chainlesschain 0.162.182 → 0.162.184

package/src/lib/process-execution-broker/index.js

@@ -38,7 +38,13 @@ import {
   postSpawnSandbox as _postSpawnSandbox,
   SANDBOX_BOUNDARIES,
 } from "./platform-sandbox.js";
+import {
+  admitLinuxGenericSandboxExecutionContract,
+  issueLinuxGenericSandboxExecutionContract,
+  LINUX_GENERIC_CONTRACT_KIND,
+} from "./linux-generic-bwrap.js";
 import { consumeIssuedPluginSandboxExecutionContract } from "../plugin-runtime/bin.js";
+import runtimeProvenanceLedger from "../runtime-provenance-ledger.js";
 import { credentialAgent } from "./credential-agent.js";
 
 const SUPPORTED_SANDBOX_BOUNDARIES = new Set(Object.values(SANDBOX_BOUNDARIES));
@@ -50,7 +56,6 @@ const SUPPORTED_SANDBOX_PROFILES = new Set([
 
 // 延迟导入避免循环依赖
 let _traceCtx = null;
-let _rpl = null;
 let _hooksV2 = null;
 const _ipcBus = null;
 
@@ -66,14 +71,7 @@ function getTraceCtx() {
 }
 
 function getRpl() {
-  if (!_rpl) {
-    try {
-      _rpl = require("../runtime-provenance-ledger.js");
-    } catch {
-      _rpl = null;
-    }
-  }
-  return _rpl;
+  return runtimeProvenanceLedger;
 }
 
 function getHooksV2() {
@@ -271,6 +269,24 @@ class ProcessExecutionBroker extends EventEmitter {
         },
       );
     };
+    if (raw?.kind === LINUX_GENERIC_CONTRACT_KIND) {
+      const admitted = admitLinuxGenericSandboxExecutionContract(raw, {
+        origin: options.origin || "unknown",
+        command: launch?.command,
+        args: launch?.args,
+        cwd: options.cwd || process.cwd(),
+        shell: options.shell,
+        sync: launch?.sync === true,
+        stdio: options.stdio,
+        requiredBoundaries,
+      });
+      if (!admitted) {
+        return invalid(
+          "sandboxExecutionContract was not issued for this workspace launch provenance",
+        );
+      }
+      return admitted;
+    }
     if (
       !consumeIssuedPluginSandboxExecutionContract(raw, {
         origin: options.origin,
@@ -315,6 +331,7 @@ class ProcessExecutionBroker extends EventEmitter {
       ![
         "strict-plugin-node-bin",
         "strict-plugin-native-static-elf-bin",
+        "strict-plugin-native-elf-bin",
       ].includes(raw.kind)
     ) {
       return invalid("unsupported sandboxExecutionContract kind or version");
@@ -407,6 +424,57 @@ class ProcessExecutionBroker extends EventEmitter {
     });
   }
 
+  /**
+   * Issue a private one-launch Linux workspace authority for trusted host
+   * call-sites. The writable root is a positional host value, never read from
+   * a manifest/spawn option. Unsupported platforms and mixed boundary sets
+   * return null so the normal fail-closed adapter path remains authoritative.
+   */
+  issueLinuxWorkspaceSandboxExecutionContract(
+    command,
+    args = [],
+    options = {},
+    trustedWorkspaceRoot = process.cwd(),
+    { sync = false } = {},
+  ) {
+    const requiredBoundaries = [
+      ...new Set([
+        ...(options.requiredBoundaries || []),
+        ...(options.sandboxPolicy?.requiredBoundaries || []),
+      ]),
+    ];
+    if (
+      process.platform !== "linux" ||
+      requiredBoundaries.length === 0 ||
+      (options.shell !== undefined &&
+        options.shell !== null &&
+        options.shell !== false) ||
+      requiredBoundaries.some(
+        (boundary) =>
+          boundary !== SANDBOX_BOUNDARIES.FILESYSTEM &&
+          boundary !== SANDBOX_BOUNDARIES.NETWORK,
+      )
+    ) {
+      return null;
+    }
+    return issueLinuxGenericSandboxExecutionContract({
+      origin: options.origin || "unknown",
+      command,
+      args,
+      cwd: options.cwd || trustedWorkspaceRoot,
+      workspaceRoot: trustedWorkspaceRoot,
+      shell: options.shell,
+      sync,
+      stdio: options.stdio,
+      requiredBoundaries,
+      detached: options.detached,
+      uid: options.uid,
+      gid: options.gid,
+      argv0: options.argv0,
+      serialization: options.serialization,
+    });
+  }
+
   _stripPluginControlOptions(options) {
     delete options.pluginId;
     delete options.pluginVersion;
@@ -636,6 +704,9 @@ class ProcessExecutionBroker extends EventEmitter {
       );
     }
     let runtimeProbe = null;
+    let genericWorkspaceProbe = false;
