@runuai/host 0.9.13 → 0.9.42

package/scripts/agent/task-up.sh

@@ -13,9 +13,12 @@
 #      branch, seed .tool-versions when missing.
 #   4. Generate .uai/docker-compose.yml in bash (and a derived .uai/Dockerfile
 #      when any project declares `extra`).
-#   5. docker compose -p task-<id> up -d (--build only when derived).
-#   6. docker cp AI auth into the container, then docker exec uai-init.
-#   7. Discover code-server + preview ports; mark status=running; unlock.
+#   5. Build the derived image when needed, then materialize every runtime and
+#      package-manager default needed by the selected projects through the
+#      exact image the task will run.
+#   6. docker compose -p task-<id> up -d (without rebuilding).
+#   7. docker cp AI auth into the container, then docker exec uai-init.
+#   8. Discover code-server + preview ports; mark status=running; unlock.
 #
 # The AIs are NOT started here — the chat orchestrator drives them and
 # delivers the task's initial prompt once the task is running.
@@ -34,10 +37,33 @@ setup_err_trap
 # Pinned constants (all clusters must agree — see ADR-022).
 STANDARD_IMAGE="uai-standard:dev"
 ASDF_VOLUME="uai-asdf-data"
+TASK_NPM_PREFIX="/home/node/.local/share/uai-npm"
+TASK_NPM_CACHE="/home/node/.cache/uai-npm"
+# Host-proved shims and system controls always win. A task-global package with
+# a new command name remains discoverable at the final path component, while a
+# package named node/claude/git/sh cannot intercept managed or agent startup.
+TASK_RUNTIME_PATH="/opt/asdf-data/shims:/opt/asdf/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$TASK_NPM_PREFIX/bin"
 # ADR-053: host-wide Playwright browser cache (Chromium downloads once).
 PW_VOLUME="uai-playwright"
+# ADR-106: on the Apple runtime the cache is a host DIRECTORY instead. Apple
+# block volumes allow exactly ONE writable attachment, and session start
+# writes browsers from inside every task — a shared writable volume let the
+# first task exclude every later `container run` (live 2026-08-17). Virtiofs
+# directory shares carry no exclusivity, like /workspace itself.
+PW_BROWSERS_DIR="$UAI_WORKSPACE_ROOT/pw-browsers"
 DERIVED_IMAGE="uai-task-${task_id}"
 
+# ADR-106: runtime selection is shared with task-down/task-status via
+# _common.sh; `docker` keeps the historical Compose path byte-for-byte, while
+# `apple-container` drives the bundled Apple CLI directly (no Compose, no
+# published ports — tasks are reached at their vmnet IP).
+validate_task_runtime_selection
+# Per-container VM sizing (Apple runtime only; Docker tasks share the daemon
+# VM). Overridable for constrained hosts; ADR-106 picked these defaults for a
+# dev task with language servers + builds.
+APPLE_TASK_MEMORY="${UAI_APPLE_TASK_MEMORY:-8192M}"
+APPLE_TASK_CPUS="${UAI_APPLE_TASK_CPUS:-4}"
+
 # Project-defined environment values arrive as one JSON object on stdin. They
 # are deliberately NOT part of this host process environment: names such as
 # BASH_ENV, PATH, GIT_CONFIG_*, and UAI_* must not influence task setup or the
@@ -60,6 +86,8 @@ task_uai_dir="$task_dir/.uai"
 projects_root="$UAI_WORKSPACE_ROOT/projects"
 compose_project=$(compose_project_for_task "$task_id")
 app_container=$(app_container_for_task "$task_id")
+[ "$TASK_RUNTIME_MODE" != "apple-container" ] \
+  || app_container=$(apple_app_container_for_task "$task_id")
 
 reject_unsafe_host_directory() {
   local path="$1" label="$2"
@@ -70,6 +98,36 @@ reject_unsafe_host_directory() {
   fi
 }
 
+reject_unsafe_runtime_manifest() {
+  local path="$1" project_slug="$2" project_id="$3"
+  if [ -L "$path" ]; then
+    emit_err "WORKTREE_FAILED" \
+      "Uai refused a symbolic-link .tool-versions for $project_slug" \
+      "validate task worktree ($project_id)"
+  fi
+  # Never open an untrusted special file: `-f` is a metadata-only check, so a
+  # FIFO/socket/device cannot block the host while it validates a resumed
+  # container-writable workspace.
+  if [ -e "$path" ] && [ ! -f "$path" ]; then
+    emit_err "WORKTREE_FAILED" \
+      "Uai refused a non-regular .tool-versions for $project_slug" \
+      "validate task worktree ($project_id)"
+  fi
+}
+
+reject_workspace_runtime_shadow() {
+  local path="$task_workspace/.tool-versions"
+  # The workspace root is not a project. Any entry here would shadow the
+  # image defaults for a no-manifest project (and even a scratchpad command),
+  # while the trusted materializer proves only the selected project paths.
+  # Metadata-only predicates keep FIFO/device/socket cases nonblocking.
+  if [ -L "$path" ] || [ -e "$path" ]; then
+    emit_err "WORKTREE_FAILED" \
+      "Uai refused a workspace-root .tool-versions because it could override the runtimes proved for this task" \
+      "validate task workspace runtime authority"
+  fi
+}
+
 mapped_host_port() {
   local container="$1" container_port="$2"
   docker port "$container" "$container_port" 2>/dev/null \
@@ -78,6 +136,292 @@ mapped_host_port() {
     || true
 }
 
+# A failed Docker call cannot be followed by an unbounded health probe: the
+# same stuck socket would defeat the operation's own watchdog. This portable
+# Bash 3.2 wrapper gives `docker info` 15 seconds, writes completion before its
+# exact wrapper PID disappears, and reaps every helper on success or timeout.
+docker_daemon_reachable_bounded() {
+  local probe_dir wrapper_pid watchdog_pid probe_rc=0 watchdog_sleep_pid
+
+  probe_dir=$(mktemp -d "$task_uai_dir/.docker-info-watchdog.XXXXXX")
+  (
+    runtime_probe_pid=""
+    finish_runtime_probe() {
+      local wrapper_rc=$?
+      trap - EXIT
+      : > "$probe_dir/completed"
+      exit "$wrapper_rc"
+    }
+    terminate_runtime_probe() {
+      local signal_rc="$1"
+      trap - TERM INT
+      if [ -n "$runtime_probe_pid" ]; then
+        kill -TERM "$runtime_probe_pid" >/dev/null 2>&1 || true
+        sleep 2
+        kill -KILL "$runtime_probe_pid" >/dev/null 2>&1 || true
+        wait "$runtime_probe_pid" 2>/dev/null || true
+      fi
+      exit "$signal_rc"
+    }
+    trap finish_runtime_probe EXIT
+    trap 'terminate_runtime_probe 143' TERM
+    trap 'terminate_runtime_probe 130' INT
+    if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+      "$CONTAINER_CLI" system status >/dev/null 2>&1 &
+    else
+      docker info --format '{{.ServerVersion}}' >/dev/null 2>&1 &
+    fi
+    runtime_probe_pid=$!
+    if wait "$runtime_probe_pid"; then exit 0; else exit $?; fi
+  ) &
+  wrapper_pid=$!
+
+  (
+    watchdog_sleep_pid=""
+    cancel_probe_watchdog() {
+      trap - TERM INT
+      if [ -n "$watchdog_sleep_pid" ]; then
+        kill -TERM "$watchdog_sleep_pid" >/dev/null 2>&1 || true
+        wait "$watchdog_sleep_pid" 2>/dev/null || true
+      fi
+      exit 0
+    }
+    trap cancel_probe_watchdog TERM INT
+    sleep 15 &
+    watchdog_sleep_pid=$!
+    if ! wait "$watchdog_sleep_pid"; then exit 0; fi
+    watchdog_sleep_pid=""
+    if [ ! -f "$probe_dir/completed" ] \
+       && kill -0 "$wrapper_pid" >/dev/null 2>&1; then
+      : > "$probe_dir/timed-out"
+      kill -TERM "$wrapper_pid" >/dev/null 2>&1 || true
+      sleep 5 &
+      watchdog_sleep_pid=$!
+      wait "$watchdog_sleep_pid" 2>/dev/null || true
+      watchdog_sleep_pid=""
+      if [ ! -f "$probe_dir/completed" ]; then
+        kill -KILL "$wrapper_pid" >/dev/null 2>&1 || true
+      fi
+    fi
+  ) &
+  watchdog_pid=$!
+
+  if wait "$wrapper_pid"; then probe_rc=0; else probe_rc=$?; fi
+  kill -TERM "$watchdog_pid" >/dev/null 2>&1 || true
+  wait "$watchdog_pid" 2>/dev/null || true
+  [ ! -f "$probe_dir/timed-out" ] || probe_rc=124
+  rm -f "$probe_dir/completed" "$probe_dir/timed-out"
+  rmdir "$probe_dir" 2>/dev/null || true
+  return "$probe_rc"
+}
+
+# A Docker-dependent step can fail for its own, degradable reason (for example,
+# uai-init exits nonzero while the container remains healthy) or because the
+# daemon disappeared after TypeScript admitted task-up. Only the latter is
+# retryable host infrastructure state. Re-probe before translating a failed
+# Docker step into an operation-specific error or warning so task-up never
+# publishes status=running against an unknown backend.
+require_docker_after_failed_step() {
+  local step_label="$1" runtime_name="Docker"
+  [ "$TASK_RUNTIME_MODE" != "apple-container" ] \
+    || runtime_name="the Apple container runtime"
+  if ! docker_daemon_reachable_bounded; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "The container runtime stopped responding during task startup. Retry after $runtime_name is running again." \
+      "$step_label"
+  fi
+}
+
+# Stop an app that failed a post-create authority proof and verify it is no
+# longer running before any credential, dependency, editor, or agent work can
+# begin. Preserve the container/worktree for diagnosis; a retry recreates the
+# container from Uai's current Compose contract.
+quarantine_untrusted_app_container() {
+  local authority_running=""
+  if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+    # `container stop` is idempotent; proven absence quarantines as well as a
+    # stopped state does. An inspect that fails WITHOUT naming this container
+    # as not-found proves nothing and must not read as stopped.
+    if ! crt stop --time 30 "$app_container" >/dev/null 2>&1; then
+      require_docker_after_failed_step "quarantine untrusted task container"
+    fi
+    apple_quarantine_proven=""
+    quarantine_state=$(crt inspect "$app_container" 2>/dev/null \
+      | jq -r '.[0].status.state // empty' 2>/dev/null) || quarantine_state=""
+    if [ -n "$quarantine_state" ] && [ "$quarantine_state" != "running" ]; then
+      apple_quarantine_proven=1
+    elif [ -z "$quarantine_state" ] \
+      && apple_container_proven_absent "$app_container"; then
+      apple_quarantine_proven=1
+    fi
+    if [ -z "$apple_quarantine_proven" ]; then
+      crt stop --signal KILL "$app_container" >/dev/null 2>&1 || true
+      quarantine_state=$(crt inspect "$app_container" 2>/dev/null \
+        | jq -r '.[0].status.state // empty' 2>/dev/null) || quarantine_state=""
+      if [ -n "$quarantine_state" ] && [ "$quarantine_state" != "running" ]; then
+        apple_quarantine_proven=1
+      elif [ -z "$quarantine_state" ] \
+        && apple_container_proven_absent "$app_container"; then
+        apple_quarantine_proven=1
+      fi
+    fi
+    [ -n "$apple_quarantine_proven" ]
+    return
+  fi
+  if ! docker stop --time 30 "$app_container" >/dev/null 2>&1; then
+    require_docker_after_failed_step "quarantine untrusted task container"
+  fi
+  authority_running=$(docker ps -q --filter "name=^/${app_container}$") \
+    || require_docker_after_failed_step "verify task-container quarantine"
+  if [ -n "$authority_running" ]; then
+    docker kill "$app_container" >/dev/null 2>&1 || true
+    authority_running=$(docker ps -q --filter "name=^/${app_container}$") \
+      || require_docker_after_failed_step "verify task-container quarantine"
+  fi
+  [ -z "$authority_running" ]
+}
+
+# Run the maintenance container under two independent deadlines. The inner GNU
+# timeout bounds the actual writer (including the shared-volume lock wait); the
+# host watchdog is slightly looser and covers a Docker CLI that hangs before it
+# creates or starts the container. Bash 3.2 has no `wait -n` or `timeout`, so
+# keep and reap both exact child PIDs explicitly.
+run_runtime_materializer() {
+  local runtime_image="$1" wrapper_pid watchdog_pid materialization_rc=0
+  local watchdog_dir watchdog_sleep_pid
+
+  watchdog_dir=$(mktemp -d "$task_uai_dir/.runtime-materializer-watchdog.XXXXXX")
+
+  # The completion marker is written from the wrapper's EXIT trap before its
+  # PID can disappear. The watchdog consults it before every signal, closing
+  # the wait/reap/PID-reuse race around a just-finished Docker client.
+  (
+    runtime_docker_pid=""
+    finish_runtime_wrapper() {
+      local wrapper_rc=$?
+      trap - EXIT
+      : > "$watchdog_dir/completed"
+      exit "$wrapper_rc"
+    }
+    terminate_runtime_wrapper() {
+      local signal_rc="$1"
+      trap - TERM INT
+      if [ -n "$runtime_docker_pid" ]; then
+        # Do not reap before the grace period: the exact child PID therefore
+        # cannot be reused between TERM and KILL.
+        kill -TERM "$runtime_docker_pid" >/dev/null 2>&1 || true
+        sleep 10
+        kill -KILL "$runtime_docker_pid" >/dev/null 2>&1 || true
+        wait "$runtime_docker_pid" 2>/dev/null || true
+      fi
+      exit "$signal_rc"
+    }
+    trap finish_runtime_wrapper EXIT
+    trap 'terminate_runtime_wrapper 143' TERM
+    trap 'terminate_runtime_wrapper 130' INT
+
+    # ADR-108: on the Apple runtime this function is never called —
+    # materialization runs inside the app container against its in-guest
+    # overlay. This maintenance-container path is Docker-only.
+    docker run --rm --user node --group-add "$task_container_gid" \
+        --workdir /workspace \
+        -v "$task_workspace:/workspace:ro" \
+        -v "$ASDF_VOLUME:/opt/asdf-data:rw" \
+        -v "$RUNTIME_MATERIALIZER_SOURCE:/usr/local/bin/uai-materialize-runtimes:ro" \
+        -v "$COREPACK_VERSION_SOURCE:/usr/local/share/uai/corepack-version:ro" \
+        -v "$runtime_projects_file:/run/uai/runtime-projects:ro" \
+        --env LD_PRELOAD= \
+        --env LD_AUDIT= \
+        --env LD_LIBRARY_PATH= \
+        --env BASH_ENV= \
+        --env ENV= \
+        --entrypoint /usr/bin/env \
+        "$runtime_image" \
+        -i \
+        HOME=/home/node \
+        ASDF_DIR=/opt/asdf \
+        ASDF_DATA_DIR=/opt/asdf-data \
+        PATH=/opt/asdf-data/shims:/opt/asdf/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
+        /usr/bin/timeout --signal=TERM --kill-after=10s 600s \
+        /usr/local/bin/uai-materialize-runtimes >&2 &
+    runtime_docker_pid=$!
+    if wait "$runtime_docker_pid"; then
+      exit 0
+    else
+      exit $?
+    fi
+  ) &
+  wrapper_pid=$!
+
+  (
+    watchdog_sleep_pid=""
+    cancel_runtime_watchdog() {
+      trap - TERM INT
+      if [ -n "$watchdog_sleep_pid" ]; then
+        kill -TERM "$watchdog_sleep_pid" >/dev/null 2>&1 || true
+        wait "$watchdog_sleep_pid" 2>/dev/null || true
+      fi
+      exit 0
+    }
+    trap cancel_runtime_watchdog TERM INT
+
+    sleep 620 &
+    watchdog_sleep_pid=$!
+    if ! wait "$watchdog_sleep_pid"; then
+      exit 0
+    fi
+    watchdog_sleep_pid=""
+
+    if [ ! -f "$watchdog_dir/completed" ] \
+       && kill -0 "$wrapper_pid" >/dev/null 2>&1; then
+      : > "$watchdog_dir/timed-out"
+      kill -TERM "$wrapper_pid" >/dev/null 2>&1 || true
+      # The wrapper gives its exact Docker child 10 seconds before KILL. This
+      # slightly looser guard is only a backstop for a wedged signal handler.
+      sleep 15 &
+      watchdog_sleep_pid=$!
+      wait "$watchdog_sleep_pid" 2>/dev/null || true
+      watchdog_sleep_pid=""
+      if [ ! -f "$watchdog_dir/completed" ]; then
+        kill -KILL "$wrapper_pid" >/dev/null 2>&1 || true
+      fi
+    fi
+  ) &
+  watchdog_pid=$!
+
+  cancel_runtime_materializer() {
+    local signal_rc="$1"
+    trap - TERM INT
+    if [ ! -f "$watchdog_dir/completed" ]; then
+      kill -TERM "$wrapper_pid" >/dev/null 2>&1 || true
+    fi
+    kill -TERM "$watchdog_pid" >/dev/null 2>&1 || true
+    wait "$watchdog_pid" 2>/dev/null || true
+    wait "$wrapper_pid" 2>/dev/null || true
+    rm -f "$watchdog_dir/completed" "$watchdog_dir/timed-out"
+    rmdir "$watchdog_dir" 2>/dev/null || true
+    exit "$signal_rc"
+  }
+  trap 'cancel_runtime_materializer 143' TERM
+  trap 'cancel_runtime_materializer 130' INT
+
+  if wait "$wrapper_pid"; then
+    materialization_rc=0
+  else
+    materialization_rc=$?
+  fi
+  kill -TERM "$watchdog_pid" >/dev/null 2>&1 || true
+  wait "$watchdog_pid" 2>/dev/null || true
+
+  trap - TERM INT
+  if [ -f "$watchdog_dir/timed-out" ]; then
+    materialization_rc=124
+  fi
+  rm -f "$watchdog_dir/completed" "$watchdog_dir/timed-out"
+  rmdir "$watchdog_dir" 2>/dev/null || true
+  return "$materialization_rc"
+}
+
 # -----------------------------------------------------------------------------
 # 1. Read rows.
 # -----------------------------------------------------------------------------
@@ -88,6 +432,7 @@ task_json=$(db_get_task "$task_id")
   || emit_err "TASK_NOT_FOUND" "no such task: $task_id" "read task row"
 
