assertledger 1.0.0 → 1.1.1

package/dist/engine/index.js

@@ -4,12 +4,15 @@ import { createReadStream } from "node:fs";
 import { cp, lstat, mkdir, mkdtemp, open, readdir, readFile, realpath, rename, rm, stat, writeFile, } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
 import { pathToFileURL } from "node:url";
 import { createScanner, SyntaxKind } from "typescript/unstable/ast";
-import { AdapterSchema, parseAgenticBenchmarkAcquisitionRequest, parseAgenticBenchmarkAcquisitionResult, parseEvidenceManifest, parseRepositoryAudit, parseRepositoryInitConfig, parseRepositoryInitLock, parseRepositoryInitResult, parseVerificationRequest, repositoryInitConfigDigest, repositoryInitLockDigest, } from "../contracts/index.js";
+import { AdapterSchema, parseAgenticBenchmarkAcquisitionRequest, parseAgenticBenchmarkAcquisitionResult, parseEvidenceManifest, parseRepositoryAudit, parseRepositoryInitConfig, parseRepositoryInitLock, parseRepositoryInitResult, parseVerificationRequest, parseVersionedVerificationRequest, repositoryInitConfigDigest, repositoryInitLockDigest, } from "../contracts/index.js";
 import { assertSafeRelativePath, canonicalize, createAgenticBenchmark, decideEvidence, portablePathKey, replayAgenticBenchmark, replayEvidenceManifest, sealManifestArtifact, sha256Canonical, } from "../core/index.js";
 import { NODE_TEST_ADAPTER_PROFILE } from "./adapters/node-test-profile.js";
 import { runNodeTestRuntimePreflight, } from "./adapters/node-test-runtime.js";
+import { CONTAINER_LIMITATIONS, CONTAINER_REPORTER_FILE, CONTAINER_RESULT_FILE, CONTAINER_WORKSPACE, DEFAULT_CONTAINER_RUNTIME_COMMAND, prepareContainerBackend, runContainerExecution, } from "./container.js";
 import { normalizeRuntimeFacts, RUNTIME_FACTS_VERSION } from "./adapters/runtime-facts.js";
 import { NODE_TEST_REPORTER_SOURCE } from "./node-test-reporter.js";
 import { runRuntimeDoctorChecks } from "./runtime-doctor.js";
@@ -50,6 +53,9 @@ class OutputAccumulator {
             this.#capturedBytes += captured.byteLength;
         }
     }
+    capturedBytes() {
+        return Buffer.concat(this.#parts);
+    }
     finish() {
         const captured = Buffer.concat(this.#parts);
         const decoded = captured.toString("utf8");
@@ -162,7 +168,14 @@ async function terminateProcessTree(pid) {
     }
 }
 export async function runProcess(value) {
-    const input = parseProcessInput(value);
+    const { stdoutBytes: _stdoutBytes, ...result } = await runBoundedProcess(parseProcessInput(value));
+    return result;
+}
+/**
+ * Runs a validated process. The optional byte stream is written to standard input; a failure to
+ * produce or deliver it makes the run an infrastructure error even when the process exits zero.