+    let sanitizedFilesystemPolicy = null;
+    let sanitizedNetworkPolicy = null;
     if (plan.runtimeProbe !== null && plan.runtimeProbe !== undefined) {
       if (
         typeof plan.runtimeProbe !== "object" ||
@@ -656,6 +727,12 @@ class ProcessExecutionBroker extends EventEmitter {
         "targetRuntime",
         "contentSnapshotScope",
         "contentSnapshotMechanism",
+        "pluginTreeContentSnapshotScope",
+        "pluginTreeContentSnapshotMechanism",
+        "pluginTreeSnapshotConsistency",
+        "initialDynamicLoadClosureScope",
+        "initialDynamicLoadClosureMechanism",
+        "initialDynamicInterpreter",
       ]) {
         if (
           plan.runtimeProbe[field] !== undefined &&
@@ -668,7 +745,14 @@ class ProcessExecutionBroker extends EventEmitter {
           );
         }
       }
-      for (const field of ["contentSnapshot", "handleAtomic"]) {
+      for (const field of [
+        "contentSnapshot",
+        "handleAtomic",
+        "pluginTreeContentSnapshot",
+        "pluginTreeSnapshotContractBound",
+        "pluginTreeSnapshotAtomic",
+        "initialDynamicLoadClosureDescriptorBound",
+      ]) {
         if (
           plan.runtimeProbe[field] !== undefined &&
           typeof plan.runtimeProbe[field] !== "boolean"
@@ -679,6 +763,503 @@ class ProcessExecutionBroker extends EventEmitter {
           );
         }
       }
+      for (const field of [
+        "pluginTreeContentSnapshotFiles",
+        "pluginTreeContentSnapshotBytes",
+        "initialDynamicDependencyCount",
+        "initialDynamicRuntimeFileCount",
+      ]) {
+        if (
+          plan.runtimeProbe[field] !== undefined &&
+          (!Number.isSafeInteger(plan.runtimeProbe[field]) ||
+            plan.runtimeProbe[field] < 0)
+        ) {
+          throw this._sandboxError(
+            "invalid_sandbox_plan",
+            `Sandbox runtime probe ${field} must be a non-negative safe integer`,
+          );
+        }
+      }
+      if (
+        plan.runtimeProbe.pluginTreeContentSnapshotDigest !== undefined &&
+        (typeof plan.runtimeProbe.pluginTreeContentSnapshotDigest !==
+          "string" ||
+          !/^[a-f0-9]{64}$/.test(
+            plan.runtimeProbe.pluginTreeContentSnapshotDigest,
+          ))
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Sandbox runtime probe pluginTreeContentSnapshotDigest must be a lowercase SHA-256 value",
+        );
+      }
+      if (
+        plan.runtimeProbe.initialDynamicLoadClosureDigest !== undefined &&
+        (typeof plan.runtimeProbe.initialDynamicLoadClosureDigest !==
+          "string" ||
+          !/^[a-f0-9]{64}$/.test(
+            plan.runtimeProbe.initialDynamicLoadClosureDigest,
+          ))
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Sandbox runtime probe initialDynamicLoadClosureDigest must be a lowercase SHA-256 value",
+        );
+      }
+      const pluginTreeSnapshot =
+        plan.runtimeProbe.pluginTreeContentSnapshot === true;
+      const pluginTreeEvidenceFields = [
+        "pluginTreeContentSnapshotScope",
+        "pluginTreeContentSnapshotMechanism",
+        "pluginTreeContentSnapshotFiles",
+        "pluginTreeContentSnapshotBytes",
+        "pluginTreeContentSnapshotDigest",
+        "pluginTreeSnapshotConsistency",
+        "pluginTreeSnapshotContractBound",
+        "pluginTreeSnapshotAtomic",
+      ];
+      if (
+        pluginTreeSnapshot &&
+        (plan.applied !== true ||
+          plan.platform !== "linux" ||
+          plan.enforcement !== "linux-bwrap" ||
+          backend !== "linux-bwrap" ||
+          candidateBackend !== null ||
+          policyAttested !== true ||
+          policyDigest === null ||
+          !guarantees.includes(SANDBOX_BOUNDARIES.FILESYSTEM) ||
+          !guarantees.includes(SANDBOX_BOUNDARIES.NETWORK) ||
+          plan.runtimeProbe.attempted !== true ||
+          plan.runtimeProbe.runnable !== true ||
+          plan.runtimeProbe.reason !== null ||
+          plan.runtimeProbe.kind !== "linux-bwrap-plugin-node-policy-v1" ||
+          plan.runtimeProbe.probeRuntime !== "node" ||
+          plan.runtimeProbe.targetRuntime !== "node" ||
+          plan.runtimeProbe.contentSnapshot !== true ||
