chainlesschain 0.163.7 → 0.164.0

package/src/lib/process-execution-broker/platform-sandbox.js

@@ -5,10 +5,13 @@
  * - macOS: Seatbelt sandbox-exec profiles
  * - Linux: prlimit resource-limit wrapper, plus a narrow bubblewrap backend
  *   for an attested direct strict Plugin Node bin or a narrow static/dynamic
- *   ELF native bin. Dynamic acceptance binds PT_INTERP plus the entry's direct
- *   DT_NEEDED names to an attested system-file set; broader loader surfaces,
- *   shells, broader working directories, host-writable paths, inherited
- *   descriptors, and network egress remain fail-closed.
+ *   ELF native bin. Dynamic acceptance recursively parses PT_INTERP and every
+ *   startup DT_NEEDED edge against the exact descriptor-bound system graph.
+ *   Dynamic native launches additionally use a read-only final mount namespace
+ *   with no procfs, devfs, or writable scratch: every pathname-visible regular
+ *   file is descriptor-pinned, hashed, and policy-bound. This closes the ELF
+ *   loader/dlopen pathname surface, but deliberately does not claim to prevent
+ *   anonymous JIT code or a custom in-process ELF loader.
  * - Windows: Win32 Job Object + restricted-token wrapper, with an attested
  *   zero-capability AppContainer for explicit filesystem/network boundaries
  *
@@ -30,6 +33,27 @@ import {
   applyLinuxGenericWorkspaceSandbox,
   isLinuxGenericWorkspaceContract,
 } from "./linux-generic-bwrap-runtime.js";
+import {
+  buildLinuxBwrapDescriptorScrubbedLaunch,
+  LINUX_BWRAP_DESCRIPTOR_SCRUBBER_PATH,
+  linuxBwrapDescriptorScrubberPolicyBinding,
+} from "./linux-bwrap-descriptor-launch.js";
+import {
+  MCP_STDIO_FD_ENTRY_BOOTSTRAP,
+  MCP_STDIO_FD_ENTRY_BOOTSTRAP_SHA256,
+  MCP_STDIO_MACOS_GATED_ENTRY_BOOTSTRAP_SHA256,
+} from "./mcp-fd-entry-bootstrap.js";
+import {
+  MACOS_MCP_LAUNCHER_INPUTS,
+  macosMcpLauncherPolicyDigest,
+  verifyMacosMcpLauncherInstallContract,
+} from "./macos-mcp-launcher-contract.js";
+
+export {
+  MCP_STDIO_FD_ENTRY_BOOTSTRAP,
+  MCP_STDIO_FD_ENTRY_BOOTSTRAP_SHA256,
+  MCP_STDIO_MACOS_GATED_ENTRY_BOOTSTRAP_SHA256,
+} from "./mcp-fd-entry-bootstrap.js";
 
 /**
  * Stable boundary identifiers shared by broker policies, platform plans, and
@@ -161,6 +185,8 @@ const LINUX_BWRAP_BACKEND = "linux-bwrap";
 const LINUX_BWRAP_NODE_PROBE_SENTINEL = "chainless-linux-bwrap-plugin-node-v1";
 const LINUX_BWRAP_CHILD_RUNTIME_PROBE_SENTINEL =
   "chainless-linux-bwrap-child-runtime-v1";
+const LINUX_BWRAP_NATIVE_RUNTIME_CLOSURE_PROBE_SENTINEL =
+  "chainless-linux-bwrap-native-runtime-pathname-closure-v1";
 const LINUX_BWRAP_CHILD_RUNTIME_PROBE_FAILURE_STATUS = 86;
 const LINUX_BWRAP_MAX_PLUGIN_ENTRIES = 512;
 const LINUX_PLUGIN_TREE_SNAPSHOT_MAX_FILES = 256;
@@ -178,15 +204,12 @@ const LINUX_ENTRY_SNAPSHOT_SOURCE_MODE = 0o400;
 const LINUX_EXECUTABLE_SNAPSHOT_SOURCE_MODE = 0o500;
 const LINUX_MCP_CAPSULE_BACKEND = "linux-fd-code-snapshot";
 const LINUX_MCP_RUNTIME_SNAPSHOT_SCOPE = "mcp-node-runtime-executable";
+const LINUX_PLUGIN_RUNTIME_SNAPSHOT_SCOPE =
+  "plugin-probe-node-runtime-executable";
 const LINUX_MCP_CAPSULE_SNAPSHOT_MECHANISM =
   "verified-o_tmpfile-copy-inherited-fd-module-compile-v1";
-const MACOS_MCP_CAPSULE_BACKEND = "macos-fd-code-snapshot";
-export const MCP_STDIO_FD_ENTRY_BOOTSTRAP =
-  'const fs=require("node:fs");const Module=require("node:module");const filename="/chainlesschain/mcp-capsule.cjs";const source=fs.readFileSync(4,"utf8");process.argv.splice(1,0,filename);const target=new Module(filename,module);target.filename=filename;target.paths=[];target._compile(source,filename);';
-export const MCP_STDIO_FD_ENTRY_BOOTSTRAP_SHA256 = crypto
-  .createHash("sha256")
-  .update(MCP_STDIO_FD_ENTRY_BOOTSTRAP)
-  .digest("hex");
+const MACOS_MCP_CAPSULE_CANDIDATE_BACKEND = "macos-fd-code-snapshot";
+const MACOS_MCP_CAPSULE_BACKEND = MACOS_MCP_LAUNCHER_INPUTS.protocol.backend;
 const LINUX_NODE_ENTRY_SNAPSHOT_SCOPE = "plugin-entry-source";
 const LINUX_NATIVE_ENTRY_SNAPSHOT_SCOPE = "plugin-entry-executable";
 const LINUX_PLUGIN_TREE_SNAPSHOT_SCOPE = "all-pinned-plugin-regular-files";
@@ -199,6 +222,9 @@ const LINUX_ELF64_DYNAMIC_ENTRY_BYTES = 16;
 const LINUX_ELF_MAX_PROGRAM_HEADERS = 128;
 const LINUX_ELF_MAX_DYNAMIC_ENTRIES = 4096;
 const LINUX_ELF_MAX_NEEDED_ENTRIES = 128;
+const LINUX_ELF_MAX_INITIAL_CLOSURE_FILES = 256;
+const LINUX_ELF_MAX_INITIAL_CLOSURE_EDGES = 1024;
+const LINUX_ELF_MAX_INITIAL_CLOSURE_BYTES = 512 * 1024 * 1024;
 const LINUX_ELF_MAX_INTERPRETER_BYTES = 4096;
 const LINUX_ELF_MAX_STRING_TABLE_BYTES = 1024 * 1024;
 const LINUX_AUXV_ENTRY_BYTES = 16;
@@ -217,6 +243,7 @@ const LINUX_ELF_DYNAMIC_NULL = 0n;
 const LINUX_ELF_DYNAMIC_NEEDED = 1n;
 const LINUX_ELF_DYNAMIC_STRTAB = 5n;
 const LINUX_ELF_DYNAMIC_STRSZ = 10n;
+const LINUX_ELF_DYNAMIC_SONAME = 14n;
 const LINUX_ELF_DYNAMIC_RPATH = 15n;
 const LINUX_ELF_DYNAMIC_TEXTREL = 22n;
 const LINUX_ELF_DYNAMIC_FLAGS = 30n;
@@ -229,10 +256,23 @@ const LINUX_ELF_DYNAMIC_AUXILIARY = 0x7ffffffdn;
 const LINUX_ELF_DYNAMIC_FILTER = 0x7fffffffn;
 const LINUX_ELF_DYNAMIC_FLAG_TEXTREL = 0x4n;
 const LINUX_ELF_DYNAMIC_FLAG_PIE = 0x08000000n;
-const LINUX_NATIVE_DYNAMIC_DIRECT_SYSTEM_SET_SCOPE =
-  "initial-pt_interp-and-direct-dt_needed-attested-system-set";
-const LINUX_NATIVE_DYNAMIC_DIRECT_SYSTEM_SET_MECHANISM =
-  "parsed-elf-direct-system-set-to-attested-node-runtime-fds-v1";
+const LINUX_NATIVE_DYNAMIC_RECURSIVE_SYSTEM_GRAPH_SCOPE =
+  "initial-pt_interp-and-recursive-dt_needed-attested-system-graph";
+const LINUX_NATIVE_DYNAMIC_RECURSIVE_SYSTEM_GRAPH_MECHANISM =
+  "recursive-parsed-elf-system-graph-to-attested-runtime-fds-v1";
+const LINUX_NATIVE_RUNTIME_PATHNAME_CLOSURE_SCOPE =
+  "all-pathname-visible-regular-files-in-read-only-bwrap-namespace";
+// In addition to the immutable mount set, the dynamic-only seccomp program
+// blocks every descriptor-acquisition syscall that could import a loader input
+// through SCM_RIGHTS, another process, or a filesystem handle. It also blocks
+// mount/user namespace mutation: otherwise an untrusted target could create a
+// nested user namespace, mount a writable tmpfs over /run, and dlopen a drop-in.
+// This remains a pathname-loader claim: anonymous JIT/custom in-process loaders
+// are excluded.
+const LINUX_NATIVE_RUNTIME_PATHNAME_CLOSURE_MECHANISM =
+  "descriptor-pinned-hashed-ro-mount-set-plus-loader-fd-and-namespace-mutation-seccomp-v2";
+const LINUX_NATIVE_RUNTIME_PATHNAME_CLOSURE_MAX_FILES = 512;
+const LINUX_NATIVE_RUNTIME_PATHNAME_CLOSURE_MAX_BYTES = 1024 * 1024 * 1024;
 const LINUX_ELF_MACHINES = Object.freeze({
   x64: 62,
   arm64: 183,
@@ -242,11 +282,32 @@ const LINUX_ELF_MACHINES = Object.freeze({
 // x64, arm64, and riscv64 use this value; unsupported seccomp architectures
 // already fail closed before the anonymous filter is created.
 const LINUX_O_TMPFILE = 0x410000;
+const LINUX_CLONE_NEWNS = 0x00020000;
+const LINUX_CLONE_NEWUSER = 0x10000000;
+const LINUX_NAMESPACE_CLONE_FLAGS = LINUX_CLONE_NEWNS | LINUX_CLONE_NEWUSER;
 const LINUX_SECCOMP_FILTERS = Object.freeze({
   x64: Object.freeze({
     auditArch: 0xc000003e,
     socketSyscall: 41,
     socketpairSyscall: 53,
+    recvmsgSyscall: 47,
+    recvmmsgSyscall: 299,
+    openByHandleAtSyscall: 304,
+    pidfdGetfdSyscall: 438,
+    cloneSyscall: 56,
+    clone3Syscall: 435,
+    unshareSyscall: 272,
+    setnsSyscall: 308,
+    mountSyscall: 165,
+    umount2Syscall: 166,
+    pivotRootSyscall: 155,
+    openTreeSyscall: 428,
+    moveMountSyscall: 429,
+    fsopenSyscall: 430,
+    fsconfigSyscall: 431,
+    fsmountSyscall: 432,
+    fspickSyscall: 433,
+    mountSetattrSyscall: 442,
     ioUringSetupSyscall: 425,
     x32SyscallBit: 0x40000000,
   }),
@@ -254,12 +315,48 @@ const LINUX_SECCOMP_FILTERS = Object.freeze({
     auditArch: 0xc00000b7,
     socketSyscall: 198,
     socketpairSyscall: 199,
+    recvmsgSyscall: 212,
+    recvmmsgSyscall: 243,
+    openByHandleAtSyscall: 265,
+    pidfdGetfdSyscall: 438,
+    cloneSyscall: 220,
+    clone3Syscall: 435,
+    unshareSyscall: 97,
+    setnsSyscall: 268,
+    mountSyscall: 40,
+    umount2Syscall: 39,
+    pivotRootSyscall: 41,
+    openTreeSyscall: 428,
+    moveMountSyscall: 429,
+    fsopenSyscall: 430,
+    fsconfigSyscall: 431,
+    fsmountSyscall: 432,
+    fspickSyscall: 433,
+    mountSetattrSyscall: 442,
     ioUringSetupSyscall: 425,
   }),
   riscv64: Object.freeze({
     auditArch: 0xc00000f3,
     socketSyscall: 198,
     socketpairSyscall: 199,
+    recvmsgSyscall: 212,
+    recvmmsgSyscall: 243,
+    openByHandleAtSyscall: 265,
+    pidfdGetfdSyscall: 438,
+    cloneSyscall: 220,
+    clone3Syscall: 435,
+    unshareSyscall: 97,
+    setnsSyscall: 268,
+    mountSyscall: 40,
+    umount2Syscall: 39,
+    pivotRootSyscall: 41,
+    openTreeSyscall: 428,
+    moveMountSyscall: 429,
+    fsopenSyscall: 430,
+    fsconfigSyscall: 431,
+    fsmountSyscall: 432,
+    fspickSyscall: 433,
+    mountSetattrSyscall: 442,
     ioUringSetupSyscall: 425,
   }),
 });
@@ -278,6 +375,8 @@ const LINUX_LOCAL_FILESYSTEM_TYPES = new Set([
 const DEFAULT_RUNTIME = Object.freeze({
   platform: os.platform(),
   arch: process.arch,
+  pkg: process.pkg || null,
+  env: process.env,
   fs,
   tmpdir: () => os.tmpdir(),
   homedir: () => os.homedir(),
@@ -292,6 +391,8 @@ const DEFAULT_RUNTIME = Object.freeze({
   sleepSync: (milliseconds) =>
     Atomics.wait(WINDOWS_IDENTITY_WAIT, 0, 0, milliseconds),
   spawnSync: nativeSpawnSync,
+  getuid: () => process.getuid?.() ?? null,
+  getgid: () => process.getgid?.() ?? null,
   warn: (message) => process.emitWarning(message),
 });
 