+ */
+async function runBoundedProcess(input, standardInput) {
     const cwd = await realpath(input.cwd);
     const cwdStats = await stat(cwd);
     if (!cwdStats.isDirectory())
@@ -173,6 +186,7 @@ export async function runProcess(value) {
         const stderr = new OutputAccumulator(input.maximumOutputBytes);
         let timedOut = false;
         let spawnError;
+        let inputError;
         let settled = false;
         let terminationTimer;
         const child = spawn(input.executable, input.args, {
@@ -181,8 +195,13 @@ export async function runProcess(value) {
             env: input.environment,
             shell: false,
             windowsHide: true,
-            stdio: ["ignore", "pipe", "pipe"],
+            stdio: [standardInput === undefined ? "ignore" : "pipe", "pipe", "pipe"],
         });
+        const inputDelivered = standardInput === undefined || child.stdin === null
+            ? Promise.resolve()
+            : pipeline(Readable.from(standardInput), child.stdin).catch((error) => {
+                inputError = error instanceof Error ? error : new Error(String(error));
+            });
         child.stdout.on("data", (chunk) => stdout.add(chunk));
         child.stderr.on("data", (chunk) => stderr.add(chunk));
         child.once("error", (error) => {
@@ -203,7 +222,12 @@ export async function runProcess(value) {
                 durationMs: Date.now() - startedAt,
                 stdout: stdout.finish(),
                 stderr: stderr.finish(),
-                ...(spawnError ? { error: spawnError.message } : {}),
+                stdoutBytes: stdout.capturedBytes(),
+                ...(spawnError
+                    ? { error: spawnError.message }
+                    : inputError
+                        ? { error: inputError.message }
+                        : {}),
             });
         };
         const timer = setTimeout(() => {
@@ -224,14 +248,20 @@ export async function runProcess(value) {
             }, PROCESS_TERMINATION_GRACE_MS);
         }, input.timeoutMs);
         child.once("close", (exitCode, signal) => {
-            const outcome = timedOut
-                ? "TIMEOUT"
-                : spawnError
-                    ? "INFRA_ERROR"
-                    : exitCode === 0
-                        ? "PASS"
-                        : "PROCESS_CRASH";
-            finish(outcome, exitCode, signal);
+            const settle = () => {
+                const outcome = timedOut
+                    ? "TIMEOUT"
+                    : spawnError || inputError
+                        ? "INFRA_ERROR"
+                        : exitCode === 0
+                            ? "PASS"
+                            : "PROCESS_CRASH";
+                finish(outcome, exitCode, signal);
+            };
+            if (standardInput === undefined)
+                settle();
+            else
+                void inputDelivered.then(settle);
         });
     });
 }
@@ -1737,7 +1767,7 @@ function assertPortableStringCollection(values, duplicateCode) {
     normalizePortableCollection(values.map((value) => ({ path: value })), duplicateCode);
 }
 function parseRequest(value) {
-    const request = parseVerificationRequest(value);
+    const request = parseVersionedVerificationRequest(value);
     const repository = requireRecord(request.repository, "repository");
     const adapter = requireRecord(request.adapter, "adapter");
     const isolation = requireRecord(request.isolation, "isolation");
@@ -1750,10 +1780,24 @@ function parseRequest(value) {
     if (adapter.kind !== "node-test" && adapter.kind !== "testforge-command") {
         throw new TypeError("UNSUPPORTED_ADAPTER");
     }
-    if (isolation.kind !== "trusted-local")
-        throw new TypeError("UNSUPPORTED_ISOLATION");
-    if (isolation.acknowledgedUnsafeExecution !== true) {
-        throw new Error("UNSAFE_LOCAL_EXECUTION_NOT_ACKNOWLEDGED");
+    // The versioned contract already restricts container isolation to v2 requests.
