@guilz-dev/belay 0.8.1 → 0.9.1

package/dist/core/audit-serialize.js

@@ -0,0 +1,179 @@
+import { createHash } from 'node:crypto';
+import { appendFile, mkdir } from 'node:fs/promises';
+import path from 'node:path';
+import { scrubString, scrubValue } from './scrub.js';
+export const AUDIT_SCHEMA_VERSION = 3;
+const ISO8601_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/;
+const HEX64_PATTERN = /^[a-f0-9]{64}$/;
+const SCRUB_PLACEHOLDERS = new Set(['<timestamp>', '<high-entropy>', '<approval-id>', '<uuid>']);
+const PRESERVED_HASH_FIELDS = new Set([
+    'fingerprint',
+    'commandFingerprint',
+    'effectIRHash',
+    'payloadHash',
+    'configFingerprint',
+    'runtimeArtifactHash',
+    'decisionConfigFingerprint',
+    'receiptHash',
+]);
+const PRESERVED_LITERAL_FIELDS = new Set([
+    'timestamp',
+    'approvalCorrelationId',
+    'runtimeVersion',
+    'runtimeBuildStamp',
+    'boundaryProfile',
+    'schemaVersion',
+    'imageId',
+    'mirrorBackend',
+    'wouldMediate',
+    'exitCode',
+    'timedOut',
+]);
+const SCRUBBED_CONTAINER_FIELDS = new Set([
+    'summary',
+    'command',
+    'payload',
+    'replayContext',
+    'actionSnapshot',
+    'assessment',
+    'predictedAssessment',
+    'observedAssessment',
+]);
+export function approvalCorrelationId(approvalId) {
+    return createHash('sha256').update(approvalId).digest('hex').slice(0, 16);
+}
+export function isValidApprovalCorrelationId(value) {
+    return /^[a-f0-9]{16}$/.test(value);
+}
+export function isValidAuditTimestamp(value) {
+    if (SCRUB_PLACEHOLDERS.has(value) || !ISO8601_PATTERN.test(value)) {
+        return false;
+    }
+    return !Number.isNaN(Date.parse(value));
+}
+export function isValidAuditFingerprint(value) {
+    return HEX64_PATTERN.test(value) && !SCRUB_PLACEHOLDERS.has(value);
+}
+function isValidPreservedHashField(field, value) {
+    if (field === 'receiptHash') {
+        return HEX64_PATTERN.test(value);
+    }
+    if (field === 'imageId') {
+        return /^sha256:[a-f0-9]{64}$/.test(value);
+    }
+    return isValidAuditFingerprint(value);
+}
+function scrubAuditContainer(value, options) {
+    return scrubValue(value, {
+        ...options,
+        maskHighEntropyStrings: true,
+    });
+}
+function serializeAuditField(key, value, options) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (key === 'approvalId') {
+        return undefined;
+    }
+    if (key === 'ts' && typeof value === 'string' && isValidAuditTimestamp(value)) {
+        return undefined;
+    }
+    if (PRESERVED_LITERAL_FIELDS.has(key)) {
+        if (key === 'timestamp' && typeof value === 'string' && isValidAuditTimestamp(value)) {
+            return value;
+        }
+        if (key === 'approvalCorrelationId' &&
+            typeof value === 'string' &&
+            isValidApprovalCorrelationId(value)) {
+            return value;
+        }
+        if ((key === 'runtimeVersion' || key === 'runtimeBuildStamp' || key === 'boundaryProfile') &&
+            typeof value === 'string' &&
+            value.length > 0) {
+            return value;
+        }
+        if (key === 'schemaVersion' && typeof value === 'number') {
+            return value;
+        }
+        if (key === 'mirrorBackend' && value === 'file_copy') {
+            return value;
+        }
+        if (key === 'wouldMediate' && value === true) {
+            return true;
+        }
+        if (key === 'exitCode' && (value === null || Number.isSafeInteger(value))) {
+            return value;
+        }
+        if (key === 'timedOut' && typeof value === 'boolean') {
+            return value;
+        }
+        if (key === 'imageId' && typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value)) {
+            return value;
+        }
+        return undefined;
+    }
+    if (PRESERVED_HASH_FIELDS.has(key) && typeof value === 'string') {
+        return isValidPreservedHashField(key, value) ? value : undefined;
+    }
+    if (SCRUBBED_CONTAINER_FIELDS.has(key)) {
+        return scrubAuditContainer(value, options);
+    }
+    if (typeof value === 'string') {
+        return scrubString(value, { ...options, maskHighEntropyStrings: true });
+    }
+    if (value !== null && typeof value === 'object') {
+        return scrubAuditContainer(value, options);
+    }
+    return value;
+}
+export function serializeAuditRecordV3(record, options) {
+    const timestamp = typeof record.timestamp === 'string' && isValidAuditTimestamp(record.timestamp)
+        ? record.timestamp
+        : typeof record.ts === 'string' && isValidAuditTimestamp(record.ts)
+            ? record.ts
+            : new Date().toISOString();
+    const serialized = {
+        schemaVersion: AUDIT_SCHEMA_VERSION,
+        timestamp,
+    };
+    if (typeof record.approvalId === 'string' && record.approvalId.length > 0) {
+        serialized.approvalCorrelationId = approvalCorrelationId(record.approvalId);
+    }
+    else if (typeof record.approvalCorrelationId === 'string' &&
+        isValidApprovalCorrelationId(record.approvalCorrelationId)) {
+        serialized.approvalCorrelationId = record.approvalCorrelationId;
+    }
+    for (const [key, value] of Object.entries(record)) {
+        if (key === 'timestamp' || key === 'ts' || key === 'approvalId' || key === 'schemaVersion') {
+            continue;
+        }
+        const next = serializeAuditField(key, value, options);
+        if (next !== undefined) {
+            serialized[key] = next;
+        }
+    }
+    return serialized;
+}
+export function parseAuditNdjsonLine(line) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(trimmed);
+        if (typeof parsed.ts === 'string' && parsed.timestamp === undefined) {
+            parsed.timestamp = parsed.ts;
+            delete parsed.ts;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+export async function appendAuditRecord(auditPath, record, options) {
+    await mkdir(path.dirname(auditPath), { recursive: true });
+    const line = JSON.stringify(serializeAuditRecordV3(record, options));
+    await appendFile(auditPath, `${line}\n`, 'utf8');
+}

