentials=absent gpu=absent","disk":false,"hostShare":false,"credentials":false,"gpu":false,"sha256":"%s"},"network":{"summary":"network=absent","guest":false,"sha256":"%s"},"guestMounts":["proc","sysfs","devtmpfs"]}}\n' "$@"
+}
+
+# Terminal event for a session that ends without a killswitch trip: the
+# envelope then carries only log lines plus this session-end record
+# (design section 5: a session with neither is containment-evidence-missing).
+gc_session_end() { # state_dir
+  # Split declarations: bash 3.2 expands every word of one `local` before any
+  # assignment, so referencing $state_dir in the same statement is an unbound
+  # variable under set -u on the host-side hook path.
+  local state_dir=$1
+  local log="$state_dir/containment.log.jsonl"
+  # Bootstrap the taxonomy copy so a zero-event session (no shim invocation,
+  # no watcher hit) still records its terminal event: without it the digest
+  # lookup below fails, no log is created, and no envelope can be emitted.
+  if [ ! -f "$state_dir/taxonomy.json" ]; then
+    mkdir -p "$state_dir" || return 2
+    gc_embedded_taxonomy >"$state_dir/taxonomy.json" || return 2
+  fi
+  local seq=1
+  if [ -f "$state_dir/seq" ]; then seq=$(( $(cat "$state_dir/seq") + 1 )); fi
+  printf '%s\n' "$seq" >"$state_dir/seq"
+  local tsha
+  tsha=$(sha256sum "$state_dir/taxonomy.json" | awk '{print $1}') || return 2
+  printf '{"schema":"%s","session":"%s","taxonomy":"%s","taxonomySha256":"%s","event":{"ts":"%s","seq":%s,"source":"supervisor","class":"session-end","action":"complete","summary":true}}\n' \
+    "$GC_LOG_SCHEMA" "$(basename "$state_dir")" "$GC_TAXONOMY_VERSION" "$tsha" "$(gc_iso8601)" "$seq" >>"$log"
+}
+
+# Host-side containment evidence (design section 5): extract the framed base64
+# envelope from the console transcript, decode it pty-safe, recompute the log
+# digest per the stated normalization, and cross-check the terminal killswitch
+# event's embedded digest against the full payload.
+gc_containment_evidence() { # transcript fixture_id [kill_report_path] -> containment block JSON on stdout
+  local transcript=$1 fid=$2 report_path=${3:-}
+  local begin="AGENTIC_CONTAINMENT_BEGIN:$fid" end="AGENTIC_CONTAINMENT_END:$fid"
+  local b64 tmp log_sha events denials ks_line ks_rule tripped rule_json
+  tmp="$transcript.containment.$$"
+  trap 'rm -f "$tmp" "$tmp.b64" "$tmp.head"' RETURN
+  # H2: exactly one envelope pair may exist; more than one is a forgery or a
+  # replay attempt and fails closed.
+  # Count with index() so pty CR suffixes do not defeat the anchor.
+  begins=$(awk -v b="$begin" 'index($0, b) == 1 { n++ } END { print n + 0 }' "$transcript")
+  ends=$(awk -v e="$end" 'index($0, e) == 1 { n++ } END { print n + 0 }' "$transcript")
+  if [ "$begins" -ne 1 ] || [ "$ends" -ne 1 ]; then
+    return 1
+  fi
+  if ! awk -v b="$begin" -v e="$end" 'index($0, b) == 1 { inside = 1; next } index($0, e) == 1 { inside = 0; next } inside' "$transcript" | tr -d '\r' >"$tmp.b64"; then
+    return 1
+  fi
+  if ! [ -s "$tmp.b64" ]; then return 1; fi
+  if ! { base64 -d <"$tmp.b64" >"$tmp" 2>/dev/null || base64 -D <"$tmp.b64" >"$tmp" 2>/dev/null; }; then return 1; fi
+  if ! grep -q '"schema":"' "$tmp"; then return 1; fi
+  ks_line=$(grep '"final":true' "$tmp" | tail -n 1)
+  ks_num=$(grep -n '"final":true' "$tmp" | tail -n 1 | cut -d: -f1)
+  if [ -n "$ks_line" ]; then
+    # Digest chain (H1): verified at the killswitch line's position — the
+    # digest covers the log up to and including the trigger event but
+    # excluding the killswitch line itself; anything after it is post-trip
+    # noise the guest's log freeze should have prevented, and is ignored for
+    # the digest rather than silently trusted.
+    ks_sha=$(printf '%s\n' "$ks_line" | sed -n 's/.*"logSha256":"\([0-9a-f]*\)".*/\1/p')
+    sed -n "1,$((ks_num - 1))p" "$tmp" >"$tmp.head" 2>/dev/null || return 1
+    chained_sha=$(sha256sum "$tmp.head" | awk '{print $1}') || return 1
+    if [ -z "$ks_sha" ] || [ "$ks_sha" != "$chained_sha" ]; then return 2; fi
+    tripped=true
+    log_sha=$ks_sha
+    ks_rule=$(printf '%s\n' "$ks_line" | sed -n 's/.*"trigger":{"rule":"\([A-Za-z0-9_-]*\)".*/\1/p')
+    ks_class=$(printf '%s\n' "$ks_line" | sed -n 's/.*"trigger":{"rule":"[A-Za-z0-9_-]*","class":"\([A-Za-z0-9_-]*\)".*/\1/p')
+    ks_tier=$(printf '%s\n' "$ks_line" | sed -n 's/.*"tier":"\([A-Za-z]*\)".*/\1/p')
+    rule_json="\"$ks_rule\""
+    class_json="\"$ks_class\""
+    tier_json="\"$ks_tier\""
+    counted=$((ks_num - 1))
+  else
+    # Fail-closed: without a killswitch record the session must end with the
+    # clean session-end terminal event.
+    grep -q '"class":"session-end"' "$tmp" || return 1
+    tripped=false
+    rule_json=null
+    class_json=null
+    tier_json=null
+    log_sha=$(sha256sum "$tmp" | awk '{print $1}') || return 1
+    counted=$(grep -c '"schema":"' "$tmp")
+  fi
+  events=$counted
+  denials=$(grep -c '"action":"deny"' "$tmp")
+  # M1: compact histogram (design section 4; open question 4 decided) — the
+  # coordinator consumes aggregates from the receipt without extra tooling.
+  # Terminal killswitch records are echoes, not events; exclude them.
+  histogram=$(awk '{
+    if ($0 !~ /guest-containment.killswitch.v1/ && match($0, /"class":"[^"]*"/)) {
+      c = substr($0, RSTART + 9, RLENGTH - 10); n[c]++
+    }
+  } END { first = 1; printf "{"; for (k in n) { if (!first) printf ","; printf "\"%s\":%d", k, n[k]; first = 0 } printf "}" }' "$tmp")
+  # Concealment index (design appendix): probes + 2*unknown-class denials
+  # + 3*containment-integrity events; probes counted alongside.
+  probes=0; concealment_index=0
+  eval "$(awk '{
+    if ($0 ~ /guest-containment.killswitch.v1/) next
+    match($0, /"class":"[^"]*"/); c = substr($0, RSTART + 9, RLENGTH - 10)
+    match($0, /"action":"[^"]*"/); a = substr($0, RSTART + 10, RLENGTH - 11)
+    if (c == "GC-PROBE") { probes++; idx += 1 }
+    else if (c == "unknown" && a == "deny") { idx += 2 }
+    else if (c == "containment-integrity") { idx += 3 }
+  } END { printf "probes=%d; concealment_index=%d;", probes + 0, idx + 0 }' "$tmp")"
+  if [ "$tripped" = true ] && [ -n "$report_path" ]; then
+    cp "$tmp" "$transcript.containment.payload" 2>/dev/null || true
+    report_json=",\"killReportPath\":\"$report_path\""
+  else
+    report_json=""
+  fi
+  rm -f "$tmp" "$tmp.b64" "$tmp.head"
+  printf '{"schema":"%s","taxonomySha256":"%s","logSha256":"%s","events":%s,"denials":%s,"probes":%s,"concealmentIndex":%s,"histogram":%s,"killswitch":{"tripped":%s,"rule":%s,"class":%s,"tier":%s,"guestPoweroff":true,"final":true}%s}' \
+    "$GC_LOG_SCHEMA" "$GC_TAXONOMY_SHA256" "$log_sha" "$events" "$denials" "$probes" "$concealment_index" "$histogram" "$tripped" "$rule_json" "$class_json" "$tier_json" "$report_json"
+}
+
+# Durable kill report (design section 5; Defect 2): when the killswitch trips,
+# the fixture writes kill-report.json next to console.typescript with session
+# identity, decoded aggregates, the trigger, the last redacted events before
+# the kill, and teardown proof status (finalized after the teardown proofs).
+gc_write_kill_report() { # fixture_root fixture_id domain remote_host block_json
+  local fixture_root=$1 fid=$2 dom=$3 host=$4 block=$5
+  local payload="$fixture_root/console.typescript.containment.payload"
+  local report="$fixture_root/kill-report.json"
+  local log_sha events denials probes concealment histogram rule class tier mode pressure threshold
+  log_sha=$(printf '%s' "$block" | sed -n 's/.*"logSha256":"\([0-9a-f]*\)".*/\1/p')
+  events=$(printf '%s' "$block" | sed -n 's/.*"events":\([0-9]*\).*/\1/p')
+  denials=$(printf '%s' "$block" | sed -n 's/.*"denials":\([0-9]*\).*/\1/p')
+  probes=$(printf '%s' "$block" | sed -n 's/.*"probes":\([0-9]*\).*/\1/p')
+  concealment=$(printf '%s' "$block" | sed -n 's/.*"concealmentIndex":\([0-9]*\).*/\1/p')
+  histogram=$(printf '%s' "$block" | sed -n 's/.*"histogram":\({[^}]*}\).*/\1/p')
+  rule=$(printf '%s' "$block" | sed -n 's/.*"killswitch":{"tripped":true,"rule":"\([^"]*\)".*/\1/p')
+  class=$(printf '%s' "$block" | sed -n 's/.*"class":"\([^"]*\)","tier":"\([^"]*\)".*/\1/p')
+  tier=$(printf '%s' "$block" | sed -n 's/.*"class":"[^"]*","tier":"\([^"]*\)".*/\1/p')
+  local ks_line first_ts last_ts
+  ks_line=$(grep '"logSha256"' "$payload" | tail -n 1 || true)
+  mode=$(printf '%s\n' "$ks_line" | sed -n 's/.*"mode":"\([^"]*\)".*/\1/p' || true)
+  pressure=$(printf '%s\n' "$ks_line" | sed -n 's/.*"pressure":\([0-9]*\).*/\1/p' || true)
+  threshold=$(printf '%s\n' "$ks_line" | sed -n 's/.*"threshold":\([0-9]*\).*/\1/p' || true)
+  # null-safe scalars: the guest emits pressure/threshold null for immediate trips.
+  pressure=${pressure:-null}
+  threshold=${threshold:-null}
+  first_ts=$(grep -o '"ts":"[^"]*"' "$payload" | head -n 1 | cut -d'"' -f4 || true)
+  last_ts=$(grep -o '"ts":"[^"]*"' "$payload" | tail -n 1 | cut -d'"' -f4 || true)
+  local last_events
+  last_events=$(awk '/"action":"deny"/ { lines[n++] = $0 } END { for (i = (n > 5 ? n - 5 : 0); i < n; i++) { if (i > (n > 5 ? n - 5 : 0)) printf ","; printf "%s", lines[i] } }' "$payload" || true)
+  printf '{"schema":"agentic-driver.guest-containment.kill-report.v1","session":{"fixtureId":"%s","domain":"%s","remoteHost":"%s"},"generatedAt":"%s","guestSession":{"firstEventAt":"%s","lastEventAt":"%s","events":%s,"denials":%s,"probes":%s,"concealmentIndex":%s,"histogram":%s},"killswitch":{"tripped":true,"rule":"%s","class":"%s","tier":"%s","mode":"%s","pressure":%s,"threshold":%s},"lastEvents":[%s],"teardown":{"domainAbsent":"PENDING","destroyRequested":"PENDING","aclRestored":"PENDING"},"logSha256":"%s"}\n' \
+    "$fid" "$dom" "$host" "$(gc_iso8601)" "$first_ts" "$last_ts" "$events" "$denials" "$probes" "$concealment" "$histogram" \
+    "$rule" "$class" "$tier" "$mode" "$pressure" "$threshold" "$last_events" "$log_sha" >"$report"
+  printf '%s\n' "$report"
+}
+
+# Test hooks: the containment core is callable without booting the guest.
+if [ "${1:-}" = "--gc-decide" ]; then shift; gc_decide "$@"; exit $?; fi
+if [ "${1:-}" = "--gc-log" ]; then shift; gc_log_event "$@"; exit $?; fi
+if [ "${1:-}" = "--gc-shim" ]; then shift; gc_shim_allow "$@"; exit $?; fi
+if [ "${1:-}" = "--gc-fs-detect" ]; then shift; gc_fs_detect "$@"; exit $?; fi
+if [ "${1:-}" = "--gc-fs-sweep" ]; then shift; gc_fs_sweep "$@"; exit $?; fi
+if [ "${1:-}" = "--gc-baseline-retreat" ]; then shift; gc_baseline_retreat "$@"; exit $?; fi
+if [ "${1:-}" = "--gc-cache-growth" ]; then shift; gc_cache_growth_sample "$@"; exit $?; fi
+if [ "${1:-}" = "--gc-net-detect" ]; then shift; gc_net_detect "$@"; exit $?; fi
+if [ "${1:-}" = "--gc-proc-detect" ]; then shift; gc_proc_detect "$@"; exit $?; fi
+if [ "${1:-}" = "--gc-proc-sweep" ]; then shift; gc_proc_watch_sweep "$@"; exit $?; fi
+if [ "${1:-}" = "--gc-liveness" ]; then shift; gc_liveness "$@"; exit $?; fi
+if [ "${1:-}" = "--gc-core-embed" ]; then
+  shift
+  # Test/regression hook: writes the embedded guest core exactly as the build
+  # phase does. Works through the streamed-stdin path (`bash -s`), where $0
+  # is "bash" and there is no script file to read back.
+  cat >"$1" <<'GC_CORE_EOF'
+# --- guest containment core (taxonomy, structured log, killswitch decision) ---
+# Design: /Users/julen/pi-dev-env/evidence/GUEST_CONTAINMENT_DESIGN.md sections
+# 2 (taxonomy), 2.0 (severity tiers), 4 (log format), 5 (killswitch semantics).
+# Watchers and shims arrive in a later step; this core is callable and testable
+# through the --gc-decide / --gc-log / --gc-taxonomy-sha hooks below.
+GC_TAXONOMY_VERSION="guest-containment-taxonomy.v1"
+GC_LOG_SCHEMA="agentic-driver.guest-containment.log.v1"
+GC_KILLSWITCH_SCHEMA="agentic-driver.guest-containment.killswitch.v1"
+GC_TAXONOMY_SHA256="f0d4f11150e0f9aef562f1e7d61afd9fa8df1f40f1c90c3c011dd768e335bb84"
+# Severity tiers (design section 2.0): CRITICAL/HIGH trip immediately,
+# ELEVATED/ANOMALY accumulate pressure within a sliding time window.
