chainlesschain 0.163.7 → 0.164.0

package/src/lib/process-execution-broker/index.js

@@ -36,16 +36,32 @@ const require = createRequire(import.meta.url);
 // platform-sandbox.js exports: applySandbox, postSpawnSandbox
 import {
   applySandbox as _applySandbox,
+  consumeMacMcpCodeSnapshotPlanBinding,
   consumeWindowsMcpCodeSnapshotPlanBinding,
   postSpawnSandbox as _postSpawnSandbox,
   MCP_STDIO_FD_ENTRY_BOOTSTRAP_SHA256,
+  MCP_STDIO_MACOS_GATED_ENTRY_BOOTSTRAP_SHA256,
+  MACOS_PKG_EXECPATH_MAGIC,
   SANDBOX_BOUNDARIES,
 } from "./platform-sandbox.js";
+import {
+  MACOS_MCP_LAUNCHER_INPUTS,
+  isMacosMcpLauncherPackageVersion,
+} from "./macos-mcp-launcher-contract.js";
 import {
   admitLinuxGenericSandboxExecutionContract,
   issueLinuxGenericSandboxExecutionContract,
   LINUX_GENERIC_CONTRACT_KIND,
+  verifyLinuxGenericBubblewrapPlan,
 } from "./linux-generic-bwrap.js";
+import {
+  LINUX_BWRAP_DESCRIPTOR_SCRUBBER_KIND,
+  LINUX_BWRAP_DESCRIPTOR_SCRUBBER_MECHANISM,
+  LINUX_BWRAP_DESCRIPTOR_SCRUBBER_PASSES,
+  LINUX_BWRAP_DESCRIPTOR_SCRUBBER_PATH,
+  LINUX_BWRAP_DESCRIPTOR_SCRUBBER_SCRIPT_SHA256,
+  parseLinuxBwrapDescriptorScrubbedLaunch,
+} from "./linux-bwrap-descriptor-launch.js";
 import { consumeIssuedPluginSandboxExecutionContract } from "../plugin-runtime/bin.js";
 import runtimeProvenanceLedger from "../runtime-provenance-ledger.js";
 import { credentialAgent } from "./credential-agent.js";
@@ -65,6 +81,424 @@ const SUPPORTED_SANDBOX_PROFILES = new Set([
 // Broker-private admission state. Public runtime-probe fields are audit
 // evidence, not authority to invoke a privileged post-spawn closure.
 const admittedWindowsMcpCodeSnapshotPlans = new WeakSet();
+const admittedMacMcpCodeSnapshotPlans = new WeakSet();
+
+const LINUX_RUNTIME_PATHNAME_POLICY_PREFIX = Object.freeze([
+  "--die-with-parent",
+  "--new-session",
+  "--unshare-user",
+  "--disable-userns",
+  "--assert-userns-disabled",
+  "--unshare-pid",
+  "--unshare-ipc",
+  "--unshare-net",
+  "--unshare-uts",
+  "--unshare-cgroup-try",
+  "--cap-drop",
+  "ALL",
+  "--hostname",
+  "chainless-sandbox",
+  "--clearenv",
+]);
+const LINUX_RUNTIME_PATHNAME_POLICY_DIRECTORIES = Object.freeze([
+  "/opt",
+  "/opt/chainless",
+  "/opt/chainless/runtime",
+  "/opt/chainless/plugin",
+  "/home",
+  "/home/sandbox",
+  "/tmp",
+  "/run",
+  "/var",
+  "/var/tmp",
+  "/proc",
+  "/dev",
+]);
+const LINUX_RUNTIME_PATHNAME_POLICY_ENVIRONMENT = Object.freeze([
+  ["CHAINLESS_SANDBOXED", "1"],
+  ["HOME", "/home/sandbox"],
+  ["LANG", "C.UTF-8"],
+  ["LC_ALL", "C.UTF-8"],
+  ["OPENSSL_CONF", "/dev/null"],
+  ["PATH", "/opt/chainless/runtime"],
+  ["TMPDIR", "/tmp"],
+  ["TZ", "UTC"],
+]);
+
+function denseOwnDataArraySnapshot(value) {
+  if (
+    !Array.isArray(value) ||
+    Object.getPrototypeOf(value) !== Array.prototype
+  ) {
+    return null;
+  }
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  const length = descriptors.length?.value;
+  if (
+    !Number.isSafeInteger(length) ||
+    length < 0 ||
+    Reflect.ownKeys(descriptors).length !== length + 1
+  ) {
+    return null;
+  }
+  const snapshot = [];
+  for (let index = 0; index < length; index += 1) {
+    const descriptor = descriptors[String(index)];
+    if (!descriptor || !("value" in descriptor)) return null;
+    snapshot.push(descriptor.value);
+  }
+  return Object.freeze(snapshot);
+}
+
+function exactOwnDataDescriptors(value, expectedKeys) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    Object.getPrototypeOf(value) !== Object.prototype
+  ) {
+    return null;
+  }
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  const keys = Reflect.ownKeys(descriptors);
+  if (
+    keys.some((key) => typeof key !== "string") ||
+    keys.length !== expectedKeys.length ||
+    expectedKeys.some((key) => !("value" in (descriptors[key] || {})))
+  ) {
+    return null;
+  }
+  return descriptors;
+}
+
+function ownDataObjectSnapshot(value) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    Object.getPrototypeOf(value) !== Object.prototype
+  ) {
+    return null;
+  }
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  const snapshot = {};
+  for (const key of Reflect.ownKeys(descriptors)) {
+    if (typeof key !== "string" || !("value" in descriptors[key])) {
+      return null;
+    }
+    Object.defineProperty(snapshot, key, {
+      value: descriptors[key].value,
+      enumerable: true,
+      configurable: true,
+      writable: true,
+    });
+  }
+  return Object.freeze(snapshot);
+}
+
+const LINUX_DESCRIPTOR_SCRUBBER_EVIDENCE_KEYS = Object.freeze([
+  "kind",
+  "mechanism",
+  "scriptSha256",
+  "executableIdentity",
+  "executablePinned",
+  "argvFixed",
+  "callerEnvironmentFixed",
+  "nodeRuntimeEnvironmentInjection",
+  "nodeIpcChildFd",
+  "nodeIpcSerializationMode",
+  "procSelfFdPasses",
+  "closesUnknownInheritedDescriptors",
+  "verificationPassesFailClosed",
+  "policyBound",
+  "scrubberChildFd",
+  "preservedMaxFd",
+  "activeStdioThrough",
+  "executableChildFd",
+]);
+const LINUX_DESCRIPTOR_SCRUBBER_IDENTITY_KEYS = Object.freeze([
+  "path",
+  "fileId",
+  "sha256",
+  "bytes",
+  "mtimeMs",
+  "mode",
+  "uid",
+  "gid",
+]);
+
+function sanitizeLinuxDescriptorScrubberEvidence(value, launch) {
+  const descriptors = exactOwnDataDescriptors(
+    value,
+    LINUX_DESCRIPTOR_SCRUBBER_EVIDENCE_KEYS,
+  );
+  const identity = descriptors?.executableIdentity?.value;
+  const identityDescriptors = exactOwnDataDescriptors(
+    identity,
+    LINUX_DESCRIPTOR_SCRUBBER_IDENTITY_KEYS,
+  );
+  const fileId = identityDescriptors?.fileId?.value;
+  const fileIdDescriptors = exactOwnDataDescriptors(fileId, ["dev", "ino"]);
+  const nodeIpcChildFd = launch?.nodeIpcChildFd ?? null;
+  const expectedInjection =
+    nodeIpcChildFd === null ? "none" : "node-child-process-exact-ipc-v1";
+  const expectedSerialization = nodeIpcChildFd === null ? null : "json";
+  if (
+    !descriptors ||
+    !launch ||
+    !identityDescriptors ||
+    !fileIdDescriptors ||
+    descriptors.kind.value !== LINUX_BWRAP_DESCRIPTOR_SCRUBBER_KIND ||
+    descriptors.mechanism.value !== LINUX_BWRAP_DESCRIPTOR_SCRUBBER_MECHANISM ||
+    descriptors.scriptSha256.value !==
+      LINUX_BWRAP_DESCRIPTOR_SCRUBBER_SCRIPT_SHA256 ||
+    descriptors.executablePinned.value !== true ||
+    descriptors.argvFixed.value !== true ||
+    descriptors.callerEnvironmentFixed.value !== true ||
+    descriptors.nodeRuntimeEnvironmentInjection.value !== expectedInjection ||
+    descriptors.nodeIpcChildFd.value !== nodeIpcChildFd ||
+    descriptors.nodeIpcSerializationMode.value !== expectedSerialization ||
+    descriptors.procSelfFdPasses.value !==
+      LINUX_BWRAP_DESCRIPTOR_SCRUBBER_PASSES ||
+    descriptors.closesUnknownInheritedDescriptors.value !== true ||
+    descriptors.verificationPassesFailClosed.value !== true ||
+    descriptors.policyBound.value !== true ||
+    descriptors.scrubberChildFd.value !== launch.scrubberChildFd ||
+    descriptors.preservedMaxFd.value !== launch.preservedMaxFd ||
+    descriptors.activeStdioThrough.value !== launch.activeStdioThrough ||
+    descriptors.executableChildFd.value !== launch.executableChildFd ||
+    identityDescriptors.path.value !== LINUX_BWRAP_DESCRIPTOR_SCRUBBER_PATH ||
+    typeof fileIdDescriptors.dev.value !== "string" ||
+    !/^(0|[1-9]\d*)$/.test(fileIdDescriptors.dev.value) ||
+    typeof fileIdDescriptors.ino.value !== "string" ||
+    !/^(0|[1-9]\d*)$/.test(fileIdDescriptors.ino.value) ||
