@holoscript/holosystem 0.2.4 → 0.2.6

package/README.md

@@ -55,6 +55,48 @@ returns one highest-priority candidate, and carries authority, validation, lease
 and spend stop conditions. It selects work; it does not claim a board task,
 publish a package, spend funds, or bypass caller authority.
 
+## HoloScript Source Canon
+
+`source-canon` is the consumer-side language-sovereignty gate. Run it from the
+root of a Git repository:
+
+```bash
+npx holosystem source-canon \
+  --output runtime/visual-state/source-canon.hsplus \
+  --json
+```
+
+The gate reads the fixed Git-tracked file inventory and accepts only `.holo`,
+`.hs`, and `.hsplus` as canonical authored source. It then parses the actual
+tracked bytes with the exact optional peer `@holoscript/core@8.0.14`; when that
+parser is unavailable, the gate fails closed. This prevents JavaScript or another
+language from becoming canonical merely by being renamed. Other HoloSystem
+commands remain usable without the optional peer.
+
+A caller cannot widen the registry with an extension allowlist. A future format
+becomes canonical only when a HoloScript release owns its parser and adds it to
+the package registry.
+
+The command exits `0` only when at least one HoloScript source file exists and
+every tracked file uses a canonical format. It exits `2` with every foreign
+tracked path named otherwise. When `--output` is supplied, the durable
+founder-visible projection must itself be a portable repository-relative
+`.hsplus` path; JSON remains available only on standard output for transient
+agent pipelines.
+
+This gate audits Git-tracked canon. Dependency caches, runtime receipts, and
+untracked generated artifacts are not silently promoted to source truth. They
+remain non-canonical operational state and must stay untracked or move to an
+external runtime store as the consumer migration proceeds.
+
+```js
+import {
+  inspectGitTrackedSourceCanon,
+  inspectSourceCanon,
+  renderSourceCanonProjection,
+} from '@holoscript/holosystem';
+```
+
 ## Substrate Closure
 
 The substrate closure replaces an implicit operating-system dependency tower
@@ -521,6 +563,20 @@ kill-on-close Job Object with one-process, memory, and UI restrictions, and
 only then resumes it. A private low-integrity temporary directory is the only
 intended writable launch location.
 
+`vm-launch-whpx-appcontainer` is a fourth, separately named vocabulary. It
+retains those restricted-token and Job controls, gives an ephemeral Windows
+AppContainer identity zero capabilities, grants that identity only read/execute
+access to the measured launch snapshot and modify access to its private temp
+directory, and requires file-read plus loopback-connect attack canaries to fail
+before either WHPX launch begins. The plan cannot name a capability, path,
+command, network mode, or fallback.
+
+`vm-launch-appcontainer` uses the same zero-capability boundary with QEMU TCG.
+It fixes the translation buffer at 64 MiB so the one-process 512 MiB Job limit
+remains effective. This is the fully confined adapter proven on the validated
+Windows host: it proves the machine VM and host file/network boundary, but sets
+`hardwareBacked: false` and keeps hardware acceleration missing.
+
 First measure the complete caller-owned QEMU runtime closure and both guest
 artifacts:
 
@@ -596,6 +652,25 @@ process creation. The launcher source and local rebuild recipe are shipped in
 `native/windows-sandbox`; the measured binary is shipped in
 `native/windows-x64`.
 
+For the AppContainer adapter, use schema
+`holoscript.holosystem.whpx-appcontainer-vm-launch-plan.v1`, use the same
+launcher digest with sandbox kind `windows-appcontainer-deny-v1`, and call
+`vm-launch-whpx-appcontainer`. The launcher creates and deletes a fresh profile
+for each launch. Its closed receipt protocol must prove the child AppContainer
+SID, zero capabilities, low-integrity filtered token, snapshot/temp grants,
+access-denied (`5`) for a protected caller-readable file, plus either explicit
+WSA access-denied (`10013`) or a bounded WFP-style packet-drop timeout (`10060`)
+with no accepted live loopback connection. Any missing or changed observation
+blocks the receipt.
+
+Use schema `holoscript.holosystem.appcontainer-vm-launch-plan.v1`, target
+accelerator `tcg`, the same two sandbox digests, and command
+`vm-launch-appcontainer` for the software-emulated confined lane. On the
+validated Windows 11 host, the WHPX AppContainer form fails closed because
+Windows returns `0x80070005` when zero-capability QEMU initializes WHPX. The
+package does not merge that result with the separately proven hardware-backed
+low-integrity WHPX receipt.
+
 The runner creates a private snapshot and remeasures the complete QEMU closure,
 kernel, and initramfs before and after each launch. It then generates QEMU
 arguments that disable user configuration, default devices, networking, USB,
@@ -629,15 +704,31 @@ boundary. The sandboxed receipt also does not prove the broader hardware and
 firmware properties named above. The
 exact claims are in the [VM launch threat model](./docs/vm-launch-threat-model.md).
 