package/dist/core/audit-types.d.ts

@@ -1,7 +1,7 @@
 import type { AuditActionSnapshot, AuditReplayContext } from './audit-replay-context.js';
 import type { Assessment } from './types.js';
 export type { AuditActionSnapshot, AuditReplayContext } from './audit-replay-context.js';
-export declare const AUDIT_METRICS_SCHEMA_VERSION = 3;
+export declare const AUDIT_METRICS_SCHEMA_VERSION = 4;
 export declare const GATE_EVENTS: Set<string>;
 export interface AuditRecord {
     timestamp?: string;
@@ -42,6 +42,12 @@ export interface AuditRecord {
     recoveryState?: string;
     replayContext?: AuditReplayContext;
     actionSnapshot?: AuditActionSnapshot;
+    wouldMediate?: boolean;
+    receiptHash?: string;
+    imageId?: string;
+    mirrorBackend?: 'file_copy';
+    exitCode?: number | null;
+    timedOut?: boolean;
     [key: string]: unknown;
 }
 export interface AuditFilter {
@@ -63,6 +69,7 @@ export interface ApprovalRoundTrip {
     approvalTimestamp?: string;
     executeTimestamp?: string;
     approvalId?: string;
+    approvalCorrelationId?: string;
     fingerprint: string;
     reason: string;
     summary: string;

package/dist/core/audit-types.js

@@ -1,2 +1,2 @@
-export const AUDIT_METRICS_SCHEMA_VERSION = 3;
+export const AUDIT_METRICS_SCHEMA_VERSION = 4;
 export const GATE_EVENTS = new Set(['beforeShellExecution', 'preToolUse', 'subagentGate']);