+    typeof identityDescriptors.sha256.value !== "string" ||
+    !/^[a-f0-9]{64}$/.test(identityDescriptors.sha256.value) ||
+    !Number.isSafeInteger(identityDescriptors.bytes.value) ||
+    identityDescriptors.bytes.value <= 0 ||
+    identityDescriptors.bytes.value > 256 * 1024 * 1024 ||
+    !Number.isFinite(identityDescriptors.mtimeMs.value) ||
+    !Number.isSafeInteger(identityDescriptors.mode.value) ||
+    (identityDescriptors.mode.value & 0o170000) !== 0o100000 ||
+    (identityDescriptors.mode.value & 0o111) === 0 ||
+    (identityDescriptors.mode.value & 0o022) !== 0 ||
+    identityDescriptors.uid.value !== 0 ||
+    !Number.isSafeInteger(identityDescriptors.gid.value) ||
+    identityDescriptors.gid.value < 0
+  ) {
+    return null;
+  }
+  const sanitizedIdentity = Object.freeze({
+    path: identityDescriptors.path.value,
+    fileId: Object.freeze({
+      dev: fileIdDescriptors.dev.value,
+      ino: fileIdDescriptors.ino.value,
+    }),
+    sha256: identityDescriptors.sha256.value,
+    bytes: identityDescriptors.bytes.value,
+    mtimeMs: identityDescriptors.mtimeMs.value,
+    mode: identityDescriptors.mode.value,
+    uid: identityDescriptors.uid.value,
+    gid: identityDescriptors.gid.value,
+  });
+  return Object.freeze({
+    kind: descriptors.kind.value,
+    mechanism: descriptors.mechanism.value,
+    scriptSha256: descriptors.scriptSha256.value,
+    executableIdentity: sanitizedIdentity,
+    executablePinned: true,
+    argvFixed: true,
+    callerEnvironmentFixed: true,
+    nodeRuntimeEnvironmentInjection: expectedInjection,
+    nodeIpcChildFd,
+    nodeIpcSerializationMode: expectedSerialization,
+    procSelfFdPasses: LINUX_BWRAP_DESCRIPTOR_SCRUBBER_PASSES,
+    closesUnknownInheritedDescriptors: true,
+    verificationPassesFailClosed: true,
+    policyBound: true,
+    scrubberChildFd: launch.scrubberChildFd,
+    preservedMaxFd: launch.preservedMaxFd,
+    activeStdioThrough: launch.activeStdioThrough,
+    executableChildFd: launch.executableChildFd,
+  });
+}
+
+function parseLinuxRuntimePathnameClosurePolicyArgs(
+  args,
+  expectedLoadSetFiles,
+) {
+  if (
+    !Array.isArray(args) ||
+    !Number.isSafeInteger(expectedLoadSetFiles) ||
+    expectedLoadSetFiles < 1 ||
+    expectedLoadSetFiles > 512
+  ) {
+    return null;
+  }
+  const targetSeparator = args.indexOf("--");
+  if (targetSeparator < 1) return null;
+  const policyArgs = args.slice(0, targetSeparator);
+  let index = 0;
+  const consume = (...expected) => {
+    if (
+      expected.some(
+        (expectedValue, offset) => policyArgs[index + offset] !== expectedValue,
+      )
+    ) {
+      return false;
+    }
+    index += expected.length;
+    return true;
+  };
+  if (!consume(...LINUX_RUNTIME_PATHNAME_POLICY_PREFIX)) return null;
+
+  const directories = [];
+  while (policyArgs[index] === "--dir") {
+    const directory = policyArgs[index + 1];
+    if (
+      typeof directory !== "string" ||
+      !path.posix.isAbsolute(directory) ||
+      path.posix.normalize(directory) !== directory ||
+      directory === "/"
+    ) {
+      return null;
+    }
+    directories.push(directory);
+    index += 2;
+  }
+  const orderedDirectories = [...directories].sort((left, right) => {
+    const depth =
+      left.split("/").filter(Boolean).length -
+      right.split("/").filter(Boolean).length;
+    return depth || left.localeCompare(right);
+  });
+  if (
+    directories.length < LINUX_RUNTIME_PATHNAME_POLICY_DIRECTORIES.length ||
+    new Set(directories).size !== directories.length ||
+    JSON.stringify(directories) !== JSON.stringify(orderedDirectories) ||
+    !LINUX_RUNTIME_PATHNAME_POLICY_DIRECTORIES.every((directory) =>
+      directories.includes(directory),
+    )
+  ) {
+    return null;
+  }
+
+  if (
+    !consume(
+      "--perms",
+      "0000",
+      "--file",
+      "3",
+      "/run/.chainless-bwrap-supervisor",
+    )
+  ) {
+    return null;
+  }
+  const permittedLoadDestination = (destination) =>
+    typeof destination === "string" &&
+    path.posix.isAbsolute(destination) &&
+    path.posix.normalize(destination) === destination &&
+    (destination === "/opt/chainless/runtime/node" ||
+      destination === "/etc/ld.so.cache" ||
+      destination.startsWith("/opt/chainless/plugin/") ||
+      ["/lib/", "/lib64/", "/usr/lib/", "/usr/lib64/"].some((prefix) =>
+        destination.startsWith(prefix),
+      ));
+  const loadDestinations = [];
+  for (let mountIndex = 0; mountIndex < expectedLoadSetFiles; mountIndex += 1) {
+    const expectedChildFd = String(4 + mountIndex);
+    let destination;
+    let mountMode;
+    let permissions = null;
+    if (policyArgs[index] === "--ro-bind-fd") {
+      if (policyArgs[index + 1] !== expectedChildFd) return null;
+      mountMode = "ro-bind-fd";
+      destination = policyArgs[index + 2];
+      index += 3;
+    } else if (policyArgs[index] === "--perms") {
+      permissions = policyArgs[index + 1];
+      if (
+        (permissions !== "0400" && permissions !== "0500") ||
+        policyArgs[index + 2] !== "--ro-bind-data" ||
+        policyArgs[index + 3] !== expectedChildFd
+      ) {
+        return null;
+      }
+      mountMode = "ro-bind-data";
+      destination = policyArgs[index + 4];
+      index += 5;
+    } else {
+      return null;
+    }
+    if (!permittedLoadDestination(destination)) return null;
+    const runtimeSnapshotDestination =
+      destination === "/opt/chainless/runtime/node";
+    const pluginSnapshotDestination = destination.startsWith(
+      "/opt/chainless/plugin/",
+    );
+    if (
+      (runtimeSnapshotDestination &&
+        (mountMode !== "ro-bind-data" || permissions !== "0500")) ||
+      (pluginSnapshotDestination && mountMode !== "ro-bind-data") ||
+      (!runtimeSnapshotDestination &&
+        !pluginSnapshotDestination &&
+        mountMode !== "ro-bind-fd")
+    ) {
+      return null;
+    }
+    loadDestinations.push(destination);
+  }
+  if (new Set(loadDestinations).size !== loadDestinations.length) return null;
+
+  const requiredDirectories = new Set(
+    LINUX_RUNTIME_PATHNAME_POLICY_DIRECTORIES,
+  );
+  for (const destination of loadDestinations) {
+    let parent = path.posix.dirname(destination);
+    while (parent !== "/") {
+      requiredDirectories.add(parent);
+      parent = path.posix.dirname(parent);
+    }
+  }
+  if (
+    ![...requiredDirectories].every((directory) =>
+      directories.includes(directory),
+    ) ||
+    directories.some(
+      (directory) =>
+        !requiredDirectories.has(directory) &&
+        !directory.startsWith("/opt/chainless/plugin/"),
+    )
+  ) {
+    return null;
+  }
+
+  if (
+    !consume("--seccomp", String(4 + expectedLoadSetFiles)) ||
+    !consume("--remount-ro", "/") ||
+    !consume(
+      "--perms",
+      "0755",
+      "--size",
+      String(16 * 1024 * 1024),
+      "--tmpfs",
+      "/run",
+      "--remount-ro",
+      "/run",
+    )
+  ) {
+    return null;
+  }
+  for (const [key, value] of LINUX_RUNTIME_PATHNAME_POLICY_ENVIRONMENT) {
+    if (!consume("--setenv", key, value)) return null;
+  }
+  if (!consume("--chdir", "/opt/chainless/plugin")) return null;
+  if (index !== policyArgs.length) return null;
+  return Object.freeze({
+    targetSeparator,
+    loadDestinations: Object.freeze(loadDestinations),
+  });
+}
 
 // Keep the broker on the shared CommonJS trace singleton so CommonJS and ESM
 // consumers observe the same AsyncLocalStorage without loader warnings.