+          plan.runtimeProbe.contentSnapshotScope !== "plugin-entry-source" ||
+          plan.runtimeProbe.contentSnapshotMechanism !==
+            "verified-o_tmpfile-copy-bwrap-ro-bind-data-v1" ||
+          plan.runtimeProbe.handleAtomic !== false ||
+          plan.runtimeProbe.supervisorDescriptorBound !== true ||
+          plan.runtimeProbe.pluginTreeContentSnapshotScope !==
+            "all-pinned-plugin-regular-files" ||
+          plan.runtimeProbe.pluginTreeContentSnapshotMechanism !==
+            "verified-o_tmpfile-copy-bwrap-ro-bind-data-v1" ||
+          !Number.isSafeInteger(
+            plan.runtimeProbe.pluginTreeContentSnapshotFiles,
+          ) ||
+          plan.runtimeProbe.pluginTreeContentSnapshotFiles < 1 ||
+          plan.runtimeProbe.pluginTreeContentSnapshotFiles > 256 ||
+          !Number.isSafeInteger(
+            plan.runtimeProbe.pluginTreeContentSnapshotBytes,
+          ) ||
+          plan.runtimeProbe.pluginTreeContentSnapshotBytes < 0 ||
+          plan.runtimeProbe.pluginTreeContentSnapshotBytes >
+            256 * 1024 * 1024 ||
+          !/^[a-f0-9]{64}$/.test(
+            plan.runtimeProbe.pluginTreeContentSnapshotDigest || "",
+          ) ||
+          plan.runtimeProbe.pluginTreeSnapshotConsistency !==
+            "per-file-pin-to-launch" ||
+          plan.runtimeProbe.pluginTreeSnapshotContractBound !== false ||
+          plan.runtimeProbe.pluginTreeSnapshotAtomic !== false)
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Sandbox runtime probe plugin tree snapshot evidence must use the typed complete-tree contract",
+        );
+      }
+      if (
+        !pluginTreeSnapshot &&
+        pluginTreeEvidenceFields.some(
+          (field) => plan.runtimeProbe[field] !== undefined,
+        )
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Sandbox runtime probe plugin tree snapshot evidence requires pluginTreeContentSnapshot",
+        );
+      }
+      const supervisorStringFields = [
+        "supervisorBindingScope",
+        "supervisorDescriptorBindingMechanism",
+        "supervisorPid1ExecutableExposure",
+      ];
+      const supervisorBooleanFields = [
+        "supervisorDescriptorBound",
+        "supervisorExecutablePinned",
+        "supervisorDescriptorContained",
+        "supervisorDescriptorConsumedBeforeTarget",
+        "supervisorStagingPathHidden",
+        "supervisorTemporaryCopyObscured",
+      ];
+      for (const field of supervisorStringFields) {
+        if (
+          plan.runtimeProbe[field] !== undefined &&
+          (typeof plan.runtimeProbe[field] !== "string" ||
+            !plan.runtimeProbe[field])
+        ) {
+          throw this._sandboxError(
+            "invalid_sandbox_plan",
+            `Sandbox runtime probe ${field} must be a non-empty string`,
+          );
+        }
+      }
+      for (const field of supervisorBooleanFields) {
+        if (
+          plan.runtimeProbe[field] !== undefined &&
+          typeof plan.runtimeProbe[field] !== "boolean"
+        ) {
+          throw this._sandboxError(
+            "invalid_sandbox_plan",
+            `Sandbox runtime probe ${field} must be boolean`,
+          );
+        }
+      }
+      const supervisorIdentity = plan.runtimeProbe.supervisorExecutableIdentity;
+      if (supervisorIdentity !== undefined) {
+        const fileId = supervisorIdentity?.fileId;
+        if (
+          !supervisorIdentity ||
+          typeof supervisorIdentity !== "object" ||
+          Array.isArray(supervisorIdentity) ||
+          typeof supervisorIdentity.path !== "string" ||
+          !supervisorIdentity.path.startsWith("/") ||
+          !fileId ||
+          typeof fileId !== "object" ||
+          Array.isArray(fileId) ||
+          typeof fileId.dev !== "string" ||
+          !/^\d+$/.test(fileId.dev) ||
+          typeof fileId.ino !== "string" ||
+          !/^\d+$/.test(fileId.ino) ||
+          typeof supervisorIdentity.sha256 !== "string" ||
+          !/^[a-f0-9]{64}$/.test(supervisorIdentity.sha256) ||
+          !Number.isSafeInteger(supervisorIdentity.bytes) ||
+          supervisorIdentity.bytes <= 0 ||
+          supervisorIdentity.bytes > 256 * 1024 * 1024 ||
