@holoscript/holosystem 0.2.3 → 0.2.5

package/src/vm-launch.mjs

@@ -8,9 +8,11 @@ import {
   readdirSync,
   readFileSync,
   rmSync,
+  writeFileSync,
 } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
 export const HOLOSYSTEM_VM_LAUNCH_PLAN_SCHEMA = 'holoscript.holosystem.vm-launch-plan.v1';
 export const HOLOSYSTEM_VM_EXECUTOR_SCHEMA = 'holoscript.holosystem.vm-executor.v1';
@@ -19,6 +21,26 @@ export const HOLOSYSTEM_VM_LAUNCH_RECEIPT_SCHEMA = 'holoscript.holosystem.vm-lau
 export const HOLOSYSTEM_WHPX_VM_LAUNCH_PLAN_SCHEMA = 'holoscript.holosystem.whpx-vm-launch-plan.v1';
 export const HOLOSYSTEM_WHPX_VM_LAUNCH_RECEIPT_SCHEMA =
   'holoscript.holosystem.whpx-vm-launch-receipt.v1';
+export const HOLOSYSTEM_WHPX_SANDBOXED_VM_LAUNCH_PLAN_SCHEMA =
+  'holoscript.holosystem.whpx-sandboxed-vm-launch-plan.v1';
+export const HOLOSYSTEM_WHPX_SANDBOXED_VM_LAUNCH_RECEIPT_SCHEMA =
+  'holoscript.holosystem.whpx-sandboxed-vm-launch-receipt.v1';
+export const HOLOSYSTEM_WHPX_APPCONTAINER_VM_LAUNCH_PLAN_SCHEMA =
+  'holoscript.holosystem.whpx-appcontainer-vm-launch-plan.v1';
+export const HOLOSYSTEM_WHPX_APPCONTAINER_VM_LAUNCH_RECEIPT_SCHEMA =
+  'holoscript.holosystem.whpx-appcontainer-vm-launch-receipt.v1';
+export const HOLOSYSTEM_APPCONTAINER_VM_LAUNCH_PLAN_SCHEMA =
+  'holoscript.holosystem.appcontainer-vm-launch-plan.v1';
+export const HOLOSYSTEM_APPCONTAINER_VM_LAUNCH_RECEIPT_SCHEMA =
+  'holoscript.holosystem.appcontainer-vm-launch-receipt.v1';
+export const HOLOSYSTEM_WINDOWS_SANDBOX_PROTOCOL =
+  'holoscript.holosystem.windows-sandbox-launch.v1';
+export const HOLOSYSTEM_WINDOWS_APPCONTAINER_PROTOCOL =
+  'holoscript.holosystem.windows-appcontainer-launch.v1';
+export const HOLOSYSTEM_WINDOWS_SANDBOX_LAUNCHER_SCHEMA =
+  'holoscript.holosystem.windows-sandbox-launcher.v1';
+export const HOLOSYSTEM_WINDOWS_APPCONTAINER_CANARY_SCHEMA =
+  'holoscript.holosystem.windows-appcontainer-canary.v1';
 