 task_branch=$(jq -r '.[0].branch' <<<"$task_json")
+UAI_RETRY_STATUS=$(jq -r '.[0].status // ""' <<<"$task_json")
 
 # The standard container runs as node:node (1000:1000), while Docker Desktop
 # hosts commonly run as 501:20 and Linux hosts may use another uid/gid. Share
@@ -117,6 +462,18 @@ esac
 step "PROJECT_NOT_FOUND" "read task projects"
 projects_json=$(db_get_projects_for_task "$task_id")
 project_count=$(jq 'length' <<<"$projects_json")
+if ! jq -e '
+  map(.slug) as $slugs
+  | all($slugs[];
+      type == "string"
+      and test("^[a-z0-9-]{1,64}$"))
+    and (($slugs | unique | length) == ($slugs | length))
+' <<<"$projects_json" >/dev/null; then
+  emit_err "WORKTREE_FAILED" \
+    "Uai refused an unsafe or duplicate project workspace slug" \
+    "validate task projects"
+fi
+runtime_project_slugs=$(jq -r '.[].slug' <<<"$projects_json")
 
 # -----------------------------------------------------------------------------
 # 2. Lock + status=starting.
@@ -145,27 +502,62 @@ reject_unsafe_host_directory "$task_uai_dir" "the task runtime directory"
 # This also cuts off legacy containers that still have the old shared
 # `repo.git` bind mount before we inspect their worktree layout below.
 step "COMPOSE_DOWN_FAILED" "remove prior task containers"
-if [ -f "$task_uai_dir/docker-compose.yml" ]; then
-  docker compose -p "$compose_project" -f "$task_uai_dir/docker-compose.yml" \
-    down --remove-orphans >/dev/null 2>&1 || true
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  # Selection fencing guarantees an apple-mode host has no Docker task rows,
+  # so the only possible prior container is this task's fixed name. `inspect`
+  # exiting nonzero afterwards is the absence proof.
+  crt stop --time 10 "$app_container" >/dev/null 2>&1 || true
+  crt delete --force "$app_container" >/dev/null 2>&1 || true
+  if crt inspect "$app_container" >/dev/null 2>&1; then
+    emit_err "COMPOSE_DOWN_FAILED" \
+      "the previous task container is still present; Uai will not let the host access its writable Git repository until that container is removed" \
+      "remove prior task containers"
+  fi
+  if ! apple_container_proven_absent "$app_container"; then
+    emit_err "COMPOSE_DOWN_FAILED" \
+      "could not verify removal of the previous task container" \
+      "remove prior task containers"
+  fi
 else
-  docker compose -p "$compose_project" down --remove-orphans \
-    >/dev/null 2>&1 || true
-fi
-prior_containers=""
-if ! prior_containers=$(docker ps -aq \
-  --filter "label=com.docker.compose.project=$compose_project"); then
-  emit_err "COMPOSE_DOWN_FAILED" \
-    "could not verify removal of the previous task container" \
-    "remove prior task containers"
-fi
-if [ -n "$prior_containers" ]; then
-  emit_err "COMPOSE_DOWN_FAILED" \
-    "the previous task container is still running or stopped; Uai will not let the host access its writable Git repository until that container is removed" \
-    "remove prior task containers"
+  if [ -f "$task_uai_dir/docker-compose.yml" ]; then
+    docker compose -p "$compose_project" -f "$task_uai_dir/docker-compose.yml" \
+      down --remove-orphans >/dev/null 2>&1 || true
+  else
+    docker compose -p "$compose_project" down --remove-orphans \
+      >/dev/null 2>&1 || true
+  fi
+  prior_containers=""
+  if ! prior_containers=$(docker ps -aq \
+    --filter "label=com.docker.compose.project=$compose_project"); then
+    emit_err "COMPOSE_DOWN_FAILED" \
+      "could not verify removal of the previous task container" \
+      "remove prior task containers"
+  fi
+  if [ -n "$prior_containers" ]; then
+    emit_err "COMPOSE_DOWN_FAILED" \
+      "the previous task container is still running or stopped; Uai will not let the host access its writable Git repository until that container is removed" \
+      "remove prior task containers"
+  fi
 fi
 reject_unsafe_host_directory "$task_workspace" "the task workspace"
 mkdir -p "$task_workspace"
+reject_workspace_runtime_shadow
+
+# Git resolves symlinked ancestors when it writes a linked worktree's absolute
+# `.git` pointer. Keep the configured (lexical) task paths as Uai's stable host
+# paths, but also remember their physical aliases for validation and bind-mount
+# destinations. The task root itself was rejected above if it was a symlink;
+# `pwd -P` therefore resolves only trusted ancestors such as a migrated
+# UAI_WORKSPACE_ROOT (`~/.uai-host-app/workspace -> ~/.uai`).
+step "WORKTREE_FAILED" "resolve task workspace paths"
+if ! task_dir_physical=$(cd "$task_dir" && pwd -P) \
+  || [ -z "$task_dir_physical" ]; then
+  emit_err "WORKTREE_FAILED" \
+    "Uai could not resolve the task workspace's physical host path" \
+    "resolve task workspace paths"
+fi
+task_workspace_physical="$task_dir_physical/workspace"
+task_uai_dir_physical="$task_dir_physical/.uai"
 
 # -----------------------------------------------------------------------------
 # 3. Bare mirrors + worktrees, one per selected project.
@@ -486,16 +878,14 @@ while IFS= read -r project_obj; do
   # that old bind mount. The new cache path has never entered a container.
   mirror_dir="$projects_root/$project_id/host-cache.git"
   task_repo_dir="$task_uai_dir/repos/$project_id.git"
+  task_repo_dir_physical="$task_uai_dir_physical/repos/$project_id.git"
   worktree_target="$task_workspace/$project_slug"
   reject_unsafe_host_directory "$worktree_target" \
     "the project worktree for $project_slug"
   # Check before remote/cache Git: a dangling symlink makes `-e` false and the
   # later seed write would otherwise follow it outside the workspace.
-  if [ -L "$worktree_target/.tool-versions" ]; then
-    emit_err "WORKTREE_FAILED" \
-      "Uai refused a symbolic-link .tool-versions for $project_slug" \
-      "validate task worktree ($project_id)"
-  fi
+  reject_unsafe_runtime_manifest "$worktree_target/.tool-versions" \
+    "$project_slug" "$project_id"
   worktree_exists=0
   standalone_worktree=0
   if [ -e "$worktree_target/.git" ] || [ -L "$worktree_target/.git" ]; then
@@ -513,14 +903,18 @@ while IFS= read -r project_obj; do
       gitdir_lines=$(awk 'END { print NR }' "$worktree_target/.git")
       gitdir_value=$(sed -n 's/^gitdir: //p' "$worktree_target/.git")
       case "$gitdir_value" in
-        "$task_repo_dir"/worktrees/*) ;;
+        "$task_repo_dir"/worktrees/*)
+          gitdir_leaf=${gitdir_value#"$task_repo_dir"/worktrees/}
+          ;;
+        "$task_repo_dir_physical"/worktrees/*)
+          gitdir_leaf=${gitdir_value#"$task_repo_dir_physical"/worktrees/}
+          ;;
         *)
           emit_err "WORKTREE_FAILED" \
             "This task uses Uai's legacy shared Git layout. Its container has been removed so it can no longer write the shared mirror. Preserve any uncommitted changes from $worktree_target, then recreate the task to migrate safely." \
             "legacy task repository requires recreation ($project_id)"
           ;;
       esac
-      gitdir_leaf=${gitdir_value#"$task_repo_dir"/worktrees/}
       case "$gitdir_leaf" in
         ''|.|..|*/*)
           emit_err "WORKTREE_FAILED" \
@@ -860,11 +1254,8 @@ while IFS= read -r project_obj; do
   # Tool-version seeding: only when the worktree has no checked-in
   # .tool-versions AND the project declares one. Never overwrite a file
   # the repo already ships.
-  if [ -L "$worktree_target/.tool-versions" ]; then
-    emit_err "WORKTREE_FAILED" \
-      "Uai refused a symbolic-link .tool-versions for $project_slug" \
-      "validate task worktree ($project_id)"
-  fi
+  reject_unsafe_runtime_manifest "$worktree_target/.tool-versions" \
+    "$project_slug" "$project_id"
   if [ ! -e "$worktree_target/.tool-versions" ] \
      && [ -n "$tool_versions" ] && [ "$tool_versions" != "null" ]; then
     printf '%s\n' "$tool_versions" > "$worktree_target/.tool-versions"
@@ -936,6 +1327,53 @@ step "RENDER_FAILED" "generate compose"
 
 mkdir -p "$task_uai_dir"
 