+          !Number.isFinite(supervisorIdentity.mtimeMs) ||
+          !Number.isSafeInteger(supervisorIdentity.mode) ||
+          supervisorIdentity.mode <= 0 ||
+          (supervisorIdentity.mode & 0o170000) !== 0o100000 ||
+          (supervisorIdentity.mode & 0o111) === 0 ||
+          (supervisorIdentity.mode & 0o022) !== 0 ||
+          !Number.isSafeInteger(supervisorIdentity.uid) ||
+          supervisorIdentity.uid !== 0 ||
+          !Number.isSafeInteger(supervisorIdentity.gid) ||
+          supervisorIdentity.gid < 0
+        ) {
+          throw this._sandboxError(
+            "invalid_sandbox_plan",
+            "Sandbox runtime probe supervisorExecutableIdentity must use the typed executable identity contract",
+          );
+        }
+      }
+      const supervisorBound =
+        plan.runtimeProbe.supervisorDescriptorBound === true;
+      if (
+        supervisorBound &&
+        (plan.runtimeProbe.supervisorExecutablePinned !== true ||
+          supervisorIdentity === undefined ||
+          plan.runtimeProbe.supervisorBindingScope !==
+            "host-path-replacement" ||
+          plan.runtimeProbe.supervisorDescriptorBindingMechanism !==
+            "pinned-child-fd3-file-consume-run-overmount-v1" ||
+          plan.runtimeProbe.supervisorPid1ExecutableExposure !== "procfs")
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Sandbox runtime probe bound supervisor evidence must include its typed identity and binding contract",
+        );
+      }
+      for (const field of [
+        "supervisorDescriptorContained",
+        "supervisorDescriptorConsumedBeforeTarget",
+        "supervisorStagingPathHidden",
+        "supervisorTemporaryCopyObscured",
+      ]) {
+        if (
+          (plan.runtimeProbe[field] === true &&
+            (!supervisorBound || plan.runtimeProbe.runnable !== true)) ||
+          (supervisorBound &&
+            plan.runtimeProbe[field] !== plan.runtimeProbe.runnable)
+        ) {
+          throw this._sandboxError(
+            "invalid_sandbox_plan",
+            `Sandbox runtime probe ${field} requires a runnable bound supervisor`,
+          );
+        }
+      }
+      const initialDynamicLoadClosureBound =
+        plan.runtimeProbe.initialDynamicLoadClosureDescriptorBound === true;
+      const initialDynamicEvidenceFields = [
+        "initialDynamicLoadClosureScope",
+        "initialDynamicLoadClosureMechanism",
+        "initialDynamicInterpreter",
+        "initialDynamicDependencyCount",
+        "initialDynamicRuntimeFileCount",
+        "initialDynamicLoadClosureDigest",
+      ];
+      const initialDynamicInterpreter =
+        plan.runtimeProbe.initialDynamicInterpreter;
+      const initialDynamicDependencyCount =
+        plan.runtimeProbe.initialDynamicDependencyCount;
+      const initialDynamicRuntimeFileCount =
+        plan.runtimeProbe.initialDynamicRuntimeFileCount;
+      const successfulDynamicProbe =
+        plan.applied === true &&
+        plan.runtimeProbe.kind ===
+          "linux-bwrap-plugin-native-dynamic-elf-policy-v1" &&
+        plan.runtimeProbe.runnable === true;
+      if (
+        initialDynamicLoadClosureBound &&
+        (plan.applied !== true ||
+          plan.platform !== "linux" ||
+          plan.enforcement !== "linux-bwrap" ||
+          backend !== "linux-bwrap" ||
+          candidateBackend !== null ||
+          policyAttested !== true ||
+          policyDigest === null ||
+          !guarantees.includes(SANDBOX_BOUNDARIES.FILESYSTEM) ||
+          !guarantees.includes(SANDBOX_BOUNDARIES.NETWORK) ||
+          plan.runtimeProbe.attempted !== true ||
+          plan.runtimeProbe.runnable !== true ||
+          plan.runtimeProbe.reason !== null ||
+          plan.runtimeProbe.kind !==
+            "linux-bwrap-plugin-native-dynamic-elf-policy-v1" ||
+          plan.runtimeProbe.probeRuntime !== "node" ||
+          plan.runtimeProbe.targetRuntime !== "native-dynamic-elf" ||
+          plan.runtimeProbe.contentSnapshot !== true ||
+          plan.runtimeProbe.contentSnapshotScope !==
+            "plugin-entry-executable" ||
+          plan.runtimeProbe.contentSnapshotMechanism !==
+            "verified-o_tmpfile-copy-bwrap-ro-bind-data-v1" ||