@@ -1078,6 +1512,15 @@ class ProcessExecutionBroker extends EventEmitter {
         "Sandbox adapter returned no spawn plan",
       );
     }
+    const authorityPlan = plan;
+    const planSnapshot = ownDataObjectSnapshot(plan);
+    if (!planSnapshot) {
+      throw this._sandboxError(
+        "invalid_sandbox_plan",
+        "Sandbox spawn plan must use own data properties",
+      );
+    }
+    plan = planSnapshot;
     if (plan.contractVersion !== 1) {
       throw this._sandboxError(
         "invalid_sandbox_plan",
@@ -1090,16 +1533,34 @@ class ProcessExecutionBroker extends EventEmitter {
         "Sandbox spawn plan is missing applied:boolean",
       );
     }
-    if (typeof plan.command !== "string" || !Array.isArray(plan.args)) {
+    let planCommand = null;
+    try {
+      const commandDescriptor = Object.getOwnPropertyDescriptor(
+        plan,
+        "command",
+      );
+      if (
+        commandDescriptor &&
+        "value" in commandDescriptor &&
+        typeof commandDescriptor.value === "string"
+      ) {
+        planCommand = commandDescriptor.value;
+      }
+    } catch {
+      planCommand = null;
+    }
+    const planArgsSnapshot = denseOwnDataArraySnapshot(plan.args);
+    if (planCommand === null || !planArgsSnapshot) {
       throw this._sandboxError(
         "invalid_sandbox_plan",
-        "Sandbox spawn plan must provide command and args",
+        "Sandbox spawn plan must provide command and dense data-property args",
       );
     }
-    if (!plan.options || typeof plan.options !== "object") {
+    const planOptionsSnapshot = ownDataObjectSnapshot(plan.options);
+    if (!planOptionsSnapshot) {
       throw this._sandboxError(
         "invalid_sandbox_plan",
-        "Sandbox spawn plan must provide options",
+        "Sandbox spawn plan must provide data-property options",
       );
     }
     if (plan.applied && typeof plan.enforcement !== "string") {
@@ -1159,6 +1620,129 @@ class ProcessExecutionBroker extends EventEmitter {
         "Sandbox policy digest must be a lowercase SHA-256 value",
       );
     }
+    const linuxDescriptorBackend =
+      plan.applied === true &&
+      (backend === "linux-bwrap" || backend === "linux-bwrap-workspace");
+    const linuxFdCodeSnapshotBackend =
+      plan.applied === true &&
+      (backend === "linux-fd-code-snapshot" ||
+        plan.enforcement === "linux-fd-code-snapshot");
+    let linuxDescriptorLaunch = null;
+    let linuxDescriptorPtyLaunch = false;
+    let linuxBubblewrapExecutableArgs = planArgsSnapshot;
+    let sanitizedDescriptorScrubber = null;
+    if (linuxFdCodeSnapshotBackend) {
+      if (plan.platform !== "linux") {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Reserved Linux FD code snapshot backend requires platform linux",
+        );
+      }
+      if (
+        plan.backend !== "linux-fd-code-snapshot" ||
+        plan.enforcement !== "linux-fd-code-snapshot"
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Reserved Linux FD code snapshot backend requires exact backend and enforcement names",
+        );
+      }
+      if (launchContext.builtInSandboxAdapter !== true) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Applied Linux FD code snapshot plans require the built-in sandbox adapter",
+        );
+      }
+      if (!guarantees.includes(SANDBOX_BOUNDARIES.CODE_SNAPSHOT)) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Reserved Linux FD code snapshot backend requires the code-snapshot guarantee",
+        );
+      }
+    }
+    if (linuxDescriptorBackend) {
+      if (plan.platform !== "linux") {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Reserved Linux bubblewrap backends require platform linux",
+        );
+      }
+      if (launchContext.builtInSandboxAdapter !== true) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Applied Linux bubblewrap plans require the built-in sandbox adapter",
+        );
+      }
+      const descriptorEvidence = plan.runtimeProbe?.descriptorScrubber;
+      const descriptorEvidenceDescriptors = exactOwnDataDescriptors(
+        descriptorEvidence,
+        LINUX_DESCRIPTOR_SCRUBBER_EVIDENCE_KEYS,
+      );
+      const activeStdioThrough =
+        backend === "linux-bwrap-workspace"
+          ? descriptorEvidenceDescriptors?.activeStdioThrough?.value
+          : 2;
+      linuxDescriptorPtyLaunch =
+        backend === "linux-bwrap-workspace" &&
+        plan.ptyPolicy !== null &&
+        plan.ptyPolicy !== undefined;
+      if (linuxDescriptorPtyLaunch) {
+        const innerArgs = Object.freeze([...planArgsSnapshot.slice(2)]);
+        linuxDescriptorLaunch =
+          planArgsSnapshot[0] === "--ctty" &&
+          typeof planArgsSnapshot[1] === "string"
+            ? parseLinuxBwrapDescriptorScrubbedLaunch(
+                planArgsSnapshot[1],
+                innerArgs,
+                planOptionsSnapshot,
+                { activeStdioThrough },
+              )
+            : null;
+      } else {
+        linuxDescriptorLaunch = parseLinuxBwrapDescriptorScrubbedLaunch(
+          planCommand,
+          planArgsSnapshot,
+          planOptionsSnapshot,
+          { activeStdioThrough },
+        );
+      }
+      sanitizedDescriptorScrubber = sanitizeLinuxDescriptorScrubberEvidence(
+        descriptorEvidence,
+        linuxDescriptorLaunch,
+      );
+      const expectedExecutableChildFd = linuxDescriptorPtyLaunch
+        ? activeStdioThrough + 2
+        : backend === "linux-bwrap-workspace"
+          ? activeStdioThrough + 1
+          : 3;
+      const outerPtyDescriptorValid =
+        !linuxDescriptorPtyLaunch ||
+        (planCommand === `/proc/self/fd/${activeStdioThrough + 1}` &&
+          Number.isSafeInteger(
+            linuxDescriptorLaunch?.stdio?.[activeStdioThrough + 1],
+          ));
+      if (
+        !linuxDescriptorLaunch ||
+        !sanitizedDescriptorScrubber ||
+        linuxDescriptorLaunch.executableChildFd !== expectedExecutableChildFd ||
+        !outerPtyDescriptorValid ||
+        (backend === "linux-bwrap" &&
+          (linuxDescriptorLaunch.activeStdioThrough !== 2 ||
+            linuxDescriptorLaunch.nodeIpcChildFd !== null ||
+            (plan.ptyPolicy !== null && plan.ptyPolicy !== undefined)))
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Applied Linux bubblewrap plans require the exact typed descriptor scrubber launch contract",
+        );
+      }
+      linuxBubblewrapExecutableArgs = linuxDescriptorLaunch.executableArgs;
+    } else if (plan.runtimeProbe?.descriptorScrubber !== undefined) {
+      throw this._sandboxError(
+        "invalid_sandbox_plan",
+        "Linux descriptor scrubber evidence requires an applied bubblewrap backend",
+      );
+    }
     let runtimeProbe = null;
     let genericWorkspaceProbe = false;
     let sanitizedFilesystemPolicy = null;
@@ -1166,6 +1750,7 @@ class ProcessExecutionBroker extends EventEmitter {
     let sanitizedProcessTreePolicy = null;
     let sanitizedPtyPolicy = null;
     let windowsPlanBindingConsumed = false;
+    let macPlanBindingConsumed = false;
     if (plan.runtimeProbe !== null && plan.runtimeProbe !== undefined) {
       if (
         typeof plan.runtimeProbe !== "object" ||