+STANDARD_CONTAINER_DIR="${UAI_STANDARD_CONTAINER_ASSETS_DIR:-$SCRIPT_DIR/../../images/standard/container}"
+if ! STANDARD_CONTAINER_DIR=$(cd "$STANDARD_CONTAINER_DIR" && pwd -P); then
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Uai's packaged container asset directory is missing. Repair or update the host installation, then retry." \
+    "resolve packaged container assets"
+fi
+UAI_INIT_SOURCE="$STANDARD_CONTAINER_DIR/uai-init"
+RUNTIME_MATERIALIZER_SOURCE="$STANDARD_CONTAINER_DIR/uai-materialize-runtimes"
+COREPACK_VERSION_SOURCE="$STANDARD_CONTAINER_DIR/corepack-version"
+if [ -L "$UAI_INIT_SOURCE" ] || [ ! -f "$UAI_INIT_SOURCE" ] \
+   || [ ! -x "$UAI_INIT_SOURCE" ]; then
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Uai's packaged task initializer is missing or unsafe. Repair or update the host installation, then retry." \
+    "resolve packaged container assets"
+fi
+if [ "$project_count" -gt 0 ]; then
+  if [ -L "$RUNTIME_MATERIALIZER_SOURCE" ] \
+     || [ ! -f "$RUNTIME_MATERIALIZER_SOURCE" ] \
+     || [ ! -x "$RUNTIME_MATERIALIZER_SOURCE" ]; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai's packaged runtime materializer is missing or unsafe. Repair or update the host installation, then retry." \
+      "resolve packaged container assets"
+  fi
+  if [ -L "$COREPACK_VERSION_SOURCE" ] \
+     || [ ! -f "$COREPACK_VERSION_SOURCE" ] \
+     || [ ! -r "$COREPACK_VERSION_SOURCE" ]; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai's packaged Corepack version pin is missing or unsafe. Repair or update the host installation, then retry." \
+      "resolve packaged container assets"
+  fi
+fi
+
+# The host-authored allowlist is the single project-set authority shared by
+# pre-start runtime proof and task-local dependency installation. It lives in
+# the container-unmounted .uai control tree and is exposed only as this one
+# read-only file. Atomic replacement keeps resumptions from observing a
+# partially written list.
+runtime_projects_file="$task_uai_dir/runtime-projects"
+runtime_projects_tmp=$(mktemp "$task_uai_dir/.runtime-projects.XXXXXX")
+if [ -n "$runtime_project_slugs" ]; then
+  printf '%s\n' "$runtime_project_slugs" > "$runtime_projects_tmp"
+else
+  : > "$runtime_projects_tmp"
+fi
+chmod 0644 "$runtime_projects_tmp"
+mv -f "$runtime_projects_tmp" "$runtime_projects_file"
+
 # Union of preview ports across projects, de-duped by containerPort
 # (first-in-position wins the name). Validated: name non-empty, 1..65535.
 union_preview_ports_json=$(jq -c '
@@ -985,6 +1423,34 @@ if [ -n "$extra_block" ]; then
   has_derived=1
 fi
 
+# One fail-closed authority for names projects must never control, whether the
+# value arrived as an ordinary declared env key or as a preview urlEnv literal.
+# UAI_EDITOR_THEME is the sole preview exception below: it is computed by the
+# cloud from the task palette, not sourced from a project.
+is_reserved_task_env_name() {
+  case "$1" in
+    GH_TOKEN | GITHUB_TOKEN | GH_CONFIG_DIR | GH_HOST | \
+    GIT_CONFIG* | GIT_DIR | GIT_WORK_TREE | GIT_COMMON_DIR | \
+    GIT_OBJECT_DIRECTORY | GIT_ALTERNATE_OBJECT_DIRECTORIES | \
+    GIT_INDEX_FILE | GIT_EXEC_PATH | GIT_ASKPASS | SSH_ASKPASS | \
+    GIT_SSH | GIT_SSH_COMMAND | HOME | XDG_CONFIG_HOME | XDG_DATA_HOME | \
+    XDG_CACHE_HOME | \
+    PATH | LD_PRELOAD | LD_AUDIT | LD_LIBRARY_PATH | NODE_OPTIONS | \
+    NODE_PATH | SHELLOPTS | BASHOPTS | PS4 | BASH_ENV | ENV | \
+    ASDF_* | COREPACK_* | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Pp][Rr][Ee][Ff][Ii][Xx] | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Cc][Aa][Cc][Hh][Ee] | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Ll][Oo][Gg][Ss][_-][Dd][Ii][Rr] | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Uu][Mm][Aa][Ss][Kk] | UAI_* | \
+    CLAUDE_CODE_OAUTH_TOKEN | \
+    ANTHROPIC_API_KEY | ANTHROPIC_AUTH_TOKEN | XAI_API_KEY | \
+    PLAYWRIGHT_BROWSERS_PATH)
+      return 0
+      ;;
+  esac
+  return 1
+}
+
 # Write the compose file. No top-level name: (the -p flag sets the project),
 # no container_name:. Env values live host-side (ADR-015): we emit only
 # pass-through references `${KEY:-}`.
@@ -1005,6 +1471,11 @@ fi
     printf '    pull_policy: never\n'
   fi
   printf '    init: true\n'
+  # Keep the host MCP gateway reachable through Docker's ordinary
+  # host-gateway address. (The Apple runtime has no extra_hosts equivalent
+  # and none is rendered for it; its gateway route is the vmnet gateway IP.)
+  printf '    extra_hosts:\n'
+  printf '      - "host.docker.internal:host-gateway"\n'
   # Give node the one host group that owns this task's bind-mounted files.
   # Numeric group_add works even when the group has a different name (or no
   # name) in the image. Root hosts use node's existing gid 1000 above.
@@ -1018,13 +1489,32 @@ fi
   # repository is mounted; the host cache never enters a container. Legacy
   # worktrees fail closed before Compose rendering and must be recreated.
   printf '      - "%s:%s"\n' "$task_workspace" "$task_workspace"
+  if [ "$task_workspace_physical" != "$task_workspace" ]; then
+    # Git canonicalizes a symlinked workspace root in both directions: the
+    # worktree's `.git` points at the physical repository, and the repository's
+    # worktree metadata points back at the physical workspace. Mount the same
+    # already-approved workspace at that alias without exposing its `.uai`
+    # sibling or any broader host directory.
+    printf '      - "%s:%s"\n' \
+      "$task_workspace" "$task_workspace_physical"
+  fi
   while IFS= read -r vol_obj; do
     [ -n "$vol_obj" ] || continue
     vol_pid=$(jq -r '.id' <<<"$vol_obj")
     printf '      - "%s/repos/%s.git:%s/repos/%s.git"\n' \
       "$task_uai_dir" "$vol_pid" "$task_uai_dir" "$vol_pid"
+    if [ "$task_uai_dir_physical" != "$task_uai_dir" ]; then
+      printf '      - "%s/repos/%s.git:%s/repos/%s.git"\n' \
+        "$task_uai_dir" "$vol_pid" "$task_uai_dir_physical" "$vol_pid"
+    fi
   done < <(jq -c '.[]' <<<"$projects_json")
-  printf '      - "%s:/opt/asdf-data"\n' "$ASDF_VOLUME"
+  printf '      - "%s:/usr/local/bin/uai-init:ro"\n' "$UAI_INIT_SOURCE"
+  printf '      - "%s:/run/uai/runtime-projects:ro"\n' \
+    "$runtime_projects_file"
+  # Task processes consume only the exact runtimes/package managers proved by
+  # pre-start maintenance. `:ro` is explicit because Docker's omitted default
+  # is read-write and a legacy Compose file must never look equivalent.
+  printf '      - "%s:/opt/asdf-data:ro"\n' "$ASDF_VOLUME"
   # ADR-053: host-wide Playwright browser cache. Always mounted (harmless
   # when browser testing is off); Chromium downloads once per HOST.
   printf '      - "%s:/opt/pw-browsers"\n' "$PW_VOLUME"
@@ -1056,6 +1546,61 @@ fi
   # the bind-mounted workspace and independent of project-defined XDG/HOME
   # values so its credential helper always resolves the connected user.
   printf '      GH_CONFIG_DIR: "/home/node/.config/gh"\n'
+  # Runtime selection/cache authority is host-owned. These values override
+  # both project-declared keys and a derived image's ENV so uai-init cannot be
+  # redirected into an unproved runtime or a different shared-cache writer.
+  printf '      PATH: "%s"\n' "$TASK_RUNTIME_PATH"
+  printf '      HOME: "/home/node"\n'
+  printf '      XDG_CONFIG_HOME: "/home/node/.config"\n'
+  printf '      XDG_DATA_HOME: "/home/node/.local/share"\n'
+  printf '      XDG_CACHE_HOME: "/home/node/.cache"\n'
+  printf '      ASDF_DIR: "/opt/asdf"\n'
+  printf '      ASDF_DATA_DIR: "/opt/asdf-data"\n'
+  printf '      ASDF_CONFIG_FILE: "/dev/null"\n'
+  printf '      ASDF_DEFAULT_TOOL_VERSIONS_FILENAME: ".tool-versions"\n'
+  printf '      ASDF_NODEJS_VERSION: ""\n'
+  printf '      ASDF_PYTHON_VERSION: ""\n'
+  printf '      ASDF_GOLANG_VERSION: ""\n'
+  printf '      ASDF_RUBY_VERSION: ""\n'
+  printf '      ASDF_RUST_VERSION: ""\n'
+  printf '      ASDF_SKIP_RESHIM: "1"\n'
+  printf '      COREPACK_HOME: "/opt/asdf-data/corepack"\n'
+  printf '      COREPACK_DEFAULT_TO_LATEST: "0"\n'
+  printf '      COREPACK_ENV_FILE: "0"\n'
+  printf '      COREPACK_NPM_REGISTRY: "https://registry.npmjs.org"\n'
+  printf '      COREPACK_ENABLE_NETWORK: "0"\n'
+  printf '      COREPACK_ENABLE_AUTO_PIN: "0"\n'
+  printf '      COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"\n'
+  printf '      COREPACK_ENABLE_PROJECT_SPEC: "1"\n'
+  printf '      COREPACK_ENABLE_STRICT: "1"\n'
+  printf '      COREPACK_ENABLE_UNSAFE_CUSTOM_URLS: "0"\n'
+  printf '      COREPACK_INTEGRITY_CHECK: "1"\n'
+  # npm injects lowercase config names into lifecycle scripts, so pin both
+  # cases. These task-private paths are never part of the shared asdf volume.
+  printf '      NPM_CONFIG_PREFIX: "%s"\n' "$TASK_NPM_PREFIX"
+  printf '      npm_config_prefix: "%s"\n' "$TASK_NPM_PREFIX"
+  printf '      NPM_CONFIG_CACHE: "%s"\n' "$TASK_NPM_CACHE"
+  printf '      npm_config_cache: "%s"\n' "$TASK_NPM_CACHE"
+  printf '      NPM_CONFIG_LOGS_DIR: "%s/_logs"\n' "$TASK_NPM_CACHE"
+  printf '      npm_config_logs_dir: "%s/_logs"\n' "$TASK_NPM_CACHE"
+  printf '      NPM_CONFIG_UMASK: "0002"\n'
+  printf '      npm_config_umask: "0002"\n'
+  printf '      UAI_WORKSPACE: "/workspace"\n'
+  printf '      UAI_RUNTIME_PROJECTS: "/run/uai/runtime-projects"\n'
+  printf '      LD_PRELOAD: ""\n'
+  printf '      LD_AUDIT: ""\n'
+  printf '      LD_LIBRARY_PATH: ""\n'
+  printf '      NODE_OPTIONS: ""\n'
+  printf '      NODE_PATH: ""\n'
+  # SHELLOPTS/BASHOPTS are deliberately ABSENT, never empty: bash exports its
+  # live options into any child when these names were present in its startup
+  # environment, so an "empty clear" let set -euo scripts stamp nounset into
+  # code-server and break every asdf shim in the Editor terminal (found live
+  # 2026-08-16, on BOTH engines; the reserved-name filter still strips any
+  # project-declared value).
+  printf '      PS4: ""\n'
+  printf '      BASH_ENV: ""\n'
+  printf '      ENV: ""\n'
   # Host-resident Claude auth (ADR-021). Headless `claude --print` no longer
   # uses the interactive subscription/keychain path, so it needs a token from
   # `claude setup-token`. Interpolated from the host-agent env at up-time, so
@@ -1093,17 +1638,7 @@ fi
   # decrypted values at `compose up` time.
   while IFS= read -r ekey; do
     [ -n "$ekey" ] || continue
-    case "$ekey" in
-      GH_TOKEN | GITHUB_TOKEN | GH_CONFIG_DIR | GH_HOST | \
-      GIT_CONFIG* | GIT_DIR | GIT_WORK_TREE | GIT_COMMON_DIR | \
-      GIT_OBJECT_DIRECTORY | GIT_ALTERNATE_OBJECT_DIRECTORIES | \
-      GIT_INDEX_FILE | GIT_EXEC_PATH | GIT_ASKPASS | SSH_ASKPASS | \
-      GIT_SSH | GIT_SSH_COMMAND | HOME | XDG_CONFIG_HOME | XDG_DATA_HOME | \
-      BASH_ENV | ENV | UAI_GIT_TRANSPORT | \
-      CLAUDE_CODE_OAUTH_TOKEN | ANTHROPIC_API_KEY | \
-      ANTHROPIC_AUTH_TOKEN | XAI_API_KEY | PLAYWRIGHT_BROWSERS_PATH | \
-      UAI_EDITOR_THEME) continue ;;
-    esac
+    is_reserved_task_env_name "$ekey" && continue
     printf '      %s: ""\n' "$ekey"
   done < <(jq -r '.[]' <<<"$union_env_keys_json")
   # Cloud-computed literal env (ADR-025): a JSON object {VAR: value} on the
@@ -1124,6 +1659,10 @@ fi
     pe_key=$(jq -r '.key' <<<"$pe_entry")
     pe_val=$(jq -r '.value' <<<"$pe_entry")
     [ -n "$pe_key" ] || continue
+    if [ "$pe_key" != "UAI_EDITOR_THEME" ] \
+       && is_reserved_task_env_name "$pe_key"; then
+      continue
+    fi
     printf '      %s: "%s"\n' "$pe_key" "$pe_val"
   done < <(jq -c 'to_entries[]?' <<<"$preview_env_raw")
   printf 'volumes:\n'
@@ -1145,13 +1684,30 @@ if [ "$has_derived" = "1" ]; then
 fi
 