+    const containerIsolation = isolation.kind === "container"
+        ? (() => {
+            const parsed = isolation;
+            return {
+                kind: "container",
+                image: parsed.image,
+                environment: parsed.environment.map(({ name, value }) => ({ name, value })),
+                limits: { ...parsed.limits },
+            };
+        })()
+        : undefined;
+    if (containerIsolation === undefined) {
+        if (isolation.kind !== "trusted-local")
+            throw new TypeError("UNSUPPORTED_ISOLATION");
+        if (isolation.acknowledgedUnsafeExecution !== true) {
+            throw new Error("UNSAFE_LOCAL_EXECUTION_NOT_ACKNOWLEDGED");
+        }
     }
     const parsedBudgets = {
         maximumCandidates: requirePositiveInteger(budgets.maximumCandidates, "maximum_candidates"),
@@ -1830,7 +1874,9 @@ function parseRequest(value) {
     const executionCount = worlds.length * requiredAttempts * (candidates.length + 1);
     if (executionCount > parsedBudgets.maximumExecutions)
         throw new Error("EXECUTION_BUDGET_EXCEEDED");
-    const environmentAllowlist = requireStringArray(isolation.environmentAllowlist, "environment_allowlist");
+    const environmentAllowlist = containerIsolation === undefined
+        ? requireStringArray(isolation.environmentAllowlist, "environment_allowlist")
+        : [];
     if (new Set(environmentAllowlist).size !== environmentAllowlist.length) {
         throw new TypeError("DUPLICATE_ENVIRONMENT_ALLOWLIST_ENTRY");
     }
@@ -1875,7 +1921,7 @@ function parseRequest(value) {
             exclude: requireStringArray(repository.exclude, "repository_exclude"),
         },
         adapter: normalizedAdapter,
-        isolation: {
+        isolation: containerIsolation ?? {
             kind: "trusted-local",
             acknowledgedUnsafeExecution: true,
             environmentAllowlist,
@@ -2133,6 +2179,155 @@ async function probeNodeTestExecutable(requestedExecutable, repositoryRoot, envi
         nodeVersion: secondProbe.nodeVersion,
     };
 }
+// Evaluated by `node -p` inside a fresh container before any candidate code runs there.
+const CONTAINER_NODE_PROBE_SOURCE = '(() => { const fs = require("node:fs"); const crypto = require("node:crypto"); const execPath = fs.realpathSync(process.execPath); return JSON.stringify({ digest: "sha256:" + crypto.createHash("sha256").update(fs.readFileSync(execPath)).digest("hex"), execPath, node: process.versions.node }); })()';
+function parseJsonBytes(bytes) {
+    if (bytes === undefined)
+        return undefined;
+    try {
+        return JSON.parse(bytes.toString("utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+async function withEmptyWorkspace(operation) {
+    const workspace = await realpath(await mkdtemp(path.join(os.tmpdir(), "assertledger-container-probe-")));
+    try {
+        return await operation(workspace);
+    }
+    finally {
+        await removeTemporaryDirectory(workspace);
+    }
+}
+async function runContainerNodeProbe(container, executable, workspace, timeoutMs, maximumOutputBytes) {
+    const { process: result } = await runContainerExecution(container, {
+        workspace,
+        executable,
+        args: ["-p", CONTAINER_NODE_PROBE_SOURCE],
+        environment: {},
+        timeoutMs: Math.min(timeoutMs, 30_000),
+        maximumOutputBytes: Math.min(maximumOutputBytes, CONTROLLED_REPORT_MAXIMUM_BYTES),
+    }, runBoundedProcess, os.tmpdir());
+    if (result.outcome !== "PASS" || result.stdout.truncated || result.stderr.totalBytes > 0) {
+        throw new Error("NODE_TEST_EXECUTABLE_PROBE_FAILED");
+    }
+    let report;
+    try {
+        report = JSON.parse(result.stdout.text.trim());
+    }
+    catch {
+        throw new Error("NODE_TEST_EXECUTABLE_PROBE_FAILED");
+    }
+    if (!isRecord(report) ||
+        Object.keys(report).sort().join("\0") !== "digest\0execPath\0node" ||
+        typeof report.execPath !== "string" ||
+        !report.execPath.startsWith("/") ||
+        typeof report.digest !== "string" ||
+        !/^sha256:[a-f0-9]{64}$/u.test(report.digest) ||
+        typeof report.node !== "string") {