+A verified `vm-launch-whpx-appcontainer` receipt additionally includes
+`host-filesystem-confidentiality` and `host-network-isolation` for the tested
+zero-capability AppContainer boundary. Those are scoped claims: they do not
+establish QEMU provenance, host-kernel correctness, IOMMU separation, measured
+boot, firmware authenticity, crash-dump custody, confidential memory, or
+side-channel resistance.
+
+A verified `vm-launch-appcontainer` receipt includes the same process,
+filesystem, and network layers while leaving
+`hardware-hypervisor-acceleration` missing. Receipts describe one executed
+boundary, not the union of properties observed in different launches.
+
 ```js
 import {
   inspectVmExecutor,
+  inspectAppContainerVmLaunchPlan,
   inspectVmLaunchAsset,
   inspectVmLaunchPlan,
   inspectWindowsVmSandboxLauncher,
+  inspectWhpxAppContainerVmLaunchPlan,
   inspectWhpxSandboxedVmLaunchPlan,
   inspectWhpxVmLaunchPlan,
   runVmLaunch,
+  runAppContainerVmLaunch,
+  runWhpxAppContainerVmLaunch,
   runWhpxSandboxedVmLaunch,
   runWhpxVmLaunch,
 } from '@holoscript/holosystem';
@@ -700,6 +791,9 @@ npx holosystem inspect holosystem.config.json --json
 
 # Pipeline input is supported.
 npx holosystem create --stdout | npx holosystem inspect - --json
+
+# Prove that Git-tracked authoring is HoloScript-only.
+npx holosystem source-canon --output source-canon.hsplus --json
 ```
 
 Creation never installs packages, connects to storage, acquires credentials, or

package/bin/holosystem.mjs

@@ -10,13 +10,17 @@ import {
   importDebianPackageSnapshot,
   importNpmPackageLock,
   inspectNativeBuildSource,
+  inspectGitTrackedSourceCanon,
   inspectHoloSystemConfig,
   inspectVmExecutor,
   inspectVmLaunchAsset,
   runNativeBuild,
+  runAppContainerVmLaunch,
   runVmLaunch,
+  runWhpxAppContainerVmLaunch,
   runWhpxSandboxedVmLaunch,
   runWhpxVmLaunch,
+  renderSourceCanonProjection,
 } from '../src/index.mjs';
 
 const CLI_RECEIPT_SCHEMA = 'holoscript.holosystem.cli-receipt.v1';
@@ -32,11 +36,14 @@ Usage:
   holosystem substrate-import-debian --status <status> (--packages <Packages> | --sources <json>) --maintainer-scripts <json> --config <file> [--output <file>] [--force] [--json]
   holosystem native-build-source --source <directory> [--json]
   holosystem native-build --plan <file> --source <directory> --executor <file> --artifact-dir <directory> [--output <receipt>] [--force] [--json]
+  holosystem source-canon [--output <projection.hsplus>] [--force] [--json]
   holosystem vm-executor --runtime <directory> [--json]
   holosystem vm-asset --kind <kernel|initrd> --file <file> [--json]
   holosystem vm-launch --plan <file> --runtime <directory> --kernel <file> --initrd <file> [--output <receipt>] [--force] [--json]
+  holosystem vm-launch-appcontainer --plan <file> --runtime <directory> --kernel <file> --initrd <file> [--output <receipt>] [--force] [--json]
   holosystem vm-launch-whpx --plan <file> --runtime <directory> --kernel <file> --initrd <file> [--output <receipt>] [--force] [--json]
   holosystem vm-launch-whpx-sandboxed --plan <file> --runtime <directory> --kernel <file> --initrd <file> [--output <receipt>] [--force] [--json]
+  holosystem vm-launch-whpx-appcontainer --plan <file> --runtime <directory> --kernel <file> --initrd <file> [--output <receipt>] [--force] [--json]
   holosystem substrate --input <file> [--output <file>] [--force] [--json]
   holosystem --help
   holosystem --version
@@ -202,6 +209,63 @@ function writeJsonOutput(path, value, { force = false } = {}) {
   writeFileSync(absolute, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
 }
 