@@ -1196,6 +1781,14 @@ class ProcessExecutionBroker extends EventEmitter {
         "initialDynamicLoadClosureScope",
         "initialDynamicLoadClosureMechanism",
         "initialDynamicInterpreter",
+        "runtimeSharedLibraryPathnameClosureExcludes",
+        "runtimeSharedLibraryClosureScope",
+        "runtimeSharedLibraryClosureMechanism",
+        "targetDescriptorAllowlist",
+        "targetRuntimeInvocationMode",
+        "helperTeamIdentifier",
+        "helperPackageIdentifier",
+        "helperPackageVersion",
       ]) {
         if (
           plan.runtimeProbe[field] !== undefined &&
@@ -1220,6 +1813,35 @@ class ProcessExecutionBroker extends EventEmitter {
         "runtimeLaunchAtomic",
         "mcpCapsuleCodeSnapshot",
         "runtimeDetachedChildSpawnVerified",
+        "runtimeSharedLibraryPathnameClosure",
+        "runtimeLoadSetPolicyBound",
+        "runtimeWritableFilesystems",
+        "runtimeProcfsMounted",
+        "runtimeDevfsMounted",
+        "runtimeScratchWritable",
+        "runtimeDescriptorReopenPaths",
+        "rootProtectedRuntimeSnapshot",
+        "entryRootOwnedAnonymousSnapshot",
+        "entrySourcePrePostStat",
+        "entryWriterClosedBeforeReadonlyReopen",
+        "entryReadonlyIdentityRechecked",
+        "entryUnlinkedAndDirectoryFsyncedBeforeTarget",
+        "targetInheritedEntrySnapshotOnly",
+        "runtimeAndCapsuleSlotsNullBeforeExec",
+        "bootstrapClosesNullAndReadyDescriptors",
+        "actualRuntimeReadyHandshake",
+        "runtimeSnapshotUnlinkedBeforeEntryRelease",
+        "callerCredentialDropIrreversible",
+        "relayParentCredentialsDropped",
+        "callerLifelineWatched",
+        "signalRelayNonblocking",
+        "pkgExecPathMagicBound",
+        "capsuleRootDescriptorBound",
+        "capsulePathObjectAtomic",
+        "sandboxProfileFixedAndDigestBound",
+        "processForkExplicitlyDenied",
+        "sandboxExecLiveGateContract",
+        "globalLaunchSerialization",
       ]) {
         if (
           plan.runtimeProbe[field] !== undefined &&
@@ -1236,10 +1858,14 @@ class ProcessExecutionBroker extends EventEmitter {
         "pluginTreeContentSnapshotBytes",
         "initialDynamicDependencyCount",
         "initialDynamicRuntimeFileCount",
+        "initialDynamicRuntimeBytes",
+        "runtimeSharedLibraryLoadSetFiles",
+        "runtimeSharedLibraryLoadSetBytes",
         "runtimeSnapshotBytes",
         "runtimeAttestedBytes",
         "entrySnapshotBytes",
         "capabilityCount",
+        "maximumStaleSnapshots",
       ]) {
         if (
           plan.runtimeProbe[field] !== undefined &&
@@ -1256,6 +1882,13 @@ class ProcessExecutionBroker extends EventEmitter {
         "runtimeSnapshotSha256",
         "runtimeAttestedSha256",
         "entrySnapshotSha256",
+        "entrySnapshotBootstrapSha256",
+        "helperSha256",
+        "helperSourceSha256",
+        "helperProtocolSha256",
+        "helperInstallContractSha256",
+        "helperDesignatedRequirementSha256",
+        "installAttestationDigest",
         "planBindingDigest",
       ]) {
         if (
@@ -1272,17 +1905,22 @@ class ProcessExecutionBroker extends EventEmitter {
       const planBindingDeclared =
         plan.runtimeProbe.planBindingMechanism !== undefined ||
         plan.runtimeProbe.planBindingDigest !== undefined;
+      const typedCodeSnapshotPlanBinding =
+        (plan.platform === "win32" &&
+          plan.runtimeProbe.planBindingMechanism ===
+            "windows-mcp-code-snapshot-plan-binding-v1") ||
+        (plan.platform === "darwin" &&
+          plan.runtimeProbe.planBindingMechanism ===
+            "macos-mcp-code-snapshot-plan-binding-v1");
       if (
         planBindingDeclared &&
-        (plan.platform !== "win32" ||
+        (!typedCodeSnapshotPlanBinding ||
           !guarantees.includes(SANDBOX_BOUNDARIES.CODE_SNAPSHOT) ||
-          plan.runtimeProbe.planBindingMechanism !==
-            "windows-mcp-code-snapshot-plan-binding-v1" ||
           !/^[a-f0-9]{64}$/.test(plan.runtimeProbe.planBindingDigest || ""))
       ) {
         throw this._sandboxError(
           "invalid_sandbox_plan",
-          "Sandbox runtime probe plan binding must use the typed Windows MCP code-snapshot contract",
+          "Sandbox runtime probe plan binding must use a typed platform MCP code-snapshot contract",
         );
       }
       if (
@@ -1311,6 +1949,19 @@ class ProcessExecutionBroker extends EventEmitter {
           "Sandbox runtime probe initialDynamicLoadClosureDigest must be a lowercase SHA-256 value",
         );
       }
+      if (
+        plan.runtimeProbe.runtimeSharedLibraryLoadSetDigest !== undefined &&
+        (typeof plan.runtimeProbe.runtimeSharedLibraryLoadSetDigest !==
+          "string" ||
+          !/^[a-f0-9]{64}$/.test(
+            plan.runtimeProbe.runtimeSharedLibraryLoadSetDigest,
+          ))
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Sandbox runtime probe runtimeSharedLibraryLoadSetDigest must be a lowercase SHA-256 value",
+        );
+      }
       const pluginTreeSnapshot =
         plan.runtimeProbe.pluginTreeContentSnapshot === true;
       const pluginTreeEvidenceFields = [
@@ -1486,6 +2137,8 @@ class ProcessExecutionBroker extends EventEmitter {
       }
       const supervisorBound =
         plan.runtimeProbe.supervisorDescriptorBound === true;
+      const runtimeSharedLibraryPathnameClosure =
+        plan.runtimeProbe.runtimeSharedLibraryPathnameClosure === true;
       if (
         supervisorBound &&
         (plan.runtimeProbe.supervisorExecutablePinned !== true ||
@@ -1494,7 +2147,10 @@ class ProcessExecutionBroker extends EventEmitter {
             "host-path-replacement" ||
           plan.runtimeProbe.supervisorDescriptorBindingMechanism !==
             "pinned-child-fd3-file-consume-run-overmount-v1" ||
-          plan.runtimeProbe.supervisorPid1ExecutableExposure !== "procfs")
+          plan.runtimeProbe.supervisorPid1ExecutableExposure !==
+            (runtimeSharedLibraryPathnameClosure
+              ? "procfs-not-mounted"
+              : "procfs"))
       ) {
         throw this._sandboxError(
           "invalid_sandbox_plan",
@@ -1527,6 +2183,7 @@ class ProcessExecutionBroker extends EventEmitter {
         "initialDynamicInterpreter",
         "initialDynamicDependencyCount",
         "initialDynamicRuntimeFileCount",
+        "initialDynamicRuntimeBytes",
         "initialDynamicLoadClosureDigest",
       ];
       const initialDynamicInterpreter =
@@ -1535,6 +2192,8 @@ class ProcessExecutionBroker extends EventEmitter {
         plan.runtimeProbe.initialDynamicDependencyCount;
       const initialDynamicRuntimeFileCount =
         plan.runtimeProbe.initialDynamicRuntimeFileCount;
+      const initialDynamicRuntimeBytes =
+        plan.runtimeProbe.initialDynamicRuntimeBytes;
       const successfulDynamicProbe =
         plan.applied === true &&
         plan.runtimeProbe.kind ===
@@ -1564,11 +2223,12 @@ class ProcessExecutionBroker extends EventEmitter {
           plan.runtimeProbe.contentSnapshotMechanism !==
             "verified-o_tmpfile-copy-bwrap-ro-bind-data-v1" ||
           plan.runtimeProbe.handleAtomic !== false ||