+          plan.runtimeProbe.handleAtomic !== false ||
+          !supervisorBound ||
+          plan.runtimeProbe.initialDynamicLoadClosureScope !==
+            "initial-pt_interp-and-direct-dt_needed-attested-system-set" ||
+          plan.runtimeProbe.initialDynamicLoadClosureMechanism !==
+            "parsed-elf-direct-system-set-to-attested-node-runtime-fds-v1" ||
+          typeof initialDynamicInterpreter !== "string" ||
+          !path.posix.isAbsolute(initialDynamicInterpreter) ||
+          path.posix.normalize(initialDynamicInterpreter) !==
+            initialDynamicInterpreter ||
+          !["/lib/", "/lib64/", "/usr/lib/", "/usr/lib64/"].some((prefix) =>
+            initialDynamicInterpreter.startsWith(prefix),
+          ) ||
+          !Number.isSafeInteger(initialDynamicDependencyCount) ||
+          initialDynamicDependencyCount < 0 ||
+          initialDynamicDependencyCount > 128 ||
+          !Number.isSafeInteger(initialDynamicRuntimeFileCount) ||
+          initialDynamicRuntimeFileCount < 1 ||
+          initialDynamicRuntimeFileCount > 129 ||
+          initialDynamicRuntimeFileCount <
+            Math.max(1, initialDynamicDependencyCount) ||
+          initialDynamicRuntimeFileCount > initialDynamicDependencyCount + 1 ||
+          !/^[a-f0-9]{64}$/.test(
+            plan.runtimeProbe.initialDynamicLoadClosureDigest || "",
+          ))
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Sandbox runtime probe initial dynamic direct system set evidence must use the typed descriptor-bound contract",
+        );
+      }
+      if (
+        !initialDynamicLoadClosureBound &&
+        initialDynamicEvidenceFields.some(
+          (field) => plan.runtimeProbe[field] !== undefined,
+        )
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Sandbox runtime probe initial dynamic direct system set evidence requires initialDynamicLoadClosureDescriptorBound",
+        );
+      }
+      if (successfulDynamicProbe && !initialDynamicLoadClosureBound) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Sandbox runtime probe successful dynamic ELF evidence requires a descriptor-bound initial direct system set",
+        );
+      }
+      const genericWorkspaceEvidenceFields = [
+        "contractDigest",
+        "policyDigest",
+        "mountTopologyDigest",
+        "emptyRoot",
+        "undeclaredRootReadOnly",
+        "workspaceReadWrite",
+        "workspaceMountTopologyAttested",
+        "workspaceRootAliasAttested",
+        "anonymousDevWritable",
+        "systemReadOnly",
+        "hostHomeHidden",
+        "outsideMarkerHidden",
+        "networkNamespace",
+        "networkNamespaceChanged",
+        "socketCreationDenied",
+        "descriptorMounts",
+        "mountTopologyAtomic",
+      ];
+      for (const field of [
+        "contractDigest",
+        "policyDigest",
+        "mountTopologyDigest",
+      ]) {
+        if (
+          plan.runtimeProbe[field] !== undefined &&
+          (typeof plan.runtimeProbe[field] !== "string" ||
+            !/^[a-f0-9]{64}$/.test(plan.runtimeProbe[field]))
+        ) {
+          throw this._sandboxError(
+            "invalid_sandbox_plan",
+            `Sandbox runtime probe ${field} must be a lowercase SHA-256 value`,
+          );
+        }
+      }
+      for (const field of genericWorkspaceEvidenceFields.slice(3)) {
+        if (
+          plan.runtimeProbe[field] !== undefined &&
+          typeof plan.runtimeProbe[field] !== "boolean"
+        ) {
+          throw this._sandboxError(
+            "invalid_sandbox_plan",
+            `Sandbox runtime probe ${field} must be boolean`,
+          );
+        }
+      }
+      const genericWorkspaceKind =
+        plan.runtimeProbe.kind === "linux-bwrap-generic-workspace-policy-v1";
+      if (
+        !genericWorkspaceKind &&
+        genericWorkspaceEvidenceFields.some(
+          (field) => plan.runtimeProbe[field] !== undefined,
+        )
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Linux generic workspace evidence requires its typed runtime probe kind",
+        );
+      }
+      if (genericWorkspaceKind) {
+        const filesystemPolicy = plan.filesystemPolicy;
+        const networkPolicy = plan.networkPolicy;