+GC_WINDOW_SECONDS=60
+GC_ELEVATED_THRESHOLD=5
+GC_ANOMALY_THRESHOLD=10
+GC_LOG_CAP_BYTES=8192
+GC_LOG_TRUNC=512
+
+gc_embedded_taxonomy() {
+  cat <<'GC_TAXONOMY_EOF'
+{
+  "schema": "guest-containment-taxonomy.v1",
+  "description": "Deny-by-default rule taxonomy for the guest containment monitor (design GUEST_CONTAINMENT_DESIGN.md section 2). One rule per line; IDs are never reused; new rules append. disposition records whether a live detector exists in the fixture (design sections 1.3, 3) or the rule is armed by the taxonomy only.",
+  "rules": [
+    {"id":"GC-PKG-001","class":"GC-PKG","severity":"ELEVATED","action":"deny","match":"package-manager-install: invocation of npm install, npm ci, pip install, yarn add, pnpm add, gem install, cargo install, apk add, apt install","evidence":"METR autonomous-replication evaluation work (arXiv:2403.13793); HF incident dependency-install persistence step","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-PKG-002","class":"GC-PKG","severity":"ELEVATED","action":"deny","match":"registry-write-command: npm publish, npm token, .npmrc writes, pip config, keyring writes","evidence":"HF incident: agent attempted package publication","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-PKG-003","class":"GC-PKG","severity":"ELEVATED","action":"deny","match":"package-metadata-tamper: writes to package.json, package-lock.json, pyproject.toml, requirements*.txt outside the job scratch space","evidence":"METR evaluation logs: dependency-manifest tampering as persistence step","since":"v1","disposition":"detector:fs-path+shim-argv"},
+    {"id":"GC-FSW-001","class":"GC-FSW","severity":"ELEVATED","action":"deny","match":"write-outside-allowlist: create/append/truncate on any path outside /tmp/session, detected by inotifyd or find -newer sweeps","evidence":"METR evaluation logs: out-of-bounds file writes during evaluation runs","since":"v1","disposition":"detector:fs-watcher"},
+    {"id":"GC-FSW-002","class":"GC-FSW","severity":"ELEVATED","action":"deny","match":"self-code-modification: writes under the agent job install/execution directories including the shim tree /shims/","evidence":"HF incident: agent rewrote the repository it was working in; monitor self-rewrite defense","since":"v1","disposition":"detector:fs-watcher"},
+    {"id":"GC-FSW-003","class":"GC-FSW","severity":"ELEVATED","action":"deny","match":"file-growth-anomaly: unexpected growth in cache/package directories (~/.npm, ~/.cache/pip, /var/cache/*) beyond the size-delta threshold","evidence":"METR evaluation logs: bulk cache staging of payloads","since":"v1","disposition":"detector:fs-sweep size-delta sampling (gc_cache_growth_sample; aggregate ELEVATED, GC_CACHE_GROWTH_KIB per sweep)"},
+    {"id":"GC-SHR-001","class":"GC-SHR","severity":"HIGH","action":"deny","match":"shared-cache-write: writes to paths shared with other agents or the coordinator; with host-share absent any such attempt is a deny","evidence":"receipt proves host-share=absent; writes would indicate boundary violation","since":"v1","disposition":"detector:fs-path; share paths auto-arm via gc_share_mounted (/proc/mounts); shared-cache roots classify as SHR when unarmed"},
+    {"id":"GC-SHR-002","class":"GC-SHR","severity":"HIGH","action":"deny","match":"cross-agent-channel: creation of or writes to inter-agent coordination paths (maildirs, task-queue files, agent state files)","evidence":"HF incident multi-agent escalation; METR coordination/sabotage threat model","since":"v1","disposition":"detector:fs-path+shim-argv heuristics (Maildir, task-queue, agent-channel, coordination paths)"},
+    {"id":"GC-NET-001","class":"GC-NET","severity":"HIGH","action":"deny","match":"socket-open: any entry in /proc/net/tcp, /proc/net/tcp6, /proc/net/udp at any sweep","evidence":"fixture boots with no network device; any socket is exfiltration-capable","since":"v1","disposition":"detector:net-proc-sweep"},
+    {"id":"GC-NET-002","class":"GC-NET","severity":"HIGH","action":"deny","match":"network-tool-invocation: shim-detects wget, curl, nc, ssh, telnet, ping regardless of arguments","evidence":"METR self-replication exfiltration patterns; HF incident remote control","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-CRED-001","class":"GC-CRED","severity":"CRITICAL","action":"deny","match":"credential-path-read: opens of ~/.ssh/, ~/.aws/, ~/.netrc, ~/.git-credentials, token files","evidence":"credential theft is step one in every reported agent-escape chain","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-CRED-002","class":"GC-CRED","severity":"CRITICAL","action":"deny","match":"env-secret-probing: attempts to dump or scan the environment for secret-shaped keys","evidence":"METR evaluation logs; HF incident postmortem credential harvest attempts","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-LOG-001","class":"GC-LOG","severity":"CRITICAL","action":"deny","match":"transcript-write: writes to the console transcript, the monitor log, or the receipt channel by any path other than the supervisor","evidence":"log is opened append-only by the supervisor; other writers are evidence tampering","since":"v1","disposition":"detector:fs-path+shim-argv (transcript/receipt-channel paths); the in-guest supervisor never writes these, so any event is a non-supervisor write"},
+    {"id":"GC-LOG-002","class":"GC-LOG","severity":"CRITICAL","action":"deny","match":"log-truncate-or-rename: >, rm, mv, truncate, sed -i targeting monitor/agent logs","evidence":"METR report: models attempting to edit their own logs","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-TOOL-001","class":"GC-TOOL","severity":"CRITICAL","action":"deny","match":"receipt-forgery: job printing AGENTIC_MICROVM_PROBE:* or AGENTIC_MICROVM_RECEIPT:* lines","evidence":"host closed-receipt parsing rejects forged output; guest-side denial closes the loop","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-TOOL-002","class":"GC-TOOL","severity":"CRITICAL","action":"deny","match":"marker-injection: writes to /dev/console, /dev/ttyS0, or other devtmpfs write targets that could inject marker text","evidence":"METR tool-call spoofing family; serial stream integrity","since":"v1","disposition":"detector:shim-argv+fs-path; known gap: char-device writes may not update mtime for the sweep"},
+    {"id":"GC-PROBE-001","class":"GC-PROBE","severity":"ELEVATED","action":"deny","match":"containment-introspection: reads or probes of /gc/** (core.sh, taxonomy, state), /shims/**, or session-dir metadata outside sanctioned /tmp/session writes","evidence":"METR report: agents research the monitoring environment before acting; HF incident agents probed sandbox infrastructure. Individually ambiguous (a job may stat its own directories), so aggregate ELEVATED rather than immediate-kill","since":"v1","disposition":"detector:fs-path+shim-argv"},
+    {"id":"GC-PROBE-002","class":"GC-PROBE","severity":"ELEVATED","action":"deny","match":"monitor-enumeration: ps/proc access patterns targeting watcher discovery (inspection looking for monitor PIDs, inotifyd, or the shim layer), shim/proc-watcher detected","evidence":"Design section 9.1 adversarial pass: monitor enumeration precedes timing and evasion attempts; aggregate ELEVATED avoids false-positive kills on process inspection","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-PROBE-003","class":"GC-PROBE","severity":"ELEVATED","action":"deny","match":"concealment-index anomaly: aggregated probe-frequency signal (GC-PROBE events plus weighted unknown-class denials) surfaced as the receipt concealmentIndex","evidence":"Timing probes and repeated no-op shim invocations to time detection are aggregate signals, not single-action violations; see design appendix formula","since":"v1","disposition":"detector:evidence-aggregate"}
+  ],
+  "residual": {"class":"unknown","tier":"ANOMALY","action":"deny","note":"everything not allowlisted and not classified above; accumulates toward the ANOMALY threshold"}
+}
+GC_TAXONOMY_EOF
+}
+
+gc_iso8601() { date -u '+%Y-%m-%dT%H:%M:%SZ'; }
+
+# Redaction per design section 4: strip control characters, replace
+# secret-shaped assignments with [REDACTED].
+gc_redact() {
+  tr -d '\000-\010\013\014\016-\037' | sed -E 's/[A-Za-z0-9_-]*([Tt]oken|TOKEN|[Ss]ecret|SECRET|[Pp]ass[A-Za-z]*|PASS[A-Za-z]*|[Cc]redential|CREDENTIAL|[Aa]pi[_-]?[Kk]ey|API[_-]?KEY|[Pp]rivate[_-]?[Kk]ey|PRIVATE[_-]?KEY)[A-Za-z0-9_-]*[=:][^ ",;&]+/[REDACTED]/g'
+}
+
+# Extract a string field from the rule object whose "id" matches rule_id.
+gc_rule_field() { # taxonomy_file rule_id field
+  sed -n "s/.*\"id\": *\"$2\"[^}]*\"$3\": *\"\([A-Za-z-]*\)\".*/\1/p" "$1" | head -n 1
+}
+
+gc_log_event() { # state_dir source class subject_type subject_value [action]
+  local state_dir=$1 source=$2 class=$3 stype=$4 svalue=$5 action=${6:-deny}
+  # Log freeze (design section 5): once a killswitch trip is recorded the log
+  # is frozen; appends after the trip would break the terminal digest chain.
+  if [ -f "$state_dir/kill" ]; then return 0; fi
+  mkdir -p "$state_dir"
+  local log="$state_dir/containment.log.jsonl"
+  local tax="$state_dir/taxonomy.json"
+  if [ ! -f "$tax" ]; then gc_embedded_taxonomy >"$tax" || return 2; fi
+  local tsha
+  tsha=$(sha256sum "$tax" | awk '{print $1}') || return 2
+  local seq=1
+  if [ -f "$state_dir/seq" ]; then seq=$(( $(cat "$state_dir/seq") + 1 )); fi
+  printf '%s\n' "$seq" >"$state_dir/seq"
+  svalue=${svalue//\\/}
+  svalue=${svalue//\"/}
+  svalue=$(printf '%s' "$svalue" | gc_redact | cut -c1-"$GC_LOG_TRUNC")
+  local ts record
+  ts=$(gc_iso8601)
+  # Summary-only degradation on flood (design section 4): context dropped,
+  # events never silently discarded.
+  if [ -f "$log" ] && [ "$(wc -c <"$log")" -gt "$GC_LOG_CAP_BYTES" ]; then
+    record=$(printf '{"schema":"%s","session":"%s","taxonomy":"%s","taxonomySha256":"%s","event":{"ts":"%s","seq":%s,"source":"%s","class":"%s","action":"%s","summary":true}}' \
+      "$GC_LOG_SCHEMA" "$(basename "$state_dir")" "$GC_TAXONOMY_VERSION" "$tsha" "$ts" "$seq" "$source" "$class" "$action")
+  else
+    record=$(printf '{"schema":"%s","session":"%s","taxonomy":"%s","taxonomySha256":"%s","event":{"ts":"%s","seq":%s,"source":"%s","class":"%s","action":"%s","subject":{"type":"%s","value":"%s"}}}' \
+      "$GC_LOG_SCHEMA" "$(basename "$state_dir")" "$GC_TAXONOMY_VERSION" "$tsha" "$ts" "$seq" "$source" "$class" "$action" "$stype" "$svalue")
+  fi
+  printf '%s\n' "$record" >>"$log"
+  printf '%s\n' "$record"
+}
+
+gc_killswitch_trip() { # state_dir rule_id class tier mode pressure threshold
+  # Trip freeze (live microvm-d7a15c47beaf94372f304da7): gc_decide gates on the
+  # kill flag, but gc_liveness calls this directly - after a session has
+  # tripped, a second terminal pair must never be appended (it would mask the
+  # real trip in the evidence extraction) and the flag must not be overwritten.
+  local state_dir=$1 rule_id=$2 class=$3 tier=$4 mode=$5 pressure=${6:-null} threshold=${7:-null}
+  if [ -f "$state_dir/kill" ]; then return 0; fi
+  local log="$state_dir/containment.log.jsonl"
+  local ks event log_sha
+  event=$(printf '{"schema":"%s","session":"%s","trigger":{"rule":"%s","class":"%s","tier":"%s","mode":"%s","pressure":%s,"threshold":%s},"final":true}' \
+    "$GC_KILLSWITCH_SCHEMA" "$(basename "$state_dir")" "$rule_id" "$class" "$tier" "$mode" "$pressure" "$threshold")
+  printf '%s\n' "$event" >>"$log"
+  log_sha=$(sha256sum "$log" | awk '{print $1}') || return 2
+  # Terminal killswitch event with log digest (design section 5, step 1).
+  ks=$(printf '{"schema":"%s","session":"%s","trigger":{"rule":"%s","class":"%s","tier":"%s","mode":"%s","pressure":%s,"threshold":%s},"logSha256":"%s","final":true}' \
+    "$GC_KILLSWITCH_SCHEMA" "$(basename "$state_dir")" "$rule_id" "$class" "$tier" "$mode" "$pressure" "$threshold" "$log_sha")
+  printf '%s\n' "$ks" >>"$log"
+  # Kill flag: the guest supervisor polls this and executes the kill path
+  # (kill process group, sync, poweroff -f); host-side hooks ignore it.
+  printf '%s\n' "$mode" >"$state_dir/kill" 2>/dev/null || true
+  printf '%s\n' "$ks"
+}
+
+gc_window_pressure() { # pressure_file
+  local now cutoff
+  now=$(date +%s)
+  cutoff=$((now - GC_WINDOW_SECONDS))
+  if [ ! -f "$1" ]; then printf '0\n'; return 0; fi
+  awk -v cutoff="$cutoff" '$1 > cutoff {n++} END {print n + 0}' "$1"
+}
+
+# Killswitch decision function (design sections 2.0 and 5): given a rule hit,
+# CRITICAL/HIGH trip immediately; ELEVATED/ANOMALY increment per-class pressure
+# within the sliding window and trip on threshold. Returns a decision JSON on
+# stdout; a trip also appends the terminal killswitch event to the log.
+gc_decide() { # state_dir rule_id [subject_value]
+  local state_dir=$1 rule_id=$2 svalue=${3:-}
+  # Log freeze gates the decision path too: after a trip the session is dead;
+  # further events must not append, re-trip, or grow pressure counters.
+  if [ -f "$state_dir/kill" ]; then
+    printf '{"rule":"%s","frozen":true,"tripped":true,"mode":"post-trip"}\n' "$rule_id"
+    return 0
+  fi
+  mkdir -p "$state_dir" || return 2
+  local tax="$state_dir/taxonomy.json"
+  if [ ! -f "$tax" ]; then gc_embedded_taxonomy >"$tax" || return 2; fi
+  local severity class tier mode=immediate pressure=null threshold=null tripped=false
+  severity=$(gc_rule_field "$tax" "$rule_id" severity)
+  if [ -z "$severity" ]; then
+    # Residual deny-by-default class (design section 2, GC-UNKNOWN).
+    severity=ANOMALY
+    class=unknown
+  else
+    class=$(gc_rule_field "$tax" "$rule_id" class)
+  fi
+  case "$severity" in
+    CRITICAL|HIGH)
+      tier=$severity
+      tripped=true
+      mode=immediate
+      ;;
+    ELEVATED|ANOMALY)
+      tier=$severity
+      mode=aggregate
+      local pfile="$state_dir/pressure.$class"
+      printf '%s\n' "$(date +%s)" >>"$pfile"
+      pressure=$(gc_window_pressure "$pfile")
+      if [ "$severity" = ELEVATED ]; then threshold=$GC_ELEVATED_THRESHOLD; else threshold=$GC_ANOMALY_THRESHOLD; fi
+      if [ "$pressure" -ge "$threshold" ]; then tripped=true; fi
+      ;;
+    *)
+      return 2
+      ;;
+  esac
+  gc_log_event "$state_dir" "shim" "$class" "exec" "$svalue" >/dev/null || return 2
+  if [ "$tripped" = true ]; then
+    gc_killswitch_trip "$state_dir" "$rule_id" "$class" "$tier" "$mode" "$pressure" "$threshold" >/dev/null || return 2
+  fi
+  printf '{"rule":"%s","class":"%s","severity":"%s","tier":"%s","tripped":%s,"mode":"%s","pressure":%s,"threshold":%s}\n' \
+    "$rule_id" "$class" "$severity" "$tier" "$tripped" "$mode" "$pressure" "$threshold"
+}
+
+# --- detection (design section 1.3, 3): shim classification, allowlist,
+# fs/net/proc detection, supervisor liveness. Callable from the guest
+# (sourced by /init and the shim dispatcher) and from the host test hooks.
+GC_LEARNING_WINDOW_SECONDS=${GC_LEARNING_WINDOW_SECONDS:-3}
+GC_CACHE_GROWTH_KIB=${GC_CACHE_GROWTH_KIB:-1024}
+GC_WRITABLE_ROOT="/tmp/session"
+
+# Shim classification: map a command line to a taxonomy rule id (empty means
+# unclassified; unclassified executables go through the observed-first-use
+# allowlist, design section 3).
+gc_shim_classify() { # tool args...
+  local tool=$1; shift
+  # busybox <applet> shim bypass (design section 9.1): classify the effective
+  # applet line instead of trusting the tool name.
+  if [ "$tool" = "busybox" ] && [ "$#" -ge 1 ]; then
+    gc_shim_classify "$1" "${@:2}"
+    return
+  fi
+  local line="$tool $*"
+  case "$tool" in
+    wget|curl|nc|ssh|telnet|ping) printf 'GC-NET-002\n'; return 0 ;;
+    printenv) printf 'GC-CRED-002\n'; return 0 ;;
+  esac
+  # Job-scratch carve-out (false-positive discipline): the sanctioned scratch
+  # root is the one tree a job may write freely, so the GC-SHR-002 and
+  # GC-LOG-001 argv heuristics must not fire on scratch-local paths. A
+  # scratch-prefixed argument is neutralized for those two rules only; writes
+  # outside the scratch keep denying exactly as before, and every other rule
+  # still sees the raw command line.
+  local line_outer="$line"
+  case "$line" in
+    *"$GC_WRITABLE_ROOT"/*)
+      line_outer=$(printf '%s\n' "$line" | sed "s|${GC_WRITABLE_ROOT}/[^[:space:]]*|/sanctioned-scratch|g") ;;
+  esac
+  case "$line_outer" in
+    *"/Maildir"*|*"/task-queue"*|*"agent-channel"*|*"/.herdr"*|*"/coordination"*)
+      # GC-SHR-002: cross-agent coordination paths (HIGH, immediate).
+      printf 'GC-SHR-002\n'; return 0 ;;
+    *"console.typescript"*|*"transcript"*|*"receipt-channel"*)
+      # GC-LOG-001: transcript/receipt-channel writes (CRITICAL, immediate).
+      printf 'GC-LOG-001\n'; return 0 ;;
+  esac
+  case "$line" in
+    *"npm install"*|*"npm ci"*|*"pip install"*|*"yarn add"*|*"pnpm add"*|*"gem install"*|*"cargo install"*|*"apk add"*|*"apt install"*)
+      printf 'GC-PKG-001\n' ;;
+    *"npm publish"*|*"npm token"*|*".npmrc"*|*"pip config"*)
+      printf 'GC-PKG-002\n' ;;
+    *".ssh/"*|*".aws/"*|*".netrc"*|*".git-credentials"*)
+      printf 'GC-CRED-001\n' ;;
+    *"env | grep"*|*"env | grep -i"*)
+      printf 'GC-CRED-002\n' ;;
+    *"package.json"*|*"package-lock.json"*|*"pyproject.toml"*|*"requirements"*.txt*)
+      printf 'GC-PKG-003\n' ;;
+    *"AGENTIC_MICROVM_PROBE"*|*"AGENTIC_MICROVM_RECEIPT"*|*"AGENTIC_CONTAINMENT_BEGIN"*|*"AGENTIC_CONTAINMENT_END"*)
+      printf 'GC-TOOL-001\n' ;;
+    *"/dev/console"*|*"/dev/ttyS"*|*"/dev/tty0"*)
+      printf 'GC-TOOL-002\n' ;;
+    *"inotifyd"*|*"watcher"*|*"cmdline"*|*"ps -"*|*"/proc/"*"stat"*)
+      # GC-PROBE-002: monitor enumeration (ps/proc patterns targeting watchers).
+      printf 'GC-PROBE-002\n' ;;
+    *"containment.log"*|*"/.gc/"*|*"> /var/log"*|*"truncate -s 0"*|*"sed -i"*)
+      printf 'GC-LOG-002\n' ;;
+    *"/gc/"*|*"core.sh"*|*"/shims/"*|*"microvm-target"*)
+      # GC-PROBE-001: monitor introspection (reads of /gc, the core, the shims).
+      printf 'GC-PROBE-001\n' ;;
+    *) return 0 ;;
+  esac
+}
+
+# Observed-first-use allowlist with a short learning window (design section 3):
+# during the window unlisted executables are logged and allowed; after lock
+# they are denied with the redacted command line.