+        throw new Error("NODE_TEST_EXECUTABLE_PROBE_FAILED");
+    }
+    if (!nodeVersionIsSupported(report.node))
+        throw new Error("NODE_TEST_VERSION_UNSUPPORTED");
+    return { execPath: report.execPath, nodeVersion: report.node, executableDigest: report.digest };
+}
+async function probeContainerNodeExecutable(container, requestedExecutable, timeoutMs, maximumOutputBytes) {
+    return withEmptyWorkspace(async (workspace) => {
+        const firstProbe = await runContainerNodeProbe(container, requestedExecutable, workspace, timeoutMs, maximumOutputBytes);
+        const secondProbe = await runContainerNodeProbe(container, firstProbe.execPath, workspace, timeoutMs, maximumOutputBytes);
+        if (secondProbe.execPath !== firstProbe.execPath ||
+            secondProbe.nodeVersion !== firstProbe.nodeVersion ||
+            secondProbe.executableDigest !== firstProbe.executableDigest) {
+            throw new Error("NODE_TEST_EXECUTABLE_PROBE_FAILED");
+        }
+        return {
+            requestedExecutable,
+            resolvedExecutable: firstProbe.execPath,
+            executableDigest: firstProbe.executableDigest,
+            nodeVersion: firstProbe.nodeVersion,
+        };
+    });
+}
+function containerPreflightExecutor(container, executable) {
+    return (probe) => withEmptyWorkspace(async (workspace) => {
+        await writeFile(path.join(workspace, "control.test.mjs"), probe.controlSource, {
+            flag: "wx",
+        });
+        await writeFile(path.join(workspace, `${probe.name}.test.mjs`), probe.candidateSource, {
+            flag: "wx",
+        });
+        const candidate = `${CONTAINER_WORKSPACE}/${probe.name}.test.mjs`;
+        const executed = await runContainerExecution(container, {
+            workspace,
+            reporterSource: probe.reporterSource,
+            executable,
+            args: [
+                "--test",
+                `--test-reporter=file://${CONTAINER_REPORTER_FILE}`,
+                `--test-reporter-destination=${CONTAINER_RESULT_FILE}`,
+                "--",
+                `${CONTAINER_WORKSPACE}/control.test.mjs`,
+                candidate,
+            ],
+            environment: { TESTFORGE_NODE_CANDIDATE_FILES: JSON.stringify([candidate]) },
+            timeoutMs: probe.timeoutMs,
+            maximumOutputBytes: probe.maximumOutputBytes,
+            resultMaximumBytes: probe.reportMaximumBytes,
+        }, runBoundedProcess, os.tmpdir());
+        return {
+            processResult: {
+                outcome: executed.process.outcome,
+                exitCode: executed.process.exitCode,
+            },
+            report: parseJsonBytes(executed.result),
+        };
+    });
+}
+async function executeContainerAdapter(request, container, workspace, candidateFiles) {
+    const adapter = request.adapter;
+    const executed = await runContainerExecution(container, {
+        workspace,
+        ...(adapter.kind === "node-test" ? { reporterSource: NODE_TEST_REPORTER_SOURCE } : {}),
+        executable: adapter.executable,
+        args: adapter.kind === "node-test"
+            ? [
+                "--test",
+                `--test-reporter=file://${CONTAINER_REPORTER_FILE}`,
+                `--test-reporter-destination=${CONTAINER_RESULT_FILE}`,
+                ...(adapter.extraArguments ?? []),
+                "--",
+                ...adapter.baseTestFiles,
+                ...candidateFiles,
+            ]
+            : adapter.arguments,
+        environment: adapter.kind === "node-test"
+            ? {
+                TESTFORGE_NODE_CANDIDATE_FILES: JSON.stringify(candidateFiles.map((file) => `${CONTAINER_WORKSPACE}/${file}`)),
+            }
+            : {
+                TESTFORGE_RESULT_FILE: CONTAINER_RESULT_FILE,
+                TESTFORGE_CANDIDATE_FILES: JSON.stringify(candidateFiles),
+            },
+        timeoutMs: request.budgets.timeoutMsPerExecution,
+        maximumOutputBytes: request.budgets.maximumOutputBytes,
+        resultMaximumBytes: CONTROLLED_REPORT_MAXIMUM_BYTES,
+    }, runBoundedProcess, os.tmpdir());
+    const result = executed.process;
