chainlesschain 0.162.182 → 0.162.184

package/src/lib/process-execution-broker/platform-sandbox.js

@@ -4,10 +4,11 @@
  * Platform enforcement currently available:
  * - macOS: Seatbelt sandbox-exec profiles
  * - Linux: prlimit resource-limit wrapper, plus a narrow bubblewrap backend
- *   for an attested direct strict Plugin Node bin or static ELF native bin.
- *   Shells, dynamically linked binaries, broader working directories,
- *   host-writable paths, inherited descriptors, and network egress remain
- *   fail-closed.
+ *   for an attested direct strict Plugin Node bin or a narrow static/dynamic
+ *   ELF native bin. Dynamic acceptance binds PT_INTERP plus the entry's direct
+ *   DT_NEEDED names to an attested system-file set; broader loader surfaces,
+ *   shells, broader working directories, host-writable paths, inherited
+ *   descriptors, and network egress remain fail-closed.
  * - Windows: Win32 Job Object + restricted-token wrapper, with an attested
  *   zero-capability AppContainer for explicit filesystem/network boundaries
  *
@@ -25,6 +26,10 @@ import * as fs from "node:fs";
 import crypto from "node:crypto";
 import { spawnSync as nativeSpawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import {
+  applyLinuxGenericWorkspaceSandbox,
+  isLinuxGenericWorkspaceContract,
+} from "./linux-generic-bwrap-runtime.js";
 
 /**
  * Stable boundary identifiers shared by broker policies, platform plans, and
@@ -146,14 +151,38 @@ const LINUX_LDD_PATH = "/usr/bin/ldd";
 const LINUX_BWRAP_BACKEND = "linux-bwrap";
 const LINUX_BWRAP_NODE_PROBE_SENTINEL = "chainless-linux-bwrap-plugin-node-v1";
 const LINUX_BWRAP_MAX_PLUGIN_ENTRIES = 512;
-const LINUX_BWRAP_FIRST_MOUNT_FD = 3;
+const LINUX_PLUGIN_TREE_SNAPSHOT_MAX_FILES = 256;
+const LINUX_PLUGIN_TREE_SNAPSHOT_MAX_BYTES = 256 * 1024 * 1024;
+const LINUX_BWRAP_SUPERVISOR_CHILD_FD = 3;
+const LINUX_BWRAP_FIRST_MOUNT_FD = 4;
+const LINUX_BWRAP_SUPERVISOR_HIDDEN_PATH = "/run/.chainless-bwrap-supervisor";
+const LINUX_BWRAP_SUPERVISOR_BINDING_MECHANISM =
+  "pinned-child-fd3-file-consume-run-overmount-v1";
 const LINUX_ATTESTED_FILE_MAX_BYTES = 256 * 1024 * 1024;
 const LINUX_ATTESTATION_HASH_CHUNK_BYTES = 1024 * 1024;
+const LINUX_ENTRY_SNAPSHOT_MECHANISM =
+  "verified-o_tmpfile-copy-bwrap-ro-bind-data-v1";
+const LINUX_ENTRY_SNAPSHOT_SOURCE_MODE = 0o400;
+const LINUX_NODE_ENTRY_SNAPSHOT_SCOPE = "plugin-entry-source";
+const LINUX_NATIVE_ENTRY_SNAPSHOT_SCOPE = "plugin-entry-executable";
+const LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE = "all-pinned-plugin-regular-files";
+const LINUX_NODE_PLUGIN_TREE_SNAPSHOT_CONSISTENCY = "per-file-pin-to-launch";
+const LINUX_NODE_ENTRY_SNAPSHOT_TARGET_MODE = "0400";
+const LINUX_NATIVE_ENTRY_SNAPSHOT_TARGET_MODE = "0500";
 const LINUX_ELF64_HEADER_BYTES = 64;
 const LINUX_ELF64_PROGRAM_HEADER_BYTES = 56;
 const LINUX_ELF64_DYNAMIC_ENTRY_BYTES = 16;
 const LINUX_ELF_MAX_PROGRAM_HEADERS = 128;
 const LINUX_ELF_MAX_DYNAMIC_ENTRIES = 4096;
+const LINUX_ELF_MAX_NEEDED_ENTRIES = 128;
+const LINUX_ELF_MAX_INTERPRETER_BYTES = 4096;
+const LINUX_ELF_MAX_STRING_TABLE_BYTES = 1024 * 1024;
+const LINUX_AUXV_ENTRY_BYTES = 16;
+const LINUX_AUXV_MAX_BYTES = 64 * 1024;
+const LINUX_AUXV_PAGE_SIZE = 6n;
+const LINUX_MIN_RUNTIME_PAGE_BYTES = 4096;
+const LINUX_MAX_RUNTIME_PAGE_BYTES = 1024 * 1024;
+const LINUX_ELF_MAX_UINT64 = (1n << 64n) - 1n;
 const LINUX_ELF_TYPE_EXEC = 2;
 const LINUX_ELF_TYPE_DYN = 3;
 const LINUX_ELF_PROGRAM_LOAD = 1;
@@ -162,8 +191,24 @@ const LINUX_ELF_PROGRAM_INTERP = 3;
 const LINUX_ELF_PROGRAM_GNU_STACK = 0x6474e551;
 const LINUX_ELF_DYNAMIC_NULL = 0n;
 const LINUX_ELF_DYNAMIC_NEEDED = 1n;
+const LINUX_ELF_DYNAMIC_STRTAB = 5n;
+const LINUX_ELF_DYNAMIC_STRSZ = 10n;
+const LINUX_ELF_DYNAMIC_RPATH = 15n;
+const LINUX_ELF_DYNAMIC_TEXTREL = 22n;
+const LINUX_ELF_DYNAMIC_FLAGS = 30n;
+const LINUX_ELF_DYNAMIC_RUNPATH = 29n;
+const LINUX_ELF_DYNAMIC_CONFIG = 0x6ffffefan;
+const LINUX_ELF_DYNAMIC_DEPAUDIT = 0x6ffffefbn;
+const LINUX_ELF_DYNAMIC_AUDIT = 0x6ffffefcn;
 const LINUX_ELF_DYNAMIC_FLAGS_1 = 0x6ffffffbn;
+const LINUX_ELF_DYNAMIC_AUXILIARY = 0x7ffffffdn;
+const LINUX_ELF_DYNAMIC_FILTER = 0x7fffffffn;
+const LINUX_ELF_DYNAMIC_FLAG_TEXTREL = 0x4n;
 const LINUX_ELF_DYNAMIC_FLAG_PIE = 0x08000000n;
+const LINUX_NATIVE_DYNAMIC_DIRECT_SYSTEM_SET_SCOPE =
+  "initial-pt_interp-and-direct-dt_needed-attested-system-set";
+const LINUX_NATIVE_DYNAMIC_DIRECT_SYSTEM_SET_MECHANISM =
+  "parsed-elf-direct-system-set-to-attested-node-runtime-fds-v1";
 const LINUX_ELF_MACHINES = Object.freeze({
   x64: 62,
   arm64: 183,
@@ -2582,18 +2627,131 @@ function linuxBubblewrapProbe(
   runnable,
   reason,
   targetRuntime = "node",
+  contentSnapshot = null,
+  supervisorBinding = null,
+  pluginTreeSnapshot = null,
+  nativeDynamicClosure = null,
 ) {
-  const native = targetRuntime === "native-static-elf";
+  const native =
+    typeof targetRuntime === "string" && targetRuntime.startsWith("native-");
+  const dynamicNative = targetRuntime === "native-dynamic-elf";
+  const expectedSnapshotScope = native
+    ? LINUX_NATIVE_ENTRY_SNAPSHOT_SCOPE
+    : LINUX_NODE_ENTRY_SNAPSHOT_SCOPE;
+  const snapshot =
+    contentSnapshot?.scope === expectedSnapshotScope &&
+    contentSnapshot?.mechanism === LINUX_ENTRY_SNAPSHOT_MECHANISM;
+  const supervisorDescriptorBound =
+    supervisorBinding?.mechanism === LINUX_BWRAP_SUPERVISOR_BINDING_MECHANISM;
+  const pluginTreeContentSnapshot =
+    !native &&
+    attempted &&
+    snapshot &&
+    runnable &&
+    reason === null &&
+    supervisorDescriptorBound &&
+    pluginTreeSnapshot?.scope === LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE &&
+    pluginTreeSnapshot?.mechanism === LINUX_ENTRY_SNAPSHOT_MECHANISM &&
+    Number.isSafeInteger(pluginTreeSnapshot?.files) &&
+    pluginTreeSnapshot.files > 0 &&
+    pluginTreeSnapshot.files <= LINUX_PLUGIN_TREE_SNAPSHOT_MAX_FILES &&
+    Number.isSafeInteger(pluginTreeSnapshot?.bytes) &&
+    pluginTreeSnapshot.bytes >= 0 &&
+    pluginTreeSnapshot.bytes <= LINUX_PLUGIN_TREE_SNAPSHOT_MAX_BYTES &&
+    typeof pluginTreeSnapshot?.digest === "string" &&
+    /^[a-f0-9]{64}$/.test(pluginTreeSnapshot.digest) &&
+    pluginTreeSnapshot?.consistency ===
+      LINUX_NODE_PLUGIN_TREE_SNAPSHOT_CONSISTENCY &&
+    pluginTreeSnapshot?.contractBound === false &&
+    pluginTreeSnapshot?.atomic === false;
+  const initialDynamicLoadClosureDescriptorBound =
+    dynamicNative &&
+    attempted &&
+    snapshot &&
+    runnable &&
+    reason === null &&
+    supervisorDescriptorBound &&
+    nativeDynamicClosure?.mechanism ===
+      LINUX_NATIVE_DYNAMIC_DIRECT_SYSTEM_SET_MECHANISM &&
+    nativeDynamicClosure?.scope ===
+      LINUX_NATIVE_DYNAMIC_DIRECT_SYSTEM_SET_SCOPE &&
+    typeof nativeDynamicClosure?.interpreter === "string" &&
+    path.posix.isAbsolute(nativeDynamicClosure.interpreter) &&
+    Number.isSafeInteger(nativeDynamicClosure?.dependencies) &&
+    nativeDynamicClosure.dependencies >= 0 &&
+    nativeDynamicClosure.dependencies <= LINUX_ELF_MAX_NEEDED_ENTRIES &&
+    Number.isSafeInteger(nativeDynamicClosure?.files) &&
+    nativeDynamicClosure.files >= 1 &&
+    typeof nativeDynamicClosure?.digest === "string" &&
+    /^[a-f0-9]{64}$/.test(nativeDynamicClosure.digest);
   return {
-    kind: native
-      ? "linux-bwrap-plugin-native-static-elf-policy-v1"
-      : "linux-bwrap-plugin-node-policy-v1",
+    kind: dynamicNative
+      ? "linux-bwrap-plugin-native-dynamic-elf-policy-v1"
+      : targetRuntime === "native-static-elf"
+        ? "linux-bwrap-plugin-native-static-elf-policy-v1"
+        : native
+          ? "linux-bwrap-plugin-native-elf-policy-v1"
+          : "linux-bwrap-plugin-node-policy-v1",
     attempted,
     runnable,
     reason,
     probeRuntime: "node",
     targetRuntime,
-    contentSnapshot: false,
+    contentSnapshot: snapshot,
+    ...(snapshot
+      ? {
+          contentSnapshotScope: contentSnapshot.scope,
+          contentSnapshotMechanism: contentSnapshot.mechanism,
+        }
+      : {}),
+    ...(pluginTreeContentSnapshot
+      ? {
+          pluginTreeContentSnapshot: true,
+          pluginTreeContentSnapshotScope: pluginTreeSnapshot.scope,
+          pluginTreeContentSnapshotMechanism: pluginTreeSnapshot.mechanism,
+          pluginTreeContentSnapshotFiles: pluginTreeSnapshot.files,
+          pluginTreeContentSnapshotBytes: pluginTreeSnapshot.bytes,
+          pluginTreeContentSnapshotDigest: pluginTreeSnapshot.digest,
+          pluginTreeSnapshotConsistency: pluginTreeSnapshot.consistency,
+          pluginTreeSnapshotContractBound: pluginTreeSnapshot.contractBound,
+          pluginTreeSnapshotAtomic: pluginTreeSnapshot.atomic,
+        }
+      : {}),
+    ...(initialDynamicLoadClosureDescriptorBound
+      ? {
+          initialDynamicLoadClosureDescriptorBound: true,
+          initialDynamicLoadClosureScope: nativeDynamicClosure.scope,
+          initialDynamicLoadClosureMechanism: nativeDynamicClosure.mechanism,
+          initialDynamicInterpreter: nativeDynamicClosure.interpreter,
+          initialDynamicDependencyCount: nativeDynamicClosure.dependencies,
+          initialDynamicRuntimeFileCount: nativeDynamicClosure.files,
+          initialDynamicLoadClosureDigest: nativeDynamicClosure.digest,
+        }
+      : {}),
+    supervisorDescriptorBound,
+    ...(supervisorDescriptorBound
+      ? {
+          supervisorExecutablePinned: true,
+          supervisorBindingScope: supervisorBinding.scope,
+          supervisorDescriptorBindingMechanism: supervisorBinding.mechanism,
+          supervisorDescriptorContained: runnable,
+          supervisorDescriptorConsumedBeforeTarget: runnable,
+          supervisorStagingPathHidden: runnable,
+          supervisorTemporaryCopyObscured: runnable,
+          supervisorPid1ExecutableExposure:
+            supervisorBinding.pid1ExecutableExposure,
+          supervisorExecutableIdentity: {
+            path: supervisorBinding.path,
+            fileId: supervisorBinding.fileId,
+            sha256: supervisorBinding.sha256,
+            bytes: supervisorBinding.bytes,
+            mtimeMs: supervisorBinding.mtimeMs,
+            mode: supervisorBinding.mode,
+            uid: supervisorBinding.uid,
+            gid: supervisorBinding.gid,
+          },
+        }
+      : {}),
     handleAtomic: false,
   };
 }
@@ -2836,7 +2994,7 @@ function assignLinuxMountChildFds(mounts) {
 function linuxStdioWithPinnedMounts(
   stdio,
   descriptors,
-  { probe = false } = {},
+  { probe = false, supervisorFd = null } = {},
 ) {
   let standard;
   if (probe) {
@@ -2849,8 +3007,10 @@ function linuxStdioWithPinnedMounts(
     standard = ["pipe", "pipe", "pipe"];
   }
   while (standard.length < 3) standard.push(undefined);
+  const supervisor = Number.isInteger(supervisorFd) ? [supervisorFd] : [];
   return [
     ...standard.slice(0, 3),
+    ...supervisor,
     ...descriptors.map((descriptor) => descriptor.fd),
   ];
 }
@@ -2862,10 +3022,16 @@ function validateLinuxPluginContract(
   contract,
   runtime,
   sync,
+  { sealedEntry = false } = {},
 ) {
   const nodeContract = contract?.kind === "strict-plugin-node-bin";
-  const nativeContract =
+  const legacyStaticNativeContract =
     contract?.kind === "strict-plugin-native-static-elf-bin";
+  const nativeContract =
+    legacyStaticNativeContract ||
+    contract?.kind === "strict-plugin-native-elf-bin";
+  const entryIsSealed =
+    (nodeContract || nativeContract) && sealedEntry === true;
   if (
     !contract ||
     contract.contractVersion !== 1 ||
@@ -2973,9 +3139,10 @@ function validateLinuxPluginContract(
   }
   if (
     !linuxDirectoryIdentityMatches(runtime, contract.rootIdentity) ||
-    !linuxIdentityMatches(runtime, contract.entryIdentity, {
-      executable: nativeContract,
-    }) ||
+    (!entryIsSealed &&
+      !linuxIdentityMatches(runtime, contract.entryIdentity, {
+        executable: nativeContract,
+      })) ||
     !linuxIdentityMatches(runtime, contract.runtimeIdentity, {
       executable: true,
     })
@@ -2983,18 +3150,24 @@ function validateLinuxPluginContract(
     return { ok: false, reason: "execution_identity_changed" };
   }
   let entryFormat = null;
-  if (nativeContract) {
+  if (nativeContract && !entryIsSealed) {
     try {
-      entryFormat = inspectLinuxStaticNativePath(
-        runtime,
-        contract.entryIdentity,
-      );
+      entryFormat = inspectLinuxNativePath(runtime, contract.entryIdentity);
     } catch (error) {
       return {
         ok: false,
         reason: error.message || "native_entry_unattested",
       };
     }
+    if (
+      legacyStaticNativeContract &&
+      entryFormat.runtime !== "native-static-elf"
+    ) {
+      return {
+        ok: false,
+        reason: "native_entry_dynamic_contract_required",
+      };
+    }
   }
   if (
     !validateLinuxPluginTree(runtime, contract.pluginRoot) ||
@@ -3005,7 +3178,12 @@ function validateLinuxPluginContract(
   return {
     ok: true,
     contract,
-    entryRuntime: nativeContract ? "native-static-elf" : "node",
+    entryRuntime: nativeContract
+      ? entryFormat?.runtime ||
+        (legacyStaticNativeContract
+          ? "native-static-elf"
+          : "native-unclassified")
+      : "node",
     entryFormat,
   };
 }
@@ -3073,18 +3251,663 @@ function hashLinuxOpenFile(runtime, fd, bytes) {
   return digest.digest("hex");
 }
 