package/dist/core/bounded-output.d.ts

@@ -0,0 +1,11 @@
+export declare const OUTPUT_TAIL_LIMIT_BYTES = 16384;
+export interface BoundedOutputTail {
+    tail: Buffer;
+    truncated: boolean;
+}
+export declare function appendBoundedOutputTail(current: Buffer, chunk: Buffer | string, limitBytes?: number): BoundedOutputTail;
+export declare function decodeBoundedOutputTail(tail: Buffer): string;
+export declare function boundedUtf8Tail(value: string, limitBytes?: number): {
+    value: string;
+    truncated: boolean;
+};

package/dist/core/bounded-output.js

@@ -0,0 +1,26 @@
+export const OUTPUT_TAIL_LIMIT_BYTES = 16_384;
+export function appendBoundedOutputTail(current, chunk, limitBytes = OUTPUT_TAIL_LIMIT_BYTES) {
+    const next = Buffer.concat([current, Buffer.from(chunk)]);
+    return {
+        tail: next.length > limitBytes ? next.subarray(-limitBytes) : next,
+        truncated: next.length > limitBytes,
+    };
+}
+export function decodeBoundedOutputTail(tail) {
+    for (let offset = 0; offset <= Math.min(3, tail.length); offset += 1) {
+        try {
+            return new TextDecoder('utf-8', { fatal: true }).decode(tail.subarray(offset));
+        }
+        catch {
+            // A byte cap may have cut a leading multi-byte character; try its next boundary.
+        }
+    }
+    return tail.toString('utf8');
+}
+export function boundedUtf8Tail(value, limitBytes = OUTPUT_TAIL_LIMIT_BYTES) {
+    const encoded = Buffer.from(value);
+    if (encoded.length <= limitBytes)
+        return { value, truncated: false };
+    const tail = encoded.subarray(-limitBytes);
+    return { value: decodeBoundedOutputTail(tail), truncated: true };
+}

package/dist/core/capability/attestation.d.ts

@@ -1,5 +1,56 @@
 export declare const BOUNDARY_ATTESTATION_VERSION: 1;
+export declare const CONTAINED_EXECUTION_ATTESTATION_VERSION: 1;
 export type BoundaryDriverId = 'container' | 'cursor-sandbox' | 'seatbelt' | 'landlock' | 'host-integration';
+export interface ContainedExecutionResourceLimits {
+    timeoutMs: number;
+    memoryMiB: number;
+    cpus: number;
+    pids: number;
+}
+export interface DockerSubstrateIdentity {
+    binaryPath: string;
+    binarySha256: string;
+    endpoint: string;
+    daemonId: string;
+}
+/** A separate execution-only capability; it does not attest L1 grant enforcement. */
+export interface ContainedExecutionAttestation {
+    version: typeof CONTAINED_EXECUTION_ATTESTATION_VERSION;
+    imageId: string;
+    imageReference: string;
+    networkNone: true;
+    isolatesWorkspaceMirror: true;
+    readOnlyRoot: true;
+    sanitizedEnvironment: true;
+    dockerSubstrate: DockerSubstrateIdentity;
+    dockerConfiguration: {
+        executable: string;
+        host: string;
+    };
+    user: string;
+    entrypoint: '/bin/sh';
+    capDropAll: true;
+    noNewPrivileges: true;
+    logDriver: 'none';
+    proxyEnvironment: 'neutralized-empty';
+    tmpfs: {
+        path: '/tmp';
+        sizeBytes: number;
+        mode: 0o1777;
+        exec: false;
+        nosuid: true;
+        nodev: true;
+    };
+    memorySwapMiB: number;
+    shmSizeMiB: number;
+    healthcheckDisabled: true;
+    privateNamespaces: true;
+    privileged: false;
+    devicesNone: true;
+    resourceLimits: ContainedExecutionResourceLimits;
+    probedAt: string;
+    expiresAt: string;
+}
 export interface BoundaryAttestation {
     version: typeof BOUNDARY_ATTESTATION_VERSION;
     driver: BoundaryDriverId;
@@ -10,7 +61,12 @@ export interface BoundaryAttestation {
     probeSignals: string[];
     /** When true, the driver can mount an execution mirror at the original workspace path. */
     isolatesWorkspaceMounts?: boolean;
+    /** Optional, execution-only proof. This must never be treated as an L1-full attestation. */
+    containedExecution?: ContainedExecutionAttestation;
 }
 export declare function validateBoundaryAttestation(value: unknown): value is BoundaryAttestation;
+export declare function validateContainedExecutionAttestation(value: unknown): value is ContainedExecutionAttestation;
+export declare function isContainedExecutionAttestationFresh(attestation: ContainedExecutionAttestation | null | undefined, now?: number): boolean;
+export declare function isAttestationCurrent(attestation: BoundaryAttestation, now?: number): boolean;
 export declare function isAttestationFresh(attestation: BoundaryAttestation, now?: number): boolean;
 export declare function attestsWorkspaceMountIsolation(attestation: BoundaryAttestation | null | undefined): boolean;