+    const document = result.outcome === "TIMEOUT" || result.outcome === "INFRA_ERROR"
+        ? undefined
+        : parseJsonBytes(executed.result);
+    return {
+        result,
+        structuredReport: adapter.kind === "testforge-command"
+            ? parseStructuredCommandReport(document, result)
+            : undefined,
+        nodeTestReport: adapter.kind === "node-test" ? parseNodeTestReport(document) : undefined,
+    };
+}
+function trustedLocalEnvironmentAllowlist(request) {
+    return request.isolation.kind === "trusted-local" ? request.isolation.environmentAllowlist : [];
+}
 function classifyNodeTest(result, report, hasCandidate) {
     if (result.outcome === "TIMEOUT")
         return { outcome: "TIMEOUT", attributed: false };
@@ -2168,7 +2363,48 @@ async function copyRepository(source, destination, excludes) {
         },
     });
 }
-async function executeObservation(request, repositoryRoot, world, candidate, attempt, nodeTestReporterPath) {
+async function executeTrustedLocalAdapter(request, workspace, temporaryRoot, candidateFiles, nodeTestReporterPath) {
+    const resultFile = path.join(temporaryRoot, "structured-command-result.json");
+    const environment = environmentFromAllowlist(trustedLocalEnvironmentAllowlist(request));
+    if (request.adapter.kind === "testforge-command") {
+        environment.TESTFORGE_RESULT_FILE = resultFile;
+        environment.TESTFORGE_CANDIDATE_FILES = JSON.stringify(candidateFiles);
+    }
+    else {
+        if (nodeTestReporterPath === undefined)
+            throw new Error("NODE_TEST_REPORTER_MISSING");
+        environment.TESTFORGE_NODE_CANDIDATE_FILES = JSON.stringify(candidateFiles.map((file) => path.resolve(workspace, ...file.split("/"))));
+    }
+    const args = request.adapter.kind === "node-test"
+        ? [
+            "--test",
+            `--test-reporter=${pathToFileURL(nodeTestReporterPath).href}`,
+            `--test-reporter-destination=${resultFile}`,
+            ...(request.adapter.extraArguments ?? []),
+            "--",
+            ...request.adapter.baseTestFiles,
+            ...candidateFiles,
+        ]
+        : request.adapter.arguments;
+    const result = await runProcess({
+        executable: request.adapter.executable,
+        args,
+        cwd: workspace,
+        environment,
+        timeoutMs: request.budgets.timeoutMsPerExecution,
+        maximumOutputBytes: request.budgets.maximumOutputBytes,
+    });
+    return {
+        result,
+        structuredReport: request.adapter.kind === "testforge-command"
+            ? await readStructuredCommandReport(resultFile, result, CONTROLLED_REPORT_MAXIMUM_BYTES)
+            : undefined,
+        nodeTestReport: request.adapter.kind === "node-test"
+            ? await readNodeTestReport(resultFile, result, CONTROLLED_REPORT_MAXIMUM_BYTES)
+            : undefined,
+    };
+}
+async function executeObservation(request, repositoryRoot, world, candidate, attempt, nodeTestReporterPath, container) {
     const temporaryRoot = await realpath(await mkdtemp(path.join(os.tmpdir(), "testforge-run-")));
     const workspace = path.join(temporaryRoot, "repository");
     try {
@@ -2177,42 +2413,9 @@ async function executeObservation(request, repositoryRoot, world, candidate, att
         if (candidate)
             await applyFiles(workspace, candidate.files);
         const candidateFiles = candidate ? candidate.files.map((file) => file.path) : [];
-        const resultFile = path.join(temporaryRoot, "structured-command-result.json");
-        const environment = environmentFromAllowlist(request.isolation.environmentAllowlist);
-        if (request.adapter.kind === "testforge-command") {
-            environment.TESTFORGE_RESULT_FILE = resultFile;
-            environment.TESTFORGE_CANDIDATE_FILES = JSON.stringify(candidateFiles);
-        }
-        else {
-            if (nodeTestReporterPath === undefined)
-                throw new Error("NODE_TEST_REPORTER_MISSING");
-            environment.TESTFORGE_NODE_CANDIDATE_FILES = JSON.stringify(candidateFiles.map((file) => path.resolve(workspace, ...file.split("/"))));
