chainlesschain 0.162.182 → 0.162.183

package/src/lib/process-execution-broker/platform-sandbox.js

@@ -146,9 +146,24 @@ const LINUX_LDD_PATH = "/usr/bin/ldd";
 const LINUX_BWRAP_BACKEND = "linux-bwrap";
 const LINUX_BWRAP_NODE_PROBE_SENTINEL = "chainless-linux-bwrap-plugin-node-v1";
 const LINUX_BWRAP_MAX_PLUGIN_ENTRIES = 512;
-const LINUX_BWRAP_FIRST_MOUNT_FD = 3;
+const LINUX_PLUGIN_TREE_SNAPSHOT_MAX_FILES = 256;
+const LINUX_PLUGIN_TREE_SNAPSHOT_MAX_BYTES = 256 * 1024 * 1024;
+const LINUX_BWRAP_SUPERVISOR_CHILD_FD = 3;
+const LINUX_BWRAP_FIRST_MOUNT_FD = 4;
+const LINUX_BWRAP_SUPERVISOR_HIDDEN_PATH = "/run/.chainless-bwrap-supervisor";
+const LINUX_BWRAP_SUPERVISOR_BINDING_MECHANISM =
+  "pinned-child-fd3-file-consume-run-overmount-v1";
 const LINUX_ATTESTED_FILE_MAX_BYTES = 256 * 1024 * 1024;
 const LINUX_ATTESTATION_HASH_CHUNK_BYTES = 1024 * 1024;
+const LINUX_ENTRY_SNAPSHOT_MECHANISM =
+  "verified-o_tmpfile-copy-bwrap-ro-bind-data-v1";
+const LINUX_ENTRY_SNAPSHOT_SOURCE_MODE = 0o400;
+const LINUX_NODE_ENTRY_SNAPSHOT_SCOPE = "plugin-entry-source";
+const LINUX_NATIVE_ENTRY_SNAPSHOT_SCOPE = "plugin-entry-executable";
+const LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE = "all-pinned-plugin-regular-files";
+const LINUX_NODE_PLUGIN_TREE_SNAPSHOT_CONSISTENCY = "per-file-pin-to-launch";
+const LINUX_NODE_ENTRY_SNAPSHOT_TARGET_MODE = "0400";
+const LINUX_NATIVE_ENTRY_SNAPSHOT_TARGET_MODE = "0500";
 const LINUX_ELF64_HEADER_BYTES = 64;
 const LINUX_ELF64_PROGRAM_HEADER_BYTES = 56;
 const LINUX_ELF64_DYNAMIC_ENTRY_BYTES = 16;
@@ -2582,8 +2597,40 @@ function linuxBubblewrapProbe(
   runnable,
   reason,
   targetRuntime = "node",
+  contentSnapshot = null,
+  supervisorBinding = null,
+  pluginTreeSnapshot = null,
 ) {
   const native = targetRuntime === "native-static-elf";
+  const expectedSnapshotScope = native
+    ? LINUX_NATIVE_ENTRY_SNAPSHOT_SCOPE
+    : LINUX_NODE_ENTRY_SNAPSHOT_SCOPE;
+  const snapshot =
+    contentSnapshot?.scope === expectedSnapshotScope &&
+    contentSnapshot?.mechanism === LINUX_ENTRY_SNAPSHOT_MECHANISM;
+  const supervisorDescriptorBound =
+    supervisorBinding?.mechanism === LINUX_BWRAP_SUPERVISOR_BINDING_MECHANISM;
+  const pluginTreeContentSnapshot =
+    !native &&
+    attempted &&
+    snapshot &&
+    runnable &&
+    reason === null &&
+    supervisorDescriptorBound &&
+    pluginTreeSnapshot?.scope === LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE &&
+    pluginTreeSnapshot?.mechanism === LINUX_ENTRY_SNAPSHOT_MECHANISM &&
+    Number.isSafeInteger(pluginTreeSnapshot?.files) &&
+    pluginTreeSnapshot.files > 0 &&
+    pluginTreeSnapshot.files <= LINUX_PLUGIN_TREE_SNAPSHOT_MAX_FILES &&
+    Number.isSafeInteger(pluginTreeSnapshot?.bytes) &&
+    pluginTreeSnapshot.bytes >= 0 &&
+    pluginTreeSnapshot.bytes <= LINUX_PLUGIN_TREE_SNAPSHOT_MAX_BYTES &&
+    typeof pluginTreeSnapshot?.digest === "string" &&
+    /^[a-f0-9]{64}$/.test(pluginTreeSnapshot.digest) &&
+    pluginTreeSnapshot?.consistency ===
+      LINUX_NODE_PLUGIN_TREE_SNAPSHOT_CONSISTENCY &&
+    pluginTreeSnapshot?.contractBound === false &&
+    pluginTreeSnapshot?.atomic === false;
   return {
     kind: native
       ? "linux-bwrap-plugin-native-static-elf-policy-v1"
@@ -2593,7 +2640,50 @@ function linuxBubblewrapProbe(
     reason,
     probeRuntime: "node",
     targetRuntime,
-    contentSnapshot: false,
+    contentSnapshot: snapshot,
+    ...(snapshot
+      ? {
+          contentSnapshotScope: contentSnapshot.scope,
+          contentSnapshotMechanism: contentSnapshot.mechanism,
+        }
+      : {}),
+    ...(pluginTreeContentSnapshot
+      ? {
+          pluginTreeContentSnapshot: true,
+          pluginTreeContentSnapshotScope: pluginTreeSnapshot.scope,
+          pluginTreeContentSnapshotMechanism: pluginTreeSnapshot.mechanism,
+          pluginTreeContentSnapshotFiles: pluginTreeSnapshot.files,
+          pluginTreeContentSnapshotBytes: pluginTreeSnapshot.bytes,
+          pluginTreeContentSnapshotDigest: pluginTreeSnapshot.digest,
+          pluginTreeSnapshotConsistency: pluginTreeSnapshot.consistency,
+          pluginTreeSnapshotContractBound: pluginTreeSnapshot.contractBound,
+          pluginTreeSnapshotAtomic: pluginTreeSnapshot.atomic,
+        }
+      : {}),
+    supervisorDescriptorBound,
+    ...(supervisorDescriptorBound
+      ? {
+          supervisorExecutablePinned: true,
+          supervisorBindingScope: supervisorBinding.scope,
+          supervisorDescriptorBindingMechanism: supervisorBinding.mechanism,
+          supervisorDescriptorContained: runnable,
+          supervisorDescriptorConsumedBeforeTarget: runnable,
+          supervisorStagingPathHidden: runnable,
+          supervisorTemporaryCopyObscured: runnable,
+          supervisorPid1ExecutableExposure:
+            supervisorBinding.pid1ExecutableExposure,
+          supervisorExecutableIdentity: {
+            path: supervisorBinding.path,
+            fileId: supervisorBinding.fileId,
+            sha256: supervisorBinding.sha256,
+            bytes: supervisorBinding.bytes,
+            mtimeMs: supervisorBinding.mtimeMs,
+            mode: supervisorBinding.mode,
+            uid: supervisorBinding.uid,
+            gid: supervisorBinding.gid,
+          },
+        }
+      : {}),
     handleAtomic: false,
   };
 }
@@ -2836,7 +2926,7 @@ function assignLinuxMountChildFds(mounts) {
 function linuxStdioWithPinnedMounts(
   stdio,
   descriptors,
-  { probe = false } = {},
+  { probe = false, supervisorFd = null } = {},
 ) {
   let standard;
   if (probe) {
@@ -2849,8 +2939,10 @@ function linuxStdioWithPinnedMounts(
     standard = ["pipe", "pipe", "pipe"];
   }
   while (standard.length < 3) standard.push(undefined);
+  const supervisor = Number.isInteger(supervisorFd) ? [supervisorFd] : [];
   return [
     ...standard.slice(0, 3),
+    ...supervisor,
     ...descriptors.map((descriptor) => descriptor.fd),
   ];
 }
@@ -2862,10 +2954,13 @@ function validateLinuxPluginContract(
   contract,
   runtime,
   sync,
+  { sealedEntry = false } = {},
 ) {
   const nodeContract = contract?.kind === "strict-plugin-node-bin";
