chainlesschain 0.163.1 → 0.163.3

package/src/lib/process-execution-broker/platform-sandbox.js

@@ -108,6 +108,13 @@ const WINDOWS_APPCONTAINER_BACKEND =
   "windows-appcontainer-job-restricted-token";
 const MCP_STDIO_CAPSULE_SANDBOX_CONTRACT_KIND = "strict-mcp-node-capsule";
 const WINDOWS_ADAPTER_IDLE_TTL_MS = 60_000;
+const WINDOWS_ADAPTER_HELPER_NAME = "windows-sandbox-helper.exe";
+const WINDOWS_ADAPTER_IDLE_TTL_ENV = "CC_WINDOWS_SANDBOX_ADAPTER_IDLE_TTL_MS";
+const WINDOWS_ADAPTER_TEMP_ROOT_ENV = "CC_WINDOWS_SANDBOX_ADAPTER_TEMP_ROOT";
+const WINDOWS_ADAPTER_TEMP_ROOT_UNTRUSTED_REASON =
+  "windows_adapter_temp_root_untrusted";
+const WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON =
+  "windows_adapter_temp_root_changed";
 // Every native helper operation starts a trusted System32 PowerShell host and
 // byte-loads the checked-in assembly. Hosted Windows runners can spend well
 // over ten seconds in that bootstrap before the managed operation begins.
@@ -169,11 +176,18 @@ const LINUX_EXECUTABLE_SNAPSHOT_SOURCE_MODE = 0o500;
 const LINUX_MCP_CAPSULE_BACKEND = "linux-fd-code-snapshot";
 const LINUX_MCP_RUNTIME_SNAPSHOT_SCOPE = "mcp-node-runtime-executable";
 const LINUX_MCP_CAPSULE_SNAPSHOT_MECHANISM =
-  "verified-o_tmpfile-copy-inherited-fd-exec-v1";
+  "verified-o_tmpfile-copy-inherited-fd-module-compile-v1";
+const MACOS_MCP_CAPSULE_BACKEND = "macos-fd-code-snapshot";
+export const MCP_STDIO_FD_ENTRY_BOOTSTRAP =
+  'const fs=require("node:fs");const Module=require("node:module");const filename="/chainlesschain/mcp-capsule.cjs";const source=fs.readFileSync(4,"utf8");process.argv.splice(1,0,filename);const target=new Module(filename,module);target.filename=filename;target.paths=[];target._compile(source,filename);';
+export const MCP_STDIO_FD_ENTRY_BOOTSTRAP_SHA256 = crypto
+  .createHash("sha256")
+  .update(MCP_STDIO_FD_ENTRY_BOOTSTRAP)
+  .digest("hex");
 const LINUX_NODE_ENTRY_SNAPSHOT_SCOPE = "plugin-entry-source";
 const LINUX_NATIVE_ENTRY_SNAPSHOT_SCOPE = "plugin-entry-executable";
-const LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE = "all-pinned-plugin-regular-files";
-const LINUX_NODE_PLUGIN_TREE_SNAPSHOT_CONSISTENCY = "per-file-pin-to-launch";
+const LINUX_PLUGIN_TREE_SNAPSHOT_SCOPE = "all-pinned-plugin-regular-files";
+const LINUX_PLUGIN_TREE_SNAPSHOT_CONSISTENCY = "per-file-pin-to-launch";
 const LINUX_NODE_ENTRY_SNAPSHOT_TARGET_MODE = "0400";
 const LINUX_NATIVE_ENTRY_SNAPSHOT_TARGET_MODE = "0500";
 const LINUX_ELF64_HEADER_BYTES = 64;
@@ -283,6 +297,14 @@ const windowsAdapterCacheEntries = new Set();
 const windowsTemporaryCleanupBacklog = new Set();
 let windowsTemporaryCleanupRetryTimer = null;
 const windowsAppContainerCleanupBacklog = new Set();
+const issuedWindowsMcpCodeSnapshotPlans = new WeakMap();
+// Only the unified production adapter can register a Windows MCP launch
+// capability. Direct callers of the exported platform-specific helper (and
+// callers that inject a test/runtime facade into applySandbox) may exercise
+// plan construction, but cannot mint a Broker-admissible capability.
+const WINDOWS_MCP_CODE_SNAPSHOT_ISSUER = Symbol(
+  "windows-mcp-code-snapshot-issuer",
+);
 // Each AppContainer retry starts a synchronous, digest-attested PowerShell
 // helper. Bound automatic retries so a permanently unsupported Windows host
 // cannot repeatedly block a long-lived CLI; explicit cleanup/reset and process
@@ -296,6 +318,325 @@ function resolveRuntime(overrides = {}) {
   return { ...DEFAULT_RUNTIME, ...overrides };
 }
 
+function windowsNativeRealpath(runtime, candidate) {
+  const nativeRealpath = runtime.fs.realpathSync?.native;
+  if (typeof nativeRealpath !== "function") {
+    throw new Error("Native Windows realpath is unavailable");
+  }
+  const nativePath = nativeRealpath.call(runtime.fs, candidate);
+  const withoutExtendedPrefix = String(nativePath).replace(
+    /^\\\\\?\\(?=[A-Za-z]:\\)/,
+    "",
+  );
+  return path.win32.resolve(withoutExtendedPrefix);
+}
+
+function windowsPathHasReparseSemantics(stat) {
+  return (
+    stat.isSymbolicLink?.() ||
+    stat.isReparsePoint?.() ||
+    stat.reparsePoint === true
+  );
+}
+
+function windowsLocalPathAncestors(candidate) {
+  const resolved = path.win32.resolve(candidate);
+  const volumeRoot = path.win32.parse(resolved).root;
+  if (!/^[A-Za-z]:\\$/.test(volumeRoot)) return null;
+  const relative = path.win32.relative(volumeRoot, resolved);
+  if (
+    path.win32.isAbsolute(relative) ||
+    relative === ".." ||
+    relative.startsWith(`..${path.win32.sep}`)
+  ) {
+    return null;
+  }
+  const ancestors = [volumeRoot];
+  let current = volumeRoot;
+  for (const segment of relative.split(path.win32.sep).filter(Boolean)) {
+    current = path.win32.join(current, segment);
+    ancestors.push(current);
+  }
+  return ancestors;
+}
+
+function windowsDirectoryIdentity(stat) {
+  const birthtimeNs =
+    stat.birthtimeNs !== undefined
+      ? String(stat.birthtimeNs)
+      : String(Math.trunc(Number(stat.birthtimeMs || 0) * 1_000_000));
+  if (
+    stat.dev === undefined ||
+    stat.ino === undefined ||
+    stat.mode === undefined
+  ) {
+    throw new Error("Windows directory identity is unavailable");
+  }
+  return Object.freeze({
+    dev: String(stat.dev),
+    ino: String(stat.ino),
+    mode: String(stat.mode),
+    birthtimeNs,
+  });
+}
+
+function sameWindowsDirectoryIdentity(left, right) {
+  return (
+    left?.dev === right?.dev &&
+    left?.ino === right?.ino &&
+    left?.mode === right?.mode &&
+    left?.birthtimeNs === right?.birthtimeNs
+  );
+}
+
+function inspectWindowsAdapterTempRoot(runtime, candidate) {
+  if (
+    typeof candidate !== "string" ||
+    candidate.length === 0 ||
+    candidate.includes("\0") ||
+    !path.win32.isAbsolute(candidate)
+  ) {
+    return null;
+  }
+  const sourcePath = path.win32.resolve(candidate);
+  const sourceAncestors = windowsLocalPathAncestors(sourcePath);
+  if (!sourceAncestors) return null;
+
+  try {
+    // Keep the caller-visible path in the trust decision even when Windows
+    // exposes it through a legitimate 8.3 alias (for example RUNNER~1 on a
+    // hosted runner). Every raw ancestor must be a plain directory before the
+    // native real path is accepted as the path used for mutations.
+    let sourceRootStat = null;
+    for (const ancestor of sourceAncestors) {
+      const stat = runtime.fs.lstatSync(ancestor, { bigint: true });
+      if (windowsPathHasReparseSemantics(stat) || !stat.isDirectory?.()) {
+        return null;
+      }
+      sourceRootStat = stat;
+    }
+
+    const rootPath = windowsNativeRealpath(runtime, sourcePath);
+    const rootAncestors = windowsLocalPathAncestors(rootPath);
+    if (!rootAncestors) return null;
+    let canonicalRootStat = null;
+    for (const ancestor of rootAncestors) {
+      const stat = runtime.fs.lstatSync(ancestor, { bigint: true });
+      if (windowsPathHasReparseSemantics(stat) || !stat.isDirectory?.()) {
+        return null;
+      }
+      canonicalRootStat = stat;
+    }
+
+    const sourceIdentity = windowsDirectoryIdentity(sourceRootStat);
+    const identity = windowsDirectoryIdentity(canonicalRootStat);
+    if (!sameWindowsDirectoryIdentity(sourceIdentity, identity)) return null;
+
+    const sourceAfter = runtime.fs.lstatSync(sourcePath, { bigint: true });
+    const rootAfter = runtime.fs.lstatSync(rootPath, { bigint: true });
+    if (
+      windowsPathHasReparseSemantics(sourceAfter) ||
+      !sourceAfter.isDirectory?.() ||
+      windowsPathHasReparseSemantics(rootAfter) ||
+      !rootAfter.isDirectory?.() ||
+      windowsCanonicalPathKey(windowsNativeRealpath(runtime, sourcePath)) !==
+        windowsCanonicalPathKey(rootPath) ||
+      windowsCanonicalPathKey(windowsNativeRealpath(runtime, rootPath)) !==
+        windowsCanonicalPathKey(rootPath) ||
+      !sameWindowsDirectoryIdentity(
+        sourceIdentity,
+        windowsDirectoryIdentity(sourceAfter),
+      ) ||
+      !sameWindowsDirectoryIdentity(
+        identity,
+        windowsDirectoryIdentity(rootAfter),
+      )
+    ) {
+      return null;
+    }
+    return Object.freeze({
+      sourcePath,
+      sourceCanonicalPathKey: windowsCanonicalPathKey(sourcePath),
+      rootPath,
+      canonicalPathKey: windowsCanonicalPathKey(rootPath),
+      volumeRoot: path.win32.parse(rootPath).root.toLowerCase(),
+      identity,
+      attestation: Object.freeze({
+        kind: "windows-adapter-temp-root-path-reattestation-v1",
+        localVolume: true,
+        nativeRealpathMatched: true,
+        sourceAliasCanonicalized:
+          windowsCanonicalPathKey(sourcePath) !==
+          windowsCanonicalPathKey(rootPath),
+        ancestorReparsePointsRejected: true,
+        rootIdentityBound: true,
+        criticalOperationReattestation: true,
+        descriptorRelativeOperations: false,
+        handleAtomic: false,
+        residualRace:
+          "same-principal-path-swap-between-reattestation-and-filesystem-call",
+        residualHandling: "fail-closed-on-detected-path-or-identity-change",
+      }),
+    });
+  } catch {
+    return null;
+  }
+}
+
+function sameWindowsAdapterTempRootBinding(left, right) {
+  return (
+    left?.sourceCanonicalPathKey === right?.sourceCanonicalPathKey &&
+    left?.canonicalPathKey === right?.canonicalPathKey &&
+    left?.volumeRoot === right?.volumeRoot &&
+    sameWindowsDirectoryIdentity(left?.identity, right?.identity)
+  );
+}
+
+function verifyWindowsAdapterTempRootBinding(runtime, binding) {
+  const current = inspectWindowsAdapterTempRoot(
+    runtime,
+    binding?.sourcePath || binding?.rootPath,
+  );
+  return Boolean(
+    current && sameWindowsAdapterTempRootBinding(binding, current),
+  );
+}
+
+function windowsAdapterTempRootChangedError() {
+  const error = new Error(
+    "Windows sandbox adapter temp root changed after attestation",
+  );
+  error.code = "ERR_WINDOWS_SANDBOX_ADAPTER_TEMP_ROOT_CHANGED";
+  error.adapterReason = WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON;
+  return error;
+}
+
+function assertWindowsAdapterTempRoot(runtime) {
+  const binding = runtime.windowsAdapterTempRootBinding;
+  if (!binding || !verifyWindowsAdapterTempRootBinding(runtime, binding)) {
+    throw windowsAdapterTempRootChangedError();
+  }
+  return binding;
+}
+
+function inspectWindowsAdapterBoundPath(
+  runtime,
+  targetPath,
+  expectedKind,
+  { allowMissing = false } = {},
+) {
+  const binding = assertWindowsAdapterTempRoot(runtime);
+  if (
+    typeof targetPath !== "string" ||
+    targetPath.includes("\0") ||
+    !path.win32.isAbsolute(targetPath)
+  ) {
+    throw windowsAdapterTempRootChangedError();
+  }
+  const resolved = path.win32.resolve(targetPath);
+  const relative = path.win32.relative(binding.rootPath, resolved);
+  if (
+    !relative ||
+    path.win32.isAbsolute(relative) ||
+    relative === ".." ||
+    relative.startsWith(`..${path.win32.sep}`)
+  ) {
+    throw windowsAdapterTempRootChangedError();
+  }
+
+  const segments = relative.split(path.win32.sep).filter(Boolean);
+  let current = binding.rootPath;
+  for (let index = 0; index < segments.length; index += 1) {
+    current = path.win32.join(current, segments[index]);
+    const isTarget = index === segments.length - 1;
+    let stat;
+    try {
+      stat = runtime.fs.lstatSync(current, { bigint: true });
+    } catch (error) {
+      if (isTarget && allowMissing && error?.code === "ENOENT") {
+        return Object.freeze({ exists: false, resolvedPath: resolved });
+      }
+      throw error;
+    }
+    if (
+      windowsPathHasReparseSemantics(stat) ||
+      windowsCanonicalPathKey(windowsNativeRealpath(runtime, current)) !==
+        windowsCanonicalPathKey(current)
+    ) {
+      throw windowsAdapterTempRootChangedError();
+    }
+    if (!isTarget && !stat.isDirectory?.()) {
+      throw windowsAdapterTempRootChangedError();
+    }
+    if (isTarget) {
+      if (
+        (expectedKind === "file" && !stat.isFile?.()) ||
+        (expectedKind === "directory" && !stat.isDirectory?.())
+      ) {
+        throw windowsAdapterTempRootChangedError();
+      }
+      return Object.freeze({
+        exists: true,
+        resolvedPath: resolved,
+        identity:
+          expectedKind === "directory"
+            ? windowsDirectoryIdentity(stat)
+            : windowsFileIdentity(stat),
+      });
+    }
+  }
+  throw windowsAdapterTempRootChangedError();
+}
+
+function assertWindowsAdapterBoundPathIdentity(
+  runtime,
+  targetPath,
+  expectedKind,
+  expectedIdentity,
+) {
+  const inspected = inspectWindowsAdapterBoundPath(
+    runtime,
+    targetPath,
+    expectedKind,
+  );
+  const matches =
+    expectedKind === "directory"
+      ? sameWindowsDirectoryIdentity(inspected.identity, expectedIdentity)
+      : sameWindowsFileIdentity(inspected.identity, expectedIdentity);
+  if (!matches) throw windowsAdapterTempRootChangedError();
+  return inspected;
+}
+
+function resolveWindowsAdapterTempRoot(runtime, runtimeOverrides = {}) {
+  const hasExplicitTmpdir = Object.prototype.hasOwnProperty.call(
+    runtimeOverrides,
+    "tmpdir",
+  );
+  const hasExplicitAdapterRoot = Object.prototype.hasOwnProperty.call(
+    runtimeOverrides,
+    "windowsAdapterTempRoot",
+  );
+  let candidate;
+  try {
+    if (hasExplicitTmpdir) {
+      if (typeof runtime.tmpdir !== "function") return null;
+      candidate = runtime.tmpdir();
+    } else if (hasExplicitAdapterRoot) {
+      candidate = runtimeOverrides.windowsAdapterTempRoot;
+    } else {
+      const environmentRoot =
+        runtime.env?.[WINDOWS_ADAPTER_TEMP_ROOT_ENV] ??
+        process.env[WINDOWS_ADAPTER_TEMP_ROOT_ENV];
+      candidate =
+        environmentRoot === undefined ? runtime.tmpdir() : environmentRoot;
+    }
+  } catch {
+    return null;
+  }
+
+  return inspectWindowsAdapterTempRoot(runtime, candidate);
+}
+
 function normalizeSandboxRequest(profileOrRequest, explicitRequest) {
   const legacyRequest =
     profileOrRequest &&
@@ -453,6 +794,8 @@ export function generateMacSeatbeltProfile(opts = {}, runtimeOverrides = {}) {
     allowNetwork = false,
     allowExec = true,
   } = opts;
+  const seatbeltLiteral = (value) =>
+    String(value).replace(/\\/g, "\\\\").replace(/"/g, '\\"');
 