 const DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/u;
 const EXECUTOR_BINARY = 'qemu-system-x86_64.exe';
@@ -29,6 +51,24 @@ const MAX_KERNEL_BYTES = 128 * 1024 * 1024;
 const MAX_INITRD_BYTES = 512 * 1024 * 1024;
 const MAX_CONSOLE_BYTES = 1024 * 1024;
 const EXPECTED_EXIT_CODE = 33;
+const SANDBOX_LAUNCHER_BINARY = 'holosystem-sandbox-launcher.exe';
+const APPCONTAINER_CANARY_BINARY = 'holosystem-appcontainer-canary.exe';
+const SANDBOX_KIND = 'windows-low-integrity-job-v1';
+const APPCONTAINER_KIND = 'windows-appcontainer-deny-v1';
+const SANDBOX_PROCESS_MEMORY_BYTES = 512 * 1024 * 1024;
+const SANDBOX_PROTOCOL_BYTES = 3 * 1024 * 1024;
+const SANDBOX_LAUNCHER_PATH = fileURLToPath(
+  new URL(`../native/windows-x64/${SANDBOX_LAUNCHER_BINARY}`, import.meta.url)
+);
+const APPCONTAINER_CANARY_PATH = fileURLToPath(
+  new URL(`../native/windows-x64/${APPCONTAINER_CANARY_BINARY}`, import.meta.url)
+);
+export const HOLOSYSTEM_WINDOWS_SANDBOX_LAUNCHER_DIGEST = hashBytes(
+  readFileSync(SANDBOX_LAUNCHER_PATH)
+);
+export const HOLOSYSTEM_WINDOWS_APPCONTAINER_CANARY_DIGEST = hashBytes(
+  readFileSync(APPCONTAINER_CANARY_PATH)
+);
 const TCG_POLICY = Object.freeze({
   accelerator: 'tcg',
   userConfiguration: 'disabled',
@@ -55,6 +95,34 @@ const WHPX_POLICY = Object.freeze({
   guestSignal: 'serial-digest-and-debug-exit',
   diagnostics: 'pinned-digest',
 });
+const WHPX_SANDBOXED_POLICY = Object.freeze({
+  ...WHPX_POLICY,
+  hostProcess: SANDBOX_KIND,
+  token: 'disable-max-privilege-low-integrity',
+  job: 'pre-resume-kill-on-close-active-process-memory-ui',
+  writableTemp: 'low-integrity-private-snapshot',
+});
+const WHPX_APPCONTAINER_POLICY = Object.freeze({
+  ...WHPX_POLICY,
+  hostProcess: APPCONTAINER_KIND,
+  token: 'disable-max-privilege-appcontainer-low-integrity',
+  capabilities: 'none',
+  filesystem: 'snapshot-read-execute-writable-temp-modify',
+  network: 'appcontainer-default-deny',
+  canaries: 'caller-readable-sentinel-and-loopback-listener',
+  job: 'pre-resume-kill-on-close-active-process-memory-ui',
+});
+const APPCONTAINER_TCG_POLICY = Object.freeze({
+  ...TCG_POLICY,
+  network: 'appcontainer-default-deny',
+  hostProcess: APPCONTAINER_KIND,
+  token: 'disable-max-privilege-appcontainer-low-integrity',
+  capabilities: 'none',
+  filesystem: 'snapshot-read-execute-writable-temp-modify',
+  canaries: 'caller-readable-sentinel-and-loopback-listener',
+  job: 'pre-resume-kill-on-close-active-process-memory-ui',
+  translationBufferMiB: 64,
+});
 const BOUNDARIES = Object.freeze([
   'guest-artifact-provenance',
   'hardware-hypervisor-acceleration',
@@ -82,6 +150,55 @@ const WHPX_ADAPTER = Object.freeze({
   receiptSchema: HOLOSYSTEM_WHPX_VM_LAUNCH_RECEIPT_SCHEMA,
   policy: WHPX_POLICY,
   requiresDiagnosticsDigest: true,
+  hostSandboxed: false,
+});
+const WHPX_SANDBOXED_ADAPTER = Object.freeze({
+  accelerator: 'whpx',
+  accelerationName: 'qemu-whpx',
+  hardwareBacked: true,
+  planSchema: HOLOSYSTEM_WHPX_SANDBOXED_VM_LAUNCH_PLAN_SCHEMA,
+  receiptSchema: HOLOSYSTEM_WHPX_SANDBOXED_VM_LAUNCH_RECEIPT_SCHEMA,
+  policy: WHPX_SANDBOXED_POLICY,
+  requiresDiagnosticsDigest: true,
+  hostSandboxed: true,
+  sandboxKind: SANDBOX_KIND,
+  sandboxProtocol: HOLOSYSTEM_WINDOWS_SANDBOX_PROTOCOL,
+  isolationScope: 'integrity-privilege-lifetime-resource-ui',
+  filesystemConfidentiality: false,
+  networkIsolation: false,
+  appContainer: false,
+});
+const WHPX_APPCONTAINER_ADAPTER = Object.freeze({
+  accelerator: 'whpx',
+  accelerationName: 'qemu-whpx',
+  hardwareBacked: true,
+  planSchema: HOLOSYSTEM_WHPX_APPCONTAINER_VM_LAUNCH_PLAN_SCHEMA,
+  receiptSchema: HOLOSYSTEM_WHPX_APPCONTAINER_VM_LAUNCH_RECEIPT_SCHEMA,
+  policy: WHPX_APPCONTAINER_POLICY,
+  requiresDiagnosticsDigest: true,
+  hostSandboxed: true,
+  sandboxKind: APPCONTAINER_KIND,
+  sandboxProtocol: HOLOSYSTEM_WINDOWS_APPCONTAINER_PROTOCOL,
+  isolationScope: 'appcontainer-zero-capability-snapshot-grant',
+  filesystemConfidentiality: true,
+  networkIsolation: true,
+  appContainer: true,
+});
+const APPCONTAINER_TCG_ADAPTER = Object.freeze({
+  accelerator: 'tcg',
+  accelerationName: 'qemu-tcg',
+  hardwareBacked: false,
+  planSchema: HOLOSYSTEM_APPCONTAINER_VM_LAUNCH_PLAN_SCHEMA,
+  receiptSchema: HOLOSYSTEM_APPCONTAINER_VM_LAUNCH_RECEIPT_SCHEMA,
+  policy: APPCONTAINER_TCG_POLICY,
+  requiresDiagnosticsDigest: false,
+  hostSandboxed: true,
+  sandboxKind: APPCONTAINER_KIND,
+  sandboxProtocol: HOLOSYSTEM_WINDOWS_APPCONTAINER_PROTOCOL,
+  isolationScope: 'appcontainer-zero-capability-snapshot-grant',
+  filesystemConfidentiality: true,
+  networkIsolation: true,
+  appContainer: true,
 });
 
 function isRecord(value) {
@@ -169,6 +286,9 @@ function normalizedPlan(plan) {
       cpus: plan.resources.cpus,
       timeoutSeconds: plan.resources.timeoutSeconds,
     },
+    sandbox: plan.sandbox
+      ? { kind: plan.sandbox.kind, launcherDigest: plan.sandbox.launcherDigest }
+      : null,
     launches: plan.launches,
   };
 }
@@ -182,7 +302,17 @@ function inspectVmLaunchPlanForAdapter(plan, adapter) {
 
   knownKeys(
     plan,
-    new Set(['schema', 'id', 'host', 'executor', 'target', 'guest', 'resources', 'launches']),
+    new Set([
+      'schema',
+      'id',
+      'host',
+      'executor',
+      'target',
+      'guest',
+      'resources',
+      ...(adapter.hostSandboxed ? ['sandbox'] : []),
+      'launches',
+    ]),
     '',
     issues
   );
@@ -280,6 +410,27 @@ function inspectVmLaunchPlanForAdapter(plan, adapter) {
     );
   }
 