package/dist/core/capability/attestation.js

@@ -1,4 +1,6 @@
+import path from 'node:path';
 export const BOUNDARY_ATTESTATION_VERSION = 1;
+export const CONTAINED_EXECUTION_ATTESTATION_VERSION = 1;
 const KNOWN_DRIVERS = new Set([
     'container',
     'cursor-sandbox',
@@ -6,15 +8,21 @@ const KNOWN_DRIVERS = new Set([
     'landlock',
     'host-integration',
 ]);
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function isBoundaryDriver(value) {
+    return typeof value === 'string' && KNOWN_DRIVERS.has(value);
+}
 export function validateBoundaryAttestation(value) {
-    if (!value || typeof value !== 'object') {
+    if (!isRecord(value)) {
         return false;
     }
     const record = value;
     if (record.version !== BOUNDARY_ATTESTATION_VERSION) {
         return false;
     }
-    if (!KNOWN_DRIVERS.has(record.driver)) {
+    if (!isBoundaryDriver(record.driver)) {
         return false;
     }
     if (typeof record.probedAt !== 'string' || typeof record.expiresAt !== 'string') {
@@ -34,6 +42,12 @@ export function validateBoundaryAttestation(value) {
         typeof record.isolatesWorkspaceMounts !== 'boolean') {
         return false;
     }
+    if (record.containedExecution !== undefined) {
+        if (record.driver !== 'container' ||
+            !validateContainedExecutionAttestation(record.containedExecution)) {
+            return false;
+        }
+    }
     if (record.driver === 'host-integration' && record.materializesGrants) {
         return false;
     }
@@ -44,7 +58,94 @@ export function validateBoundaryAttestation(value) {
     }
     return true;
 }
-export function isAttestationFresh(attestation, now = Date.now()) {
+function hasPositiveLimit(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0;
+}
+function hasPositiveIntegerLimit(value) {
+    return hasPositiveLimit(value) && Number.isSafeInteger(value);
+}
+export function validateContainedExecutionAttestation(value) {
+    if (!isRecord(value)) {
+        return false;
+    }
+    const record = value;
+    const dockerSubstrate = record.dockerSubstrate;
+    const dockerConfiguration = record.dockerConfiguration;
+    if (record.version !== CONTAINED_EXECUTION_ATTESTATION_VERSION ||
+        typeof record.imageId !== 'string' ||
+        !/^sha256:[a-f0-9]{64}$/i.test(record.imageId) ||
+        typeof record.imageReference !== 'string' ||
+        !record.imageReference ||
+        /[\0\n\r]/.test(record.imageReference) ||
+        record.networkNone !== true ||
+        record.isolatesWorkspaceMirror !== true ||
+        record.readOnlyRoot !== true ||
+        record.sanitizedEnvironment !== true ||
+        !isRecord(dockerSubstrate) ||
+        typeof dockerSubstrate.binaryPath !== 'string' ||
+        !path.isAbsolute(dockerSubstrate.binaryPath) ||
+        /[\0\n\r]/.test(dockerSubstrate.binaryPath) ||
+        typeof dockerSubstrate.binarySha256 !== 'string' ||
+        !/^[a-f0-9]{64}$/.test(dockerSubstrate.binarySha256) ||
+        typeof dockerSubstrate.endpoint !== 'string' ||
+        !dockerSubstrate.endpoint.startsWith('unix:///') ||
+        !path.isAbsolute(dockerSubstrate.endpoint.slice('unix://'.length)) ||