   const lines = [
     "(version 1)",
@@ -485,12 +828,12 @@ export function generateMacSeatbeltProfile(opts = {}, runtimeOverrides = {}) {
 
   // Allow read/write to specific paths
   for (const p of allowRead) {
-    const abs = runtime.resolvePath(p);
+    const abs = seatbeltLiteral(runtime.resolvePath(p));
     lines.push(`(allow file-read* (subpath "${abs}"))`);
   }
 
   for (const p of allowWrite) {
-    const abs = runtime.resolvePath(p);
+    const abs = seatbeltLiteral(runtime.resolvePath(p));
     lines.push(`(allow file-read* file-write* (subpath "${abs}"))`);
   }
 
@@ -511,6 +854,144 @@ export function generateMacSeatbeltProfile(opts = {}, runtimeOverrides = {}) {
   return lines.join("\n");
 }
 
+function validateMacMcpCapsuleContract(
+  command,
+  args,
+  spawnOpts,
+  contract,
+  runtime,
+  sync,
+) {
+  if (
+    contract?.kind !== MCP_STDIO_CAPSULE_SANDBOX_CONTRACT_KIND ||
+    contract.contractVersion !== 1 ||
+    (sync !== true && sync !== false) ||
+    spawnOpts?.shell !== false ||
+    !linuxStdioIsNarrow(spawnOpts?.stdio) ||
+    spawnOpts?.serialization !== undefined ||
+    spawnOpts?.argv0 !== undefined ||
+    spawnOpts?.uid !== undefined ||
+    spawnOpts?.gid !== undefined ||
+    !Array.isArray(args) ||
+    args.length < 1 ||
+    args.some((value) => typeof value !== "string" || value.includes("\0")) ||
+    command !== contract.runtimePath ||
+    command !== contract.runtimeIdentity?.realPath ||
+    args[0] !== contract.entryIdentity?.realPath ||
+    ![".js", ".cjs", ".mjs"].includes(
+      path.posix.extname(contract.entryIdentity?.realPath || "").toLowerCase(),
+    )
+  ) {
+    return { ok: false, reason: "launch_identity_mismatch" };
+  }
+  for (const value of [
+    contract.pluginRoot,
+    contract.workingDirectory,
+    contract.rootIdentity?.realPath,
+    contract.entryIdentity?.realPath,
+    contract.runtimeIdentity?.realPath,
+  ]) {
+    if (
+      typeof value !== "string" ||
+      !path.posix.isAbsolute(value) ||
+      value.includes("\0")
+    ) {
+      return { ok: false, reason: "noncanonical_contract_path" };
+    }
+  }
+  try {
+    if (
+      linuxRealpath(runtime, contract.pluginRoot) !== contract.pluginRoot ||
+      linuxRealpath(runtime, contract.workingDirectory) !==
+        contract.workingDirectory ||
+      linuxRealpath(runtime, spawnOpts.cwd) !== contract.pluginRoot ||
+      contract.workingDirectory !== contract.pluginRoot ||
+      contract.rootIdentity?.realPath !== contract.pluginRoot ||
+      !linuxPathWithin(contract.pluginRoot, contract.entryIdentity.realPath)
+    ) {
+      return { ok: false, reason: "noncanonical_contract_path" };
+    }
+  } catch {
+    return { ok: false, reason: "contract_path_unavailable" };
+  }
+  if (
+    !linuxDirectoryIdentityMatches(runtime, contract.rootIdentity) ||
+    !linuxIdentityMatches(runtime, contract.runtimeIdentity, {
+      executable: true,
+    }) ||
+    !linuxIdentityMatches(runtime, contract.entryIdentity)
+  ) {
+    return { ok: false, reason: "execution_identity_changed" };
+  }
+  return { ok: true };
+}
+
+function applyMacMcpCapsuleCodeSnapshot(
+  command,
+  args,
+  spawnOpts,
+  sandboxOpts,
+  runtime,
+  base,
+) {
+  const contract = sandboxOpts.executionContract;
+  const validation = validateMacMcpCapsuleContract(
+    command,
+    args,
+    spawnOpts,
+    contract,
+    runtime,
+    sandboxOpts.sync,
+  );
+  const unavailable = (reason, runtimeProbe = null) =>
+    createSandboxPlan({
+      ...base,
+      backend: null,
+      candidateBackend: MACOS_MCP_CAPSULE_BACKEND,
+      policyAttested: false,
+      runtimeProbe: runtimeProbe
+        ? {
+            kind: "darwin-mcp-capsule-code-snapshot-v1",
+            attempted: runtimeProbe.attempted !== false,
+            probeRuntime: "node",
+            targetRuntime: "node",
+            ...runtimeProbe,
+          }
+        : null,
+      reason,
+      guarantees: [],
+    });
+  if (!validation.ok) {
+    return unavailable("macos_mcp_capsule_execution_contract_invalid", {
+      attempted: false,
+      runnable: false,
+      reason: validation.reason,
+      contentSnapshot: false,
+      handleAtomic: false,
+      entrySnapshotAtomic: false,
+      runtimeLaunchAtomic: false,
+      sharedLibraryClosure: false,
+    });
+  }
+
+  // Darwin exposes only pathname-based exec/spawn APIs to an unprivileged
+  // process. An inherited descriptor can bind the entry source, but public
+  // APIs cannot bind the verified Node runtime descriptor to the image that
+  // executes. Private temporary paths and Seatbelt still leave a same-UID
+  // pathname-replacement window, so they cannot satisfy CODE_SNAPSHOT.
+  return unavailable("macos_atomic_runtime_exec_unavailable", {
+    attempted: true,
+    runnable: false,
+    reason: "public_api_has_no_descriptor_bound_exec",
+    contentSnapshot: false,
+    handleAtomic: false,
+    entrySnapshotAtomic: false,
+    runtimeLaunchAtomic: false,
+    runtimeLaunchMechanism: "darwin-public-api-pathname-exec-only-v1",
+    sharedLibraryClosure: false,
+  });
+}
+
 /**
  * Apply macOS sandbox via SBWritableProfile or sandbox-exec wrapper.
  *
@@ -552,6 +1033,20 @@ export function applyMacSandbox(
     });
   }
 