   const nativeContract =
     contract?.kind === "strict-plugin-native-static-elf-bin";
+  const entryIsSealed =
+    (nodeContract || nativeContract) && sealedEntry === true;
   if (
     !contract ||
     contract.contractVersion !== 1 ||
@@ -2973,9 +3068,10 @@ function validateLinuxPluginContract(
   }
   if (
     !linuxDirectoryIdentityMatches(runtime, contract.rootIdentity) ||
-    !linuxIdentityMatches(runtime, contract.entryIdentity, {
-      executable: nativeContract,
-    }) ||
+    (!entryIsSealed &&
+      !linuxIdentityMatches(runtime, contract.entryIdentity, {
+        executable: nativeContract,
+      })) ||
     !linuxIdentityMatches(runtime, contract.runtimeIdentity, {
       executable: true,
     })
@@ -2983,7 +3079,7 @@ function validateLinuxPluginContract(
     return { ok: false, reason: "execution_identity_changed" };
   }
   let entryFormat = null;
-  if (nativeContract) {
+  if (nativeContract && !entryIsSealed) {
     try {
       entryFormat = inspectLinuxStaticNativePath(
         runtime,
@@ -3073,6 +3169,500 @@ function hashLinuxOpenFile(runtime, fd, bytes) {
   return digest.digest("hex");
 }
 
+function linuxEntrySnapshotContract(targetRuntime) {
+  if (targetRuntime === "native-static-elf") {
+    return {
+      scope: LINUX_NATIVE_ENTRY_SNAPSHOT_SCOPE,
+      targetMode: LINUX_NATIVE_ENTRY_SNAPSHOT_TARGET_MODE,
+      minimumBytes: LINUX_ELF64_HEADER_BYTES,
+      errorPrefix: "native_entry_snapshot",
+    };
+  }
+  if (targetRuntime === "node") {
+    return {
+      scope: LINUX_NODE_ENTRY_SNAPSHOT_SCOPE,
+      targetMode: LINUX_NODE_ENTRY_SNAPSHOT_TARGET_MODE,
+      minimumBytes: 0,
+      errorPrefix: "node_entry_snapshot",
+    };
+  }
+  throw new Error("entry_snapshot_runtime_unsupported");
+}
+
+function linuxNodePluginTreeFileSnapshotContract(sourceMode) {
+  if (!Number.isSafeInteger(sourceMode) || sourceMode < 0) {
+    throw new Error("node_plugin_tree_snapshot_source_mode_invalid");
+  }
+  return {
+    scope: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE,
+    targetMode: (sourceMode & 0o111) !== 0 ? "0500" : "0400",
+    minimumBytes: 0,
+    errorPrefix: "node_plugin_tree_snapshot",
+  };
+}
+
+function createLinuxRegularFileSnapshot(
+  runtime,
+  entryMount,
+  entryIdentity,
+  snapshotContract,
+) {
+  let writerFd;
+  let probeFd;
+  let finalFd;
+  try {
+    if (
+      !snapshotContract ||
+      typeof snapshotContract.scope !== "string" ||
+      typeof snapshotContract.targetMode !== "string" ||
+      !Number.isSafeInteger(snapshotContract.minimumBytes) ||
+      typeof snapshotContract.errorPrefix !== "string"
+    ) {
+      throw new Error("file_snapshot_contract_invalid");
+    }
+    const snapshotError = (reason) =>
+      new Error(`${snapshotContract.errorPrefix}_${reason}`);
+    const expectedSha256 = entryIdentity?.sha256 ?? null;
+    for (const method of [
+      "openSync",
+      "readSync",
+      "writeSync",
+      "fchmodSync",
+      "fsyncSync",
+      "fstatSync",
+      "closeSync",
+    ]) {
+      if (typeof runtime.fs[method] !== "function") {
+        throw snapshotError(`${method}_unavailable`);
+      }
+    }
+    if (
+      !Number.isInteger(entryMount?.fd) ||
+      !entryIdentity ||
+      (expectedSha256 !== null &&
+        (typeof expectedSha256 !== "string" ||
+          !/^[a-f0-9]{64}$/.test(expectedSha256))) ||
+      !Number.isSafeInteger(entryIdentity.bytes) ||
+      entryIdentity.bytes < snapshotContract.minimumBytes ||
+      entryIdentity.bytes > LINUX_ATTESTED_FILE_MAX_BYTES
+    ) {
+      throw snapshotError("identity_invalid");
+    }
+
+    const sourceBefore = runtime.fs.fstatSync(entryMount.fd);
+    const sourceFileMode = Number(sourceBefore.mode) & 0o7777;
+    if (
+      !sourceBefore.isFile() ||
+      Number(sourceBefore.nlink) !== 1 ||
+      String(sourceBefore.dev) !== String(entryIdentity.fileId?.dev) ||
+      String(sourceBefore.ino) !== String(entryIdentity.fileId?.ino) ||
+      Number(sourceBefore.size) !== entryIdentity.bytes ||
+      Number(sourceBefore.mtimeMs) !== Number(entryIdentity.mtimeMs)
+    ) {
+      throw snapshotError("source_changed");
+    }
+    if (
+      snapshotContract.scope === LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE &&
+      snapshotContract.targetMode !==
+        linuxNodePluginTreeFileSnapshotContract(sourceFileMode).targetMode
+    ) {
+      throw snapshotError("source_mode_changed");
+    }
+    if (
+      snapshotContract.scope === LINUX_NATIVE_ENTRY_SNAPSHOT_SCOPE &&
+      (sourceFileMode & 0o111) === 0
+    ) {
+      throw snapshotError("source_mode_changed");
+    }
+
+    const constants = runtime.fs.constants || fs.constants;
+    const writerFlags =
+      Number(constants.O_RDWR) |
+      Number(constants.O_EXCL) |
+      Number(constants.O_TMPFILE ?? LINUX_O_TMPFILE) |
+      Number(constants.O_NOFOLLOW || 0) |
+      Number(constants.O_NONBLOCK || 0);
+    writerFd = runtime.fs.openSync(
+      "/tmp",
+      writerFlags,
+      LINUX_ENTRY_SNAPSHOT_SOURCE_MODE,
+    );
+
+    const sourceDigest = crypto.createHash("sha256");
+    const chunk = Buffer.allocUnsafe(
+      Math.max(
+        1,
+        Math.min(LINUX_ATTESTATION_HASH_CHUNK_BYTES, entryIdentity.bytes),
+      ),
+    );
+    let copied = 0;
+    while (copied < entryIdentity.bytes) {
+      const read = runtime.fs.readSync(
+        entryMount.fd,
+        chunk,
+        0,
+        Math.min(chunk.length, entryIdentity.bytes - copied),
+        copied,
+      );
+      if (read <= 0) {
+        throw snapshotError("source_ended_early");
+      }
+      sourceDigest.update(chunk.subarray(0, read));
+      let written = 0;
+      while (written < read) {
+        const count = runtime.fs.writeSync(
+          writerFd,
+          chunk,
+          written,
+          read - written,
+          copied + written,
+        );
+        if (count <= 0) {
+          throw snapshotError("write_failed");
+        }
+        written += count;
+      }
+      copied += read;
+    }
+    const sourceAfter = runtime.fs.fstatSync(entryMount.fd);