+          plan.runtimeProbe.sharedLibraryClosure !== false ||
           !supervisorBound ||
           plan.runtimeProbe.initialDynamicLoadClosureScope !==
-            "initial-pt_interp-and-direct-dt_needed-attested-system-set" ||
+            "initial-pt_interp-and-recursive-dt_needed-attested-system-graph" ||
           plan.runtimeProbe.initialDynamicLoadClosureMechanism !==
-            "parsed-elf-direct-system-set-to-attested-node-runtime-fds-v1" ||
+            "recursive-parsed-elf-system-graph-to-attested-runtime-fds-v1" ||
           typeof initialDynamicInterpreter !== "string" ||
           !path.posix.isAbsolute(initialDynamicInterpreter) ||
           path.posix.normalize(initialDynamicInterpreter) !==
@@ -1578,20 +2238,20 @@ class ProcessExecutionBroker extends EventEmitter {
           ) ||
           !Number.isSafeInteger(initialDynamicDependencyCount) ||
           initialDynamicDependencyCount < 0 ||
-          initialDynamicDependencyCount > 128 ||
+          initialDynamicDependencyCount > 1024 ||
           !Number.isSafeInteger(initialDynamicRuntimeFileCount) ||
           initialDynamicRuntimeFileCount < 1 ||
-          initialDynamicRuntimeFileCount > 129 ||
-          initialDynamicRuntimeFileCount <
-            Math.max(1, initialDynamicDependencyCount) ||
-          initialDynamicRuntimeFileCount > initialDynamicDependencyCount + 1 ||
+          initialDynamicRuntimeFileCount > 256 ||
+          !Number.isSafeInteger(initialDynamicRuntimeBytes) ||
+          initialDynamicRuntimeBytes < 1 ||
+          initialDynamicRuntimeBytes > 512 * 1024 * 1024 ||
           !/^[a-f0-9]{64}$/.test(
             plan.runtimeProbe.initialDynamicLoadClosureDigest || "",
           ))
       ) {
         throw this._sandboxError(
           "invalid_sandbox_plan",
-          "Sandbox runtime probe initial dynamic direct system set evidence must use the typed descriptor-bound contract",
+          "Sandbox runtime probe initial recursive dynamic system graph evidence must use the typed descriptor-bound contract",
         );
       }
       if (
@@ -1602,13 +2262,89 @@ class ProcessExecutionBroker extends EventEmitter {
       ) {
         throw this._sandboxError(
           "invalid_sandbox_plan",
-          "Sandbox runtime probe initial dynamic direct system set evidence requires initialDynamicLoadClosureDescriptorBound",
+          "Sandbox runtime probe initial recursive dynamic system graph evidence requires initialDynamicLoadClosureDescriptorBound",
         );
       }
       if (successfulDynamicProbe && !initialDynamicLoadClosureBound) {
         throw this._sandboxError(
           "invalid_sandbox_plan",
-          "Sandbox runtime probe successful dynamic ELF evidence requires a descriptor-bound initial direct system set",
+          "Sandbox runtime probe successful dynamic ELF evidence requires a descriptor-bound initial recursive system graph",
+        );
+      }
+      const runtimePathnameClosureEvidenceFields = [
+        "runtimeSharedLibraryPathnameClosureExcludes",
+        "runtimeSharedLibraryClosureScope",
+        "runtimeSharedLibraryClosureMechanism",
+        "runtimeSharedLibraryLoadSetFiles",
+        "runtimeSharedLibraryLoadSetBytes",
+        "runtimeSharedLibraryLoadSetDigest",
+        "runtimeLoadSetPolicyBound",
+        "runtimeWritableFilesystems",
+        "runtimeProcfsMounted",
+        "runtimeDevfsMounted",
+        "runtimeScratchWritable",
+        "runtimeDescriptorReopenPaths",
+      ];
+      const runtimePathnameMountPolicy =
+        parseLinuxRuntimePathnameClosurePolicyArgs(
+          linuxBubblewrapExecutableArgs,
+          plan.runtimeProbe.runtimeSharedLibraryLoadSetFiles,
+        ) !== null;
+      if (
+        runtimeSharedLibraryPathnameClosure &&
+        (!successfulDynamicProbe ||
+          !initialDynamicLoadClosureBound ||
+          plan.runtimeProbe.sharedLibraryClosure !== false ||
+          plan.runtimeProbe.runtimeSharedLibraryPathnameClosureExcludes !==
+            "anonymous-jit-and-custom-in-process-loader" ||
+          plan.runtimeProbe.runtimeSharedLibraryClosureScope !==
+            "all-pathname-visible-regular-files-in-read-only-bwrap-namespace" ||
+          plan.runtimeProbe.runtimeSharedLibraryClosureMechanism !==
+            "descriptor-pinned-hashed-ro-mount-set-plus-loader-fd-and-namespace-mutation-seccomp-v2" ||
+          !Number.isSafeInteger(
+            plan.runtimeProbe.runtimeSharedLibraryLoadSetFiles,
+          ) ||
+          plan.runtimeProbe.runtimeSharedLibraryLoadSetFiles < 1 ||
+          plan.runtimeProbe.runtimeSharedLibraryLoadSetFiles > 512 ||
+          !Number.isSafeInteger(
+            plan.runtimeProbe.runtimeSharedLibraryLoadSetBytes,
+          ) ||
+          plan.runtimeProbe.runtimeSharedLibraryLoadSetBytes < 1 ||
+          plan.runtimeProbe.runtimeSharedLibraryLoadSetBytes >
+            1024 * 1024 * 1024 ||
+          !/^[a-f0-9]{64}$/.test(
+            plan.runtimeProbe.runtimeSharedLibraryLoadSetDigest || "",
+          ) ||
+          plan.runtimeProbe.runtimeLoadSetPolicyBound !== true ||
+          plan.runtimeProbe.runtimeWritableFilesystems !== false ||
+          plan.runtimeProbe.runtimeProcfsMounted !== false ||
+          plan.runtimeProbe.runtimeDevfsMounted !== false ||
+          plan.runtimeProbe.runtimeScratchWritable !== false ||
+          plan.runtimeProbe.runtimeDescriptorReopenPaths !== false ||
+          plan.runtimeProbe.supervisorPid1ExecutableExposure !==
+            "procfs-not-mounted" ||
+          !runtimePathnameMountPolicy)
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Sandbox runtime probe pathname shared-library closure must use the typed read-only no-proc bwrap contract",
+        );
+      }
+      if (
+        !runtimeSharedLibraryPathnameClosure &&
+        runtimePathnameClosureEvidenceFields.some(
+          (field) => plan.runtimeProbe[field] !== undefined,
+        )
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Sandbox runtime probe pathname shared-library evidence requires runtimeSharedLibraryPathnameClosure",
+        );
+      }
+      if (successfulDynamicProbe && !runtimeSharedLibraryPathnameClosure) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Successful dynamic ELF evidence requires a runtime pathname shared-library closure",
         );
       }
       const codeSnapshotGuaranteed = guarantees.includes(
@@ -1623,11 +2359,28 @@ class ProcessExecutionBroker extends EventEmitter {
           plan.platform === "win32" &&
           (plan.runtimeProbe.planBindingMechanism !== undefined ||
             plan.runtimeProbe.planBindingDigest !== undefined);
-        // Consume before evaluating any other Windows evidence. A genuine
+        const macPlanBindingDeclared =
+          plan.platform === "darwin" &&
+          (plan.runtimeProbe.planBindingMechanism !== undefined ||
+            plan.runtimeProbe.planBindingDigest !== undefined);
+        // Consume before evaluating any other privileged-helper evidence. A genuine
         // one-launch plan is therefore burned by its first admission attempt,
         // including an attempt with a mismatched command or contract.