+  if (adapter.hostSandboxed) {
+    knownKeys(
+      plan.sandbox,
+      new Set(['kind', 'launcherDigest', ...(adapter.appContainer ? ['canaryDigest'] : [])]),
+      'sandbox',
+      issues
+    );
+    if (plan.sandbox?.kind !== adapter.sandboxKind) {
+      issue(
+        issues,
+        'vm-launch-sandbox-unsupported',
+        'sandbox.kind',
+        `This adapter requires ${adapter.sandboxKind}.`
+      );
+    }
+    inspectDigest(plan.sandbox?.launcherDigest, 'sandbox.launcherDigest', issues);
+    if (adapter.appContainer) {
+      inspectDigest(plan.sandbox?.canaryDigest, 'sandbox.canaryDigest', issues);
+    }
+  }
+
   return { ready: issues.length === 0, issues };
 }
 
@@ -291,6 +442,18 @@ export function inspectWhpxVmLaunchPlan(plan) {
   return inspectVmLaunchPlanForAdapter(plan, WHPX_ADAPTER);
 }
 
+export function inspectWhpxSandboxedVmLaunchPlan(plan) {
+  return inspectVmLaunchPlanForAdapter(plan, WHPX_SANDBOXED_ADAPTER);
+}
+
+export function inspectWhpxAppContainerVmLaunchPlan(plan) {
+  return inspectVmLaunchPlanForAdapter(plan, WHPX_APPCONTAINER_ADAPTER);
+}
+
+export function inspectAppContainerVmLaunchPlan(plan) {
+  return inspectVmLaunchPlanForAdapter(plan, APPCONTAINER_TCG_ADAPTER);
+}
+
 function scanRuntime(directory, issues) {
   const files = [];
   let totalBytes = 0;
@@ -482,6 +645,74 @@ export function inspectVmLaunchAsset({ assetPath, kind } = {}) {
   };
 }
 
+export function inspectWindowsVmSandboxLauncher() {
+  const issues = [];
+  let content = null;
+  try {
+    const stats = lstatSync(SANDBOX_LAUNCHER_PATH);
+    if (!stats.isFile() || stats.isSymbolicLink()) throw new TypeError('not a regular file');
+    content = readFileSync(SANDBOX_LAUNCHER_PATH);
+  } catch {
+    issue(
+      issues,
+      'vm-launch-sandbox-launcher-invalid',
+      'sandbox.launcher',
+      'The packaged Windows sandbox launcher must be a readable regular file.'
+    );
+  }
+  const digest = content ? hashBytes(content) : null;
+  if (digest && digest !== HOLOSYSTEM_WINDOWS_SANDBOX_LAUNCHER_DIGEST) {
+    issue(
+      issues,
+      'vm-launch-sandbox-launcher-drift',
+      'sandbox.launcherDigest',
+      'The packaged Windows sandbox launcher changed after module initialization.'
+    );
+  }
+  return {
+    schema: HOLOSYSTEM_WINDOWS_SANDBOX_LAUNCHER_SCHEMA,
+    ready: issues.length === 0,
+    kind: SANDBOX_KIND,
+    digest: issues.length === 0 ? digest : null,
+    bytes: issues.length === 0 ? content.length : null,
+    issues,
+  };
+}
+
+export function inspectWindowsVmAppContainerCanary() {
+  const issues = [];
+  let content = null;
+  try {
+    const stats = lstatSync(APPCONTAINER_CANARY_PATH);
+    if (!stats.isFile() || stats.isSymbolicLink()) throw new TypeError('not a regular file');
+    content = readFileSync(APPCONTAINER_CANARY_PATH);
+  } catch {
+    issue(
+      issues,
+      'vm-launch-appcontainer-canary-invalid',
+      'sandbox.canary',
+      'The packaged Windows AppContainer canary must be a readable regular file.'
+    );
+  }
+  const digest = content ? hashBytes(content) : null;
+  if (digest && digest !== HOLOSYSTEM_WINDOWS_APPCONTAINER_CANARY_DIGEST) {
+    issue(
+      issues,
+      'vm-launch-appcontainer-canary-drift',
+      'sandbox.canaryDigest',
+      'The packaged Windows AppContainer canary changed after module initialization.'
+    );
+  }
+  return {
+    schema: HOLOSYSTEM_WINDOWS_APPCONTAINER_CANARY_SCHEMA,
+    ready: issues.length === 0,
+    kind: APPCONTAINER_KIND,
+    digest: issues.length === 0 ? digest : null,
+    bytes: issues.length === 0 ? content.length : null,
+    issues,
+  };
+}
+
 function logSummary(value) {
   const bytes = Buffer.isBuffer(value) ? value : Buffer.from(String(value || ''), 'utf8');
   return { bytes: bytes.length, digest: hashBytes(bytes) };
@@ -525,10 +756,27 @@ function baseReceipt(plan, now, issues, adapter) {
       evidence: adapter.hardwareBacked ? 'two-explicit-successful-launches' : 'software-emulation',
       verified: false,
     },
-    isolation: {
-      hostProcess: 'ambient-windows-process',
-      verified: false,
-    },
+    isolation: adapter.hostSandboxed
+      ? {
+          hostProcess: adapter.sandboxKind,
+          scope: adapter.isolationScope,
+          verified: false,
+          launcherDigest: DIGEST_PATTERN.test(plan?.sandbox?.launcherDigest || '')
+            ? plan.sandbox.launcherDigest
+            : null,
+          ...(adapter.appContainer
+            ? {
+                canaryDigest: DIGEST_PATTERN.test(plan?.sandbox?.canaryDigest || '')
+                  ? plan.sandbox.canaryDigest
+                  : null,
+              }
+            : {}),
+          controls: emptyIsolationControls(adapter),
+        }
+      : {
+          hostProcess: 'ambient-windows-process',
+          verified: false,
+        },
     measurementDigest: null,
     executor: {
       kind: plan?.executor?.kind === 'qemu-system' ? 'qemu-system' : null,
@@ -579,20 +827,30 @@ function baseReceipt(plan, now, issues, adapter) {
         'virtual-device-minimization',
       ],
     },
-    boundaries: BOUNDARIES.filter(
-      (layer) => !(adapter.hardwareBacked && layer === 'hardware-hypervisor-acceleration')
-    ),
+    boundaries: [
+      ...BOUNDARIES.filter(
+        (layer) =>
+          !(adapter.hardwareBacked && layer === 'hardware-hypervisor-acceleration') &&
+          !(adapter.hostSandboxed && layer === 'host-process-isolation')
+      ),
+      ...(adapter.hostSandboxed && !adapter.filesystemConfidentiality
+        ? ['host-filesystem-confidentiality']
+        : []),
+      ...(adapter.hostSandboxed && !adapter.networkIsolation ? ['host-network-isolation'] : []),
+    ],
     issues,
   };
 }
 