+  if (
+    Array.isArray(sandboxOpts.requiredBoundaries) &&
+    sandboxOpts.requiredBoundaries.includes(SANDBOX_BOUNDARIES.CODE_SNAPSHOT)
+  ) {
+    return applyMacMcpCapsuleCodeSnapshot(
+      command,
+      args,
+      spawnOpts,
+      sandboxOpts,
+      runtime,
+      base,
+    );
+  }
+
   // A deny-by-default Seatbelt profile cannot safely infer the filesystem,
   // IPC, and inherited-descriptor access required by an arbitrary command.
   // Keep the boundary truthful for the broker's implicit default profile:
@@ -619,14 +1114,42 @@ function cleanupWindowsTemporaryPath(
   targetPath,
   attempts = 100,
   delayMs = 10,
+  expectedIdentity = null,
 ) {
   if (!targetPath) return true;
   for (let attempt = 0; attempt < attempts; attempt += 1) {
     try {
+      const inspected = inspectWindowsAdapterBoundPath(
+        runtime,
+        targetPath,
+        "file",
+        { allowMissing: true },
+      );
+      if (!inspected.exists) {
+        assertWindowsAdapterTempRoot(runtime);
+        return true;
+      }
+      if (
+        !expectedIdentity ||
+        !sameWindowsFileIdentity(inspected.identity, expectedIdentity)
+      ) {
+        return false;
+      }
       runtime.fs.unlinkSync(targetPath);
+      assertWindowsAdapterTempRoot(runtime);
       return true;
     } catch (error) {
-      if (error?.code === "ENOENT") return true;
+      if (error?.adapterReason === WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON) {
+        return false;
+      }
+      if (error?.code === "ENOENT") {
+        try {
+          assertWindowsAdapterTempRoot(runtime);
+          return true;
+        } catch {
+          return false;
+        }
+      }
     }
     if (attempt + 1 < attempts) runtime.sleepSync(delayMs);
   }
@@ -637,13 +1160,32 @@ function cleanupOrTrackWindowsTemporaryPath(
   runtime,
   targetPath,
   attempts = 100,
+  entry = null,
+  expectedIdentity = null,
 ) {
-  if (cleanupWindowsTemporaryPath(runtime, targetPath, attempts)) {
+  if (
+    cleanupWindowsTemporaryPath(
+      runtime,
+      targetPath,
+      attempts,
+      10,
+      expectedIdentity,
+    )
+  ) {
+    const residualEntries = new Set();
     for (const residual of [...windowsTemporaryCleanupBacklog]) {
-      if (residual.runtime === runtime && residual.targetPath === targetPath) {
+      if (
+        residual.kind === "file" &&
+        residual.runtime === runtime &&
+        residual.targetPath === targetPath
+      ) {
         windowsTemporaryCleanupBacklog.delete(residual);
+        if (residual.entry) residualEntries.add(residual.entry);
       }
     }
+    for (const residualEntry of residualEntries) {
+      finalizeWindowsTemporaryCleanupEntry(residualEntry);
+    }
     if (
       windowsTemporaryCleanupBacklog.size === 0 &&
       windowsTemporaryCleanupRetryTimer
@@ -653,13 +1195,25 @@ function cleanupOrTrackWindowsTemporaryPath(
     }
     return true;
   }
-  if (
-    ![...windowsTemporaryCleanupBacklog].some(
-      (residual) =>
-        residual.runtime === runtime && residual.targetPath === targetPath,
-    )
-  ) {
-    windowsTemporaryCleanupBacklog.add({ runtime, targetPath });
+  const existing = [...windowsTemporaryCleanupBacklog].find(
+    (residual) =>
+      residual.kind === "file" &&
+      residual.runtime === runtime &&
+      residual.targetPath === targetPath,
+  );
+  if (existing) {
+    if (entry) existing.entry = entry;
+    if (!existing.expectedIdentity && expectedIdentity) {
+      existing.expectedIdentity = expectedIdentity;
+    }
+  } else {
+    windowsTemporaryCleanupBacklog.add({
+      kind: "file",
+      runtime,
+      targetPath,
+      entry,
+      expectedIdentity,
+    });
   }
   registerWindowsAdapterExitCleanup();
   scheduleWindowsTemporaryCleanupRetry();
@@ -669,14 +1223,25 @@ function cleanupOrTrackWindowsTemporaryPath(
 function retryWindowsTemporaryCleanupBacklog(attempts = 100) {
   let cleaned = true;
   for (const residual of [...windowsTemporaryCleanupBacklog]) {
-    if (
-      cleanupWindowsTemporaryPath(
-        residual.runtime,
-        residual.targetPath,
-        attempts,
-      )
-    ) {
+    const residualCleaned =
+      residual.kind === "directory"
+        ? cleanupWindowsTemporaryDirectory(
+            residual.runtime,
+            residual.targetPath,
+            attempts,
+            10,
+            residual.expectedIdentity,
+          )
+        : cleanupWindowsTemporaryPath(
+            residual.runtime,
+            residual.targetPath,
+            attempts,
+            10,
+            residual.expectedIdentity,
+          );
+    if (residualCleaned) {
       windowsTemporaryCleanupBacklog.delete(residual);
+      if (residual.entry) finalizeWindowsTemporaryCleanupEntry(residual.entry);
     } else {
       cleaned = false;
     }
@@ -691,6 +1256,18 @@ function retryWindowsTemporaryCleanupBacklog(attempts = 100) {
   return cleaned;
 }
 
+function finalizeWindowsTemporaryCleanupEntry(entry) {
+  if (
+    [...windowsTemporaryCleanupBacklog].some(
+      (residual) => residual.entry === entry,
+    )
+  ) {
+    return;
+  }
+  entry.cleaned = true;
+  windowsAdapterCacheEntries.delete(entry);
+}
+
 function scheduleWindowsTemporaryCleanupRetry() {
   if (
     windowsTemporaryCleanupRetryTimer ||
@@ -713,17 +1290,109 @@ function cleanupWindowsTemporaryDirectory(
   targetPath,
   attempts = 100,
   delayMs = 10,
+  expectedIdentity = null,
 ) {
   if (!targetPath) return true;
   for (let attempt = 0; attempt < attempts; attempt += 1) {
     try {
+      const inspected = inspectWindowsAdapterBoundPath(
+        runtime,
+        targetPath,
+        "directory",
+        { allowMissing: true },
+      );
+      if (!inspected.exists) {
+        assertWindowsAdapterTempRoot(runtime);
+        return true;
+      }
+      if (
+        !expectedIdentity ||
+        !sameWindowsDirectoryIdentity(inspected.identity, expectedIdentity)
+      ) {
+        return false;
+      }
       runtime.fs.rmdirSync(targetPath);
+      assertWindowsAdapterTempRoot(runtime);
       return true;
     } catch (error) {
-      if (error?.code === "ENOENT") return true;
+      if (error?.adapterReason === WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON) {
+        return false;
+      }
+      if (error?.code === "ENOENT") {
+        try {
+          assertWindowsAdapterTempRoot(runtime);
+          return true;
+        } catch {
+          return false;
+        }
+      }
+    }
+    if (attempt + 1 < attempts) runtime.sleepSync(delayMs);
+  }
+  return false;
+}
+
+function cleanupOrTrackWindowsTemporaryDirectory(
+  runtime,
+  targetPath,
+  attempts = 100,
+  entry = null,
+  expectedIdentity = null,
+) {
+  if (
+    cleanupWindowsTemporaryDirectory(
+      runtime,
+      targetPath,
+      attempts,
+      10,
+      expectedIdentity,
+    )
+  ) {
+    const residualEntries = new Set();
+    for (const residual of [...windowsTemporaryCleanupBacklog]) {
+      if (
+        residual.kind === "directory" &&
+        residual.runtime === runtime &&
+        residual.targetPath === targetPath
+      ) {
+        windowsTemporaryCleanupBacklog.delete(residual);
+        if (residual.entry) residualEntries.add(residual.entry);
+      }
+    }
+    for (const residualEntry of residualEntries) {
+      finalizeWindowsTemporaryCleanupEntry(residualEntry);
+    }
+    if (
+      windowsTemporaryCleanupBacklog.size === 0 &&
+      windowsTemporaryCleanupRetryTimer
+    ) {
+      clearTimeout(windowsTemporaryCleanupRetryTimer);
+      windowsTemporaryCleanupRetryTimer = null;
     }
-    if (attempt + 1 < attempts) runtime.sleepSync(delayMs);
+    return true;
+  }
+  const existing = [...windowsTemporaryCleanupBacklog].find(
+    (residual) =>
+      residual.kind === "directory" &&
+      residual.runtime === runtime &&
+      residual.targetPath === targetPath,
+  );
+  if (existing) {
+    if (entry) existing.entry = entry;
+    if (!existing.expectedIdentity && expectedIdentity) {
+      existing.expectedIdentity = expectedIdentity;
+    }
+  } else {
+    windowsTemporaryCleanupBacklog.add({
+      kind: "directory",
+      runtime,
+      targetPath,
+      entry,
+      expectedIdentity,
+    });
   }
+  registerWindowsAdapterExitCleanup();
+  scheduleWindowsTemporaryCleanupRetry();
   return false;
 }
 
@@ -731,6 +1400,218 @@ function sha256(value) {
   return crypto.createHash("sha256").update(value).digest("hex");
 }
 