+function writeSourceCanonProjection(path, value, { force = false } = {}) {
+  if (
+    typeof path !== 'string' ||
+    !path.endsWith('.hsplus') ||
+    /^[A-Za-z]:[\\/]/u.test(path) ||
+    /^(?:[\\/]{1,2}|~[\\/])/u.test(path) ||
+    path.replaceAll('\\', '/').split('/').some((segment) => segment === '..' || segment === '.')
+  ) {
+    throw new Error('--output must be a portable repository-relative .hsplus path.');
+  }
+  const absolute = resolve(process.cwd(), path);
+  if (existsSync(absolute) && !force)
+    throw new Error(`${path} already exists; use --force to replace it.`);
+  writeFileSync(absolute, value, 'utf8');
+}
+
+async function runSourceCanon(args) {
+  let parsed;
+  try {
+    parsed = parseArguments(args, {
+      output: 'value',
+      force: 'boolean',
+      json: 'boolean',
+    });
+  } catch (error) {
+    die(error.message, { json: args.includes('--json') });
+  }
+  const { options, positionals } = parsed;
+  if (positionals.length > 0) {
+    die('source-canon does not accept positional arguments.', { json: options.json });
+  }
+
+  let report;
+  try {
+    report = await inspectGitTrackedSourceCanon({ rootDirectory: process.cwd() });
+    if (options.output) {
+      writeSourceCanonProjection(options.output, renderSourceCanonProjection(report), {
+        force: options.force,
+      });
+    }
+  } catch (error) {
+    die(`Cannot inspect source canon: ${error.message}`, { json: options.json, code: 2 });
+  }
+
+  if (options.json) outputJson(report);
+  else {
+    process.stdout.write(
+      `Source canon: ${report.status} HoloScript=${report.summary.holoScriptFiles} foreign=${report.summary.foreignFiles}\n`
+    );
+    for (const issue of report.issues) {
+      process.stdout.write(`BLOCK ${issue.code} ${issue.path}: ${issue.message}\n`);
+    }
+    if (options.output) process.stdout.write(`Wrote ${options.output}\n`);
+  }
+  if (!report.verified) process.exitCode = 2;
+}
+
 function runInspect(args) {
   let parsed;
   try {
@@ -697,12 +761,19 @@ if (!command || command === '--help' || command === '-h' || command === 'help')
   runNativeBuildSource(argv.slice(1));
 } else if (command === 'native-build') {
   runNativeBuildCommand(argv.slice(1));
+} else if (command === 'source-canon') {
+  await runSourceCanon(argv.slice(1));
 } else if (command === 'vm-executor') {
   runVmExecutor(argv.slice(1));
 } else if (command === 'vm-asset') {
   runVmAsset(argv.slice(1));
 } else if (command === 'vm-launch') {
   runVmLaunchCommand(argv.slice(1));
+} else if (command === 'vm-launch-appcontainer') {
+  runVmLaunchCommand(argv.slice(1), {
+    launcher: runAppContainerVmLaunch,
+    commandName: 'vm-launch-appcontainer',
+  });
 } else if (command === 'vm-launch-whpx') {
   runVmLaunchCommand(argv.slice(1), {
     launcher: runWhpxVmLaunch,
@@ -713,6 +784,11 @@ if (!command || command === '--help' || command === '-h' || command === 'help')
     launcher: runWhpxSandboxedVmLaunch,
     commandName: 'vm-launch-whpx-sandboxed',
   });
+} else if (command === 'vm-launch-whpx-appcontainer') {
+  runVmLaunchCommand(argv.slice(1), {
+    launcher: runWhpxAppContainerVmLaunch,
+    commandName: 'vm-launch-whpx-appcontainer',
+  });
 } else if (command === 'substrate') {
   runSubstrate(argv.slice(1));
 } else {

package/docs/vm-launch-threat-model.md

@@ -27,6 +27,25 @@ full Job UI restrictions. Its `host-process-isolation` claim is limited to
 those controls. It is not an AppContainer and does not claim host filesystem
 confidentiality or host network isolation.
 