 function qemuArguments(plan, kernelPath, initrdPath, adapter) {
+  const appContainerTcg = adapter === APPCONTAINER_TCG_ADAPTER;
   return [
     '-no-user-config',
     '-nodefaults',
     '-machine',
-    `q35,accel=${adapter.accelerator},usb=off`,
-    ...(adapter === TCG_ADAPTER ? ['-cpu', 'max'] : []),
+    appContainerTcg ? 'q35,usb=off' : `q35,accel=${adapter.accelerator},usb=off`,
+    ...(appContainerTcg ? ['-accel', 'tcg,tb-size=64'] : []),
+    ...([TCG_ADAPTER, APPCONTAINER_TCG_ADAPTER].includes(adapter) ? ['-cpu', 'max'] : []),
     '-m',
     `${plan.resources.memoryMiB}M`,
     '-smp',
@@ -617,21 +875,196 @@ function qemuArguments(plan, kernelPath, initrdPath, adapter) {
   ];
 }
 
-function minimalEnvironment(snapshotRoot, runtimeDirectory) {
+function minimalEnvironment(snapshotRoot, runtimeDirectory, temporaryDirectory = snapshotRoot) {
+  const systemRoot = process.env.SystemRoot || process.env.WINDIR;
+  const systemDrive = process.env.SystemDrive || systemRoot?.slice(0, 2);
   const env = {
+    APPDATA: temporaryDirectory,
     HOME: snapshotRoot,
+    HOMEDRIVE: systemDrive,
+    HOMEPATH: '\\',
+    LOCALAPPDATA: temporaryDirectory,
+    OS: 'Windows_NT',
+    Path: runtimeDirectory,
+    PATHEXT: '.COM;.EXE;.BAT;.CMD',
     USERPROFILE: snapshotRoot,
-    TEMP: snapshotRoot,
-    TMP: snapshotRoot,
-    PATH: runtimeDirectory,
+    TEMP: temporaryDirectory,
+    TMP: temporaryDirectory,
     LANG: 'C',
     LC_ALL: 'C',
   };
-  if (typeof process.env.SystemRoot === 'string') env.SystemRoot = process.env.SystemRoot;
-  if (typeof process.env.WINDIR === 'string') env.WINDIR = process.env.WINDIR;
+  if (systemDrive) env.SystemDrive = systemDrive;
+  if (systemRoot) {
+    env.SystemRoot = systemRoot;
+    env.windir = systemRoot;
+    env.ComSpec = join(systemRoot, 'System32', 'cmd.exe');
+  }
   return env;
 }
 