+    const sourceSha256 = sourceDigest.digest("hex");
+    if (
+      !linuxOpenStatMatches(sourceBefore, sourceAfter) ||
+      (expectedSha256 !== null && sourceSha256 !== expectedSha256)
+    ) {
+      throw snapshotError("source_changed");
+    }
+
+    runtime.fs.fsyncSync(writerFd);
+    const snapshotBeforeRead = runtime.fs.fstatSync(writerFd);
+    if (
+      !snapshotBeforeRead.isFile() ||
+      Number(snapshotBeforeRead.nlink) !== 0 ||
+      Number(snapshotBeforeRead.size) !== entryIdentity.bytes
+    ) {
+      throw snapshotError("identity_changed");
+    }
+    const snapshotSha256 = hashLinuxOpenFile(
+      runtime,
+      writerFd,
+      entryIdentity.bytes,
+    );
+    const snapshotAfterRead = runtime.fs.fstatSync(writerFd);
+    if (
+      !linuxOpenStatMatches(snapshotBeforeRead, snapshotAfterRead) ||
+      snapshotSha256 !== sourceSha256
+    ) {
+      throw snapshotError("identity_changed");
+    }
+
+    runtime.fs.fchmodSync(writerFd, LINUX_ENTRY_SNAPSHOT_SOURCE_MODE);
+    runtime.fs.fsyncSync(writerFd);
+    const sealedBeforeRead = runtime.fs.fstatSync(writerFd);
+    if (
+      !sealedBeforeRead.isFile() ||
+      Number(sealedBeforeRead.nlink) !== 0 ||
+      Number(sealedBeforeRead.size) !== entryIdentity.bytes ||
+      (Number(sealedBeforeRead.mode) & 0o777) !==
+        LINUX_ENTRY_SNAPSHOT_SOURCE_MODE
+    ) {
+      throw snapshotError("readonly_mode_unattested");
+    }
+    const sealedSha256 = hashLinuxOpenFile(
+      runtime,
+      writerFd,
+      entryIdentity.bytes,
+    );
+    const sealed = runtime.fs.fstatSync(writerFd);
+    if (
+      !linuxOpenStatMatches(sealedBeforeRead, sealed) ||
+      sealedSha256 !== sourceSha256
+    ) {
+      throw snapshotError("identity_changed");
+    }
+
+    const readerFlags =
+      Number(constants.O_RDONLY) | Number(constants.O_NONBLOCK || 0);
+    probeFd = runtime.fs.openSync(`/proc/self/fd/${writerFd}`, readerFlags);
+    finalFd = runtime.fs.openSync(`/proc/self/fd/${writerFd}`, readerFlags);
+    if (probeFd === finalFd) {
+      throw snapshotError("readers_not_independent");
+    }
+    for (const fd of [probeFd, finalFd]) {
+      const reader = runtime.fs.fstatSync(fd);
+      if (!linuxOpenStatMatches(sealed, reader)) {
+        throw snapshotError("reader_identity_changed");
+      }
+    }
+    const ownedWriterFd = writerFd;
+    writerFd = undefined;
+    runtime.fs.closeSync(ownedWriterFd);
+
+    const verifyClosedWriterSnapshot = runtime.fs.fstatSync(finalFd);
+    if (!linuxOpenStatMatches(sealed, verifyClosedWriterSnapshot)) {
+      throw snapshotError("reader_identity_changed");
+    }
+
+    const attestation = Object.freeze({
+      scope: snapshotContract.scope,
+      mechanism: LINUX_ENTRY_SNAPSHOT_MECHANISM,
+      sha256: sourceSha256,
+      bytes: entryIdentity.bytes,
+      sourceFileId: Object.freeze({
+        dev: String(entryIdentity.fileId.dev),
+        ino: String(entryIdentity.fileId.ino),
+      }),
+      sourceMtimeMs: Number(entryIdentity.mtimeMs),
+      sourceFileMode: sourceFileMode.toString(8).padStart(4, "0"),
+      sourceMode: LINUX_ENTRY_SNAPSHOT_SOURCE_MODE.toString(8).padStart(4, "0"),
+      targetMode: snapshotContract.targetMode,
+    });
+    const descriptor = (fd) => {
+      const stat = runtime.fs.fstatSync(fd);
+      return {
+        ...entryMount,
+        fd,
+        fileId: {
+          dev: String(stat.dev),
+          ino: String(stat.ino),
+        },
+        bytes: Number(stat.size),
+        mtimeMs: Number(stat.mtimeMs),
+        mountMode: "ro-bind-data",
+        mountPermissions: snapshotContract.targetMode,
+        contentSnapshot: attestation,
+        snapshotIdentity: Object.freeze({
+          sha256: sourceSha256,
+          bytes: entryIdentity.bytes,
+          fileId: Object.freeze({
+            dev: String(stat.dev),
+            ino: String(stat.ino),
+          }),
+          mtimeMs: Number(stat.mtimeMs),
+        }),
+      };
+    };
+    const result = {
+      attestation,
+      probeMount: descriptor(probeFd),
+      finalMount: descriptor(finalFd),
+    };
+    probeFd = undefined;
+    finalFd = undefined;
+    return result;
+  } catch (error) {
+    closeLinuxPinnedMounts(
+      runtime,
+      [probeFd, finalFd, writerFd]
+        .filter(Number.isInteger)
+        .map((fd) => ({ fd })),
+    );
+    throw error;
+  }
+}
+
+function createLinuxEntrySnapshot(
+  runtime,
+  entryMount,
+  entryIdentity,
+  targetRuntime,
+) {
+  return createLinuxRegularFileSnapshot(
+    runtime,
+    entryMount,
+    entryIdentity,
+    linuxEntrySnapshotContract(targetRuntime),
+  );
+}
+
+function attestLinuxRegularFileSnapshot(
+  runtime,
+  mount,
+  attestation,
+  snapshotContract,
+) {
+  const errorPrefix = snapshotContract.errorPrefix;
+  const before = runtime.fs.fstatSync(mount?.fd);
+  if (
+    attestation?.scope !== snapshotContract.scope ||
+    attestation?.mechanism !== LINUX_ENTRY_SNAPSHOT_MECHANISM ||
+    attestation?.sourceMode !==
+      LINUX_ENTRY_SNAPSHOT_SOURCE_MODE.toString(8).padStart(4, "0") ||
+    typeof attestation?.sourceFileMode !== "string" ||
+    !/^[0-7]{4}$/.test(attestation.sourceFileMode) ||
+    attestation?.targetMode !== snapshotContract.targetMode ||
+    mount?.mountMode !== "ro-bind-data" ||
+    mount?.mountPermissions !== snapshotContract.targetMode ||
+    mount?.contentSnapshot !== attestation ||
+    !before.isFile() ||
+    Number(before.nlink) !== 0 ||
+    (Number(before.mode) & 0o777) !== LINUX_ENTRY_SNAPSHOT_SOURCE_MODE ||
+    String(before.dev) !== String(mount?.snapshotIdentity?.fileId?.dev) ||
+    String(before.ino) !== String(mount?.snapshotIdentity?.fileId?.ino) ||
+    Number(before.size) !== Number(attestation?.bytes) ||
+    Number(before.size) !== Number(mount?.snapshotIdentity?.bytes) ||
+    Number(before.mtimeMs) !== Number(mount?.snapshotIdentity?.mtimeMs)
+  ) {
+    throw new Error(`${errorPrefix}_identity_changed`);
+  }
+  const sha256 = hashLinuxOpenFile(runtime, mount.fd, Number(before.size));
+  const after = runtime.fs.fstatSync(mount.fd);