@@ -301,6 +402,7 @@ const windowsTemporaryCleanupBacklog = new Set();
 let windowsTemporaryCleanupRetryTimer = null;
 const windowsAppContainerCleanupBacklog = new Set();
 const issuedWindowsMcpCodeSnapshotPlans = new WeakMap();
+const issuedMacMcpCodeSnapshotPlans = new WeakMap();
 // Only the unified production adapter can register a Windows MCP launch
 // capability. Direct callers of the exported platform-specific helper (and
 // callers that inject a test/runtime facade into applySandbox) may exercise
@@ -308,6 +410,7 @@ const issuedWindowsMcpCodeSnapshotPlans = new WeakMap();
 const WINDOWS_MCP_CODE_SNAPSHOT_ISSUER = Symbol(
   "windows-mcp-code-snapshot-issuer",
 );
+const MACOS_MCP_CODE_SNAPSHOT_ISSUER = Symbol("macos-mcp-code-snapshot-issuer");
 // Each AppContainer retry starts a synchronous, digest-attested PowerShell
 // helper. Bound automatic retries so a permanently unsupported Windows host
 // cannot repeatedly block a long-lived CLI; explicit cleanup/reset and process
@@ -693,11 +796,55 @@ function normalizeSandboxRequest(profileOrRequest, explicitRequest) {
  * Materialize the requested POSIX shell before adding either wrapper. The
  * sandbox executable itself is always spawned directly.
  */
+function snapshotWrappedInvocationArgs(args) {
+  if (args === null || args === undefined) return Object.freeze([]);
+  try {
+    if (
+      !Array.isArray(args) ||
+      Object.getPrototypeOf(args) !== Array.prototype
+    ) {
+      return null;
+    }
+    const descriptors = Object.getOwnPropertyDescriptors(args);
+    const lengthDescriptor = descriptors.length;
+    if (
+      !lengthDescriptor ||
+      !("value" in lengthDescriptor) ||
+      !Number.isSafeInteger(lengthDescriptor.value) ||
+      lengthDescriptor.value < 0 ||
+      Reflect.ownKeys(descriptors).length !== lengthDescriptor.value + 1
+    ) {
+      return null;
+    }
+    const snapshot = [];
+    for (let index = 0; index < lengthDescriptor.value; index += 1) {
+      const descriptor = descriptors[String(index)];
+      if (!descriptor || !("value" in descriptor)) return null;
+      snapshot.push(descriptor.value);
+    }
+    return Object.freeze(snapshot);
+  } catch {
+    return null;
+  }
+}
+
 function normalizeWrappedInvocation(command, args, spawnOpts, platform) {
+  const argsSnapshot = snapshotWrappedInvocationArgs(args);
+  if (!argsSnapshot) {
+    return {
+      command,
+      args: [],
+      inputArgs: [],
+      argumentsValid: false,
+      options: { ...(spawnOpts || {}) },
+    };
+  }
   if (!spawnOpts?.shell) {
     return {
       command,
-      args: [...(args || [])],
+      args: [...argsSnapshot],
+      inputArgs: argsSnapshot,
+      argumentsValid: true,
       options: { ...(spawnOpts || {}) },
     };
   }
@@ -707,20 +854,24 @@ function normalizeWrappedInvocation(command, args, spawnOpts, platform) {
       typeof spawnOpts.shell === "string"
         ? spawnOpts.shell
         : process.env.ComSpec || "C:\\Windows\\System32\\cmd.exe";
-    const shellCommand = [command, ...(args || [])].map(String).join(" ");
+    const shellCommand = [command, ...argsSnapshot].map(String).join(" ");
     return {
       command: shell,
       args: ["/d", "/s", "/c", shellCommand],
+      inputArgs: argsSnapshot,
+      argumentsValid: true,
       options: { ...spawnOpts, shell: false },
     };
   }
 
   const shell =
     typeof spawnOpts.shell === "string" ? spawnOpts.shell : "/bin/sh";
-  const shellCommand = [command, ...(args || [])].map(String).join(" ");
+  const shellCommand = [command, ...argsSnapshot].map(String).join(" ");
   return {
     command: shell,
     args: ["-c", shellCommand],
+    inputArgs: argsSnapshot,
+    argumentsValid: true,
     options: { ...spawnOpts, shell: false },
   };
 }
@@ -857,6 +1008,650 @@ export function generateMacSeatbeltProfile(opts = {}, runtimeOverrides = {}) {
   return lines.join("\n");
 }
 