+        const workspaceRoot = filesystemPolicy?.workspaceRoot;
+        const workingDirectory = filesystemPolicy?.workingDirectory;
+        const workspaceRelative =
+          typeof workspaceRoot === "string" &&
+          typeof workingDirectory === "string"
+            ? path.posix.relative(workspaceRoot, workingDirectory)
+            : "..";
+        genericWorkspaceProbe =
+          plan.applied === true &&
+          plan.platform === "linux" &&
+          plan.enforcement === "linux-bwrap-workspace" &&
+          backend === "linux-bwrap-workspace" &&
+          candidateBackend === null &&
+          policyAttested === true &&
+          policyDigest !== null &&
+          plan.runtimeProbe.policyDigest === policyDigest &&
+          /^[a-f0-9]{64}$/.test(plan.runtimeProbe.contractDigest || "") &&
+          guarantees.includes(SANDBOX_BOUNDARIES.FILESYSTEM) &&
+          guarantees.includes(SANDBOX_BOUNDARIES.NETWORK) &&
+          plan.runtimeProbe.attempted === true &&
+          plan.runtimeProbe.runnable === true &&
+          plan.runtimeProbe.reason === null &&
+          plan.runtimeProbe.probeRuntime === "posix-sh" &&
+          plan.runtimeProbe.targetRuntime === "generic-command" &&
+          plan.runtimeProbe.contentSnapshot === false &&
+          plan.runtimeProbe.handleAtomic === false &&
+          plan.runtimeProbe.mountTopologyAtomic === false &&
+          plan.runtimeProbe.mountTopologyDigest ===
+            filesystemPolicy?.mountTopologyDigest &&
+          [
+            "emptyRoot",
+            "undeclaredRootReadOnly",
+            "workspaceReadWrite",
+            "workspaceMountTopologyAttested",
+            "workspaceRootAliasAttested",
+            "anonymousDevWritable",
+            "systemReadOnly",
+            "hostHomeHidden",
+            "outsideMarkerHidden",
+            "networkNamespace",
+            "networkNamespaceChanged",
+            "socketCreationDenied",
+            "descriptorMounts",
+          ].every((field) => plan.runtimeProbe[field] === true) &&
+          typeof workspaceRoot === "string" &&
+          path.posix.isAbsolute(workspaceRoot) &&
+          workspaceRoot !== "/" &&
+          typeof workingDirectory === "string" &&
+          path.posix.isAbsolute(workingDirectory) &&
+          workspaceRelative !== ".." &&
+          !workspaceRelative.startsWith("../") &&
+          !path.posix.isAbsolute(workspaceRelative) &&
+          filesystemPolicy.workspaceAccess === "read-write" &&
+          filesystemPolicy.systemAccess === "read-only" &&
+          filesystemPolicy.undeclaredRootAccess === "read-only" &&
+          filesystemPolicy.hostRootMapped === false &&
+          filesystemPolicy.hostHomeMapped === false &&
+          filesystemPolicy.workspaceDescriptorBound === true &&
+          filesystemPolicy.systemDescriptorBound === true &&
+          filesystemPolicy.exactEtcFileDescriptors === true &&
+          filesystemPolicy.workspaceRecursiveBind === true &&
+          filesystemPolicy.workspaceMountTopology ===
+            "no-strict-descendants-or-forbidden-root-aliases-at-attestation" &&
+          filesystemPolicy.mountTopologySource === "proc-self-mountinfo" &&
+          /^[a-f0-9]{64}$/.test(filesystemPolicy.mountTopologyDigest || "") &&
+          filesystemPolicy.mountTopologyAtomic === false &&
+          Array.isArray(filesystemPolicy.anonymousWritablePaths) &&
+          filesystemPolicy.anonymousWritablePaths.length === 5 &&
+          ["/home/sandbox", "/dev", "/run", "/tmp", "/var/tmp"].every(
+            (value, index) =>
+              filesystemPolicy.anonymousWritablePaths[index] === value,
+          ) &&
+          networkPolicy?.namespace === "new" &&
+          networkPolicy?.namespaceIdentityChanged === true &&
+          networkPolicy?.seccomp === "deny-network-creation" &&
+          plan.command.startsWith("/proc/self/fd/") &&
+          plan.options?.cwd === "/" &&
+          plan.options?.shell === false &&
+          Array.isArray(plan.options?.stdio) &&
+          plan.args.includes("--bind-fd") &&
+          plan.args.includes("--ro-bind-fd") &&
+          plan.args.includes("--remount-ro") &&
+          plan.args.includes("--unshare-net") &&