+  if (
+    !linuxOpenStatMatches(before, after) ||
+    sha256 !== attestation?.sha256 ||
+    sha256 !== mount.snapshotIdentity.sha256
+  ) {
+    throw new Error(`${errorPrefix}_identity_changed`);
+  }
+}
+
+function attestLinuxEntrySnapshot(runtime, mount, attestation, targetRuntime) {
+  attestLinuxRegularFileSnapshot(
+    runtime,
+    mount,
+    attestation,
+    linuxEntrySnapshotContract(targetRuntime),
+  );
+}
+
+function buildLinuxNodePluginTreeSnapshotAttestation(mounts, entryDestination) {
+  const members = [];
+  const destinations = new Set();
+  for (const mount of mounts || []) {
+    if (!linuxPathWithin("/opt/chainless/plugin", mount?.destination)) continue;
+    if (
+      path.posix.normalize(mount.destination) !== mount.destination ||
+      destinations.has(mount.destination)
+    ) {
+      throw new Error("node_plugin_tree_snapshot_destination_invalid");
+    }
+    destinations.add(mount.destination);
+    const snapshot = mount.contentSnapshot;
+    const entry = mount.destination === entryDestination;
+    const expectedScope = entry
+      ? LINUX_NODE_ENTRY_SNAPSHOT_SCOPE
+      : LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE;
+    const sourceMode = Number.parseInt(snapshot?.sourceFileMode, 8);
+    const expectedTargetMode = entry
+      ? LINUX_NODE_ENTRY_SNAPSHOT_TARGET_MODE
+      : linuxNodePluginTreeFileSnapshotContract(sourceMode).targetMode;
+    if (
+      snapshot?.scope !== expectedScope ||
+      snapshot?.mechanism !== LINUX_ENTRY_SNAPSHOT_MECHANISM ||
+      typeof snapshot?.sha256 !== "string" ||
+      !/^[a-f0-9]{64}$/.test(snapshot.sha256) ||
+      typeof snapshot?.sourceFileId !== "object" ||
+      typeof snapshot.sourceFileId?.dev !== "string" ||
+      !/^\d+$/.test(snapshot.sourceFileId.dev) ||
+      typeof snapshot.sourceFileId?.ino !== "string" ||
+      !/^\d+$/.test(snapshot.sourceFileId.ino) ||
+      !Number.isFinite(snapshot?.sourceMtimeMs) ||
+      !Number.isSafeInteger(snapshot?.bytes) ||
+      snapshot.bytes < 0 ||
+      snapshot.bytes > LINUX_ATTESTED_FILE_MAX_BYTES ||
+      typeof snapshot?.sourceFileMode !== "string" ||
+      !/^[0-7]{4}$/.test(snapshot.sourceFileMode) ||
+      snapshot.sourceMode !==
+        LINUX_ENTRY_SNAPSHOT_SOURCE_MODE.toString(8).padStart(4, "0") ||
+      snapshot.targetMode !== expectedTargetMode ||
+      mount.mountMode !== "ro-bind-data" ||
+      mount.mountPermissions !== expectedTargetMode
+    ) {
+      throw new Error("node_plugin_tree_snapshot_member_invalid");
+    }
+    members.push({
+      destination: mount.destination,
+      sourceFileId: snapshot.sourceFileId,
+      sourceMtimeMs: snapshot.sourceMtimeMs,
+      sourceFileMode: snapshot.sourceFileMode,
+      sha256: snapshot.sha256,
+      bytes: snapshot.bytes,
+      sourceMode: snapshot.sourceMode,
+      targetMode: snapshot.targetMode,
+      scope: snapshot.scope,
+      mechanism: snapshot.mechanism,
+    });
+  }
+  members.sort((left, right) =>
+    left.destination < right.destination
+      ? -1
+      : left.destination > right.destination
+        ? 1
+        : 0,
+  );
+  if (
+    members.length < 1 ||
+    members.length > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_FILES ||
+    !members.some((member) => member.destination === entryDestination)
+  ) {
+    throw new Error("node_plugin_tree_snapshot_file_count_invalid");
+  }
+  const bytes = members.reduce((total, member) => total + member.bytes, 0);
+  if (
+    !Number.isSafeInteger(bytes) ||
+    bytes > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_BYTES
+  ) {
+    throw new Error("node_plugin_tree_snapshot_bytes_exceeded");
+  }
+  const digest = crypto
+    .createHash("sha256")
+    .update(
+      JSON.stringify({
+        version: 1,
+        scope: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE,
+        consistency: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_CONSISTENCY,
+        members,
+      }),
+    )
+    .digest("hex");
+  return Object.freeze({
+    scope: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE,
+    mechanism: LINUX_ENTRY_SNAPSHOT_MECHANISM,
+    files: members.length,
+    bytes,
+    digest,
+    consistency: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_CONSISTENCY,
+    contractBound: false,
+    atomic: false,
+  });
+}
+
+function attestLinuxNodePluginTreeSnapshot(
+  runtime,
+  mounts,
+  entryDestination,
+  expected,
+) {
+  for (const mount of mounts || []) {
+    if (!linuxPathWithin("/opt/chainless/plugin", mount?.destination)) continue;
+    const snapshot = mount.contentSnapshot;
+    const contract =
+      mount.destination === entryDestination
+        ? linuxEntrySnapshotContract("node")
+        : linuxNodePluginTreeFileSnapshotContract(
+            Number.parseInt(snapshot?.sourceFileMode, 8),
+          );
+    attestLinuxRegularFileSnapshot(runtime, mount, snapshot, contract);
+  }
+  const actual = buildLinuxNodePluginTreeSnapshotAttestation(
+    mounts,
+    entryDestination,
+  );
+  for (const field of [
+    "scope",
+    "mechanism",
+    "files",
+    "bytes",
+    "digest",
+    "consistency",
+    "contractBound",
+    "atomic",
+  ]) {
+    if (actual[field] !== expected?.[field]) {
+      throw new Error("node_plugin_tree_snapshot_identity_changed");
+    }
+  }
+}
+
 /**
  * Classify one already-pinned plugin entry without invoking it or any host
  * inspection utility. The native slice accepts conventional fully static
@@ -3355,8 +3945,12 @@ function linuxFdMountId(runtime, fd) {
 function closeLinuxPinnedMounts(runtime, mounts) {
   for (const mount of mounts || []) {
     if (!Number.isInteger(mount?.fd)) continue;
+    const fd = mount.fd;
+    // Clear ownership before close so repeated cleanup cannot close an
+    // unrelated descriptor if the OS has already reused this number.
+    mount.fd = null;
     try {
-      runtime.fs.closeSync(mount.fd);
+      runtime.fs.closeSync(fd);
     } catch {
       // Best effort. The process is already fail-closed if a pin cannot be
       // created; cleanup must not replace the original boundary error.