+function sameStringArray(left, right) {
+  return (
+    Array.isArray(left) &&
+    Array.isArray(right) &&
+    left.length === right.length &&
+    left.every((value, index) => value === right[index])
+  );
+}
+
+function captureWindowsStdio(stdio) {
+  if (Array.isArray(stdio)) return Object.freeze([...stdio]);
+  return stdio ?? null;
+}
+
+function sameWindowsStdio(left, right) {
+  const normalizedRight = right ?? null;
+  if (Array.isArray(left) || Array.isArray(normalizedRight)) {
+    return (
+      Array.isArray(left) &&
+      Array.isArray(normalizedRight) &&
+      left.length === normalizedRight.length &&
+      left.every((entry, index) => Object.is(entry, normalizedRight[index]))
+    );
+  }
+  return Object.is(left, normalizedRight);
+}
+
+function windowsStdioDigestContract(stdio) {
+  const normalizeEntry = (entry) => {
+    if (entry === null || entry === undefined) return ["null"];
+    if (typeof entry === "string") return ["string", entry];
+    if (Number.isInteger(entry)) return ["fd", entry];
+    return [typeof entry];
+  };
+  return Array.isArray(stdio)
+    ? ["array", ...stdio.map(normalizeEntry)]
+    : ["scalar", ...normalizeEntry(stdio)];
+}
+
+function windowsEnvironmentDigest(env) {
+  const entries = Object.entries(env || {})
+    .map(([key, value]) => [key, String(value)])
+    .sort(([leftKey, leftValue], [rightKey, rightValue]) => {
+      if (leftKey !== rightKey) return leftKey < rightKey ? -1 : 1;
+      if (leftValue === rightValue) return 0;
+      return leftValue < rightValue ? -1 : 1;
+    });
+  return sha256(JSON.stringify(entries));
+}
+
+function windowsMcpBindingIdentity(identity) {
+  if (!identity) return null;
+  return {
+    contractVersion: identity.contractVersion ?? null,
+    realPath: identity.realPath ?? null,
+    sha256: identity.sha256 ?? null,
+    bytes: identity.bytes ?? null,
+    fileId: identity.fileId
+      ? {
+          dev: identity.fileId.dev ?? null,
+          ino: identity.fileId.ino ?? null,
+        }
+      : null,
+    mtimeMs: identity.mtimeMs ?? null,
+    attestation: identity.attestation ?? null,
+  };
+}
+
+function windowsMcpBindingContract(contract) {
+  return {
+    contractVersion: contract?.contractVersion ?? null,
+    kind: contract?.kind ?? null,
+    pluginRoot: contract?.pluginRoot ?? null,
+    workingDirectory: contract?.workingDirectory ?? null,
+    runtimePath: contract?.runtimePath ?? null,
+    rootIdentity: contract?.rootIdentity
+      ? {
+          realPath: contract.rootIdentity.realPath ?? null,
+          fileId: contract.rootIdentity.fileId
+            ? {
+                dev: contract.rootIdentity.fileId.dev ?? null,
+                ino: contract.rootIdentity.fileId.ino ?? null,
+              }
+            : null,
+          attestation: contract.rootIdentity.attestation ?? null,
+        }
+      : null,
+    entryIdentity: windowsMcpBindingIdentity(contract?.entryIdentity),
+    runtimeIdentity: windowsMcpBindingIdentity(contract?.runtimeIdentity),
+  };
+}
+
+function createWindowsMcpCodeSnapshotPlanBinding({
+  executionContract,
+  command,
+  args,
+  spawnOpts,
+  profile,
+  requiredBoundaries,
+  sync,
+  backend,
+  policyAttested,
+  policyDigest,
+  adapterSource,
+  helperInvocation,
+  helperOptions,
+  postSpawn,
+  postSpawnWindows,
+}) {
+  const helperEnvDigest = windowsEnvironmentDigest(helperOptions.env);
+  const helperStdio = captureWindowsStdio(helperOptions.stdio);
+  const originalArgs = Object.freeze([...(args || [])]);
+  const helperArgs = Object.freeze([...(helperInvocation.args || [])]);
+  const normalizedPostSpawn = Object.freeze({
+    required: postSpawn?.required === true,
+    mode: postSpawn?.mode || "none",
+  });
+  const digestPayload = {
+    version: 1,
+    kind: "windows-mcp-code-snapshot-plan-binding-v1",
+    executionContract: windowsMcpBindingContract(executionContract),
+    originalLaunch: {
+      command,
+      args: originalArgs,
+      cwd: spawnOpts?.cwd ?? null,
+      shell: spawnOpts?.shell ?? null,
+      detached: spawnOpts?.detached ?? null,
+      profile,
+      requiredBoundaries: [...requiredBoundaries],
+      sync,
+    },
+    policy: { backend, policyAttested, policyDigest },
+    adapter: {
+      loaderMode: adapterSource.loaderMode,
+      sourceDigest: adapterSource.sourceDigest,
+      sourceContractDigest: adapterSource.sourceContractDigest,
+    },
+    helperInvocation: {
+      command: helperInvocation.command,
+      args: helperArgs,
+      cwd: helperOptions.cwd ?? null,
+      shell: helperOptions.shell ?? null,
+      detached: helperOptions.detached ?? null,
+      envDigest: helperEnvDigest,
+      stdio: windowsStdioDigestContract(helperStdio),
+    },
+    postSpawn: normalizedPostSpawn,
+  };
+  return Object.freeze({
+    executionContract,
+    originalCommand: command,
+    originalArgs,
+    originalCwd: spawnOpts?.cwd ?? null,
+    originalShell: spawnOpts?.shell ?? null,
+    originalDetached: spawnOpts?.detached ?? null,
+    profile,
+    requiredBoundaries: Object.freeze([...requiredBoundaries]),
+    sync,
+    backend,
+    policyAttested,
+    policyDigest,
+    helperCommand: helperInvocation.command,
+    helperArgs,
+    helperCwd: helperOptions.cwd ?? null,
+    helperShell: helperOptions.shell ?? null,
+    helperDetached: helperOptions.detached ?? null,
+    helperEnvDigest,
+    helperStdio,
+    postSpawn: normalizedPostSpawn,
+    postSpawnWindows: postSpawnWindows || null,
+    planBindingDigest: sha256(JSON.stringify(digestPayload)),
+  });
+}
+
+/**
+ * Consume the one-launch capability attached to a real built-in Windows MCP
+ * code-snapshot plan. The issuer stays module-private so an injected adapter
+ * cannot make a structurally similar helper payload authoritative.
+ */
+export function consumeWindowsMcpCodeSnapshotPlanBinding(plan, expected = {}) {
+  const issued = issuedWindowsMcpCodeSnapshotPlans.get(plan);
+  if (!issued) return false;
+  issuedWindowsMcpCodeSnapshotPlans.delete(plan);
+  return (
+    issued.executionContract === expected.executionContract &&
+    issued.originalCommand === expected.command &&
+    sameStringArray(issued.originalArgs, expected.args) &&
+    issued.originalCwd === (expected.cwd ?? null) &&
+    issued.originalShell === (expected.shell ?? null) &&
+    issued.originalDetached === (expected.detached ?? null) &&
+    issued.profile === expected.profile &&
+    sameStringArray(issued.requiredBoundaries, expected.requiredBoundaries) &&
+    issued.sync === (expected.sync === true) &&
+    plan.backend === issued.backend &&
+    plan.policyAttested === issued.policyAttested &&
+    plan.policyDigest === issued.policyDigest &&
+    plan.command === issued.helperCommand &&
+    sameStringArray(plan.args, issued.helperArgs) &&
+    plan.options?.cwd === issued.helperCwd &&
+    plan.options?.shell === issued.helperShell &&
+    plan.options?.detached === issued.helperDetached &&
+    windowsEnvironmentDigest(plan.options?.env) === issued.helperEnvDigest &&
+    sameWindowsStdio(issued.helperStdio, plan.options?.stdio) &&
+    plan.postSpawn?.required === issued.postSpawn.required &&
+    plan.postSpawn?.mode === issued.postSpawn.mode &&
+    (plan.postSpawnWindows || null) === issued.postSpawnWindows &&
+    plan.runtimeProbe?.planBindingMechanism ===
+      "windows-mcp-code-snapshot-plan-binding-v1" &&
+    plan.runtimeProbe?.planBindingDigest === issued.planBindingDigest
+  );
+}
+
 function windowsFileIdentity(stat) {
   const timestamp = (nanosecondsKey, millisecondsKey) => {
     if (stat[nanosecondsKey] !== undefined) {
@@ -762,15 +1643,11 @@ function sameWindowsFileIdentity(left, right) {
 }
 
 function inspectWindowsAdapterAssembly(runtime, assemblyPath) {
-  if (typeof runtime.fs.lstatSync === "function") {
-    const linkStat = runtime.fs.lstatSync(assemblyPath, { bigint: true });
-    if (
-      linkStat.isSymbolicLink?.() ||
-      (typeof linkStat.isFile === "function" && !linkStat.isFile())
-    ) {
-      throw new Error("Windows in-memory adapter is not a regular file");
-    }
-  }
+  const boundBefore = inspectWindowsAdapterBoundPath(
+    runtime,
+    assemblyPath,
+    "file",
+  );
   const before = runtime.fs.statSync(assemblyPath, { bigint: true });
   if (typeof before.isFile === "function" && !before.isFile()) {
     throw new Error("Windows in-memory adapter is not a regular file");
@@ -783,6 +1660,15 @@ function inspectWindowsAdapterAssembly(runtime, assemblyPath) {
   if (!sameWindowsFileIdentity(beforeIdentity, afterIdentity)) {
     throw new Error("Windows in-memory adapter changed during attestation");
   }
+  const boundAfter = assertWindowsAdapterBoundPathIdentity(
+    runtime,
+    assemblyPath,
+    "file",
+    boundBefore.identity,
+  );
+  if (!sameWindowsFileIdentity(afterIdentity, boundAfter.identity)) {
+    throw new Error("Windows in-memory adapter changed during attestation");
+  }
   return { assemblyDigest, fileIdentity: afterIdentity };
 }
 
@@ -792,6 +1678,11 @@ function verifyWindowsAdapterEntry(entry, runtime, source) {
     entry.cleaned ||
     entry.runtimeFs !== runtime.fs ||
     entry.tempDirectory !== source.tempDirectory ||
+    entry.idleTtlMs !== source.idleTtlMs ||
+    !sameWindowsAdapterTempRootBinding(
+      entry.tempRootBinding,
+      source.tempRootBinding,
+    ) ||
     entry.sourceDigest !== source.sourceDigest ||
     entry.sourceContractDigest !== source.sourceContractDigest ||
     entry.loaderMode !== source.loaderMode
@@ -799,6 +1690,15 @@ function verifyWindowsAdapterEntry(entry, runtime, source) {
     return false;
   }
   try {
+    assertWindowsAdapterTempRoot(runtime);
+    if (entry.adapterDirectory) {
+      assertWindowsAdapterBoundPathIdentity(
+        runtime,
+        entry.adapterDirectory,
+        "directory",
+        entry.adapterDirectoryIdentity,
+      );
+    }
     const attestation = inspectWindowsAdapterAssembly(
       runtime,
       entry.assemblyPath,
@@ -822,14 +1722,18 @@ function cleanupWindowsAdapterEntry(entry, attempts = 100) {
     entry.runtime,
     entry.assemblyPath,
     attempts,
+    entry,
+    entry.fileIdentity,
   );
-  const directoryDeleted =
-    deleted &&
-    cleanupWindowsTemporaryDirectory(
-      entry.runtime,
-      entry.adapterDirectory,
-      attempts,
-    );
+  const directoryDeleted = entry.adapterDirectory
+    ? cleanupOrTrackWindowsTemporaryDirectory(
+        entry.runtime,
+        entry.adapterDirectory,
+        attempts,
+        entry,
+        entry.adapterDirectoryIdentity,
+      )
+    : true;
   if (deleted && directoryDeleted) {
     entry.cleaned = true;
     windowsAdapterCacheEntries.delete(entry);
@@ -872,15 +1776,35 @@ function registerWindowsAdapterExitCleanup() {
  * this hook at a known quiescent point to prove cleanup.
  */
 export function resetWindowsSandboxAdapterCache() {
-  let cleaned = retryWindowsAppContainerCleanupBacklog();
+  const appContainerCleaned = retryWindowsAppContainerCleanupBacklog();
   windowsAdapterCache = null;
   for (const entry of [...windowsAdapterCacheEntries]) {
     entry.retired = true;
     entry.refCount = 0;
-    if (!cleanupWindowsAdapterEntry(entry)) cleaned = false;
+    cleanupWindowsAdapterEntry(entry);
   }
-  if (!retryWindowsTemporaryCleanupBacklog()) cleaned = false;
-  return cleaned;
+  retryWindowsTemporaryCleanupBacklog();
+  return (
+    appContainerCleaned &&
+    windowsTemporaryCleanupBacklog.size === 0 &&
+    windowsAdapterCacheEntries.size === 0
+  );
+}
+
+function normalizeWindowsAdapterIdleTtlMs(runtime) {
+  const explicitTtl = runtime.windowsAdapterIdleTtlMs;
+  const environmentTtl =
+    runtime.env?.[WINDOWS_ADAPTER_IDLE_TTL_ENV] ??
+    process.env[WINDOWS_ADAPTER_IDLE_TTL_ENV];
+  const configuredTtl =
+    explicitTtl === undefined ? environmentTtl : explicitTtl;
+  const numericTtl =
+    configuredTtl === "" || configuredTtl === null
+      ? Number.NaN
+      : Number(configuredTtl);
+  return Number.isFinite(numericTtl) && numericTtl >= 0
+    ? numericTtl
+    : WINDOWS_ADAPTER_IDLE_TTL_MS;
 }
 