         windowsPlanBindingConsumed = windowsPlanBindingDeclared
-          ? consumeWindowsMcpCodeSnapshotPlanBinding(plan, {
+          ? consumeWindowsMcpCodeSnapshotPlanBinding(authorityPlan, {
+              command: launchContext.command,
+              args: launchArgs,
+              cwd: launchContext.cwd,
+              shell: launchContext.shell,
+              detached: launchContext.detached,
+              executionContract,
+              profile: launchContext.profile,
+              requiredBoundaries: launchContext.requiredBoundaries,
+              sync: launchContext.sync,
+            })
+          : false;
+        macPlanBindingConsumed = macPlanBindingDeclared
+          ? consumeMacMcpCodeSnapshotPlanBinding(authorityPlan, {
               command: launchContext.command,
               args: launchArgs,
               cwd: launchContext.cwd,
@@ -1674,6 +2427,8 @@ class ProcessExecutionBroker extends EventEmitter {
             executionContract?.runtimeIdentity?.bytes &&
           plan.runtimeProbe.runtimeAttestedSha256 === undefined &&
           plan.runtimeProbe.runtimeAttestedBytes === undefined;
+        const macRuntimeSnapshotContractBound =
+          linuxRuntimeSnapshotContractBound;
         const windowsRuntimeAttestationContractBound =
           plan.runtimeProbe.runtimeAttestedSha256 ===
             executionContract?.runtimeIdentity?.sha256 &&
@@ -1712,6 +2467,7 @@ class ProcessExecutionBroker extends EventEmitter {
           plan.runtimeProbe.entrySnapshotBytes >= 0 &&
           plan.runtimeProbe.entrySnapshotBytes <= 64 * 1024 * 1024;
         const linuxSnapshotEvidence =
+          launchContext.builtInSandboxAdapter === true &&
           plan.platform === "linux" &&
           backend === "linux-fd-code-snapshot" &&
           plan.enforcement === "linux-fd-code-snapshot" &&
@@ -1736,16 +2492,18 @@ class ProcessExecutionBroker extends EventEmitter {
           Number.isSafeInteger(plan.runtimeProbe.runtimeSnapshotBytes) &&
           plan.runtimeProbe.runtimeSnapshotBytes > 0 &&
           plan.runtimeProbe.runtimeSnapshotBytes <= 256 * 1024 * 1024 &&
-          /^\/proc\/self\/fd\/\d+$/.test(plan.command) &&
-          plan.args[0] === "-e" &&
+          /^\/proc\/self\/fd\/\d+$/.test(planCommand) &&
+          planArgsSnapshot[0] === "-e" &&
           crypto
             .createHash("sha256")
-            .update(plan.args[1] || "")
+            .update(planArgsSnapshot[1] || "")
             .digest("hex") === MCP_STDIO_FD_ENTRY_BOOTSTRAP_SHA256 &&
-          plan.args[2] === "--" &&
-          passthroughArgsMatch(plan.args.slice(3));
-        const linuxBubblewrapTargetSeparator = plan.args.indexOf("--");
+          planArgsSnapshot[2] === "--" &&
+          passthroughArgsMatch(planArgsSnapshot.slice(3));
+        const linuxBubblewrapTargetSeparator =
+          linuxBubblewrapExecutableArgs.indexOf("--");
         const linuxBubblewrapSnapshotEvidence =
+          launchContext.builtInSandboxAdapter === true &&
           plan.platform === "linux" &&
           backend === "linux-bwrap" &&
           plan.enforcement === "linux-bwrap" &&
@@ -1776,15 +2534,137 @@ class ProcessExecutionBroker extends EventEmitter {
           Number.isSafeInteger(plan.runtimeProbe.runtimeSnapshotBytes) &&
           plan.runtimeProbe.runtimeSnapshotBytes > 0 &&
           plan.runtimeProbe.runtimeSnapshotBytes <= 256 * 1024 * 1024 &&
-          /^\/proc\/self\/fd\/\d+$/.test(plan.command) &&
+          /^\/proc\/self\/fd\/\d+$/.test(planCommand) &&
           linuxBubblewrapTargetSeparator >= 0 &&
-          plan.args[linuxBubblewrapTargetSeparator + 1] ===
+          linuxBubblewrapExecutableArgs[linuxBubblewrapTargetSeparator + 1] ===
             plan.runtimeProbe.runtimeLaunchPath &&
-          plan.args[linuxBubblewrapTargetSeparator + 2] ===
+          linuxBubblewrapExecutableArgs[linuxBubblewrapTargetSeparator + 2] ===
             plan.runtimeProbe.entrySnapshotPath &&
           passthroughArgsMatch(
-            plan.args.slice(linuxBubblewrapTargetSeparator + 3),
+            linuxBubblewrapExecutableArgs.slice(
+              linuxBubblewrapTargetSeparator + 3,
+            ),
           );
+        const macProtocol = MACOS_MCP_LAUNCHER_INPUTS.protocol;
+        const macStdio = planOptionsSnapshot.stdio;
+        const macSnapshotPath = path.posix.join(
+          macProtocol.snapshotRoot,
+          planArgsSnapshot[1] || "invalid",
+          "node",
+        );
+        const macSnapshotEvidence =
+          plan.platform === "darwin" &&
+          backend === macProtocol.backend &&
+          plan.enforcement === macProtocol.backend &&
+          policyAttested === true &&
+          policyDigest !== null &&
+          plan.runtimeProbe.kind === "darwin-mcp-capsule-code-snapshot-v2" &&
+          plan.runtimeProbe.contentSnapshotScope ===
+            "mcp-capsule-entry-and-node-runtime" &&
+          plan.runtimeProbe.contentSnapshotMechanism ===
+            "signed-root-runtime-path-and-anonymous-entry-fd-snapshots-v1" &&
+          plan.runtimeProbe.handleAtomic === true &&
+          plan.runtimeProbe.entrySnapshotAtomic === true &&
+          plan.runtimeProbe.runtimeLaunchAtomic === true &&
+          plan.runtimeProbe.runtimeLaunchMechanism ===
+            "signed-root-helper-fd-copy-protected-path-ready-gate-v1" &&
+          plan.runtimeProbe.entrySnapshotBootstrapSha256 ===
+            MCP_STDIO_MACOS_GATED_ENTRY_BOOTSTRAP_SHA256 &&
+          macRuntimeSnapshotContractBound &&
+          plan.runtimeProbe.runtimeSnapshotBytes > 0 &&
+          plan.runtimeProbe.runtimeSnapshotBytes <= 256 * 1024 * 1024 &&
+          plan.runtimeProbe.entrySnapshotBytes <= 64 * 1024 * 1024 &&
+          plan.runtimeProbe.rootProtectedRuntimeSnapshot === true &&
+          plan.runtimeProbe.entryRootOwnedAnonymousSnapshot === true &&
+          plan.runtimeProbe.entrySourcePrePostStat === true &&
+          plan.runtimeProbe.entryWriterClosedBeforeReadonlyReopen === true &&
+          plan.runtimeProbe.entryReadonlyIdentityRechecked === true &&
+          plan.runtimeProbe.entryUnlinkedAndDirectoryFsyncedBeforeTarget ===
+            true &&
+          plan.runtimeProbe.targetInheritedEntrySnapshotOnly === true &&
+          plan.runtimeProbe.runtimeAndCapsuleSlotsNullBeforeExec === true &&
+          plan.runtimeProbe.bootstrapClosesNullAndReadyDescriptors === true &&
+          plan.runtimeProbe.actualRuntimeReadyHandshake === true &&
+          plan.runtimeProbe.runtimeSnapshotUnlinkedBeforeEntryRelease ===
+            true &&
+          plan.runtimeProbe.callerCredentialDropIrreversible === true &&
+          plan.runtimeProbe.relayParentCredentialsDropped === true &&
+          plan.runtimeProbe.callerLifelineWatched === true &&
+          plan.runtimeProbe.signalRelayNonblocking === true &&
+          ((plan.runtimeProbe.targetRuntimeInvocationMode ===
+            "node-executable-eval-v1" &&
+            plan.runtimeProbe.pkgExecPathMagicBound === false) ||
+            (plan.runtimeProbe.targetRuntimeInvocationMode ===
+              "pkg-copied-executable-eval-v1" &&
+              plan.runtimeProbe.pkgExecPathMagicBound === true &&
+              planOptionsSnapshot.env?.PKG_EXECPATH ===
+                MACOS_PKG_EXECPATH_MAGIC)) &&
+          plan.runtimeProbe.targetDescriptorAllowlist ===
+            "stdio-fd3-null-fd4-entry-fd5-null-fd6-gate-fd7-ready" &&
+          plan.runtimeProbe.capsuleRootDescriptorBound === true &&
+          plan.runtimeProbe.capsulePathObjectAtomic === false &&
+          plan.runtimeProbe.sandboxProfileFixedAndDigestBound === true &&
+          plan.runtimeProbe.processForkExplicitlyDenied === true &&
+          plan.runtimeProbe.sandboxExecLiveGateContract === true &&
+          plan.runtimeProbe.globalLaunchSerialization === true &&
+          plan.runtimeProbe.maximumStaleSnapshots === 8 &&
+          plan.runtimeProbe.helperSourceSha256 ===
+            MACOS_MCP_LAUNCHER_INPUTS.sourceSha256 &&
+          plan.runtimeProbe.helperProtocolSha256 ===
+            MACOS_MCP_LAUNCHER_INPUTS.protocolSha256 &&
+          [
+            "helperSha256",