 # -----------------------------------------------------------------------------
-# 5. Compose up.
+# 5. Build (when derived) + pre-materialize project runtimes.
 # -----------------------------------------------------------------------------
 
 # The shared asdf cache volume is host-wide and declared external — make
-# sure it exists before compose references it. Idempotent.
-docker volume create "$ASDF_VOLUME" >/dev/null 2>&1 || true
-docker volume create "$PW_VOLUME" >/dev/null 2>&1 || true
+# sure it exists before compose references it. Idempotent under Docker; the
+# Apple CLI errors on an existing name, so tolerate creation and then demand
+# the volume actually exists.
+crt volume create "$ASDF_VOLUME" >/dev/null 2>&1 || true
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  # Browsers ride a host directory here, never a block volume — see
+  # PW_BROWSERS_DIR above for why.
+  if ! /bin/mkdir -p "$PW_BROWSERS_DIR"; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai could not create the shared Playwright browsers directory $PW_BROWSERS_DIR." \
+      "create shared volumes"
+  fi
+  if ! crt volume inspect "$ASDF_VOLUME" >/dev/null 2>&1; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai could not create the shared $ASDF_VOLUME volume on the Apple container runtime. Retry after the runtime is healthy." \
+      "create shared volumes"
+  fi
+else
+  crt volume create "$PW_VOLUME" >/dev/null 2>&1 || true
+fi
 
 # The standard base image is built by the host (ensureStandardImage), never
 # pulled from a registry — and derived tasks FROM it too. If it's absent (the
@@ -1159,24 +1715,215 @@ docker volume create "$PW_VOLUME" >/dev/null 2>&1 || true
 # a doomed registry pull; fail with an actionable message instead (the host
 # also (re)builds it on demand before task-up — this is the belt-and-suspenders
 # check for a still-in-progress or failed build). Live 2026-07-22.
-if ! docker image inspect "$STANDARD_IMAGE" >/dev/null 2>&1; then
+if ! crt image inspect "$STANDARD_IMAGE" >/dev/null 2>&1; then
   emit_err "STANDARD_IMAGE_MISSING" \
     "the host base image $STANDARD_IMAGE is not built yet — the host builds it at startup (a few minutes on first run, and after Docker Desktop finishes starting). Wait for the host log line 'built standard image', or restart the host, then retry. If it keeps failing the host log shows the build error (often Docker Desktop low on memory/disk)." \
     "check standard image"
 fi
 