+function linuxEntrySnapshotContract(targetRuntime) {
+  if (targetRuntime?.startsWith("native-")) {
+    return {
+      scope: LINUX_NATIVE_ENTRY_SNAPSHOT_SCOPE,
+      targetMode: LINUX_NATIVE_ENTRY_SNAPSHOT_TARGET_MODE,
+      minimumBytes: LINUX_ELF64_HEADER_BYTES,
+      errorPrefix: "native_entry_snapshot",
+    };
+  }
+  if (targetRuntime === "node") {
+    return {
+      scope: LINUX_NODE_ENTRY_SNAPSHOT_SCOPE,
+      targetMode: LINUX_NODE_ENTRY_SNAPSHOT_TARGET_MODE,
+      minimumBytes: 0,
+      errorPrefix: "node_entry_snapshot",
+    };
+  }
+  throw new Error("entry_snapshot_runtime_unsupported");
+}
+
+function linuxNodePluginTreeFileSnapshotContract(sourceMode) {
+  if (!Number.isSafeInteger(sourceMode) || sourceMode < 0) {
+    throw new Error("node_plugin_tree_snapshot_source_mode_invalid");
+  }
+  return {
+    scope: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE,
+    targetMode: (sourceMode & 0o111) !== 0 ? "0500" : "0400",
+    minimumBytes: 0,
+    errorPrefix: "node_plugin_tree_snapshot",
+  };
+}
+
+function createLinuxRegularFileSnapshot(
+  runtime,
+  entryMount,
+  entryIdentity,
+  snapshotContract,
+) {
+  let writerFd;
+  let probeFd;
+  let finalFd;
+  try {
+    if (
+      !snapshotContract ||
+      typeof snapshotContract.scope !== "string" ||
+      typeof snapshotContract.targetMode !== "string" ||
+      !Number.isSafeInteger(snapshotContract.minimumBytes) ||
+      typeof snapshotContract.errorPrefix !== "string"
+    ) {
+      throw new Error("file_snapshot_contract_invalid");
+    }
+    const snapshotError = (reason) =>
+      new Error(`${snapshotContract.errorPrefix}_${reason}`);
+    const expectedSha256 = entryIdentity?.sha256 ?? null;
+    for (const method of [
+      "openSync",
+      "readSync",
+      "writeSync",
+      "fchmodSync",
+      "fsyncSync",
+      "fstatSync",
+      "closeSync",
+    ]) {
+      if (typeof runtime.fs[method] !== "function") {
+        throw snapshotError(`${method}_unavailable`);
+      }
+    }
+    if (
+      !Number.isInteger(entryMount?.fd) ||
+      !entryIdentity ||
+      (expectedSha256 !== null &&
+        (typeof expectedSha256 !== "string" ||
+          !/^[a-f0-9]{64}$/.test(expectedSha256))) ||
+      !Number.isSafeInteger(entryIdentity.bytes) ||
+      entryIdentity.bytes < snapshotContract.minimumBytes ||
+      entryIdentity.bytes > LINUX_ATTESTED_FILE_MAX_BYTES
+    ) {
+      throw snapshotError("identity_invalid");
+    }
+
+    const sourceBefore = runtime.fs.fstatSync(entryMount.fd);
+    const sourceFileMode = Number(sourceBefore.mode) & 0o7777;
+    if (
+      !sourceBefore.isFile() ||
+      Number(sourceBefore.nlink) !== 1 ||
+      String(sourceBefore.dev) !== String(entryIdentity.fileId?.dev) ||
+      String(sourceBefore.ino) !== String(entryIdentity.fileId?.ino) ||
+      Number(sourceBefore.size) !== entryIdentity.bytes ||
+      Number(sourceBefore.mtimeMs) !== Number(entryIdentity.mtimeMs)
+    ) {
+      throw snapshotError("source_changed");
+    }
+    if (
+      snapshotContract.scope === LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE &&
+      snapshotContract.targetMode !==
+        linuxNodePluginTreeFileSnapshotContract(sourceFileMode).targetMode
+    ) {
+      throw snapshotError("source_mode_changed");
+    }
+    if (
+      snapshotContract.scope === LINUX_NATIVE_ENTRY_SNAPSHOT_SCOPE &&
+      (sourceFileMode & 0o111) === 0
+    ) {
+      throw snapshotError("source_mode_changed");
+    }
+
+    const constants = runtime.fs.constants || fs.constants;
+    const writerFlags =
+      Number(constants.O_RDWR) |
+      Number(constants.O_EXCL) |
+      Number(constants.O_TMPFILE ?? LINUX_O_TMPFILE) |
+      Number(constants.O_NOFOLLOW || 0) |
+      Number(constants.O_NONBLOCK || 0);
+    writerFd = runtime.fs.openSync(
+      "/tmp",
+      writerFlags,
+      LINUX_ENTRY_SNAPSHOT_SOURCE_MODE,
+    );
+
+    const sourceDigest = crypto.createHash("sha256");
+    const chunk = Buffer.allocUnsafe(
+      Math.max(
+        1,
+        Math.min(LINUX_ATTESTATION_HASH_CHUNK_BYTES, entryIdentity.bytes),
+      ),
+    );
+    let copied = 0;
+    while (copied < entryIdentity.bytes) {
+      const read = runtime.fs.readSync(
+        entryMount.fd,
+        chunk,
+        0,
+        Math.min(chunk.length, entryIdentity.bytes - copied),
+        copied,
+      );
+      if (read <= 0) {
+        throw snapshotError("source_ended_early");
+      }
+      sourceDigest.update(chunk.subarray(0, read));
+      let written = 0;
+      while (written < read) {
+        const count = runtime.fs.writeSync(
+          writerFd,
+          chunk,
+          written,
+          read - written,
+          copied + written,
+        );
+        if (count <= 0) {
+          throw snapshotError("write_failed");
+        }
+        written += count;
+      }
+      copied += read;
+    }
+    const sourceAfter = runtime.fs.fstatSync(entryMount.fd);
+    const sourceSha256 = sourceDigest.digest("hex");
+    if (
+      !linuxOpenStatMatches(sourceBefore, sourceAfter) ||
+      (expectedSha256 !== null && sourceSha256 !== expectedSha256)
+    ) {
+      throw snapshotError("source_changed");
+    }
+
+    runtime.fs.fsyncSync(writerFd);
+    const snapshotBeforeRead = runtime.fs.fstatSync(writerFd);
+    if (
+      !snapshotBeforeRead.isFile() ||
+      Number(snapshotBeforeRead.nlink) !== 0 ||
+      Number(snapshotBeforeRead.size) !== entryIdentity.bytes
+    ) {
+      throw snapshotError("identity_changed");
+    }
+    const snapshotSha256 = hashLinuxOpenFile(
+      runtime,
+      writerFd,
+      entryIdentity.bytes,
+    );
+    const snapshotAfterRead = runtime.fs.fstatSync(writerFd);
+    if (
+      !linuxOpenStatMatches(snapshotBeforeRead, snapshotAfterRead) ||
+      snapshotSha256 !== sourceSha256
+    ) {
+      throw snapshotError("identity_changed");
+    }
+
+    runtime.fs.fchmodSync(writerFd, LINUX_ENTRY_SNAPSHOT_SOURCE_MODE);
+    runtime.fs.fsyncSync(writerFd);
+    const sealedBeforeRead = runtime.fs.fstatSync(writerFd);
+    if (
+      !sealedBeforeRead.isFile() ||
+      Number(sealedBeforeRead.nlink) !== 0 ||
+      Number(sealedBeforeRead.size) !== entryIdentity.bytes ||
+      (Number(sealedBeforeRead.mode) & 0o777) !==
+        LINUX_ENTRY_SNAPSHOT_SOURCE_MODE
+    ) {
+      throw snapshotError("readonly_mode_unattested");
+    }
+    const sealedSha256 = hashLinuxOpenFile(
+      runtime,
+      writerFd,
+      entryIdentity.bytes,
+    );
+    const sealed = runtime.fs.fstatSync(writerFd);
+    if (
+      !linuxOpenStatMatches(sealedBeforeRead, sealed) ||
+      sealedSha256 !== sourceSha256
+    ) {
+      throw snapshotError("identity_changed");
+    }
+
+    const readerFlags =
+      Number(constants.O_RDONLY) | Number(constants.O_NONBLOCK || 0);
+    probeFd = runtime.fs.openSync(`/proc/self/fd/${writerFd}`, readerFlags);
+    finalFd = runtime.fs.openSync(`/proc/self/fd/${writerFd}`, readerFlags);
+    if (probeFd === finalFd) {
+      throw snapshotError("readers_not_independent");
+    }
+    for (const fd of [probeFd, finalFd]) {
+      const reader = runtime.fs.fstatSync(fd);
+      if (!linuxOpenStatMatches(sealed, reader)) {
+        throw snapshotError("reader_identity_changed");
+      }
+    }
+    const ownedWriterFd = writerFd;
+    writerFd = undefined;
+    runtime.fs.closeSync(ownedWriterFd);
+
+    const verifyClosedWriterSnapshot = runtime.fs.fstatSync(finalFd);
+    if (!linuxOpenStatMatches(sealed, verifyClosedWriterSnapshot)) {
+      throw snapshotError("reader_identity_changed");
+    }
+
+    const attestation = Object.freeze({
+      scope: snapshotContract.scope,
+      mechanism: LINUX_ENTRY_SNAPSHOT_MECHANISM,
+      sha256: sourceSha256,
+      bytes: entryIdentity.bytes,
+      sourceFileId: Object.freeze({
+        dev: String(entryIdentity.fileId.dev),
+        ino: String(entryIdentity.fileId.ino),
+      }),
+      sourceMtimeMs: Number(entryIdentity.mtimeMs),
+      sourceFileMode: sourceFileMode.toString(8).padStart(4, "0"),
+      sourceMode: LINUX_ENTRY_SNAPSHOT_SOURCE_MODE.toString(8).padStart(4, "0"),
+      targetMode: snapshotContract.targetMode,
+    });
+    const descriptor = (fd) => {
+      const stat = runtime.fs.fstatSync(fd);
+      return {
+        ...entryMount,
+        fd,
+        fileId: {
+          dev: String(stat.dev),
+          ino: String(stat.ino),
+        },
+        bytes: Number(stat.size),
+        mtimeMs: Number(stat.mtimeMs),
+        mountMode: "ro-bind-data",
+        mountPermissions: snapshotContract.targetMode,
+        contentSnapshot: attestation,
+        snapshotIdentity: Object.freeze({
+          sha256: sourceSha256,
+          bytes: entryIdentity.bytes,
+          fileId: Object.freeze({
+            dev: String(stat.dev),
+            ino: String(stat.ino),
+          }),
+          mtimeMs: Number(stat.mtimeMs),
+        }),
+      };
+    };
+    const result = {
+      attestation,
+      probeMount: descriptor(probeFd),
+      finalMount: descriptor(finalFd),
+    };
+    probeFd = undefined;
+    finalFd = undefined;
+    return result;
+  } catch (error) {
+    closeLinuxPinnedMounts(
+      runtime,
+      [probeFd, finalFd, writerFd]
+        .filter(Number.isInteger)
+        .map((fd) => ({ fd })),
+    );
+    throw error;
+  }
+}
+
+function createLinuxEntrySnapshot(
+  runtime,
+  entryMount,
+  entryIdentity,
+  targetRuntime,
+) {
+  return createLinuxRegularFileSnapshot(
+    runtime,
+    entryMount,
+    entryIdentity,
+    linuxEntrySnapshotContract(targetRuntime),
+  );
+}
+
+function attestLinuxRegularFileSnapshot(
+  runtime,
+  mount,
+  attestation,
+  snapshotContract,
+) {
+  const errorPrefix = snapshotContract.errorPrefix;
+  const before = runtime.fs.fstatSync(mount?.fd);
+  if (
+    attestation?.scope !== snapshotContract.scope ||
+    attestation?.mechanism !== LINUX_ENTRY_SNAPSHOT_MECHANISM ||
+    attestation?.sourceMode !==
+      LINUX_ENTRY_SNAPSHOT_SOURCE_MODE.toString(8).padStart(4, "0") ||
+    typeof attestation?.sourceFileMode !== "string" ||
+    !/^[0-7]{4}$/.test(attestation.sourceFileMode) ||
+    attestation?.targetMode !== snapshotContract.targetMode ||
+    mount?.mountMode !== "ro-bind-data" ||
+    mount?.mountPermissions !== snapshotContract.targetMode ||
+    mount?.contentSnapshot !== attestation ||
+    !before.isFile() ||
+    Number(before.nlink) !== 0 ||
+    (Number(before.mode) & 0o777) !== LINUX_ENTRY_SNAPSHOT_SOURCE_MODE ||
+    String(before.dev) !== String(mount?.snapshotIdentity?.fileId?.dev) ||
+    String(before.ino) !== String(mount?.snapshotIdentity?.fileId?.ino) ||
+    Number(before.size) !== Number(attestation?.bytes) ||
+    Number(before.size) !== Number(mount?.snapshotIdentity?.bytes) ||
+    Number(before.mtimeMs) !== Number(mount?.snapshotIdentity?.mtimeMs)
+  ) {
+    throw new Error(`${errorPrefix}_identity_changed`);
+  }
+  const sha256 = hashLinuxOpenFile(runtime, mount.fd, Number(before.size));
+  const after = runtime.fs.fstatSync(mount.fd);
+  if (
+    !linuxOpenStatMatches(before, after) ||
+    sha256 !== attestation?.sha256 ||
+    sha256 !== mount.snapshotIdentity.sha256
+  ) {
+    throw new Error(`${errorPrefix}_identity_changed`);
+  }
+}
+
+function attestLinuxEntrySnapshot(runtime, mount, attestation, targetRuntime) {
+  attestLinuxRegularFileSnapshot(
+    runtime,
+    mount,
+    attestation,
+    linuxEntrySnapshotContract(targetRuntime),
+  );
+}
+
+function buildLinuxNodePluginTreeSnapshotAttestation(mounts, entryDestination) {
+  const members = [];
+  const destinations = new Set();
+  for (const mount of mounts || []) {
+    if (!linuxPathWithin("/opt/chainless/plugin", mount?.destination)) continue;
+    if (
+      path.posix.normalize(mount.destination) !== mount.destination ||
+      destinations.has(mount.destination)
+    ) {
+      throw new Error("node_plugin_tree_snapshot_destination_invalid");
+    }
+    destinations.add(mount.destination);
+    const snapshot = mount.contentSnapshot;
+    const entry = mount.destination === entryDestination;
+    const expectedScope = entry
+      ? LINUX_NODE_ENTRY_SNAPSHOT_SCOPE
+      : LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE;
+    const sourceMode = Number.parseInt(snapshot?.sourceFileMode, 8);
+    const expectedTargetMode = entry
+      ? LINUX_NODE_ENTRY_SNAPSHOT_TARGET_MODE
+      : linuxNodePluginTreeFileSnapshotContract(sourceMode).targetMode;
+    if (
+      snapshot?.scope !== expectedScope ||
+      snapshot?.mechanism !== LINUX_ENTRY_SNAPSHOT_MECHANISM ||
+      typeof snapshot?.sha256 !== "string" ||
+      !/^[a-f0-9]{64}$/.test(snapshot.sha256) ||
+      typeof snapshot?.sourceFileId !== "object" ||
+      typeof snapshot.sourceFileId?.dev !== "string" ||
+      !/^\d+$/.test(snapshot.sourceFileId.dev) ||
+      typeof snapshot.sourceFileId?.ino !== "string" ||
+      !/^\d+$/.test(snapshot.sourceFileId.ino) ||
+      !Number.isFinite(snapshot?.sourceMtimeMs) ||
+      !Number.isSafeInteger(snapshot?.bytes) ||
+      snapshot.bytes < 0 ||
+      snapshot.bytes > LINUX_ATTESTED_FILE_MAX_BYTES ||
+      typeof snapshot?.sourceFileMode !== "string" ||
+      !/^[0-7]{4}$/.test(snapshot.sourceFileMode) ||
+      snapshot.sourceMode !==
+        LINUX_ENTRY_SNAPSHOT_SOURCE_MODE.toString(8).padStart(4, "0") ||
+      snapshot.targetMode !== expectedTargetMode ||
+      mount.mountMode !== "ro-bind-data" ||
+      mount.mountPermissions !== expectedTargetMode
+    ) {
+      throw new Error("node_plugin_tree_snapshot_member_invalid");
+    }
+    members.push({
+      destination: mount.destination,
+      sourceFileId: snapshot.sourceFileId,
+      sourceMtimeMs: snapshot.sourceMtimeMs,
+      sourceFileMode: snapshot.sourceFileMode,
+      sha256: snapshot.sha256,
+      bytes: snapshot.bytes,
+      sourceMode: snapshot.sourceMode,
+      targetMode: snapshot.targetMode,
+      scope: snapshot.scope,
+      mechanism: snapshot.mechanism,
+    });
+  }
+  members.sort((left, right) =>
+    left.destination < right.destination
+      ? -1
+      : left.destination > right.destination
+        ? 1
+        : 0,
+  );
+  if (
+    members.length < 1 ||
+    members.length > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_FILES ||
+    !members.some((member) => member.destination === entryDestination)
+  ) {
+    throw new Error("node_plugin_tree_snapshot_file_count_invalid");
+  }
+  const bytes = members.reduce((total, member) => total + member.bytes, 0);
+  if (
+    !Number.isSafeInteger(bytes) ||
+    bytes > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_BYTES
+  ) {
+    throw new Error("node_plugin_tree_snapshot_bytes_exceeded");
+  }
+  const digest = crypto
+    .createHash("sha256")
+    .update(
+      JSON.stringify({
+        version: 1,
+        scope: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE,
+        consistency: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_CONSISTENCY,
+        members,
+      }),
+    )
+    .digest("hex");
+  return Object.freeze({
+    scope: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE,
+    mechanism: LINUX_ENTRY_SNAPSHOT_MECHANISM,
+    files: members.length,
+    bytes,
+    digest,
+    consistency: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_CONSISTENCY,
+    contractBound: false,
+    atomic: false,
+  });
+}
+
+function attestLinuxNodePluginTreeSnapshot(
+  runtime,
+  mounts,
+  entryDestination,
+  expected,
+) {
+  for (const mount of mounts || []) {
+    if (!linuxPathWithin("/opt/chainless/plugin", mount?.destination)) continue;
+    const snapshot = mount.contentSnapshot;
+    const contract =
+      mount.destination === entryDestination
+        ? linuxEntrySnapshotContract("node")
+        : linuxNodePluginTreeFileSnapshotContract(
+            Number.parseInt(snapshot?.sourceFileMode, 8),
+          );
+    attestLinuxRegularFileSnapshot(runtime, mount, snapshot, contract);
+  }
+  const actual = buildLinuxNodePluginTreeSnapshotAttestation(
+    mounts,
+    entryDestination,
+  );
+  for (const field of [
+    "scope",
+    "mechanism",
+    "files",
+    "bytes",
+    "digest",
+    "consistency",
+    "contractBound",
+    "atomic",
+  ]) {
+    if (actual[field] !== expected?.[field]) {
+      throw new Error("node_plugin_tree_snapshot_identity_changed");
+    }
+  }
+}
+
+function validLinuxRuntimePageSize(value) {
+  if (
+    !Number.isSafeInteger(value) ||
+    value < LINUX_MIN_RUNTIME_PAGE_BYTES ||
+    value > LINUX_MAX_RUNTIME_PAGE_BYTES
+  ) {
+    return false;
+  }
+  const size = BigInt(value);
+  return (size & (size - 1n)) === 0n;
+}
+
+function readLinuxPageSizeFromAuxv(runtimeFs) {
+  // AT_PAGESZ is emitted by the kernel for this exact process and matches the
+  // page granularity used by the ELF loader. Avoid filesystem block sizes or
+  // an external getconf binary, neither of which is the loader contract.
+  const raw = runtimeFs.readFileSync("/proc/self/auxv");
+  const auxv = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);
+  if (
+    auxv.length < LINUX_AUXV_ENTRY_BYTES ||
+    auxv.length > LINUX_AUXV_MAX_BYTES ||
+    auxv.length % LINUX_AUXV_ENTRY_BYTES !== 0
+  ) {
+    throw new Error("linux_runtime_auxv_invalid");
+  }
+  let pageSize = null;
+  let terminated = false;
+  for (let offset = 0; offset < auxv.length; offset += LINUX_AUXV_ENTRY_BYTES) {
+    const tag = auxv.readBigUInt64LE(offset);
+    const value = auxv.readBigUInt64LE(offset + 8);
+    if (tag === 0n) {
+      terminated = true;
+      break;
+    }
+    if (tag !== LINUX_AUXV_PAGE_SIZE) continue;
+    if (pageSize !== null || value > BigInt(Number.MAX_SAFE_INTEGER)) {
+      throw new Error("linux_runtime_page_size_ambiguous");
+    }
+    pageSize = Number(value);
+  }
+  if (!terminated || !validLinuxRuntimePageSize(pageSize)) {
+    throw new Error("linux_runtime_page_size_unattested");
+  }
+  return pageSize;
+}
+
+function linuxElfRuntimePageSize(runtime) {
+  const pageSize =
+    typeof runtime.linuxPageSize === "function"
+      ? runtime.linuxPageSize()
+      : readLinuxPageSizeFromAuxv(runtime.fs);
+  if (!validLinuxRuntimePageSize(pageSize)) {
+    throw new Error("linux_runtime_page_size_unattested");
+  }
+  return BigInt(pageSize);
+}
+
+function linuxElfAlignDown(value, alignment) {
+  return value - (value % alignment);
+}
+
+function linuxElfAlignUp(value, alignment) {
+  const remainder = value % alignment;
+  return remainder === 0n ? value : value + alignment - remainder;
+}
+
+function attestLinuxElfLoadMappings(loadSegments, pageSize) {
+  // Linux maps later PT_LOAD entries with MAP_FIXED. Even disjoint byte ranges
+  // can therefore replace one another after the loader rounds them to pages.
+  // A conservative no-overlap contract keeps our file-offset parser and the
+  // in-memory dynamic-loader view identical.
+  const ranges = [];
+  for (const load of loadSegments) {
+    if (
+      load.fileOffset % pageSize !== load.virtualAddress % pageSize ||
+      (load.alignment > 1n &&
+        ((load.alignment & (load.alignment - 1n)) !== 0n ||
+          load.fileOffset % load.alignment !==
+            load.virtualAddress % load.alignment))
+    ) {
+      throw new Error("native_entry_load_segment_alignment_invalid");
+    }
+    if (
+      load.virtualAddress > LINUX_ELF_MAX_UINT64 - load.memorySize ||
+      load.virtualAddress + load.memorySize >
+        LINUX_ELF_MAX_UINT64 - (pageSize - 1n)
+    ) {
+      throw new Error("native_entry_load_segment_virtual_range_overflow");
+    }
+    if (load.memorySize === 0n) continue;
+    ranges.push({
+      start: linuxElfAlignDown(load.virtualAddress, pageSize),
+      end: linuxElfAlignUp(load.virtualAddress + load.memorySize, pageSize),
+    });
+  }
+  ranges.sort((left, right) =>
+    left.start < right.start ? -1 : left.start > right.start ? 1 : 0,
+  );
+  for (let index = 1; index < ranges.length; index += 1) {
+    if (ranges[index].start < ranges[index - 1].end) {
+      throw new Error("native_entry_load_segment_page_overlap");
+    }
+  }
+}
+
+function linuxElfVirtualRangeFileMappings(loadSegments, address, bytes) {
+  return loadSegments
+    .filter((load) => {
+      if (address < load.virtualAddress) return false;
+      const delta = address - load.virtualAddress;
+      return (
+        delta <= load.fileSize &&
+        bytes <= load.fileSize - delta &&
+        delta <= load.memorySize &&
+        bytes <= load.memorySize - delta
+      );
+    })
+    .map((load) => ({
+      load,
+      fileOffset: load.fileOffset + (address - load.virtualAddress),
+    }));
+}
+
+function readLinuxElfString(table, offset, label) {
+  if (!Number.isSafeInteger(offset) || offset < 0 || offset >= table.length) {
+    throw new Error(`native_entry_${label}_string_out_of_bounds`);
+  }
+  const end = table.indexOf(0, offset);
+  if (end < 0) {
+    throw new Error(`native_entry_${label}_string_unterminated`);
+  }
+  const bytes = table.subarray(offset, end);
+  if (bytes.length < 1 || bytes.some((value) => value < 0x21 || value > 0x7e)) {
+    throw new Error(`native_entry_${label}_string_invalid`);
+  }
+  return bytes.toString("ascii");
+}
+
+function linuxSystemDynamicPath(value) {
+  return (
+    typeof value === "string" &&
+    path.posix.isAbsolute(value) &&
+    path.posix.normalize(value) === value &&
+    !value.includes("\0") &&
+    ["/lib/", "/lib64/", "/usr/lib/", "/usr/lib64/"].some((prefix) =>
+      value.startsWith(prefix),
+    )
+  );
+}
+
 /**
- * Classify one already-pinned plugin entry without invoking it or any host
- * inspection utility. The native slice accepts conventional fully static
- * ELF64 ET_EXEC images and a narrow static-PIE-shaped ELF:
- * ET_DYN without PT_INTERP, with one bounded PT_DYNAMIC table that declares
- * PIE but no external DT_NEEDED dependency.
+ * Classify one already-pinned plugin entry without invoking it or passing it
+ * to a host inspection utility. Besides conventional fully static ET_EXEC and
+ * static-PIE-shaped ET_DYN images, the parser can describe a narrow dynamic
+ * executable. The caller must separately prove that its PT_INTERP and every
+ * direct DT_NEEDED member are present in a pinned, attested system-file set.
  */
-function inspectLinuxStaticNativeElf(runtime, fd, identity) {
+function inspectLinuxNativeElf(runtime, fd, identity) {
   const expectedMachine = LINUX_ELF_MACHINES[runtime.arch];
   if (!expectedMachine) {
     throw new Error(`unsupported_elf_architecture:${String(runtime.arch)}`);
   }
+  const runtimePageSize = linuxElfRuntimePageSize(runtime);
   const before = runtime.fs.fstatSync(fd);
   if (
     !before.isFile() ||
@@ -3151,6 +3974,7 @@ function inspectLinuxStaticNativeElf(runtime, fd, identity) {
   let nonExecutableStack = false;
   const loadSegments = [];
   const dynamicSegments = [];
+  const interpreterSegments = [];
   for (let index = 0; index < programHeaderCount; index += 1) {
     const offset =
       Number(programHeaderOffset) + index * LINUX_ELF64_PROGRAM_HEADER_BYTES;
@@ -3166,6 +3990,7 @@ function inspectLinuxStaticNativeElf(runtime, fd, identity) {
     const virtualAddress = program.readBigUInt64LE(16);
     const fileSize = program.readBigUInt64LE(32);
     const memorySize = program.readBigUInt64LE(40);
+    const alignment = program.readBigUInt64LE(48);
     if (fileOffset > fileBytes || fileSize > fileBytes - fileOffset) {
       throw new Error("native_entry_segment_out_of_bounds");
     }
@@ -3173,18 +3998,21 @@ function inspectLinuxStaticNativeElf(runtime, fd, identity) {
       throw new Error("native_entry_segment_out_of_bounds");
     }
     if (type === LINUX_ELF_PROGRAM_INTERP) {
-      throw new Error("native_entry_interpreter_unsupported");
+      interpreterSegments.push({
+        flags,
+        fileOffset,
+        fileSize,
+        memorySize,
+      });
     }
     if (type === LINUX_ELF_PROGRAM_DYNAMIC) {
-      if (elfType === LINUX_ELF_TYPE_EXEC) {
-        throw new Error("native_entry_dynamic_elf_unsupported");
-      }
       dynamicSegments.push({
         flags,
         fileOffset,
         virtualAddress,
         fileSize,
         memorySize,
+        alignment,
       });
     }
     if (type === LINUX_ELF_PROGRAM_GNU_STACK) {
@@ -3200,6 +4028,7 @@ function inspectLinuxStaticNativeElf(runtime, fd, identity) {
         virtualAddress,
         fileSize,
         memorySize,
+        alignment,
       });
     }
     if (type === LINUX_ELF_PROGRAM_LOAD && (flags & 0x1) !== 0) {
@@ -3215,6 +4044,7 @@ function inspectLinuxStaticNativeElf(runtime, fd, identity) {
       }
     }
   }
+  attestLinuxElfLoadMappings(loadSegments, runtimePageSize);
   if (!executableLoad || !entryInExecutableLoad) {
     throw new Error("native_entry_has_no_executable_entry_segment");
   }
@@ -3222,23 +4052,65 @@ function inspectLinuxStaticNativeElf(runtime, fd, identity) {
     throw new Error("native_entry_nonexecutable_stack_unattested");
   }
 