@@ -3706,13 +4300,209 @@ function attestLinuxBubblewrapBinary(runtime) {
   );
 }
 
-function attestLinuxBubblewrapCapabilities(runtime) {
+function linuxBubblewrapSupervisorStatValid(
+  stat,
+  { allowUnlinked = false } = {},
+) {
+  const linkCount = Number(stat?.nlink);
+  return (
+    stat?.isFile?.() === true &&
+    Number(stat.uid) === 0 &&
+    (linkCount === 1 || (allowUnlinked && linkCount === 0)) &&
+    Number(stat.size) > 0 &&
+    Number(stat.size) <= LINUX_ATTESTED_FILE_MAX_BYTES &&
+    (Number(stat.mode) & 0o111) !== 0 &&
+    (Number(stat.mode) & 0o022) === 0
+  );
+}
+
+function linuxBubblewrapPinnedStatMatches(expected, current) {
+  return (
+    linuxBubblewrapSupervisorStatValid(current, { allowUnlinked: true }) &&
+    String(expected.dev) === String(current.dev) &&
+    String(expected.ino) === String(current.ino) &&
+    Number(expected.size) === Number(current.size) &&
+    Number(expected.mtimeMs) === Number(current.mtimeMs) &&
+    Number(expected.mode) === Number(current.mode) &&
+    Number(expected.uid) === Number(current.uid) &&
+    Number(expected.gid) === Number(current.gid)
+  );
+}
+
+function pinLinuxBubblewrapSupervisor(runtime) {
+  let fd;
+  try {
+    for (const method of [
+      "openSync",
+      "readSync",
+      "fstatSync",
+      "statSync",
+      "lstatSync",
+      "closeSync",
+    ]) {
+      if (typeof runtime.fs?.[method] !== "function") {
+        throw new Error(`supervisor_${method}_unavailable`);
+      }
+    }
+    if (linuxRealpath(runtime, LINUX_BWRAP_PATH) !== LINUX_BWRAP_PATH) {
+      throw new Error("supervisor_realpath_changed");
+    }
+    const pathBefore = runtime.fs.lstatSync(LINUX_BWRAP_PATH, {
+      bigint: true,
+    });
+    if (
+      pathBefore.isSymbolicLink?.() === true ||
+      !linuxBubblewrapSupervisorStatValid(pathBefore)
+    ) {
+      throw new Error("supervisor_path_unattested");
+    }
+    const constants = runtime.fs.constants || fs.constants;
+    const flags =
+      Number(constants.O_RDONLY) |
+      Number(constants.O_NOFOLLOW || 0) |
+      Number(constants.O_NONBLOCK || 0);
+    fd = runtime.fs.openSync(LINUX_BWRAP_PATH, flags);
+    const openedBefore = runtime.fs.fstatSync(fd, { bigint: true });
+    const currentPath = runtime.fs.statSync(LINUX_BWRAP_PATH, {
+      bigint: true,
+    });
+    if (
+      !linuxBubblewrapSupervisorStatValid(openedBefore) ||
+      !linuxOpenStatMatches(pathBefore, openedBefore) ||
+      !linuxOpenStatMatches(openedBefore, currentPath)
+    ) {
+      throw new Error("supervisor_identity_changed");
+    }
+    const sha256 = hashLinuxOpenFile(runtime, fd, Number(openedBefore.size));
+    const openedAfter = runtime.fs.fstatSync(fd, { bigint: true });
+    const pathAfter = runtime.fs.statSync(LINUX_BWRAP_PATH, {
+      bigint: true,
+    });
+    if (
+      !linuxOpenStatMatches(openedBefore, openedAfter) ||
+      !linuxOpenStatMatches(openedAfter, pathAfter)
+    ) {
+      throw new Error("supervisor_identity_changed");
+    }
+    const attestation = Object.freeze({
+      path: LINUX_BWRAP_PATH,
+      fileId: Object.freeze({
+        dev: String(openedAfter.dev),
+        ino: String(openedAfter.ino),
+      }),
+      sha256,
+      bytes: Number(openedAfter.size),
+      mtimeMs: Number(openedAfter.mtimeMs),
+      mode: Number(openedAfter.mode),
+      uid: Number(openedAfter.uid),
+      gid: Number(openedAfter.gid),
+      mechanism: LINUX_BWRAP_SUPERVISOR_BINDING_MECHANISM,
+      scope: "host-path-replacement",
+      childFd: LINUX_BWRAP_SUPERVISOR_CHILD_FD,
+      consumeOperation: "file-copy-close",
+      consumePath: LINUX_BWRAP_SUPERVISOR_HIDDEN_PATH,
+      consumeMode: "0000",
+      obscuredBy: "tmpfs:/run",
+      pid1ExecutableExposure: "procfs",
+    });
+    return {
+      fd,
+      openedStat: openedAfter,
+      attestation,
+    };
+  } catch (error) {
+    if (fd !== undefined) {
+      try {
+        runtime.fs.closeSync(fd);
+      } catch {
+        // Preserve the original attestation error.
+      }
+    }
+    throw error;
+  }
+}
+
+function openLinuxBubblewrapSupervisorLaunch(runtime, supervisorPin) {
+  let fd;
+  try {
+    if (
+      !Number.isInteger(supervisorPin?.fd) ||
+      !supervisorPin.openedStat ||
+      !supervisorPin.attestation
+    ) {
+      throw new Error("supervisor_pin_missing");
+    }
+    const constants = runtime.fs.constants || fs.constants;
+    const flags =
+      Number(constants.O_RDONLY) | Number(constants.O_NONBLOCK || 0);
+    fd = runtime.fs.openSync(`/proc/self/fd/${supervisorPin.fd}`, flags);
+    const openedBefore = runtime.fs.fstatSync(fd, { bigint: true });
+    if (
+      !linuxBubblewrapPinnedStatMatches(supervisorPin.openedStat, openedBefore)
+    ) {
+      throw new Error("supervisor_launch_reader_identity_changed");
+    }
+    const sha256 = hashLinuxOpenFile(
+      runtime,
+      fd,
+      supervisorPin.attestation.bytes,
+    );
+    const openedAfter = runtime.fs.fstatSync(fd, { bigint: true });
+    if (
+      !linuxOpenStatMatches(openedBefore, openedAfter) ||
+      sha256 !== supervisorPin.attestation.sha256
+    ) {
+      throw new Error("supervisor_launch_reader_identity_changed");
+    }
+    return {
+      fd,
+      command: `/proc/self/fd/${LINUX_BWRAP_SUPERVISOR_CHILD_FD}`,
+    };
+  } catch (error) {
+    if (fd !== undefined) {
+      try {
+        runtime.fs.closeSync(fd);
+      } catch {
+        // Preserve the original launch-reader error.
+      }
+    }
+    throw error;
+  }
+}
+
+function attestLinuxBubblewrapSupervisorPin(runtime, supervisorPin) {
+  if (
+    !Number.isInteger(supervisorPin?.fd) ||
+    !supervisorPin.openedStat ||
+    !supervisorPin.attestation
+  ) {
+    throw new Error("supervisor_pin_missing");
+  }
+  const before = runtime.fs.fstatSync(supervisorPin.fd, { bigint: true });
+  if (!linuxBubblewrapPinnedStatMatches(supervisorPin.openedStat, before)) {
+    throw new Error("supervisor_identity_changed");
+  }
+  const sha256 = hashLinuxOpenFile(
+    runtime,
+    supervisorPin.fd,
+    supervisorPin.attestation.bytes,
+  );
+  const after = runtime.fs.fstatSync(supervisorPin.fd, { bigint: true });
+  if (
+    !linuxOpenStatMatches(before, after) ||
+    sha256 !== supervisorPin.attestation.sha256
+  ) {
+    throw new Error("supervisor_identity_changed");
+  }
+}
+
+function attestLinuxBubblewrapCapabilities(runtime, supervisorLaunch) {
   let result;
   try {
-    result = runtime.spawnSync(LINUX_BWRAP_PATH, ["--help"], {
+    result = runtime.spawnSync(supervisorLaunch.command, ["--help"], {
       shell: false,
       encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"],
+      stdio: ["ignore", "pipe", "pipe", supervisorLaunch.fd],
       timeout: 10_000,
       env: {
         PATH: "/usr/bin:/bin",
@@ -3727,13 +4517,18 @@ function attestLinuxBubblewrapCapabilities(runtime) {
     return { ok: false, reason: "capability_probe_failed" };
   }
   const help = `${String(result.stdout || "")}\n${String(result.stderr || "")}`;
-  for (const option of [
+  const supportedOptions = new Set(help.split(/\s+/).filter(Boolean));
+  const requiredOptions = [
+    "--file",
+    "--perms",
     "--ro-bind-fd",
+    "--ro-bind-data",
     "--disable-userns",
     "--assert-userns-disabled",
     "--seccomp",
-  ]) {
-    if (!help.includes(option)) {
+  ];
+  for (const option of requiredOptions) {
+    if (!supportedOptions.has(option)) {
       return {
         ok: false,
         reason: `required_option_missing:${option.slice(2)}`,
@@ -3928,8 +4723,30 @@ function buildLinuxBubblewrapPolicyArgs(
   for (const directory of orderedDirectories) {
     args.push("--dir", directory);
   }
+  // FD 3 is also the descriptor-backed executable used to start bubblewrap.
+  // Consume and close it during setup, then obscure this staging copy with the
+  // later /run tmpfs. The target can still observe bubblewrap itself as the
+  // PID-namespace supervisor through procfs; this only contains the inherited
+  // launch descriptor and its temporary setup path.