+          plan.args.includes("--seccomp") &&
+          !plan.args.includes("--ro-bind");
+        if (!genericWorkspaceProbe) {
+          throw this._sandboxError(
+            "invalid_sandbox_plan",
+            "Linux generic workspace evidence must use the typed descriptor-bound empty-root contract",
+          );
+        }
+        sanitizedFilesystemPolicy = Object.freeze({
+          workspaceRoot,
+          workingDirectory,
+          workspaceAccess: filesystemPolicy.workspaceAccess,
+          systemAccess: filesystemPolicy.systemAccess,
+          undeclaredRootAccess: filesystemPolicy.undeclaredRootAccess,
+          anonymousWritablePaths: Object.freeze([
+            ...filesystemPolicy.anonymousWritablePaths,
+          ]),
+          hostRootMapped: filesystemPolicy.hostRootMapped,
+          hostHomeMapped: filesystemPolicy.hostHomeMapped,
+          workspaceDescriptorBound: filesystemPolicy.workspaceDescriptorBound,
+          systemDescriptorBound: filesystemPolicy.systemDescriptorBound,
+          exactEtcFileDescriptors: filesystemPolicy.exactEtcFileDescriptors,
+          workspaceRecursiveBind: filesystemPolicy.workspaceRecursiveBind,
+          workspaceMountTopology: filesystemPolicy.workspaceMountTopology,
+          mountTopologySource: filesystemPolicy.mountTopologySource,
+          mountTopologyDigest: filesystemPolicy.mountTopologyDigest,
+          mountTopologyAtomic: filesystemPolicy.mountTopologyAtomic,
+        });
+        sanitizedNetworkPolicy = Object.freeze({
+          namespace: networkPolicy.namespace,
+          namespaceIdentityChanged: networkPolicy.namespaceIdentityChanged,
+          seccomp: networkPolicy.seccomp,
+        });
+      }
       runtimeProbe = {
         kind: plan.runtimeProbe.kind,
         attempted: plan.runtimeProbe.attempted,
@@ -708,6 +1289,56 @@ class ProcessExecutionBroker extends EventEmitter {
             }
           : {}),
       };
+      for (const field of [
+        "pluginTreeContentSnapshot",
+        ...pluginTreeEvidenceFields,
+      ]) {
+        if (plan.runtimeProbe[field] !== undefined) {
+          runtimeProbe[field] = plan.runtimeProbe[field];
+        }
+      }
+      for (const field of [
+        ...supervisorStringFields,
+        ...supervisorBooleanFields,
+      ]) {
+        if (plan.runtimeProbe[field] !== undefined) {
+          runtimeProbe[field] = plan.runtimeProbe[field];
+        }
+      }
+      for (const field of [
+        "initialDynamicLoadClosureDescriptorBound",
+        ...initialDynamicEvidenceFields,
+      ]) {
+        if (plan.runtimeProbe[field] !== undefined) {
+          runtimeProbe[field] = plan.runtimeProbe[field];
+        }
+      }
+      for (const field of genericWorkspaceEvidenceFields) {
+        if (plan.runtimeProbe[field] !== undefined) {
+          runtimeProbe[field] = plan.runtimeProbe[field];
+        }
+      }
+      if (supervisorIdentity !== undefined) {
+        runtimeProbe.supervisorExecutableIdentity = {
+          path: supervisorIdentity.path,
+          fileId: {
+            dev: supervisorIdentity.fileId.dev,
+            ino: supervisorIdentity.fileId.ino,
+          },
+          sha256: supervisorIdentity.sha256,
+          bytes: supervisorIdentity.bytes,
+          mtimeMs: supervisorIdentity.mtimeMs,
+          mode: supervisorIdentity.mode,
+          uid: supervisorIdentity.uid,
+          gid: supervisorIdentity.gid,
+        };
+      }
+    }
+    if (backend === "linux-bwrap-workspace" && !genericWorkspaceProbe) {
+      throw this._sandboxError(
+        "invalid_sandbox_plan",
+        "Applied Linux generic workspace plans require typed runtime evidence",
+      );
     }
     const postSpawn = plan.postSpawn || { required: false, mode: "none" };
     if (
@@ -730,6 +1361,12 @@ class ProcessExecutionBroker extends EventEmitter {
       policyAttested,
       policyDigest,
       runtimeProbe,
+      ...(sanitizedFilesystemPolicy
+        ? {
+            filesystemPolicy: sanitizedFilesystemPolicy,
+            networkPolicy: sanitizedNetworkPolicy,
+          }
+        : {}),
       postSpawn: { ...postSpawn },
     };
   }
@@ -884,6 +1521,39 @@ class ProcessExecutionBroker extends EventEmitter {