-step "COMPOSE_UP_FAILED" "docker compose up -d"
+# A derived task must materialize through the exact filesystem it will run:
+# project `extra` may add runtime build dependencies. Split build from up so a
+# failed materialization can never start the task container, and so a later up
+# cannot silently rebuild a different image after the proof succeeds.
+runtime_image="$STANDARD_IMAGE"
+if [ "$has_derived" = "1" ]; then
+  if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+    step "COMPOSE_UP_FAILED" "build derived task image"
+    if ! "$CONTAINER_CLI" build -t "$DERIVED_IMAGE" \
+      -f "$task_uai_dir/Dockerfile" "$task_uai_dir" >&2; then
+      require_docker_after_failed_step "build derived task image"
+      emit_err "COMPOSE_UP_FAILED" \
+        "Uai could not build this task's derived image. Check the project's extra setup commands, then retry." \
+        "build derived task image"
+    fi
+  else
+    step "COMPOSE_UP_FAILED" "docker compose build app"
+    if ! docker compose -p "$compose_project" \
+      -f "$task_uai_dir/docker-compose.yml" build app >&2; then
+      require_docker_after_failed_step "docker compose build app"
+      emit_err "COMPOSE_UP_FAILED" \
+        "Uai could not build this task's derived image. Check the project's extra setup commands, then retry." \
+        "docker compose build app"
+    fi
+  fi
+  runtime_image="$DERIVED_IMAGE"
+fi
+
+# Resolve the mutable service tag once and use only its immutable local image
+# ID for both maintenance and app creation. The on-disk Compose file keeps its
+# tag so task-down can still identify/remove a derived image, but no concurrent
+# rebuild can swap code between runtime proof and execution.
+step "CONTAINER_INIT_FAILED" "resolve task image identity"
+runtime_image_id=""
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  # One snapshot supplies identity, environment, and entrypoint together, so
+  # every image-authority decision below describes the same bytes. The Apple
+  # CLI cannot run an image by its 64-hex id, so the id is re-checked against
+  # the tag after the container is created instead of run directly.
+  apple_image_snapshot=""
+  if ! apple_image_snapshot=$("$CONTAINER_CLI" image inspect \
+    "$runtime_image" 2>/dev/null); then
+    require_docker_after_failed_step "resolve task image identity"
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai could not resolve the exact local image for this task. Retry after the host image is available." \
+      "resolve task image identity"
+  fi
+  runtime_image_id=$(printf '%s\n' "$apple_image_snapshot" \
+    | jq -r '.[0].id // empty' 2>/dev/null) || runtime_image_id=""
+  if ! printf '%s\n' "$runtime_image_id" \
+    | grep -Eq '^[0-9a-f]{64}$'; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "The Apple container runtime returned an invalid image identity for $runtime_image; Uai refused to start an unpinned task container." \
+      "resolve task image identity"
+  fi
+  # Without a --entrypoint override flag, an image-declared ENTRYPOINT would
+  # prefix every argv this script passes (including the materializer's
+  # `env -i`). Refuse such an image before anything executes from it.
+  if ! printf '%s\n' "$apple_image_snapshot" | jq -e '
+    (.[0].variants | type == "array" and length == 1)
+    and ((.[0].variants[0].config.config.Entrypoint // []) | length == 0)
+  ' >/dev/null 2>&1; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai refused this task image because it declares an ENTRYPOINT or multiple platform variants, which the Apple container runtime cannot safely override. Remove the ENTRYPOINT from the project's extra setup, then retry." \
+      "resolve task image identity"
+  fi
+else
+  if ! runtime_image_id=$(docker image inspect --format '{{.Id}}' \
+    "$runtime_image" 2>/dev/null); then
+    require_docker_after_failed_step "resolve task image identity"
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai could not resolve the exact local image for this task. Retry after the host image is available." \
+      "resolve task image identity"
+  fi
+  if ! printf '%s\n' "$runtime_image_id" \
+    | grep -Eq '^sha256:[0-9a-f]{64}$'; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Docker returned an invalid image identity for $runtime_image; Uai refused to start an unpinned task container." \
+      "resolve task image identity"
+  fi
+fi
+
+# Docker keeps image Config.Env entries whose names differ only by case from
+# later `docker exec -e` overrides. npm treats those spellings
+# case-insensitively and, depending on environment order, a mixed-case value
+# can beat both canonical values. Reject such an image before maintenance or
+# app creation; ordinary registry/auth npm config remains allowed, while the
+# four path/permission authorities must use one of the two spellings Uai can
+# deterministically replace.
+step "CONTAINER_INIT_FAILED" "verify task image npm authority"
+runtime_image_env_json=""
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  # From the same snapshot the identity pin came from — the single variant
+  # was already proven above.
+  runtime_image_env_json=$(printf '%s\n' "$apple_image_snapshot" \
+    | jq -c '.[0].variants[0].config.config.Env // []' 2>/dev/null) \
+    || runtime_image_env_json=""
+  if [ -z "$runtime_image_env_json" ]; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai could not inspect this task image's npm environment authority. Retry after the Apple container runtime is stable." \
+      "verify task image npm authority"
+  fi
+elif ! runtime_image_env_json=$(docker image inspect \
+  --format '{{json .Config.Env}}' "$runtime_image_id" 2>/dev/null); then
+  require_docker_after_failed_step "verify task image npm authority"
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Uai could not inspect this task image's npm environment authority. Retry after Docker is stable." \
+    "verify task image npm authority"
+fi
+if ! printf '%s\n' "$runtime_image_env_json" | jq -e '
+  def is_owned_npm_config($owned):
+    ascii_downcase as $folded
+    | ($folded | startswith("npm_config_"))
+      and (($owned | index($folded[11:] | gsub("_"; "-"))) != null);
+  (. // []) as $env
+  | [
+      "NPM_CONFIG_PREFIX", "npm_config_prefix",
+      "NPM_CONFIG_CACHE", "npm_config_cache",
+      "NPM_CONFIG_LOGS_DIR", "npm_config_logs_dir",
+      "NPM_CONFIG_UMASK", "npm_config_umask"
+    ] as $canonical
+  | [
+      "prefix", "cache", "logs-dir", "umask"
+    ] as $owned
+  | ($env | type == "array")
+    and all($env[]; type == "string")
+    and all($env[];
+      (split("=")[0]) as $key
+      | (($key | is_owned_npm_config($owned)) | not)
+        or (($canonical | index($key)) != null)
+    )
+' >/dev/null 2>&1; then
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Uai refused this task image because a mixed-case npm prefix/cache/log setting could redirect global package writes. Remove that image ENV setting (unrelated registry/auth settings remain supported) and retry." \
+    "verify task image npm authority"
+fi
+
+# Runtime installation is a host-maintenance phase, not task-container init.
+# Give the one-shot container only the immutable workspace view and the
+# explicitly writable host-wide asdf volume. Run it for every selected-project
+# task: projects without .tool-versions still use the image's proven root
+# defaults and may request a Corepack-managed package manager. A true
+# zero-project scratchpad has nothing to prepare and remains the only skip.
+# GNU timeout lives in the Debian standard image (and therefore every derived
+# image); it bounds the shared lock wait plus all installs and positive
+# verification without leaving an orphaned volume writer when the cloud's
+# 15-minute RPC deadline expires.
+if [ "$project_count" -gt 0 ]; then
+  step "CONTAINER_INIT_FAILED" "materialize task runtimes"
+  materialization_rc=0
+  if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+    # ADR-108: the shared volume is never written on the task path. Apple
+    # materialization runs INSIDE the app container after the in-guest
+    # overlay is established (section 6a below) — a missing toolchain
+    # installs into the task's own upper layer with zero shared-volume
+    # coordination, at any task count.
+    log "apple runtime materialization runs in-container after the overlay is established"
+  else
+    run_runtime_materializer "$runtime_image_id" || materialization_rc=$?
+  fi
+  if [ "$materialization_rc" -ne 0 ]; then
+    require_docker_after_failed_step "materialize task runtimes"
+    case "$materialization_rc" in
+      124|137)
+        emit_err "CONTAINER_INIT_FAILED" \
+          "Runtime materialization did not finish inside Uai's 10-minute startup budget. Retry the task: Uai will re-check every required runtime and package manager before it starts any task container, and will not trust a partial cache." \
+          "materialize task runtimes"
+        ;;
+      *)
+        emit_err "CONTAINER_INIT_FAILED" \
+          "Uai could not install and verify every runtime and package manager needed by this task. Check the project's .tool-versions and packageManager entries and the host's network and disk availability, then retry." \
+          "materialize task runtimes"
+        ;;
+    esac
+  fi
+else
+  log "zero-project scratchpad — skipping runtime materialization"
+fi
+
+# -----------------------------------------------------------------------------
+# 6. Compose up.
+# -----------------------------------------------------------------------------
+
+step "COMPOSE_UP_FAILED" "start task container"
 # Limit the supplied values to keys the selected projects actually declare,
-# then remove Uai-managed names and preview URL names. JSON is valid YAML, so
-# Compose can merge this secret-bearing override directly from stdin without a
-# temporary env/YAML file and without exporting any value to host commands.
+# then remove Uai-managed names and preview URL names. Both runtimes consume
+# the same filtered object: Docker merges it as a Compose stdin override, and
+# the Apple path serializes it into a transient env-file below. JSON is valid
+# YAML, so Compose can merge this secret-bearing override directly from stdin
+# without a temporary env/YAML file and without exporting any value to host
+# commands.
 preview_env_raw=$(jq -r '.[0].preview_env // "{}"' <<<"$task_json")
-compose_env_override=$(printf '%s' "$project_env_json" | jq -c \
+filtered_project_env=$(printf '%s' "$project_env_json" | jq -c \
   --argjson declared "$union_env_keys_json" \
   --argjson preview "$preview_env_raw" '
     .
     | with_entries(.key as $key | select($declared | index($key)))
     | with_entries(select(.key | test("^GIT_CONFIG($|_)") | not))
+    | with_entries(select(.key | test(
+        "^(ASDF_|COREPACK_)|^npm_config_(prefix|cache|logs[_-]dir|umask)$";
+        "i"
+      ) | not))
+    | with_entries(select(.key | test("^UAI_") | not))
     | del(
         .GH_TOKEN,
         .GITHUB_TOKEN,
@@ -1196,6 +1943,16 @@ compose_env_override=$(printf '%s' "$project_env_json" | jq -c \
         .HOME,
         .XDG_CONFIG_HOME,
         .XDG_DATA_HOME,
+        .XDG_CACHE_HOME,
+        .PATH,
+        .LD_PRELOAD,
+        .LD_AUDIT,
+        .LD_LIBRARY_PATH,
+        .NODE_OPTIONS,
+        .NODE_PATH,
+        .SHELLOPTS,
+        .BASHOPTS,
+        .PS4,
         .BASH_ENV,
         .ENV,
         .UAI_GIT_TRANSPORT,
@@ -1207,18 +1964,466 @@ compose_env_override=$(printf '%s' "$project_env_json" | jq -c \
         .UAI_EDITOR_THEME
       )
     | delpaths($preview | keys | map([.]))
-    | {services:{app:{environment:.}}}
   ')
-if [ "$has_derived" = "1" ]; then
-  printf '%s\n' "$compose_env_override" | docker compose -p "$compose_project" \
-    -f "$task_uai_dir/docker-compose.yml" -f - up -d --build >/dev/null
+compose_env_override=""
+if [ "$TASK_RUNTIME_MODE" = "docker" ]; then
+  compose_env_override=$(printf '%s\n' "$filtered_project_env" | jq -c \
+    --arg image "$runtime_image_id" \
+    '{services:{app:{environment:.,image:$image,pull_policy:"never"}}}')
+fi
+
+# Detect a tag replacement that completed during materialization and fail with
+# a clear retry instead of starting a task under a stale generation. The
+# immutable stdin override below also closes the remaining recheck→up window.
+step "CONTAINER_INIT_FAILED" "verify task image identity"
+current_runtime_image_id=""
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  if ! current_runtime_image_id=$("$CONTAINER_CLI" image inspect \
+    "$runtime_image" 2>/dev/null | jq -r '.[0].id // empty' 2>/dev/null); then
+    require_docker_after_failed_step "verify task image identity"
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai could not re-check this task's image after runtime materialization. Retry after the Apple container runtime is stable." \
+      "verify task image identity"
+  fi
+elif ! current_runtime_image_id=$(docker image inspect --format '{{.Id}}' \
+  "$runtime_image" 2>/dev/null); then
+  require_docker_after_failed_step "verify task image identity"
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Uai could not re-check this task's image after runtime materialization. Retry after Docker is stable." \
+    "verify task image identity"
+fi
+if [ "$current_runtime_image_id" != "$runtime_image_id" ]; then
+  emit_err "CONTAINER_INIT_FAILED" \
+    "This task's image changed while Uai was materializing runtimes. Retry so the new image receives a complete runtime proof before any task container starts." \
+    "verify task image identity"
+fi
+reject_workspace_runtime_shadow
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  step "COMPOSE_UP_FAILED" "start task container"
+  # The Apple CLI takes environment through an env-file whose values are read
+  # verbatim from the first `=` to the newline. A value containing a newline
+  # cannot survive that framing — refuse it rather than truncate a secret.
+  if ! printf '%s\n' "$filtered_project_env" | jq -e \
+    'to_entries | all(.value | type == "string" and (test("[\r\n]") | not))' \
+    >/dev/null 2>&1; then
+    emit_err "COMPOSE_UP_FAILED" \
+      "A project environment value contains a newline, which the Apple container runtime cannot pass through its env-file. Store the value single-line (for example base64) or run this task on a Docker host." \
+      "start task container"
+  fi
+  task_env_file=$(mktemp "$task_uai_dir/.task-env.XXXXXX")
+  chmod 0600 "$task_env_file"
+  {
+    # Mirrors the Compose service environment exactly (see the rendered
+    # docker-compose.yml for the rationale on each block). Later lines win in
+    # both dialects, so ordering here preserves the Compose precedence:
+    # static authority, engine tokens, declared project values, preview env.
+    printf 'UAI_GIT_TRANSPORT=%s\n' "$uai_git_transport"
+    printf 'GH_CONFIG_DIR=/home/node/.config/gh\n'
+    printf 'PATH=%s\n' "$TASK_RUNTIME_PATH"
+    printf 'HOME=/home/node\n'
+    printf 'XDG_CONFIG_HOME=/home/node/.config\n'
+    printf 'XDG_DATA_HOME=/home/node/.local/share\n'
+    printf 'XDG_CACHE_HOME=/home/node/.cache\n'
+    printf 'ASDF_DIR=/opt/asdf\n'
+    printf 'ASDF_DATA_DIR=/opt/asdf-data\n'
+    printf 'ASDF_CONFIG_FILE=/dev/null\n'
+    printf 'ASDF_DEFAULT_TOOL_VERSIONS_FILENAME=.tool-versions\n'
+    printf 'ASDF_NODEJS_VERSION=\n'
+    printf 'ASDF_PYTHON_VERSION=\n'
+    printf 'ASDF_GOLANG_VERSION=\n'
+    printf 'ASDF_RUBY_VERSION=\n'
+    printf 'ASDF_RUST_VERSION=\n'
+    printf 'ASDF_SKIP_RESHIM=1\n'
+    printf 'COREPACK_HOME=/opt/asdf-data/corepack\n'
+    printf 'COREPACK_DEFAULT_TO_LATEST=0\n'
+    printf 'COREPACK_ENV_FILE=0\n'
+    printf 'COREPACK_NPM_REGISTRY=https://registry.npmjs.org\n'
+    printf 'COREPACK_ENABLE_NETWORK=0\n'
+    printf 'COREPACK_ENABLE_AUTO_PIN=0\n'
+    printf 'COREPACK_ENABLE_DOWNLOAD_PROMPT=0\n'
+    printf 'COREPACK_ENABLE_PROJECT_SPEC=1\n'
+    printf 'COREPACK_ENABLE_STRICT=1\n'
+    printf 'COREPACK_ENABLE_UNSAFE_CUSTOM_URLS=0\n'
+    printf 'COREPACK_INTEGRITY_CHECK=1\n'
+    printf 'NPM_CONFIG_PREFIX=%s\n' "$TASK_NPM_PREFIX"
+    printf 'npm_config_prefix=%s\n' "$TASK_NPM_PREFIX"
+    printf 'NPM_CONFIG_CACHE=%s\n' "$TASK_NPM_CACHE"
+    printf 'npm_config_cache=%s\n' "$TASK_NPM_CACHE"
+    printf 'NPM_CONFIG_LOGS_DIR=%s/_logs\n' "$TASK_NPM_CACHE"
+    printf 'npm_config_logs_dir=%s/_logs\n' "$TASK_NPM_CACHE"
+    printf 'NPM_CONFIG_UMASK=0002\n'
+    printf 'npm_config_umask=0002\n'
+    printf 'UAI_WORKSPACE=/workspace\n'
+    printf 'UAI_RUNTIME_PROJECTS=/run/uai/runtime-projects\n'
+    printf 'LD_PRELOAD=\n'
+    printf 'LD_AUDIT=\n'
+    printf 'LD_LIBRARY_PATH=\n'
+    printf 'NODE_OPTIONS=\n'
+    printf 'NODE_PATH=\n'
+    printf 'PS4=\n'
+    printf 'BASH_ENV=\n'
+    printf 'ENV=\n'
+    printf 'CLAUDE_CODE_OAUTH_TOKEN=%s\n' "${CLAUDE_CODE_OAUTH_TOKEN:-}"
+    printf 'ANTHROPIC_API_KEY=%s\n' "${ANTHROPIC_API_KEY:-}"
+    printf 'ANTHROPIC_AUTH_TOKEN=%s\n' "${ANTHROPIC_AUTH_TOKEN:-}"
+    printf 'XAI_API_KEY=%s\n' "${XAI_API_KEY:-}"
+    printf 'PLAYWRIGHT_BROWSERS_PATH=/opt/pw-browsers\n'
+    printf '%s\n' "$filtered_project_env" \
+      | jq -r 'to_entries[] | "\(.key)=\(.value)"'
+    while IFS= read -r pe_entry; do
+      [ -n "$pe_entry" ] || continue
+      pe_key=$(jq -r '.key' <<<"$pe_entry")
+      pe_val=$(jq -r '.value' <<<"$pe_entry")
+      [ -n "$pe_key" ] || continue
+      if [ "$pe_key" != "UAI_EDITOR_THEME" ] \
+         && is_reserved_task_env_name "$pe_key"; then
+        continue
+      fi
+      printf '%s=%s\n' "$pe_key" "$pe_val"
+    done < <(jq -c 'to_entries[]?' <<<"$preview_env_raw")
+  } > "$task_env_file"
+  # The mount set matches the rendered Compose file's app service one-for-one
+  # (minus host-gateway and group_add, which have no Apple equivalent and are
+  # not needed — ownership maps transparently across the VM boundary).
+  apple_run_args=(
+    -v "$task_workspace:/workspace"
+    -v "$task_workspace:$task_workspace"
+  )
+  if [ "$task_workspace_physical" != "$task_workspace" ]; then
+    apple_run_args+=( -v "$task_workspace:$task_workspace_physical" )
+  fi
+  while IFS= read -r vol_obj; do
+    [ -n "$vol_obj" ] || continue
+    vol_pid=$(jq -r '.id' <<<"$vol_obj")
+    apple_run_args+=(
+      -v "$task_uai_dir/repos/$vol_pid.git:$task_uai_dir/repos/$vol_pid.git"
+    )
+    if [ "$task_uai_dir_physical" != "$task_uai_dir" ]; then
+      apple_run_args+=(
+        -v "$task_uai_dir/repos/$vol_pid.git:$task_uai_dir_physical/repos/$vol_pid.git"
+      )
+    fi
+  done < <(jq -c '.[]' <<<"$projects_json")
+  apple_run_args+=(
+    -v "$UAI_INIT_SOURCE:/usr/local/bin/uai-init:ro"
+    -v "$runtime_projects_file:/run/uai/runtime-projects:ro"
+    # ADR-108: the shared volume attaches READ-ONLY at a staging path and an
+    # in-guest overlay presents it writable at /opt/asdf-data (upper = the
+    # task's own layer). The shared volume is never written on the task path,
+    # so any number of tasks coexist and first-time installs need no window.
+    -v "$ASDF_VOLUME:/run/uai/asdf-lower:ro"
+    # In-container materialization (post-overlay) uses the packaged current
+    # materializer + Corepack pin, exactly like the retired maintenance
+    # container did.
+    -v "$RUNTIME_MATERIALIZER_SOURCE:/usr/local/bin/uai-materialize-runtimes:ro"
+    -v "$COREPACK_VERSION_SOURCE:/usr/local/share/uai/corepack-version:ro"
+    -v "$PW_BROWSERS_DIR:/opt/pw-browsers"
+  )
+  if [ "$shared_files_mode" != "off" ]; then
+    shared_suffix=""
+    [ "$shared_files_mode" = "ro" ] && shared_suffix=":ro"
+    if [ -n "$shared_owner_org" ]; then
+      apple_run_args+=(
+        -v "$shared_root/orgs/$shared_owner_org:/workspace/files/org$shared_suffix"
+      )
+    fi
+    if [ -n "$shared_owner_user" ]; then
+      apple_run_args+=(
+        -v "$shared_root/users/$shared_owner_user:/workspace/files/me$shared_suffix"
+      )
+    fi
+  fi
+  apple_up_rc=0
+  # CAP_SYS_ADMIN: required for the ADR-108 in-guest overlay mount. The
+  # capability is confined by the VM boundary — the guest kernel is the
+  # task's own, so this grants nothing on the host.
+  "$CONTAINER_CLI" run -d --init \
+    --name "$app_container" \
+    -l "com.uai.task=$task_id" \
+    --cap-add CAP_SYS_ADMIN \
+    --workdir /workspace \
+    --memory "$APPLE_TASK_MEMORY" \
+    --cpus "$APPLE_TASK_CPUS" \
+    --env-file "$task_env_file" \
+    "${apple_run_args[@]}" \
+    "$runtime_image" >/dev/null || apple_up_rc=$?
+  rm -f "$task_env_file"
+  if [ "$apple_up_rc" -ne 0 ]; then
+    require_docker_after_failed_step "start task container"
+    emit_err "COMPOSE_UP_FAILED" \
+      "Uai could not start this task's container on the Apple container runtime. Retry the task." \
+      "start task container"
+  fi
+  # The runtime cannot start a container by immutable image id, so prove the
+  # tag still resolves to the pinned bytes now that the container exists. A
+  # concurrent retag loses either way: before create, the recheck above; here,
+  # the container is quarantined before credentials are installed.
+  apple_post_up_image_id=$("$CONTAINER_CLI" image inspect "$runtime_image" \
+    2>/dev/null | jq -r '.[0].id // empty' 2>/dev/null) \
+    || apple_post_up_image_id=""
+  if [ "$apple_post_up_image_id" != "$runtime_image_id" ]; then
+    if ! quarantine_untrusted_app_container; then
+      emit_err "CONTAINER_INIT_FAILED" \
+        "This task's image changed while its container was being created, and Uai could not prove the container stopped. Stop it manually before retrying." \
+        "verify task image identity"
+    fi
+    emit_err "CONTAINER_INIT_FAILED" \
+      "This task's image changed while its container was being created. Retry so the new image receives a complete runtime proof first." \
+      "verify task image identity"
+  fi
 else
+  step "COMPOSE_UP_FAILED" "docker compose up -d"
   printf '%s\n' "$compose_env_override" | docker compose -p "$compose_project" \
-    -f "$task_uai_dir/docker-compose.yml" -f - up -d >/dev/null
+    -f "$task_uai_dir/docker-compose.yml" -f - up -d --no-build >/dev/null
+fi
+
+# Rendered YAML is not runtime evidence: Compose could reuse unexpected state,
+# or a compatibility bug could silently drop `:ro`. Inspect the exact created
+# app before it receives credentials. There must be one named volume at this
+# destination, with Docker itself reporting the mount read-only, and the same
+# shared volume must not be exposed again at any other destination.
+step "CONTAINER_INIT_FAILED" "verify task runtime isolation"
+app_mounts_json=""
+apple_app_snapshot=""
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  # One container snapshot backs both the mount and environment proofs, so
+  # they describe the same observed state.
+  apple_app_snapshot=$(crt inspect "$app_container" 2>/dev/null) \
+    || apple_app_snapshot=""
+  app_mounts_json=$(printf '%s\n' "$apple_app_snapshot" \
+    | jq -c '.[0].configuration.mounts // empty' 2>/dev/null) \
+    || app_mounts_json=""
+fi
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ] \
+   && [ -z "$app_mounts_json" ]; then
+  require_docker_after_failed_step "inspect task runtime isolation"
+  if ! quarantine_untrusted_app_container; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai could not inspect or stop the task container before credentials were installed. Stop it manually before retrying." \
+      "verify task runtime isolation"
+  fi
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Uai could not inspect the task container's shared runtime mount. Retry to recreate it safely." \
+    "verify task runtime isolation"
+elif [ "$TASK_RUNTIME_MODE" = "docker" ] \
+  && ! app_mounts_json=$(docker inspect --format '{{json .Mounts}}' \
+  "$app_container" 2>/dev/null); then
+  require_docker_after_failed_step "inspect task runtime isolation"
+  if ! quarantine_untrusted_app_container; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai could not inspect or stop the task container before credentials were installed. Stop it manually before retrying." \
+      "verify task runtime isolation"
+  fi
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Uai could not inspect the task container's shared runtime mount. Retry to recreate it safely." \
+    "verify task runtime isolation"
+fi
+app_config_env_json=""
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  app_config_env_json=$(printf '%s\n' "$apple_app_snapshot" \
+    | jq -c '.[0].configuration.initProcess.environment // empty' \
+    2>/dev/null) || app_config_env_json=""
+fi
+if { [ "$TASK_RUNTIME_MODE" = "apple-container" ] \
+     && [ -z "$app_config_env_json" ]; } \
+   || { [ "$TASK_RUNTIME_MODE" = "docker" ] \
+     && ! app_config_env_json=$(docker inspect \
+       --format '{{json .Config.Env}}' "$app_container" 2>/dev/null); }; then
+  require_docker_after_failed_step "inspect task runtime environment"
+  if ! quarantine_untrusted_app_container; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai could not inspect or stop the task container before credentials were installed. Stop it manually before retrying." \
+      "verify task runtime isolation"
+  fi
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Uai could not inspect the task container's runtime environment. Retry to recreate it safely." \
+    "verify task runtime isolation"
+fi
+# The two runtimes report mounts in different shapes; each filter asserts the
+# same contract — exactly one /opt/asdf-data mount, it is the shared
+# uai-asdf-data volume, the runtime itself reports it read-only, and that
+# volume appears at no other destination.
+mounts_proof_filter='
+  [ .[] | select(.Destination == "/opt/asdf-data") ] as $runtime
+  | [ .[] | select(.Name? == "uai-asdf-data") ] as $shared
+  | ($runtime | length) == 1
+    and ($shared | length) == 1
+    and $runtime[0].Type == "volume"
+    and $runtime[0].Name == "uai-asdf-data"
+    and $runtime[0].RW == false
+'
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  # ADR-108: the shared volume attaches READ-ONLY at the overlay staging
+  # path, appears nowhere else, and /opt/asdf-data is NOT a host mount at
+  # all — the writable view there is the in-guest overlay, proven from
+  # inside the guest right after this (host inspect cannot see guest
+  # mounts).
+  mounts_proof_filter='
+    [ .[] | select(.destination == "/run/uai/asdf-lower") ] as $runtime
+    | [ .[] | select((.type.volume.name? // "") == "uai-asdf-data") ] as $shared
+    | ($runtime | length) == 1
+      and ($shared | length) == 1
+      and (($runtime[0].type.volume.name? // "") == "uai-asdf-data")
+      and ((($runtime[0].options // []) | index("ro")) != null)
+      and ((($runtime[0].options // []) | index("rw")) == null)
+      and (([ .[] | select(.destination == "/opt/asdf-data") ] | length) == 0)
+  '
+fi
+if ! printf '%s\n' "$app_mounts_json" \
+  | jq -e "$mounts_proof_filter" >/dev/null 2>&1; then
+  if ! quarantine_untrusted_app_container; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai found an unsafe shared runtime mount and could not prove the task container stopped. Stop it manually before retrying." \
+      "verify task runtime isolation"
+  fi
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Uai stopped this task because its shared runtime cache was not the exact read-only uai-asdf-data volume. Retry to recreate the container safely." \
+    "verify task runtime isolation"
+fi
+if ! printf '%s\n' "$app_config_env_json" | jq -e \
+  --arg path "$TASK_RUNTIME_PATH" \
+  --arg prefix "$TASK_NPM_PREFIX" \
+  --arg cache "$TASK_NPM_CACHE" '
+  def is_owned_npm_config($owned):
+    ascii_downcase as $folded
+    | ($folded | startswith("npm_config_"))
+      and (($owned | index($folded[11:] | gsub("_"; "-"))) != null);
+  (. // []) as $env
+  | [
+      "NPM_CONFIG_PREFIX=\($prefix)",
+      "npm_config_prefix=\($prefix)",
+      "NPM_CONFIG_CACHE=\($cache)",
+      "npm_config_cache=\($cache)",
+      "NPM_CONFIG_LOGS_DIR=\($cache)/_logs",
+      "npm_config_logs_dir=\($cache)/_logs",
+      "NPM_CONFIG_UMASK=0002",
+      "npm_config_umask=0002"
+    ] as $required
+  | [
+      "prefix", "cache", "logs-dir", "umask"
+    ] as $owned
+  | ($env | type == "array")
+    and all($env[]; type == "string")
+    and all($required[];
+      . as $required_value
+      | ([ $env[] | select(. == $required_value) ] | length) == 1
+    )
+    and ([
+      $env[]
+      | split("=")[0]
+      | select(is_owned_npm_config($owned))
+    ] | length) == ($required | length)
+    and ([ $env[] | select(. == "PATH=\($path)") ] | length) == 1
+    and ([ $env[] | select(. == "ASDF_DATA_DIR=/opt/asdf-data") ] | length) == 1
+    and ([ $env[] | select(. == "ASDF_SKIP_RESHIM=1") ] | length) == 1
+    and ([ $env[] | select(. == "COREPACK_HOME=/opt/asdf-data/corepack") ] | length) == 1
+    and ([ $env[] | select(. == "COREPACK_ENABLE_NETWORK=0") ] | length) == 1
+' >/dev/null 2>&1; then
+  if ! quarantine_untrusted_app_container; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai found an unsafe task runtime environment and could not prove the container stopped. Stop it manually before retrying." \
+      "verify task runtime isolation"
+  fi
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Uai stopped this task because its runtime/npm environment did not match the fixed private-prefix and read-only-cache authority. Retry to recreate the container safely." \
+    "verify task runtime isolation"
 fi
 