-        }
-        const args = request.adapter.kind === "node-test"
-            ? [
-                "--test",
-                `--test-reporter=${pathToFileURL(nodeTestReporterPath).href}`,
-                `--test-reporter-destination=${resultFile}`,
-                ...(request.adapter.extraArguments ?? []),
-                "--",
-                ...request.adapter.baseTestFiles,
-                ...candidateFiles,
-            ]
-            : request.adapter.arguments;
-        const result = await runProcess({
-            executable: request.adapter.executable,
-            args,
-            cwd: workspace,
-            environment,
-            timeoutMs: request.budgets.timeoutMsPerExecution,
-            maximumOutputBytes: request.budgets.maximumOutputBytes,
-        });
-        const structuredReport = request.adapter.kind === "testforge-command"
-            ? await readStructuredCommandReport(resultFile, result, CONTROLLED_REPORT_MAXIMUM_BYTES)
-            : undefined;
-        const nodeTestReport = request.adapter.kind === "node-test"
-            ? await readNodeTestReport(resultFile, result, CONTROLLED_REPORT_MAXIMUM_BYTES)
-            : undefined;
+        const { result, structuredReport, nodeTestReport } = container === undefined
+            ? await executeTrustedLocalAdapter(request, workspace, temporaryRoot, candidateFiles, nodeTestReporterPath)
+            : await executeContainerAdapter(request, container, workspace, candidateFiles);
         const nodeClassification = request.adapter.kind === "node-test"
             ? classifyNodeTest(result, nodeTestReport, candidate !== null)
             : undefined;
@@ -2241,8 +2444,11 @@ async function executeObservation(request, repositoryRoot, world, candidate, att
         await removeTemporaryDirectory(temporaryRoot);
     }
 }
-export async function verifyCampaign(value) {
+export async function verifyCampaign(value, options = {}) {
     const request = parseRequest(value);
+    const container = request.isolation.kind === "container"
+        ? await prepareContainerBackend(options.containerRuntime?.command ?? DEFAULT_CONTAINER_RUNTIME_COMMAND, request.isolation, runBoundedProcess, os.tmpdir())
+        : undefined;
     const repositoryRoot = await resolveRepositoryRoot(request.repository.root);
     const excludes = effectiveExcludes(request.repository.exclude);
     const sourceInventory = await walkFiles(repositoryRoot, excludes);
@@ -2252,9 +2458,11 @@ export async function verifyCampaign(value) {
     if (sourceInventory.totalBytes > request.budgets.maximumRepositoryBytes) {
         throw new Error("REPOSITORY_BYTES_BUDGET_EXCEEDED");
     }
-    const nodeIdentity = request.adapter.kind === "node-test"
-        ? await probeNodeTestExecutable(request.adapter.executable, repositoryRoot, request.isolation.environmentAllowlist, request.budgets.timeoutMsPerExecution, request.budgets.maximumOutputBytes)
-        : undefined;
+    const nodeIdentity = request.adapter.kind !== "node-test"
+        ? undefined
+        : container === undefined
+            ? await probeNodeTestExecutable(request.adapter.executable, repositoryRoot, trustedLocalEnvironmentAllowlist(request), request.budgets.timeoutMsPerExecution, request.budgets.maximumOutputBytes)
+            : await probeContainerNodeExecutable(container, request.adapter.executable, request.budgets.timeoutMsPerExecution, request.budgets.maximumOutputBytes);
     if (request.adapter.kind === "node-test" && nodeIdentity !== undefined) {
         request.adapter.executable = nodeIdentity.resolvedExecutable;
     }
@@ -2262,10 +2470,15 @@ export async function verifyCampaign(value) {
         ? await runNodeTestRuntimePreflight({
             executable: nodeIdentity.resolvedExecutable,
             reporterSource: NODE_TEST_REPORTER_SOURCE,
-            environment: environmentFromAllowlist(request.isolation.environmentAllowlist),
+            environment: environmentFromAllowlist(trustedLocalEnvironmentAllowlist(request)),
             timeoutMs: request.budgets.timeoutMsPerExecution,
             maximumOutputBytes: request.budgets.maximumOutputBytes,