 function scheduleWindowsAdapterIdleCleanup(entry) {
@@ -892,11 +1816,11 @@ function scheduleWindowsAdapterIdleCleanup(entry) {
   ) {
     return;
   }
-  const configuredTtl = Number(entry.runtime.windowsAdapterIdleTtlMs);
-  const idleTtlMs =
-    Number.isFinite(configuredTtl) && configuredTtl >= 0
-      ? configuredTtl
-      : WINDOWS_ADAPTER_IDLE_TTL_MS;
+  const idleTtlMs = entry.idleTtlMs;
+  if (idleTtlMs === 0) {
+    retireWindowsAdapterEntry(entry);
+    return;
+  }
   entry.idleTimer = setTimeout(() => {
     entry.idleTimer = null;
     if (
@@ -912,6 +1836,7 @@ function scheduleWindowsAdapterIdleCleanup(entry) {
 }
 
 function loadWindowsAdapterSource(runtime, loaderMode) {
+  const tempRootBinding = assertWindowsAdapterTempRoot(runtime);
   const bundled = runtime.windowsAdapterContent === undefined;
   const content = bundled
     ? loaderMode === "managed-executable"
@@ -926,7 +1851,10 @@ function loadWindowsAdapterSource(runtime, loaderMode) {
         : WINDOWS_SANDBOX_HELPER_ASSEMBLY_DIGEST
       : sha256(content),
     sourceContractDigest: bundled ? WINDOWS_SANDBOX_HELPER_SOURCE_DIGEST : null,
-    tempDirectory: runtime.tmpdir(),
+    tempDirectory: tempRootBinding.rootPath,
+    tempRootBinding,
+    tempRootAttestation: tempRootBinding.attestation,
+    idleTtlMs: runtime.windowsAdapterIdleTtlMs,
     loaderMode,
   };
 }
@@ -948,54 +1876,121 @@ function materializeWindowsAdapter(runtime, source) {
   const assemblyPath = runtime.joinPath(
     adapterDirectory || source.tempDirectory,
     source.loaderMode === "managed-executable"
-      ? "windows-sandbox-helper.exe"
+      ? WINDOWS_ADAPTER_HELPER_NAME
       : `${adapterBaseName}.dll`,
   );
-  if (
-    (adapterDirectory && runtime.fs.existsSync(adapterDirectory)) ||
-    runtime.fs.existsSync(assemblyPath)
-  ) {
-    return { reason: "windows_native_adapter_random_path_collision" };
-  }
+  let adapterDirectoryIdentity = null;
+  let assemblyFileIdentity = null;
   try {
+    assertWindowsAdapterTempRoot(runtime);
     if (adapterDirectory) {
+      if (
+        inspectWindowsAdapterBoundPath(runtime, adapterDirectory, "directory", {
+          allowMissing: true,
+        }).exists
+      ) {
+        return { reason: "windows_native_adapter_random_path_collision" };
+      }
       runtime.fs.mkdirSync(adapterDirectory, {
         mode: 0o700,
         recursive: false,
       });
+      adapterDirectoryIdentity = inspectWindowsAdapterBoundPath(
+        runtime,
+        adapterDirectory,
+        "directory",
+      ).identity;
+    }
+    if (
+      inspectWindowsAdapterBoundPath(runtime, assemblyPath, "file", {
+        allowMissing: true,
+      }).exists
+    ) {
+      const collision = new Error(
+        "Windows native adapter random path collision",
+      );
+      collision.code = "EEXIST";
+      throw collision;
     }
     runtime.fs.writeFileSync(assemblyPath, source.content, {
       mode: adapterDirectory ? 0o500 : 0o600,
       flag: "wx",
     });
+    assemblyFileIdentity = inspectWindowsAdapterAssembly(
+      runtime,
+      assemblyPath,
+    ).fileIdentity;
   } catch (error) {
+    if (error?.code === "EEXIST") {
+      const directoryDeleted = cleanupOrTrackWindowsTemporaryDirectory(
+        runtime,
+        adapterDirectory,
+        100,
+        null,
+        adapterDirectoryIdentity,
+      );
+      return {
+        reason: directoryDeleted
+          ? "windows_native_adapter_random_path_collision"
+          : "windows_native_adapter_compile_cleanup_unverified",
+      };
+    }
+    if (!assemblyFileIdentity) {
+      try {
+        const inspected = inspectWindowsAdapterBoundPath(
+          runtime,
+          assemblyPath,
+          "file",
+          { allowMissing: true },
+        );
+        assemblyFileIdentity = inspected.exists ? inspected.identity : null;
+      } catch {
+        assemblyFileIdentity = null;
+      }
+    }
     const assemblyDeleted = cleanupOrTrackWindowsTemporaryPath(
       runtime,
       assemblyPath,
+      100,
+      null,
+      assemblyFileIdentity,
     );
-    const directoryDeleted =
-      assemblyDeleted &&
-      cleanupWindowsTemporaryDirectory(runtime, adapterDirectory);
+    const directoryDeleted = cleanupOrTrackWindowsTemporaryDirectory(
+      runtime,
+      adapterDirectory,
+      100,
+      null,
+      adapterDirectoryIdentity,
+    );
+    if (error?.adapterReason === WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON) {
+      return { reason: WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON };
+    }
     if (!assemblyDeleted || !directoryDeleted) {
       return { reason: "windows_native_adapter_compile_cleanup_unverified" };
     }
-    if (error?.code === "EEXIST") {
-      return { reason: "windows_native_adapter_random_path_collision" };
-    }
     return { reason: "windows_native_adapter_materialize_failed" };
   }
   return {
     adapterDirectory,
+    adapterDirectoryIdentity,
     assemblyPath,
+    assemblyFileIdentity,
     cleanupAssembly: () => {
       const assemblyDeleted = cleanupOrTrackWindowsTemporaryPath(
         runtime,
         assemblyPath,
+        100,
+        null,
+        assemblyFileIdentity,
       );
-      return (
-        assemblyDeleted &&
-        cleanupWindowsTemporaryDirectory(runtime, adapterDirectory)
+      const directoryDeleted = cleanupOrTrackWindowsTemporaryDirectory(
+        runtime,
+        adapterDirectory,
+        100,
+        null,
+        adapterDirectoryIdentity,
       );
+      return assemblyDeleted && directoryDeleted;
     },
   };
 }
@@ -1007,9 +2002,7 @@ function materializeWindowsAdapterInvocation(runtime, helperArgs) {
       .randomBytes(24)
       .toString("hex")}.json`,
   );
-  if (runtime.fs.existsSync(payloadPath)) {
-    return { reason: "windows_adapter_invocation_random_path_collision" };
-  }
+  let fileIdentity = null;
   let content;
   try {
     content = Buffer.from(
@@ -1029,16 +2022,57 @@ function materializeWindowsAdapterInvocation(runtime, helperArgs) {
     return { reason: "windows_adapter_invocation_too_large" };
   }
   try {
+    if (
+      inspectWindowsAdapterBoundPath(runtime, payloadPath, "file", {
+        allowMissing: true,
+      }).exists
+    ) {
+      return { reason: "windows_adapter_invocation_random_path_collision" };
+    }
     runtime.fs.writeFileSync(payloadPath, content, {
       mode: 0o600,
       flag: "wx",
     });
+    const inspected = inspectWindowsAdapterAssembly(runtime, payloadPath);
+    if (inspected.assemblyDigest !== sha256(content)) {
+      throw new Error("Windows adapter invocation changed after creation");
+    }
+    fileIdentity = inspected.fileIdentity;
   } catch (error) {
+    if (!fileIdentity) {
+      try {
+        const inspected = inspectWindowsAdapterBoundPath(
+          runtime,
+          payloadPath,
+          "file",
+          { allowMissing: true },
+        );
+        fileIdentity = inspected.exists ? inspected.identity : null;
+      } catch {
+        fileIdentity = null;
+      }
+    }
+    if (error?.adapterReason === WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON) {
+      cleanupOrTrackWindowsTemporaryPath(
+        runtime,
+        payloadPath,
+        100,
+        null,
+        fileIdentity,
+      );
+      return { reason: WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON };
+    }
     if (error?.code === "EEXIST") {
       return { reason: "windows_adapter_invocation_random_path_collision" };
     }
     return {
-      reason: cleanupOrTrackWindowsTemporaryPath(runtime, payloadPath)
+      reason: cleanupOrTrackWindowsTemporaryPath(
+        runtime,
+        payloadPath,
+        100,
+        null,
+        fileIdentity,
+      )
         ? "windows_adapter_invocation_materialize_failed"
         : "windows_adapter_invocation_cleanup_unverified",
     };
@@ -1046,7 +2080,24 @@ function materializeWindowsAdapterInvocation(runtime, helperArgs) {
   return {
     payloadPath,
     payloadDigest: sha256(content),
-    cleanup: () => cleanupOrTrackWindowsTemporaryPath(runtime, payloadPath),
+    fileIdentity,
+    verify: () => {
+      const inspected = assertWindowsAdapterBoundPathIdentity(
+        runtime,
+        payloadPath,
+        "file",
+        fileIdentity,
+      );
+      return inspected.exists;
+    },
+    cleanup: () =>
+      cleanupOrTrackWindowsTemporaryPath(
+        runtime,
+        payloadPath,
+        100,
+        null,
+        fileIdentity,
+      ),
   };
 }
 
@@ -1102,6 +2153,7 @@ function buildWindowsAdapterInvocation(entry, invocation) {
         invocation.payloadPath,
         invocation.payloadDigest,
       ],
+      verify: invocation.verify,
       cleanup: invocation.cleanup,
     };
   }
@@ -1116,6 +2168,7 @@ function buildWindowsAdapterInvocation(entry, invocation) {
       "-EncodedCommand",
       windowsPowerShellBootstrap(entry, invocation),
     ],
+    verify: invocation.verify,
     cleanup: invocation.cleanup,
   };
 }
@@ -1202,11 +2255,14 @@ function createFreshWindowsAdapter(runtime, source, hostEnvironment) {
     runtime,
     runtimeFs: runtime.fs,
     tempDirectory: source.tempDirectory,
+    tempRootBinding: source.tempRootBinding,
+    idleTtlMs: source.idleTtlMs,
     sourceDigest: source.sourceDigest,
     sourceContractDigest: source.sourceContractDigest,
     loaderMode: source.loaderMode,
     powershellPath: powershellHosts[0] || null,
     adapterDirectory: materialized.adapterDirectory,
+    adapterDirectoryIdentity: materialized.adapterDirectoryIdentity,
     assemblyPath: materialized.assemblyPath,
     assemblyDigest: attestation.assemblyDigest,
     fileIdentity: attestation.fileIdentity,
@@ -1362,7 +2418,9 @@ function createWindowsAdapterController(runtime, source, hostEnvironment) {
       error.adapterReason = payload.reason;
       throw error;
     }
-    return buildWindowsAdapterInvocation(entry, payload);
+    const invocation = buildWindowsAdapterInvocation(entry, payload);
+    invocation.verify();
+    return invocation;
   };
 
   return {
@@ -1373,6 +2431,7 @@ function createWindowsAdapterController(runtime, source, hostEnvironment) {
       let result;
       let failure;
       try {
+        invocation.verify();
         result = runtime.spawnSync(invocation.command, invocation.args, {
           ...options,
           cwd: runtime.joinPath(runtime.windowsDir(), "System32"),
@@ -1400,20 +2459,40 @@ function createWindowsAdapterController(runtime, source, hostEnvironment) {
   };
 }
 