 # -----------------------------------------------------------------------------
-# 6. Container init — copy AI creds in, install deps, launch code-server.
+# 6a. ADR-108 (apple only): establish the in-guest runtime overlay, then
+#     materialize runtimes INSIDE the container. The shared volume is never
+#     written on the task path: the read-only lower proved above merges under
+#     a task-private upper layer, so a missing toolchain installs into this
+#     task's own layer with zero shared-volume coordination. Both steps run
+#     before any credential, editor, or agent work; a failure quarantines the
+#     container exactly like the isolation proofs above.
+# -----------------------------------------------------------------------------
+
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  step "CONTAINER_INIT_FAILED" "establish task runtime overlay"
+  overlay_rc=0
+  "$CONTAINER_CLI" exec -u root "$app_container" /bin/sh -c '
+    set -e
+    /bin/mkdir -p /var/lib/uai/asdf-upper /var/lib/uai/asdf-work /opt/asdf-data
+    # The merged root inherits the UPPER directory'"'"'s metadata; without this
+    # the node user cannot write the merged view at all (live 2026-08-18).
+    /bin/chown node:node /var/lib/uai/asdf-upper
+    if ! /bin/grep -q "^overlay /opt/asdf-data overlay " /proc/mounts; then
+      /bin/mount -t overlay overlay \
+        -o lowerdir=/run/uai/asdf-lower,upperdir=/var/lib/uai/asdf-upper,workdir=/var/lib/uai/asdf-work \
+        /opt/asdf-data
+    fi
+    # Prove the exact shape from the guest mount table, not from trust —
+    # token-exact (comma-delimited; substring matching accepted
+    # lowerdir=/run/uai/asdf-lower-evil), exactly ONE effective mount at the
+    # merged path and at the lower, a read-only lower, and a real node-owned
+    # upper directory.
+    overlay_lines=$(/bin/grep -c "^overlay /opt/asdf-data overlay " /proc/mounts || true)
+    [ "$overlay_lines" = "1" ] || { echo "expected exactly one /opt/asdf-data overlay, found $overlay_lines" >&2; exit 1; }
+    any_lines=$(/bin/grep -c " /opt/asdf-data " /proc/mounts || true)
+    [ "$any_lines" = "1" ] || { echo "unexpected extra mounts at /opt/asdf-data" >&2; exit 1; }
+    opts=$(/bin/grep "^overlay /opt/asdf-data overlay " /proc/mounts | /usr/bin/cut -d" " -f4)
+    case ",$opts," in *",lowerdir=/run/uai/asdf-lower,"*) ;; *) echo "overlay lower is foreign" >&2; exit 1 ;; esac
+    case ",$opts," in *",upperdir=/var/lib/uai/asdf-upper,"*) ;; *) echo "overlay upper is foreign" >&2; exit 1 ;; esac
+    case ",$opts," in *",workdir=/var/lib/uai/asdf-work,"*) ;; *) echo "overlay workdir is foreign" >&2; exit 1 ;; esac
+    case ",$opts," in *",ro,"*) echo "overlay is unexpectedly read-only" >&2; exit 1 ;; esac
+    lower_lines=$(/bin/grep -c " /run/uai/asdf-lower " /proc/mounts || true)
+    [ "$lower_lines" = "1" ] || { echo "expected exactly one lower attachment, found $lower_lines" >&2; exit 1; }
+    lopts=$(/bin/grep " /run/uai/asdf-lower " /proc/mounts | /usr/bin/cut -d" " -f4)
+    case ",$lopts," in *",ro,"*) ;; *) echo "lower attachment is not read-only" >&2; exit 1 ;; esac
+    [ ! -L /var/lib/uai/asdf-upper ] || { echo "upper is a symlink" >&2; exit 1; }
+    [ -d /var/lib/uai/asdf-upper ] || { echo "upper is not a directory" >&2; exit 1; }
+    [ "$(/usr/bin/stat -c %U /var/lib/uai/asdf-upper)" = "node" ] || { echo "upper is not node-owned" >&2; exit 1; }
+    /usr/bin/test -d /opt/asdf-data/plugins
+  ' >/dev/null || overlay_rc=$?
+  if [ "$overlay_rc" -ne 0 ]; then
+    require_docker_after_failed_step "establish task runtime overlay"
+    if ! quarantine_untrusted_app_container; then
+      emit_err "CONTAINER_INIT_FAILED" \
+        "Uai could not establish this task's runtime overlay, and could not prove the container stopped. Stop it manually before retrying." \
+        "establish task runtime overlay"
+    fi
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai could not establish this task's runtime overlay on the Apple container runtime. Retry the task." \
+      "establish task runtime overlay"
+  fi
+
+  if [ "$project_count" -gt 0 ]; then
+    step "CONTAINER_INIT_FAILED" "materialize task runtimes in container"
+    materialization_rc=0
+    "$CONTAINER_CLI" exec -u node -w /workspace "$app_container" \
+      /usr/bin/env -i \
+      HOME=/home/node \
+      ASDF_DIR=/opt/asdf \
+      ASDF_DATA_DIR=/opt/asdf-data \
+      PATH=/opt/asdf-data/shims:/opt/asdf/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
+      /usr/bin/timeout --signal=TERM --kill-after=10s 600s \
+      /usr/local/bin/uai-materialize-runtimes >&2 || materialization_rc=$?
+    if [ "$materialization_rc" -ne 0 ]; then
+      require_docker_after_failed_step "materialize task runtimes in container"
+      if ! quarantine_untrusted_app_container; then
+        emit_err "CONTAINER_INIT_FAILED" \
+          "Runtime materialization failed and Uai could not prove the task container stopped. Stop it manually before retrying." \
+          "materialize task runtimes in container"
+      fi
+      case "$materialization_rc" in
+        124|137)
+          emit_err "CONTAINER_INIT_FAILED" \
+            "Runtime materialization did not finish inside Uai's 10-minute startup budget. Retry the task: Uai re-checks every required runtime and package manager before agents start." \
+            "materialize task runtimes in container"
+          ;;
+        *)
+          emit_err "CONTAINER_INIT_FAILED" \
+            "Uai could not install and verify every runtime and package manager needed by this task. Check the project's .tool-versions and packageManager entries and the host's network availability, then retry." \
+            "materialize task runtimes in container"
+          ;;
+      esac
+    fi
+  fi
+fi
+
+# -----------------------------------------------------------------------------
+# 7. Container init — copy AI creds in, install deps, launch code-server.
 # -----------------------------------------------------------------------------
 