+function macMode(stat) {
+  return Number(stat.mode) & 0o7777;
+}
+
+function macSameOpenIdentity(left, right) {
+  return (
+    linuxOpenStatMatches(left, right) &&
+    String(left.uid) === String(right.uid) &&
+    String(left.gid) === String(right.gid)
+  );
+}
+
+function macFixedPathStat(runtime, candidate, options) {
+  const resolved = linuxRealpath(runtime, candidate);
+  const stat = runtime.fs.lstatSync(candidate);
+  const kindMatches =
+    options.kind === "directory" ? stat.isDirectory() : stat.isFile();
+  if (
+    resolved !== candidate ||
+    stat.isSymbolicLink?.() ||
+    !kindMatches ||
+    Number(stat.uid) !== 0 ||
+    Number(stat.gid) !== 0 ||
+    (options.mode !== undefined && macMode(stat) !== options.mode) ||
+    (options.mode === undefined && (macMode(stat) & 0o022) !== 0) ||
+    (options.nlink !== undefined && Number(stat.nlink) !== options.nlink)
+  ) {
+    throw new Error(options.reason || "macos_fixed_path_untrusted");
+  }
+  return stat;
+}
+
+function macOpenPinnedFile(runtime, candidate, options = {}) {
+  let fd;
+  try {
+    const namedBefore = macFixedPathStat(runtime, candidate, {
+      kind: "file",
+      mode: options.mode,
+      nlink: options.nlink,
+      reason: options.reason,
+    });
+    const constants = runtime.fs.constants || fs.constants;
+    fd = runtime.fs.openSync(
+      candidate,
+      Number(constants.O_RDONLY) |
+        Number(constants.O_NOFOLLOW || 0) |
+        Number(constants.O_CLOEXEC || 0) |
+        Number(constants.O_NONBLOCK || 0),
+    );
+    const before = runtime.fs.fstatSync(fd);
+    const bytes = Number(before.size);
+    if (
+      !before.isFile() ||
+      !macSameOpenIdentity(namedBefore, before) ||
+      (options.executable === true && (Number(before.mode) & 0o111) === 0) ||
+      !Number.isSafeInteger(bytes) ||
+      bytes < (options.minimumBytes ?? 1) ||
+      bytes > (options.maximumBytes ?? 16 * 1024 * 1024) ||
+      (options.expectedBytes !== undefined && bytes !== options.expectedBytes)
+    ) {
+      throw new Error(options.reason || "macos_fixed_file_untrusted");
+    }
+    const digest = hashLinuxOpenFile(runtime, fd, bytes);
+    const after = runtime.fs.fstatSync(fd);
+    const namedAfter = runtime.fs.lstatSync(candidate);
+    if (
+      !macSameOpenIdentity(before, after) ||
+      !macSameOpenIdentity(after, namedAfter) ||
+      linuxRealpath(runtime, candidate) !== candidate ||
+      (options.expectedSha256 !== undefined &&
+        digest !== options.expectedSha256)
+    ) {
+      throw new Error(options.reason || "macos_fixed_file_changed");
+    }
+    return {
+      fd,
+      stat: after,
+      sha256: digest,
+      bytes,
+      fileId: { dev: String(after.dev), ino: String(after.ino) },
+      mtimeMs: Number(after.mtimeMs),
+    };
+  } catch (error) {
+    if (fd !== undefined) {
+      try {
+        runtime.fs.closeSync(fd);
+      } catch {
+        // best effort
+      }
+    }
+    throw error;
+  }
+}
+
+function macReadPinnedUtf8(runtime, pin, maximumBytes) {
+  if (pin.bytes > maximumBytes) throw new Error("macos_contract_too_large");
+  const buffer = Buffer.alloc(pin.bytes);
+  let offset = 0;
+  while (offset < buffer.length) {
+    const read = runtime.fs.readSync(
+      pin.fd,
+      buffer,
+      offset,
+      buffer.length - offset,
+      offset,
+    );
+    if (read <= 0) throw new Error("macos_contract_ended_early");
+    offset += read;
+  }
+  return buffer.toString("utf8");
+}
+
+function macSpawnAttestation(runtime, command, args) {
+  const result = runtime.spawnSync(command, args, {
+    cwd: "/",
+    shell: false,
+    encoding: "utf8",
+    timeout: 15_000,
+    env: { PATH: "/usr/bin:/bin", LANG: "C", LC_ALL: "C" },
+  });
+  if (result?.error || result?.signal || result?.status !== 0) {
+    throw new Error("macos_helper_attestation_command_failed");
+  }
+  return {
+    stdout: String(result.stdout || ""),
+    stderr: String(result.stderr || ""),
+  };
+}
+
+function macExactObjectKeys(value, keys) {
+  return (
+    value &&
+    typeof value === "object" &&
+    !Array.isArray(value) &&
+    JSON.stringify(Object.keys(value).sort()) ===
+      JSON.stringify([...keys].sort())
+  );
+}
+
+function verifyMacHelperProbe(probe, nonce, contract, runtime) {
+  const keys = [
+    "schema",
+    "nonce",
+    "protocolVersion",
+    "protocolSha256",
+    "sourceSha256",
+    "gateBootstrapSha256",
+    "selfSha256",
+    "realUid",
+    "effectiveUid",
+    "realGid",
+    "effectiveGid",
+    "installedMode",
+    "snapshotRootMode",
+    "readyGate",
+    "rootWatchdog",
+    "staleCleanupBounded",
+    "maximumStaleSnapshots",
+    "globalLaunchLock",
+    "callerLifelineFd",
+    "callerLifelineWatched",
+    "signalRelayNonblocking",
+    "relayParentCredentialsDropped",
+    "entryRootOwnedAnonymousSnapshot",
+    "entrySourcePrePostStat",
+    "entryWriterClosedBeforeReadonlyReopen",
+    "entryReadonlyIdentityRechecked",
+    "entryUnlinkedAndDirectoryFsyncedBeforeTarget",
+    "targetInheritedEntrySnapshotOnly",
+    "runtimeAndCapsuleSlotsNullBeforeExec",
+    "bootstrapClosesNullAndReadyDescriptors",
+    "processForkExplicitlyDenied",
+  ];
+  const callerUid = runtime.getuid();
+  const callerGid = runtime.getgid();
+  if (
+    !macExactObjectKeys(probe, keys) ||
+    !Number.isSafeInteger(callerUid) ||
+    callerUid <= 0 ||
+    !Number.isSafeInteger(callerGid) ||
+    callerGid <= 0 ||
+    probe.schema !== "chainlesschain.macos-mcp-launcher-probe.v1" ||
+    probe.nonce !== nonce ||
+    probe.protocolVersion !== 1 ||
+    probe.protocolSha256 !== MACOS_MCP_LAUNCHER_INPUTS.protocolSha256 ||
+    probe.sourceSha256 !== MACOS_MCP_LAUNCHER_INPUTS.sourceSha256 ||
+    probe.gateBootstrapSha256 !==
+      MCP_STDIO_MACOS_GATED_ENTRY_BOOTSTRAP_SHA256 ||
+    probe.selfSha256 !== contract.helperSha256 ||
+    probe.realUid !== callerUid ||
+    probe.effectiveUid !== 0 ||
+    probe.realGid !== callerGid ||
+    probe.effectiveGid !== callerGid ||
+    probe.installedMode !== "4555" ||
+    probe.snapshotRootMode !== "0711" ||
+    probe.readyGate !== true ||
+    probe.rootWatchdog !== true ||
+    probe.staleCleanupBounded !== true ||
+    probe.maximumStaleSnapshots !==
+      MACOS_MCP_LAUNCHER_INPUTS.protocol.maximumStaleSnapshots ||
+    probe.globalLaunchLock !== true ||
+    probe.callerLifelineFd !==
+      MACOS_MCP_LAUNCHER_INPUTS.protocol.callerLifelineFd ||
+    probe.callerLifelineWatched !== true ||
+    probe.signalRelayNonblocking !== true ||
+    probe.relayParentCredentialsDropped !== true ||
+    probe.entryRootOwnedAnonymousSnapshot !== true ||
+    probe.entrySourcePrePostStat !== true ||
+    probe.entryWriterClosedBeforeReadonlyReopen !== true ||
+    probe.entryReadonlyIdentityRechecked !== true ||
+    probe.entryUnlinkedAndDirectoryFsyncedBeforeTarget !== true ||
+    probe.targetInheritedEntrySnapshotOnly !== true ||
+    probe.runtimeAndCapsuleSlotsNullBeforeExec !== true ||
+    probe.bootstrapClosesNullAndReadyDescriptors !== true ||
+    probe.processForkExplicitlyDenied !== true
+  ) {
+    throw new Error("macos_helper_probe_contract_mismatch");
+  }
+  return probe;
+}
+
+function attestInstalledMacMcpLauncher(runtime) {
+  const protocol = MACOS_MCP_LAUNCHER_INPUTS.protocol;
+  let contractPin;
+  let helperPin;
+  try {
+    for (const directory of [
+      "/Library",
+      "/Library/PrivilegedHelperTools",
+      "/Library/Application Support",
+      "/Library/Application Support/ChainlessChain",
+      "/Library/Application Support/ChainlessChain/McpLauncher",
+    ]) {
+      macFixedPathStat(runtime, directory, {
+        kind: "directory",
+        mode: 0o755,
+        reason: "macos_helper_install_directory_untrusted",
+      });
+    }
+    macFixedPathStat(runtime, protocol.snapshotRoot, {
+      kind: "directory",
+      mode: 0o711,
+      reason: "macos_helper_snapshot_root_untrusted",
+    });
+    macFixedPathStat(
+      runtime,
+      path.posix.join(protocol.snapshotRoot, protocol.snapshotLockName),
+      {
+        kind: "file",
+        mode: 0o600,
+        nlink: 1,
+        reason: "macos_helper_snapshot_lock_untrusted",
+      },
+    );
+    macFixedPathStat(runtime, protocol.sandboxExecutable, {
+      kind: "file",
+      reason: "macos_sandbox_exec_untrusted",
+    });
+    for (const tool of [
+      "/usr/bin/codesign",
+      "/usr/sbin/pkgutil",
+      "/usr/sbin/spctl",
+    ]) {
+      macFixedPathStat(runtime, tool, {
+        kind: "file",
+        reason: "macos_signature_tool_untrusted",
+      });
+    }
+    contractPin = macOpenPinnedFile(runtime, protocol.installContractPath, {
+      mode: 0o444,
+      nlink: 1,
+      maximumBytes: 64 * 1024,
+      reason: "macos_helper_install_contract_untrusted",
+    });
+    const contractText = macReadPinnedUtf8(runtime, contractPin, 64 * 1024);
+    const contract = verifyMacosMcpLauncherInstallContract(
+      JSON.parse(contractText),
+    );
+    const receiptResult = macSpawnAttestation(runtime, "/usr/sbin/pkgutil", [
+      "--pkg-info",
+      contract.packageIdentifier,
+    ]);
+    const receipt = Object.fromEntries(
+      receiptResult.stdout
+        .split(/\r?\n/u)
+        .map((line) => line.match(/^([^:]+):\s*(.*)$/u))
+        .filter(Boolean)
+        .map((match) => [match[1], match[2]]),
+    );
+    if (
+      receipt["package-id"] !== contract.packageIdentifier ||
+      receipt.version !== contract.packageVersion ||
+      receipt.volume !== "/"
+    ) {
+      throw new Error("macos_helper_package_receipt_mismatch");
+    }
+    helperPin = macOpenPinnedFile(runtime, protocol.helperInstallPath, {
+      mode: 0o4555,
+      nlink: 1,
+      executable: true,
+      expectedBytes: contract.helperBytes,
+      expectedSha256: contract.helperSha256,
+      reason: "macos_helper_binary_untrusted",
+    });
+    macSpawnAttestation(runtime, "/usr/bin/codesign", [
+      "--verify",
+      "--strict",
+      "--verbose=4",
+      `-R=${contract.designatedRequirement}`,
+      protocol.helperInstallPath,
+    ]);
+    const description = macSpawnAttestation(runtime, "/usr/bin/codesign", [
+      "-dvvv",
+      protocol.helperInstallPath,
+    ]);
+    const details = `${description.stdout}\n${description.stderr}`;
+    const teamIdentifier = details.match(/^TeamIdentifier=(.+)$/mu)?.[1];
+    const signingIdentifier = details.match(/^Identifier=(.+)$/mu)?.[1];
+    if (
+      teamIdentifier !== contract.teamIdentifier ||
+      signingIdentifier !== contract.signingIdentifier ||
+      !/^CodeDirectory .+ flags=.+\(runtime\)/mu.test(details)
+    ) {
+      throw new Error("macos_helper_signature_identity_mismatch");
+    }
+    const requirementOutput = macSpawnAttestation(
+      runtime,
+      "/usr/bin/codesign",
+      ["-dr", "-", protocol.helperInstallPath],
+    );
+    const designatedRequirement =
+      `${requirementOutput.stdout}\n${requirementOutput.stderr}`.match(
+        /^designated => (.+)$/mu,
+      )?.[1];
+    if (designatedRequirement !== contract.designatedRequirement) {
+      throw new Error("macos_helper_designated_requirement_mismatch");
+    }
+    const gatekeeper = macSpawnAttestation(runtime, "/usr/sbin/spctl", [
+      "--assess",
+      "--type",
+      "execute",
+      "--verbose=4",
+      protocol.helperInstallPath,
+    ]);
+    const gatekeeperEvidence = `${gatekeeper.stdout}\n${gatekeeper.stderr}`;
+    if (
+      !/\baccepted\b/iu.test(gatekeeperEvidence) ||
+      !/source=Notarized Developer ID/iu.test(gatekeeperEvidence)
+    ) {
+      throw new Error("macos_helper_notarization_unattested");
+    }
+    const nonce = runtime.randomBytes(32).toString("hex");
+    const probeResult = macSpawnAttestation(
+      runtime,
+      protocol.helperInstallPath,
+      ["--probe-v1", nonce],
+    );
+    if (probeResult.stderr.trim() !== "") {
+      throw new Error("macos_helper_probe_stderr");
+    }
+    const probe = verifyMacHelperProbe(
+      JSON.parse(probeResult.stdout),
+      nonce,
+      contract,
+      runtime,
+    );
+    if (
+      hashLinuxOpenFile(runtime, helperPin.fd, helperPin.bytes) !==
+        helperPin.sha256 ||
+      !macSameOpenIdentity(
+        helperPin.stat,
+        runtime.fs.fstatSync(helperPin.fd),
+      ) ||
+      !macSameOpenIdentity(
+        helperPin.stat,
+        macFixedPathStat(runtime, protocol.helperInstallPath, {
+          kind: "file",
+          mode: 0o4555,
+          nlink: 1,
+          reason: "macos_helper_binary_changed",
+        }),
+      ) ||
+      !macSameOpenIdentity(
+        contractPin.stat,
+        macFixedPathStat(runtime, protocol.installContractPath, {
+          kind: "file",
+          mode: 0o444,
+          nlink: 1,
+          reason: "macos_helper_install_contract_changed",
+        }),
+      )
+    ) {
+      throw new Error("macos_helper_installation_changed_during_attestation");
+    }
+    const installContractSha256 = crypto
+      .createHash("sha256")
+      .update(contractText)
+      .digest("hex");
+    return Object.freeze({
+      contract,
+      probe,
+      helper: Object.freeze({
+        path: protocol.helperInstallPath,
+        sha256: helperPin.sha256,
+        bytes: helperPin.bytes,
+        fileId: Object.freeze({ ...helperPin.fileId }),
+        mode: macMode(helperPin.stat),
+        uid: Number(helperPin.stat.uid),
+        gid: Number(helperPin.stat.gid),
+        signingIdentifier,
+        teamIdentifier,
+        packageIdentifier: contract.packageIdentifier,
+        packageVersion: contract.packageVersion,
+        designatedRequirementSha256: crypto
+          .createHash("sha256")
+          .update(designatedRequirement)
+          .digest("hex"),
+      }),
+      installContractSha256,
+    });
+  } finally {
+    for (const pin of [helperPin, contractPin]) {
+      if (pin?.fd !== undefined) {
+        try {
+          runtime.fs.closeSync(pin.fd);
+        } catch {
+          // best effort; launch admission still fails if later pinning fails
+        }
+      }
+    }
+  }
+}
+
+function macPinContractFile(runtime, identity, options = {}) {
+  let fd;
+  try {
+    if (
+      !identity ||
+      typeof identity.realPath !== "string" ||
+      !path.posix.isAbsolute(identity.realPath) ||
+      !/^[a-f0-9]{64}$/u.test(identity.sha256 || "") ||
+      !identity.fileId ||
+      !Number.isSafeInteger(identity.bytes) ||
+      identity.bytes < (options.minimumBytes ?? 0) ||
+      identity.bytes > options.maximumBytes ||
+      linuxRealpath(runtime, identity.realPath) !== identity.realPath
+    ) {
+      throw new Error("macos_contract_file_identity_invalid");
+    }
+    const namedBefore = runtime.fs.lstatSync(identity.realPath);
+    const constants = runtime.fs.constants || fs.constants;
+    if (namedBefore.isSymbolicLink?.() || !namedBefore.isFile()) {
+      throw new Error("macos_contract_file_identity_invalid");
+    }
+    fd = runtime.fs.openSync(
+      identity.realPath,
+      Number(constants.O_RDONLY) |
+        Number(constants.O_NOFOLLOW || 0) |
+        Number(constants.O_CLOEXEC || 0) |
+        Number(constants.O_NONBLOCK || 0),
+    );
+    const before = runtime.fs.fstatSync(fd);
+    if (
+      !before.isFile() ||
+      !macSameOpenIdentity(namedBefore, before) ||
+      String(before.dev) !== String(identity.fileId.dev) ||
+      String(before.ino) !== String(identity.fileId.ino) ||
+      Number(before.size) !== identity.bytes ||
+      Number(before.mtimeMs) !== Number(identity.mtimeMs) ||
+      (options.executable === true && (Number(before.mode) & 0o111) === 0)
+    ) {
+      throw new Error("macos_contract_file_identity_changed");
+    }
+    const sha256 = hashLinuxOpenFile(runtime, fd, identity.bytes);
+    const after = runtime.fs.fstatSync(fd);
+    const namedAfter = runtime.fs.lstatSync(identity.realPath);
+    if (
+      sha256 !== identity.sha256 ||
+      !macSameOpenIdentity(before, after) ||
+      !macSameOpenIdentity(after, namedAfter) ||
+      linuxRealpath(runtime, identity.realPath) !== identity.realPath
+    ) {
+      throw new Error("macos_contract_file_identity_changed");
+    }
+    return {
+      fd,
+      sha256,
+      bytes: identity.bytes,
+      fileId: { dev: String(after.dev), ino: String(after.ino) },
+      mtimeMs: Number(after.mtimeMs),
+      mode: Number(after.mode),
+    };
+  } catch (error) {
+    if (fd !== undefined) {
+      try {
+        runtime.fs.closeSync(fd);
+      } catch {
+        // best effort
+      }
+    }
+    throw error;
+  }
+}
+
+function macPinCapsuleDirectory(runtime, contract, callerUid) {