+function readWindowsAdapterBoundFile(runtime, filePath, encoding = null) {
+  const before = inspectWindowsAdapterBoundPath(runtime, filePath, "file");
+  const content = runtime.fs.readFileSync(filePath, encoding || undefined);
+  const after = assertWindowsAdapterBoundPathIdentity(
+    runtime,
+    filePath,
+    "file",
+    before.identity,
+  );
+  if (!sameWindowsFileIdentity(before.identity, after.identity)) {
+    throw windowsAdapterTempRootChangedError();
+  }
+  return { content, fileIdentity: after.identity };
+}
+
 function waitForWindowsTargetIdentity(
   proc,
   identityPath,
   runtime,
   expectedAppContainer = null,
   timeoutMs = 30_000,
+  onIdentityFileAttested = null,
 ) {
   const deadline = runtime.now() + timeoutMs;
   let lastError;
   while (runtime.now() < deadline) {
     try {
-      const identity = JSON.parse(
-        runtime.fs.readFileSync(identityPath, "utf8"),
+      const identityFile = readWindowsAdapterBoundFile(
+        runtime,
+        identityPath,
+        "utf8",
       );
+      onIdentityFileAttested?.(identityFile.fileIdentity);
+      const identity = JSON.parse(identityFile.content);
       if (identity?.error) {
         throw new Error(
           `Windows sandbox helper rejected the target: ${identity.error}`,
@@ -2077,6 +3156,7 @@ export function applyWindowsSandbox(
   spawnOpts,
   sandboxOpts = {},
   runtimeOverrides = {},
+  planBindingAuthority = null,
 ) {
   let runtime = resolveRuntime(runtimeOverrides);
   const requiredBoundaries = Array.isArray(sandboxOpts.requiredBoundaries)
@@ -2097,6 +3177,10 @@ export function applyWindowsSandbox(
     SANDBOX_BOUNDARIES.RESOURCE_LIMITS,
     SANDBOX_BOUNDARIES.PRIVILEGE_REDUCTION,
   ];
+  const appContainerSupportedBoundaries = [
+    ...appContainerGuarantees,
+    SANDBOX_BOUNDARIES.CODE_SNAPSHOT,
+  ];
   const base = {
     platform: runtime.platform,
     profile: sandboxOpts.profileName || "default",
@@ -2143,7 +3227,7 @@ export function applyWindowsSandbox(
   if (
     requiresAppContainer &&
     requiredBoundaries.some(
-      (boundary) => !appContainerGuarantees.includes(boundary),
+      (boundary) => !appContainerSupportedBoundaries.includes(boundary),
     )
   ) {
     return unavailablePlan("windows_appcontainer_boundary_unsupported");
@@ -2224,11 +3308,33 @@ export function applyWindowsSandbox(
   ) {
     return unavailablePlan("windows_git_nested_process_compatibility");
   }
+  const windowsAdapterTempRootBinding = resolveWindowsAdapterTempRoot(
+    runtime,
+    runtimeOverrides,
+  );
+  if (!windowsAdapterTempRootBinding) {
+    return unavailablePlan(WINDOWS_ADAPTER_TEMP_ROOT_UNTRUSTED_REASON);
+  }
+  const windowsAdapterIdleTtlMs = normalizeWindowsAdapterIdleTtlMs(runtime);
+  runtime = {
+    ...runtime,
+    windowsAdapterTempRoot: windowsAdapterTempRootBinding.rootPath,
+    windowsAdapterTempRootBinding,
+    windowsAdapterIdleTtlMs,
+    tmpdir: () => windowsAdapterTempRootBinding.rootPath,
+  };
   const loaderMode =
     profile !== "strict" && !requiresAppContainer && !entrySnapshot.locks
       ? "managed-executable"
       : "powershell-byte-assembly";
-  const adapterSource = loadWindowsAdapterSource(runtime, loaderMode);
+  let adapterSource;
+  try {
+    adapterSource = loadWindowsAdapterSource(runtime, loaderMode);
+  } catch (error) {
+    return unavailablePlan(
+      error?.adapterReason || WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON,
+    );
+  }
   if (!adapterSource.content) {
     return unavailablePlan(adapterSource.reason);
   }
@@ -2273,6 +3379,22 @@ export function applyWindowsSandbox(
             .toString("hex")}.json`,
         )
       : null;
+  let identityFileIdentity = null;
+  if (identityPath) {
+    try {
+      if (
+        inspectWindowsAdapterBoundPath(runtime, identityPath, "file", {
+          allowMissing: true,
+        }).exists
+      ) {
+        return unavailablePlan("windows_identity_random_path_collision");
+      }
+    } catch (error) {
+      return unavailablePlan(
+        error?.adapterReason || WINDOWS_ADAPTER_TEMP_ROOT_CHANGED_REASON,
+      );
+    }
+  }
   const launchSpec = {
     cpuSeconds: Number(limits.cpu || 0),
     processMemoryBytes: Number(
@@ -2313,7 +3435,13 @@ export function applyWindowsSandbox(
   if (identityPath) launchSpec.identityPath = identityPath;
   const cleanupIdentity = () => {
     if (!identityPath) return true;
-    return cleanupOrTrackWindowsTemporaryPath(runtime, identityPath);
+    return cleanupOrTrackWindowsTemporaryPath(
+      runtime,
+      identityPath,
+      100,
+      null,
+      identityFileIdentity,
+    );
   };
   const appContainerProfileName = requiresAppContainer
     ? `ChainlessChain.CliSandbox.${runtime.randomBytes(12).toString("hex")}`
@@ -2503,10 +3631,14 @@ export function applyWindowsSandbox(
     detached: false,
     shell: false,
     cwd: helperWorkingDirectory,
-    env: hostEnvironment,
+    env: Object.freeze({ ...hostEnvironment }),
+    stdio: Array.isArray(invocation.options.stdio)
+      ? Object.freeze([...invocation.options.stdio])
+      : invocation.options.stdio,
   };
   let appContainerCleanupVerified = false;
   let appContainerCleanupRecord = null;
+  let issuedWindowsMcpPlan = null;
   const cleanupAppContainer = () => {
     if (!appContainer || appContainerCleanupVerified) return true;
     if (appContainerCleanupRecord) {
@@ -2544,6 +3676,10 @@ export function applyWindowsSandbox(
     return false;
   };
   const cleanup = () => {
+    if (issuedWindowsMcpPlan) {
+      issuedWindowsMcpCodeSnapshotPlans.delete(issuedWindowsMcpPlan);
+      issuedWindowsMcpPlan = null;
+    }
     const failures = [];
     const attempt = (label, action) => {
       try {
@@ -2579,6 +3715,10 @@ export function applyWindowsSandbox(
               identityPath,
               runtime,
               appContainer,
+              30_000,
+              (fileIdentity) => {
+                identityFileIdentity = fileIdentity;
+              },
             );
             if (!cleanupIdentity()) {
               throw new Error(
@@ -2604,6 +3744,28 @@ export function applyWindowsSandbox(
         },
       }
     : {};
+  const windowsMcpPlanBinding =
+    entrySnapshot.locks &&
+    sandboxOpts.executionContract?.kind ===
+      MCP_STDIO_CAPSULE_SANDBOX_CONTRACT_KIND
+      ? createWindowsMcpCodeSnapshotPlanBinding({
+          executionContract: sandboxOpts.executionContract,
+          command,
+          args,
+          spawnOpts,
+          profile,
+          requiredBoundaries,
+          sync: sandboxOpts.sync === true,
+          backend,
+          policyAttested: requiresAppContainer ? true : null,
+          policyDigest: appContainerPolicyDigest,
+          adapterSource,
+          helperInvocation,
+          helperOptions: options,
+          postSpawn: identityContract.postSpawn,
+          postSpawnWindows: identityContract.postSpawnWindows,
+        })
+      : null;
   const entrySnapshotRuntimeProbe = entrySnapshot.locks
     ? {
         ...(appContainerRuntimeProbe || nodeSnapshotRuntimeProbe),
@@ -2636,16 +3798,19 @@ export function applyWindowsSandbox(
               runtimeLaunchMechanism:
                 "filter-oplock-locked-createprocess-suspended-image-v1",
               sharedLibraryClosure: false,
+              planBindingMechanism: "windows-mcp-code-snapshot-plan-binding-v1",
+              planBindingDigest: windowsMcpPlanBinding.planBindingDigest,
             }
           : {}),
       }
     : appContainerRuntimeProbe;
-  return createSandboxPlan({
+  const plan = createSandboxPlan({
     ...base,
     applied: true,
     enforcement: backend,
     policyAttested: requiresAppContainer ? true : null,
     policyDigest: appContainerPolicyDigest,
+    adapterTempRootAttestation: adapterSource.tempRootAttestation,
     runtimeProbe: entrySnapshotRuntimeProbe,
     guarantees: [
       ...(requiresAppContainer
@@ -2667,6 +3832,14 @@ export function applyWindowsSandbox(
     ...identityContract,
     cleanup,
   });
+  if (
+    windowsMcpPlanBinding &&
+    planBindingAuthority === WINDOWS_MCP_CODE_SNAPSHOT_ISSUER
+  ) {
+    issuedWindowsMcpPlan = plan;
+    issuedWindowsMcpCodeSnapshotPlans.set(plan, windowsMcpPlanBinding);
+  }
+  return plan;
 }
 
 /**
@@ -2717,13 +3890,12 @@ function linuxBubblewrapProbe(
   const supervisorDescriptorBound =
     supervisorBinding?.mechanism === LINUX_BWRAP_SUPERVISOR_BINDING_MECHANISM;
   const pluginTreeContentSnapshot =
-    !native &&
     attempted &&
     snapshot &&
     runnable &&
     reason === null &&
     supervisorDescriptorBound &&
-    pluginTreeSnapshot?.scope === LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE &&
+    pluginTreeSnapshot?.scope === LINUX_PLUGIN_TREE_SNAPSHOT_SCOPE &&
     pluginTreeSnapshot?.mechanism === LINUX_ENTRY_SNAPSHOT_MECHANISM &&
     Number.isSafeInteger(pluginTreeSnapshot?.files) &&
     pluginTreeSnapshot.files > 0 &&
@@ -2734,7 +3906,7 @@ function linuxBubblewrapProbe(
     typeof pluginTreeSnapshot?.digest === "string" &&
     /^[a-f0-9]{64}$/.test(pluginTreeSnapshot.digest) &&
     pluginTreeSnapshot?.consistency ===
-      LINUX_NODE_PLUGIN_TREE_SNAPSHOT_CONSISTENCY &&
+      LINUX_PLUGIN_TREE_SNAPSHOT_CONSISTENCY &&
     pluginTreeSnapshot?.contractBound === false &&
     pluginTreeSnapshot?.atomic === false;
   const initialDynamicLoadClosureDescriptorBound =
@@ -3349,16 +4521,20 @@ function linuxEntrySnapshotContract(targetRuntime) {
   throw new Error("entry_snapshot_runtime_unsupported");
 }
 