 step "CONTAINER_INIT_FAILED" "uai-init (deps + code-server)"
@@ -1234,7 +2439,38 @@ managed_exec_env=(
   -e "PATH=/usr/bin:/bin"
   -e "XDG_CONFIG_HOME="
   -e "XDG_DATA_HOME="
+  -e "XDG_CACHE_HOME="
+  -e "ASDF_DIR=/opt/asdf"
+  -e "ASDF_DATA_DIR=/opt/asdf-data"
+  -e "ASDF_CONFIG_FILE=/dev/null"
+  -e "ASDF_DEFAULT_TOOL_VERSIONS_FILENAME=.tool-versions"
+  -e "ASDF_NODEJS_VERSION="
+  -e "ASDF_PYTHON_VERSION="
+  -e "ASDF_GOLANG_VERSION="
+  -e "ASDF_RUBY_VERSION="
+  -e "ASDF_RUST_VERSION="
+  -e "ASDF_SKIP_RESHIM=1"
+  -e "COREPACK_HOME=/opt/asdf-data/corepack"
+  -e "COREPACK_DEFAULT_TO_LATEST=0"
+  -e "COREPACK_ENV_FILE=0"
+  -e "COREPACK_NPM_REGISTRY=https://registry.npmjs.org"
+  -e "COREPACK_ENABLE_NETWORK=0"
+  -e "COREPACK_ENABLE_AUTO_PIN=0"
+  -e "COREPACK_ENABLE_DOWNLOAD_PROMPT=0"
+  -e "COREPACK_ENABLE_PROJECT_SPEC=1"
+  -e "COREPACK_ENABLE_STRICT=1"
+  -e "COREPACK_ENABLE_UNSAFE_CUSTOM_URLS=0"
+  -e "COREPACK_INTEGRITY_CHECK=1"
+  -e "NPM_CONFIG_PREFIX=$TASK_NPM_PREFIX"
+  -e "npm_config_prefix=$TASK_NPM_PREFIX"
+  -e "NPM_CONFIG_CACHE=$TASK_NPM_CACHE"
+  -e "npm_config_cache=$TASK_NPM_CACHE"
+  -e "NPM_CONFIG_LOGS_DIR=$TASK_NPM_CACHE/_logs"
+  -e "npm_config_logs_dir=$TASK_NPM_CACHE/_logs"
+  -e "NPM_CONFIG_UMASK=0002"
+  -e "npm_config_umask=0002"
   -e "LD_PRELOAD="
+  -e "LD_AUDIT="
   -e "LD_LIBRARY_PATH="
   -e "DYLD_INSERT_LIBRARIES="
   -e "DYLD_LIBRARY_PATH="
@@ -1260,13 +2496,62 @@ managed_clean_env=(
   "PATH=/usr/bin:/bin"
 )
 
+# Runtime-bearing task initialization gets the same fixed environment as
+# Compose and agent launches. Unlike the root/control array above, this path
+# includes task-private global packages last so unique tools are usable while
+# they remain unable to shadow shared shims or system controls.
+task_runtime_exec_env=(
+  -e "HOME=/home/node"
+  -e "PATH=$TASK_RUNTIME_PATH"
+  -e "XDG_CONFIG_HOME=/home/node/.config"
+  -e "XDG_DATA_HOME=/home/node/.local/share"
+  -e "XDG_CACHE_HOME=/home/node/.cache"
+  -e "ASDF_DIR=/opt/asdf"
+  -e "ASDF_DATA_DIR=/opt/asdf-data"
+  -e "ASDF_CONFIG_FILE=/dev/null"
+  -e "ASDF_DEFAULT_TOOL_VERSIONS_FILENAME=.tool-versions"
+  -e "ASDF_NODEJS_VERSION="
+  -e "ASDF_PYTHON_VERSION="
+  -e "ASDF_GOLANG_VERSION="
+  -e "ASDF_RUBY_VERSION="
+  -e "ASDF_RUST_VERSION="
+  -e "ASDF_SKIP_RESHIM=1"
+  -e "COREPACK_HOME=/opt/asdf-data/corepack"
+  -e "COREPACK_DEFAULT_TO_LATEST=0"
+  -e "COREPACK_ENV_FILE=0"
+  -e "COREPACK_NPM_REGISTRY=https://registry.npmjs.org"
+  -e "COREPACK_ENABLE_NETWORK=0"
+  -e "COREPACK_ENABLE_AUTO_PIN=0"
+  -e "COREPACK_ENABLE_DOWNLOAD_PROMPT=0"
+  -e "COREPACK_ENABLE_PROJECT_SPEC=1"
+  -e "COREPACK_ENABLE_STRICT=1"
+  -e "COREPACK_ENABLE_UNSAFE_CUSTOM_URLS=0"
+  -e "COREPACK_INTEGRITY_CHECK=1"
+  -e "NPM_CONFIG_PREFIX=$TASK_NPM_PREFIX"
+  -e "npm_config_prefix=$TASK_NPM_PREFIX"
+  -e "NPM_CONFIG_CACHE=$TASK_NPM_CACHE"
+  -e "npm_config_cache=$TASK_NPM_CACHE"
+  -e "NPM_CONFIG_LOGS_DIR=$TASK_NPM_CACHE/_logs"
+  -e "npm_config_logs_dir=$TASK_NPM_CACHE/_logs"
+  -e "NPM_CONFIG_UMASK=0002"
+  -e "npm_config_umask=0002"
+  -e "LD_PRELOAD="
+  -e "LD_AUDIT="
+  -e "LD_LIBRARY_PATH="
+  -e "NODE_OPTIONS="
+  -e "NODE_PATH="
+  -e "PS4="
+  -e "BASH_ENV="
+  -e "ENV="
+)
+
 # OpenCode and code-server share ~/.local/share. OpenCode credentials are
 # copied as root below, so creating only its leaf with `mkdir -p` can leave the
 # shared parent root-owned (live 2026-08-04). Then node cannot create
 # code-server's User profile and the editor silently falls back to its light,
 # full-chrome defaults. Repair both explicitly on every start/resume; GNU
 # `install -d` also corrects an existing directory with the wrong owner.
-if ! docker exec -u root "${managed_exec_env[@]}" "$app_container" \
+if ! crt exec -u root "${managed_exec_env[@]}" "$app_container" \
   /usr/bin/install -d -o node -g node -m 0755 \
     /home/node/.local/share \
     /home/node/.local/share/opencode >/dev/null; then
@@ -1280,7 +2565,7 @@ fi
 # and never the host cache. The task-private ~/.gitconfig makes these entries
 # local to this container, and the read-before-add keeps resumes idempotent.
 step "CONTAINER_INIT_FAILED" "trust task Git worktrees"
-container_safe_dirs=$(docker exec -u node "${managed_exec_env[@]}" \
+container_safe_dirs=$(crt exec -u node "${managed_exec_env[@]}" \
   "$app_container" "${managed_clean_env[@]}" /usr/bin/git config --global \
   --get-all safe.directory 2>/dev/null || true)
 while IFS= read -r safe_project; do
@@ -1290,10 +2575,12 @@ while IFS= read -r safe_project; do
   for safe_worktree in \
     "/workspace/$safe_project_slug" \
     "$task_workspace/$safe_project_slug" \
-    "$task_uai_dir/repos/$safe_project_id.git"; do
+    "$task_uai_dir/repos/$safe_project_id.git" \
+    "$task_workspace_physical/$safe_project_slug" \
+    "$task_uai_dir_physical/repos/$safe_project_id.git"; do
     if ! printf '%s\n' "$container_safe_dirs" \
       | grep -Fqx -- "$safe_worktree"; then
-      if ! docker exec -u node "${managed_exec_env[@]}" "$app_container" \
+      if ! crt exec -u node "${managed_exec_env[@]}" "$app_container" \
         "${managed_clean_env[@]}" /usr/bin/git config --global --add \
         safe.directory "$safe_worktree" >/dev/null; then
         emit_err "CONTAINER_INIT_FAILED" \
@@ -1305,11 +2592,31 @@ while IFS= read -r safe_project; do
   done
 done < <(jq -c '.[]' <<<"$projects_json")
 
+# A running container is not sufficient proof that its linked worktrees are
+# usable. In particular, Git may have canonicalized a symlinked host workspace
+# root while Compose mounted only its lexical spelling. Verify the actual path
+# agents use before credentials, dependency installation, or status=running.
+step "CONTAINER_INIT_FAILED" "verify task Git worktrees"
+while IFS= read -r verify_project; do
+  [ -n "$verify_project" ] || continue
+  verify_project_slug=$(jq -r '.slug' <<<"$verify_project")
+  verify_is_worktree=""
+  if ! verify_is_worktree=$(crt exec -u node "${managed_exec_env[@]}" \
+    "$app_container" "${managed_clean_env[@]}" /usr/bin/git \
+    -C "/workspace/$verify_project_slug" rev-parse \
+    --is-inside-work-tree 2>/dev/null) \
+    || [ "$verify_is_worktree" != "true" ]; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai could not open $verify_project_slug as a Git worktree inside the task container. Retry the task after checking the host workspace path." \
+      "verify task Git worktree ($verify_project_slug)"
+  fi
+done < <(jq -c '.[]' <<<"$projects_json")
+
 # A failed/retried start can preserve a container that still holds a previous
 # account. Erase that Uai-managed state first for both connected and
 # disconnected starts; otherwise a no-credential resume could briefly reuse a
 # stale token before the asynchronous reconciler catches up.
-if ! docker exec -u node "${managed_exec_env[@]}" "$app_container" \
+if ! crt exec -u node "${managed_exec_env[@]}" "$app_container" \
   "${managed_clean_env[@]}" /bin/sh -c '
     set -eu
     /bin/rm -f "$GH_CONFIG_DIR/hosts.yml"
@@ -1326,6 +2633,7 @@ if ! docker exec -u node "${managed_exec_env[@]}" "$app_container" \
     done
     test ! -e "$GH_CONFIG_DIR/hosts.yml"
   ' >/dev/null; then
+  require_docker_after_failed_step "clear container GitHub credential"
   emit_err "GITHUB_AUTH_UNAVAILABLE" \
     "Uai could not clear the previous managed GitHub credential from the task container. Retry the task before doing GitHub work." \
     "clear container GitHub credential"
@@ -1340,16 +2648,18 @@ if [ -n "$github_credential_socket" ]; then
   if ! printf 'protocol=https\nhost=github.com\n\n' \
     | git_with_github_credential credential fill \
     | sed -n 's/^password=//p' \
-    | docker exec -i -u node "${managed_exec_env[@]}" "$app_container" \
+    | crt exec -i -u node "${managed_exec_env[@]}" "$app_container" \
         "${managed_clean_env[@]}" /usr/bin/gh auth login --with-token \
         --hostname github.com --git-protocol https >/dev/null; then
+    require_docker_after_failed_step "configure container GitHub credential"
     emit_err "GITHUB_AUTH_UNAVAILABLE" \
       "GitHub is connected on this host, but Uai could not install that credential in the task container. Retry the task; if it persists, reconnect GitHub on this host." \
       "configure container GitHub credential"
   fi
-  if ! docker exec -u node "${managed_exec_env[@]}" "$app_container" \
+  if ! crt exec -u node "${managed_exec_env[@]}" "$app_container" \
     "${managed_clean_env[@]}" /usr/bin/gh auth setup-git \
     --hostname github.com >/dev/null; then
+    require_docker_after_failed_step "configure container Git credential helper"
     emit_err "GITHUB_AUTH_UNAVAILABLE" \
       "GitHub is connected on this host, but Uai could not configure Git HTTPS in the task container. Retry the task; if it persists, reconnect GitHub on this host." \
       "configure container Git credential helper"
@@ -1362,11 +2672,11 @@ fi
 # the bind mount and leave a stale dentry, after which claude refuses to
 # start. docker cp gives the container its own stable copy. Best-effort.
 if [ -f "$UAI_OWNER_HOME/.claude.json" ]; then
-  docker cp "$UAI_OWNER_HOME/.claude.json" \
+  crt cp "$UAI_OWNER_HOME/.claude.json" \
     "$app_container":/home/node/.claude.json >/dev/null 2>&1 \
-    || log "warning: docker cp of .claude.json failed; claude may need re-login"
-  docker exec -u root "$app_container" \
-    chown node:node /home/node/.claude.json >/dev/null 2>&1 || true
+    || log "warning: crt cp of .claude.json failed; claude may need re-login"
+  crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+    /usr/bin/chown node:node /home/node/.claude.json >/dev/null 2>&1 || true
 fi
 