+  let fd;
+  try {
+    const root = contract.pluginRoot;
+    const identity = contract.rootIdentity;
+    if (
+      typeof root !== "string" ||
+      linuxRealpath(runtime, root) !== root ||
+      !identity?.fileId ||
+      identity.realPath !== root
+    ) {
+      throw new Error("macos_capsule_root_identity_invalid");
+    }
+    const namedBefore = runtime.fs.lstatSync(root);
+    const constants = runtime.fs.constants || fs.constants;
+    if (
+      namedBefore.isSymbolicLink?.() ||
+      !namedBefore.isDirectory() ||
+      Number(namedBefore.uid) !== callerUid ||
+      (Number(namedBefore.mode) & 0o022) !== 0
+    ) {
+      throw new Error("macos_capsule_root_identity_invalid");
+    }
+    fd = runtime.fs.openSync(
+      root,
+      Number(constants.O_RDONLY) |
+        Number(constants.O_DIRECTORY || 0) |
+        Number(constants.O_NOFOLLOW || 0) |
+        Number(constants.O_CLOEXEC || 0) |
+        Number(constants.O_NONBLOCK || 0),
+    );
+    const before = runtime.fs.fstatSync(fd);
+    const namedAfter = runtime.fs.lstatSync(root);
+    if (
+      !before.isDirectory() ||
+      !macSameOpenIdentity(namedBefore, before) ||
+      !macSameOpenIdentity(before, namedAfter) ||
+      String(before.dev) !== String(identity.fileId.dev) ||
+      String(before.ino) !== String(identity.fileId.ino) ||
+      linuxRealpath(runtime, root) !== root
+    ) {
+      throw new Error("macos_capsule_root_identity_changed");
+    }
+    return {
+      fd,
+      fileId: { dev: String(before.dev), ino: String(before.ino) },
+      mode: Number(before.mode),
+      uid: Number(before.uid),
+      gid: Number(before.gid),
+    };
+  } catch (error) {
+    if (fd !== undefined) {
+      try {
+        runtime.fs.closeSync(fd);
+      } catch {
+        // best effort
+      }
+    }
+    throw error;
+  }
+}
+
+function macStandardStdio(stdio) {
+  if (Array.isArray(stdio)) {
+    return [stdio[0] ?? "pipe", stdio[1] ?? "pipe", stdio[2] ?? "pipe"];
+  }
+  const value = stdio ?? "pipe";
+  return [value, value, value];
+}
+
+function macEnvironmentDigest(environment) {
+  const normalized = Object.fromEntries(
+    Object.entries(environment || {})
+      .map(([key, value]) => [key, String(value)])
+      .sort(([left], [right]) => left.localeCompare(right)),
+  );
+  return crypto
+    .createHash("sha256")
+    .update(JSON.stringify(normalized))
+    .digest("hex");
+}
+
+export const MACOS_PKG_EXECPATH_MAGIC = "PKG_INVOKE_NODEJS";
+
+export function macMcpTargetEnvironment(
+  environment,
+  { packaged = false, inheritedEnvironment = process.env } = {},
+) {
+  if (!packaged) return environment;
+  const base = environment ?? inheritedEnvironment;
+  if (!base || typeof base !== "object" || Array.isArray(base)) {
+    throw new TypeError("packaged macOS MCP environment must be an object");
+  }
+  return {
+    ...base,
+    PKG_EXECPATH: MACOS_PKG_EXECPATH_MAGIC,
+  };
+}
+
+function sameMacStdio(left, right) {
+  return (
+    Array.isArray(left) &&
+    Array.isArray(right) &&
+    left.length === 9 &&
+    right.length === 9 &&
+    left.every((value, index) => value === right[index])
+  );
+}
+
+export function consumeMacMcpCodeSnapshotPlanBinding(plan, expected = {}) {
+  const issued = issuedMacMcpCodeSnapshotPlans.get(plan);
+  if (!issued) return false;
+  issuedMacMcpCodeSnapshotPlans.delete(plan);
+  return (
+    issued.executionContract === expected.executionContract &&
+    issued.originalCommand === expected.command &&
+    sameStringArray(issued.originalArgs, expected.args) &&
+    issued.originalCwd === (expected.cwd ?? null) &&
+    issued.originalShell === (expected.shell ?? null) &&
+    issued.originalDetached === (expected.detached ?? null) &&
+    issued.profile === expected.profile &&
+    sameStringArray(issued.requiredBoundaries, expected.requiredBoundaries) &&
+    issued.sync === (expected.sync === true) &&
+    plan.backend === MACOS_MCP_CAPSULE_BACKEND &&
+    plan.enforcement === MACOS_MCP_CAPSULE_BACKEND &&
+    plan.policyAttested === true &&
+    plan.policyDigest === issued.policyDigest &&
+    plan.command === issued.helperCommand &&
+    sameStringArray(plan.args, issued.helperArgs) &&
+    plan.options?.cwd === "/" &&
+    plan.options?.shell === false &&
+    plan.options?.detached !== true &&
+    macEnvironmentDigest(plan.options?.env) === issued.environmentDigest &&
+    sameMacStdio(issued.stdio, plan.options?.stdio) &&
+    plan.postSpawn?.required === false &&
+    plan.postSpawn?.mode === "none" &&
+    plan.runtimeProbe?.planBindingDigest === issued.planBindingDigest
+  );
+}
+
 function validateMacMcpCapsuleContract(
   command,
   args,
@@ -873,6 +1668,7 @@ function validateMacMcpCapsuleContract(
     !linuxStdioIsNarrow(spawnOpts?.stdio) ||
     spawnOpts?.serialization !== undefined ||
     spawnOpts?.argv0 !== undefined ||
+    spawnOpts?.detached === true ||
     spawnOpts?.uid !== undefined ||
     spawnOpts?.gid !== undefined ||
     !Array.isArray(args) ||
@@ -936,6 +1732,7 @@ function applyMacMcpCapsuleCodeSnapshot(
   sandboxOpts,
   runtime,
   base,
+  planBindingAuthority = null,
 ) {
   const contract = sandboxOpts.executionContract;
   const validation = validateMacMcpCapsuleContract(
@@ -950,7 +1747,7 @@ function applyMacMcpCapsuleCodeSnapshot(
     createSandboxPlan({
       ...base,
       backend: null,
-      candidateBackend: MACOS_MCP_CAPSULE_BACKEND,
+      candidateBackend: MACOS_MCP_CAPSULE_CANDIDATE_BACKEND,
       policyAttested: false,
       runtimeProbe: runtimeProbe
         ? {
@@ -968,31 +1765,288 @@ function applyMacMcpCapsuleCodeSnapshot(
     return unavailable("macos_mcp_capsule_execution_contract_invalid", {
       attempted: false,
       runnable: false,
-      reason: validation.reason,
+      reason: validation.reason,
+      contentSnapshot: false,
+      handleAtomic: false,
+      entrySnapshotAtomic: false,
+      runtimeLaunchAtomic: false,
+      sharedLibraryClosure: false,
+    });
+  }
+
+  const protocol = MACOS_MCP_LAUNCHER_INPUTS.protocol;
+  const legacyUnavailable = () =>
+    unavailable("macos_atomic_runtime_exec_unavailable", {
+      attempted: true,
+      runnable: false,
+      reason: "public_api_has_no_descriptor_bound_exec",
+      contentSnapshot: false,
+      handleAtomic: false,
+      entrySnapshotAtomic: false,
+      runtimeLaunchAtomic: false,
+      runtimeLaunchMechanism: "darwin-public-api-pathname-exec-only-v1",
+      sharedLibraryClosure: false,
+    });
+  if (
+    typeof runtime.fs.existsSync !== "function" ||
+    !runtime.fs.existsSync(protocol.helperInstallPath) ||
+    !runtime.fs.existsSync(protocol.installContractPath)
+  ) {
+    // Darwin public APIs still provide no descriptor-bound exec. Production is
+    // enabled only by the separately signed, root-installed release contract.
+    return legacyUnavailable();
+  }
+
+  let runtimePin;
+  let entryPin;
+  let capsulePin;
+  try {
+    const callerUid = runtime.getuid();
+    const callerGid = runtime.getgid();
+    if (
+      !Number.isSafeInteger(callerUid) ||
+      callerUid <= 0 ||
+      !Number.isSafeInteger(callerGid) ||
+      callerGid <= 0
+    ) {
+      throw new Error("macos_helper_caller_credentials_invalid");
+    }
+    const installation = attestInstalledMacMcpLauncher(runtime);
+    runtimePin = macPinContractFile(runtime, contract.runtimeIdentity, {
+      executable: true,
+      minimumBytes: 1,
+      maximumBytes: protocol.maximumRuntimeBytes,
+    });
+    entryPin = macPinContractFile(runtime, contract.entryIdentity, {
+      minimumBytes: 0,
+      maximumBytes: protocol.maximumEntryBytes,
+    });
+    capsulePin = macPinCapsuleDirectory(runtime, contract, callerUid);
+    const nonce = runtime.randomBytes(32).toString("hex");
+    if (!/^[a-f0-9]{64}$/u.test(nonce)) {
+      throw new Error("macos_helper_nonce_generation_failed");
+    }
+    const snapshotPath = path.posix.join(protocol.snapshotRoot, nonce, "node");
+    const policyDigest = macosMcpLauncherPolicyDigest({
+      snapshotPath,
+      capsulePath: contract.pluginRoot,
+    });
+    const helperArgs = [
+      "--launch-v1",
+      nonce,
+      MACOS_MCP_LAUNCHER_INPUTS.protocolSha256,
+      runtimePin.sha256,
+      String(runtimePin.bytes),
+      entryPin.sha256,
+      String(entryPin.bytes),
+      String(callerUid),
+      String(callerGid),
+      policyDigest,
+      ...args.slice(1),
+    ];
+    const stdio = [
+      ...macStandardStdio(spawnOpts?.stdio),
+      runtimePin.fd,
+      entryPin.fd,
+      capsulePin.fd,
+      "ignore",
+      "ignore",
+      "pipe",
+    ];
+    const packagedRuntime = Boolean(runtime.pkg);
+    const targetEnvironment = macMcpTargetEnvironment(spawnOpts?.env, {
+      packaged: packagedRuntime,
+      inheritedEnvironment: runtime.env,
+    });
+    const options = {
+      ...(spawnOpts || {}),
+      cwd: "/",
+      shell: false,
+      detached: false,
+      stdio,
+      ...(targetEnvironment === undefined ? {} : { env: targetEnvironment }),
+    };
+    const installAttestationDigest = crypto
+      .createHash("sha256")
+      .update(
+        JSON.stringify({
+          version: 1,
+          protocolSha256: MACOS_MCP_LAUNCHER_INPUTS.protocolSha256,
+          sourceSha256: MACOS_MCP_LAUNCHER_INPUTS.sourceSha256,
+          gateBootstrapSha256: MCP_STDIO_MACOS_GATED_ENTRY_BOOTSTRAP_SHA256,
+          helper: installation.helper,
+          installContractSha256: installation.installContractSha256,
+        }),
+      )
+      .digest("hex");
+    const environmentDigest = macEnvironmentDigest(options.env);
+    const planBindingDigest = crypto
+      .createHash("sha256")
+      .update(
+        JSON.stringify({
+          version: 1,
+          backend: MACOS_MCP_CAPSULE_BACKEND,
+          helperArgs,
+          policyDigest,
+          installAttestationDigest,
+          environmentDigest,
+          runtimeFd: runtimePin.fd,
+          entryFd: entryPin.fd,
+          capsuleRootFd: capsulePin.fd,
+          callerLifelineFd: protocol.callerLifelineFd,
+        }),
+      )
+      .digest("hex");
+    let cleaned = false;
+    const cleanup = () => {
+      if (cleaned) return;
+      cleaned = true;
+      for (const pin of [runtimePin, entryPin, capsulePin]) {
+        if (pin?.fd !== undefined) {
+          try {
+            runtime.fs.closeSync(pin.fd);
+          } catch {
+            // Closing an already-duplicated parent descriptor is best effort.
+          }
+        }
+      }
+    };
+    const runtimeProbe = {
+      kind: "darwin-mcp-capsule-code-snapshot-v2",
+      attempted: true,
+      runnable: true,
+      reason: null,
+      probeRuntime: "node",
+      targetRuntime: "node",
+      targetRuntimeInvocationMode: packagedRuntime
+        ? "pkg-copied-executable-eval-v1"
+        : "node-executable-eval-v1",
+      pkgExecPathMagicBound: packagedRuntime,
+      contentSnapshot: true,
+      contentSnapshotScope: "mcp-capsule-entry-and-node-runtime",
+      contentSnapshotMechanism:
+        "signed-root-runtime-path-and-anonymous-entry-fd-snapshots-v1",
+      handleAtomic: true,
+      entrySnapshotAtomic: true,
+      runtimeLaunchAtomic: true,
+      runtimeLaunchMechanism:
+        "signed-root-helper-fd-copy-protected-path-ready-gate-v1",
+      runtimeLaunchPath: snapshotPath,
+      entrySnapshotPath: "anonymous-root-owned-fd4",
+      runtimeSnapshotSha256: runtimePin.sha256,
+      runtimeSnapshotBytes: runtimePin.bytes,
+      entrySnapshotSha256: entryPin.sha256,
+      entrySnapshotBytes: entryPin.bytes,
+      entrySnapshotBootstrapSha256:
+        MCP_STDIO_MACOS_GATED_ENTRY_BOOTSTRAP_SHA256,
+      sharedLibraryClosure: false,
+      rootProtectedRuntimeSnapshot: true,
+      entryRootOwnedAnonymousSnapshot: true,
+      entrySourcePrePostStat: true,
+      entryWriterClosedBeforeReadonlyReopen: true,
+      entryReadonlyIdentityRechecked: true,
+      entryUnlinkedAndDirectoryFsyncedBeforeTarget: true,
+      targetInheritedEntrySnapshotOnly: true,
+      runtimeAndCapsuleSlotsNullBeforeExec: true,
+      bootstrapClosesNullAndReadyDescriptors: true,
+      actualRuntimeReadyHandshake: true,
+      runtimeSnapshotUnlinkedBeforeEntryRelease: true,
+      callerCredentialDropIrreversible: true,
+      relayParentCredentialsDropped: true,
+      callerLifelineWatched: true,
+      signalRelayNonblocking: true,
+      targetDescriptorAllowlist:
+        "stdio-fd3-null-fd4-entry-fd5-null-fd6-gate-fd7-ready",
+      capsuleRootDescriptorBound: true,
+      capsulePathObjectAtomic: false,
+      sandboxProfileFixedAndDigestBound: true,
+      processForkExplicitlyDenied: true,
+      sandboxExecLiveGateContract: true,
+      globalLaunchSerialization: true,
+      maximumStaleSnapshots: protocol.maximumStaleSnapshots,
+      helperSha256: installation.helper.sha256,
+      helperSourceSha256: MACOS_MCP_LAUNCHER_INPUTS.sourceSha256,
+      helperProtocolSha256: MACOS_MCP_LAUNCHER_INPUTS.protocolSha256,
+      helperInstallContractSha256: installation.installContractSha256,
+      helperDesignatedRequirementSha256:
+        installation.helper.designatedRequirementSha256,
+      helperTeamIdentifier: installation.helper.teamIdentifier,
+      helperPackageIdentifier: installation.helper.packageIdentifier,
+      helperPackageVersion: installation.helper.packageVersion,
+      installAttestationDigest,
+      planBindingMechanism: "macos-mcp-code-snapshot-plan-binding-v1",
+      planBindingDigest,
+    };
+    const plan = createSandboxPlan({
+      ...base,
+      applied: true,
+      enforcement: MACOS_MCP_CAPSULE_BACKEND,
+      backend: MACOS_MCP_CAPSULE_BACKEND,
+      candidateBackend: null,
+      policyAttested: true,
+      policyDigest,
+      command: protocol.helperInstallPath,
+      args: helperArgs,
+      options,
+      runtimeProbe,
+      guarantees: [
+        SANDBOX_BOUNDARIES.CODE_SNAPSHOT,
+        SANDBOX_BOUNDARIES.FILESYSTEM,
+        SANDBOX_BOUNDARIES.NETWORK,
+        SANDBOX_BOUNDARIES.PROCESS_EXEC,
+        SANDBOX_BOUNDARIES.PROCESS_TREE,
+        SANDBOX_BOUNDARIES.PRIVILEGE_REDUCTION,
+      ],
+      cleanup,
+    });
+    if (planBindingAuthority === MACOS_MCP_CODE_SNAPSHOT_ISSUER) {
+      issuedMacMcpCodeSnapshotPlans.set(
+        plan,
+        Object.freeze({
+          executionContract: contract,
+          originalCommand: command,
+          originalArgs: Object.freeze([...args]),
+          originalCwd: spawnOpts?.cwd ?? null,
+          originalShell: spawnOpts?.shell ?? null,
+          originalDetached: spawnOpts?.detached ?? null,
+          profile: base.profile,
+          requiredBoundaries: Object.freeze([
+            ...(sandboxOpts.requiredBoundaries || []),
+          ]),
+          sync: sandboxOpts.sync === true,
+          policyDigest,
+          helperCommand: protocol.helperInstallPath,
+          helperArgs: Object.freeze([...helperArgs]),
+          environmentDigest,
+          stdio: Object.freeze([...stdio]),
+          planBindingDigest,
+        }),
+      );
+    }
+    return plan;
+  } catch (error) {
+    for (const pin of [runtimePin, entryPin, capsulePin]) {
+      if (pin?.fd !== undefined) {
+        try {
+          runtime.fs.closeSync(pin.fd);
+        } catch {
+          // best effort
+        }
+      }
+    }
+    return unavailable("macos_atomic_runtime_exec_unavailable", {
+      kind: "darwin-mcp-capsule-code-snapshot-v2",
+      attempted: true,
+      runnable: false,
+      reason: error?.message || "signed_root_helper_unattested",
       contentSnapshot: false,
       handleAtomic: false,
       entrySnapshotAtomic: false,
       runtimeLaunchAtomic: false,
+      runtimeLaunchMechanism: "signed-root-helper-unattested-v1",
       sharedLibraryClosure: false,
     });
   }
-
-  // Darwin exposes only pathname-based exec/spawn APIs to an unprivileged
-  // process. An inherited descriptor can bind the entry source, but public
-  // APIs cannot bind the verified Node runtime descriptor to the image that
-  // executes. Private temporary paths and Seatbelt still leave a same-UID
-  // pathname-replacement window, so they cannot satisfy CODE_SNAPSHOT.
-  return unavailable("macos_atomic_runtime_exec_unavailable", {
-    attempted: true,
-    runnable: false,
-    reason: "public_api_has_no_descriptor_bound_exec",
-    contentSnapshot: false,
-    handleAtomic: false,
-    entrySnapshotAtomic: false,
-    runtimeLaunchAtomic: false,
-    runtimeLaunchMechanism: "darwin-public-api-pathname-exec-only-v1",
-    sharedLibraryClosure: false,
-  });
 }
 