+            "helperInstallContractSha256",
+            "helperDesignatedRequirementSha256",
+            "installAttestationDigest",
+            "planBindingDigest",
+          ].every((field) =>
+            /^[a-f0-9]{64}$/.test(plan.runtimeProbe[field] || ""),
+          ) &&
+          /^[A-Z0-9]{10}$/.test(plan.runtimeProbe.helperTeamIdentifier || "") &&
+          plan.runtimeProbe.helperPackageIdentifier ===
+            macProtocol.packageIdentifier &&
+          isMacosMcpLauncherPackageVersion(
+            plan.runtimeProbe.helperPackageVersion,
+          ) &&
+          plan.runtimeProbe.planBindingMechanism ===
+            "macos-mcp-code-snapshot-plan-binding-v1" &&
+          plan.runtimeProbe.runtimeLaunchPath === macSnapshotPath &&
+          plan.runtimeProbe.entrySnapshotPath === "anonymous-root-owned-fd4" &&
+          planCommand === macProtocol.helperInstallPath &&
+          planArgsSnapshot.length >= 10 &&
+          planArgsSnapshot[0] === "--launch-v1" &&
+          /^[a-f0-9]{64}$/.test(planArgsSnapshot[1] || "") &&
+          planArgsSnapshot[2] === MACOS_MCP_LAUNCHER_INPUTS.protocolSha256 &&
+          planArgsSnapshot[3] === executionContract.runtimeIdentity.sha256 &&
+          planArgsSnapshot[4] ===
+            String(executionContract.runtimeIdentity.bytes) &&
+          planArgsSnapshot[5] === executionContract.entryIdentity.sha256 &&
+          planArgsSnapshot[6] ===
+            String(executionContract.entryIdentity.bytes) &&
+          /^[1-9]\d*$/.test(planArgsSnapshot[7] || "") &&
+          /^[1-9]\d*$/.test(planArgsSnapshot[8] || "") &&
+          planArgsSnapshot[9] === policyDigest &&
+          passthroughArgsMatch(planArgsSnapshot.slice(10)) &&
+          planOptionsSnapshot.cwd === "/" &&
+          planOptionsSnapshot.shell === false &&
+          planOptionsSnapshot.detached === false &&
+          Array.isArray(macStdio) &&
+          macStdio.length === 9 &&
+          macStdio
+            .slice(0, 3)
+            .every((value) => ["pipe", "ignore"].includes(value)) &&
+          macStdio.slice(3, 6).every(Number.isInteger) &&
+          macStdio[6] === "ignore" &&
+          macStdio[7] === "ignore" &&
+          macStdio[8] === "pipe" &&
+          launchContext.builtInSandboxAdapter === true &&
+          macPlanBindingConsumed &&
+          guarantees.includes(SANDBOX_BOUNDARIES.FILESYSTEM) &&
+          guarantees.includes(SANDBOX_BOUNDARIES.NETWORK) &&
+          guarantees.includes(SANDBOX_BOUNDARIES.PROCESS_EXEC) &&
+          guarantees.includes(SANDBOX_BOUNDARIES.PROCESS_TREE) &&
+          guarantees.includes(SANDBOX_BOUNDARIES.PRIVILEGE_REDUCTION);
         const windowsSnapshotEvidence =
           plan.platform === "win32" &&
           [
@@ -1826,6 +2706,7 @@ class ProcessExecutionBroker extends EventEmitter {
           !exactSnapshotEvidence ||
           (!linuxSnapshotEvidence &&
             !linuxBubblewrapSnapshotEvidence &&
+            !macSnapshotEvidence &&
             !windowsSnapshotEvidence)
         ) {
           throw this._sandboxError(
@@ -1935,12 +2816,12 @@ class ProcessExecutionBroker extends EventEmitter {
             ptyPolicy.launcherDescriptorConsumedBeforeTarget === true &&
             ptyPolicy.launcherStagingPathHidden === true &&
             ptyPolicy.bwrapNewSession === false &&
-            plan.args[0] === "--ctty" &&
-            /^\/proc\/self\/fd\/\d+$/.test(plan.args[1] || "") &&
-            !plan.args.includes("--new-session")
+            planArgsSnapshot[0] === "--ctty" &&
+            /^\/proc\/self\/fd\/\d+$/.test(planArgsSnapshot[1] || "") &&
+            !linuxBubblewrapExecutableArgs.includes("--new-session")
           : ptyPolicy === null &&
-            plan.args[0] !== "--ctty" &&
-            plan.args.includes("--new-session");
+            planArgsSnapshot[0] !== "--ctty" &&
+            linuxBubblewrapExecutableArgs.includes("--new-session");
         const workspaceRoot = filesystemPolicy?.workspaceRoot;
         const workingDirectory = filesystemPolicy?.workingDirectory;
         const workspaceRelative =
@@ -1948,7 +2829,19 @@ class ProcessExecutionBroker extends EventEmitter {
           typeof workingDirectory === "string"
             ? path.posix.relative(workspaceRoot, workingDirectory)
             : "..";
+        const genericExecutionContract = launchContext.executionContract;
+        const genericExecutionContractBound =
+          launchContext.builtInSandboxAdapter === true &&
+          verifyLinuxGenericBubblewrapPlan(authorityPlan) &&
+          genericExecutionContract?.contractVersion === 1 &&
+          genericExecutionContract.kind === LINUX_GENERIC_CONTRACT_KIND &&
+          genericExecutionContract.contractDigest ===
+            plan.runtimeProbe.contractDigest &&
+          genericExecutionContract.workspaceRoot === workspaceRoot &&
+          genericExecutionContract.workingDirectory === workingDirectory &&
+          launchContext.cwd === workingDirectory;
         genericWorkspaceProbe =
+          genericExecutionContractBound &&
           plan.applied === true &&
           plan.platform === "linux" &&
           plan.enforcement === "linux-bwrap-workspace" &&
@@ -2036,20 +2929,20 @@ class ProcessExecutionBroker extends EventEmitter {
           processTreePolicy?.parentDeathSignal === "SIGKILL" &&
           processTreePolicy?.asPid1 === false &&
           processTreePolicy?.closeFence === "pid-namespace-empty-or-killed" &&
-          plan.command.startsWith("/proc/self/fd/") &&
-          plan.options?.cwd === "/" &&
-          plan.options?.shell === false &&
-          plan.options?.detached === false &&
-          Array.isArray(plan.options?.stdio) &&
-          plan.args.includes("--bind-fd") &&
-          plan.args.includes("--ro-bind-fd") &&
-          plan.args.includes("--remount-ro") &&
-          plan.args.includes("--unshare-net") &&
-          plan.args.includes("--unshare-pid") &&
-          plan.args.includes("--die-with-parent") &&
-          !plan.args.includes("--as-pid-1") &&
-          plan.args.includes("--seccomp") &&
-          !plan.args.includes("--ro-bind") &&
+          planCommand.startsWith("/proc/self/fd/") &&
+          linuxDescriptorLaunch.options.cwd === "/" &&
+          linuxDescriptorLaunch.options.shell === false &&
+          linuxDescriptorLaunch.options.detached === false &&
+          Array.isArray(linuxDescriptorLaunch.stdio) &&
+          linuxBubblewrapExecutableArgs.includes("--bind-fd") &&
+          linuxBubblewrapExecutableArgs.includes("--ro-bind-fd") &&
+          linuxBubblewrapExecutableArgs.includes("--remount-ro") &&
+          linuxBubblewrapExecutableArgs.includes("--unshare-net") &&
+          linuxBubblewrapExecutableArgs.includes("--unshare-pid") &&
+          linuxBubblewrapExecutableArgs.includes("--die-with-parent") &&
+          !linuxBubblewrapExecutableArgs.includes("--as-pid-1") &&
+          linuxBubblewrapExecutableArgs.includes("--seccomp") &&
+          !linuxBubblewrapExecutableArgs.includes("--ro-bind") &&
           ptyPlanValid;
         if (!genericWorkspaceProbe) {
           throw this._sandboxError(
@@ -2230,11 +3123,62 @@ class ProcessExecutionBroker extends EventEmitter {
           runtimeProbe[field] = plan.runtimeProbe[field];
         }
       }
+      for (const field of [
+        "runtimeSharedLibraryPathnameClosure",
+        ...runtimePathnameClosureEvidenceFields,
+      ]) {
+        if (plan.runtimeProbe[field] !== undefined) {
+          runtimeProbe[field] = plan.runtimeProbe[field];
+        }
+      }
+      for (const field of [
+        "rootProtectedRuntimeSnapshot",
+        "entryRootOwnedAnonymousSnapshot",
+        "entrySourcePrePostStat",
+        "entryWriterClosedBeforeReadonlyReopen",
+        "entryReadonlyIdentityRechecked",
+        "entryUnlinkedAndDirectoryFsyncedBeforeTarget",
+        "targetInheritedEntrySnapshotOnly",
+        "runtimeAndCapsuleSlotsNullBeforeExec",
+        "bootstrapClosesNullAndReadyDescriptors",
+        "actualRuntimeReadyHandshake",
+        "runtimeSnapshotUnlinkedBeforeEntryRelease",
+        "callerCredentialDropIrreversible",