+gc_shim_allow() { # state_dir tool args... -> decision JSON on stdout
+  local state_dir=$1 tool=$2; shift 2
+  mkdir -p "$state_dir" || return 2
+  local rule
+  rule=$(gc_shim_classify "$tool" "$@")
+  if [ -n "$rule" ]; then
+    gc_decide "$state_dir" "$rule" "$tool $*" >/dev/null || return 2
+    printf '{"decision":"deny","rule":"%s","tool":"%s"}\n' "$rule" "$tool"
+    return 0
+  fi
+  local allow="$state_dir/allowlist" lock="$state_dir/allowlist.lock" start="$state_dir/learning_start"
+  if [ ! -f "$start" ]; then printf '%s\n' "$(date +%s)" >"$start"; fi
+  if [ ! -f "$lock" ] && [ $(( $(date +%s) - $(cat "$start") )) -ge "$GC_LEARNING_WINDOW_SECONDS" ]; then
+    printf '%s\n' "$(date +%s)" >"$lock"
+  fi
+  if [ -f "$lock" ]; then
+    if grep -F -x -- "$tool" "$allow" >/dev/null 2>&1; then
+      printf '{"decision":"allow","tool":"%s","learned":false}\n' "$tool"
+    else
+      gc_decide "$state_dir" "unknown" "$tool $*" >/dev/null || return 2
+      printf '{"decision":"deny","rule":"unknown","tool":"%s"}\n' "$tool"
+    fi
+  else
+    if ! grep -F -x -- "$tool" "$allow" >/dev/null 2>&1; then
+      printf '%s\n' "$tool" >>"$allow"
+    fi
+    # Learning-window observations are logged (design section 3): allowed, but
+    # recorded as events so the learning window is auditable.
+    gc_log_event "$state_dir" "shim" "unknown" "exec" "$tool $*" "observe" >/dev/null 2>&1 || true
+    printf '{"decision":"allow","tool":"%s","learned":true}\n' "$tool"
+  fi
+}
+
+# Share-mount arm check (GC-SHR-001): share paths auto-arm only when a
+# host-share mount is visible in /proc/mounts. GC_PROC_MOUNTS overrides the
+# mounts source for tests; production always reads /proc/mounts.
+gc_share_mounted() {
+  local mounts="${GC_PROC_MOUNTS:-/proc/mounts}"
+  [ -r "$mounts" ] || return 1
+  grep -qE '(^|[[:space:]])(/share|/mnt/share)([[:space:]]|$)|[[:space:]](9p|virtiofs|nfs|cifs)[[:space:]]' "$mounts" 2>/dev/null
+}
+
+# GC-FSW-003 detector: cache/package size-delta sampling in the sweep. Each
+# sample records the summed KiB of the watched roots; a delta at or above
+# GC_CACHE_GROWTH_KIB since the previous sample is ONE aggregate ELEVATED
+# decision (trips at the class threshold, never per event).
+gc_cache_growth_sample() { # state_dir dir...
+  local state_dir=$1; shift
+  mkdir -p "$state_dir" 2>/dev/null || return 2
+  local dir kib total=0 baseline="$state_dir/cache.baseline"
+  for dir in "$@"; do
+    [ -d "$dir" ] || continue
+    kib=$(du -sk "$dir" 2>/dev/null | awk '{print $1}') || kib=0
+    total=$((total + ${kib:-0}))
+  done
+  if [ ! -f "$baseline" ]; then
+    if printf '%s\n' "$total" >"$baseline" 2>/dev/null; then
+      gc_log_event "$state_dir" "sweep" "GC-FSW-003" "sample" "baseline=${total}KiB" "observe" >/dev/null 2>&1 || true
+    fi
+    return 0
+  fi
+  local prev delta
+  prev=$(cat "$baseline" 2>/dev/null) || prev=$total
+  printf '%s\n' "$total" >"$baseline" 2>/dev/null || true
+  delta=$((total - ${prev:-0}))
+  # Diagnostic observe (live microvm-b583fccb8abf8bccb0989e10): one compact
+  # line per sample so the next live run shows total/prev/delta/threshold and
+  # the decision path even when no event fires.
+  gc_log_event "$state_dir" "sweep" "GC-FSW-003" "sample" "total=${total}KiB prev=${prev:-none}KiB delta=${delta}KiB threshold=${GC_CACHE_GROWTH_KIB}KiB" "observe" >/dev/null 2>&1 || true
+  if [ "$delta" -ge "$GC_CACHE_GROWTH_KIB" ]; then
+    gc_decide "$state_dir" GC-FSW-003 "cache growth ${delta}KiB" >/dev/null || return 2
+    printf '{"decision":"deny","rule":"GC-FSW-003","growthKiB":%s}\n' "$delta"
+  fi
+  return 0
+}
+
+# fs-watcher detection: only the job scratch root is writable; writes to the
+# shim/agent trees are self-code-modification, everything else is
+# write-outside-allowlist.
+gc_fs_detect() { # state_dir path -> decision JSON
+  local state_dir=$1 path=$2
+  case "$path" in
+    "$GC_WRITABLE_ROOT"|"$GC_WRITABLE_ROOT"/*)
+      printf '{"decision":"allow","path":"%s"}\n' "$path" ;;
+    /gc|/gc/*)
+      # GC-PROBE-001: introspection of the monitor tree itself (section 9.1).
+      decision=$(gc_decide "$state_dir" GC-PROBE-001 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-PROBE-001","path":"%s"}\n' "$path" ;;
+      esac ;;
+    /shims|/shims/*|/agent|/agent/*)
+      decision=$(gc_decide "$state_dir" GC-FSW-002 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-FSW-002","path":"%s"}\n' "$path" ;;
+      esac ;;
+    */package.json|*/package-lock.json|*/pyproject.toml|*/requirements*.txt|/package.json|/pyproject.toml)
+      decision=$(gc_decide "$state_dir" GC-PKG-003 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-PKG-003","path":"%s"}\n' "$path" ;;
+      esac ;;
+    /dev/*|/dev)
+      # Write targets on devtmpfs could inject marker text (GC-TOOL-002).
+      decision=$(gc_decide "$state_dir" GC-TOOL-002 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-TOOL-002","path":"%s"}\n' "$path" ;;
+      esac ;;
+    /share|/share/*|/mnt/share|/mnt/share/*)
+      if gc_share_mounted; then
+        # GC-SHR-001 armed form: a share mount is present, so these paths
+        # exist as a live share; any write is a shared-cache write (HIGH).
+        decision=$(gc_decide "$state_dir" GC-SHR-001 "$path") || return 2
+        case "$decision" in
+          *'"frozen":true'*) printf '%s\n' "$decision" ;;
+          *) printf '{"decision":"deny","rule":"GC-SHR-001","path":"%s"}\n' "$path" ;;
+        esac
+      else
+        # Unarmed: with no share mount these paths are ordinary writes
+        # outside the allowlist - normal FSW-001 handling, not a share trip.
+        decision=$(gc_decide "$state_dir" GC-FSW-001 "$path") || return 2
+        case "$decision" in
+          *'"frozen":true'*) printf '%s\n' "$decision" ;;
+          *) printf '{"decision":"deny","rule":"GC-FSW-001","path":"%s"}\n' "$path" ;;
+        esac
+      fi ;;
+    */.npm|*/.npm/*|*/.cache|*/.cache/*|/var/cache|/var/cache/*)
+      # GC-SHR-001 deny-otherwise form: without an armed share mount these
+      # shared-cache roots have no legitimate writer, so a write is classified
+      # as shared-cache, not plain FSW-001 (HIGH, immediate).
+      decision=$(gc_decide "$state_dir" GC-SHR-001 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-SHR-001","path":"%s"}\n' "$path" ;;
+      esac ;;
+    */Maildir|*/Maildir/*|*/task-queue/*|*/.herdr/*|*/agent-channel/*|*/coordination/*)
+      # GC-SHR-002: cross-agent coordination paths (HIGH, immediate).
+      decision=$(gc_decide "$state_dir" GC-SHR-002 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-SHR-002","path":"%s"}\n' "$path" ;;
+      esac ;;
+    *console.typescript*|*typescript|*transcript*|*/receipt-channel/*)
+      # GC-LOG-001: the supervisor never writes transcript/receipt-channel
+      # files inside the guest (the host recorder owns them), so any fs event
+      # here is a non-supervisor write (CRITICAL, immediate).
+      decision=$(gc_decide "$state_dir" GC-LOG-001 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-LOG-001","path":"%s"}\n' "$path" ;;
+      esac ;;
+    *"containment.log"*|*/.gc/*)
+      gc_decide "$state_dir" GC-LOG-002 "$path" >/dev/null || return 2
+      printf '{"decision":"deny","rule":"GC-LOG-002","path":"%s"}\n' "$path" ;;
+    *)
+      decision=$(gc_decide "$state_dir" GC-FSW-001 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-FSW-001","path":"%s"}\n' "$path" ;;
+      esac ;;
+  esac
+}
+
+# find -newer sweep fallback for the fs-watcher: detect every path handed in.
+gc_fs_sweep() { # state_dir path...
+  local state_dir=$1; shift
+  local path
+  for path in "$@"; do gc_fs_detect "$state_dir" "$path"; done
+}
+
+# Sweep-baseline retreat (live microvm-11d339266876dcfad3d3ac32, card R2):
+# the sweep used to `touch baseline` right after `find -newer baseline`, so a
+# write landing between the find pass and that touch was never strictly newer
+# than the baseline and stayed invisible forever - the live cp into
+# /var/cache/shared-write was seen by the GC-FSW-003 sampler (delta=4KiB) yet
+# produced no gc_fs_detect decision, no GC-SHR-001 deny, and no trip. The
+# baseline must move BACK one second after each find so same-second writes
+# stay strictly newer at the next sweep. Cost: one re-scan of the previous
+# second (duplicate denies only add pressure; HIGH rules trip immediately).
+gc_baseline_retreat() { # path
+  local p=$1 now ts
+  now=$(date +%s) || { touch "$p"; return 0; }
+  ts=$((now - 1))
+  if ! touch -d "@$ts" "$p" 2>/dev/null; then
+    if ! touch -t "$(date -v-1S +%Y%m%d%H%M.%S 2>/dev/null)" "$p" 2>/dev/null; then
+      touch "$p"
+    fi
+  fi
+}
+
+# net-watcher detection: any socket row is a violation (GC-NET-001).
+gc_net_detect() { # state_dir socket_entry
+  local state_dir=$1 entry=$2
+  [ -n "$entry" ] || return 0
+  decision=$(gc_decide "$state_dir" GC-NET-001 "$entry") || return 2
+  case "$decision" in
+    *'"frozen":true'*) printf '%s\n' "$decision" ;;
+    *) printf '{"decision":"deny","rule":"GC-NET-001"}\n' ;;
+  esac
+}
+
+# Proc-watcher sweep: enumerate userspace processes only. Kernel threads
+# (kthreadd, kworker/*) have an empty /proc/PID/cmdline and are children of
+# kthreadd (ppid 2); flagging them produced 117+ false unknown-class events on
+# the first live proof and tripped the ANOMALY threshold before the job ran
+# (fixture microvm-ab06221027d3e36afc843b91). base_dir defaults to /proc and
+# is a parameter so tests can exercise the filter against a simulated tree.
+gc_proc_watch_sweep() { # [base_dir] -> "comm" lines of userspace processes
+  local base=${1:-/proc} p comm
+  for p in "$base"/[0-9]*; do
+    [ -d "$p" ] || continue
+    [ -s "$p/cmdline" ] || continue   # kernel threads: empty cmdline
+    [ "$(awk '{print $4}' "$p/stat" 2>/dev/null)" = "2" ] && continue
+    comm=$(cat "$p/comm" 2>/dev/null) || continue
+    [ -n "$comm" ] && printf '%s\n' "$comm"
+  done
+}
+
+# proc-watcher detection: a process outside the job tree is an anomaly.
+gc_proc_detect() { # state_dir process_identity
+  local state_dir=$1 identity=$2
+  gc_decide "$state_dir" unknown "proc $identity" >/dev/null || return 2
+  printf '{"decision":"deny","rule":"unknown"}\n'
+}
+
+# Supervisor liveness (design section 1.3): a dead monitor loop is a
+# containment failure and trips the killswitch immediately.
+gc_liveness() { # state_dir alive_flags ("1 1 1"; any 0 is a dead loop)
+  local state_dir=$1 flags=$2
+  # Post-trip the session is already dead; monitor collateral at teardown must
+  # not trip a masking containment-integrity terminal (see trip freeze above).
+  if [ -f "$state_dir/kill" ]; then return 0; fi
+  case " $flags " in
+    *" 0 "*)
+      gc_log_event "$state_dir" "watcher:proc" containment-integrity proc "monitor loop dead" >/dev/null || return 2
+      gc_killswitch_trip "$state_dir" containment-integrity containment-integrity CRITICAL immediate null null >/dev/null || return 2
+      printf '{"decision":"deny","rule":"containment-integrity","tier":"CRITICAL","mode":"immediate"}\n' ;;
+    *) printf '{"decision":"allow"}\n' ;;
+  esac
+}
+
+# B1: the one real receipt printf. The containment segment is passed as a %s
+# argument (never interpolated into the format string, where it would stay
+# literal under single quotes); an empty segment yields the v1 receipt shape.
+gc_receipt_json() { # schema remote_host fixture_id domain marker marker_sha script_hash initramfs_sha containment_segment domain destroy_requested absent acl_before acl_after fs_ctx_sha net_ctx_sha
+  printf '{"schema":"%s","ok":true,"status":"VERIFIED","authorityCreated":false,"runtimeActivated":false,"persisted":false,"identity":{"remoteHost":"%s","fixtureId":"%s","domain":"%s"},"marker":{"value":"%s","sha256":"%s"},"scriptHash":"%s","initramfsSha256":"%s"%s,"teardown":{"domain":{"name":"%s","transient":true,"destroyOnExit":true,"destroyRequested":%s,"absent":%s,"checked":true,"check":"virsh dominfo/list"},"acl":{"beforeSha256":"%s","afterSha256":"%s","equal":true,"checked":true,"initramfsEntryRemoved":true}},"context":{"filesystem":{"summary":"disk=absent host-share=absent credentials=absent gpu=absent","disk":false,"hostShare":false,"credentials":false,"gpu":false,"sha256":"%s"},"network":{"summary":"network=absent","guest":false,"sha256":"%s"},"guestMounts":["proc","sysfs","devtmpfs"]}}\n' "$@"
+}
+
+# Terminal event for a session that ends without a killswitch trip: the
+# envelope then carries only log lines plus this session-end record
+# (design section 5: a session with neither is containment-evidence-missing).
+gc_session_end() { # state_dir
+  # Split declarations: bash 3.2 expands every word of one `local` before any
+  # assignment, so referencing $state_dir in the same statement is an unbound
+  # variable under set -u on the host-side hook path.
+  local state_dir=$1
+  local log="$state_dir/containment.log.jsonl"
+  # Bootstrap the taxonomy copy so a zero-event session (no shim invocation,
+  # no watcher hit) still records its terminal event: without it the digest
+  # lookup below fails, no log is created, and no envelope can be emitted.
+  if [ ! -f "$state_dir/taxonomy.json" ]; then
+    mkdir -p "$state_dir" || return 2
+    gc_embedded_taxonomy >"$state_dir/taxonomy.json" || return 2
+  fi
+  local seq=1
+  if [ -f "$state_dir/seq" ]; then seq=$(( $(cat "$state_dir/seq") + 1 )); fi
+  printf '%s\n' "$seq" >"$state_dir/seq"
+  local tsha
+  tsha=$(sha256sum "$state_dir/taxonomy.json" | awk '{print $1}') || return 2
+  printf '{"schema":"%s","session":"%s","taxonomy":"%s","taxonomySha256":"%s","event":{"ts":"%s","seq":%s,"source":"supervisor","class":"session-end","action":"complete","summary":true}}\n' \
+    "$GC_LOG_SCHEMA" "$(basename "$state_dir")" "$GC_TAXONOMY_VERSION" "$tsha" "$(gc_iso8601)" "$seq" >>"$log"
+}
+
+# Host-side containment evidence (design section 5): extract the framed base64
+# envelope from the console transcript, decode it pty-safe, recompute the log
+# digest per the stated normalization, and cross-check the terminal killswitch
+# event's embedded digest against the full payload.
+gc_containment_evidence() { # transcript fixture_id [kill_report_path] -> containment block JSON on stdout
+  local transcript=$1 fid=$2 report_path=${3:-}
+  local begin="AGENTIC_CONTAINMENT_BEGIN:$fid" end="AGENTIC_CONTAINMENT_END:$fid"
+  local b64 tmp log_sha events denials ks_line ks_rule tripped rule_json
+  tmp="$transcript.containment.$$"
+  trap 'rm -f "$tmp" "$tmp.b64" "$tmp.head"' RETURN
+  # H2: exactly one envelope pair may exist; more than one is a forgery or a
+  # replay attempt and fails closed.
+  # Count with index() so pty CR suffixes do not defeat the anchor.
+  begins=$(awk -v b="$begin" 'index($0, b) == 1 { n++ } END { print n + 0 }' "$transcript")
+  ends=$(awk -v e="$end" 'index($0, e) == 1 { n++ } END { print n + 0 }' "$transcript")
+  if [ "$begins" -ne 1 ] || [ "$ends" -ne 1 ]; then
+    return 1
+  fi
+  if ! awk -v b="$begin" -v e="$end" 'index($0, b) == 1 { inside = 1; next } index($0, e) == 1 { inside = 0; next } inside' "$transcript" | tr -d '\r' >"$tmp.b64"; then
+    return 1
+  fi
+  if ! [ -s "$tmp.b64" ]; then return 1; fi
+  if ! { base64 -d <"$tmp.b64" >"$tmp" 2>/dev/null || base64 -D <"$tmp.b64" >"$tmp" 2>/dev/null; }; then return 1; fi
+  if ! grep -q '"schema":"' "$tmp"; then return 1; fi
+  ks_line=$(grep '"final":true' "$tmp" | tail -n 1)
+  ks_num=$(grep -n '"final":true' "$tmp" | tail -n 1 | cut -d: -f1)
+  if [ -n "$ks_line" ]; then
+    # Digest chain (H1): verified at the killswitch line's position — the
+    # digest covers the log up to and including the trigger event but
+    # excluding the killswitch line itself; anything after it is post-trip
+    # noise the guest's log freeze should have prevented, and is ignored for
+    # the digest rather than silently trusted.