 /**
@@ -1013,6 +2067,7 @@ export function applyMacSandbox(
   spawnOpts,
   sandboxOpts = {},
   runtimeOverrides = {},
+  planBindingAuthority = null,
 ) {
   const runtime = resolveRuntime(runtimeOverrides);
   const invocation = normalizeWrappedInvocation(
@@ -1047,6 +2102,7 @@ export function applyMacSandbox(
       sandboxOpts,
       runtime,
       base,
+      planBindingAuthority,
     );
   }
 
@@ -3882,6 +4938,7 @@ function linuxBubblewrapProbe(
   supervisorBinding = null,
   pluginTreeSnapshot = null,
   nativeDynamicClosure = null,
+  runtimeLoadSet = null,
   runtimeDetachedChildSpawnVerified = false,
 ) {
   const native =
@@ -3923,18 +4980,42 @@ function linuxBubblewrapProbe(
     reason === null &&
     supervisorDescriptorBound &&
     nativeDynamicClosure?.mechanism ===
-      LINUX_NATIVE_DYNAMIC_DIRECT_SYSTEM_SET_MECHANISM &&
+      LINUX_NATIVE_DYNAMIC_RECURSIVE_SYSTEM_GRAPH_MECHANISM &&
     nativeDynamicClosure?.scope ===
-      LINUX_NATIVE_DYNAMIC_DIRECT_SYSTEM_SET_SCOPE &&
+      LINUX_NATIVE_DYNAMIC_RECURSIVE_SYSTEM_GRAPH_SCOPE &&
     typeof nativeDynamicClosure?.interpreter === "string" &&
     path.posix.isAbsolute(nativeDynamicClosure.interpreter) &&
     Number.isSafeInteger(nativeDynamicClosure?.dependencies) &&
     nativeDynamicClosure.dependencies >= 0 &&
-    nativeDynamicClosure.dependencies <= LINUX_ELF_MAX_NEEDED_ENTRIES &&
+    nativeDynamicClosure.dependencies <= LINUX_ELF_MAX_INITIAL_CLOSURE_EDGES &&
     Number.isSafeInteger(nativeDynamicClosure?.files) &&
     nativeDynamicClosure.files >= 1 &&
+    nativeDynamicClosure.files <= LINUX_ELF_MAX_INITIAL_CLOSURE_FILES &&
+    Number.isSafeInteger(nativeDynamicClosure?.bytes) &&
+    nativeDynamicClosure.bytes > 0 &&
+    nativeDynamicClosure.bytes <= LINUX_ELF_MAX_INITIAL_CLOSURE_BYTES &&
     typeof nativeDynamicClosure?.digest === "string" &&
     /^[a-f0-9]{64}$/.test(nativeDynamicClosure.digest);
+  const runtimeSharedLibraryPathnameClosure =
+    initialDynamicLoadClosureDescriptorBound &&
+    pluginTreeContentSnapshot &&
+    runtimeLoadSet?.scope === LINUX_NATIVE_RUNTIME_PATHNAME_CLOSURE_SCOPE &&
+    runtimeLoadSet?.mechanism ===
+      LINUX_NATIVE_RUNTIME_PATHNAME_CLOSURE_MECHANISM &&
+    Number.isSafeInteger(runtimeLoadSet?.files) &&
+    runtimeLoadSet.files > 0 &&
+    runtimeLoadSet.files <= LINUX_NATIVE_RUNTIME_PATHNAME_CLOSURE_MAX_FILES &&
+    Number.isSafeInteger(runtimeLoadSet?.bytes) &&
+    runtimeLoadSet.bytes > 0 &&
+    runtimeLoadSet.bytes <= LINUX_NATIVE_RUNTIME_PATHNAME_CLOSURE_MAX_BYTES &&
+    typeof runtimeLoadSet?.digest === "string" &&
+    /^[a-f0-9]{64}$/.test(runtimeLoadSet.digest) &&
+    runtimeLoadSet.policyBound === true &&
+    runtimeLoadSet.writableFilesystems === false &&
+    runtimeLoadSet.procfsMounted === false &&
+    runtimeLoadSet.devfsMounted === false &&
+    runtimeLoadSet.scratchWritable === false &&
+    runtimeLoadSet.descriptorReopenPaths === false;
   return {
     kind: dynamicNative
       ? "linux-bwrap-plugin-native-dynamic-elf-policy-v1"
@@ -3977,7 +5058,31 @@ function linuxBubblewrapProbe(
           initialDynamicInterpreter: nativeDynamicClosure.interpreter,
           initialDynamicDependencyCount: nativeDynamicClosure.dependencies,
           initialDynamicRuntimeFileCount: nativeDynamicClosure.files,
+          initialDynamicRuntimeBytes: nativeDynamicClosure.bytes,
           initialDynamicLoadClosureDigest: nativeDynamicClosure.digest,
+          // The legacy aggregate field is intentionally kept false: this
+          // production slice closes libc/ELF-loader pathname resolution, not
+          // anonymous JIT mappings or a malicious custom in-process loader.
+          sharedLibraryClosure: false,
+          ...(runtimeSharedLibraryPathnameClosure
+            ? {
+                runtimeSharedLibraryPathnameClosure: true,
+                runtimeSharedLibraryPathnameClosureExcludes:
+                  "anonymous-jit-and-custom-in-process-loader",
+                runtimeSharedLibraryClosureScope: runtimeLoadSet.scope,
+                runtimeSharedLibraryClosureMechanism: runtimeLoadSet.mechanism,
+                runtimeSharedLibraryLoadSetFiles: runtimeLoadSet.files,
+                runtimeSharedLibraryLoadSetBytes: runtimeLoadSet.bytes,
+                runtimeSharedLibraryLoadSetDigest: runtimeLoadSet.digest,
+                runtimeLoadSetPolicyBound: runtimeLoadSet.policyBound,
+                runtimeWritableFilesystems: runtimeLoadSet.writableFilesystems,
+                runtimeProcfsMounted: runtimeLoadSet.procfsMounted,
+                runtimeDevfsMounted: runtimeLoadSet.devfsMounted,
+                runtimeScratchWritable: runtimeLoadSet.scratchWritable,
+                runtimeDescriptorReopenPaths:
+                  runtimeLoadSet.descriptorReopenPaths,
+              }
+            : {}),
         }
       : {}),
     supervisorDescriptorBound,
@@ -3990,8 +5095,9 @@ function linuxBubblewrapProbe(
           supervisorDescriptorConsumedBeforeTarget: runnable,
           supervisorStagingPathHidden: runnable,
           supervisorTemporaryCopyObscured: runnable,
-          supervisorPid1ExecutableExposure:
-            supervisorBinding.pid1ExecutableExposure,
+          supervisorPid1ExecutableExposure: runtimeSharedLibraryPathnameClosure
+            ? "procfs-not-mounted"
+            : supervisorBinding.pid1ExecutableExposure,
           supervisorExecutableIdentity: {
             path: supervisorBinding.path,
             fileId: supervisorBinding.fileId,
@@ -4246,7 +5352,7 @@ function assignLinuxMountChildFds(mounts) {
 function linuxStdioWithPinnedMounts(
   stdio,
   descriptors,
-  { probe = false, supervisorFd = null } = {},
+  { probe = false, supervisorFd = null, scrubberFd = null } = {},
 ) {
   let standard;
   if (probe) {
@@ -4260,10 +5366,12 @@ function linuxStdioWithPinnedMounts(
   }
   while (standard.length < 3) standard.push(undefined);
   const supervisor = Number.isInteger(supervisorFd) ? [supervisorFd] : [];
+  const scrubber = Number.isInteger(scrubberFd) ? [scrubberFd] : [];
   return [
     ...standard.slice(0, 3),
     ...supervisor,
     ...descriptors.map((descriptor) => descriptor.fd),
+    ...scrubber,
   ];
 }
 