+`vm-launch-whpx-appcontainer` is another separate schema and receipt. It adds
+an ephemeral zero-capability AppContainer identity to the same filtered,
+low-integrity token and pre-resume Job boundary. The identity receives inherited
+read/execute access to the private measured snapshot and modify access only to
+the private temp directory. Before QEMU starts, the launcher runs an
+AppContainer child under the same token and verifies that it cannot read a
+caller-readable protected sentinel or connect to a live loopback listener. The
+receipt claims filesystem confidentiality and network isolation only when the
+token identity, zero capability count, exact denial errors, and both WHPX boots
+all verify.
+
+`vm-launch-appcontainer` applies the same boundary to TCG with a fixed 64 MiB
+translation buffer. It can claim process, filesystem, and network isolation
+after two deterministic boots, but it cannot claim hardware acceleration. On
+the validated Windows 11 host, zero-capability QEMU receives access denied
+(`0x80070005`) while initializing WHPX. That negative result is preserved as a
+blocked WHPX AppContainer receipt; it is never combined with the verified TCG
+AppContainer receipt or the separately verified low-integrity WHPX receipt.
+
 ## Protected assets and trust boundaries
 
 The protected inputs are the declarative plan, the complete caller-owned QEMU
@@ -65,6 +84,10 @@ than implied away by a successful boot.
 | Select ambient execution, weaken a sandbox control, change the launcher, or forge its protocol       | Reject the distinct sandbox schema, launcher digest, or incomplete evidence | Closed sandbox vocabulary and protocol-forgery tests       |
 | Pass inherited parent handles into sandboxed QEMU                                                    | Admit only NUL input and the two bounded output pipes                       | Native handle-list evidence and receipt assertion          |
 | Spawn another process or escape launcher lifetime/resource bounds                                    | Assign suspended QEMU before resume to a one-process, kill-on-close Job     | Native Job evidence and adversarial receipt tests          |
+| Add an AppContainer capability, path grant, network mode, command, or fallback                        | Reject the distinct closed plan vocabulary before launch                    | AppContainer closed-vocabulary test                        |
+| Forge the AppContainer SID, capability count, profile cleanup, or grant evidence                      | Reject the closed native protocol                                            | AppContainer protocol-forgery test                         |
+| Read a caller-readable file outside the measured snapshot                                             | Require exact access-denied evidence from a zero-capability AppContainer     | Protected-sentinel canary and receipt assertion            |
+| Connect to the host loopback listener from compromised QEMU                                           | Require bounded WSA deny/drop evidence and no accepted connection            | Loopback canary and receipt assertion                      |
 | Put an operational path or guest output in the receipt                                               | Withhold it; report only digest and byte count                              | Receipt disclosure assertions                              |
 
 ## Fixed launch policy
@@ -93,6 +116,20 @@ rejects unknown fields, non-canonical base64, an unbounded enabled-privilege
 count, a missing control, or launcher stderr. Launcher and QEMU snapshots are
 remeasured before and after both launches.
 
+The AppContainer adapter uses the same measured launcher but a distinct plan,
+protocol, and control vocabulary. It never accepts caller-specified capabilities
+or ACL paths. Each native invocation creates a fresh AppContainer profile,
+applies the fixed grants, runs both canaries, creates QEMU with the same zero
+capability `SECURITY_CAPABILITIES`, checks the suspended child token, and deletes
+the profile during cleanup. HoloSystem rejects a nonzero capability count,
+unexpected bounded denial code, accepted loopback connection, incomplete cleanup, or
+any unknown protocol field.
+
+The TCG AppContainer plan also fixes `tcg,tb-size=64`; a caller cannot enlarge
+the JIT translation buffer or relax the 512 MiB process limit. Its receipt keeps
+`hardware-hypervisor-acceleration` missing even when every confinement canary
+passes.
+
 ## Residual risk and next layer
 
 The QEMU runtime closure includes firmware data files and DLLs, so substitution
@@ -114,8 +151,9 @@ isolation controls verify. The launcher binary is measured, but source-to-binary
 reproducibility and code signing remain part of `qemu-runtime-supply-chain` and
 host correctness trust.
 