+    ks_sha=$(printf '%s\n' "$ks_line" | sed -n 's/.*"logSha256":"\([0-9a-f]*\)".*/\1/p')
+    sed -n "1,$((ks_num - 1))p" "$tmp" >"$tmp.head" 2>/dev/null || return 1
+    chained_sha=$(sha256sum "$tmp.head" | awk '{print $1}') || return 1
+    if [ -z "$ks_sha" ] || [ "$ks_sha" != "$chained_sha" ]; then return 2; fi
+    tripped=true
+    log_sha=$ks_sha
+    ks_rule=$(printf '%s\n' "$ks_line" | sed -n 's/.*"trigger":{"rule":"\([A-Za-z0-9_-]*\)".*/\1/p')
+    ks_class=$(printf '%s\n' "$ks_line" | sed -n 's/.*"trigger":{"rule":"[A-Za-z0-9_-]*","class":"\([A-Za-z0-9_-]*\)".*/\1/p')
+    ks_tier=$(printf '%s\n' "$ks_line" | sed -n 's/.*"tier":"\([A-Za-z]*\)".*/\1/p')
+    rule_json="\"$ks_rule\""
+    class_json="\"$ks_class\""
+    tier_json="\"$ks_tier\""
+    counted=$((ks_num - 1))
+  else
+    # Fail-closed: without a killswitch record the session must end with the
+    # clean session-end terminal event.
+    grep -q '"class":"session-end"' "$tmp" || return 1
+    tripped=false
+    rule_json=null
+    class_json=null
+    tier_json=null
+    log_sha=$(sha256sum "$tmp" | awk '{print $1}') || return 1
+    counted=$(grep -c '"schema":"' "$tmp")
+  fi
+  events=$counted
+  denials=$(grep -c '"action":"deny"' "$tmp")
+  # M1: compact histogram (design section 4; open question 4 decided) — the
+  # coordinator consumes aggregates from the receipt without extra tooling.
+  # Terminal killswitch records are echoes, not events; exclude them.
+  histogram=$(awk '{
+    if ($0 !~ /guest-containment.killswitch.v1/ && match($0, /"class":"[^"]*"/)) {
+      c = substr($0, RSTART + 9, RLENGTH - 10); n[c]++
+    }
+  } END { first = 1; printf "{"; for (k in n) { if (!first) printf ","; printf "\"%s\":%d", k, n[k]; first = 0 } printf "}" }' "$tmp")
+  # Concealment index (design appendix): probes + 2*unknown-class denials
+  # + 3*containment-integrity events; probes counted alongside.
+  probes=0; concealment_index=0
+  eval "$(awk '{
+    if ($0 ~ /guest-containment.killswitch.v1/) next
+    match($0, /"class":"[^"]*"/); c = substr($0, RSTART + 9, RLENGTH - 10)
+    match($0, /"action":"[^"]*"/); a = substr($0, RSTART + 10, RLENGTH - 11)
+    if (c == "GC-PROBE") { probes++; idx += 1 }
+    else if (c == "unknown" && a == "deny") { idx += 2 }
+    else if (c == "containment-integrity") { idx += 3 }
+  } END { printf "probes=%d; concealment_index=%d;", probes + 0, idx + 0 }' "$tmp")"
+  if [ "$tripped" = true ] && [ -n "$report_path" ]; then
+    cp "$tmp" "$transcript.containment.payload" 2>/dev/null || true
+    report_json=",\"killReportPath\":\"$report_path\""
+  else
+    report_json=""
+  fi
+  rm -f "$tmp" "$tmp.b64" "$tmp.head"
+  printf '{"schema":"%s","taxonomySha256":"%s","logSha256":"%s","events":%s,"denials":%s,"probes":%s,"concealmentIndex":%s,"histogram":%s,"killswitch":{"tripped":%s,"rule":%s,"class":%s,"tier":%s,"guestPoweroff":true,"final":true}%s}' \
+    "$GC_LOG_SCHEMA" "$GC_TAXONOMY_SHA256" "$log_sha" "$events" "$denials" "$probes" "$concealment_index" "$histogram" "$tripped" "$rule_json" "$class_json" "$tier_json" "$report_json"
+}
+
+# Durable kill report (design section 5; Defect 2): when the killswitch trips,
+# the fixture writes kill-report.json next to console.typescript with session
+# identity, decoded aggregates, the trigger, the last redacted events before
+# the kill, and teardown proof status (finalized after the teardown proofs).
+gc_write_kill_report() { # fixture_root fixture_id domain remote_host block_json
+  local fixture_root=$1 fid=$2 dom=$3 host=$4 block=$5
+  local payload="$fixture_root/console.typescript.containment.payload"
+  local report="$fixture_root/kill-report.json"
+  local log_sha events denials probes concealment histogram rule class tier mode pressure threshold
+  log_sha=$(printf '%s' "$block" | sed -n 's/.*"logSha256":"\([0-9a-f]*\)".*/\1/p')
+  events=$(printf '%s' "$block" | sed -n 's/.*"events":\([0-9]*\).*/\1/p')
+  denials=$(printf '%s' "$block" | sed -n 's/.*"denials":\([0-9]*\).*/\1/p')
+  probes=$(printf '%s' "$block" | sed -n 's/.*"probes":\([0-9]*\).*/\1/p')
+  concealment=$(printf '%s' "$block" | sed -n 's/.*"concealmentIndex":\([0-9]*\).*/\1/p')
+  histogram=$(printf '%s' "$block" | sed -n 's/.*"histogram":\({[^}]*}\).*/\1/p')
+  rule=$(printf '%s' "$block" | sed -n 's/.*"killswitch":{"tripped":true,"rule":"\([^"]*\)".*/\1/p')
+  class=$(printf '%s' "$block" | sed -n 's/.*"class":"\([^"]*\)","tier":"\([^"]*\)".*/\1/p')
+  tier=$(printf '%s' "$block" | sed -n 's/.*"class":"[^"]*","tier":"\([^"]*\)".*/\1/p')
+  local ks_line first_ts last_ts
+  ks_line=$(grep '"logSha256"' "$payload" | tail -n 1 || true)
+  mode=$(printf '%s\n' "$ks_line" | sed -n 's/.*"mode":"\([^"]*\)".*/\1/p' || true)
+  pressure=$(printf '%s\n' "$ks_line" | sed -n 's/.*"pressure":\([0-9]*\).*/\1/p' || true)
+  threshold=$(printf '%s\n' "$ks_line" | sed -n 's/.*"threshold":\([0-9]*\).*/\1/p' || true)
+  # null-safe scalars: the guest emits pressure/threshold null for immediate trips.
+  pressure=${pressure:-null}
+  threshold=${threshold:-null}
+  first_ts=$(grep -o '"ts":"[^"]*"' "$payload" | head -n 1 | cut -d'"' -f4 || true)
+  last_ts=$(grep -o '"ts":"[^"]*"' "$payload" | tail -n 1 | cut -d'"' -f4 || true)
+  local last_events
+  last_events=$(awk '/"action":"deny"/ { lines[n++] = $0 } END { for (i = (n > 5 ? n - 5 : 0); i < n; i++) { if (i > (n > 5 ? n - 5 : 0)) printf ","; printf "%s", lines[i] } }' "$payload" || true)
+  printf '{"schema":"agentic-driver.guest-containment.kill-report.v1","session":{"fixtureId":"%s","domain":"%s","remoteHost":"%s"},"generatedAt":"%s","guestSession":{"firstEventAt":"%s","lastEventAt":"%s","events":%s,"denials":%s,"probes":%s,"concealmentIndex":%s,"histogram":%s},"killswitch":{"tripped":true,"rule":"%s","class":"%s","tier":"%s","mode":"%s","pressure":%s,"threshold":%s},"lastEvents":[%s],"teardown":{"domainAbsent":"PENDING","destroyRequested":"PENDING","aclRestored":"PENDING"},"logSha256":"%s"}\n' \
+    "$fid" "$dom" "$host" "$(gc_iso8601)" "$first_ts" "$last_ts" "$events" "$denials" "$probes" "$concealment" "$histogram" \
+    "$rule" "$class" "$tier" "$mode" "$pressure" "$threshold" "$last_events" "$log_sha" >"$report"
+  printf '%s\n' "$report"
+}
+
+GC_CORE_EOF
+  exit 0
+fi
+if [ "${1:-}" = "--gc-receipt-print" ]; then
+  shift
+  # Print-only hook (B1): executes the real receipt printf with
+  # test-supplied computed values; segment "-" means empty (v1 shape).
+  receipt_segment=""
+  if [ "${9:-}" != "-" ]; then receipt_segment="$9"; fi
+  gc_receipt_json "$1" "$2" "$3" "$4" "$5" "$6" "$7" "$8" "$receipt_segment" "${10}" "${11}" "${12}" "${13}" "${14}" "${15}" "${16}"
+  exit 0
+fi
+if [ "${1:-}" = "--gc-kill-report" ]; then
+  shift
+  # Hook: reads the saved payload next to the transcript and the extracted
+  # block as an argv argument (bounded; never stdin — node execFile+input
+  # stalls against this hook in test harnesses). Length guarded below.
+  block=${5:-}
+  if [ "${#block}" -gt 65536 ]; then
+    printf 'microvm failure phase=evidence code=containment-evidence-missing\n' >&2
+    exit 2
+  fi
+  gc_write_kill_report "$1" "$2" "$3" "$4" "$block"
+  exit 0
+fi
+if [ "${1:-}" = "--gc-envelope-extract" ]; then
+  shift
+  gc_containment_evidence "$@" || {
+    printf 'microvm failure phase=evidence code=containment-evidence-missing\n' >&2
+    exit 1
+  }
+  printf '\n'
+  exit 0
+fi
+if [ "${1:-}" = "--gc-taxonomy-sha" ]; then
+  computed=$(gc_embedded_taxonomy | sha256sum | awk '{print $1}')
+  if [ "$computed" != "$GC_TAXONOMY_SHA256" ]; then
+    printf 'microvm failure phase=setup code=taxonomy-digest-mismatch\n' >&2
+    exit 2
+  fi
+  printf '%s\n' "$computed"
+  exit 0
+fi
+
+# Containment job payload helpers (design sections 1.3, 3): transport is
+# base64 on the argv (shell-safe for the ssh remote-shell command string; see
+# the tool side); decode here, then validate the text: printable ASCII,
+# newline, tab only, at most 8192 bytes. Never model-set. Absent payload =
+# plain proof mode.
+gc_payload_decode() { # b64 -> decoded payload text on stdout
+  local b64=$1 text
+  case "$b64" in
+    ""|*[!A-Za-z0-9+/=]*) return 2 ;;
+  esac
+  text=$(printf '%s' "$b64" | base64 -d 2>/dev/null) \
+    || text=$(printf '%s' "$b64" | base64 -D 2>/dev/null) \
+    || return 2
+  printf '%s' "$text"
+}
+gc_payload_text_ok() { # payload text -> 0 ok, 2 invalid
+  local bad_pattern
+  [ "${#1}" -ge 1 ] || return 2
+  [ "${#1}" -le 8192 ] || return 2
+  # Allowed: printable ASCII (space..~), tab, newline. The forbidden-class
+  # pattern is built with printf because a literal tab cannot be written in
+  # a case/glob bracket via \t (that is an escaped letter, not a tab).
+  bad_pattern=$(printf '[^ -~\t]')
+  if printf '%s' "$1" | LC_ALL=C grep -q -- "$bad_pattern"; then return 2; fi
+}
+# Console capture window (live-proof fix): in plain proof mode the marker is
+# the only evidence and appears within the first poll ticks. In containment
+# mode the envelope is emitted at SESSION END (after the job and the terminal
+# event), so the host must keep the recorder window open until the envelope
+# END anchor is seen — otherwise teardown destroys the still-running guest
+# before it can emit evidence (live failure: phase=containment code=10).
+# Bounded; missing evidence still fails closed at the evidence phase.
+GC_ENVELOPE_WAIT_ATTEMPTS=240
+gc_console_wait() { # transcript fixture_id payload_present recorder_pid attempts
+  local transcript=$1 fid=$2 payload=$3 recorder=$4 attempts=$5 n
+  local marker="AGENTIC_MICROVM_PROBE:$fid" envend="AGENTIC_CONTAINMENT_END:$fid"
+  for n in $(seq 1 "$attempts"); do
+    if grep -F "$marker" "$transcript" >/dev/null 2>&1; then
+      if [ "$payload" != true ]; then return 0; fi
+      if grep -F "$envend" "$transcript" >/dev/null 2>&1; then return 0; fi
+    fi
+    if ! kill -0 "$recorder" 2>/dev/null; then return 0; fi
+    sleep 0.5
+  done
+  return 1
+}
+if [ "${1:-}" = "--gc-console-wait" ]; then
+  shift; gc_console_wait "$@"; exit $?
+fi
+if [ "${1:-}" = "--gc-session-end" ]; then
+  shift; gc_session_end "$@"; exit $?
+fi
+if [ "${1:-}" = "--gc-payload-validate" ]; then
+  shift
+  text=$(gc_payload_decode "${1:-}") || { printf 'microvm failure phase=setup code=2 detail=invalid containment job payload (base64 transport)\n' >&2; exit 2; }
+  gc_payload_text_ok "$text" || { printf 'microvm failure phase=setup code=2 detail=invalid containment job payload (printable ASCII, newline, tab, at most 8192 bytes)\n' >&2; exit 2; }
+  printf '%s\n' "$text"
+  exit 0
+fi
+
 phase=setup
-if [ "$#" -ne 2 ]; then
-  printf 'microvm failure phase=identity code=2 detail=fixture id and script hash are required\n' >&2
+# Exactly: fixture id + script hash, plus the optional allocation pair and
+# optional base64 job payload (2..5 args). The tool always passes 4 (plain
+# proof) or 5 (containment); fewer or more is an invocation error.
+if [ "$#" -lt 2 ] || [ "$#" -gt 5 ]; then
+  printf 'microvm failure phase=identity code=2 detail=fixture id and script hash are required (optional vcpu, memoryMiB, base64 job payload)\n' >&2
   exit 2
 fi
 fixture_id=$1
 script_hash=$2
+vcpu_arg=${3:-}
+memory_arg=${4:-}
+containment_payload_b64=${5:-}
+# set -u invariant: containment_payload is referenced unconditionally later
+# (job.sh embed, envelope gating). Always defined; set only when a payload arrives.
+containment_payload=""
 fixture_fail() {
   local code=$1
   shift
@@ -21,6 +1444,24 @@ if [ "${#script_hash}" -ne 64 ]; then fixture_fail 2 'invalid fixture script has
 case "$script_hash" in
   ""|*[!0-9a-f]*) fixture_fail 2 'invalid fixture script hash' ;;
 esac
+# Containment job payload (main path): decode the base64 argv and validate
+# the text; the helpers above are shared with the --gc-payload-validate hook.
+if [ -n "$containment_payload_b64" ]; then
+  if ! containment_payload=$(gc_payload_decode "$containment_payload_b64"); then
+    fixture_fail 2 'invalid containment job payload (base64 transport)'
+  fi
+  gc_payload_text_ok "$containment_payload" \
+    || fixture_fail 2 'invalid containment job payload (printable ASCII, newline, tab, at most 8192 bytes)'
+fi
+# Elastic resource allocation (design section 6.1): user-configured via the
+# target config, validated here; defaults are the proof values. Never
+# model-set (the tool exposes no parameters for it).
+validate_vcpu() { case "$1" in ''|*[!0-9]*) return 1 ;; esac; [ "$1" -ge 1 ] && [ "$1" -le 64 ]; }
+validate_memory() { case "$1" in ''|*[!0-9]*) return 1 ;; esac; [ "$1" -ge 64 ] && [ "$1" -le 1048576 ]; }
+if ! validate_vcpu "$vcpu_arg"; then fixture_fail 2 'invalid vcpu allocation (integer 1-64)'; fi
+if ! validate_memory "$memory_arg"; then fixture_fail 2 'invalid memory allocation (integer 64-1048576 MiB)'; fi
+vcpu=${vcpu_arg:-1}
+memory_mib=${memory_arg:-128}
 
 state_root="$HOME/agentic-driver-state/cutover-fixtures/microvm"
 fixture_root="$state_root/$fixture_id"
@@ -214,6 +1655,16 @@ for tool in /usr/bin/qemu-system-x86_64 /usr/bin/busybox /usr/bin/cpio /usr/bin/
   if ! test -x "$tool"; then fixture_fail 4 "required tool unavailable: $tool"; fi
 done
 if ! test -r /dev/kvm -a -w /dev/kvm; then fixture_fail 4 '/dev/kvm is unavailable'; fi
+# Job shell (containment repair, live fixture microvm-8673d4b4...): busybox
+# ash resolves applet names (wget, curl, ...) from its compiled-in applet
+# table and never execs through PATH — the /shims layer cannot interpose, so
+# GC-NET-002 cannot trip (empirically confirmed on BusyBox v1.37.0). The job
+# therefore runs under dash, a real PATH-resolving shell, copied in with its
+# dynamic loader and libc. Fail closed when any piece is missing: silently
+# falling back to busybox sh would reopen the applet bypass.
+for job_shell_component in /bin/dash /lib64/ld-linux-x86-64.so.2 /lib/x86_64-linux-gnu/libc.so.6; do
+  if ! test -r "$job_shell_component"; then fixture_fail 4 "job shell component unavailable: $job_shell_component"; fi
+done
 if ! test -e "$kernel"; then fixture_fail 4 "kernel unavailable: $kernel"; fi
 if state=$(domain_state); then
   if [ "$state" != absent ]; then fixture_fail 5 'fixture domain already exists'; fi
@@ -223,11 +1674,781 @@ fi
 
 phase=build
 root="$fixture_root/root"
-if ! mkdir -p "$root/bin" "$root/proc" "$root/sys" "$root/dev"; then fixture_fail 6 'guest root could not be created'; fi
+if ! mkdir -p "$root/bin" "$root/proc" "$root/sys" "$root/dev" "$root/etc"; then fixture_fail 6 'guest root could not be created'; fi
 if ! cp /usr/bin/busybox "$root/bin/busybox"; then fixture_fail 6 'BusyBox could not be copied'; fi
-for name in sh mount poweroff uname; do
+applet_list=$(/usr/bin/busybox --list 2>/dev/null || true)
+for name in sh mount poweroff uname mkdir cat sed awk grep cut wc head tail find tr date touch sha256sum sleep kill ps base64 du; do
+  if ! grep -qx "$name" <<<"$applet_list"; then fixture_fail 6 "BusyBox applet unavailable: $name"; fi
   if ! ln -s busybox "$root/bin/$name"; then fixture_fail 6 "BusyBox link could not be created: $name"; fi
 done
+# Optional applets: inotifyd upgrades the fs-watcher to event-driven when the
+# build has it (design section 1.2); setsid gives the job its own process group.