@@ -4306,16 +5414,51 @@ function validateLinuxPluginContract(
   ) {
     return { ok: false, reason: "unsupported_launch_options" };
   }
-  const invalidArgs =
-    !Array.isArray(args) ||
-    args.some((arg) => typeof arg !== "string" || arg.includes("\0"));
+  let argsSnapshot = null;
+  try {
+    if (
+      Array.isArray(args) &&
+      Object.getPrototypeOf(args) === Array.prototype
+    ) {
+      const descriptors = Object.getOwnPropertyDescriptors(args);
+      const lengthDescriptor = descriptors.length;
+      if (
+        lengthDescriptor &&
+        "value" in lengthDescriptor &&
+        Number.isSafeInteger(lengthDescriptor.value) &&
+        lengthDescriptor.value >= 0 &&
+        Reflect.ownKeys(descriptors).length === lengthDescriptor.value + 1
+      ) {
+        const snapshot = [];
+        for (let index = 0; index < lengthDescriptor.value; index += 1) {
+          const descriptor = descriptors[String(index)];
+          if (
+            !descriptor ||
+            !("value" in descriptor) ||
+            typeof descriptor.value !== "string" ||
+            descriptor.value.includes("\0")
+          ) {
+            argsSnapshot = null;
+            break;
+          }
+          snapshot.push(descriptor.value);
+        }
+        if (snapshot.length === lengthDescriptor.value) {
+          argsSnapshot = Object.freeze(snapshot);
+        }
+      }
+    }
+  } catch {
+    argsSnapshot = null;
+  }
+  const invalidArgs = argsSnapshot === null;
   const invalidNodeLaunch =
     nodeContract &&
-    (!Array.isArray(args) ||
+    (!argsSnapshot ||
       command !== contract.runtimePath ||
       command !== contract.runtimeIdentity?.realPath ||
-      args.length < 1 ||
-      args[0] !== contract.entryIdentity?.realPath);
+      argsSnapshot.length < 1 ||
+      argsSnapshot[0] !== contract.entryIdentity?.realPath);
   const invalidNativeLaunch =
     nativeContract && command !== contract.entryIdentity?.realPath;
   if (
@@ -4433,6 +5576,7 @@ function validateLinuxPluginContract(
   return {
     ok: true,
     contract,
+    argsSnapshot,
     entryRuntime: nativeContract
       ? entryFormat?.runtime ||
         (legacyStaticNativeContract
@@ -4555,6 +5699,16 @@ function linuxMcpRuntimeSnapshotContract() {
   };
 }
 