+  args.push(
+    "--perms",
+    "0000",
+    "--file",
+    String(LINUX_BWRAP_SUPERVISOR_CHILD_FD),
+    LINUX_BWRAP_SUPERVISOR_HIDDEN_PATH,
+  );
   for (const mount of pinnedMounts) {
-    args.push("--ro-bind-fd", String(mount.childFd), mount.destination);
+    if (mount.mountMode === "ro-bind-data") {
+      args.push(
+        "--perms",
+        mount.mountPermissions,
+        "--ro-bind-data",
+        String(mount.childFd),
+        mount.destination,
+      );
+    } else {
+      args.push("--ro-bind-fd", String(mount.childFd), mount.destination);
+    }
   }
   args.push(
     "--seccomp",
@@ -3974,29 +4791,50 @@ function buildLinuxBubblewrapPolicyArgs(
 
 function probeLinuxBubblewrapPolicy(
   runtime,
+  supervisorLaunch,
+  supervisorBinding,
   policyArgs,
   pinnedDescriptors,
   targetRuntime,
+  contentSnapshot = null,
 ) {
+  const supervisorIdentity = JSON.stringify({
+    dev: supervisorBinding.fileId.dev,
+    ino: supervisorBinding.fileId.ino,
+    bytes: supervisorBinding.bytes,
+  });
+  const probeSource = [
+    'const fs = require("node:fs");',
+    `const expected = ${supervisorIdentity};`,
+    'for (const name of fs.readdirSync("/proc/self/fd")) {',
+    "  let current;",
+    "  try { current = fs.fstatSync(Number(name), { bigint: true }); } catch { continue; }",
+    "  if (String(current.dev) === expected.dev &&",
+    "      String(current.ino) === expected.ino &&",
+    "      Number(current.size) === expected.bytes) {",
+    '    throw new Error("bubblewrap supervisor descriptor leaked");',
+    "  }",
+    "}",
+    "try {",
+    `  fs.lstatSync(${JSON.stringify(LINUX_BWRAP_SUPERVISOR_HIDDEN_PATH)});`,
+    '  throw new Error("bubblewrap supervisor staging path visible");',
+    "} catch (error) {",
+    '  if (error?.code !== "ENOENT") throw error;',
+    "}",
+    `process.stdout.write(${JSON.stringify(LINUX_BWRAP_NODE_PROBE_SENTINEL)});`,
+  ].join("\n");
   let result;
   try {
     result = runtime.spawnSync(
-      LINUX_BWRAP_PATH,
-      [
-        ...policyArgs,
-        "--",
-        "/opt/chainless/runtime/node",
-        "-e",
-        `process.stdout.write(${JSON.stringify(
-          LINUX_BWRAP_NODE_PROBE_SENTINEL,
-        )})`,
-      ],
+      supervisorLaunch.command,
+      [...policyArgs, "--", "/opt/chainless/runtime/node", "-e", probeSource],
       {
         cwd: "/",
         shell: false,
         encoding: "utf8",
         stdio: linuxStdioWithPinnedMounts(null, pinnedDescriptors, {
           probe: true,
+          supervisorFd: supervisorLaunch.fd,
         }),
         timeout: 15_000,
         env: {
@@ -4012,6 +4850,8 @@ function probeLinuxBubblewrapPolicy(
       false,
       "probe_spawn_failed",
       targetRuntime,
+      contentSnapshot,
+      supervisorBinding,
     );
   }
   if (result?.error || result?.status !== 0) {
@@ -4020,6 +4860,8 @@ function probeLinuxBubblewrapPolicy(
       false,
       result?.error ? "probe_spawn_failed" : "probe_failed",
       targetRuntime,
+      contentSnapshot,
+      supervisorBinding,
     );
   }
   if (String(result.stdout) !== LINUX_BWRAP_NODE_PROBE_SENTINEL) {
@@ -4028,9 +4870,18 @@ function probeLinuxBubblewrapPolicy(
       false,
       "node_runtime_probe_failed",
       targetRuntime,
+      contentSnapshot,
+      supervisorBinding,
     );
   }
-  return linuxBubblewrapProbe(true, true, null, targetRuntime);
+  return linuxBubblewrapProbe(
+    true,
+    true,
+    null,
+    targetRuntime,
+    contentSnapshot,
+    supervisorBinding,
+  );
 }
 
 /**
@@ -4129,24 +4980,6 @@ export function applyLinuxSandbox(
         guarantees: [],
       });
     }
-    const capabilities = attestLinuxBubblewrapCapabilities(runtime);
-    if (!capabilities.ok) {
-      return createSandboxPlan({
-        ...base,
-        backend: null,
-        candidateBackend: LINUX_BWRAP_BACKEND,
-        policyAttested: false,
-        runtimeProbe: linuxBubblewrapProbe(
-          true,
-          false,
-          capabilities.reason,
-          validation.entryRuntime,
-        ),
-        reason: "linux_bwrap_unavailable",
-        guarantees: [],
-      });
-    }
-
     let runtimeMounts;
     let pinnedRuntimeMounts = [];
     try {
@@ -4181,6 +5014,14 @@ export function applyLinuxSandbox(
     let pluginTree;
     let entryFormat = null;
     let entryMount;
+    const entryRelative = path.posix.relative(
+      validation.contract.pluginRoot,
+      validation.contract.entryIdentity.realPath,
+    );
+    const sandboxEntry = path.posix.join(
+      "/opt/chainless/plugin",
+      entryRelative,
+    );
     try {
       pluginTree = pinLinuxPluginTree(
         runtime,
@@ -4240,8 +5081,124 @@ export function applyLinuxSandbox(
       });
     }
 
+    let entrySnapshot = null;
+    let pluginTreeSnapshot = null;
+    const pluginTreeFileSnapshots = [];
+    let probePinnedMounts = pinnedMounts;
+    try {
+      const entryIndex = pinnedMounts.indexOf(entryMount);
+      if (entryIndex < 0) {
+        throw new Error("plugin_entry_pin_missing");
+      }
+      const pluginMountIndexes = pinnedMounts
+        .map((mount, index) =>
+          linuxPathWithin("/opt/chainless/plugin", mount.destination)
+            ? index
+            : -1,
+        )
+        .filter((index) => index >= 0);
+      const rawPluginMounts = pluginMountIndexes.map(
+        (index) => pinnedMounts[index],
+      );
+      if (validation.entryRuntime === "node") {
+        if (
+          pluginMountIndexes.length < 1 ||
+          pluginMountIndexes.length > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_FILES
+        ) {
+          throw new Error("node_plugin_tree_snapshot_file_count_invalid");
+        }
+        const pluginBytes = pluginMountIndexes.reduce((total, index) => {
+          const bytes = pinnedMounts[index]?.bytes;
+          if (
+            !Number.isSafeInteger(bytes) ||
+            bytes < 0 ||
+            bytes > LINUX_ATTESTED_FILE_MAX_BYTES
+          ) {
+            throw new Error("node_plugin_tree_snapshot_member_size_invalid");
+          }
+          return total + bytes;
+        }, 0);
+        if (
+          !Number.isSafeInteger(pluginBytes) ||
+          pluginBytes > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_BYTES
+        ) {
+          throw new Error("node_plugin_tree_snapshot_bytes_exceeded");
+        }
+      }
+      const rawEntryMount = entryMount;
+      const snapshot = createLinuxEntrySnapshot(
+        runtime,
+        rawEntryMount,
+        validation.contract.entryIdentity,
+        validation.entryRuntime,
+      );
+      const finalMounts = [...pinnedMounts];
+      const probeMounts = [...pinnedMounts];
+      finalMounts[entryIndex] = snapshot.finalMount;
+      probeMounts[entryIndex] = snapshot.probeMount;
+      entrySnapshot = snapshot;
+      if (validation.entryRuntime === "node") {
+        for (const index of pluginMountIndexes) {
+          if (index === entryIndex) continue;
+          const rawMount = pinnedMounts[index];
+          const source = runtime.fs.fstatSync(rawMount.fd);
+          const fileSnapshot = createLinuxRegularFileSnapshot(
+            runtime,
+            rawMount,
+            {
+              fileId: rawMount.fileId,
+              bytes: rawMount.bytes,
+              mtimeMs: rawMount.mtimeMs,
+            },
+            linuxNodePluginTreeFileSnapshotContract(Number(source.mode)),
+          );
+          pluginTreeFileSnapshots.push(fileSnapshot);
+          finalMounts[index] = fileSnapshot.finalMount;
+          probeMounts[index] = fileSnapshot.probeMount;
+        }