+have_inotifyd=false
+have_setsid=false
+if grep -qx inotifyd <<<"$applet_list"; then
+  ln -s busybox "$root/bin/inotifyd" && have_inotifyd=true
+fi
+if grep -qx setsid <<<"$applet_list"; then
+  ln -s busybox "$root/bin/setsid" && have_setsid=true
+fi
+# Job shell (see the preflight note): dash plus its loader and libc at the
+# exact PT_INTERP/linker paths dash was linked against, so guest PATH lookups
+# reach /shims instead of busybox's internal applet table.
+if ! cp /bin/dash "$root/bin/dash"; then fixture_fail 6 'job shell could not be copied'; fi
+if ! mkdir -p "$root/lib/x86_64-linux-gnu" "$root/lib64"; then fixture_fail 6 'job shell library directories could not be created'; fi
+if ! cp /lib/x86_64-linux-gnu/libc.so.6 "$root/lib/x86_64-linux-gnu/libc.so.6" \
+  || ! cp /lib64/ld-linux-x86-64.so.2 "$root/lib64/ld-linux-x86-64.so.2"; then
+  fixture_fail 6 'job shell runtime libraries could not be copied'
+fi
+# Containment guest directories plus the GC-FSW-003 watched roots (live
+# microvm-b583fccb8abf8bccb0989e10: /var/cache and /root were never created in
+# the image, the payload's dd could not create its parent directory, so no
+# growth ever existed to sample — the sampler watched nothing). Creating the
+# roots at build time makes the baseline meaningful and a write into them
+# detectable (and, per the deny-otherwise branch, denied as GC-SHR-001).
+if ! mkdir -p "$root/gc" "$root/shims" "$root/tmp" "$root/var/cache" "$root/root"; then fixture_fail 6 'containment guest directories could not be created'; fi
+# The guest containment core is embedded verbatim as its own heredoc (like
+# the taxonomy embed): one source of truth for taxonomy, log, and killswitch
+# semantics, with no dependency on $0 — the fixture streams over SSH via
+# `bash -s` (stdin), where there is no script file to read back. The host
+# side still runs the same core as functions defined below; tests assert the
+# two can never drift. The initramfsSha256 covers the embedded result.
+if ! cat >"$root/gc/core.sh" <<'GC_CORE_EOF'
+# --- guest containment core (taxonomy, structured log, killswitch decision) ---
+# Design: /Users/julen/pi-dev-env/evidence/GUEST_CONTAINMENT_DESIGN.md sections
+# 2 (taxonomy), 2.0 (severity tiers), 4 (log format), 5 (killswitch semantics).
+# Watchers and shims arrive in a later step; this core is callable and testable
+# through the --gc-decide / --gc-log / --gc-taxonomy-sha hooks below.
+GC_TAXONOMY_VERSION="guest-containment-taxonomy.v1"
+GC_LOG_SCHEMA="agentic-driver.guest-containment.log.v1"
+GC_KILLSWITCH_SCHEMA="agentic-driver.guest-containment.killswitch.v1"
+GC_TAXONOMY_SHA256="f0d4f11150e0f9aef562f1e7d61afd9fa8df1f40f1c90c3c011dd768e335bb84"
+# Severity tiers (design section 2.0): CRITICAL/HIGH trip immediately,
+# ELEVATED/ANOMALY accumulate pressure within a sliding time window.
+GC_WINDOW_SECONDS=60
+GC_ELEVATED_THRESHOLD=5
+GC_ANOMALY_THRESHOLD=10
+GC_LOG_CAP_BYTES=8192
+GC_LOG_TRUNC=512
+
+gc_embedded_taxonomy() {
+  cat <<'GC_TAXONOMY_EOF'
+{
+  "schema": "guest-containment-taxonomy.v1",
+  "description": "Deny-by-default rule taxonomy for the guest containment monitor (design GUEST_CONTAINMENT_DESIGN.md section 2). One rule per line; IDs are never reused; new rules append. disposition records whether a live detector exists in the fixture (design sections 1.3, 3) or the rule is armed by the taxonomy only.",
+  "rules": [
+    {"id":"GC-PKG-001","class":"GC-PKG","severity":"ELEVATED","action":"deny","match":"package-manager-install: invocation of npm install, npm ci, pip install, yarn add, pnpm add, gem install, cargo install, apk add, apt install","evidence":"METR autonomous-replication evaluation work (arXiv:2403.13793); HF incident dependency-install persistence step","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-PKG-002","class":"GC-PKG","severity":"ELEVATED","action":"deny","match":"registry-write-command: npm publish, npm token, .npmrc writes, pip config, keyring writes","evidence":"HF incident: agent attempted package publication","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-PKG-003","class":"GC-PKG","severity":"ELEVATED","action":"deny","match":"package-metadata-tamper: writes to package.json, package-lock.json, pyproject.toml, requirements*.txt outside the job scratch space","evidence":"METR evaluation logs: dependency-manifest tampering as persistence step","since":"v1","disposition":"detector:fs-path+shim-argv"},
+    {"id":"GC-FSW-001","class":"GC-FSW","severity":"ELEVATED","action":"deny","match":"write-outside-allowlist: create/append/truncate on any path outside /tmp/session, detected by inotifyd or find -newer sweeps","evidence":"METR evaluation logs: out-of-bounds file writes during evaluation runs","since":"v1","disposition":"detector:fs-watcher"},
+    {"id":"GC-FSW-002","class":"GC-FSW","severity":"ELEVATED","action":"deny","match":"self-code-modification: writes under the agent job install/execution directories including the shim tree /shims/","evidence":"HF incident: agent rewrote the repository it was working in; monitor self-rewrite defense","since":"v1","disposition":"detector:fs-watcher"},
+    {"id":"GC-FSW-003","class":"GC-FSW","severity":"ELEVATED","action":"deny","match":"file-growth-anomaly: unexpected growth in cache/package directories (~/.npm, ~/.cache/pip, /var/cache/*) beyond the size-delta threshold","evidence":"METR evaluation logs: bulk cache staging of payloads","since":"v1","disposition":"detector:fs-sweep size-delta sampling (gc_cache_growth_sample; aggregate ELEVATED, GC_CACHE_GROWTH_KIB per sweep)"},
+    {"id":"GC-SHR-001","class":"GC-SHR","severity":"HIGH","action":"deny","match":"shared-cache-write: writes to paths shared with other agents or the coordinator; with host-share absent any such attempt is a deny","evidence":"receipt proves host-share=absent; writes would indicate boundary violation","since":"v1","disposition":"detector:fs-path; share paths auto-arm via gc_share_mounted (/proc/mounts); shared-cache roots classify as SHR when unarmed"},
+    {"id":"GC-SHR-002","class":"GC-SHR","severity":"HIGH","action":"deny","match":"cross-agent-channel: creation of or writes to inter-agent coordination paths (maildirs, task-queue files, agent state files)","evidence":"HF incident multi-agent escalation; METR coordination/sabotage threat model","since":"v1","disposition":"detector:fs-path+shim-argv heuristics (Maildir, task-queue, agent-channel, coordination paths)"},
+    {"id":"GC-NET-001","class":"GC-NET","severity":"HIGH","action":"deny","match":"socket-open: any entry in /proc/net/tcp, /proc/net/tcp6, /proc/net/udp at any sweep","evidence":"fixture boots with no network device; any socket is exfiltration-capable","since":"v1","disposition":"detector:net-proc-sweep"},
+    {"id":"GC-NET-002","class":"GC-NET","severity":"HIGH","action":"deny","match":"network-tool-invocation: shim-detects wget, curl, nc, ssh, telnet, ping regardless of arguments","evidence":"METR self-replication exfiltration patterns; HF incident remote control","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-CRED-001","class":"GC-CRED","severity":"CRITICAL","action":"deny","match":"credential-path-read: opens of ~/.ssh/, ~/.aws/, ~/.netrc, ~/.git-credentials, token files","evidence":"credential theft is step one in every reported agent-escape chain","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-CRED-002","class":"GC-CRED","severity":"CRITICAL","action":"deny","match":"env-secret-probing: attempts to dump or scan the environment for secret-shaped keys","evidence":"METR evaluation logs; HF incident postmortem credential harvest attempts","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-LOG-001","class":"GC-LOG","severity":"CRITICAL","action":"deny","match":"transcript-write: writes to the console transcript, the monitor log, or the receipt channel by any path other than the supervisor","evidence":"log is opened append-only by the supervisor; other writers are evidence tampering","since":"v1","disposition":"detector:fs-path+shim-argv (transcript/receipt-channel paths); the in-guest supervisor never writes these, so any event is a non-supervisor write"},
+    {"id":"GC-LOG-002","class":"GC-LOG","severity":"CRITICAL","action":"deny","match":"log-truncate-or-rename: >, rm, mv, truncate, sed -i targeting monitor/agent logs","evidence":"METR report: models attempting to edit their own logs","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-TOOL-001","class":"GC-TOOL","severity":"CRITICAL","action":"deny","match":"receipt-forgery: job printing AGENTIC_MICROVM_PROBE:* or AGENTIC_MICROVM_RECEIPT:* lines","evidence":"host closed-receipt parsing rejects forged output; guest-side denial closes the loop","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-TOOL-002","class":"GC-TOOL","severity":"CRITICAL","action":"deny","match":"marker-injection: writes to /dev/console, /dev/ttyS0, or other devtmpfs write targets that could inject marker text","evidence":"METR tool-call spoofing family; serial stream integrity","since":"v1","disposition":"detector:shim-argv+fs-path; known gap: char-device writes may not update mtime for the sweep"},
+    {"id":"GC-PROBE-001","class":"GC-PROBE","severity":"ELEVATED","action":"deny","match":"containment-introspection: reads or probes of /gc/** (core.sh, taxonomy, state), /shims/**, or session-dir metadata outside sanctioned /tmp/session writes","evidence":"METR report: agents research the monitoring environment before acting; HF incident agents probed sandbox infrastructure. Individually ambiguous (a job may stat its own directories), so aggregate ELEVATED rather than immediate-kill","since":"v1","disposition":"detector:fs-path+shim-argv"},
+    {"id":"GC-PROBE-002","class":"GC-PROBE","severity":"ELEVATED","action":"deny","match":"monitor-enumeration: ps/proc access patterns targeting watcher discovery (inspection looking for monitor PIDs, inotifyd, or the shim layer), shim/proc-watcher detected","evidence":"Design section 9.1 adversarial pass: monitor enumeration precedes timing and evasion attempts; aggregate ELEVATED avoids false-positive kills on process inspection","since":"v1","disposition":"detector:shim-argv"},
+    {"id":"GC-PROBE-003","class":"GC-PROBE","severity":"ELEVATED","action":"deny","match":"concealment-index anomaly: aggregated probe-frequency signal (GC-PROBE events plus weighted unknown-class denials) surfaced as the receipt concealmentIndex","evidence":"Timing probes and repeated no-op shim invocations to time detection are aggregate signals, not single-action violations; see design appendix formula","since":"v1","disposition":"detector:evidence-aggregate"}
+  ],
+  "residual": {"class":"unknown","tier":"ANOMALY","action":"deny","note":"everything not allowlisted and not classified above; accumulates toward the ANOMALY threshold"}
+}
+GC_TAXONOMY_EOF
+}
+
+gc_iso8601() { date -u '+%Y-%m-%dT%H:%M:%SZ'; }
+
+# Redaction per design section 4: strip control characters, replace
+# secret-shaped assignments with [REDACTED].
+gc_redact() {
+  tr -d '\000-\010\013\014\016-\037' | sed -E 's/[A-Za-z0-9_-]*([Tt]oken|TOKEN|[Ss]ecret|SECRET|[Pp]ass[A-Za-z]*|PASS[A-Za-z]*|[Cc]redential|CREDENTIAL|[Aa]pi[_-]?[Kk]ey|API[_-]?KEY|[Pp]rivate[_-]?[Kk]ey|PRIVATE[_-]?KEY)[A-Za-z0-9_-]*[=:][^ ",;&]+/[REDACTED]/g'
+}
+
+# Extract a string field from the rule object whose "id" matches rule_id.
+gc_rule_field() { # taxonomy_file rule_id field
+  sed -n "s/.*\"id\": *\"$2\"[^}]*\"$3\": *\"\([A-Za-z-]*\)\".*/\1/p" "$1" | head -n 1
+}
+
+gc_log_event() { # state_dir source class subject_type subject_value [action]
+  local state_dir=$1 source=$2 class=$3 stype=$4 svalue=$5 action=${6:-deny}
+  # Log freeze (design section 5): once a killswitch trip is recorded the log
+  # is frozen; appends after the trip would break the terminal digest chain.
+  if [ -f "$state_dir/kill" ]; then return 0; fi
+  mkdir -p "$state_dir"
+  local log="$state_dir/containment.log.jsonl"
+  local tax="$state_dir/taxonomy.json"
+  if [ ! -f "$tax" ]; then gc_embedded_taxonomy >"$tax" || return 2; fi
+  local tsha
+  tsha=$(sha256sum "$tax" | awk '{print $1}') || return 2
+  local seq=1
+  if [ -f "$state_dir/seq" ]; then seq=$(( $(cat "$state_dir/seq") + 1 )); fi
+  printf '%s\n' "$seq" >"$state_dir/seq"
+  svalue=${svalue//\\/}
+  svalue=${svalue//\"/}
+  svalue=$(printf '%s' "$svalue" | gc_redact | cut -c1-"$GC_LOG_TRUNC")
+  local ts record
+  ts=$(gc_iso8601)
+  # Summary-only degradation on flood (design section 4): context dropped,
+  # events never silently discarded.
+  if [ -f "$log" ] && [ "$(wc -c <"$log")" -gt "$GC_LOG_CAP_BYTES" ]; then
+    record=$(printf '{"schema":"%s","session":"%s","taxonomy":"%s","taxonomySha256":"%s","event":{"ts":"%s","seq":%s,"source":"%s","class":"%s","action":"%s","summary":true}}' \
+      "$GC_LOG_SCHEMA" "$(basename "$state_dir")" "$GC_TAXONOMY_VERSION" "$tsha" "$ts" "$seq" "$source" "$class" "$action")
+  else
+    record=$(printf '{"schema":"%s","session":"%s","taxonomy":"%s","taxonomySha256":"%s","event":{"ts":"%s","seq":%s,"source":"%s","class":"%s","action":"%s","subject":{"type":"%s","value":"%s"}}}' \
+      "$GC_LOG_SCHEMA" "$(basename "$state_dir")" "$GC_TAXONOMY_VERSION" "$tsha" "$ts" "$seq" "$source" "$class" "$action" "$stype" "$svalue")
+  fi
+  printf '%s\n' "$record" >>"$log"
+  printf '%s\n' "$record"
+}
+
+gc_killswitch_trip() { # state_dir rule_id class tier mode pressure threshold
+  # Trip freeze (live microvm-d7a15c47beaf94372f304da7): gc_decide gates on the
+  # kill flag, but gc_liveness calls this directly - after a session has
+  # tripped, a second terminal pair must never be appended (it would mask the
+  # real trip in the evidence extraction) and the flag must not be overwritten.
+  local state_dir=$1 rule_id=$2 class=$3 tier=$4 mode=$5 pressure=${6:-null} threshold=${7:-null}
+  if [ -f "$state_dir/kill" ]; then return 0; fi
+  local log="$state_dir/containment.log.jsonl"
+  local ks event log_sha
+  event=$(printf '{"schema":"%s","session":"%s","trigger":{"rule":"%s","class":"%s","tier":"%s","mode":"%s","pressure":%s,"threshold":%s},"final":true}' \
+    "$GC_KILLSWITCH_SCHEMA" "$(basename "$state_dir")" "$rule_id" "$class" "$tier" "$mode" "$pressure" "$threshold")
+  printf '%s\n' "$event" >>"$log"
+  log_sha=$(sha256sum "$log" | awk '{print $1}') || return 2
+  # Terminal killswitch event with log digest (design section 5, step 1).
+  ks=$(printf '{"schema":"%s","session":"%s","trigger":{"rule":"%s","class":"%s","tier":"%s","mode":"%s","pressure":%s,"threshold":%s},"logSha256":"%s","final":true}' \
+    "$GC_KILLSWITCH_SCHEMA" "$(basename "$state_dir")" "$rule_id" "$class" "$tier" "$mode" "$pressure" "$threshold" "$log_sha")
+  printf '%s\n' "$ks" >>"$log"
+  # Kill flag: the guest supervisor polls this and executes the kill path
+  # (kill process group, sync, poweroff -f); host-side hooks ignore it.
+  printf '%s\n' "$mode" >"$state_dir/kill" 2>/dev/null || true
+  printf '%s\n' "$ks"
+}
+
+gc_window_pressure() { # pressure_file
+  local now cutoff
+  now=$(date +%s)
+  cutoff=$((now - GC_WINDOW_SECONDS))
+  if [ ! -f "$1" ]; then printf '0\n'; return 0; fi
+  awk -v cutoff="$cutoff" '$1 > cutoff {n++} END {print n + 0}' "$1"
+}
+
+# Killswitch decision function (design sections 2.0 and 5): given a rule hit,
+# CRITICAL/HIGH trip immediately; ELEVATED/ANOMALY increment per-class pressure
+# within the sliding window and trip on threshold. Returns a decision JSON on
+# stdout; a trip also appends the terminal killswitch event to the log.