+        /[\0\n\r]/.test(dockerSubstrate.endpoint) ||
+        typeof dockerSubstrate.daemonId !== 'string' ||
+        !dockerSubstrate.daemonId ||
+        /[\0\n\r]/.test(dockerSubstrate.daemonId) ||
+        !isRecord(dockerConfiguration) ||
+        typeof dockerConfiguration.executable !== 'string' ||
+        !path.isAbsolute(dockerConfiguration.executable) ||
+        /[\0\n\r]/.test(dockerConfiguration.executable) ||
+        typeof dockerConfiguration.host !== 'string' ||
+        !dockerConfiguration.host.startsWith('unix:///') ||
+        !path.isAbsolute(dockerConfiguration.host.slice('unix://'.length)) ||
+        /[\0\n\r]/.test(dockerConfiguration.host) ||
+        typeof record.user !== 'string' ||
+        !/^\d+:\d+$/.test(record.user) ||
+        record.entrypoint !== '/bin/sh' ||
+        record.capDropAll !== true ||
+        record.noNewPrivileges !== true ||
+        record.logDriver !== 'none' ||
+        record.proxyEnvironment !== 'neutralized-empty' ||
+        typeof record.probedAt !== 'string' ||
+        typeof record.expiresAt !== 'string') {
+        return false;
+    }
+    const probedAt = Date.parse(record.probedAt);
+    const expiresAt = Date.parse(record.expiresAt);
+    if (!Number.isFinite(probedAt) || !Number.isFinite(expiresAt) || expiresAt <= probedAt) {
+        return false;
+    }
+    const limits = record.resourceLimits;
+    const tmpfs = record.tmpfs;
+    return (isRecord(tmpfs) &&
+        tmpfs.path === '/tmp' &&
+        hasPositiveIntegerLimit(tmpfs.sizeBytes) &&
+        tmpfs.mode === 0o1777 &&
+        tmpfs.exec === false &&
+        tmpfs.nosuid === true &&
+        tmpfs.nodev === true &&
+        hasPositiveIntegerLimit(record.memorySwapMiB) &&
+        hasPositiveIntegerLimit(record.shmSizeMiB) &&
+        record.healthcheckDisabled === true &&
+        record.privateNamespaces === true &&
+        record.privileged === false &&
+        record.devicesNone === true &&
+        isRecord(limits) &&
+        hasPositiveIntegerLimit(limits.timeoutMs) &&
+        hasPositiveIntegerLimit(limits.memoryMiB) &&
+        hasPositiveLimit(limits.cpus) &&
+        hasPositiveIntegerLimit(limits.pids));
+}
+export function isContainedExecutionAttestationFresh(attestation, now = Date.now()) {
+    // A contained proof must have been observed already; no clock skew is accepted.
+    return (validateContainedExecutionAttestation(attestation) &&
+        Date.parse(attestation.probedAt) <= now &&
+        Date.parse(attestation.expiresAt) > now);
+}
+export function isAttestationCurrent(attestation, now = Date.now()) {
     const expires = Date.parse(attestation.expiresAt);
     if (!Number.isFinite(expires)) {
         return false;
@@ -52,6 +153,12 @@ export function isAttestationFresh(attestation, now = Date.now()) {
     if (expires <= now) {
         return false;
     }
+    return true;
+}
+export function isAttestationFresh(attestation, now = Date.now()) {
+    if (!isAttestationCurrent(attestation, now)) {
+        return false;
+    }
     if (attestation.driver === 'host-integration') {
         return true;
     }