+const SANDBOX_CONTROL_KEYS = Object.freeze([
+  'filteredToken',
+  'disableMaxPrivilege',
+  'enabledPrivilegeCount',
+  'privilegesBounded',
+  'lowIntegrity',
+  'assignedBeforeResume',
+  'handleAllowlist',
+  'killOnClose',
+  'activeProcessLimit',
+  'processMemoryLimit',
+  'uiRestrictions',
+  'writableTempLowIntegrity',
+]);
+const APPCONTAINER_CONTROL_KEYS = Object.freeze([
+  'filteredToken',
+  'disableMaxPrivilege',
+  'enabledPrivilegeCount',
+  'privilegesBounded',
+  'lowIntegrity',
+  'assignedBeforeResume',
+  'handleAllowlist',
+  'killOnClose',
+  'activeProcessLimit',
+  'processMemoryLimit',
+  'uiRestrictions',
+  'appContainer',
+  'appContainerSidMatched',
+  'capabilityCount',
+  'snapshotReadExecuteGrant',
+  'writableTempModifyGrant',
+  'filesystemCanaryDenied',
+  'filesystemCanaryError',
+  'networkCanaryDenied',
+  'networkCanaryError',
+  'loopbackAccepted',
+  'profileDeleted',
+]);
+
+function isolationControlKeys(adapter) {
+  return adapter.appContainer ? APPCONTAINER_CONTROL_KEYS : SANDBOX_CONTROL_KEYS;
+}
+
+function emptyIsolationControls(adapter) {
+  return Object.fromEntries(
+    isolationControlKeys(adapter).map((key) => [
+      key,
+      ['enabledPrivilegeCount', 'capabilityCount', 'filesystemCanaryError', 'networkCanaryError'].includes(
+        key
+      )
+        ? null
+        : false,
+    ])
+  );
+}
+
+function isolationControlsReady(controls, adapter) {
+  if (
+    !Number.isInteger(controls.enabledPrivilegeCount) ||
+    controls.enabledPrivilegeCount < 0 ||
+    controls.enabledPrivilegeCount > 1
+  ) {
+    return false;
+  }
+  if (!adapter.appContainer) {
+    return SANDBOX_CONTROL_KEYS.every(
+      (key) => key === 'enabledPrivilegeCount' || controls[key] === true
+    );
+  }
+  return (
+    APPCONTAINER_CONTROL_KEYS.every(
+      (key) =>
+        ['enabledPrivilegeCount', 'capabilityCount', 'filesystemCanaryError', 'networkCanaryError'].includes(
+          key
+        ) ||
+        (key === 'loopbackAccepted' ? controls[key] === false : controls[key] === true)
+    ) &&
+    controls.capabilityCount === 0 &&
+    controls.filesystemCanaryError === 5 &&
+    [10013, 10060].includes(controls.networkCanaryError)
+  );
+}
+
+function canonicalBase64(value) {
+  if (
+    typeof value !== 'string' ||
+    value.length > Math.ceil(MAX_CONSOLE_BYTES / 3) * 4 ||
+    !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(value)
+  ) {
+    return null;
+  }
+  const bytes = Buffer.from(value, 'base64');
+  return bytes.toString('base64') === value && bytes.length <= MAX_CONSOLE_BYTES ? bytes : null;
+}
+
+function parseSandboxProtocol(result, adapter) {
+  if (
+    result?.status !== 0 ||
+    result?.signal ||
+    result?.error ||
+    logSummary(result?.stderr).bytes !== 0
+  ) {
+    return { ready: false, issueCode: 'vm-launch-sandbox-launcher-failed' };
+  }
+  let message;
+  try {
+    const encoded = Buffer.isBuffer(result.stdout)
+      ? result.stdout.toString('utf8')
+      : String(result.stdout || '');
+    message = JSON.parse(encoded.trim());
+  } catch {
+    return { ready: false, issueCode: 'vm-launch-sandbox-protocol-invalid' };
+  }
+  if (
+    !isRecord(message) ||
+    message.protocol !== adapter.sandboxProtocol ||
+    !isRecord(message.isolation) ||
+    Object.keys(message).some(
+      (key) =>
+        ![
+          'protocol',
+          'launched',
+          'timedOut',
+          'exitCode',
+          'isolation',
+          'stdoutBase64',
+          'stderrBase64',
+          'errorStage',
+          'errorCode',
+        ].includes(key)
+    ) ||
+    Object.keys(message.isolation).some((key) => !isolationControlKeys(adapter).includes(key)) ||
+    Object.keys(message.isolation).length !== isolationControlKeys(adapter).length
+  ) {
+    return { ready: false, issueCode: 'vm-launch-sandbox-protocol-invalid' };
+  }
+  const stdout = canonicalBase64(message.stdoutBase64);
+  const stderr = canonicalBase64(message.stderrBase64);
+  const controlsReady = isolationControlsReady(message.isolation, adapter);
+  if (
+    message.launched !== true ||
+    message.timedOut !== false ||
+    !Number.isInteger(message.exitCode) ||
+    message.errorStage !== null ||
+    message.errorCode !== 0 ||
+    !controlsReady ||
+    !stdout ||
+    !stderr
+  ) {
+    return { ready: false, issueCode: 'vm-launch-sandbox-evidence-invalid' };
+  }
+  return {
+    ready: true,
+    status: message.exitCode,
+    signal: null,
+    stdout,
+    stderr,
+    isolation: Object.fromEntries(
+      isolationControlKeys(adapter).map((key) => [key, message.isolation[key]])
+    ),
+  };
+}
+
 function copyRuntimeSnapshot(sourceDirectory, report, destinationDirectory) {
   mkdirSync(destinationDirectory, { recursive: true });
   for (const file of report.files) {
@@ -656,6 +1089,25 @@ function launchSnapshotMatches(plan, runtimeDirectory, kernelPath, initrdPath) {
   );
 }
 