+gc_decide() { # state_dir rule_id [subject_value]
+  local state_dir=$1 rule_id=$2 svalue=${3:-}
+  # Log freeze gates the decision path too: after a trip the session is dead;
+  # further events must not append, re-trip, or grow pressure counters.
+  if [ -f "$state_dir/kill" ]; then
+    printf '{"rule":"%s","frozen":true,"tripped":true,"mode":"post-trip"}\n' "$rule_id"
+    return 0
+  fi
+  mkdir -p "$state_dir" || return 2
+  local tax="$state_dir/taxonomy.json"
+  if [ ! -f "$tax" ]; then gc_embedded_taxonomy >"$tax" || return 2; fi
+  local severity class tier mode=immediate pressure=null threshold=null tripped=false
+  severity=$(gc_rule_field "$tax" "$rule_id" severity)
+  if [ -z "$severity" ]; then
+    # Residual deny-by-default class (design section 2, GC-UNKNOWN).
+    severity=ANOMALY
+    class=unknown
+  else
+    class=$(gc_rule_field "$tax" "$rule_id" class)
+  fi
+  case "$severity" in
+    CRITICAL|HIGH)
+      tier=$severity
+      tripped=true
+      mode=immediate
+      ;;
+    ELEVATED|ANOMALY)
+      tier=$severity
+      mode=aggregate
+      local pfile="$state_dir/pressure.$class"
+      printf '%s\n' "$(date +%s)" >>"$pfile"
+      pressure=$(gc_window_pressure "$pfile")
+      if [ "$severity" = ELEVATED ]; then threshold=$GC_ELEVATED_THRESHOLD; else threshold=$GC_ANOMALY_THRESHOLD; fi
+      if [ "$pressure" -ge "$threshold" ]; then tripped=true; fi
+      ;;
+    *)
+      return 2
+      ;;
+  esac
+  gc_log_event "$state_dir" "shim" "$class" "exec" "$svalue" >/dev/null || return 2
+  if [ "$tripped" = true ]; then
+    gc_killswitch_trip "$state_dir" "$rule_id" "$class" "$tier" "$mode" "$pressure" "$threshold" >/dev/null || return 2
+  fi
+  printf '{"rule":"%s","class":"%s","severity":"%s","tier":"%s","tripped":%s,"mode":"%s","pressure":%s,"threshold":%s}\n' \
+    "$rule_id" "$class" "$severity" "$tier" "$tripped" "$mode" "$pressure" "$threshold"
+}
+
+# --- detection (design section 1.3, 3): shim classification, allowlist,
+# fs/net/proc detection, supervisor liveness. Callable from the guest
+# (sourced by /init and the shim dispatcher) and from the host test hooks.
+GC_LEARNING_WINDOW_SECONDS=${GC_LEARNING_WINDOW_SECONDS:-3}
+GC_CACHE_GROWTH_KIB=${GC_CACHE_GROWTH_KIB:-1024}
+GC_WRITABLE_ROOT="/tmp/session"
+
+# Shim classification: map a command line to a taxonomy rule id (empty means
+# unclassified; unclassified executables go through the observed-first-use
+# allowlist, design section 3).
+gc_shim_classify() { # tool args...
+  local tool=$1; shift
+  # busybox <applet> shim bypass (design section 9.1): classify the effective
+  # applet line instead of trusting the tool name.
+  if [ "$tool" = "busybox" ] && [ "$#" -ge 1 ]; then
+    gc_shim_classify "$1" "${@:2}"
+    return
+  fi
+  local line="$tool $*"
+  case "$tool" in
+    wget|curl|nc|ssh|telnet|ping) printf 'GC-NET-002\n'; return 0 ;;
+    printenv) printf 'GC-CRED-002\n'; return 0 ;;
+  esac
+  # Job-scratch carve-out (false-positive discipline): the sanctioned scratch
+  # root is the one tree a job may write freely, so the GC-SHR-002 and
+  # GC-LOG-001 argv heuristics must not fire on scratch-local paths. A
+  # scratch-prefixed argument is neutralized for those two rules only; writes
+  # outside the scratch keep denying exactly as before, and every other rule
+  # still sees the raw command line.
+  local line_outer="$line"
+  case "$line" in
+    *"$GC_WRITABLE_ROOT"/*)
+      line_outer=$(printf '%s\n' "$line" | sed "s|${GC_WRITABLE_ROOT}/[^[:space:]]*|/sanctioned-scratch|g") ;;
+  esac
+  case "$line_outer" in
+    *"/Maildir"*|*"/task-queue"*|*"agent-channel"*|*"/.herdr"*|*"/coordination"*)
+      # GC-SHR-002: cross-agent coordination paths (HIGH, immediate).
+      printf 'GC-SHR-002\n'; return 0 ;;
+    *"console.typescript"*|*"transcript"*|*"receipt-channel"*)
+      # GC-LOG-001: transcript/receipt-channel writes (CRITICAL, immediate).
+      printf 'GC-LOG-001\n'; return 0 ;;
+  esac
+  case "$line" in
+    *"npm install"*|*"npm ci"*|*"pip install"*|*"yarn add"*|*"pnpm add"*|*"gem install"*|*"cargo install"*|*"apk add"*|*"apt install"*)
+      printf 'GC-PKG-001\n' ;;
+    *"npm publish"*|*"npm token"*|*".npmrc"*|*"pip config"*)
+      printf 'GC-PKG-002\n' ;;
+    *".ssh/"*|*".aws/"*|*".netrc"*|*".git-credentials"*)
+      printf 'GC-CRED-001\n' ;;
+    *"env | grep"*|*"env | grep -i"*)
+      printf 'GC-CRED-002\n' ;;
+    *"package.json"*|*"package-lock.json"*|*"pyproject.toml"*|*"requirements"*.txt*)
+      printf 'GC-PKG-003\n' ;;
+    *"AGENTIC_MICROVM_PROBE"*|*"AGENTIC_MICROVM_RECEIPT"*|*"AGENTIC_CONTAINMENT_BEGIN"*|*"AGENTIC_CONTAINMENT_END"*)
+      printf 'GC-TOOL-001\n' ;;
+    *"/dev/console"*|*"/dev/ttyS"*|*"/dev/tty0"*)
+      printf 'GC-TOOL-002\n' ;;
+    *"inotifyd"*|*"watcher"*|*"cmdline"*|*"ps -"*|*"/proc/"*"stat"*)
+      # GC-PROBE-002: monitor enumeration (ps/proc patterns targeting watchers).
+      printf 'GC-PROBE-002\n' ;;
+    *"containment.log"*|*"/.gc/"*|*"> /var/log"*|*"truncate -s 0"*|*"sed -i"*)
+      printf 'GC-LOG-002\n' ;;
+    *"/gc/"*|*"core.sh"*|*"/shims/"*|*"microvm-target"*)
+      # GC-PROBE-001: monitor introspection (reads of /gc, the core, the shims).
+      printf 'GC-PROBE-001\n' ;;
+    *) return 0 ;;
+  esac
+}
+
+# Observed-first-use allowlist with a short learning window (design section 3):
+# during the window unlisted executables are logged and allowed; after lock
+# they are denied with the redacted command line.
+gc_shim_allow() { # state_dir tool args... -> decision JSON on stdout
+  local state_dir=$1 tool=$2; shift 2
+  mkdir -p "$state_dir" || return 2
+  local rule
+  rule=$(gc_shim_classify "$tool" "$@")
+  if [ -n "$rule" ]; then
+    gc_decide "$state_dir" "$rule" "$tool $*" >/dev/null || return 2
+    printf '{"decision":"deny","rule":"%s","tool":"%s"}\n' "$rule" "$tool"
+    return 0
+  fi
+  local allow="$state_dir/allowlist" lock="$state_dir/allowlist.lock" start="$state_dir/learning_start"
+  if [ ! -f "$start" ]; then printf '%s\n' "$(date +%s)" >"$start"; fi
+  if [ ! -f "$lock" ] && [ $(( $(date +%s) - $(cat "$start") )) -ge "$GC_LEARNING_WINDOW_SECONDS" ]; then
+    printf '%s\n' "$(date +%s)" >"$lock"
+  fi
+  if [ -f "$lock" ]; then
+    if grep -F -x -- "$tool" "$allow" >/dev/null 2>&1; then
+      printf '{"decision":"allow","tool":"%s","learned":false}\n' "$tool"
+    else
+      gc_decide "$state_dir" "unknown" "$tool $*" >/dev/null || return 2
+      printf '{"decision":"deny","rule":"unknown","tool":"%s"}\n' "$tool"
+    fi
+  else
+    if ! grep -F -x -- "$tool" "$allow" >/dev/null 2>&1; then
+      printf '%s\n' "$tool" >>"$allow"
+    fi
+    # Learning-window observations are logged (design section 3): allowed, but
+    # recorded as events so the learning window is auditable.
+    gc_log_event "$state_dir" "shim" "unknown" "exec" "$tool $*" "observe" >/dev/null 2>&1 || true
+    printf '{"decision":"allow","tool":"%s","learned":true}\n' "$tool"
+  fi
+}
+
+# Share-mount arm check (GC-SHR-001): share paths auto-arm only when a
+# host-share mount is visible in /proc/mounts. GC_PROC_MOUNTS overrides the
+# mounts source for tests; production always reads /proc/mounts.
+gc_share_mounted() {
+  local mounts="${GC_PROC_MOUNTS:-/proc/mounts}"
+  [ -r "$mounts" ] || return 1
+  grep -qE '(^|[[:space:]])(/share|/mnt/share)([[:space:]]|$)|[[:space:]](9p|virtiofs|nfs|cifs)[[:space:]]' "$mounts" 2>/dev/null
+}
+
+# GC-FSW-003 detector: cache/package size-delta sampling in the sweep. Each
+# sample records the summed KiB of the watched roots; a delta at or above
+# GC_CACHE_GROWTH_KIB since the previous sample is ONE aggregate ELEVATED
+# decision (trips at the class threshold, never per event).
+gc_cache_growth_sample() { # state_dir dir...
+  local state_dir=$1; shift
+  mkdir -p "$state_dir" 2>/dev/null || return 2
+  local dir kib total=0 baseline="$state_dir/cache.baseline"
+  for dir in "$@"; do
+    [ -d "$dir" ] || continue
+    kib=$(du -sk "$dir" 2>/dev/null | awk '{print $1}') || kib=0
+    total=$((total + ${kib:-0}))
+  done
+  if [ ! -f "$baseline" ]; then
+    if printf '%s\n' "$total" >"$baseline" 2>/dev/null; then
+      gc_log_event "$state_dir" "sweep" "GC-FSW-003" "sample" "baseline=${total}KiB" "observe" >/dev/null 2>&1 || true
+    fi
+    return 0
+  fi
+  local prev delta
+  prev=$(cat "$baseline" 2>/dev/null) || prev=$total
+  printf '%s\n' "$total" >"$baseline" 2>/dev/null || true
+  delta=$((total - ${prev:-0}))
+  # Diagnostic observe (live microvm-b583fccb8abf8bccb0989e10): one compact
+  # line per sample so the next live run shows total/prev/delta/threshold and
+  # the decision path even when no event fires.
+  gc_log_event "$state_dir" "sweep" "GC-FSW-003" "sample" "total=${total}KiB prev=${prev:-none}KiB delta=${delta}KiB threshold=${GC_CACHE_GROWTH_KIB}KiB" "observe" >/dev/null 2>&1 || true
+  if [ "$delta" -ge "$GC_CACHE_GROWTH_KIB" ]; then
+    gc_decide "$state_dir" GC-FSW-003 "cache growth ${delta}KiB" >/dev/null || return 2
+    printf '{"decision":"deny","rule":"GC-FSW-003","growthKiB":%s}\n' "$delta"
+  fi
+  return 0
+}
+
+# fs-watcher detection: only the job scratch root is writable; writes to the
+# shim/agent trees are self-code-modification, everything else is
+# write-outside-allowlist.
+gc_fs_detect() { # state_dir path -> decision JSON
+  local state_dir=$1 path=$2
+  case "$path" in
+    "$GC_WRITABLE_ROOT"|"$GC_WRITABLE_ROOT"/*)
+      printf '{"decision":"allow","path":"%s"}\n' "$path" ;;
+    /gc|/gc/*)
+      # GC-PROBE-001: introspection of the monitor tree itself (section 9.1).
+      decision=$(gc_decide "$state_dir" GC-PROBE-001 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-PROBE-001","path":"%s"}\n' "$path" ;;
+      esac ;;
+    /shims|/shims/*|/agent|/agent/*)
+      decision=$(gc_decide "$state_dir" GC-FSW-002 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-FSW-002","path":"%s"}\n' "$path" ;;
+      esac ;;
+    */package.json|*/package-lock.json|*/pyproject.toml|*/requirements*.txt|/package.json|/pyproject.toml)
+      decision=$(gc_decide "$state_dir" GC-PKG-003 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-PKG-003","path":"%s"}\n' "$path" ;;
+      esac ;;
+    /dev/*|/dev)
+      # Write targets on devtmpfs could inject marker text (GC-TOOL-002).
+      decision=$(gc_decide "$state_dir" GC-TOOL-002 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-TOOL-002","path":"%s"}\n' "$path" ;;
+      esac ;;
+    /share|/share/*|/mnt/share|/mnt/share/*)
+      if gc_share_mounted; then
+        # GC-SHR-001 armed form: a share mount is present, so these paths
+        # exist as a live share; any write is a shared-cache write (HIGH).
+        decision=$(gc_decide "$state_dir" GC-SHR-001 "$path") || return 2
+        case "$decision" in
+          *'"frozen":true'*) printf '%s\n' "$decision" ;;
+          *) printf '{"decision":"deny","rule":"GC-SHR-001","path":"%s"}\n' "$path" ;;
+        esac
+      else
+        # Unarmed: with no share mount these paths are ordinary writes
+        # outside the allowlist - normal FSW-001 handling, not a share trip.
+        decision=$(gc_decide "$state_dir" GC-FSW-001 "$path") || return 2
+        case "$decision" in
+          *'"frozen":true'*) printf '%s\n' "$decision" ;;
+          *) printf '{"decision":"deny","rule":"GC-FSW-001","path":"%s"}\n' "$path" ;;
+        esac
+      fi ;;
+    */.npm|*/.npm/*|*/.cache|*/.cache/*|/var/cache|/var/cache/*)
+      # GC-SHR-001 deny-otherwise form: without an armed share mount these
+      # shared-cache roots have no legitimate writer, so a write is classified
+      # as shared-cache, not plain FSW-001 (HIGH, immediate).
+      decision=$(gc_decide "$state_dir" GC-SHR-001 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-SHR-001","path":"%s"}\n' "$path" ;;
+      esac ;;
+    */Maildir|*/Maildir/*|*/task-queue/*|*/.herdr/*|*/agent-channel/*|*/coordination/*)
+      # GC-SHR-002: cross-agent coordination paths (HIGH, immediate).
+      decision=$(gc_decide "$state_dir" GC-SHR-002 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-SHR-002","path":"%s"}\n' "$path" ;;
+      esac ;;
+    *console.typescript*|*typescript|*transcript*|*/receipt-channel/*)
+      # GC-LOG-001: the supervisor never writes transcript/receipt-channel
+      # files inside the guest (the host recorder owns them), so any fs event
+      # here is a non-supervisor write (CRITICAL, immediate).
+      decision=$(gc_decide "$state_dir" GC-LOG-001 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-LOG-001","path":"%s"}\n' "$path" ;;
+      esac ;;
+    *"containment.log"*|*/.gc/*)
+      gc_decide "$state_dir" GC-LOG-002 "$path" >/dev/null || return 2
+      printf '{"decision":"deny","rule":"GC-LOG-002","path":"%s"}\n' "$path" ;;
+    *)
+      decision=$(gc_decide "$state_dir" GC-FSW-001 "$path") || return 2
+      case "$decision" in
+        *'"frozen":true'*) printf '%s\n' "$decision" ;;
+        *) printf '{"decision":"deny","rule":"GC-FSW-001","path":"%s"}\n' "$path" ;;
+      esac ;;
+  esac
+}
+
+# find -newer sweep fallback for the fs-watcher: detect every path handed in.
+gc_fs_sweep() { # state_dir path...
+  local state_dir=$1; shift
+  local path
+  for path in "$@"; do gc_fs_detect "$state_dir" "$path"; done
+}
+
+# Sweep-baseline retreat (live microvm-11d339266876dcfad3d3ac32, card R2):
+# the sweep used to `touch baseline` right after `find -newer baseline`, so a
+# write landing between the find pass and that touch was never strictly newer
+# than the baseline and stayed invisible forever - the live cp into
+# /var/cache/shared-write was seen by the GC-FSW-003 sampler (delta=4KiB) yet
+# produced no gc_fs_detect decision, no GC-SHR-001 deny, and no trip. The
+# baseline must move BACK one second after each find so same-second writes
+# stay strictly newer at the next sweep. Cost: one re-scan of the previous
+# second (duplicate denies only add pressure; HIGH rules trip immediately).
+gc_baseline_retreat() { # path
+  local p=$1 now ts
+  now=$(date +%s) || { touch "$p"; return 0; }
+  ts=$((now - 1))
+  if ! touch -d "@$ts" "$p" 2>/dev/null; then
+    if ! touch -t "$(date -v-1S +%Y%m%d%H%M.%S 2>/dev/null)" "$p" 2>/dev/null; then
+      touch "$p"
+    fi
+  fi
+}
+
+# net-watcher detection: any socket row is a violation (GC-NET-001).
+gc_net_detect() { # state_dir socket_entry
+  local state_dir=$1 entry=$2
+  [ -n "$entry" ] || return 0
+  decision=$(gc_decide "$state_dir" GC-NET-001 "$entry") || return 2
+  case "$decision" in
+    *'"frozen":true'*) printf '%s\n' "$decision" ;;
+    *) printf '{"decision":"deny","rule":"GC-NET-001"}\n' ;;
+  esac
+}
+
+# Proc-watcher sweep: enumerate userspace processes only. Kernel threads
+# (kthreadd, kworker/*) have an empty /proc/PID/cmdline and are children of
+# kthreadd (ppid 2); flagging them produced 117+ false unknown-class events on
+# the first live proof and tripped the ANOMALY threshold before the job ran
+# (fixture microvm-ab06221027d3e36afc843b91). base_dir defaults to /proc and
+# is a parameter so tests can exercise the filter against a simulated tree.