-function linuxNodePluginTreeFileSnapshotContract(sourceMode) {
+function linuxPluginTreeFileSnapshotContract(sourceMode, targetRuntime) {
+  const native = targetRuntime?.startsWith("native-");
+  const errorPrefix = native
+    ? "native_plugin_tree_snapshot"
+    : "node_plugin_tree_snapshot";
   if (!Number.isSafeInteger(sourceMode) || sourceMode < 0) {
-    throw new Error("node_plugin_tree_snapshot_source_mode_invalid");
+    throw new Error(`${errorPrefix}_source_mode_invalid`);
   }
   return {
-    scope: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE,
+    scope: LINUX_PLUGIN_TREE_SNAPSHOT_SCOPE,
     targetMode: (sourceMode & 0o111) !== 0 ? "0500" : "0400",
     sourceMode: LINUX_ENTRY_SNAPSHOT_SOURCE_MODE,
     minimumBytes: 0,
-    errorPrefix: "node_plugin_tree_snapshot",
+    errorPrefix,
   };
 }
 
@@ -3439,9 +4615,9 @@ function createLinuxRegularFileSnapshot(
       throw snapshotError("source_changed");
     }
     if (
-      snapshotContract.scope === LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE &&
+      snapshotContract.scope === LINUX_PLUGIN_TREE_SNAPSHOT_SCOPE &&
       snapshotContract.targetMode !==
-        linuxNodePluginTreeFileSnapshotContract(sourceFileMode).targetMode
+        ((sourceFileMode & 0o111) !== 0 ? "0500" : "0400")
     ) {
       throw snapshotError("source_mode_changed");
     }
@@ -3829,7 +5005,6 @@ function applyLinuxMcpCapsuleCodeSnapshot(
   ]);
   const descriptors = [runtimeSnapshot.finalMount, entrySnapshot.finalMount];
   const runtimeFd = 3;
-  const entryFd = 4;
   const snapshotIdentity = Object.freeze({
     runtimeSnapshotSha256: runtimeSnapshot.attestation.sha256,
     runtimeSnapshotBytes: runtimeSnapshot.attestation.bytes,
@@ -3846,6 +5021,8 @@ function applyLinuxMcpCapsuleCodeSnapshot(
       ].sort(),
       identity: snapshotIdentity,
       cwd: invocation.options.cwd,
+      entrySnapshotBootstrapSha256: MCP_STDIO_FD_ENTRY_BOOTSTRAP_SHA256,
+      runtimeLaunchMechanism: "inherited-executable-fd-v1",
       passthroughArgsDigest: sha256(JSON.stringify(invocation.args.slice(1))),
     }),
   );
@@ -3874,13 +5051,22 @@ function applyLinuxMcpCapsuleCodeSnapshot(
       contentSnapshotScope: "mcp-capsule-entry-and-node-runtime",
       contentSnapshotMechanism: LINUX_MCP_CAPSULE_SNAPSHOT_MECHANISM,
       handleAtomic: true,
+      entrySnapshotAtomic: true,
+      runtimeLaunchAtomic: true,
+      runtimeLaunchMechanism: "inherited-executable-fd-v1",
+      entrySnapshotBootstrapSha256: MCP_STDIO_FD_ENTRY_BOOTSTRAP_SHA256,
       sharedLibraryClosure: false,
       ...snapshotIdentity,
     },
     reason: null,
     guarantees: [SANDBOX_BOUNDARIES.CODE_SNAPSHOT],
     command: `/proc/self/fd/${runtimeFd}`,
-    args: [`/proc/self/fd/${entryFd}`, ...invocation.args.slice(1)],
+    args: [
+      "-e",
+      MCP_STDIO_FD_ENTRY_BOOTSTRAP,
+      "--",
+      ...invocation.args.slice(1),
+    ],
     options: {
       ...invocation.options,
       shell: false,
@@ -3892,7 +5078,21 @@ function applyLinuxMcpCapsuleCodeSnapshot(
   });
 }
 
-function buildLinuxNodePluginTreeSnapshotAttestation(mounts, entryDestination) {
+/**
+ * Bind the synthetic plugin tree to the anonymous content snapshots mounted
+ * for launch. Directory membership is fixed by pinLinuxPluginTree; contents
+ * are copied and sealed per file, so the evidence deliberately remains
+ * `atomic: false` rather than claiming one filesystem-wide transaction.
+ */
+function buildLinuxPluginTreeSnapshotAttestation(
+  mounts,
+  entryDestination,
+  targetRuntime,
+) {
+  const native = targetRuntime?.startsWith("native-");
+  const errorPrefix = native
+    ? "native_plugin_tree_snapshot"
+    : "node_plugin_tree_snapshot";
   const members = [];
   const destinations = new Set();
   for (const mount of mounts || []) {
@@ -3901,18 +5101,23 @@ function buildLinuxNodePluginTreeSnapshotAttestation(mounts, entryDestination) {
       path.posix.normalize(mount.destination) !== mount.destination ||
       destinations.has(mount.destination)
     ) {
-      throw new Error("node_plugin_tree_snapshot_destination_invalid");
+      throw new Error(`${errorPrefix}_destination_invalid`);
     }
     destinations.add(mount.destination);
     const snapshot = mount.contentSnapshot;
     const entry = mount.destination === entryDestination;
     const expectedScope = entry
-      ? LINUX_NODE_ENTRY_SNAPSHOT_SCOPE
-      : LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE;
+      ? native
+        ? LINUX_NATIVE_ENTRY_SNAPSHOT_SCOPE
+        : LINUX_NODE_ENTRY_SNAPSHOT_SCOPE
+      : LINUX_PLUGIN_TREE_SNAPSHOT_SCOPE;
     const sourceMode = Number.parseInt(snapshot?.sourceFileMode, 8);
     const expectedTargetMode = entry
-      ? LINUX_NODE_ENTRY_SNAPSHOT_TARGET_MODE
-      : linuxNodePluginTreeFileSnapshotContract(sourceMode).targetMode;
+      ? native
+        ? LINUX_NATIVE_ENTRY_SNAPSHOT_TARGET_MODE
+        : LINUX_NODE_ENTRY_SNAPSHOT_TARGET_MODE
+      : linuxPluginTreeFileSnapshotContract(sourceMode, targetRuntime)
+          .targetMode;
     if (
       snapshot?.scope !== expectedScope ||
       snapshot?.mechanism !== LINUX_ENTRY_SNAPSHOT_MECHANISM ||
@@ -3935,7 +5140,7 @@ function buildLinuxNodePluginTreeSnapshotAttestation(mounts, entryDestination) {
       mount.mountMode !== "ro-bind-data" ||
       mount.mountPermissions !== expectedTargetMode
     ) {
-      throw new Error("node_plugin_tree_snapshot_member_invalid");
+      throw new Error(`${errorPrefix}_member_invalid`);
     }
     members.push({
       destination: mount.destination,
@@ -3962,58 +5167,66 @@ function buildLinuxNodePluginTreeSnapshotAttestation(mounts, entryDestination) {
     members.length > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_FILES ||
     !members.some((member) => member.destination === entryDestination)
   ) {
-    throw new Error("node_plugin_tree_snapshot_file_count_invalid");
+    throw new Error(`${errorPrefix}_file_count_invalid`);
   }
   const bytes = members.reduce((total, member) => total + member.bytes, 0);
   if (
     !Number.isSafeInteger(bytes) ||
     bytes > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_BYTES
   ) {
-    throw new Error("node_plugin_tree_snapshot_bytes_exceeded");
+    throw new Error(`${errorPrefix}_bytes_exceeded`);
   }
   const digest = crypto
     .createHash("sha256")
     .update(
       JSON.stringify({
         version: 1,
-        scope: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE,
-        consistency: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_CONSISTENCY,
+        scope: LINUX_PLUGIN_TREE_SNAPSHOT_SCOPE,
+        ...(native ? { targetRuntime } : {}),
+        consistency: LINUX_PLUGIN_TREE_SNAPSHOT_CONSISTENCY,
         members,
       }),
     )
     .digest("hex");
   return Object.freeze({
-    scope: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_SCOPE,
+    scope: LINUX_PLUGIN_TREE_SNAPSHOT_SCOPE,
     mechanism: LINUX_ENTRY_SNAPSHOT_MECHANISM,
     files: members.length,
     bytes,
     digest,
-    consistency: LINUX_NODE_PLUGIN_TREE_SNAPSHOT_CONSISTENCY,
+    consistency: LINUX_PLUGIN_TREE_SNAPSHOT_CONSISTENCY,
     contractBound: false,
     atomic: false,
   });
 }
 
-function attestLinuxNodePluginTreeSnapshot(
+function attestLinuxPluginTreeSnapshot(
   runtime,
   mounts,
   entryDestination,
+  targetRuntime,
   expected,
 ) {
+  const native = targetRuntime?.startsWith("native-");
+  const errorPrefix = native
+    ? "native_plugin_tree_snapshot"
+    : "node_plugin_tree_snapshot";
   for (const mount of mounts || []) {
     if (!linuxPathWithin("/opt/chainless/plugin", mount?.destination)) continue;
     const snapshot = mount.contentSnapshot;
     const contract =
       mount.destination === entryDestination
-        ? linuxEntrySnapshotContract("node")
-        : linuxNodePluginTreeFileSnapshotContract(
+        ? linuxEntrySnapshotContract(targetRuntime)
+        : linuxPluginTreeFileSnapshotContract(
             Number.parseInt(snapshot?.sourceFileMode, 8),
+            targetRuntime,
           );
     attestLinuxRegularFileSnapshot(runtime, mount, snapshot, contract);
   }
-  const actual = buildLinuxNodePluginTreeSnapshotAttestation(
+  const actual = buildLinuxPluginTreeSnapshotAttestation(
     mounts,
     entryDestination,
+    targetRuntime,
   );
   for (const field of [
     "scope",
@@ -4026,7 +5239,7 @@ function attestLinuxNodePluginTreeSnapshot(
     "atomic",
   ]) {
     if (actual[field] !== expected?.[field]) {
-      throw new Error("node_plugin_tree_snapshot_identity_changed");
+      throw new Error(`${errorPrefix}_identity_changed`);
     }
   }
 }
@@ -5707,7 +6920,10 @@ export function applyLinuxSandbox(
       boundary === SANDBOX_BOUNDARIES.PROCESS_TREE,
   );
 