-  if (elfType === LINUX_ELF_TYPE_DYN) {
+  if (interpreterSegments.length > 1) {
+    throw new Error("native_entry_interpreter_ambiguous");
+  }
+  let interpreter = null;
+  if (interpreterSegments.length === 1) {
+    const segment = interpreterSegments[0];
+    if (
+      (segment.flags & 0x3) !== 0 ||
+      segment.fileSize < 2n ||
+      segment.fileSize > BigInt(LINUX_ELF_MAX_INTERPRETER_BYTES) ||
+      segment.fileSize > segment.memorySize
+    ) {
+      throw new Error("native_entry_interpreter_invalid");
+    }
+    const contents = readLinuxFdExactly(
+      runtime,
+      fd,
+      Number(segment.fileSize),
+      Number(segment.fileOffset),
+    );
+    if (
+      contents[contents.length - 1] !== 0 ||
+      contents.indexOf(0) !== contents.length - 1
+    ) {
+      throw new Error("native_entry_interpreter_unterminated");
+    }
+    interpreter = readLinuxElfString(contents, 0, "interpreter");
+    if (!linuxSystemDynamicPath(interpreter)) {
+      throw new Error("native_entry_interpreter_outside_system_roots");
+    }
+  }
+
+  const staticPie = elfType === LINUX_ELF_TYPE_DYN && interpreter === null;
+  const dynamicExecutable = interpreter !== null;
+  let dynamicMetadata = null;
+  if (elfType === LINUX_ELF_TYPE_EXEC && !dynamicExecutable) {
+    if (dynamicSegments.length > 0) {
+      throw new Error("native_entry_dynamic_elf_unsupported");
+    }
+  } else {
+    const prefix = staticPie
+      ? "native_entry_static_pie"
+      : "native_entry_dynamic";
     if (dynamicSegments.length === 0) {
-      throw new Error("native_entry_static_pie_dynamic_segment_missing");
+      throw new Error(`${prefix}_dynamic_segment_missing`);
     }
     if (dynamicSegments.length !== 1) {
-      throw new Error("native_entry_static_pie_dynamic_segment_ambiguous");
+      throw new Error(`${prefix}_dynamic_segment_ambiguous`);
     }
     const dynamic = dynamicSegments[0];
     if ((dynamic.flags & 0x1) !== 0) {
-      throw new Error("native_entry_static_pie_dynamic_segment_executable");
+      throw new Error(`${prefix}_dynamic_segment_executable`);
     }
     if (
       dynamic.fileSize < BigInt(LINUX_ELF64_DYNAMIC_ENTRY_BYTES) ||
       dynamic.fileSize % BigInt(LINUX_ELF64_DYNAMIC_ENTRY_BYTES) !== 0n ||
       dynamic.fileSize > dynamic.memorySize
     ) {
-      throw new Error("native_entry_static_pie_dynamic_segment_invalid");
+      throw new Error(`${prefix}_dynamic_segment_invalid`);
     }
     const dynamicEntries =
       dynamic.fileSize / BigInt(LINUX_ELF64_DYNAMIC_ENTRY_BYTES);
@@ -3246,9 +4118,9 @@ function inspectLinuxStaticNativeElf(runtime, fd, identity) {
       dynamicEntries < 1n ||
       dynamicEntries > BigInt(LINUX_ELF_MAX_DYNAMIC_ENTRIES)
     ) {
-      throw new Error("native_entry_static_pie_dynamic_table_too_large");
+      throw new Error(`${prefix}_dynamic_table_too_large`);
     }
-    const containingLoad = loadSegments.find((load) => {
+    const containingLoads = loadSegments.filter((load) => {
       if (
         dynamic.fileOffset < load.fileOffset ||
         dynamic.virtualAddress < load.virtualAddress
@@ -3265,8 +4137,22 @@ function inspectLinuxStaticNativeElf(runtime, fd, identity) {
         dynamic.memorySize <= load.memorySize - memoryDelta
       );
     });
-    if (!containingLoad) {
-      throw new Error("native_entry_static_pie_dynamic_segment_unmapped");
+    if (containingLoads.length === 0) {
+      throw new Error(`${prefix}_dynamic_segment_unmapped`);
+    }
+    if (containingLoads.length !== 1) {
+      throw new Error(`${prefix}_dynamic_segment_mapping_ambiguous`);
+    }
+    const dynamicLoaderMappings = linuxElfVirtualRangeFileMappings(
+      loadSegments,
+      dynamic.virtualAddress,
+      dynamic.fileSize,
+    );
+    if (
+      dynamicLoaderMappings.length !== 1 ||
+      dynamicLoaderMappings[0].fileOffset !== dynamic.fileOffset
+    ) {
+      throw new Error(`${prefix}_dynamic_segment_loader_view_mismatch`);
     }
 