+        pluginTreeSnapshot = buildLinuxNodePluginTreeSnapshotAttestation(
+          finalMounts,
+          sandboxEntry,
+        );
+      }
+      pinnedMounts = finalMounts;
+      probePinnedMounts = probeMounts;
+      entryMount = entrySnapshot.finalMount;
+      closeLinuxPinnedMounts(
+        runtime,
+        validation.entryRuntime === "node" ? rawPluginMounts : [rawEntryMount],
+      );
+    } catch (error) {
+      closeLinuxPinnedMounts(runtime, pinnedMounts);
+      closeLinuxPinnedMounts(runtime, [
+        entrySnapshot?.probeMount,
+        entrySnapshot?.finalMount,
+        ...pluginTreeFileSnapshots.flatMap((snapshot) => [
+          snapshot.probeMount,
+          snapshot.finalMount,
+        ]),
+      ]);
+      return createSandboxPlan({
+        ...base,
+        backend: null,
+        candidateBackend: LINUX_BWRAP_BACKEND,
+        policyAttested: false,
+        runtimeProbe: linuxBubblewrapProbe(
+          false,
+          false,
+          error.message || "entry_snapshot_unattested",
+          validation.entryRuntime,
+        ),
+        reason: "linux_bwrap_plugin_snapshot_unattested",
+        guarantees: [],
+      });
+    }
+
     let probeSeccompFilter;
     let seccompFilter;
+    const pluginTreeProbeMounts = pluginTreeFileSnapshots.map(
+      (snapshot) => snapshot.probeMount,
+    );
     try {
       probeSeccompFilter = pinLinuxNetworkSeccompFilter(runtime);
       seccompFilter = pinLinuxNetworkSeccompFilter(runtime);
@@ -4255,7 +5212,12 @@ export function applyLinuxSandbox(
       closeLinuxPinnedMounts(runtime, pinnedMounts);
       closeLinuxPinnedMounts(
         runtime,
-        [probeSeccompFilter, seccompFilter].filter(Boolean),
+        [
+          entrySnapshot?.probeMount,
+          ...pluginTreeProbeMounts,
+          probeSeccompFilter,
+          seccompFilter,
+        ].filter(Boolean),
       );
       return createSandboxPlan({
         ...base,
@@ -4273,7 +5235,89 @@ export function applyLinuxSandbox(
       });
     }
     const pinnedDescriptors = [...pinnedMounts, seccompFilter];
-    const probeDescriptors = [...pinnedMounts, probeSeccompFilter];
+    const probeDescriptors = [...probePinnedMounts, probeSeccompFilter];
+    const closeStrongLinuxResources = (...extra) => {
+      closeLinuxPinnedMounts(runtime, [
+        ...pinnedDescriptors,
+        probeSeccompFilter,
+        entrySnapshot?.probeMount,
+        ...pluginTreeProbeMounts,
+        ...extra,
+      ]);
+    };
+    let supervisorPin;
+    let capabilityLaunch;
+    let probeLaunch;
+    let finalLaunch;
+    try {
+      supervisorPin = pinLinuxBubblewrapSupervisor(runtime);
+      capabilityLaunch = openLinuxBubblewrapSupervisorLaunch(
+        runtime,
+        supervisorPin,
+      );
+    } catch (error) {
+      closeStrongLinuxResources(supervisorPin);
+      return createSandboxPlan({
+        ...base,
+        backend: null,
+        candidateBackend: LINUX_BWRAP_BACKEND,
+        policyAttested: false,
+        runtimeProbe: linuxBubblewrapProbe(
+          false,
+          false,
+          error.message || "supervisor_descriptor_unattested",
+          validation.entryRuntime,
+        ),
+        reason: "linux_bwrap_unavailable",
+        guarantees: [],
+      });
+    }
+    const capabilities = attestLinuxBubblewrapCapabilities(
+      runtime,
+      capabilityLaunch,
+    );
+    closeLinuxPinnedMounts(runtime, [capabilityLaunch]);
+    capabilityLaunch = null;
+    if (!capabilities.ok) {
+      closeStrongLinuxResources(supervisorPin);
+      return createSandboxPlan({
+        ...base,
+        backend: null,
+        candidateBackend: LINUX_BWRAP_BACKEND,
+        policyAttested: false,
+        runtimeProbe: linuxBubblewrapProbe(
+          true,
+          false,
+          capabilities.reason,
+          validation.entryRuntime,
+          null,
+          supervisorPin.attestation,
+        ),
+        reason: "linux_bwrap_unavailable",
+        guarantees: [],
+      });
+    }
+    try {
+      probeLaunch = openLinuxBubblewrapSupervisorLaunch(runtime, supervisorPin);
+    } catch (error) {
+      closeStrongLinuxResources(supervisorPin, probeLaunch);
+      return createSandboxPlan({
+        ...base,
+        backend: null,
+        candidateBackend: LINUX_BWRAP_BACKEND,
+        policyAttested: false,
+        runtimeProbe: linuxBubblewrapProbe(
+          true,
+          false,
+          error.message || "supervisor_launch_reader_unattested",
+          validation.entryRuntime,
+          null,
+          supervisorPin.attestation,
+        ),
+        reason: "linux_bwrap_unavailable",
+        guarantees: [],
+      });
+    }
     const environment = linuxSandboxEnvironment();
     const policyArgs = buildLinuxBubblewrapPolicyArgs(
       pluginTree.directories,
@@ -4281,24 +5325,32 @@ export function applyLinuxSandbox(
       environment,
       seccompFilter,
     );
-    const entryRelative = path.posix.relative(
-      validation.contract.pluginRoot,
-      validation.contract.entryIdentity.realPath,
-    );
-    const sandboxEntry = path.posix.join(
-      "/opt/chainless/plugin",
-      entryRelative,
-    );
     const targetArgs =
       validation.entryRuntime === "native-static-elf"
         ? [sandboxEntry, ...args]
         : ["/opt/chainless/runtime/node", sandboxEntry, ...args.slice(1)];
+    const snapshotPolicyBinding = entrySnapshot
+      ? {
+          scope: entrySnapshot.attestation.scope,
+          mechanism: entrySnapshot.attestation.mechanism,
+          sourceIdentity: validation.contract.entryIdentity,
+          sha256: entrySnapshot.attestation.sha256,
+          bytes: entrySnapshot.attestation.bytes,
+          destination: sandboxEntry,
+          ...(validation.entryRuntime === "node"
+            ? { sourceFileMode: entrySnapshot.attestation.sourceFileMode }
+            : {}),
+          sourceMode: entrySnapshot.attestation.sourceMode,
+          targetMode: entrySnapshot.attestation.targetMode,
+        }
+      : null;
     const policyDigest = crypto
       .createHash("sha256")
       .update(
         JSON.stringify({
-          version: 1,
+          version: validation.entryRuntime === "node" ? 4 : 3,
           backend: LINUX_BWRAP_BACKEND,
+          supervisor: supervisorPin.attestation,
           contract: {
             kind: validation.contract.kind,
             pluginRoot: validation.contract.pluginRoot,
@@ -4308,12 +5360,38 @@ export function applyLinuxSandbox(
             entryRuntime: validation.entryRuntime,
             entryFormat,
           },
-          mounts: pinnedMounts.map((mount) => ({
-            destination: mount.destination,
-            fileId: mount.fileId,
-            bytes: mount.bytes,
-            mtimeMs: mount.mtimeMs,
-          })),
+          mounts: pinnedMounts.map((mount) =>
+            mount.contentSnapshot
+              ? {
+                  destination: mount.destination,
+                  fileId: mount.contentSnapshot.sourceFileId,
+                  bytes: mount.contentSnapshot.bytes,
+                  mtimeMs: mount.contentSnapshot.sourceMtimeMs,
+                  contentSnapshot: {
+                    scope: mount.contentSnapshot.scope,
+                    mechanism: mount.contentSnapshot.mechanism,
+                    sha256: mount.contentSnapshot.sha256,
+                    bytes: mount.contentSnapshot.bytes,
+                    ...(validation.entryRuntime === "node"
+                      ? {
+                          sourceFileMode: mount.contentSnapshot.sourceFileMode,
+                        }
+                      : {}),