-  if (requiredBoundaries.includes(SANDBOX_BOUNDARIES.CODE_SNAPSHOT)) {
+  if (
+    requiredBoundaries.includes(SANDBOX_BOUNDARIES.CODE_SNAPSHOT) &&
+    !requiresStrongLinuxBoundary
+  ) {
     return applyLinuxMcpCapsuleCodeSnapshot(
       command,
       args,
@@ -5921,30 +7137,33 @@ export function applyLinuxSandbox(
       const rawPluginMounts = pluginMountIndexes.map(
         (index) => pinnedMounts[index],
       );
-      if (validation.entryRuntime === "node") {
-        if (
-          pluginMountIndexes.length < 1 ||
-          pluginMountIndexes.length > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_FILES
-        ) {
-          throw new Error("node_plugin_tree_snapshot_file_count_invalid");
-        }
-        const pluginBytes = pluginMountIndexes.reduce((total, index) => {
-          const bytes = pinnedMounts[index]?.bytes;
-          if (
-            !Number.isSafeInteger(bytes) ||
-            bytes < 0 ||
-            bytes > LINUX_ATTESTED_FILE_MAX_BYTES
-          ) {
-            throw new Error("node_plugin_tree_snapshot_member_size_invalid");
-          }
-          return total + bytes;
-        }, 0);
+      const pluginSnapshotErrorPrefix = validation.entryRuntime.startsWith(
+        "native-",
+      )
+        ? "native_plugin_tree_snapshot"
+        : "node_plugin_tree_snapshot";
+      if (
+        pluginMountIndexes.length < 1 ||
+        pluginMountIndexes.length > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_FILES
+      ) {
+        throw new Error(`${pluginSnapshotErrorPrefix}_file_count_invalid`);
+      }
+      const pluginBytes = pluginMountIndexes.reduce((total, index) => {
+        const bytes = pinnedMounts[index]?.bytes;
         if (
-          !Number.isSafeInteger(pluginBytes) ||
-          pluginBytes > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_BYTES
+          !Number.isSafeInteger(bytes) ||
+          bytes < 0 ||
+          bytes > LINUX_ATTESTED_FILE_MAX_BYTES
         ) {
-          throw new Error("node_plugin_tree_snapshot_bytes_exceeded");
+          throw new Error(`${pluginSnapshotErrorPrefix}_member_size_invalid`);
         }
+        return total + bytes;
+      }, 0);
+      if (
+        !Number.isSafeInteger(pluginBytes) ||
+        pluginBytes > LINUX_PLUGIN_TREE_SNAPSHOT_MAX_BYTES
+      ) {
+        throw new Error(`${pluginSnapshotErrorPrefix}_bytes_exceeded`);
       }
       const rawEntryMount = entryMount;
       const snapshot = createLinuxEntrySnapshot(
@@ -5958,37 +7177,36 @@ export function applyLinuxSandbox(
       finalMounts[entryIndex] = snapshot.finalMount;
       probeMounts[entryIndex] = snapshot.probeMount;
       entrySnapshot = snapshot;
-      if (validation.entryRuntime === "node") {
-        for (const index of pluginMountIndexes) {
-          if (index === entryIndex) continue;
-          const rawMount = pinnedMounts[index];
-          const source = runtime.fs.fstatSync(rawMount.fd);
-          const fileSnapshot = createLinuxRegularFileSnapshot(
-            runtime,
-            rawMount,
-            {
-              fileId: rawMount.fileId,
-              bytes: rawMount.bytes,
-              mtimeMs: rawMount.mtimeMs,
-            },
-            linuxNodePluginTreeFileSnapshotContract(Number(source.mode)),
-          );
-          pluginTreeFileSnapshots.push(fileSnapshot);
-          finalMounts[index] = fileSnapshot.finalMount;
-          probeMounts[index] = fileSnapshot.probeMount;
-        }
-        pluginTreeSnapshot = buildLinuxNodePluginTreeSnapshotAttestation(
-          finalMounts,
-          sandboxEntry,
+      for (const index of pluginMountIndexes) {
+        if (index === entryIndex) continue;
+        const rawMount = pinnedMounts[index];
+        const source = runtime.fs.fstatSync(rawMount.fd);
+        const fileSnapshot = createLinuxRegularFileSnapshot(
+          runtime,
+          rawMount,
+          {
+            fileId: rawMount.fileId,
+            bytes: rawMount.bytes,
+            mtimeMs: rawMount.mtimeMs,
+          },
+          linuxPluginTreeFileSnapshotContract(
+            Number(source.mode),
+            validation.entryRuntime,
+          ),
         );
+        pluginTreeFileSnapshots.push(fileSnapshot);
+        finalMounts[index] = fileSnapshot.finalMount;
+        probeMounts[index] = fileSnapshot.probeMount;
       }
+      pluginTreeSnapshot = buildLinuxPluginTreeSnapshotAttestation(
+        finalMounts,
+        sandboxEntry,
+        validation.entryRuntime,
+      );
       pinnedMounts = finalMounts;
       probePinnedMounts = probeMounts;
       entryMount = entrySnapshot.finalMount;
-      closeLinuxPinnedMounts(
-        runtime,
-        validation.entryRuntime === "node" ? rawPluginMounts : [rawEntryMount],
-      );
+      closeLinuxPinnedMounts(runtime, rawPluginMounts);
     } catch (error) {
       closeLinuxPinnedMounts(runtime, pinnedMounts);
       closeLinuxPinnedMounts(runtime, [
@@ -6168,7 +7386,7 @@ export function applyLinuxSandbox(
       .createHash("sha256")
       .update(
         JSON.stringify({
-          version: validation.entryRuntime === "node" ? 4 : 3,
+          version: 4,
           backend: LINUX_BWRAP_BACKEND,
           supervisor: supervisorPin.attestation,
           contract: {
@@ -6212,9 +7430,7 @@ export function applyLinuxSandbox(
           ...(nativeDynamicClosure
             ? { initialDynamicLoadClosure: nativeDynamicClosure }
             : {}),
-          ...(validation.entryRuntime === "node"
-            ? { pluginTreeContentSnapshot: pluginTreeSnapshot }
-            : {}),
+          pluginTreeContentSnapshot: pluginTreeSnapshot,
           seccomp: {
             arch: seccompFilter.arch,
             policy: seccompFilter.policy,
@@ -6287,21 +7503,13 @@ export function applyLinuxSandbox(
       });
     }
     try {
-      if (validation.entryRuntime === "node") {
-        attestLinuxNodePluginTreeSnapshot(
-          runtime,
-          pinnedMounts,
-          sandboxEntry,
-          pluginTreeSnapshot,
-        );
-      } else {
-        attestLinuxEntrySnapshot(
-          runtime,
-          entryMount,
-          entrySnapshot.attestation,
-          validation.entryRuntime,
-        );
-      }
+      attestLinuxPluginTreeSnapshot(
+        runtime,
+        pinnedMounts,
+        sandboxEntry,
+        validation.entryRuntime,
+        pluginTreeSnapshot,
+      );
     } catch (error) {
       closeStrongLinuxResources(supervisorPin, finalLaunch);
       return createSandboxPlan({
@@ -6369,17 +7577,36 @@ export function applyLinuxSandbox(
     const supervisorBinding = supervisorPin.attestation;
     closeLinuxPinnedMounts(runtime, [supervisorPin]);
     supervisorPin = null;
+    const capsuleContract =
+      validation.contract.kind === MCP_STDIO_CAPSULE_SANDBOX_CONTRACT_KIND;
+    const baseRuntimeProbe = linuxBubblewrapProbe(
+      true,
+      true,
+      null,
+      validation.entryRuntime,
+      entrySnapshot?.attestation,
+      supervisorBinding,
+      pluginTreeSnapshot,
+      nativeDynamicClosure,
+    );
     const runtimeProbe = Object.freeze(
-      linuxBubblewrapProbe(
-        true,
-        true,
-        null,
-        validation.entryRuntime,
-        entrySnapshot?.attestation,
-        supervisorBinding,
-        pluginTreeSnapshot,
-        nativeDynamicClosure,
-      ),
+      capsuleContract
+        ? {
+            ...baseRuntimeProbe,
+            mcpCapsuleCodeSnapshot: true,
+            entrySnapshotAtomic: true,
+            runtimeLaunchAtomic: true,
+            runtimeLaunchMechanism:
+              "bwrap-descriptor-mount-node-runtime-exec-v1",
+            sharedLibraryClosure: false,
+            runtimeSnapshotSha256: validation.contract.runtimeIdentity.sha256,
+            runtimeSnapshotBytes: validation.contract.runtimeIdentity.bytes,
+            entrySnapshotSha256: entrySnapshot.attestation.sha256,
+            entrySnapshotBytes: entrySnapshot.attestation.bytes,
+            runtimeLaunchPath: "/opt/chainless/runtime/node",
+            entrySnapshotPath: sandboxEntry,
+          }
+        : baseRuntimeProbe,
     );
     const options = {
       ...spawnOpts,
@@ -6417,6 +7644,7 @@ export function applyLinuxSandbox(
         SANDBOX_BOUNDARIES.FILESYSTEM,
         SANDBOX_BOUNDARIES.NETWORK,
         SANDBOX_BOUNDARIES.PROCESS_TREE,
+        ...(capsuleContract ? [SANDBOX_BOUNDARIES.CODE_SNAPSHOT] : []),
       ],
       command: finalLaunch.command,
       args: [...policyArgs, "--", ...targetArgs],
@@ -6492,21 +7720,27 @@ export function applySandbox(
   args,
   spawnOpts,
   profileOrRequest = "default",
-  runtimeOverrides = {},
+  runtimeOverrides = undefined,
   explicitRequest = null,
 ) {
+  const runtimeInjected = runtimeOverrides !== undefined;
   const runtime = resolveRuntime(runtimeOverrides);
   const sandboxRequest = normalizeSandboxRequest(
     profileOrRequest,
     explicitRequest,
   );
   const profileName = sandboxRequest.profile;
+  // Windows does not consume the POSIX allow-write lists. Avoid invoking an
+  // embedding temp-directory hook while eagerly constructing three unused
+  // profiles; applyWindowsSandbox resolves and pins that hook exactly once.
+  const profileTempDirectory =
+    runtime.platform === "win32" ? null : runtime.tmpdir();
   const profiles = {
     default: {
       allowNetwork: false,
       allowExec: true,
       allowRead: [runtime.homedir(), "/tmp"],
-      allowWrite: [runtime.tmpdir()],
+      allowWrite: profileTempDirectory ? [profileTempDirectory] : [],
       limits: {
         // RLIMIT_NPROC is intentionally omitted. Linux applies it per real
         // user ID rather than to this child tree, so it can starve unrelated
@@ -6519,7 +7753,7 @@ export function applySandbox(
       allowNetwork: false,
       allowExec: false,
       allowRead: [],
-      allowWrite: [runtime.tmpdir()],
+      allowWrite: profileTempDirectory ? [profileTempDirectory] : [],
       limits: {
         cpu: 10,
         as: 256 * 1024 * 1024, // 256MB address space
@@ -6530,7 +7764,7 @@ export function applySandbox(
       allowNetwork: true,
       allowExec: true,
       allowRead: [runtime.homedir()],
-      allowWrite: [runtime.tmpdir()],
+      allowWrite: profileTempDirectory ? [profileTempDirectory] : [],
       limits: {
         cpu: 60,
         nofile: 512,
@@ -6558,6 +7792,7 @@ export function applySandbox(
       spawnOpts,
       profile,
       runtimeOverrides,
+      runtimeInjected ? null : WINDOWS_MCP_CODE_SNAPSHOT_ISSUER,
     );
   }
   if (runtime.platform === "linux") {