     const dynamicTable = readLinuxFdExactly(
@@ -3275,8 +4161,21 @@ function inspectLinuxStaticNativeElf(runtime, fd, identity) {
       Number(dynamic.fileSize),
       Number(dynamic.fileOffset),
     );
+    const neededOffsets = [];
+    const forbiddenDependencyTags = new Set([
+      LINUX_ELF_DYNAMIC_RPATH,
+      LINUX_ELF_DYNAMIC_RUNPATH,
+      LINUX_ELF_DYNAMIC_CONFIG,
+      LINUX_ELF_DYNAMIC_DEPAUDIT,
+      LINUX_ELF_DYNAMIC_AUDIT,
+      LINUX_ELF_DYNAMIC_AUXILIARY,
+      LINUX_ELF_DYNAMIC_FILTER,
+    ]);
     let terminated = false;
+    let flags = null;
     let flags1 = null;
+    let stringTableAddress = null;
+    let stringTableBytes = null;
     for (
       let offset = 0;
       offset < dynamicTable.length;
@@ -3288,21 +4187,113 @@ function inspectLinuxStaticNativeElf(runtime, fd, identity) {
         terminated = true;
         break;
       }
-      if (tag === LINUX_ELF_DYNAMIC_NEEDED) {
-        throw new Error("native_entry_static_pie_dependency_unsupported");
+      if (
+        tag === LINUX_ELF_DYNAMIC_TEXTREL ||
+        forbiddenDependencyTags.has(tag)
+      ) {
+        throw new Error(`${prefix}_loader_directive_unsupported`);
       }
-      if (tag === LINUX_ELF_DYNAMIC_FLAGS_1) {
-        if (flags1 !== null) {
-          throw new Error("native_entry_static_pie_flags_ambiguous");
+      if (tag === LINUX_ELF_DYNAMIC_NEEDED) {
+        neededOffsets.push(value);
+        if (neededOffsets.length > LINUX_ELF_MAX_NEEDED_ENTRIES) {
+          throw new Error(`${prefix}_dependency_count_exceeded`);
+        }
+      } else if (tag === LINUX_ELF_DYNAMIC_STRTAB) {
+        if (stringTableAddress !== null) {
+          throw new Error(`${prefix}_string_table_ambiguous`);
+        }
+        stringTableAddress = value;
+      } else if (tag === LINUX_ELF_DYNAMIC_STRSZ) {
+        if (stringTableBytes !== null) {
+          throw new Error(`${prefix}_string_table_ambiguous`);
+        }
+        stringTableBytes = value;
+      } else if (tag === LINUX_ELF_DYNAMIC_FLAGS) {
+        if (flags !== null) {
+          throw new Error(`${prefix}_flags_ambiguous`);
+        }
+        flags = value;
+      } else if (tag === LINUX_ELF_DYNAMIC_FLAGS_1) {
+        if (flags1 !== null) {
+          throw new Error(`${prefix}_flags_ambiguous`);
         }
         flags1 = value;
       }
     }
     if (!terminated) {
-      throw new Error("native_entry_static_pie_dynamic_table_unterminated");
+      throw new Error(`${prefix}_dynamic_table_unterminated`);
     }
-    if (flags1 === null || (flags1 & LINUX_ELF_DYNAMIC_FLAG_PIE) === 0n) {
-      throw new Error("native_entry_static_pie_flag_missing");
+    if (flags !== null && (flags & LINUX_ELF_DYNAMIC_FLAG_TEXTREL) !== 0n) {
+      throw new Error(`${prefix}_text_relocation_unsupported`);
+    }
+    if (
+      elfType === LINUX_ELF_TYPE_DYN &&
+      (flags1 === null || (flags1 & LINUX_ELF_DYNAMIC_FLAG_PIE) === 0n)
+    ) {
+      throw new Error(`${prefix}_flag_missing`);
+    }
+    if (staticPie && neededOffsets.length > 0) {
+      throw new Error("native_entry_static_pie_dependency_unsupported");
+    }
+
+    let needed = [];
+    if (neededOffsets.length > 0) {
+      if (
+        stringTableAddress === null ||
+        stringTableBytes === null ||
+        stringTableBytes < 1n ||
+        stringTableBytes > BigInt(LINUX_ELF_MAX_STRING_TABLE_BYTES)
+      ) {
+        throw new Error(`${prefix}_string_table_invalid`);
+      }
+      const stringTableMappings = linuxElfVirtualRangeFileMappings(
+        loadSegments,
+        stringTableAddress,
+        stringTableBytes,
+      );
+      if (stringTableMappings.length === 0) {
+        throw new Error(`${prefix}_string_table_unmapped`);
+      }
+      if (stringTableMappings.length !== 1) {
+        throw new Error(`${prefix}_string_table_mapping_ambiguous`);
+      }
+      const stringTableOffset = stringTableMappings[0].fileOffset;
+      if (stringTableOffset > BigInt(Number.MAX_SAFE_INTEGER)) {
+        throw new Error(`${prefix}_string_table_unmapped`);
+      }
+      const stringTable = readLinuxFdExactly(
+        runtime,
+        fd,
+        Number(stringTableBytes),
+        Number(stringTableOffset),
+      );
+      needed = neededOffsets.map((offset) => {
+        if (offset > BigInt(Number.MAX_SAFE_INTEGER)) {
+          throw new Error(`${prefix}_dependency_string_out_of_bounds`);
+        }
+        const name = readLinuxElfString(
+          stringTable,
+          Number(offset),
+          "dynamic_dependency",
+        );
+        if (
+          !/^[A-Za-z0-9][A-Za-z0-9._+-]{0,254}$/.test(name) ||
+          path.posix.basename(name) !== name
+        ) {
+          throw new Error("native_entry_dynamic_dependency_name_invalid");
+        }
+        return name;
+      });
+      if (new Set(needed).size !== needed.length) {
+        throw new Error("native_entry_dynamic_dependency_ambiguous");
+      }
+    }
+
+    if (dynamicExecutable) {
+      dynamicMetadata = Object.freeze({
+        interpreter,
+        needed: Object.freeze(needed),
+      });
     }
   }
 