+                    sourceMode: mount.contentSnapshot.sourceMode,
+                    targetMode: mount.contentSnapshot.targetMode,
+                  },
+                }
+              : {
+                  destination: mount.destination,
+                  fileId: mount.fileId,
+                  bytes: mount.bytes,
+                  mtimeMs: mount.mtimeMs,
+                },
+          ),
+          contentSnapshot: snapshotPolicyBinding,
+          ...(validation.entryRuntime === "node"
+            ? { pluginTreeContentSnapshot: pluginTreeSnapshot }
+            : {}),
           seccomp: {
             arch: seccompFilter.arch,
             policy: seccompFilter.policy,
@@ -4327,24 +5405,32 @@ export function applyLinuxSandbox(
         }),
       )
       .digest("hex");
-    const runtimeProbe = Object.freeze(
+    const policyProbe = Object.freeze(
       probeLinuxBubblewrapPolicy(
         runtime,
+        probeLaunch,
+        supervisorPin.attestation,
         policyArgs,
         probeDescriptors,
         validation.entryRuntime,
       ),
     );
-    closeLinuxPinnedMounts(runtime, [probeSeccompFilter]);
-    if (!runtimeProbe.runnable) {
-      closeLinuxPinnedMounts(runtime, pinnedDescriptors);
+    closeLinuxPinnedMounts(runtime, [
+      probeLaunch,
+      probeSeccompFilter,
+      entrySnapshot?.probeMount,
+      ...pluginTreeProbeMounts,
+    ]);
+    probeLaunch = null;
+    if (!policyProbe.runnable) {
+      closeStrongLinuxResources(supervisorPin, finalLaunch);
       return createSandboxPlan({
         ...base,
         backend: null,
         candidateBackend: LINUX_BWRAP_BACKEND,
         policyAttested: false,
         policyDigest,
-        runtimeProbe,
+        runtimeProbe: policyProbe,
         reason: "linux_bwrap_policy_probe_failed",
         guarantees: [],
       });
@@ -4356,9 +5442,10 @@ export function applyLinuxSandbox(
       validation.contract,
       runtime,
       sandboxOpts.sync,
+      { sealedEntry: entrySnapshot !== null },
     );
     if (!finalValidation.ok) {
-      closeLinuxPinnedMounts(runtime, pinnedDescriptors);
+      closeStrongLinuxResources(supervisorPin, finalLaunch);
       return createSandboxPlan({
         ...base,
         backend: null,
@@ -4370,46 +5457,107 @@ export function applyLinuxSandbox(
           false,
           `post_probe_${finalValidation.reason}`,
           validation.entryRuntime,
+          null,
+          supervisorPin.attestation,
         ),
         reason: "linux_bwrap_execution_contract_changed",
         guarantees: [],
       });
     }
-    if (validation.entryRuntime === "native-static-elf") {
-      try {
-        const finalEntryFormat = inspectLinuxStaticNativeElf(
+    try {
+      if (validation.entryRuntime === "node") {
+        attestLinuxNodePluginTreeSnapshot(
           runtime,
-          entryMount.fd,
-          validation.contract.entryIdentity,
+          pinnedMounts,
+          sandboxEntry,
+          pluginTreeSnapshot,
+        );
+      } else {
+        attestLinuxEntrySnapshot(
+          runtime,
+          entryMount,
+          entrySnapshot.attestation,
+          validation.entryRuntime,
         );
-        if (JSON.stringify(finalEntryFormat) !== JSON.stringify(entryFormat)) {
-          throw new Error("native_entry_format_changed");
-        }
-        if (
-          JSON.stringify(finalValidation.entryFormat) !==
-          JSON.stringify(entryFormat)
-        ) {
-          throw new Error("native_entry_path_format_changed");
-        }
-      } catch (error) {
-        closeLinuxPinnedMounts(runtime, pinnedDescriptors);
-        return createSandboxPlan({
-          ...base,
-          backend: null,
-          candidateBackend: LINUX_BWRAP_BACKEND,
-          policyAttested: false,
-          policyDigest,
-          runtimeProbe: linuxBubblewrapProbe(
-            true,
-            false,
-            `post_probe_${error.message || "native_entry_changed"}`,
-            validation.entryRuntime,
-          ),
-          reason: "linux_bwrap_execution_contract_changed",
-          guarantees: [],
-        });
       }
+    } catch (error) {
+      closeStrongLinuxResources(supervisorPin, finalLaunch);
+      return createSandboxPlan({
+        ...base,
+        backend: null,
+        candidateBackend: LINUX_BWRAP_BACKEND,
+        policyAttested: false,
+        policyDigest,
+        runtimeProbe: linuxBubblewrapProbe(
+          true,
+          false,
+          `post_probe_${error.message || "entry_snapshot_changed"}`,
+          validation.entryRuntime,
+          null,
+          supervisorPin.attestation,
+        ),
+        reason: "linux_bwrap_execution_contract_changed",
+        guarantees: [],
+      });
+    }
+    try {
+      attestLinuxBubblewrapSupervisorPin(runtime, supervisorPin);
+    } catch (error) {
+      closeStrongLinuxResources(supervisorPin, finalLaunch);
+      return createSandboxPlan({
+        ...base,
+        backend: null,
+        candidateBackend: LINUX_BWRAP_BACKEND,
+        policyAttested: false,
+        policyDigest,
+        runtimeProbe: linuxBubblewrapProbe(
+          true,
+          false,
+          `post_probe_${error.message || "supervisor_identity_changed"}`,
+          validation.entryRuntime,
+          null,
+          supervisorPin.attestation,
+        ),
+        reason: "linux_bwrap_execution_contract_changed",
+        guarantees: [],
+      });
+    }
+    try {
+      finalLaunch = openLinuxBubblewrapSupervisorLaunch(runtime, supervisorPin);
+    } catch (error) {
+      closeStrongLinuxResources(supervisorPin, finalLaunch);
+      return createSandboxPlan({
+        ...base,
+        backend: null,
+        candidateBackend: LINUX_BWRAP_BACKEND,
+        policyAttested: false,
+        policyDigest,
+        runtimeProbe: linuxBubblewrapProbe(
+          true,
+          false,
+          `post_probe_${error.message || "supervisor_launch_reader_unattested"}`,
+          validation.entryRuntime,
+          null,
+          supervisorPin.attestation,
+        ),
+        reason: "linux_bwrap_execution_contract_changed",
+        guarantees: [],
+      });
     }
+    const supervisorBinding = supervisorPin.attestation;
+    closeLinuxPinnedMounts(runtime, [supervisorPin]);
+    supervisorPin = null;
+    const runtimeProbe = Object.freeze(
+      linuxBubblewrapProbe(
+        true,
+        true,
+        null,
+        validation.entryRuntime,
+        entrySnapshot?.attestation,
+        supervisorBinding,
+        pluginTreeSnapshot,
+      ),
+    );
     const options = {
       ...spawnOpts,
       cwd: "/",
@@ -4421,14 +5569,16 @@ export function applyLinuxSandbox(
         LC_ALL: "C",
       },
       stdio: Object.freeze(
-        linuxStdioWithPinnedMounts(spawnOpts?.stdio, pinnedDescriptors),
+        linuxStdioWithPinnedMounts(spawnOpts?.stdio, pinnedDescriptors, {
+          supervisorFd: finalLaunch.fd,
+        }),
       ),
     };
     let pinsClosed = false;
     const cleanup = () => {
       if (pinsClosed) return;
       pinsClosed = true;
-      closeLinuxPinnedMounts(runtime, pinnedDescriptors);
+      closeLinuxPinnedMounts(runtime, [...pinnedDescriptors, finalLaunch]);
     };
     return createSandboxPlan({
       ...base,
@@ -4441,7 +5591,7 @@ export function applyLinuxSandbox(
       runtimeProbe,
       reason: null,
       guarantees: [SANDBOX_BOUNDARIES.FILESYSTEM, SANDBOX_BOUNDARIES.NETWORK],
-      command: LINUX_BWRAP_PATH,
+      command: finalLaunch.command,
       args: [...policyArgs, "--", ...targetArgs],
       options,
       cleanup,