 # Copy Codex credentials/config into a task-private /home/node/.codex.
@@ -1376,18 +2686,18 @@ fi
 # docker cp preserves the host uid/gid, so a skipped chown leaves 0600
 # files owned by e.g. macOS 501:20 that the container's node (1000:1000)
 # cannot read — Codex then dies at startup.
-if docker exec -u root "$app_container" \
-    mkdir -p /home/node/.codex >/dev/null; then
+if crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+    /usr/bin/mkdir -p /home/node/.codex >/dev/null; then
   for codex_item in auth.json config.toml AGENTS.md version.json installation_id rules; do
     if [ -e "$UAI_OWNER_HOME/.codex/$codex_item" ]; then
-      docker cp "$UAI_OWNER_HOME/.codex/$codex_item" \
+      crt cp "$UAI_OWNER_HOME/.codex/$codex_item" \
         "$app_container":/home/node/.codex/ >/dev/null \
-        || log "ERROR: docker cp of .codex/$codex_item failed; Codex in this task may not authenticate"
+        || log "ERROR: crt cp of .codex/$codex_item failed; Codex in this task may not authenticate"
     fi
   done
-  docker exec -u root "$app_container" \
-      chown -R node:node /home/node/.codex >/dev/null \
-    || log "ERROR: chown of /home/node/.codex failed — 0600 credentials remain unreadable by node. Fix: docker exec -u root $app_container chown -R node:node /home/node/.codex"
+  crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+      /usr/bin/chown -R node:node /home/node/.codex >/dev/null \
+    || log "ERROR: chown of /home/node/.codex failed — 0600 credentials remain unreadable by node. Fix (docker mode; use the bundled container CLI on Apple hosts): docker exec -u root -e PATH=/usr/bin:/bin $app_container /usr/bin/chown -R node:node /home/node/.codex"
 else
   log "ERROR: mkdir /home/node/.codex failed in $app_container; Codex credentials were not injected"
 fi
@@ -1396,39 +2706,39 @@ fi
 # The Linux `kimi` binary is baked into the image; here we copy ONLY the
 # arch-independent config + credential (never the host's macOS bin/, nor live
 # session state) so the container's kimi runs on the operator's subscription.
-docker exec -u root "$app_container" \
-  mkdir -p /home/node/.kimi-code/credentials >/dev/null 2>&1 || true
+crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+  /usr/bin/mkdir -p /home/node/.kimi-code/credentials >/dev/null 2>&1 || true
 if [ -e "$UAI_OWNER_HOME/.kimi-code/config.toml" ]; then
-  docker cp "$UAI_OWNER_HOME/.kimi-code/config.toml" \
+  crt cp "$UAI_OWNER_HOME/.kimi-code/config.toml" \
     "$app_container":/home/node/.kimi-code/config.toml >/dev/null 2>&1 \
-    || log "warning: docker cp of .kimi-code/config.toml failed; kimi may need re-login"
+    || log "warning: crt cp of .kimi-code/config.toml failed; kimi may need re-login"
 fi
 if [ -e "$UAI_OWNER_HOME/.kimi-code/device_id" ]; then
-  docker cp "$UAI_OWNER_HOME/.kimi-code/device_id" \
+  crt cp "$UAI_OWNER_HOME/.kimi-code/device_id" \
     "$app_container":/home/node/.kimi-code/device_id >/dev/null 2>&1 || true
 fi
 if [ -e "$UAI_OWNER_HOME/.kimi-code/credentials/kimi-code.json" ]; then
-  docker cp "$UAI_OWNER_HOME/.kimi-code/credentials/kimi-code.json" \
+  crt cp "$UAI_OWNER_HOME/.kimi-code/credentials/kimi-code.json" \
     "$app_container":/home/node/.kimi-code/credentials/kimi-code.json >/dev/null 2>&1 \
-    || log "warning: docker cp of .kimi-code credential failed; kimi may need re-login"
+    || log "warning: crt cp of .kimi-code credential failed; kimi may need re-login"
 fi
-docker exec -u root "$app_container" \
-  chown -R node:node /home/node/.kimi-code >/dev/null 2>&1 || true
+crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+  /usr/bin/chown -R node:node /home/node/.kimi-code >/dev/null 2>&1 || true
 
 # Copy Grok subscription/config into a task-private /home/node/.grok. The Linux
 # `grok` binary is baked into the image; here we copy the arch-independent
 # auth + config (auth.json is an OIDC token the CLI refreshes in-container).
-docker exec -u root "$app_container" \
-  mkdir -p /home/node/.grok >/dev/null 2>&1 || true
+crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+  /usr/bin/mkdir -p /home/node/.grok >/dev/null 2>&1 || true
 for grok_item in auth.json config.toml models_cache.json agent_id; do
   if [ -e "$UAI_OWNER_HOME/.grok/$grok_item" ]; then
-    docker cp "$UAI_OWNER_HOME/.grok/$grok_item" \
+    crt cp "$UAI_OWNER_HOME/.grok/$grok_item" \
       "$app_container":/home/node/.grok/ >/dev/null 2>&1 \
-      || log "warning: docker cp of .grok/$grok_item failed; grok may need re-login"
+      || log "warning: crt cp of .grok/$grok_item failed; grok may need re-login"
   fi
 done
-docker exec -u root "$app_container" \
-  chown -R node:node /home/node/.grok >/dev/null 2>&1 || true
+crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+  /usr/bin/chown -R node:node /home/node/.grok >/dev/null 2>&1 || true
 
 # Copy OpenCode provider auth into a task-private /home/node/.local/share/opencode
 # (ADR-077), same per-task-writable-copy pattern as Codex. The Linux `opencode`
@@ -1438,13 +2748,13 @@ docker exec -u root "$app_container" \
 # The shared parent and this leaf were created with node ownership above.
 for oc_item in auth.json config.json; do
   if [ -e "$UAI_OWNER_HOME/.local/share/opencode/$oc_item" ]; then
-    docker cp "$UAI_OWNER_HOME/.local/share/opencode/$oc_item" \
+    crt cp "$UAI_OWNER_HOME/.local/share/opencode/$oc_item" \
       "$app_container":/home/node/.local/share/opencode/ >/dev/null 2>&1 \
-      || log "warning: docker cp of opencode/$oc_item failed; opencode may need re-login"
+      || log "warning: crt cp of opencode/$oc_item failed; opencode may need re-login"
   fi
 done
-docker exec -u root "$app_container" \
-  chown -R node:node /home/node/.local/share/opencode >/dev/null 2>&1 || true
+crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+  /usr/bin/chown -R node:node /home/node/.local/share/opencode >/dev/null 2>&1 || true
 
 # Copy the resolved SSH identity into the container for commit/tag signing and
 # as the no-GitHub-connection transport fallback. Connected users clone, fetch,
@@ -1454,17 +2764,17 @@ docker exec -u root "$app_container" \
 # permissions problem hours later; live 2026-07-21). The channel-ensure path
 # (ensureTaskSshIdentity) re-asserts all of this on reconnects.
 if [ -f "$uai_identity_key" ]; then
-  docker exec -u root "$app_container" \
-    mkdir -p /home/node/.ssh >/dev/null 2>&1 \
+  crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+    /usr/bin/mkdir -p /home/node/.ssh >/dev/null 2>&1 \
     || log "warning: ssh setup: mkdir ~/.ssh failed in $app_container"
-  docker cp "$uai_identity_key" \
+  crt cp "$uai_identity_key" \
     "$app_container":/home/node/.ssh/id_ed25519 >/dev/null 2>&1 \
     || log "warning: ssh setup: key copy failed — signing and SSH fallback unavailable"
-  docker cp "${uai_identity_key}.pub" \
+  crt cp "${uai_identity_key}.pub" \
     "$app_container":/home/node/.ssh/id_ed25519.pub >/dev/null 2>&1 \
     || log "warning: ssh setup: pubkey copy failed (signing will be off)"
-  docker exec -u root "$app_container" sh -c \
-    'chown -R node:node /home/node/.ssh && chmod 700 /home/node/.ssh && chmod 600 /home/node/.ssh/id_ed25519' \
+  crt exec -u root "${managed_exec_env[@]}" "$app_container" /bin/sh -c \
+    '/usr/bin/chown -R node:node /home/node/.ssh && /usr/bin/chmod 700 /home/node/.ssh && /usr/bin/chmod 600 /home/node/.ssh/id_ed25519' \
     >/dev/null 2>&1 \
     || log "warning: ssh setup: chown/chmod failed — key may be unreadable by node"
 fi
@@ -1475,26 +2785,70 @@ fi
 # anywhere on this path) used to fail the whole task over a step anyone can
 # re-run. Retry once, then come up DEGRADED with a warning the host surfaces
 # as a system note in the task feed.
+quarantine_runtime_authority_violation() {
+  quarantine_untrusted_app_container
+}
+
 init_warning=""
-if ! docker exec "$app_container" /usr/local/bin/uai-init >/dev/null; then
+init_rc=0
+crt exec "${task_runtime_exec_env[@]}" "$app_container" \
+  /usr/local/bin/uai-init >/dev/null || init_rc=$?
+if [ "$init_rc" -ne 0 ]; then
+  require_docker_after_failed_step "uai-init (deps + code-server)"
+  if [ "$init_rc" -eq 78 ]; then
+    # Exit 78 is reserved for a host-authority violation, not an ordinary
+    # best-effort dependency failure. Keep the already-created app unavailable
+    # and prove it stopped before returning an actionable task-up failure.
+    if ! quarantine_runtime_authority_violation; then
+      emit_err "CONTAINER_INIT_FAILED" \
+        "A workspace runtime-authority violation was detected, and Uai could not prove the task container stopped. Stop it manually before retrying." \
+        "quarantine runtime-authority violation"
+    fi
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai stopped this task because its runtime isolation changed after startup (for example, a writable shared cache, an unsafe private npm path, or a workspace-root .tool-versions). Retry after removing the reported redirect; project runtime manifests belong only inside selected project directories." \
+      "uai-init runtime authority"
+  fi
   log "warning: uai-init failed — retrying once"
   sleep 2
-  if ! docker exec "$app_container" /usr/local/bin/uai-init >/dev/null; then
+  init_rc=0
+  crt exec "${task_runtime_exec_env[@]}" "$app_container" \
+    /usr/local/bin/uai-init >/dev/null || init_rc=$?
+  if [ "$init_rc" -ne 0 ]; then
+    require_docker_after_failed_step "uai-init (deps + code-server)"
+    if [ "$init_rc" -eq 78 ]; then
+      if ! quarantine_runtime_authority_violation; then
+        emit_err "CONTAINER_INIT_FAILED" \
+          "A workspace runtime-authority violation was detected, and Uai could not prove the task container stopped. Stop it manually before retrying." \
+          "quarantine runtime-authority violation"
+      fi
+      emit_err "CONTAINER_INIT_FAILED" \
+        "Uai stopped this task because its runtime isolation changed after startup (for example, a writable shared cache, an unsafe private npm path, or a workspace-root .tool-versions). Retry after removing the reported redirect." \
+        "uai-init runtime authority"
+    fi
     init_warning="Workspace init (deps + editor) failed twice — the task is up, but the editor and installed dependencies may be missing. Retry from a task terminal with: /usr/local/bin/uai-init"
     log "warning: $init_warning"
   fi
 fi
 
 # -----------------------------------------------------------------------------
-# 7. Discover code-server + preview ports, mark running, unlock.
+# 8. Discover code-server + preview ports, mark running, unlock.
 # -----------------------------------------------------------------------------
 
 # code-server: container exposes 8080; Docker auto-maps to a random host
 # port. Discover via `docker port`. Best-effort — if it fails the Editor
 # pane is just unavailable.
-code_server_port=$(mapped_host_port "$app_container" 8080)
-if [ -z "$code_server_port" ]; then
-  log "warning: could not discover code-server port for ${app_container} (editor pane unavailable)"
+code_server_port=""
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  # No ports are published on the Apple runtime: the container's vmnet IP is
+  # host-routable, so the Editor tunnel dials <container-ip>:8080 directly
+  # (resolved per-request from the provider's route inspection).
+  :
+else
+  code_server_port=$(mapped_host_port "$app_container" 8080)
+  if [ -z "$code_server_port" ]; then
+    require_docker_after_failed_step "discover code-server port"
+    log "warning: could not discover code-server port for ${app_container} (editor pane unavailable)"
+  fi
 fi
 
 # ADR-043 Stage 2: preview ports are no longer published at task-up, so there is