@@ -3312,17 +4303,23 @@ function inspectLinuxStaticNativeElf(runtime, fd, identity) {
     throw new Error("native_entry_changed_during_elf_attestation");
   }
   return Object.freeze({
-    format:
-      elfType === LINUX_ELF_TYPE_DYN
+    runtime: dynamicExecutable ? "native-dynamic-elf" : "native-static-elf",
+    format: dynamicExecutable
+      ? elfType === LINUX_ELF_TYPE_DYN
+        ? "elf64-dynamic-pie-et-dyn"
+        : "elf64-dynamic-et-exec"
+      : elfType === LINUX_ELF_TYPE_DYN
         ? "elf64-static-pie-shaped-et-dyn"
         : "elf64-static-et-exec",
     architecture: runtime.arch,
     machine: expectedMachine,
+    loaderPageBytes: Number(runtimePageSize),
     programHeaders: programHeaderCount,
+    ...(dynamicMetadata || {}),
   });
 }
 
-function inspectLinuxStaticNativePath(runtime, identity) {
+function inspectLinuxNativePath(runtime, identity) {
   let fd;
   try {
     const constants = runtime.fs.constants || fs.constants;
@@ -3331,7 +4328,7 @@ function inspectLinuxStaticNativePath(runtime, identity) {
       Number(constants.O_NOFOLLOW || 0) |
       Number(constants.O_NONBLOCK || 0);
     fd = runtime.fs.openSync(identity.realPath, flags);
-    return inspectLinuxStaticNativeElf(runtime, fd, identity);
+    return inspectLinuxNativeElf(runtime, fd, identity);
   } finally {
     if (fd !== undefined) {
       try {
@@ -3355,8 +4352,12 @@ function linuxFdMountId(runtime, fd) {
 function closeLinuxPinnedMounts(runtime, mounts) {
   for (const mount of mounts || []) {
     if (!Number.isInteger(mount?.fd)) continue;
+    const fd = mount.fd;
+    // Clear ownership before close so repeated cleanup cannot close an
+    // unrelated descriptor if the OS has already reused this number.
+    mount.fd = null;
     try {
-      runtime.fs.closeSync(mount.fd);
+      runtime.fs.closeSync(fd);
     } catch {
       // Best effort. The process is already fail-closed if a pin cannot be
       // created; cleanup must not replace the original boundary error.
@@ -3706,13 +4707,209 @@ function attestLinuxBubblewrapBinary(runtime) {
   );
 }
 