+function linuxPluginRuntimeSnapshotContract() {
+  return {
+    scope: LINUX_PLUGIN_RUNTIME_SNAPSHOT_SCOPE,
+    targetMode: "0500",
+    sourceMode: LINUX_EXECUTABLE_SNAPSHOT_SOURCE_MODE,
+    minimumBytes: 1,
+    errorPrefix: "plugin_node_runtime_snapshot",
+  };
+}
+
 function createLinuxRegularFileSnapshot(
   runtime,
   entryMount,
@@ -4630,7 +5784,8 @@ function createLinuxRegularFileSnapshot(
     }
     if (
       (snapshotContract.scope === LINUX_NATIVE_ENTRY_SNAPSHOT_SCOPE ||
-        snapshotContract.scope === LINUX_MCP_RUNTIME_SNAPSHOT_SCOPE) &&
+        snapshotContract.scope === LINUX_MCP_RUNTIME_SNAPSHOT_SCOPE ||
+        snapshotContract.scope === LINUX_PLUGIN_RUNTIME_SNAPSHOT_SCOPE) &&
       (sourceFileMode & 0o111) === 0
     ) {
       throw snapshotError("source_mode_changed");
@@ -5406,9 +6561,14 @@ function linuxSystemDynamicPath(value) {
  * to a host inspection utility. Besides conventional fully static ET_EXEC and
  * static-PIE-shaped ET_DYN images, the parser can describe a narrow dynamic
  * executable. The caller must separately prove that its PT_INTERP and every
- * direct DT_NEEDED member are present in a pinned, attested system-file set.
+ * recursively reachable startup DT_NEEDED member resolve through a pinned,
+ * attested system-file graph.
  */
-function inspectLinuxNativeElf(runtime, fd, identity) {
+function inspectLinuxNativeElf(runtime, fd, identity, { role = "entry" } = {}) {
+  const dependencyObject = role === "dependency";
+  if (!dependencyObject && role !== "entry") {
+    throw new Error("native_elf_inspection_role_invalid");
+  }
   const expectedMachine = LINUX_ELF_MACHINES[runtime.arch];
   if (!expectedMachine) {
     throw new Error(`unsupported_elf_architecture:${String(runtime.arch)}`);
@@ -5417,8 +6577,11 @@ function inspectLinuxNativeElf(runtime, fd, identity) {
   const before = runtime.fs.fstatSync(fd);
   if (
     !before.isFile() ||
-    Number(before.nlink) !== 1 ||
-    (Number(before.mode) & 0o111) === 0 ||
+    (dependencyObject
+      ? Number(before.nlink) < 1 ||
+        Number(before.uid) !== 0 ||
+        (Number(before.mode) & 0o022) !== 0
+      : Number(before.nlink) !== 1 || (Number(before.mode) & 0o111) === 0) ||
     (Number(before.mode) & 0o6000) !== 0 ||
     String(before.dev) !== String(identity?.fileId?.dev) ||
     String(before.ino) !== String(identity?.fileId?.ino) ||
@@ -5447,6 +6610,9 @@ function inspectLinuxNativeElf(runtime, fd, identity) {
   if (elfType !== LINUX_ELF_TYPE_EXEC && elfType !== LINUX_ELF_TYPE_DYN) {
     throw new Error("native_entry_unsupported_elf_type");
   }
+  if (dependencyObject && elfType !== LINUX_ELF_TYPE_DYN) {
+    throw new Error("native_dependency_not_shared_object");
+  }
   if (header.readUInt16LE(18) !== expectedMachine) {
     throw new Error("native_entry_architecture_mismatch");
   }
@@ -5551,7 +6717,7 @@ function inspectLinuxNativeElf(runtime, fd, identity) {
     }
   }
   attestLinuxElfLoadMappings(loadSegments, runtimePageSize);
-  if (!executableLoad || !entryInExecutableLoad) {
+  if (!executableLoad || (!dependencyObject && !entryInExecutableLoad)) {
     throw new Error("native_entry_has_no_executable_entry_segment");
   }
   if (!nonExecutableStack) {
@@ -5561,6 +6727,12 @@ function inspectLinuxNativeElf(runtime, fd, identity) {
   if (interpreterSegments.length > 1) {
     throw new Error("native_entry_interpreter_ambiguous");
   }
+  // A shared object can itself be directly executable: Ubuntu 24.04's
+  // libc.so.6, for example, carries PT_INTERP. The dynamic loader ignores
+  // that segment when it maps the object as a dependency, so rejecting it
+  // would exclude a legitimate recursive startup graph. Still parse and
+  // validate the segment below; only an entry object's interpreter becomes
+  // part of the kernel-exec contract and returned closure evidence.
   let interpreter = null;
   if (interpreterSegments.length === 1) {
     const segment = interpreterSegments[0];
@@ -5590,17 +6762,24 @@ function inspectLinuxNativeElf(runtime, fd, identity) {
     }
   }
 
-  const staticPie = elfType === LINUX_ELF_TYPE_DYN && interpreter === null;
-  const dynamicExecutable = interpreter !== null;
+  const staticPie =
+    !dependencyObject && elfType === LINUX_ELF_TYPE_DYN && interpreter === null;
+  const dynamicExecutable = !dependencyObject && interpreter !== null;
   let dynamicMetadata = null;
-  if (elfType === LINUX_ELF_TYPE_EXEC && !dynamicExecutable) {
+  if (
+    !dependencyObject &&
+    elfType === LINUX_ELF_TYPE_EXEC &&
+    !dynamicExecutable
+  ) {
     if (dynamicSegments.length > 0) {
       throw new Error("native_entry_dynamic_elf_unsupported");
     }
   } else {
-    const prefix = staticPie
-      ? "native_entry_static_pie"
-      : "native_entry_dynamic";
+    const prefix = dependencyObject
+      ? "native_dependency_dynamic"
+      : staticPie
+        ? "native_entry_static_pie"
+        : "native_entry_dynamic";
     if (dynamicSegments.length === 0) {
       throw new Error(`${prefix}_dynamic_segment_missing`);
     }
@@ -5668,6 +6847,7 @@ function inspectLinuxNativeElf(runtime, fd, identity) {
       Number(dynamic.fileOffset),
     );
     const neededOffsets = [];
+    let sonameOffset = null;
     const forbiddenDependencyTags = new Set([
       LINUX_ELF_DYNAMIC_RPATH,
       LINUX_ELF_DYNAMIC_RUNPATH,
@@ -5704,6 +6884,11 @@ function inspectLinuxNativeElf(runtime, fd, identity) {
         if (neededOffsets.length > LINUX_ELF_MAX_NEEDED_ENTRIES) {
           throw new Error(`${prefix}_dependency_count_exceeded`);
         }
+      } else if (tag === LINUX_ELF_DYNAMIC_SONAME) {
+        if (sonameOffset !== null) {
+          throw new Error(`${prefix}_soname_ambiguous`);
+        }
+        sonameOffset = value;
       } else if (tag === LINUX_ELF_DYNAMIC_STRTAB) {
         if (stringTableAddress !== null) {
           throw new Error(`${prefix}_string_table_ambiguous`);
@@ -5733,17 +6918,19 @@ function inspectLinuxNativeElf(runtime, fd, identity) {
       throw new Error(`${prefix}_text_relocation_unsupported`);
     }
     if (
+      !dependencyObject &&
       elfType === LINUX_ELF_TYPE_DYN &&
       (flags1 === null || (flags1 & LINUX_ELF_DYNAMIC_FLAG_PIE) === 0n)
     ) {
       throw new Error(`${prefix}_flag_missing`);
     }
-    if (staticPie && neededOffsets.length > 0) {
+    if (!dependencyObject && staticPie && neededOffsets.length > 0) {
       throw new Error("native_entry_static_pie_dependency_unsupported");
     }
 
     let needed = [];
-    if (neededOffsets.length > 0) {
+    let soname = null;
+    if (neededOffsets.length > 0 || sonameOffset !== null) {
       if (
         stringTableAddress === null ||
         stringTableBytes === null ||
@@ -5793,34 +6980,61 @@ function inspectLinuxNativeElf(runtime, fd, identity) {
       if (new Set(needed).size !== needed.length) {
         throw new Error("native_entry_dynamic_dependency_ambiguous");
       }
+      if (sonameOffset !== null) {
+        if (sonameOffset > BigInt(Number.MAX_SAFE_INTEGER)) {
+          throw new Error(`${prefix}_soname_string_out_of_bounds`);
+        }
+        soname = readLinuxElfString(
+          stringTable,
+          Number(sonameOffset),
+          "dynamic_soname",
+        );
+        if (
+          !/^[A-Za-z0-9][A-Za-z0-9._+-]{0,254}$/.test(soname) ||
+          path.posix.basename(soname) !== soname
+        ) {
+          throw new Error(`${prefix}_soname_invalid`);
+        }
+      }
     }
 
-    if (dynamicExecutable) {
+    if (dynamicExecutable || dependencyObject) {
       dynamicMetadata = Object.freeze({
-        interpreter,
+        ...(dynamicExecutable ? { interpreter } : {}),
         needed: Object.freeze(needed),
+        soname,
       });
     }
   }
 
   const sha256 = hashLinuxOpenFile(runtime, fd, Number(before.size));
   const after = runtime.fs.fstatSync(fd);
-  if (!linuxOpenStatMatches(before, after) || sha256 !== identity.sha256) {
+  if (
+    !linuxOpenStatMatches(before, after) ||
+    (identity.sha256 !== undefined && sha256 !== identity.sha256)
+  ) {
     throw new Error("native_entry_changed_during_elf_attestation");
   }
   return Object.freeze({
-    runtime: dynamicExecutable ? "native-dynamic-elf" : "native-static-elf",
-    format: dynamicExecutable
-      ? elfType === LINUX_ELF_TYPE_DYN
-        ? "elf64-dynamic-pie-et-dyn"
-        : "elf64-dynamic-et-exec"
-      : elfType === LINUX_ELF_TYPE_DYN
-        ? "elf64-static-pie-shaped-et-dyn"
-        : "elf64-static-et-exec",
+    runtime: dependencyObject
+      ? "native-shared-object"
+      : dynamicExecutable
+        ? "native-dynamic-elf"
+        : "native-static-elf",
+    format: dependencyObject
+      ? "elf64-shared-object-et-dyn"
+      : dynamicExecutable
+        ? elfType === LINUX_ELF_TYPE_DYN
+          ? "elf64-dynamic-pie-et-dyn"
+          : "elf64-dynamic-et-exec"
+        : elfType === LINUX_ELF_TYPE_DYN
+          ? "elf64-static-pie-shaped-et-dyn"
+          : "elf64-static-et-exec",
     architecture: runtime.arch,
     machine: expectedMachine,
     loaderPageBytes: Number(runtimePageSize),
     programHeaders: programHeaderCount,
+    sha256,
     ...(dynamicMetadata || {}),
   });
 }
@@ -5856,17 +7070,22 @@ function linuxFdMountId(runtime, fd) {
 }
 
 function closeLinuxPinnedMounts(runtime, mounts) {
+  const closed = new Set();
   for (const mount of mounts || []) {
-    if (!Number.isInteger(mount?.fd)) continue;
-    const fd = mount.fd;
-    // Clear ownership before close so repeated cleanup cannot close an
-    // unrelated descriptor if the OS has already reused this number.
-    mount.fd = null;
-    try {
-      runtime.fs.closeSync(fd);
-    } catch {
-      // Best effort. The process is already fail-closed if a pin cannot be
-      // created; cleanup must not replace the original boundary error.
+    for (const field of ["fd", "scrubberFd"]) {
+      if (!Number.isInteger(mount?.[field])) continue;
+      const fd = mount[field];
+      // Clear ownership before close so repeated cleanup cannot close an
+      // unrelated descriptor if the OS has already reused this number.
+      mount[field] = null;
+      if (closed.has(fd)) continue;
+      closed.add(fd);
+      try {
+        runtime.fs.closeSync(fd);
+      } catch {
+        // Best effort. The process is already fail-closed if a pin cannot be
+        // created; cleanup must not replace the original boundary error.
+      }
     }
   }
 }
@@ -6042,7 +7261,10 @@ function pinLinuxPluginTree(runtime, pluginRoot, rootIdentity) {
   }
 }
 
-function buildLinuxNetworkSeccompFilter(arch) {
+function buildLinuxNetworkSeccompFilter(
+  arch,
+  { runtimePathnameClosure = false } = {},
+) {
   const architecture = LINUX_SECCOMP_FILTERS[arch];
   if (!architecture) {
     throw new Error(`unsupported_seccomp_architecture:${String(arch)}`);
@@ -6071,8 +7293,54 @@ function buildLinuxNetworkSeccompFilter(arch) {
     // syscall. No ring descriptor is inherited by this narrow launch route.
     [0x15, 0, 1, architecture.ioUringSetupSyscall],
     [0x06, 0, 0, 0x00050001],
-    [0x06, 0, 0, 0x7fff0000],
   );
+  if (runtimePathnameClosure) {
+    // clone3 receives a pointer to struct clone_args, which classic seccomp BPF
+    // cannot safely dereference. Make the syscall unavailable so glibc can
+    // fall back to classic clone for ordinary threads; the classic call below
+    // rejects only namespace-producing flags.
+    instructions.push(
+      [0x15, 0, 1, architecture.clone3Syscall],
+      [0x06, 0, 0, 0x00050026],
+    );
+    for (const syscall of [
+      // recvmsg(2) and recvmmsg(2) are the two receive APIs capable of
+      // importing SCM_RIGHTS descriptors. recvfrom/read cannot receive
+      // ancillary descriptors, and sendmsg does not import one.
+      architecture.recvmsgSyscall,
+      architecture.recvmmsgSyscall,
+      architecture.pidfdGetfdSyscall,
+      architecture.openByHandleAtSyscall,
+      // A read-only outer namespace is not a closure if the target can create
+      // or join another namespace and mount writable bytes over a visible path.
+      architecture.unshareSyscall,
+      architecture.setnsSyscall,
+      architecture.mountSyscall,
+      architecture.umount2Syscall,
+      architecture.pivotRootSyscall,
+      architecture.openTreeSyscall,
+      architecture.moveMountSyscall,
+      architecture.fsopenSyscall,
+      architecture.fsconfigSyscall,
+      architecture.fsmountSyscall,
+      architecture.fspickSyscall,
+      architecture.mountSetattrSyscall,
+    ]) {
+      instructions.push([0x15, 0, 1, syscall], [0x06, 0, 0, 0x00050001]);
+    }
+    instructions.push(
+      // seccomp_data.args[0] starts at byte 16. All supported ABIs are
+      // little-endian, so loading this word inspects the low classic-clone
+      // flags. Preserve fork/pthread clone calls while rejecting NEWUSER/NEWNS.
+      [0x15, 0, 5, architecture.cloneSyscall],
+      [0x20, 0, 0, 16],
+      [0x54, 0, 0, LINUX_NAMESPACE_CLONE_FLAGS],
+      [0x15, 1, 0, 0],
+      [0x06, 0, 0, 0x00050001],
+      [0x06, 0, 0, 0x7fff0000],
+    );
+  }
+  instructions.push([0x06, 0, 0, 0x7fff0000]);
   const buffer = Buffer.alloc(instructions.length * 8);
   instructions.forEach(([code, jumpTrue, jumpFalse, value], index) => {
     const offset = index * 8;
@@ -6088,8 +7356,8 @@ function buildLinuxNetworkSeccompFilter(arch) {
   };
 }
 