+function sandboxArtifactsSnapshotMatch(plan, launcherPath, canaryPath, adapter) {
+  if (!adapter.hostSandboxed) return true;
+  try {
+    const stats = lstatSync(launcherPath);
+    const canaryStats = adapter.appContainer ? lstatSync(canaryPath) : null;
+    return (
+      stats.isFile() &&
+      !stats.isSymbolicLink() &&
+      hashBytes(readFileSync(launcherPath)) === plan.sandbox.launcherDigest &&
+      (!adapter.appContainer ||
+        (canaryStats.isFile() &&
+          !canaryStats.isSymbolicLink() &&
+          hashBytes(readFileSync(canaryPath)) === plan.sandbox.canaryDigest))
+    );
+  } catch {
+    return false;
+  }
+}
+
 function runVmLaunchWithProcessRunner(
   { plan, executorDirectory, kernelPath, initrdPath, now = new Date() } = {},
   processRunner,
@@ -668,7 +1120,15 @@ function runVmLaunchWithProcessRunner(
   const executor = inspectVmExecutor({ executorDirectory });
   const kernel = inspectVmLaunchAsset({ assetPath: kernelPath, kind: 'kernel' });
   const initrd = inspectVmLaunchAsset({ assetPath: initrdPath, kind: 'initrd' });
-  receipt.issues.push(...executor.issues, ...kernel.issues, ...initrd.issues);
+  const sandboxLauncher = adapter.hostSandboxed ? inspectWindowsVmSandboxLauncher() : null;
+  const appContainerCanary = adapter.appContainer ? inspectWindowsVmAppContainerCanary() : null;
+  receipt.issues.push(
+    ...executor.issues,
+    ...kernel.issues,
+    ...initrd.issues,
+    ...(sandboxLauncher?.issues || []),
+    ...(appContainerCanary?.issues || [])
+  );
   if (executor.ready && executor.digest !== plan.executor.runtimeDigest) {
     issue(
       receipt.issues,
@@ -701,6 +1161,30 @@ function runVmLaunchWithProcessRunner(
       'Guest initrd does not match the pinned plan digest.'
     );
   }
+  if (
+    adapter.hostSandboxed &&
+    sandboxLauncher?.ready &&
+    sandboxLauncher.digest !== plan.sandbox.launcherDigest
+  ) {
+    issue(
+      receipt.issues,
+      'vm-launch-sandbox-launcher-mismatch',
+      'sandbox.launcherDigest',
+      'Packaged Windows sandbox launcher does not match the pinned plan digest.'
+    );
+  }
+  if (
+    adapter.appContainer &&
+    appContainerCanary?.ready &&
+    appContainerCanary.digest !== plan.sandbox.canaryDigest
+  ) {
+    issue(
+      receipt.issues,
+      'vm-launch-appcontainer-canary-mismatch',
+      'sandbox.canaryDigest',
+      'Packaged Windows AppContainer canary does not match the pinned plan digest.'
+    );
+  }
   if (receipt.issues.length > 0) return finishReceipt(receipt);
 
   const sourceRuntime = resolve(executorDirectory);
@@ -710,12 +1194,27 @@ function runVmLaunchWithProcessRunner(
   const snapshotRuntime = join(snapshotRoot, 'runtime');
   const snapshotKernel = join(snapshotRoot, 'vmlinuz');
   const snapshotInitrd = join(snapshotRoot, 'initramfs');
+  const snapshotLauncher = join(snapshotRoot, SANDBOX_LAUNCHER_BINARY);
+  const snapshotCanary = join(snapshotRoot, APPCONTAINER_CANARY_BINARY);
+  const snapshotTemporary = join(snapshotRoot, 'sandbox-temp');
+  const protectedRoot = adapter.appContainer
+    ? mkdtempSync(join(tmpdir(), 'holosystem-vm-protected-'))
+    : null;
+  const protectedSentinel = protectedRoot ? join(protectedRoot, 'caller-readable.bin') : null;
 
   try {
     try {
       copyRuntimeSnapshot(sourceRuntime, executor, snapshotRuntime);
       copyFileSync(sourceKernel, snapshotKernel);
       copyFileSync(sourceInitrd, snapshotInitrd);
+      if (adapter.hostSandboxed) {
+        copyFileSync(SANDBOX_LAUNCHER_PATH, snapshotLauncher);
+        mkdirSync(snapshotTemporary);
+      }
+      if (adapter.appContainer) copyFileSync(APPCONTAINER_CANARY_PATH, snapshotCanary);
+      if (adapter.appContainer) {
+        writeFileSync(protectedSentinel, Buffer.from('holosystem-appcontainer-read-canary-v1'));
+      }
     } catch {
       issue(
         receipt.issues,
@@ -729,6 +1228,26 @@ function runVmLaunchWithProcessRunner(
     const pinnedExecutor = inspectVmExecutor({ executorDirectory: snapshotRuntime });
     const pinnedKernel = inspectVmLaunchAsset({ assetPath: snapshotKernel, kind: 'kernel' });
     const pinnedInitrd = inspectVmLaunchAsset({ assetPath: snapshotInitrd, kind: 'initrd' });
+    let pinnedLauncherDigest = null;
+    let pinnedCanaryDigest = null;
+    if (adapter.hostSandboxed) {
+      try {
+        const stats = lstatSync(snapshotLauncher);
+        if (!stats.isFile() || stats.isSymbolicLink()) throw new TypeError('not a regular file');
+        pinnedLauncherDigest = hashBytes(readFileSync(snapshotLauncher));
+      } catch {
+        pinnedLauncherDigest = null;
+      }
+    }
+    if (adapter.appContainer) {
+      try {
+        const stats = lstatSync(snapshotCanary);
+        if (!stats.isFile() || stats.isSymbolicLink()) throw new TypeError('not a regular file');
+        pinnedCanaryDigest = hashBytes(readFileSync(snapshotCanary));
+      } catch {
+        pinnedCanaryDigest = null;
+      }
+    }
     if (
       !pinnedExecutor.ready ||
       pinnedExecutor.digest !== plan.executor.runtimeDigest ||
@@ -757,6 +1276,22 @@ function runVmLaunchWithProcessRunner(
         'Guest initrd changed while its private launch snapshot was materialized.'
       );
     }
+    if (adapter.hostSandboxed && pinnedLauncherDigest !== plan.sandbox.launcherDigest) {
+      issue(
+        receipt.issues,
+        'vm-launch-sandbox-launcher-snapshot-mismatch',
+        'sandbox.launcherDigest',
+        'Windows sandbox launcher changed while its private snapshot was materialized.'
+      );
+    }
+    if (adapter.appContainer && pinnedCanaryDigest !== plan.sandbox.canaryDigest) {
+      issue(
+        receipt.issues,
+        'vm-launch-appcontainer-canary-snapshot-mismatch',
+        'sandbox.canaryDigest',
+        'Windows AppContainer canary changed while its private snapshot was materialized.'
+      );
+    }
     if (receipt.issues.length > 0) return finishReceipt(receipt);
 