-function attestLinuxBubblewrapCapabilities(runtime) {
+function linuxBubblewrapSupervisorStatValid(
+  stat,
+  { allowUnlinked = false } = {},
+) {
+  const linkCount = Number(stat?.nlink);
+  return (
+    stat?.isFile?.() === true &&
+    Number(stat.uid) === 0 &&
+    (linkCount === 1 || (allowUnlinked && linkCount === 0)) &&
+    Number(stat.size) > 0 &&
+    Number(stat.size) <= LINUX_ATTESTED_FILE_MAX_BYTES &&
+    (Number(stat.mode) & 0o111) !== 0 &&
+    (Number(stat.mode) & 0o022) === 0
+  );
+}
+
+function linuxBubblewrapPinnedStatMatches(expected, current) {
+  return (
+    linuxBubblewrapSupervisorStatValid(current, { allowUnlinked: true }) &&
+    String(expected.dev) === String(current.dev) &&
+    String(expected.ino) === String(current.ino) &&
+    Number(expected.size) === Number(current.size) &&
+    Number(expected.mtimeMs) === Number(current.mtimeMs) &&
+    Number(expected.mode) === Number(current.mode) &&
+    Number(expected.uid) === Number(current.uid) &&
+    Number(expected.gid) === Number(current.gid)
+  );
+}
+
+function pinLinuxBubblewrapSupervisor(runtime) {
+  let fd;
+  try {
+    for (const method of [
+      "openSync",
+      "readSync",
+      "fstatSync",
+      "statSync",
+      "lstatSync",
+      "closeSync",
+    ]) {
+      if (typeof runtime.fs?.[method] !== "function") {
+        throw new Error(`supervisor_${method}_unavailable`);
+      }
+    }
+    if (linuxRealpath(runtime, LINUX_BWRAP_PATH) !== LINUX_BWRAP_PATH) {
+      throw new Error("supervisor_realpath_changed");
+    }
+    const pathBefore = runtime.fs.lstatSync(LINUX_BWRAP_PATH, {
+      bigint: true,
+    });
+    if (
+      pathBefore.isSymbolicLink?.() === true ||
+      !linuxBubblewrapSupervisorStatValid(pathBefore)
+    ) {
+      throw new Error("supervisor_path_unattested");
+    }
+    const constants = runtime.fs.constants || fs.constants;
+    const flags =
+      Number(constants.O_RDONLY) |
+      Number(constants.O_NOFOLLOW || 0) |
+      Number(constants.O_NONBLOCK || 0);
+    fd = runtime.fs.openSync(LINUX_BWRAP_PATH, flags);
+    const openedBefore = runtime.fs.fstatSync(fd, { bigint: true });
+    const currentPath = runtime.fs.statSync(LINUX_BWRAP_PATH, {
+      bigint: true,
+    });
+    if (
+      !linuxBubblewrapSupervisorStatValid(openedBefore) ||
+      !linuxOpenStatMatches(pathBefore, openedBefore) ||
+      !linuxOpenStatMatches(openedBefore, currentPath)
+    ) {
+      throw new Error("supervisor_identity_changed");
+    }
+    const sha256 = hashLinuxOpenFile(runtime, fd, Number(openedBefore.size));
+    const openedAfter = runtime.fs.fstatSync(fd, { bigint: true });
+    const pathAfter = runtime.fs.statSync(LINUX_BWRAP_PATH, {
+      bigint: true,
+    });
+    if (
+      !linuxOpenStatMatches(openedBefore, openedAfter) ||
+      !linuxOpenStatMatches(openedAfter, pathAfter)
+    ) {
+      throw new Error("supervisor_identity_changed");
+    }
+    const attestation = Object.freeze({
+      path: LINUX_BWRAP_PATH,
+      fileId: Object.freeze({
+        dev: String(openedAfter.dev),
+        ino: String(openedAfter.ino),
+      }),
+      sha256,
+      bytes: Number(openedAfter.size),
+      mtimeMs: Number(openedAfter.mtimeMs),
+      mode: Number(openedAfter.mode),
+      uid: Number(openedAfter.uid),
+      gid: Number(openedAfter.gid),
+      mechanism: LINUX_BWRAP_SUPERVISOR_BINDING_MECHANISM,
+      scope: "host-path-replacement",
+      childFd: LINUX_BWRAP_SUPERVISOR_CHILD_FD,
+      consumeOperation: "file-copy-close",
+      consumePath: LINUX_BWRAP_SUPERVISOR_HIDDEN_PATH,
+      consumeMode: "0000",
+      obscuredBy: "tmpfs:/run",
+      pid1ExecutableExposure: "procfs",
+    });
+    return {
+      fd,
+      openedStat: openedAfter,
+      attestation,
+    };
+  } catch (error) {
+    if (fd !== undefined) {
+      try {
+        runtime.fs.closeSync(fd);
+      } catch {
+        // Preserve the original attestation error.
+      }
+    }
+    throw error;
+  }
+}
+
+function openLinuxBubblewrapSupervisorLaunch(runtime, supervisorPin) {
+  let fd;
+  try {
+    if (
+      !Number.isInteger(supervisorPin?.fd) ||
+      !supervisorPin.openedStat ||
+      !supervisorPin.attestation
+    ) {
+      throw new Error("supervisor_pin_missing");
+    }
+    const constants = runtime.fs.constants || fs.constants;
+    const flags =
+      Number(constants.O_RDONLY) | Number(constants.O_NONBLOCK || 0);
+    fd = runtime.fs.openSync(`/proc/self/fd/${supervisorPin.fd}`, flags);
+    const openedBefore = runtime.fs.fstatSync(fd, { bigint: true });
+    if (
+      !linuxBubblewrapPinnedStatMatches(supervisorPin.openedStat, openedBefore)
+    ) {
+      throw new Error("supervisor_launch_reader_identity_changed");
+    }
+    const sha256 = hashLinuxOpenFile(
+      runtime,
+      fd,
+      supervisorPin.attestation.bytes,
+    );
+    const openedAfter = runtime.fs.fstatSync(fd, { bigint: true });
+    if (
+      !linuxOpenStatMatches(openedBefore, openedAfter) ||
+      sha256 !== supervisorPin.attestation.sha256
+    ) {
+      throw new Error("supervisor_launch_reader_identity_changed");
+    }
+    return {
+      fd,
+      command: `/proc/self/fd/${LINUX_BWRAP_SUPERVISOR_CHILD_FD}`,
+    };
+  } catch (error) {
+    if (fd !== undefined) {
+      try {
+        runtime.fs.closeSync(fd);
+      } catch {
+        // Preserve the original launch-reader error.
+      }
+    }
+    throw error;
+  }
+}
+
+function attestLinuxBubblewrapSupervisorPin(runtime, supervisorPin) {
+  if (
+    !Number.isInteger(supervisorPin?.fd) ||
+    !supervisorPin.openedStat ||
+    !supervisorPin.attestation
+  ) {
+    throw new Error("supervisor_pin_missing");
+  }
+  const before = runtime.fs.fstatSync(supervisorPin.fd, { bigint: true });
+  if (!linuxBubblewrapPinnedStatMatches(supervisorPin.openedStat, before)) {
+    throw new Error("supervisor_identity_changed");
+  }
+  const sha256 = hashLinuxOpenFile(
+    runtime,
+    supervisorPin.fd,
+    supervisorPin.attestation.bytes,
+  );
+  const after = runtime.fs.fstatSync(supervisorPin.fd, { bigint: true });
+  if (
+    !linuxOpenStatMatches(before, after) ||
+    sha256 !== supervisorPin.attestation.sha256
+  ) {
+    throw new Error("supervisor_identity_changed");
+  }
+}
+
+function attestLinuxBubblewrapCapabilities(runtime, supervisorLaunch) {
   let result;
   try {
-    result = runtime.spawnSync(LINUX_BWRAP_PATH, ["--help"], {
+    result = runtime.spawnSync(supervisorLaunch.command, ["--help"], {
       shell: false,
       encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"],
+      stdio: ["ignore", "pipe", "pipe", supervisorLaunch.fd],
       timeout: 10_000,
       env: {
         PATH: "/usr/bin:/bin",
@@ -3727,13 +4924,18 @@ function attestLinuxBubblewrapCapabilities(runtime) {
     return { ok: false, reason: "capability_probe_failed" };
   }
   const help = `${String(result.stdout || "")}\n${String(result.stderr || "")}`;
-  for (const option of [
+  const supportedOptions = new Set(help.split(/\s+/).filter(Boolean));
+  const requiredOptions = [
+    "--file",
+    "--perms",
     "--ro-bind-fd",
+    "--ro-bind-data",
     "--disable-userns",
     "--assert-userns-disabled",
     "--seccomp",
-  ]) {
-    if (!help.includes(option)) {
+  ];
+  for (const option of requiredOptions) {
+    if (!supportedOptions.has(option)) {
       return {
         ok: false,
         reason: `required_option_missing:${option.slice(2)}`,
@@ -3861,6 +5063,87 @@ function pinLinuxRuntimeMounts(runtime, runtimeMounts, runtimeIdentity) {
   }
 }
 
+// Bind only the kernel-selected interpreter and the entry ELF's direct
+// DT_NEEDED names. This deliberately does not claim transitive or dlopen-time
+// closure; handleAtomic remains false for the wider launch chain.
+function bindLinuxNativeDynamicRuntime(entryFormat, pinnedRuntimeMounts) {
+  if (entryFormat?.runtime !== "native-dynamic-elf") return null;
+  if (
+    !linuxSystemDynamicPath(entryFormat.interpreter) ||
+    !Array.isArray(entryFormat.needed) ||
+    entryFormat.needed.length > LINUX_ELF_MAX_NEEDED_ENTRIES
+  ) {
+    throw new Error("native_dynamic_metadata_invalid");
+  }
+  const systemMounts = (pinnedRuntimeMounts || []).filter(
+    (mount) =>
+      linuxSystemDynamicPath(mount?.destination) &&
+      Number.isInteger(mount?.fd) &&
+      typeof mount?.fileId?.dev === "string" &&
+      typeof mount?.fileId?.ino === "string" &&
+      Number.isSafeInteger(mount?.bytes) &&
+      mount.bytes > 0 &&
+      Number.isFinite(mount?.mtimeMs),
+  );
+  const interpreterMount = systemMounts.find(
+    (mount) => mount.destination === entryFormat.interpreter,
+  );
+  if (!interpreterMount) {
+    throw new Error("native_dynamic_interpreter_outside_direct_system_set");
+  }
+  const selected = new Map([[interpreterMount.destination, interpreterMount]]);
+  for (const dependency of entryFormat.needed) {
+    if (
+      typeof dependency !== "string" ||
+      !/^[A-Za-z0-9][A-Za-z0-9._+-]{0,254}$/.test(dependency)
+    ) {
+      throw new Error("native_dynamic_dependency_name_invalid");
+    }
+    const matches = systemMounts.filter(
+      (mount) => path.posix.basename(mount.destination) === dependency,
+    );
+    if (matches.length === 0) {
+      throw new Error("native_dynamic_dependency_outside_direct_system_set");
+    }
+    if (matches.length !== 1) {
+      throw new Error("native_dynamic_dependency_runtime_ambiguous");
+    }
+    selected.set(matches[0].destination, matches[0]);
+  }
+  const members = [...selected.values()]
+    .map((mount) => ({
+      destination: mount.destination,
+      fileId: {
+        dev: mount.fileId.dev,
+        ino: mount.fileId.ino,
+      },
+      bytes: mount.bytes,
+      mtimeMs: mount.mtimeMs,
+    }))
+    .sort((left, right) => left.destination.localeCompare(right.destination));
+  const digest = crypto
+    .createHash("sha256")
+    .update(
+      JSON.stringify({
+        version: 1,
+        scope: LINUX_NATIVE_DYNAMIC_DIRECT_SYSTEM_SET_SCOPE,
+        mechanism: LINUX_NATIVE_DYNAMIC_DIRECT_SYSTEM_SET_MECHANISM,
+        interpreter: entryFormat.interpreter,
+        needed: [...entryFormat.needed].sort(),
+        members,
+      }),
+    )
+    .digest("hex");
+  return Object.freeze({
+    scope: LINUX_NATIVE_DYNAMIC_DIRECT_SYSTEM_SET_SCOPE,
+    mechanism: LINUX_NATIVE_DYNAMIC_DIRECT_SYSTEM_SET_MECHANISM,
+    interpreter: entryFormat.interpreter,
+    dependencies: entryFormat.needed.length,
+    files: members.length,
+    digest,
+  });
+}
+
 function linuxSandboxEnvironment() {
   return {
     HOME: "/home/sandbox",
@@ -3928,8 +5211,30 @@ function buildLinuxBubblewrapPolicyArgs(
   for (const directory of orderedDirectories) {
     args.push("--dir", directory);
   }
+  // FD 3 is also the descriptor-backed executable used to start bubblewrap.
+  // Consume and close it during setup, then obscure this staging copy with the
+  // later /run tmpfs. The target can still observe bubblewrap itself as the
+  // PID-namespace supervisor through procfs; this only contains the inherited
+  // launch descriptor and its temporary setup path.
+  args.push(
+    "--perms",
+    "0000",
+    "--file",
+    String(LINUX_BWRAP_SUPERVISOR_CHILD_FD),
+    LINUX_BWRAP_SUPERVISOR_HIDDEN_PATH,
+  );
   for (const mount of pinnedMounts) {
-    args.push("--ro-bind-fd", String(mount.childFd), mount.destination);
+    if (mount.mountMode === "ro-bind-data") {
+      args.push(
+        "--perms",
+        mount.mountPermissions,
+        "--ro-bind-data",
+        String(mount.childFd),
+        mount.destination,
+      );
+    } else {
+      args.push("--ro-bind-fd", String(mount.childFd), mount.destination);
+    }
   }
   args.push(
     "--seccomp",
@@ -3974,29 +5279,50 @@ function buildLinuxBubblewrapPolicyArgs(
 