             processRunner: runProcess,
+            ...(container === undefined
+                ? {}
+                : {
+                    probeExecutor: containerPreflightExecutor(container, nodeIdentity.resolvedExecutable),
+                }),
         })
         : undefined;
     const campaignRoot = await realpath(await mkdtemp(path.join(os.tmpdir(), "testforge-campaign-")));
@@ -2305,13 +2518,13 @@ export async function verifyCampaign(value) {
         const observations = [];
         for (const world of request.worlds) {
             for (let attempt = 1; attempt <= request.policy.requiredAttempts; attempt += 1) {
-                observations.push(await executeObservation(request, repositorySnapshot, world, null, attempt, nodeTestReporterPath));
+                observations.push(await executeObservation(request, repositorySnapshot, world, null, attempt, nodeTestReporterPath, container));
             }
         }
         for (const candidate of request.candidates) {
             for (const world of request.worlds) {
                 for (let attempt = 1; attempt <= request.policy.requiredAttempts; attempt += 1) {
-                    observations.push(await executeObservation(request, repositorySnapshot, world, candidate, attempt, nodeTestReporterPath));
+                    observations.push(await executeObservation(request, repositorySnapshot, world, candidate, attempt, nodeTestReporterPath, container));
                 }
             }
         }
@@ -2350,10 +2563,19 @@ export async function verifyCampaign(value) {
                         : request.adapter,
                 },
                 execution: {
-                    isolation: "UNSANDBOXED",
-                    environmentAllowlist: request.isolation.environmentAllowlist,
+                    isolation: container === undefined ? "UNSANDBOXED" : "CONTAINER",
+                    environmentAllowlist: container === undefined
+                        ? trustedLocalEnvironmentAllowlist(request)
+                        : container.isolation.environment.map((variable) => variable.name).sort(),
                     budgets: request.budgets,
                     candidateRoots: request.candidateRoots,
+                    ...(request.schemaVersion === "1.0.0"
+                        ? {}
+                        : {
+                            backend: container === undefined
+                                ? { kind: "trusted-local", level: "UNSANDBOXED" }
+                                : container.record,
+                        }),
                 },
                 worlds: request.worlds.map((world) => ({
                     id: world.id,
@@ -2379,15 +2601,19 @@ export async function verifyCampaign(value) {
             adapter: request.adapter.kind === "testforge-command"
                 ? { kind: request.adapter.kind, protocolVersion: request.adapter.protocolVersion }
                 : { kind: request.adapter.kind },
-            isolation: {
-                kind: "trusted-local",
-                level: "UNSANDBOXED",
-                acknowledgedUnsafeExecution: true,
-            },
-            limitations: [
-                "UNSANDBOXED trusted-local execution cannot safely contain hostile candidate code.",
-                "Process-tree termination is best effort and depends on host operating-system facilities.",
-            ],
+            isolation: container === undefined
+                ? {
+                    kind: "trusted-local",
+                    level: "UNSANDBOXED",
+                    acknowledgedUnsafeExecution: true,
+                }
+                : { kind: "container", level: "CONTAINER", runtimeCommand: container.runtimeCommand },
+            limitations: container === undefined
+                ? [
+                    "UNSANDBOXED trusted-local execution cannot safely contain hostile candidate code.",
+                    "Process-tree termination is best effort and depends on host operating-system facilities.",
+                ]
+                : [...CONTAINER_LIMITATIONS],
         };
         return sealManifestArtifact(finalManifest);
     }