+        "relayParentCredentialsDropped",
+        "callerLifelineWatched",
+        "signalRelayNonblocking",
+        "targetRuntimeInvocationMode",
+        "pkgExecPathMagicBound",
+        "targetDescriptorAllowlist",
+        "capsuleRootDescriptorBound",
+        "capsulePathObjectAtomic",
+        "sandboxProfileFixedAndDigestBound",
+        "processForkExplicitlyDenied",
+        "sandboxExecLiveGateContract",
+        "globalLaunchSerialization",
+        "maximumStaleSnapshots",
+        "helperSha256",
+        "helperSourceSha256",
+        "helperProtocolSha256",
+        "helperInstallContractSha256",
+        "helperDesignatedRequirementSha256",
+        "helperTeamIdentifier",
+        "helperPackageIdentifier",
+        "helperPackageVersion",
+        "installAttestationDigest",
+      ]) {
+        if (plan.runtimeProbe[field] !== undefined) {
+          runtimeProbe[field] = plan.runtimeProbe[field];
+        }
+      }
       for (const field of genericWorkspaceEvidenceFields) {
         if (plan.runtimeProbe[field] !== undefined) {
           runtimeProbe[field] = plan.runtimeProbe[field];
         }
       }
+      if (sanitizedDescriptorScrubber !== null) {
+        runtimeProbe.descriptorScrubber = sanitizedDescriptorScrubber;
+      }
       if (supervisorIdentity !== undefined) {
         runtimeProbe.supervisorExecutableIdentity = {
           path: supervisorIdentity.path,
@@ -2277,10 +3221,29 @@ class ProcessExecutionBroker extends EventEmitter {
         "Required post-spawn enforcement must declare sync or async mode",
       );
     }
+    const validatedArgs = linuxDescriptorLaunch
+      ? linuxDescriptorPtyLaunch
+        ? Object.freeze([
+            "--ctty",
+            `/proc/self/fd/${linuxDescriptorLaunch.scrubberChildFd}`,
+            ...linuxDescriptorLaunch.launchArgs,
+          ])
+        : linuxDescriptorLaunch.launchArgs
+      : planArgsSnapshot;
+    const validatedOptions = linuxDescriptorLaunch
+      ? Object.freeze({
+          ...linuxDescriptorLaunch.options,
+          stdio: Object.freeze([...linuxDescriptorLaunch.stdio]),
+          env: Object.freeze({
+            ...linuxDescriptorLaunch.callerEnvironment,
+          }),
+        })
+      : planOptionsSnapshot;
     const validatedPlan = {
       ...plan,
-      args: [...plan.args],
-      options: { ...plan.options },
+      command: planCommand,
+      args: [...validatedArgs],
+      options: { ...validatedOptions },
       backend,
       guarantees: [...new Set(guarantees)],
       candidateBackend,
@@ -2305,6 +3268,14 @@ class ProcessExecutionBroker extends EventEmitter {
       };
       admittedWindowsMcpCodeSnapshotPlans.add(validatedPlan);
     }
+    if (macPlanBindingConsumed) {
+      const upstreamCleanup = validatedPlan.cleanup;
+      validatedPlan.cleanup = (...args) => {
+        admittedMacMcpCodeSnapshotPlans.delete(validatedPlan);
+        return upstreamCleanup?.(...args);
+      };
+      admittedMacMcpCodeSnapshotPlans.add(validatedPlan);
+    }
     return validatedPlan;
   }
 
@@ -2353,6 +3324,15 @@ class ProcessExecutionBroker extends EventEmitter {
       };
       admittedWindowsMcpCodeSnapshotPlans.add(assertedPlan);
     }
+    if (admittedMacMcpCodeSnapshotPlans.has(plan)) {
+      admittedMacMcpCodeSnapshotPlans.delete(plan);
+      const upstreamCleanup = assertedPlan.cleanup;
+      assertedPlan.cleanup = (...args) => {
+        admittedMacMcpCodeSnapshotPlans.delete(assertedPlan);
+        return upstreamCleanup?.(...args);
+      };
+      admittedMacMcpCodeSnapshotPlans.add(assertedPlan);
+    }
     return assertedPlan;
   }
 
@@ -3432,6 +4412,21 @@ class ProcessExecutionBroker extends EventEmitter {
     let proc;
     let workspaceProcessClosed = null;
     try {
+      const macPlanBindingDeclared =
+        sandboxPlan.platform === "darwin" &&
+        sandboxPlan.runtimeProbe?.planBindingMechanism ===
+          "macos-mcp-code-snapshot-plan-binding-v1";
+      const builtInMacMcpPlan =
+        admittedMacMcpCodeSnapshotPlans.has(sandboxPlan);
+      if (macPlanBindingDeclared && !builtInMacMcpPlan) {
+        throw this._sandboxError(
+          "macos_mcp_plan_binding_consumed",
+          "macOS MCP sandbox plan binding is unavailable or already consumed",
+        );
+      }
+      if (builtInMacMcpPlan) {
+        admittedMacMcpCodeSnapshotPlans.delete(sandboxPlan);
+      }
       if (mcpStdioExecutableIdentityAuthority !== undefined) {
         const admitted = consumeMcpStdioExecutableIdentityAuthority(
           mcpStdioExecutableIdentityAuthority,
@@ -3444,6 +4439,31 @@ class ProcessExecutionBroker extends EventEmitter {
         auditEntry.mcpStdioExecutableIdentityDigest = admitted.identityDigest;
       }
       proc = nativeSpawnFn(command, args, optsForSpawn);
+      if (builtInMacMcpPlan) {
+        const callerLifeline = proc?.stdio?.[8];
+        if (
+          !callerLifeline ||
+          typeof callerLifeline !== "object" ||
+          callerLifeline.destroyed === true ||
+          typeof callerLifeline.destroy !== "function"
+        ) {
+          try {
+            proc?.kill?.("SIGKILL");
+          } catch {
+            // The missing lifeline is already a fail-closed launch failure.
+          }
+          throw this._sandboxError(
+            "macos_mcp_caller_lifeline_unavailable",
+            "macOS MCP launch did not retain its Broker-side caller lifeline",
+          );
+        }
+        Object.defineProperty(proc, "macosMcpCallerLifeline", {
+          configurable: false,
+          enumerable: false,
+          writable: false,
+          value: callerLifeline,
+        });
+      }
       workspaceProcessClosed = this._createWorkspaceProcessCloseFence(
         auditEntry,
         proc,
@@ -3477,15 +4497,16 @@ class ProcessExecutionBroker extends EventEmitter {
         sandboxPlan.applied === true &&
         (sandboxPlan.backend === "linux-bwrap-workspace" ||
           sandboxPlan.backend === "linux-bwrap" ||
-          sandboxPlan.backend === "linux-fd-code-snapshot") &&
+          sandboxPlan.backend === "linux-fd-code-snapshot" ||
+          sandboxPlan.backend === "macos-signed-root-fd-launcher") &&
         sandboxPlan.postSpawn.required === false
       ) {
         // child_process.spawn() has synchronously duplicated every stdio entry
         // into the launched process before returning. The generic/direct bwrap
-        // backends and the MCP anonymous-code snapshot backend are complete
-        // pre-spawn plans with no parent-side enforcement handle. Retaining
-        // their pinned descriptors until a long-lived process exits would turn
-        // each child into an avoidable FD leak.
+        // backends and the MCP code-snapshot backends are complete pre-spawn
+        // plans. macOS retains its independently created stdio[8] lifeline on
+        // ChildProcess for the full process lifetime; cleanup closes only the
+        // three already-duplicated source pins.
         cleanupSandbox();
       }
       try {
@@ -3735,6 +4756,23 @@ class ProcessExecutionBroker extends EventEmitter {
 
     const nativeSpawnSyncFn = this._native?.spawnSync || nativeSpawnSync;
     try {
+      const macPlanBindingDeclared =
+        sandboxPlan.platform === "darwin" &&
+        sandboxPlan.runtimeProbe?.planBindingMechanism ===
+          "macos-mcp-code-snapshot-plan-binding-v1";
+      const builtInMacMcpPlan =
+        admittedMacMcpCodeSnapshotPlans.has(sandboxPlan);
+      if (macPlanBindingDeclared && !builtInMacMcpPlan) {
+        throw this._sandboxError(
+          "macos_mcp_plan_binding_consumed",
+          "macOS MCP sandbox plan binding is unavailable or already consumed",
+        );
+      }
+      if (builtInMacMcpPlan) {
+        // spawnSync owns the parent endpoint for stdio[8] until the helper
+        // exits; burning before entry prevents replay on every outcome.
+        admittedMacMcpCodeSnapshotPlans.delete(sandboxPlan);
+      }
       const result = nativeSpawnSyncFn(command, args, optsForSync);
       this._settleWorkspaceTransactionSpawn(auditEntry, {
         exitCode: result.status,