 function probeLinuxBubblewrapPolicy(
   runtime,
+  supervisorLaunch,
+  supervisorBinding,
   policyArgs,
   pinnedDescriptors,
   targetRuntime,
+  contentSnapshot = null,
 ) {
+  const supervisorIdentity = JSON.stringify({
+    dev: supervisorBinding.fileId.dev,
+    ino: supervisorBinding.fileId.ino,
+    bytes: supervisorBinding.bytes,
+  });
+  const probeSource = [
+    'const fs = require("node:fs");',
+    `const expected = ${supervisorIdentity};`,
+    'for (const name of fs.readdirSync("/proc/self/fd")) {',
+    "  let current;",
+    "  try { current = fs.fstatSync(Number(name), { bigint: true }); } catch { continue; }",
+    "  if (String(current.dev) === expected.dev &&",
+    "      String(current.ino) === expected.ino &&",
+    "      Number(current.size) === expected.bytes) {",
+    '    throw new Error("bubblewrap supervisor descriptor leaked");',
+    "  }",
+    "}",
+    "try {",
+    `  fs.lstatSync(${JSON.stringify(LINUX_BWRAP_SUPERVISOR_HIDDEN_PATH)});`,
+    '  throw new Error("bubblewrap supervisor staging path visible");',
+    "} catch (error) {",
+    '  if (error?.code !== "ENOENT") throw error;',
+    "}",
+    `process.stdout.write(${JSON.stringify(LINUX_BWRAP_NODE_PROBE_SENTINEL)});`,
+  ].join("\n");
   let result;
   try {
     result = runtime.spawnSync(
-      LINUX_BWRAP_PATH,
-      [
-        ...policyArgs,
-        "--",
-        "/opt/chainless/runtime/node",
-        "-e",
-        `process.stdout.write(${JSON.stringify(
-          LINUX_BWRAP_NODE_PROBE_SENTINEL,
-        )})`,
-      ],
+      supervisorLaunch.command,
+      [...policyArgs, "--", "/opt/chainless/runtime/node", "-e", probeSource],
       {
         cwd: "/",
         shell: false,
         encoding: "utf8",
         stdio: linuxStdioWithPinnedMounts(null, pinnedDescriptors, {
           probe: true,
+          supervisorFd: supervisorLaunch.fd,
         }),
         timeout: 15_000,
         env: {
@@ -4012,6 +5338,8 @@ function probeLinuxBubblewrapPolicy(
       false,
       "probe_spawn_failed",
       targetRuntime,
+      contentSnapshot,
+      supervisorBinding,
     );
   }
   if (result?.error || result?.status !== 0) {
@@ -4020,6 +5348,8 @@ function probeLinuxBubblewrapPolicy(
       false,
       result?.error ? "probe_spawn_failed" : "probe_failed",
       targetRuntime,
+      contentSnapshot,
+      supervisorBinding,
     );
   }
   if (String(result.stdout) !== LINUX_BWRAP_NODE_PROBE_SENTINEL) {
@@ -4028,9 +5358,18 @@ function probeLinuxBubblewrapPolicy(
       false,
       "node_runtime_probe_failed",
       targetRuntime,
+      contentSnapshot,
+      supervisorBinding,
     );
   }
-  return linuxBubblewrapProbe(true, true, null, targetRuntime);
+  return linuxBubblewrapProbe(
+    true,
+    true,
+    null,
+    targetRuntime,
+    contentSnapshot,
+    supervisorBinding,
+  );
 }
 
 /**
@@ -4081,11 +5420,22 @@ export function applyLinuxSandbox(
   );
 
   if (requiresStrongLinuxBoundary) {
+    if (isLinuxGenericWorkspaceContract(sandboxOpts.executionContract)) {
+      return applyLinuxGenericWorkspaceSandbox(
+        command,
+        args,
+        spawnOpts,
+        sandboxOpts,
+        runtime,
+      );
+    }
     const requestedEntryRuntime =
       sandboxOpts.executionContract?.kind ===
       "strict-plugin-native-static-elf-bin"
         ? "native-static-elf"
-        : "node";
+        : sandboxOpts.executionContract?.kind === "strict-plugin-native-elf-bin"
+          ? "native-unclassified"
+          : "node";
     const validation = validateLinuxPluginContract(
       command,
       args,
@@ -4129,24 +5479,6 @@ export function applyLinuxSandbox(
         guarantees: [],
       });
     }
-    const capabilities = attestLinuxBubblewrapCapabilities(runtime);
-    if (!capabilities.ok) {
-      return createSandboxPlan({
-        ...base,
-        backend: null,
-        candidateBackend: LINUX_BWRAP_BACKEND,
-        policyAttested: false,
-        runtimeProbe: linuxBubblewrapProbe(
-          true,
-          false,
-          capabilities.reason,
-          validation.entryRuntime,
-        ),
-        reason: "linux_bwrap_unavailable",
-        guarantees: [],
-      });
-    }
-
     let runtimeMounts;
     let pinnedRuntimeMounts = [];
     try {
@@ -4176,11 +5508,42 @@ export function applyLinuxSandbox(
         guarantees: [],
       });
     }
+    let nativeDynamicClosure = null;
+    try {
+      nativeDynamicClosure = bindLinuxNativeDynamicRuntime(
+        validation.entryFormat,
+        pinnedRuntimeMounts,
+      );
+    } catch (error) {
+      closeLinuxPinnedMounts(runtime, pinnedRuntimeMounts);
+      return createSandboxPlan({
+        ...base,
+        backend: null,
+        candidateBackend: LINUX_BWRAP_BACKEND,
+        policyAttested: false,
+        runtimeProbe: linuxBubblewrapProbe(
+          false,
+          false,
+          error.message || "native_dynamic_direct_system_set_unattested",
+          validation.entryRuntime,
+        ),
+        reason: "linux_bwrap_native_runtime_unattested",
+        guarantees: [],
+      });
+    }
 
     let pinnedMounts = [];
     let pluginTree;
     let entryFormat = null;
     let entryMount;
+    const entryRelative = path.posix.relative(
+      validation.contract.pluginRoot,
+      validation.contract.entryIdentity.realPath,
+    );
+    const sandboxEntry = path.posix.join(
+      "/opt/chainless/plugin",
+      entryRelative,
+    );
     try {
       pluginTree = pinLinuxPluginTree(
         runtime,
@@ -4205,8 +5568,8 @@ export function applyLinuxSandbox(
       ) {
         throw new Error("plugin_entry_pin_mismatch");
       }
-      if (validation.entryRuntime === "native-static-elf") {
-        entryFormat = inspectLinuxStaticNativeElf(
+      if (validation.entryRuntime.startsWith("native-")) {
+        entryFormat = inspectLinuxNativeElf(
           runtime,
           entryMount.fd,
           validation.contract.entryIdentity,
@@ -4240,8 +5603,124 @@ export function applyLinuxSandbox(
       });
     }
 