+gc_proc_watch_sweep() { # [base_dir] -> "comm" lines of userspace processes
+  local base=${1:-/proc} p comm
+  for p in "$base"/[0-9]*; do
+    [ -d "$p" ] || continue
+    [ -s "$p/cmdline" ] || continue   # kernel threads: empty cmdline
+    [ "$(awk '{print $4}' "$p/stat" 2>/dev/null)" = "2" ] && continue
+    comm=$(cat "$p/comm" 2>/dev/null) || continue
+    [ -n "$comm" ] && printf '%s\n' "$comm"
+  done
+}
+
+# proc-watcher detection: a process outside the job tree is an anomaly.
+gc_proc_detect() { # state_dir process_identity
+  local state_dir=$1 identity=$2
+  gc_decide "$state_dir" unknown "proc $identity" >/dev/null || return 2
+  printf '{"decision":"deny","rule":"unknown"}\n'
+}
+
+# Supervisor liveness (design section 1.3): a dead monitor loop is a
+# containment failure and trips the killswitch immediately.
+gc_liveness() { # state_dir alive_flags ("1 1 1"; any 0 is a dead loop)
+  local state_dir=$1 flags=$2
+  # Post-trip the session is already dead; monitor collateral at teardown must
+  # not trip a masking containment-integrity terminal (see trip freeze above).
+  if [ -f "$state_dir/kill" ]; then return 0; fi
+  case " $flags " in
+    *" 0 "*)
+      gc_log_event "$state_dir" "watcher:proc" containment-integrity proc "monitor loop dead" >/dev/null || return 2
+      gc_killswitch_trip "$state_dir" containment-integrity containment-integrity CRITICAL immediate null null >/dev/null || return 2
+      printf '{"decision":"deny","rule":"containment-integrity","tier":"CRITICAL","mode":"immediate"}\n' ;;
+    *) printf '{"decision":"allow"}\n' ;;
+  esac
+}
+
+# B1: the one real receipt printf. The containment segment is passed as a %s
+# argument (never interpolated into the format string, where it would stay
+# literal under single quotes); an empty segment yields the v1 receipt shape.
+gc_receipt_json() { # schema remote_host fixture_id domain marker marker_sha script_hash initramfs_sha containment_segment domain destroy_requested absent acl_before acl_after fs_ctx_sha net_ctx_sha
+  printf '{"schema":"%s","ok":true,"status":"VERIFIED","authorityCreated":false,"runtimeActivated":false,"persisted":false,"identity":{"remoteHost":"%s","fixtureId":"%s","domain":"%s"},"marker":{"value":"%s","sha256":"%s"},"scriptHash":"%s","initramfsSha256":"%s"%s,"teardown":{"domain":{"name":"%s","transient":true,"destroyOnExit":true,"destroyRequested":%s,"absent":%s,"checked":true,"check":"virsh dominfo/list"},"acl":{"beforeSha256":"%s","afterSha256":"%s","equal":true,"checked":true,"initramfsEntryRemoved":true}},"context":{"filesystem":{"summary":"disk=absent host-share=absent credentials=absent gpu=absent","disk":false,"hostShare":false,"credentials":false,"gpu":false,"sha256":"%s"},"network":{"summary":"network=absent","guest":false,"sha256":"%s"},"guestMounts":["proc","sysfs","devtmpfs"]}}\n' "$@"
+}
+
+# Terminal event for a session that ends without a killswitch trip: the
+# envelope then carries only log lines plus this session-end record
+# (design section 5: a session with neither is containment-evidence-missing).
+gc_session_end() { # state_dir
+  # Split declarations: bash 3.2 expands every word of one `local` before any
+  # assignment, so referencing $state_dir in the same statement is an unbound
+  # variable under set -u on the host-side hook path.
+  local state_dir=$1
+  local log="$state_dir/containment.log.jsonl"
+  # Bootstrap the taxonomy copy so a zero-event session (no shim invocation,
+  # no watcher hit) still records its terminal event: without it the digest
+  # lookup below fails, no log is created, and no envelope can be emitted.
+  if [ ! -f "$state_dir/taxonomy.json" ]; then
+    mkdir -p "$state_dir" || return 2
+    gc_embedded_taxonomy >"$state_dir/taxonomy.json" || return 2
+  fi
+  local seq=1
+  if [ -f "$state_dir/seq" ]; then seq=$(( $(cat "$state_dir/seq") + 1 )); fi
+  printf '%s\n' "$seq" >"$state_dir/seq"
+  local tsha
+  tsha=$(sha256sum "$state_dir/taxonomy.json" | awk '{print $1}') || return 2
+  printf '{"schema":"%s","session":"%s","taxonomy":"%s","taxonomySha256":"%s","event":{"ts":"%s","seq":%s,"source":"supervisor","class":"session-end","action":"complete","summary":true}}\n' \
+    "$GC_LOG_SCHEMA" "$(basename "$state_dir")" "$GC_TAXONOMY_VERSION" "$tsha" "$(gc_iso8601)" "$seq" >>"$log"
+}
+
+# Host-side containment evidence (design section 5): extract the framed base64
+# envelope from the console transcript, decode it pty-safe, recompute the log
+# digest per the stated normalization, and cross-check the terminal killswitch
+# event's embedded digest against the full payload.
+gc_containment_evidence() { # transcript fixture_id [kill_report_path] -> containment block JSON on stdout
+  local transcript=$1 fid=$2 report_path=${3:-}
+  local begin="AGENTIC_CONTAINMENT_BEGIN:$fid" end="AGENTIC_CONTAINMENT_END:$fid"
+  local b64 tmp log_sha events denials ks_line ks_rule tripped rule_json
+  tmp="$transcript.containment.$$"
+  trap 'rm -f "$tmp" "$tmp.b64" "$tmp.head"' RETURN
+  # H2: exactly one envelope pair may exist; more than one is a forgery or a
+  # replay attempt and fails closed.
+  # Count with index() so pty CR suffixes do not defeat the anchor.
+  begins=$(awk -v b="$begin" 'index($0, b) == 1 { n++ } END { print n + 0 }' "$transcript")
+  ends=$(awk -v e="$end" 'index($0, e) == 1 { n++ } END { print n + 0 }' "$transcript")
+  if [ "$begins" -ne 1 ] || [ "$ends" -ne 1 ]; then
+    return 1
+  fi
+  if ! awk -v b="$begin" -v e="$end" 'index($0, b) == 1 { inside = 1; next } index($0, e) == 1 { inside = 0; next } inside' "$transcript" | tr -d '\r' >"$tmp.b64"; then
+    return 1
+  fi
+  if ! [ -s "$tmp.b64" ]; then return 1; fi
+  if ! { base64 -d <"$tmp.b64" >"$tmp" 2>/dev/null || base64 -D <"$tmp.b64" >"$tmp" 2>/dev/null; }; then return 1; fi
+  if ! grep -q '"schema":"' "$tmp"; then return 1; fi
+  ks_line=$(grep '"final":true' "$tmp" | tail -n 1)
+  ks_num=$(grep -n '"final":true' "$tmp" | tail -n 1 | cut -d: -f1)
+  if [ -n "$ks_line" ]; then
+    # Digest chain (H1): verified at the killswitch line's position — the
+    # digest covers the log up to and including the trigger event but
+    # excluding the killswitch line itself; anything after it is post-trip
+    # noise the guest's log freeze should have prevented, and is ignored for
+    # the digest rather than silently trusted.
+    ks_sha=$(printf '%s\n' "$ks_line" | sed -n 's/.*"logSha256":"\([0-9a-f]*\)".*/\1/p')
+    sed -n "1,$((ks_num - 1))p" "$tmp" >"$tmp.head" 2>/dev/null || return 1
+    chained_sha=$(sha256sum "$tmp.head" | awk '{print $1}') || return 1
+    if [ -z "$ks_sha" ] || [ "$ks_sha" != "$chained_sha" ]; then return 2; fi
+    tripped=true
+    log_sha=$ks_sha
+    ks_rule=$(printf '%s\n' "$ks_line" | sed -n 's/.*"trigger":{"rule":"\([A-Za-z0-9_-]*\)".*/\1/p')
+    ks_class=$(printf '%s\n' "$ks_line" | sed -n 's/.*"trigger":{"rule":"[A-Za-z0-9_-]*","class":"\([A-Za-z0-9_-]*\)".*/\1/p')
+    ks_tier=$(printf '%s\n' "$ks_line" | sed -n 's/.*"tier":"\([A-Za-z]*\)".*/\1/p')
+    rule_json="\"$ks_rule\""
+    class_json="\"$ks_class\""
+    tier_json="\"$ks_tier\""
+    counted=$((ks_num - 1))
+  else
+    # Fail-closed: without a killswitch record the session must end with the
+    # clean session-end terminal event.
+    grep -q '"class":"session-end"' "$tmp" || return 1
+    tripped=false
+    rule_json=null
+    class_json=null
+    tier_json=null
+    log_sha=$(sha256sum "$tmp" | awk '{print $1}') || return 1
+    counted=$(grep -c '"schema":"' "$tmp")
+  fi
+  events=$counted
+  denials=$(grep -c '"action":"deny"' "$tmp")
+  # M1: compact histogram (design section 4; open question 4 decided) — the
+  # coordinator consumes aggregates from the receipt without extra tooling.
+  # Terminal killswitch records are echoes, not events; exclude them.
+  histogram=$(awk '{
+    if ($0 !~ /guest-containment.killswitch.v1/ && match($0, /"class":"[^"]*"/)) {
+      c = substr($0, RSTART + 9, RLENGTH - 10); n[c]++
+    }
+  } END { first = 1; printf "{"; for (k in n) { if (!first) printf ","; printf "\"%s\":%d", k, n[k]; first = 0 } printf "}" }' "$tmp")
+  # Concealment index (design appendix): probes + 2*unknown-class denials
+  # + 3*containment-integrity events; probes counted alongside.
+  probes=0; concealment_index=0
+  eval "$(awk '{
+    if ($0 ~ /guest-containment.killswitch.v1/) next
+    match($0, /"class":"[^"]*"/); c = substr($0, RSTART + 9, RLENGTH - 10)
+    match($0, /"action":"[^"]*"/); a = substr($0, RSTART + 10, RLENGTH - 11)
+    if (c == "GC-PROBE") { probes++; idx += 1 }
+    else if (c == "unknown" && a == "deny") { idx += 2 }
+    else if (c == "containment-integrity") { idx += 3 }
+  } END { printf "probes=%d; concealment_index=%d;", probes + 0, idx + 0 }' "$tmp")"
+  if [ "$tripped" = true ] && [ -n "$report_path" ]; then
+    cp "$tmp" "$transcript.containment.payload" 2>/dev/null || true
+    report_json=",\"killReportPath\":\"$report_path\""
+  else
+    report_json=""
+  fi
+  rm -f "$tmp" "$tmp.b64" "$tmp.head"
+  printf '{"schema":"%s","taxonomySha256":"%s","logSha256":"%s","events":%s,"denials":%s,"probes":%s,"concealmentIndex":%s,"histogram":%s,"killswitch":{"tripped":%s,"rule":%s,"class":%s,"tier":%s,"guestPoweroff":true,"final":true}%s}' \
+    "$GC_LOG_SCHEMA" "$GC_TAXONOMY_SHA256" "$log_sha" "$events" "$denials" "$probes" "$concealment_index" "$histogram" "$tripped" "$rule_json" "$class_json" "$tier_json" "$report_json"
+}
+
+# Durable kill report (design section 5; Defect 2): when the killswitch trips,
+# the fixture writes kill-report.json next to console.typescript with session
+# identity, decoded aggregates, the trigger, the last redacted events before
+# the kill, and teardown proof status (finalized after the teardown proofs).
+gc_write_kill_report() { # fixture_root fixture_id domain remote_host block_json
+  local fixture_root=$1 fid=$2 dom=$3 host=$4 block=$5
+  local payload="$fixture_root/console.typescript.containment.payload"
+  local report="$fixture_root/kill-report.json"
+  local log_sha events denials probes concealment histogram rule class tier mode pressure threshold
+  log_sha=$(printf '%s' "$block" | sed -n 's/.*"logSha256":"\([0-9a-f]*\)".*/\1/p')
+  events=$(printf '%s' "$block" | sed -n 's/.*"events":\([0-9]*\).*/\1/p')
+  denials=$(printf '%s' "$block" | sed -n 's/.*"denials":\([0-9]*\).*/\1/p')
+  probes=$(printf '%s' "$block" | sed -n 's/.*"probes":\([0-9]*\).*/\1/p')
+  concealment=$(printf '%s' "$block" | sed -n 's/.*"concealmentIndex":\([0-9]*\).*/\1/p')
+  histogram=$(printf '%s' "$block" | sed -n 's/.*"histogram":\({[^}]*}\).*/\1/p')
+  rule=$(printf '%s' "$block" | sed -n 's/.*"killswitch":{"tripped":true,"rule":"\([^"]*\)".*/\1/p')
+  class=$(printf '%s' "$block" | sed -n 's/.*"class":"\([^"]*\)","tier":"\([^"]*\)".*/\1/p')
+  tier=$(printf '%s' "$block" | sed -n 's/.*"class":"[^"]*","tier":"\([^"]*\)".*/\1/p')
+  local ks_line first_ts last_ts
+  ks_line=$(grep '"logSha256"' "$payload" | tail -n 1 || true)
+  mode=$(printf '%s\n' "$ks_line" | sed -n 's/.*"mode":"\([^"]*\)".*/\1/p' || true)
+  pressure=$(printf '%s\n' "$ks_line" | sed -n 's/.*"pressure":\([0-9]*\).*/\1/p' || true)
+  threshold=$(printf '%s\n' "$ks_line" | sed -n 's/.*"threshold":\([0-9]*\).*/\1/p' || true)
+  # null-safe scalars: the guest emits pressure/threshold null for immediate trips.
+  pressure=${pressure:-null}
+  threshold=${threshold:-null}
+  first_ts=$(grep -o '"ts":"[^"]*"' "$payload" | head -n 1 | cut -d'"' -f4 || true)
+  last_ts=$(grep -o '"ts":"[^"]*"' "$payload" | tail -n 1 | cut -d'"' -f4 || true)
+  local last_events
+  last_events=$(awk '/"action":"deny"/ { lines[n++] = $0 } END { for (i = (n > 5 ? n - 5 : 0); i < n; i++) { if (i > (n > 5 ? n - 5 : 0)) printf ","; printf "%s", lines[i] } }' "$payload" || true)
+  printf '{"schema":"agentic-driver.guest-containment.kill-report.v1","session":{"fixtureId":"%s","domain":"%s","remoteHost":"%s"},"generatedAt":"%s","guestSession":{"firstEventAt":"%s","lastEventAt":"%s","events":%s,"denials":%s,"probes":%s,"concealmentIndex":%s,"histogram":%s},"killswitch":{"tripped":true,"rule":"%s","class":"%s","tier":"%s","mode":"%s","pressure":%s,"threshold":%s},"lastEvents":[%s],"teardown":{"domainAbsent":"PENDING","destroyRequested":"PENDING","aclRestored":"PENDING"},"logSha256":"%s"}\n' \
+    "$fid" "$dom" "$host" "$(gc_iso8601)" "$first_ts" "$last_ts" "$events" "$denials" "$probes" "$concealment" "$histogram" \
+    "$rule" "$class" "$tier" "$mode" "$pressure" "$threshold" "$last_events" "$log_sha" >"$report"
+  printf '%s\n' "$report"
+}
+
+GC_CORE_EOF
+then
+  fixture_fail 6 'guest containment core could not be embedded'
+fi
+if ! grep -q 'gc_killswitch_trip' "$root/gc/core.sh"; then fixture_fail 6 'guest containment core embed is incomplete'; fi
+if ! cat >"$root/gc/dispatch" <<'GC_DISPATCH_EOF'
+#!/bin/busybox sh
+# Every applet is shimmed, so the dispatcher must resolve its own helpers
+# (core.sh uses sed/grep/awk/sha256sum/...) from /bin directly; otherwise
+# each helper would re-enter /shims and recurse.
+PATH=/bin
+. /gc/core.sh
+session=/tmp/session/.gc
+tool=${0##*/}
+decision=$(gc_shim_allow "$session" "$tool" "$@") || exit 126
+case "$decision" in
+  *'"decision":"allow"'*)
+    exec /bin/busybox "$tool" "$@" ;;
+  *)
+    # Denied and logged (and, per severity tier, possibly killswitched); the
+    # supervisor kill path runs from the kill flag. When this denial TRIPPED
+    # the killswitch (flag present), also kill the job synchronously: the
+    # supervisor polls once a second, and without this the job shell would
+    # run its next command inside that window. PID-1 safety (review R1):
+    # never signal PPID directly when it is PID 1 — a job shell that exec'd
+    # the denied tool leaves dispatch parented by init; synchronous
+    # containment for that case is the process-group kill below, which fires
+    # only when dispatch's group differs from PID 1's group (setsid job) and
+    # is skipped when either group id cannot be established. PID 1 and its
+    # group are never signalled.
+    if [ -f "$session/kill" ]; then
+      if [ "$PPID" != "1" ]; then
+        kill -KILL "$PPID" 2>/dev/null || true
+      fi
+      if [ -r /proc/self/stat ] && [ -r /proc/1/stat ]; then
+        my_pgid=$(awk '{print $5}' /proc/self/stat 2>/dev/null) || my_pgid=
+        init_pgid=$(awk '{print $5}' /proc/1/stat 2>/dev/null) || init_pgid=
+        if [ -n "$my_pgid" ] && [ -n "$init_pgid" ] && [ "$my_pgid" != "$init_pgid" ]; then
+          kill -KILL 0 2>/dev/null || true
+        fi
+      fi
+    fi
+    exit 126 ;;
+esac
+GC_DISPATCH_EOF
+then
+  fixture_fail 6 'guest shim dispatcher could not be written'
+fi
+if ! cat >"$root/gc/fs-handler" <<'GC_FS_HANDLER_EOF'
+#!/bin/busybox sh
+# inotifyd handler: allow only the job scratch root; everything else is
+# classified by gc_fs_detect. PATH=/bin keeps core.sh helpers out of /shims.