package/dist/core/capability/boundary-session.d.ts

@@ -1,4 +1,5 @@
 import type { BelayConfigV4 } from '../config.js';
+import { type ContainedDockerDependencies } from '../contained-execution/docker.js';
 import type { BoundaryAttestation, BoundaryDriverId } from './attestation.js';
 import { type BoundaryDriver } from './boundary-driver.js';
 import { dockerNetworkArgs } from './boundary-egress.js';
@@ -15,6 +16,7 @@ export interface ResolvedBoundaryDriverContext {
     attestationPath: string;
     attestation: BoundaryAttestation | null;
     attestationFresh: boolean;
+    containedExecutionFresh?: boolean;
 }
 export declare function boundaryAttestationPath(repoRoot: string, config: BelayConfigV4): string;
 export declare function loadBoundaryAttestation(filePath: string, expectedRepoRoot?: string, controlPlaneDir?: string): Promise<BoundaryAttestation | null>;
@@ -38,6 +40,7 @@ export declare function startBoundarySession(params: {
     config: BelayConfigV4;
     driverId?: BoundaryDriverId;
     egressProxyRunning?: boolean;
+    containedDockerDependencies?: ContainedDockerDependencies;
 }): Promise<{
     attestation: BoundaryAttestation;
     attestationPath: string;
@@ -45,10 +48,12 @@ export declare function startBoundarySession(params: {
 export declare function boundarySessionStatus(params: {
     repoRoot: string;
     config: BelayConfigV4;
+    now?: number;
 }): Promise<{
     attestationPath: string;
     attestation: BoundaryAttestation | null;
     fresh: boolean;
+    containedExecutionFresh?: boolean;
 }>;
 export declare function runBoundaryAgentCommand(params: {
     repoRoot: string;

package/dist/core/capability/boundary-session.js

@@ -2,11 +2,34 @@ import { mkdir, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { egressStatus } from '../../services/egress-service.js';
 import { configuredControlPlaneDir } from '../config.js';
-import { isAttestationFresh } from './attestation.js';
+import { probeContainedDockerForSession, } from '../contained-execution/docker.js';
+import { isAttestationFresh, isContainedExecutionAttestationFresh } from './attestation.js';
 import { readSignedAttestationFile, signBoundaryAttestation, verifySignedBoundaryAttestation, } from './boundary-attestation-sign.js';
 import { getDefaultBoundaryDriver } from './boundary-driver.js';
 import { dockerNetworkArgs, isEgressProxyActive, resolveBoundaryEgressProxyEnv, } from './boundary-egress.js';
 import { runWithBoundaryRunnable, } from './boundary-run.js';
+function containedExecutionFresh(attestation, config, now = Date.now()) {
+    if (attestation?.driver !== 'container' || !attestation.containedExecution)
+        return undefined;
+    const current = config.sandbox.containedExecution;
+    const capability = attestation.containedExecution;
+    const configCompatible = Boolean(current?.enabled &&
+        current.image === capability.imageReference &&
+        current.dockerExecutable === capability.dockerConfiguration.executable &&
+        current.dockerHost === capability.dockerConfiguration.host &&
+        current.timeoutMs === capability.resourceLimits.timeoutMs &&
+        current.memoryMiB === capability.resourceLimits.memoryMiB &&
+        current.cpus === capability.resourceLimits.cpus &&
+        current.pids === capability.resourceLimits.pids);
+    const probedAt = Date.parse(attestation.probedAt);
+    const expiresAt = Date.parse(attestation.expiresAt);
+    return (Number.isFinite(probedAt) &&
+        Number.isFinite(expiresAt) &&
+        probedAt <= now &&
+        expiresAt > now &&
+        configCompatible &&
+        isContainedExecutionAttestationFresh(capability, now));
+}
 export function boundaryAttestationPath(repoRoot, config) {
     const rel = config.capability?.attestationRelPath ?? '.belay/attestation.json';
     return path.isAbsolute(rel) ? rel : path.join(repoRoot, rel);
@@ -92,6 +115,7 @@ export async function resolveBoundaryDriverContext(params) {
         attestationPath,
         attestation,
         attestationFresh: attestation ? isAttestationFresh(attestation) : false,
+        containedExecutionFresh: containedExecutionFresh(attestation, params.config),
     };
 }
 export async function runWithBoundaryDriver(params) {
@@ -104,6 +128,18 @@ export async function runWithBoundaryDriver(params) {
     });
 }
 export async function startBoundarySession(params) {
+    const contained = params.config.sandbox.containedExecution;
+    if (contained?.enabled === true) {
+        const attestation = await probeContainedDockerForSession({
+            repoRoot: params.repoRoot,
+            controlPlaneDir: configuredControlPlaneDir(params.config),
+            config: contained,
+            dependencies: params.containedDockerDependencies,
+        });
+        const attestationPath = boundaryAttestationPath(params.repoRoot, params.config);
+        await saveBoundaryAttestation(attestationPath, attestation, params.repoRoot, configuredControlPlaneDir(params.config));
+        return { attestation, attestationPath };
+    }
     const resolved = await resolveBoundaryDriverContext(params);
     const attestation = await resolved.driver.probe();
     if (resolved.driver.prepare) {
@@ -120,6 +156,7 @@ export async function boundarySessionStatus(params) {
         attestationPath,
         attestation,
         fresh: attestation ? isAttestationFresh(attestation) : false,
+        containedExecutionFresh: containedExecutionFresh(attestation, params.config, params.now),
     };
 }
 export async function runBoundaryAgentCommand(params) {