     receipt.measurementDigest = hashJson({
@@ -765,22 +1300,60 @@ function runVmLaunchWithProcessRunner(
       binaryDigest: pinnedExecutor.binaryDigest,
       kernelDigest: pinnedKernel.digest,
       initrdDigest: pinnedInitrd.digest,
+      ...(adapter.hostSandboxed ? { sandboxLauncherDigest: pinnedLauncherDigest } : {}),
+      ...(adapter.appContainer ? { appContainerCanaryDigest: pinnedCanaryDigest } : {}),
       policy: adapter.policy,
     });
 
-    const command = join(snapshotRuntime, EXECUTOR_BINARY);
-    const args = qemuArguments(plan, snapshotKernel, snapshotInitrd, adapter);
+    const qemuCommand = join(snapshotRuntime, EXECUTOR_BINARY);
+    const qemuArgs = qemuArguments(plan, snapshotKernel, snapshotInitrd, adapter);
+    const command = adapter.hostSandboxed ? snapshotLauncher : qemuCommand;
+    const args = adapter.hostSandboxed
+      ? [
+          '--executable',
+          qemuCommand,
+          '--working-directory',
+          snapshotRuntime,
+          '--sandbox-root',
+          snapshotRoot,
+          '--writable-temp',
+          snapshotTemporary,
+          '--timeout-ms',
+          String(plan.resources.timeoutSeconds * 1000),
+          '--process-memory-bytes',
+          String(SANDBOX_PROCESS_MEMORY_BYTES),
+          ...(adapter.appContainer
+            ? [
+                '--appcontainer-deny',
+                'v1',
+                '--protected-sentinel',
+                protectedSentinel,
+                '--canary-executable',
+                snapshotCanary,
+              ]
+            : []),
+          '--',
+          ...qemuArgs,
+        ]
+      : qemuArgs;
     const options = {
       encoding: null,
-      env: minimalEnvironment(snapshotRoot, snapshotRuntime),
-      maxBuffer: MAX_CONSOLE_BYTES,
+      env: minimalEnvironment(
+        snapshotRoot,
+        snapshotRuntime,
+        adapter.hostSandboxed ? snapshotTemporary : snapshotRoot
+      ),
+      maxBuffer: adapter.hostSandboxed ? SANDBOX_PROTOCOL_BYTES : MAX_CONSOLE_BYTES,
       shell: false,
-      timeout: plan.resources.timeoutSeconds * 1000,
+      timeout: plan.resources.timeoutSeconds * 1000 + (adapter.hostSandboxed ? 5000 : 0),
       windowsHide: true,
     };
 
     for (let index = 0; index < plan.launches; index += 1) {
-      if (!launchSnapshotMatches(plan, snapshotRuntime, snapshotKernel, snapshotInitrd)) {
+      if (
+        !launchSnapshotMatches(plan, snapshotRuntime, snapshotKernel, snapshotInitrd) ||
+        !sandboxArtifactsSnapshotMatch(plan, snapshotLauncher, snapshotCanary, adapter)
+      ) {
         issue(
           receipt.issues,
           'vm-launch-snapshot-drift',
@@ -795,10 +1368,30 @@ function runVmLaunchWithProcessRunner(
       } catch {
         result = { status: null, signal: null, stdout: Buffer.alloc(0), stderr: Buffer.alloc(0) };
       }
+      if (adapter.hostSandboxed) {
+        const protocol = parseSandboxProtocol(result, adapter);
+        if (!protocol.ready) {
+          issue(
+            receipt.issues,
+            protocol.issueCode,
+            `launches[${index}].isolation`,
+            'Measured Windows sandbox launcher did not return complete closed-protocol evidence.'
+          );
+          result = {
+            status: null,
+            signal: null,
+            stdout: Buffer.alloc(0),
+            stderr: Buffer.alloc(0),
+            isolation: null,
+          };
+        } else {
+          result = protocol;
+        }
+      }
       const stdout = logSummary(result?.stdout);
       const stderr = logSummary(
         adapter.requiresDiagnosticsDigest
-          ? normalizedDiagnostics(result?.stderr, command)
+          ? normalizedDiagnostics(result?.stderr, qemuCommand)
           : result?.stderr
       );
       const launch = {
@@ -807,6 +1400,7 @@ function runVmLaunchWithProcessRunner(
         signal: typeof result?.signal === 'string' ? result.signal : null,
         stdout,
         stderr,
+        ...(adapter.hostSandboxed ? { isolation: result?.isolation || null } : {}),
       };
       receipt.launches.push(launch);
       if (result?.status === null || result?.status === undefined || result?.error) {
@@ -850,7 +1444,10 @@ function runVmLaunchWithProcessRunner(
           'Host emulator diagnostics were emitted; raw bytes are withheld.'
         );
       }
-      if (!launchSnapshotMatches(plan, snapshotRuntime, snapshotKernel, snapshotInitrd)) {
+      if (
+        !launchSnapshotMatches(plan, snapshotRuntime, snapshotKernel, snapshotInitrd) ||
+        !sandboxArtifactsSnapshotMatch(plan, snapshotLauncher, snapshotCanary, adapter)
+      ) {
         issue(
           receipt.issues,
           'vm-launch-snapshot-drift',
@@ -862,10 +1459,17 @@ function runVmLaunchWithProcessRunner(
     }
   } finally {
     rmSync(snapshotRoot, { recursive: true, force: true });
+    if (protectedRoot) rmSync(protectedRoot, { recursive: true, force: true });
   }
 