     auditEntry.sandboxPolicyAttested =
       typeof plan?.policyAttested === "boolean" ? plan.policyAttested : null;
     auditEntry.sandboxPolicyDigest = plan?.policyDigest || null;
+    const genericPolicy =
+      applied === true && plan?.backend === "linux-bwrap-workspace";
+    auditEntry.sandboxFilesystemPolicy = genericPolicy
+      ? {
+          workspaceRoot: plan.filesystemPolicy.workspaceRoot,
+          workingDirectory: plan.filesystemPolicy.workingDirectory,
+          workspaceAccess: plan.filesystemPolicy.workspaceAccess,
+          systemAccess: plan.filesystemPolicy.systemAccess,
+          undeclaredRootAccess: plan.filesystemPolicy.undeclaredRootAccess,
+          anonymousWritablePaths: [
+            ...plan.filesystemPolicy.anonymousWritablePaths,
+          ],
+          hostRootMapped: plan.filesystemPolicy.hostRootMapped,
+          hostHomeMapped: plan.filesystemPolicy.hostHomeMapped,
+          workspaceDescriptorBound:
+            plan.filesystemPolicy.workspaceDescriptorBound,
+          systemDescriptorBound: plan.filesystemPolicy.systemDescriptorBound,
+          exactEtcFileDescriptors:
+            plan.filesystemPolicy.exactEtcFileDescriptors,
+          workspaceRecursiveBind: plan.filesystemPolicy.workspaceRecursiveBind,
+          workspaceMountTopology: plan.filesystemPolicy.workspaceMountTopology,
+          mountTopologySource: plan.filesystemPolicy.mountTopologySource,
+          mountTopologyDigest: plan.filesystemPolicy.mountTopologyDigest,
+          mountTopologyAtomic: plan.filesystemPolicy.mountTopologyAtomic,
+        }
+      : null;
+    auditEntry.sandboxNetworkPolicy = genericPolicy
+      ? {
+          namespace: plan.networkPolicy.namespace,
+          namespaceIdentityChanged: plan.networkPolicy.namespaceIdentityChanged,
+          seccomp: plan.networkPolicy.seccomp,
+        }
+      : null;
     auditEntry.sandboxCandidateReason = plan?.candidateBackend
       ? plan?.reason || null
       : null;
@@ -1145,12 +1815,13 @@ class ProcessExecutionBroker extends EventEmitter {
 
   _writeRplEntry(auditEntry, status = "started", error = null) {
     const rpl = getRpl();
-    if (!rpl || !rpl.default) return;
+    if (!rpl) return;
     try {
       const traceCtx = this._getTraceContext();
-      rpl.default.append(
+      if (typeof rpl.record !== "function") return;
+      rpl.record(
+        "process.execution",
         {
-          kind: "process.execution",
           component: auditEntry.origin,
           action: "spawn",
           artifactId: auditEntry.executionId,
@@ -1171,6 +1842,15 @@ class ProcessExecutionBroker extends EventEmitter {
             policy: auditEntry.policy,
             scope: auditEntry.scope,
           },
+          sandbox: {
+            applied: auditEntry.sandboxed === true,
+            backend: auditEntry.sandboxBackend || null,
+            guarantees: [...(auditEntry.sandboxGuarantees || [])],
+            policyAttested: auditEntry.sandboxPolicyAttested === true,
+            policyDigest: auditEntry.sandboxPolicyDigest || null,
+            filesystemPolicy: auditEntry.sandboxFilesystemPolicy || null,
+            networkPolicy: auditEntry.sandboxNetworkPolicy || null,
+          },
           traceId:
             traceCtx?.traceId || auditEntry.traceId || `trace-${Date.now()}`,
           parentSpanId: traceCtx?.spanId || null,
@@ -1356,6 +2036,18 @@ class ProcessExecutionBroker extends EventEmitter {
       proc,
       sandboxPlan.cleanup,
     );
+    if (
+      sandboxPlan.applied === true &&
+      sandboxPlan.backend === "linux-bwrap-workspace" &&
+      sandboxPlan.postSpawn.required === false
+    ) {
+      // child_process.spawn() has synchronously duplicated every stdio entry
+      // into the launched bwrap process before returning. Generic workspace
+      // plans do not need a parent-side post-spawn handle, so retaining their
+      // pinned mount/seccomp descriptors until a long-lived MCP/LSP/monitor
+      // exits would turn each child into an avoidable FD leak.
+      cleanupSandbox();
+    }
     try {
       this._runPostSpawnSandbox(proc, sandboxPlan, auditEntry);
       auditEntry.pid = proc.pid;