package/dist/core/capability/index.d.ts

@@ -1,5 +1,5 @@
 export { addPathToAllowlist, allPathsAllowlisted, fsScopeAllowlistPath, isPathAllowlisted, loadFsScopeAllowlist, loadFsScopeAllowlistSync, saveFsScopeAllowlist, } from './allowlist.js';
-export { attestsWorkspaceMountIsolation, BOUNDARY_ATTESTATION_VERSION, type BoundaryAttestation, type BoundaryDriverId, isAttestationFresh, } from './attestation.js';
+export { attestsWorkspaceMountIsolation, BOUNDARY_ATTESTATION_VERSION, type BoundaryAttestation, type BoundaryDriverId, CONTAINED_EXECUTION_ATTESTATION_VERSION, type ContainedExecutionAttestation, type ContainedExecutionResourceLimits, isAttestationFresh, isContainedExecutionAttestationFresh, validateContainedExecutionAttestation, } from './attestation.js';
 export { BOUNDARY_PROFILE_L1_ATTESTED, BOUNDARY_PROFILE_L3_L4_ONLY, BOUNDARY_PROFILE_L3_POLICY, boundaryVerifiedAllowEnabled, isAttestedBoundary, resolveBoundaryProfile, } from './boundary-profile.js';
 export { evaluateL1FullStatus, hasSandboxRuntime, isCapabilityBrokerDemotionActive, isSandboxBrokerEnabled, } from './broker.js';
 export { CAPABILITY_GRANT_VERSION, type CapabilityGrantV1, isGrantScopeTooBroad, } from './grant.js';

package/dist/core/capability/index.js

@@ -1,5 +1,5 @@
 export { addPathToAllowlist, allPathsAllowlisted, fsScopeAllowlistPath, isPathAllowlisted, loadFsScopeAllowlist, loadFsScopeAllowlistSync, saveFsScopeAllowlist, } from './allowlist.js';
-export { attestsWorkspaceMountIsolation, BOUNDARY_ATTESTATION_VERSION, isAttestationFresh, } from './attestation.js';
+export { attestsWorkspaceMountIsolation, BOUNDARY_ATTESTATION_VERSION, CONTAINED_EXECUTION_ATTESTATION_VERSION, isAttestationFresh, isContainedExecutionAttestationFresh, validateContainedExecutionAttestation, } from './attestation.js';
 export { BOUNDARY_PROFILE_L1_ATTESTED, BOUNDARY_PROFILE_L3_L4_ONLY, BOUNDARY_PROFILE_L3_POLICY, boundaryVerifiedAllowEnabled, isAttestedBoundary, resolveBoundaryProfile, } from './boundary-profile.js';
 export { evaluateL1FullStatus, hasSandboxRuntime, isCapabilityBrokerDemotionActive, isSandboxBrokerEnabled, } from './broker.js';
 export { CAPABILITY_GRANT_VERSION, isGrantScopeTooBroad, } from './grant.js';