-  const launchSignatures = receipt.launches.map(({ exitCode, signal, stdout, stderr }) =>
-    hashJson({ exitCode, signal, stdout, stderr })
+  const launchSignatures = receipt.launches.map(({ exitCode, signal, stdout, stderr, isolation }) =>
+    hashJson({
+      exitCode,
+      signal,
+      stdout,
+      stderr,
+      ...(adapter.hostSandboxed ? { isolation } : {}),
+    })
   );
   if (launchSignatures.length === plan.launches && new Set(launchSignatures).size !== 1) {
     issue(
@@ -884,16 +1488,32 @@ function runVmLaunchWithProcessRunner(
     receipt.verified = true;
     receipt.hardwareBacked = adapter.hardwareBacked;
     receipt.acceleration.verified = adapter.hardwareBacked;
+    if (adapter.hostSandboxed) {
+      receipt.isolation = {
+        ...receipt.isolation,
+        verified: true,
+        controls: { ...receipt.launches[0].isolation },
+      };
+    }
     receipt.coverage = {
       includedLayers: [
         'guest-artifact-measurement',
         ...(adapter.hardwareBacked ? ['hardware-hypervisor-acceleration'] : []),
+        ...(adapter.hostSandboxed ? ['host-process-isolation'] : []),
+        ...(adapter.filesystemConfidentiality ? ['host-filesystem-confidentiality'] : []),
+        ...(adapter.networkIsolation ? ['host-network-isolation'] : []),
         'machine-vm-launch',
         'virtual-device-minimization',
       ],
       missingLayers: [
         ...(!adapter.hardwareBacked ? ['hardware-hypervisor-acceleration'] : []),
-        'host-process-isolation',
+        ...(!adapter.hostSandboxed ? ['host-process-isolation'] : []),
+        ...(adapter.hostSandboxed && !adapter.filesystemConfidentiality
+          ? ['host-filesystem-confidentiality']
+          : []),
+        ...(adapter.hostSandboxed && !adapter.networkIsolation
+          ? ['host-network-isolation']
+          : []),
       ],
     };
   }
@@ -908,6 +1528,18 @@ export function runWhpxVmLaunch(options = {}) {
   return runVmLaunchWithProcessRunner(options, spawnSync, WHPX_ADAPTER);
 }
 
+export function runWhpxSandboxedVmLaunch(options = {}) {
+  return runVmLaunchWithProcessRunner(options, spawnSync, WHPX_SANDBOXED_ADAPTER);
+}
+
+export function runWhpxAppContainerVmLaunch(options = {}) {
+  return runVmLaunchWithProcessRunner(options, spawnSync, WHPX_APPCONTAINER_ADAPTER);
+}
+
+export function runAppContainerVmLaunch(options = {}) {
+  return runVmLaunchWithProcessRunner(options, spawnSync, APPCONTAINER_TCG_ADAPTER);
+}
+
 // Repository tests need a deterministic process boundary without publishing an
 // injectable executor through the package root export.
 export function runVmLaunchWithProcessRunnerForTest(options = {}) {
@@ -925,3 +1557,27 @@ export function runWhpxVmLaunchWithProcessRunnerForTest(options = {}) {
   const { processRunner, ...launchOptions } = options;
   return runVmLaunchWithProcessRunner(launchOptions, processRunner, WHPX_ADAPTER);
 }
+
+export function runWhpxSandboxedVmLaunchWithProcessRunnerForTest(options = {}) {
+  if (typeof options.processRunner !== 'function') {
+    throw new TypeError('processRunner test adapter is required.');
+  }
+  const { processRunner, ...launchOptions } = options;
+  return runVmLaunchWithProcessRunner(launchOptions, processRunner, WHPX_SANDBOXED_ADAPTER);
+}
+
+export function runWhpxAppContainerVmLaunchWithProcessRunnerForTest(options = {}) {
+  if (typeof options.processRunner !== 'function') {
+    throw new TypeError('processRunner test adapter is required.');
+  }
+  const { processRunner, ...launchOptions } = options;
+  return runVmLaunchWithProcessRunner(launchOptions, processRunner, WHPX_APPCONTAINER_ADAPTER);
+}
+
+export function runAppContainerVmLaunchWithProcessRunnerForTest(options = {}) {
+  if (typeof options.processRunner !== 'function') {
+    throw new TypeError('processRunner test adapter is required.');
+  }
+  const { processRunner, ...launchOptions } = options;
+  return runVmLaunchWithProcessRunner(launchOptions, processRunner, APPCONTAINER_TCG_ADAPTER);
+}