+    let entrySnapshot = null;
+    let pluginTreeSnapshot = null;
+    const pluginTreeFileSnapshots = [];
+    let probePinnedMounts = pinnedMounts;
+    try {
+      const entryIndex = pinnedMounts.indexOf(entryMount);
+      if (entryIndex < 0) {
+        throw new Error("plugin_entry_pin_missing");
+      }
+      const pluginMountIndexes = pinnedMounts
+        .map((mount, index) =>
+          linuxPathWithin("/opt/chainless/plugin", mount.destination)
+            ? index
+            : -1,
+        )
+        .filter((index) => index >= 0);
+      const rawPluginMounts = pluginMountIndexes.map(
+        (index) => pinnedMounts[index],
+      );
+      if (validation.entryRuntime === "node") {
+        if (
+          pluginMountIndexes.length < 1 ||
+          pluginMountIndexes.length > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_FILES
+        ) {
+          throw new Error("node_plugin_tree_snapshot_file_count_invalid");
+        }
+        const pluginBytes = pluginMountIndexes.reduce((total, index) => {
+          const bytes = pinnedMounts[index]?.bytes;
+          if (
+            !Number.isSafeInteger(bytes) ||
+            bytes < 0 ||
+            bytes > LINUX_ATTESTED_FILE_MAX_BYTES
+          ) {
+            throw new Error("node_plugin_tree_snapshot_member_size_invalid");
+          }
+          return total + bytes;
+        }, 0);
+        if (
+          !Number.isSafeInteger(pluginBytes) ||
+          pluginBytes > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_BYTES
+        ) {
+          throw new Error("node_plugin_tree_snapshot_bytes_exceeded");
+        }
+      }
+      const rawEntryMount = entryMount;
+      const snapshot = createLinuxEntrySnapshot(
+        runtime,
+        rawEntryMount,
+        validation.contract.entryIdentity,
+        validation.entryRuntime,
+      );
+      const finalMounts = [...pinnedMounts];
+      const probeMounts = [...pinnedMounts];
+      finalMounts[entryIndex] = snapshot.finalMount;
+      probeMounts[entryIndex] = snapshot.probeMount;
+      entrySnapshot = snapshot;
+      if (validation.entryRuntime === "node") {
+        for (const index of pluginMountIndexes) {
+          if (index === entryIndex) continue;
+          const rawMount = pinnedMounts[index];
+          const source = runtime.fs.fstatSync(rawMount.fd);
+          const fileSnapshot = createLinuxRegularFileSnapshot(
+            runtime,
+            rawMount,
+            {
+              fileId: rawMount.fileId,
+              bytes: rawMount.bytes,
+              mtimeMs: rawMount.mtimeMs,
+            },
+            linuxNodePluginTreeFileSnapshotContract(Number(source.mode)),
+          );
+          pluginTreeFileSnapshots.push(fileSnapshot);
+          finalMounts[index] = fileSnapshot.finalMount;
+          probeMounts[index] = fileSnapshot.probeMount;
+        }
+        pluginTreeSnapshot = buildLinuxNodePluginTreeSnapshotAttestation(
+          finalMounts,
+          sandboxEntry,
+        );
+      }
+      pinnedMounts = finalMounts;
+      probePinnedMounts = probeMounts;
+      entryMount = entrySnapshot.finalMount;
+      closeLinuxPinnedMounts(
+        runtime,
+        validation.entryRuntime === "node" ? rawPluginMounts : [rawEntryMount],
+      );
+    } catch (error) {
+      closeLinuxPinnedMounts(runtime, pinnedMounts);
+      closeLinuxPinnedMounts(runtime, [
+        entrySnapshot?.probeMount,
+        entrySnapshot?.finalMount,
+        ...pluginTreeFileSnapshots.flatMap((snapshot) => [
+          snapshot.probeMount,
+          snapshot.finalMount,
+        ]),
+      ]);
+      return createSandboxPlan({
+        ...base,
+        backend: null,
+        candidateBackend: LINUX_BWRAP_BACKEND,
+        policyAttested: false,
+        runtimeProbe: linuxBubblewrapProbe(
+          false,
+          false,
+          error.message || "entry_snapshot_unattested",
+          validation.entryRuntime,
+        ),
+        reason: "linux_bwrap_plugin_snapshot_unattested",
+        guarantees: [],
+      });
+    }
+
     let probeSeccompFilter;
     let seccompFilter;
+    const pluginTreeProbeMounts = pluginTreeFileSnapshots.map(
+      (snapshot) => snapshot.probeMount,
+    );
     try {
       probeSeccompFilter = pinLinuxNetworkSeccompFilter(runtime);
       seccompFilter = pinLinuxNetworkSeccompFilter(runtime);
@@ -4255,7 +5734,12 @@ export function applyLinuxSandbox(
       closeLinuxPinnedMounts(runtime, pinnedMounts);
       closeLinuxPinnedMounts(
         runtime,
-        [probeSeccompFilter, seccompFilter].filter(Boolean),
+        [
+          entrySnapshot?.probeMount,
+          ...pluginTreeProbeMounts,
+          probeSeccompFilter,
+          seccompFilter,
+        ].filter(Boolean),
       );
       return createSandboxPlan({
         ...base,
@@ -4273,7 +5757,89 @@ export function applyLinuxSandbox(
       });
     }
     const pinnedDescriptors = [...pinnedMounts, seccompFilter];
-    const probeDescriptors = [...pinnedMounts, probeSeccompFilter];
+    const probeDescriptors = [...probePinnedMounts, probeSeccompFilter];
+    const closeStrongLinuxResources = (...extra) => {
+      closeLinuxPinnedMounts(runtime, [
+        ...pinnedDescriptors,
+        probeSeccompFilter,
+        entrySnapshot?.probeMount,
+        ...pluginTreeProbeMounts,
+        ...extra,
+      ]);
+    };
+    let supervisorPin;
+    let capabilityLaunch;
+    let probeLaunch;
+    let finalLaunch;
+    try {
+      supervisorPin = pinLinuxBubblewrapSupervisor(runtime);
+      capabilityLaunch = openLinuxBubblewrapSupervisorLaunch(
+        runtime,
+        supervisorPin,
+      );
+    } catch (error) {
+      closeStrongLinuxResources(supervisorPin);
+      return createSandboxPlan({
+        ...base,
+        backend: null,
+        candidateBackend: LINUX_BWRAP_BACKEND,
+        policyAttested: false,
+        runtimeProbe: linuxBubblewrapProbe(
+          false,
+          false,
+          error.message || "supervisor_descriptor_unattested",
+          validation.entryRuntime,
+        ),
+        reason: "linux_bwrap_unavailable",
+        guarantees: [],
+      });
+    }
+    const capabilities = attestLinuxBubblewrapCapabilities(
+      runtime,
+      capabilityLaunch,
+    );
+    closeLinuxPinnedMounts(runtime, [capabilityLaunch]);
+    capabilityLaunch = null;
+    if (!capabilities.ok) {
+      closeStrongLinuxResources(supervisorPin);
+      return createSandboxPlan({
+        ...base,
+        backend: null,
+        candidateBackend: LINUX_BWRAP_BACKEND,
+        policyAttested: false,
+        runtimeProbe: linuxBubblewrapProbe(
+          true,
+          false,
+          capabilities.reason,
+          validation.entryRuntime,
+          null,
+          supervisorPin.attestation,
+        ),
+        reason: "linux_bwrap_unavailable",
+        guarantees: [],
+      });
+    }
+    try {
+      probeLaunch = openLinuxBubblewrapSupervisorLaunch(runtime, supervisorPin);
+    } catch (error) {
+      closeStrongLinuxResources(supervisorPin, probeLaunch);
+      return createSandboxPlan({
+        ...base,
+        backend: null,
+        candidateBackend: LINUX_BWRAP_BACKEND,
+        policyAttested: false,
+        runtimeProbe: linuxBubblewrapProbe(
+          true,
+          false,
+          error.message || "supervisor_launch_reader_unattested",
+          validation.entryRuntime,
+          null,
+          supervisorPin.attestation,
+        ),
+        reason: "linux_bwrap_unavailable",
+        guarantees: [],
+      });
+    }
     const environment = linuxSandboxEnvironment();
     const policyArgs = buildLinuxBubblewrapPolicyArgs(
       pluginTree.directories,
@@ -4281,24 +5847,31 @@ export function applyLinuxSandbox(
       environment,
       seccompFilter,
     );
-    const entryRelative = path.posix.relative(
-      validation.contract.pluginRoot,
-      validation.contract.entryIdentity.realPath,
-    );
-    const sandboxEntry = path.posix.join(
-      "/opt/chainless/plugin",
-      entryRelative,
-    );
-    const targetArgs =
-      validation.entryRuntime === "native-static-elf"
-        ? [sandboxEntry, ...args]
-        : ["/opt/chainless/runtime/node", sandboxEntry, ...args.slice(1)];
+    const targetArgs = validation.entryRuntime.startsWith("native-")
+      ? [sandboxEntry, ...args]
+      : ["/opt/chainless/runtime/node", sandboxEntry, ...args.slice(1)];
+    const snapshotPolicyBinding = entrySnapshot
+      ? {
+          scope: entrySnapshot.attestation.scope,
+          mechanism: entrySnapshot.attestation.mechanism,
+          sourceIdentity: validation.contract.entryIdentity,
+          sha256: entrySnapshot.attestation.sha256,
+          bytes: entrySnapshot.attestation.bytes,
+          destination: sandboxEntry,
+          ...(validation.entryRuntime === "node"
+            ? { sourceFileMode: entrySnapshot.attestation.sourceFileMode }
+            : {}),
+          sourceMode: entrySnapshot.attestation.sourceMode,
+          targetMode: entrySnapshot.attestation.targetMode,
+        }
+      : null;
     const policyDigest = crypto
       .createHash("sha256")
       .update(
         JSON.stringify({
-          version: 1,
+          version: validation.entryRuntime === "node" ? 4 : 3,
           backend: LINUX_BWRAP_BACKEND,
+          supervisor: supervisorPin.attestation,
           contract: {
             kind: validation.contract.kind,
             pluginRoot: validation.contract.pluginRoot,
@@ -4308,43 +5881,79 @@ export function applyLinuxSandbox(
             entryRuntime: validation.entryRuntime,
             entryFormat,
           },
-          mounts: pinnedMounts.map((mount) => ({
-            destination: mount.destination,
-            fileId: mount.fileId,
-            bytes: mount.bytes,
-            mtimeMs: mount.mtimeMs,
-          })),
+          mounts: pinnedMounts.map((mount) =>
+            mount.contentSnapshot
+              ? {
+                  destination: mount.destination,
+                  fileId: mount.contentSnapshot.sourceFileId,
+                  bytes: mount.contentSnapshot.bytes,
+                  mtimeMs: mount.contentSnapshot.sourceMtimeMs,
+                  contentSnapshot: {
+                    scope: mount.contentSnapshot.scope,
+                    mechanism: mount.contentSnapshot.mechanism,
+                    sha256: mount.contentSnapshot.sha256,
+                    bytes: mount.contentSnapshot.bytes,
+                    ...(validation.entryRuntime === "node"
+                      ? {
+                          sourceFileMode: mount.contentSnapshot.sourceFileMode,
+                        }
+                      : {}),
+                    sourceMode: mount.contentSnapshot.sourceMode,
+                    targetMode: mount.contentSnapshot.targetMode,
+                  },
+                }
+              : {
+                  destination: mount.destination,
+                  fileId: mount.fileId,
+                  bytes: mount.bytes,
+                  mtimeMs: mount.mtimeMs,
+                },
+          ),
+          contentSnapshot: snapshotPolicyBinding,
+          ...(nativeDynamicClosure
+            ? { initialDynamicLoadClosure: nativeDynamicClosure }
+            : {}),
+          ...(validation.entryRuntime === "node"
+            ? { pluginTreeContentSnapshot: pluginTreeSnapshot }
+            : {}),
           seccomp: {
             arch: seccompFilter.arch,
             policy: seccompFilter.policy,
             sha256: seccompFilter.sha256,
           },
           policyArgs,
-          target:
-            validation.entryRuntime === "native-static-elf"
-              ? targetArgs.slice(0, 1)
-              : targetArgs.slice(0, 2),
+          target: validation.entryRuntime.startsWith("native-")
+            ? targetArgs.slice(0, 1)
+            : targetArgs.slice(0, 2),
         }),
       )
       .digest("hex");
-    const runtimeProbe = Object.freeze(
+    const policyProbe = Object.freeze(
       probeLinuxBubblewrapPolicy(
         runtime,
+        probeLaunch,
+        supervisorPin.attestation,
         policyArgs,
         probeDescriptors,
         validation.entryRuntime,
       ),
     );
-    closeLinuxPinnedMounts(runtime, [probeSeccompFilter]);
-    if (!runtimeProbe.runnable) {
-      closeLinuxPinnedMounts(runtime, pinnedDescriptors);
+    closeLinuxPinnedMounts(runtime, [
+      probeLaunch,
+      probeSeccompFilter,
+      entrySnapshot?.probeMount,
+      ...pluginTreeProbeMounts,
+    ]);
+    probeLaunch = null;
+    if (!policyProbe.runnable) {
+      closeStrongLinuxResources(supervisorPin, finalLaunch);
       return createSandboxPlan({
         ...base,
         backend: null,
         candidateBackend: LINUX_BWRAP_BACKEND,
         policyAttested: false,
         policyDigest,
-        runtimeProbe,
+        runtimeProbe: policyProbe,
         reason: "linux_bwrap_policy_probe_failed",
         guarantees: [],
       });
@@ -4356,9 +5965,10 @@ export function applyLinuxSandbox(
       validation.contract,
       runtime,
       sandboxOpts.sync,
+      { sealedEntry: entrySnapshot !== null },
     );
     if (!finalValidation.ok) {
-      closeLinuxPinnedMounts(runtime, pinnedDescriptors);
+      closeStrongLinuxResources(supervisorPin, finalLaunch);
       return createSandboxPlan({
         ...base,
         backend: null,
@@ -4370,46 +5980,108 @@ export function applyLinuxSandbox(
           false,
           `post_probe_${finalValidation.reason}`,
           validation.entryRuntime,
+          null,
+          supervisorPin.attestation,
         ),
         reason: "linux_bwrap_execution_contract_changed",
         guarantees: [],
       });
     }
-    if (validation.entryRuntime === "native-static-elf") {
-      try {
-        const finalEntryFormat = inspectLinuxStaticNativeElf(
+    try {
+      if (validation.entryRuntime === "node") {
+        attestLinuxNodePluginTreeSnapshot(
           runtime,
-          entryMount.fd,
-          validation.contract.entryIdentity,
+          pinnedMounts,
+          sandboxEntry,
+          pluginTreeSnapshot,
+        );
+      } else {
+        attestLinuxEntrySnapshot(
+          runtime,
+          entryMount,
+          entrySnapshot.attestation,
+          validation.entryRuntime,
         );
-        if (JSON.stringify(finalEntryFormat) !== JSON.stringify(entryFormat)) {
-          throw new Error("native_entry_format_changed");
-        }
-        if (
-          JSON.stringify(finalValidation.entryFormat) !==
-          JSON.stringify(entryFormat)
-        ) {
-          throw new Error("native_entry_path_format_changed");
-        }
-      } catch (error) {
-        closeLinuxPinnedMounts(runtime, pinnedDescriptors);
-        return createSandboxPlan({
-          ...base,
-          backend: null,
-          candidateBackend: LINUX_BWRAP_BACKEND,
-          policyAttested: false,
-          policyDigest,
-          runtimeProbe: linuxBubblewrapProbe(
-            true,
-            false,
-            `post_probe_${error.message || "native_entry_changed"}`,
-            validation.entryRuntime,
-          ),
-          reason: "linux_bwrap_execution_contract_changed",
-          guarantees: [],
-        });
       }
+    } catch (error) {
+      closeStrongLinuxResources(supervisorPin, finalLaunch);
+      return createSandboxPlan({
+        ...base,
+        backend: null,
+        candidateBackend: LINUX_BWRAP_BACKEND,
+        policyAttested: false,
+        policyDigest,
+        runtimeProbe: linuxBubblewrapProbe(
+          true,
+          false,
+          `post_probe_${error.message || "entry_snapshot_changed"}`,
+          validation.entryRuntime,
+          null,
+          supervisorPin.attestation,
+        ),
+        reason: "linux_bwrap_execution_contract_changed",
+        guarantees: [],
+      });
+    }
+    try {
+      attestLinuxBubblewrapSupervisorPin(runtime, supervisorPin);
+    } catch (error) {
+      closeStrongLinuxResources(supervisorPin, finalLaunch);
+      return createSandboxPlan({
+        ...base,
+        backend: null,
+        candidateBackend: LINUX_BWRAP_BACKEND,
+        policyAttested: false,
+        policyDigest,
+        runtimeProbe: linuxBubblewrapProbe(
+          true,
+          false,
+          `post_probe_${error.message || "supervisor_identity_changed"}`,
+          validation.entryRuntime,
+          null,
+          supervisorPin.attestation,
+        ),
+        reason: "linux_bwrap_execution_contract_changed",
+        guarantees: [],
+      });
     }
+    try {
+      finalLaunch = openLinuxBubblewrapSupervisorLaunch(runtime, supervisorPin);
+    } catch (error) {
+      closeStrongLinuxResources(supervisorPin, finalLaunch);
+      return createSandboxPlan({
+        ...base,
+        backend: null,
+        candidateBackend: LINUX_BWRAP_BACKEND,
+        policyAttested: false,
+        policyDigest,
+        runtimeProbe: linuxBubblewrapProbe(
+          true,
+          false,
+          `post_probe_${error.message || "supervisor_launch_reader_unattested"}`,
+          validation.entryRuntime,
+          null,
+          supervisorPin.attestation,
+        ),
+        reason: "linux_bwrap_execution_contract_changed",
+        guarantees: [],
+      });
+    }
+    const supervisorBinding = supervisorPin.attestation;
+    closeLinuxPinnedMounts(runtime, [supervisorPin]);
+    supervisorPin = null;
+    const runtimeProbe = Object.freeze(
+      linuxBubblewrapProbe(
+        true,
+        true,
+        null,
+        validation.entryRuntime,
+        entrySnapshot?.attestation,
+        supervisorBinding,
+        pluginTreeSnapshot,
+        nativeDynamicClosure,
+      ),
+    );
     const options = {
       ...spawnOpts,
       cwd: "/",
@@ -4421,14 +6093,16 @@ export function applyLinuxSandbox(
         LC_ALL: "C",
       },
       stdio: Object.freeze(
-        linuxStdioWithPinnedMounts(spawnOpts?.stdio, pinnedDescriptors),
+        linuxStdioWithPinnedMounts(spawnOpts?.stdio, pinnedDescriptors, {
+          supervisorFd: finalLaunch.fd,
+        }),
       ),
     };
     let pinsClosed = false;
     const cleanup = () => {
       if (pinsClosed) return;
       pinsClosed = true;
-      closeLinuxPinnedMounts(runtime, pinnedDescriptors);
+      closeLinuxPinnedMounts(runtime, [...pinnedDescriptors, finalLaunch]);
     };
     return createSandboxPlan({
       ...base,
@@ -4441,7 +6115,7 @@ export function applyLinuxSandbox(
       runtimeProbe,
       reason: null,
       guarantees: [SANDBOX_BOUNDARIES.FILESYSTEM, SANDBOX_BOUNDARIES.NETWORK],
-      command: LINUX_BWRAP_PATH,
+      command: finalLaunch.command,
       args: [...policyArgs, "--", ...targetArgs],
       options,
       cleanup,