-The next stronger layer is an AppContainer or separate-host-VM adapter that can
-retain WHPX access while proving capability-scoped filesystem and network
-denial, followed by firmware/measured-boot evidence. It must continue to report
-IOMMU, device-assignment, crash-dump custody, and side-channel boundaries
-separately.
+The TCG AppContainer tracer implements capability-scoped filesystem and network
+denial without hardware acceleration; the WHPX form remains blocked on the
+validated host. It does not turn the Windows kernel into a separate trust
+domain. The next layers are a WHPX broker or independent host boundary and
+firmware/measured-boot evidence. IOMMU, device-assignment, crash-dump custody,
+host correctness, and side-channel boundaries remain separate.

package/native/windows-sandbox/Canary.c

@@ -0,0 +1,107 @@
+#define WIN32_LEAN_AND_MEAN
+#include <winsock2.h>
+#include <windows.h>
+#include <stdio.h>
+#include <wchar.h>
+
+static int read_token_integer(HANDLE token, TOKEN_INFORMATION_CLASS information_class, int fallback)
+{
+    DWORD required = 0;
+    BYTE *buffer;
+    int value;
+    GetTokenInformation(token, information_class, NULL, 0, &required);
+    if (required == 0) return fallback;
+    buffer = (BYTE *)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, required);
+    if (buffer == NULL) return fallback;
+    if (!GetTokenInformation(token, information_class, buffer, required, &required)) {
+        HeapFree(GetProcessHeap(), 0, buffer);
+        return fallback;
+    }
+    value = *(int *)buffer;
+    HeapFree(GetProcessHeap(), 0, buffer);
+    return value;
+}
+
+int wmain(int argc, wchar_t **argv)
+{
+    HANDLE file = INVALID_HANDLE_VALUE;
+    HANDLE token = NULL;
+    WSADATA socket_data;
+    SOCKET socket_handle = INVALID_SOCKET;
+    struct sockaddr_in address;
+    fd_set writable;
+    fd_set exceptional;
+    struct timeval wait_time;
+    u_long nonblocking = 1;
+    int port;
+    int filesystem_error = 0;
+    int network_error = 0;
+    int app_container = 0;
+    int capability_count = -1;
+
+    if (argc != 5 || wcscmp(argv[1], L"--protected-sentinel") != 0 ||
+        wcscmp(argv[3], L"--loopback-port") != 0) return 64;
+    port = _wtoi(argv[4]);
+    if (port < 1 || port > 65535) return 64;
+
+    file = CreateFileW(
+        argv[2], GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING,
+        FILE_ATTRIBUTE_NORMAL, NULL
+    );
+    if (file == INVALID_HANDLE_VALUE) filesystem_error = (int)GetLastError();
+    else CloseHandle(file);
+
+    if (WSAStartup(MAKEWORD(2, 2), &socket_data) != 0) {
+        network_error = WSAGetLastError();
+    } else {
+        socket_handle = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+        if (socket_handle == INVALID_SOCKET) {
+            network_error = WSAGetLastError();
+        } else {
+            ioctlsocket(socket_handle, FIONBIO, &nonblocking);
+            ZeroMemory(&address, sizeof(address));
+            address.sin_family = AF_INET;
+            address.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+            address.sin_port = htons((u_short)port);
+            if (connect(socket_handle, (struct sockaddr *)&address, sizeof(address)) == SOCKET_ERROR) {
+                network_error = WSAGetLastError();
+                if (network_error == WSAEWOULDBLOCK) {
+                    FD_ZERO(&writable);
+                    FD_ZERO(&exceptional);
+                    FD_SET(socket_handle, &writable);
+                    FD_SET(socket_handle, &exceptional);
+                    wait_time.tv_sec = 2;
+                    wait_time.tv_usec = 0;
+                    if (select(0, NULL, &writable, &exceptional, &wait_time) > 0) {
+                        int socket_error = 0;
+                        int error_length = sizeof(socket_error);
+                        if (getsockopt(
+                            socket_handle, SOL_SOCKET, SO_ERROR,
+                            (char *)&socket_error, &error_length
+                        ) == 0) network_error = socket_error;
+                        else network_error = WSAGetLastError();
+                    } else {
+                        network_error = WSAETIMEDOUT;
+                    }
+                }
+            }
+            closesocket(socket_handle);
+        }
+        WSACleanup();
+    }
+
+    if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &token)) {
+        app_container = read_token_integer(token, TokenIsAppContainer, 0);
+        capability_count = read_token_integer(token, TokenCapabilities, -1);
+        CloseHandle(token);
+    }
+
+    printf(
+        "appContainer=%d;capabilityCount=%d;filesystemError=%d;networkError=%d\n",
+        app_container != 0 ? 1 : 0,
+        capability_count,
+        filesystem_error,
+        network_error
+    );
+    return 0;
+}