+PATH=/bin
+. /gc/core.sh
+session=/tmp/session/.gc
+event=$1 dir=$2 name=$3
+[ -n "$dir" ] || exit 0
+path="${dir%/}"
+[ -n "$name" ] && [ "$name" != "INSERT" ] && path="$path/$name"
+gc_fs_detect "$session" "$path" >/dev/null 2>&1
+GC_FS_HANDLER_EOF
+then
+  fixture_fail 6 'guest fs-watcher handler could not be written'
+fi
+# R2: shim every BusyBox applet, not a fixed dangerous-tools list — the shim
+# layer is the command boundary (design sections 1.2, 3), so plain
+# `cat /root/.ssh/...`, `sed -i ...`, or `sh -c '... > /dev/console'` must
+# reach the classifier too. Only the job runs under the shim PATH and the
+# dispatcher resets PATH=/bin for its own helpers, so the wider surface adds
+# no recursion. Observed-first-use learning semantics are unchanged.
+shim_links=0
+for name in $applet_list; do
+  if ! ln -s ../gc/dispatch "$root/shims/$name"; then fixture_fail 6 "shim link could not be created: $name"; fi
+  shim_links=$((shim_links + 1))
+done
+if [ "$shim_links" -lt 1 ]; then fixture_fail 6 'no BusyBox applets available for the shim layer'; fi
+# Classified tool names that busybox --list does not ship (live fixture S1:
+# five `npm install` commands produced zero denials, the payload ran to
+# completion, and no kill report existed — dash resolved npm through PATH,
+# found nothing under /shims or /bin, reported not-found, and continued, so
+# the classified command never reached the dispatcher). Stub each name with
+# a dispatcher symlink so PATH lookup reaches the classifier and the deny
+# decision happens before any real tool could; names busybox already
+# provides as applets keep their applet shim.
+for name in npm pip pip3 yarn pnpm gem cargo apk apt apt-get telnet; do
+  grep -qx "$name" <<<"$applet_list" && continue
+  if ! ln -s ../gc/dispatch "$root/shims/$name"; then fixture_fail 6 "shim link could not be created: $name"; fi
+  shim_links=$((shim_links + 1))
+done
 if ! cat >"$root/init" <<EOF
 #!/bin/busybox sh
 /bin/mount -t proc proc /proc
@@ -236,13 +2457,161 @@ if ! cat >"$root/init" <<EOF
 echo '$marker'
 echo "guest-kernel=\$(/bin/uname -r)"
 echo 'network=absent disk=absent host-share=absent'
+if [ ! -x /job.sh ]; then
+  sync
+  /bin/poweroff -f
+fi
+# --- containment session (design section 1.3): deny-by-default supervisor ---
+. /gc/core.sh
+session_id=$fixture_id
+session=/tmp/session/.gc
+mkdir -p /tmp/session "\$session" || { sync; /bin/poweroff -f; }
+touch "\$session/baseline"
+# The supervisor and monitor loops resolve applets from /bin directly; only
+# the job below runs under the shim PATH, so the monitor never interposes on
+# its own helpers now that every applet is shimmed.
+export PATH=/bin
+(
+  while :; do
+    for f in /proc/net/tcp /proc/net/tcp6 /proc/net/udp; do
+      if [ -s "\$f" ]; then
+        rows=\$(wc -l < "\$f")
+        if [ "\$rows" -gt 1 ]; then
+          gc_net_detect "\$session" "\$(sed -n 2p "\$f")" >/dev/null 2>&1
+        fi
+      fi
+    done
+    sleep 1
+  done
+) &
+net_pid=\$!
+(
+  if [ -x /bin/inotifyd ]; then
+    # R1: event-driven top-level watches close the create/use/delete race at
+    # depth one, but inotify watches are non-recursive — nested writes at
+    # depth >= 2 under a watched root would be invisible to them. Both
+    # detectors run side by side (design sections 1.3, 9.1): inotifyd in the
+    # background for immediacy, the recursive find -newer sweep below
+    # unconditionally for coverage (and as the fallback when inotifyd is
+    # absent or dies). A top-level write may be seen twice; that only adds
+    # deny pressure, never misses one.
+    watches=""
+    for d in /*; do
+      case "\$d" in /proc|/sys|/dev|/tmp/session|/tmp/session/*) continue ;; esac
+      [ -d "\$d" ] && watches="\$watches \$d:ncp"
+    done
+    [ -n "\$watches" ] && /bin/inotifyd /gc/fs-handler \$watches &
+  fi
+  while :; do
+    find / -newer "\$session/baseline" 2>/dev/null | grep -Ev '^/(tmp/session|proc|sys|dev|gc)' | while IFS= read -r p; do
+      gc_fs_detect "\$session" "\$p" >/dev/null 2>&1
+    done
+    if ! gc_cache_growth_sample "\$session" /root/.npm /root/.cache /var/cache >/dev/null 2>&1; then
+      # Fail closed: a sampler error is logged, never silently blind.
+      gc_log_event "\$session" "sweep" "GC-FSW-003" "sampler" "cache-growth sampling failed" "error" >/dev/null 2>&1 || true
+    fi
+    # R2 (microvm-11d339266876dcfad3d3ac32): retreat, never plain-touch - a
+    # write in the same second as this touch would never be -newer again.
+    gc_baseline_retreat "\$session/baseline"
+    sleep 1
+  done
+) &
+fs_pid=\$!
+(
+  while :; do
+    gc_proc_watch_sweep /proc | while IFS= read -r c; do
+      case "\$c" in busybox|sh|init|inotifyd|poweroff|sync|comm) continue ;; esac
+      grep -F -x -- "\$c" "\$session/allowlist" >/dev/null 2>&1 || gc_proc_detect "\$session" "\$c" >/dev/null 2>&1
+    done
+    [ -f "\$session/kill" ] && break
+    sleep 1
+  done
+) &
+proc_pid=\$!
+# Only the job runs under the shim PATH (design section 1.3); PATH= above
+# keeps the supervisor and monitor loops on /bin. The job shell is dash, not
+# busybox sh: busybox ash resolves applet names from its compiled-in table
+# and bypasses PATH, so /shims would never interpose (live fixture
+# microvm-8673d4b468440affb14a58ed: wget ran as an internal applet, GC-NET-002
+# never tripped, the payload ran to completion). dash has no applet table —
+# every external command execs through /shims. The supervisor and monitors
+# stay on busybox applets (PATH=/bin, never shimmed).
+# GC-FSW-003 pre-job baseline (live microvm-e2abe44348e29c9472f3b941): the
+# sampler previously ran only inside the fs-watcher loop, and a fast job was
+# over before a second sweep could straddle its writes — the live dd (2 MiB
+# into /var/cache) produced no event. Capture the baseline BEFORE the job
+# starts so any job-time growth is provably newer than the baseline; the
+# final post-job sample below closes the straddle deterministically.
+gc_cache_growth_sample "\$session" /root/.npm /root/.cache /var/cache >/dev/null 2>&1 || true
+if [ "$have_setsid" = true ]; then
+  PATH=/shims:/bin /bin/setsid /bin/dash /job.sh &
+else
+  PATH=/shims:/bin /bin/dash /job.sh &
+fi
+job_pid=\$!
+while :; do
+  alive=\$(for pid in "\$net_pid" "\$fs_pid" "\$proc_pid"; do [ -e "/proc/\$pid" ] && printf '1 ' || printf '0 '; done)
+  gc_liveness "\$session" "\$alive" >/dev/null 2>&1
+  if [ -f "\$session/kill" ]; then break; fi
+  kill -0 "\$job_pid" 2>/dev/null || break
+  sleep 1
+done
+# Killswitch action (design section 5): kill the job process group, sync,
+# poweroff. on_poweroff=destroy tears the transient domain down host-side.
+# M5: without setsid there is no separate process group; fall back to killing
+# the job and its /proc-visible descendants directly. R3 caveats, both bounded
+# by the unconditional poweroff -f below (which ends every descendant
+# regardless): the walk covers direct children only (TERM pass, then KILL
+# pass), and /proc/<pid>/stat field parsing assumes a space-free comm.
+if [ -x /bin/setsid ]; then
+  kill -TERM -"\$job_pid" 2>/dev/null
+  kill -KILL -"\$job_pid" 2>/dev/null
+else
+  for p in /proc/[0-9]*; do
+    ppid=\$(awk '{print \$4}' "\$p/stat" 2>/dev/null) || continue
+    if [ "\$ppid" = "\$job_pid" ]; then kill -TERM "\${p#/proc/}" 2>/dev/null; fi
+  done
+  kill -TERM "\$job_pid" 2>/dev/null
+  for p in /proc/[0-9]*; do
+    ppid=\$(awk '{print \$4}' "\$p/stat" 2>/dev/null) || continue
+    if [ "\$ppid" = "\$job_pid" ]; then kill -KILL "\${p#/proc/}" 2>/dev/null; fi
+  done
+  kill -KILL "\$job_pid" 2>/dev/null
+fi
+# GC-FSW-003 final sample (see the pre-job baseline note): the supervisor
+# loop exits when the job ends or the killswitch trips, so this is the one
+# sample guaranteed to run AFTER any job-time cache growth, independent of
+# the fs-watcher loop's lifetime. Fail closed: a sampler error is logged,
+# never silently blind.
+if ! gc_cache_growth_sample "\$session" /root/.npm /root/.cache /var/cache >/dev/null 2>&1; then
+  gc_log_event "\$session" "sweep" "GC-FSW-003" "sampler" "cache-growth sampling failed" "error" >/dev/null 2>&1 || true
+fi
+if [ ! -f "\$session/kill" ]; then gc_session_end "\$session" || :; fi
+# Denial-evidence transport (design section 5): framed base64 envelope on the
+# console channel, UTF-8, LF-only, fixed key order; pty-safe alphabet.
+if [ -f "\$session/containment.log.jsonl" ]; then
+  printf '%s\n' "AGENTIC_CONTAINMENT_BEGIN:\$session_id"
+  /bin/base64 "\$session/containment.log.jsonl"
+  printf '%s\n' "AGENTIC_CONTAINMENT_END:\$session_id"
+fi
 sync
 /bin/poweroff -f
 EOF
 then
   fixture_fail 6 'guest init could not be written'
 fi
-if ! chmod 0755 "$root/init"; then fixture_fail 6 'guest init could not be made executable'; fi
+if ! chmod 0755 "$root/init" "$root/gc/dispatch" "$root/gc/fs-handler"; then fixture_fail 6 'guest containment scripts could not be made executable'; fi
+if [ -n "$containment_payload" ]; then
+  # M6: the payload is inline text; write it as the guest job under the shim PATH.
+  if ! printf '%s\n' "$containment_payload" >"$root/job.sh"; then fixture_fail 6 'containment payload could not be embedded'; fi
+  if ! chmod 0755 "$root/job.sh"; then fixture_fail 6 'containment payload could not be made executable'; fi
+fi
+if ! gc_embedded_taxonomy >"$root/etc/guest-containment-taxonomy.v1.json"; then
+  fixture_fail 6 'containment taxonomy could not be embedded in the initramfs'
+fi
+if [ "$(sha256sum "$root/etc/guest-containment-taxonomy.v1.json" | awk '{print $1}')" != "$GC_TAXONOMY_SHA256" ]; then
+  fixture_fail 6 'embedded containment taxonomy digest mismatch'
+fi
 if ! (
   cd "$root"
   find . -print0 | LC_ALL=C sort -z | /usr/bin/cpio --null -o --format=newc 2>"$initramfs_build_log" | /usr/bin/gzip -n >"$initramfs"
@@ -258,8 +2627,8 @@ if [ "${#initramfs_sha}" -ne 64 ]; then fixture_fail 6 'initramfs digest is inva
 if ! cat >"$fixture_root/domain.xml" <<EOF
 <domain type='kvm'>
   <name>$domain</name>
-  <memory unit='MiB'>128</memory>
-  <vcpu placement='static'>1</vcpu>
+  <memory unit='MiB'>$memory_mib</memory>
+  <vcpu placement='static'>$vcpu</vcpu>
   <os>
     <type arch='x86_64' machine='microvm'>hvm</type>
     <kernel>$kernel</kernel>
@@ -294,15 +2663,16 @@ phase=console
 domain_started=true
 script -q -e -c "virsh create '$fixture_root/domain.xml' --console" "$fixture_root/console.typescript" > /dev/null 2>"$console_error" &
 recorder_pid=$!
+# Plain proof mode waits for the marker only (unchanged semantics); a
+# containment run additionally waits, bounded, for the envelope END anchor
+# so the guest completes its session and emits evidence before teardown.
+if [ -n "$containment_payload" ]; then
+  gc_console_wait "$fixture_root/console.typescript" "$fixture_id" true "$recorder_pid" "$GC_ENVELOPE_WAIT_ATTEMPTS" || :
+else
+  gc_console_wait "$fixture_root/console.typescript" "$fixture_id" false "$recorder_pid" 90 || :
+fi
 marker_seen=false
-for _attempt in $(seq 1 90); do
-  if grep -F "$marker" "$fixture_root/console.typescript" >/dev/null 2>&1; then
-    marker_seen=true
-    break
-  fi
-  if ! kill -0 "$recorder_pid" 2>/dev/null; then break; fi
-  sleep 0.5
-done
+if grep -F "$marker" "$fixture_root/console.typescript" >/dev/null 2>&1; then marker_seen=true; fi
 
 phase=teardown
 if ! state=$(domain_state); then fixture_fail 9 'domain teardown query failed'; fi
@@ -328,6 +2698,17 @@ if [ "$marker_seen" != true ]; then
   fixture_fail 10 'guest marker missing from bounded console recording'
 fi
 
+phase=containment
+containment_segment=""
+receipt_schema="agentic-driver.linux-microvm-cutover.v1"
+if [ -n "$containment_payload" ]; then
+  receipt_schema="agentic-driver.linux-microvm-cutover.v2"
+  if ! containment_block=$(gc_containment_evidence "$fixture_root/console.typescript" "$fixture_id" "$fixture_root/kill-report.json"); then
+    fixture_fail 10 'containment evidence missing or invalid in bounded console recording'
+  fi
+  containment_segment=",\"containment\":$containment_block"
+fi
+
 phase=acl
 if ! setfacl -x u:libvirt-qemu "$initramfs"; then fixture_fail 11 'initramfs ACL could not be removed'; fi
 if ! verify_initramfs_acl_removed; then fixture_fail 11 'initramfs ACL removal could not be verified'; fi
@@ -358,9 +2739,27 @@ case "$remote_host" in
   ""|*[!A-Za-z0-9._-]*) fixture_fail 12 'remote host identity is unsafe' ;;
 esac
 
+# Defect 1 (live microvm-f84dceaecc99f8d791d8916d): a tripped session's
+# receipt advertised kill-report.json (gc_containment_evidence embeds the
+# path), but the production path never called gc_write_kill_report — only
+# the --gc-kill-report test hook did, so the advertised file was absent on
+# the live retry. Write it here for tripped sessions, after remote_host is
+# observed and before teardown finalization, and fail closed if it cannot
+# be written: a receipt advertising a durable report must never be emitted
+# without the report existing at the advertised path.
+if grep -q '"tripped":true' <<<"$containment_block" 2>/dev/null; then
+  gc_write_kill_report "$fixture_root" "$fixture_id" "$domain" "$remote_host" "$containment_block" >/dev/null
+  [ -s "$fixture_root/kill-report.json" ] || fixture_fail 10 'kill report could not be written for the tripped session'
+fi
+
+# Defect 2: finalize the durable kill report with teardown proof status.
+if grep -q '"tripped":true' <<<"$containment_block" 2>/dev/null && [ -f "$fixture_root/kill-report.json" ]; then
+  sed -i.bak 's/"domainAbsent":"PENDING"/"domainAbsent":'"$([ "$domain_absent" = true ] && echo true || echo false)"'/' "$fixture_root/kill-report.json"
+  sed -i.bak 's/"destroyRequested":"PENDING"/"destroyRequested":'"$([ "$domain_destroy_requested" = true ] && echo true || echo false)"'/' "$fixture_root/kill-report.json"
+  sed -i.bak 's/"aclRestored":"PENDING"/"aclRestored":'"$([ "$acl_restored" = true ] && echo true || echo false)"'/' "$fixture_root/kill-report.json"
+  rm -f "$fixture_root/kill-report.json.bak"
+fi
+
 trap - EXIT INT TERM HUP
-printf '{"schema":"%s","ok":true,"status":"VERIFIED","authorityCreated":false,"runtimeActivated":false,"persisted":false,"identity":{"remoteHost":"%s","fixtureId":"%s","domain":"%s"},"marker":{"value":"%s","sha256":"%s"},"scriptHash":"%s","initramfsSha256":"%s","teardown":{"domain":{"name":"%s","transient":true,"destroyOnExit":true,"destroyRequested":%s,"absent":%s,"checked":true,"check":"virsh dominfo/list"},"acl":{"beforeSha256":"%s","afterSha256":"%s","equal":true,"checked":true,"initramfsEntryRemoved":true}},"context":{"filesystem":{"summary":"disk=absent host-share=absent credentials=absent gpu=absent","disk":false,"hostShare":false,"credentials":false,"gpu":false,"sha256":"%s"},"network":{"summary":"network=absent","guest":false,"sha256":"%s"},"guestMounts":["proc","sysfs","devtmpfs"]}}\n' \
-  "$receipt_schema" "$remote_host" "$fixture_id" "$domain" "$marker" "$marker_sha" "$script_hash" "$initramfs_sha" \
-  "$domain" "$domain_destroy_requested" "$domain_absent" "$home_acl_before_sha" "$home_acl_after_sha" \
-  "$filesystem_context_sha" "$network_context_sha"
+gc_receipt_json "$receipt_schema" "$remote_host" "$fixture_id" "$domain" "$marker" "$marker_sha" "$script_hash" "$initramfs_sha" "$containment_segment" "$domain" "$domain_destroy_requested" "$domain_absent" "$home_acl_before_sha" "$home_acl_after_sha" "$filesystem_context_sha" "$network_context_sha"
 exit 0