package/dist/core/capability/policy-engine.js

@@ -40,17 +40,11 @@ function effectPathIsLocal(target, context) {
     const resolved = resolveCapabilityPath(target, context.cwd);
     return (resolveWorkspaceRootMatch(context.repoRoot, [...(context.trustedWorkspaceRoots ?? [])], resolved) !== null);
 }
-function effectPathIsHighStakes(target, context) {
+function effectPathIsSecretOrCredentialPath(target, context) {
     const resolved = resolveCapabilityPath(target, context.cwd);
     if (HIGH_STAKES_EFFECT_PATHS.some((pattern) => pattern.test(resolved))) {
         return true;
     }
-    if (context.protectedArtifactRoots?.some((root) => pathWithinRoot(canonicalPath(root), resolved))) {
-        return true;
-    }
-    if (isGitMetadataPath(resolved, context.repoRoot)) {
-        return true;
-    }
     const workspaceMatch = resolveWorkspaceRootMatch(context.repoRoot, [...(context.trustedWorkspaceRoots ?? [])], resolved);
     if (!workspaceMatch) {
         return false;
@@ -59,6 +53,24 @@ function effectPathIsHighStakes(target, context) {
         ...(context.sensitivePaths ?? []),
     ]);
 }
+function effectPathIsControlPlaneArtifactPath(target, context) {
+    const resolved = resolveCapabilityPath(target, context.cwd);
+    return (context.protectedArtifactRoots?.some((root) => pathWithinRoot(canonicalPath(root), resolved)) ??
+        false);
+}
+function effectPathIsHighStakes(target, context) {
+    if (effectPathIsSecretOrCredentialPath(target, context)) {
+        return true;
+    }
+    if (effectPathIsControlPlaneArtifactPath(target, context)) {
+        return true;
+    }
+    const resolved = resolveCapabilityPath(target, context.cwd);
+    if (isGitMetadataPath(resolved, context.repoRoot)) {
+        return true;
+    }
+    return false;
+}
 /**
  * Policy for a lowered shell effect. It intentionally ignores executable
  * command names, segment heads, command text, and config allowlists.
@@ -115,12 +127,13 @@ export function evaluateEffectRequirementPolicy(requirement, context) {
     }
     switch (requirement.action) {
         case 'fs.read':
-            if (requirement.resource.kind === 'path' &&
-                effectPathIsHighStakes(requirement.resource.path, context)) {
-                return effectDecision('ask', 'high_stakes_path', 'effect.fs_read_high_stakes', [
-                    ...signals,
-                    'sensitive_path_read',
-                ]);
+            if (requirement.resource.kind === 'path') {
+                if (effectPathIsSecretOrCredentialPath(requirement.resource.path, context)) {
+                    return effectDecision('ask', 'high_stakes_path', 'effect.fs_read_high_stakes', [
+                        ...signals,
+                        'sensitive_path_read',
+                    ]);
+                }
             }
             return effectDecision('allow', 'read_only', 'effect.fs_read', signals);
         case 'fs.write':
@@ -130,6 +143,12 @@ export function evaluateEffectRequirementPolicy(requirement, context) {
             if (requirement.resource.kind !== 'path') {
                 return effectDecision('ask', 'indeterminate_effect', 'effect.fs_write_unknown', signals);
             }
+            if (effectPathIsControlPlaneArtifactPath(requirement.resource.path, context)) {
+                return effectDecision('ask', 'control_plane_mutation', 'effect.control_plane_write', [
+                    ...signals,
+                    'control_plane_path',
+                ]);
+            }
             if (effectPathIsHighStakes(requirement.resource.path, context)) {
                 return effectDecision('ask', 'high_stakes_path', 'effect.fs_write_high_stakes', [
                     ...signals,