-function pinLinuxNetworkSeccompFilter(runtime) {
-  const filter = buildLinuxNetworkSeccompFilter(runtime.arch);
+function pinLinuxNetworkSeccompFilter(runtime, options = {}) {
+  const filter = buildLinuxNetworkSeccompFilter(runtime.arch, options);
   let fd;
   try {
     for (const method of [
@@ -6159,7 +7427,9 @@ function pinLinuxNetworkSeccompFilter(runtime) {
       childFd: null,
       arch: filter.arch,
       sha256: filter.sha256,
-      policy: "deny-network-creation",
+      policy: options.runtimePathnameClosure
+        ? "deny-network-creation-loader-fd-acquisition-and-namespace-mutation"
+        : "deny-network-creation",
     };
   } catch (error) {
     if (fd !== undefined) {
@@ -6336,42 +7606,119 @@ function pinLinuxBubblewrapSupervisor(runtime) {
   }
 }
 
-function openLinuxBubblewrapSupervisorLaunch(runtime, supervisorPin) {
+function pinLinuxBubblewrapDescriptorScrubber(runtime) {
   let fd;
   try {
+    for (const method of [
+      "openSync",
+      "readSync",
+      "fstatSync",
+      "statSync",
+      "lstatSync",
+      "closeSync",
+    ]) {
+      if (typeof runtime.fs?.[method] !== "function") {
+        throw new Error(`descriptor_scrubber_${method}_unavailable`);
+      }
+    }
+    if (
+      linuxRealpath(runtime, LINUX_BWRAP_DESCRIPTOR_SCRUBBER_PATH) !==
+      LINUX_BWRAP_DESCRIPTOR_SCRUBBER_PATH
+    ) {
+      throw new Error("descriptor_scrubber_realpath_changed");
+    }
+    const pathBefore = runtime.fs.lstatSync(
+      LINUX_BWRAP_DESCRIPTOR_SCRUBBER_PATH,
+      { bigint: true },
+    );
     if (
-      !Number.isInteger(supervisorPin?.fd) ||
-      !supervisorPin.openedStat ||
-      !supervisorPin.attestation
+      pathBefore.isSymbolicLink?.() === true ||
+      !linuxBubblewrapSupervisorStatValid(pathBefore)
     ) {
-      throw new Error("supervisor_pin_missing");
+      throw new Error("descriptor_scrubber_path_unattested");
     }
     const constants = runtime.fs.constants || fs.constants;
     const flags =
-      Number(constants.O_RDONLY) | Number(constants.O_NONBLOCK || 0);
-    fd = runtime.fs.openSync(`/proc/self/fd/${supervisorPin.fd}`, flags);
+      Number(constants.O_RDONLY) |
+      Number(constants.O_NOFOLLOW || 0) |
+      Number(constants.O_NONBLOCK || 0);
+    fd = runtime.fs.openSync(LINUX_BWRAP_DESCRIPTOR_SCRUBBER_PATH, flags);
     const openedBefore = runtime.fs.fstatSync(fd, { bigint: true });
+    const currentPath = runtime.fs.statSync(
+      LINUX_BWRAP_DESCRIPTOR_SCRUBBER_PATH,
+      { bigint: true },
+    );
     if (
-      !linuxBubblewrapPinnedStatMatches(supervisorPin.openedStat, openedBefore)
+      !linuxBubblewrapSupervisorStatValid(openedBefore) ||
+      !linuxOpenStatMatches(pathBefore, openedBefore) ||
+      !linuxOpenStatMatches(openedBefore, currentPath)
     ) {
-      throw new Error("supervisor_launch_reader_identity_changed");
+      throw new Error("descriptor_scrubber_identity_changed");
     }
-    const sha256 = hashLinuxOpenFile(
-      runtime,
-      fd,
-      supervisorPin.attestation.bytes,
-    );
+    const sha256 = hashLinuxOpenFile(runtime, fd, Number(openedBefore.size));
     const openedAfter = runtime.fs.fstatSync(fd, { bigint: true });
+    const pathAfter = runtime.fs.statSync(
+      LINUX_BWRAP_DESCRIPTOR_SCRUBBER_PATH,
+      { bigint: true },
+    );
     if (
       !linuxOpenStatMatches(openedBefore, openedAfter) ||
-      sha256 !== supervisorPin.attestation.sha256
+      !linuxOpenStatMatches(openedAfter, pathAfter)
     ) {
-      throw new Error("supervisor_launch_reader_identity_changed");
+      throw new Error("descriptor_scrubber_identity_changed");
     }
     return {
       fd,
-      command: `/proc/self/fd/${LINUX_BWRAP_SUPERVISOR_CHILD_FD}`,
+      openedStat: openedAfter,
+      attestation: Object.freeze({
+        path: LINUX_BWRAP_DESCRIPTOR_SCRUBBER_PATH,
+        fileId: Object.freeze({
+          dev: String(openedAfter.dev),
+          ino: String(openedAfter.ino),
+        }),
+        sha256,
+        bytes: Number(openedAfter.size),
+        mtimeMs: Number(openedAfter.mtimeMs),
+        mode: Number(openedAfter.mode),
+        uid: Number(openedAfter.uid),
+        gid: Number(openedAfter.gid),
+      }),
     };
+  } catch (error) {
+    if (fd !== undefined) {
+      try {
+        runtime.fs.closeSync(fd);
+      } catch {
+        // Preserve the original attestation error.
+      }
+    }
+    throw error;
+  }
+}
+
+function openLinuxBubblewrapPinnedExecutableReader(runtime, pin, label) {
+  let fd;
+  try {
+    if (!Number.isInteger(pin?.fd) || !pin.openedStat || !pin.attestation) {
+      throw new Error(`${label}_pin_missing`);
+    }
+    const constants = runtime.fs.constants || fs.constants;
+    const flags =
+      Number(constants.O_RDONLY) | Number(constants.O_NONBLOCK || 0);
+    fd = runtime.fs.openSync(`/proc/self/fd/${pin.fd}`, flags);
+    const openedBefore = runtime.fs.fstatSync(fd, { bigint: true });
+    if (!linuxBubblewrapPinnedStatMatches(pin.openedStat, openedBefore)) {
+      throw new Error(`${label}_launch_reader_identity_changed`);
+    }
+    const sha256 = hashLinuxOpenFile(runtime, fd, pin.attestation.bytes);
+    const openedAfter = runtime.fs.fstatSync(fd, { bigint: true });
+    if (
+      !linuxOpenStatMatches(openedBefore, openedAfter) ||
+      sha256 !== pin.attestation.sha256
+    ) {
+      throw new Error(`${label}_launch_reader_identity_changed`);
+    }
+    return fd;
   } catch (error) {
     if (fd !== undefined) {
       try {
@@ -6384,17 +7731,46 @@ function openLinuxBubblewrapSupervisorLaunch(runtime, supervisorPin) {
   }
 }
 
-function attestLinuxBubblewrapSupervisorPin(runtime, supervisorPin) {
+function openLinuxBubblewrapSupervisorLaunch(
+  runtime,
+  supervisorPin,
+  descriptorScrubberPin,
+) {
+  let fd;
+  let scrubberFd;
+  try {
+    fd = openLinuxBubblewrapPinnedExecutableReader(
+      runtime,
+      supervisorPin,
+      "supervisor",
+    );
+    scrubberFd = openLinuxBubblewrapPinnedExecutableReader(
+      runtime,
+      descriptorScrubberPin,
+      "descriptor_scrubber",
+    );
+    return { fd, scrubberFd };
+  } catch (error) {
+    closeLinuxPinnedMounts(runtime, [{ fd }, { fd: scrubberFd }]);
+    throw error;
+  }
+}
+
+function attestLinuxBubblewrapSupervisorPin(
+  runtime,
+  supervisorPin,
+  label = "supervisor",
+) {
   if (
     !Number.isInteger(supervisorPin?.fd) ||
     !supervisorPin.openedStat ||
     !supervisorPin.attestation
   ) {
-    throw new Error("supervisor_pin_missing");
+    throw new Error(`${label}_pin_missing`);
   }
   const before = runtime.fs.fstatSync(supervisorPin.fd, { bigint: true });
   if (!linuxBubblewrapPinnedStatMatches(supervisorPin.openedStat, before)) {
-    throw new Error("supervisor_identity_changed");
+    throw new Error(`${label}_identity_changed`);
   }
   const sha256 = hashLinuxOpenFile(
     runtime,
@@ -6406,17 +7782,72 @@ function attestLinuxBubblewrapSupervisorPin(runtime, supervisorPin) {
     !linuxOpenStatMatches(before, after) ||
     sha256 !== supervisorPin.attestation.sha256
   ) {
-    throw new Error("supervisor_identity_changed");
+    throw new Error(`${label}_identity_changed`);
+  }
+}
+
+function linuxBubblewrapScrubbedInvocation(
+  supervisorLaunch,
+  executableArgs,
+  stdio,
+) {
+  const scrubberChildFd = stdio.length - 1;
+  let explicitLayout = true;
+  const parentFds = new Set();
+  for (
+    let index = LINUX_BWRAP_SUPERVISOR_CHILD_FD;
+    index <= scrubberChildFd;
+    index += 1
+  ) {
+    const parentFd = stdio[index];
+    if (
+      !Object.hasOwn(stdio, index) ||
+      !Number.isSafeInteger(parentFd) ||
+      parentFd < 0 ||
+      parentFds.has(parentFd)
+    ) {
+      explicitLayout = false;
+      break;
+    }
+    parentFds.add(parentFd);
+  }
+  if (
+    !Number.isInteger(supervisorLaunch?.fd) ||
+    !Number.isInteger(supervisorLaunch?.scrubberFd) ||
+    stdio.length < 5 ||
+    stdio[LINUX_BWRAP_SUPERVISOR_CHILD_FD] !== supervisorLaunch.fd ||
+    stdio[scrubberChildFd] !== supervisorLaunch.scrubberFd ||
+    !explicitLayout
+  ) {
+    throw new Error("descriptor_scrubber_launch_layout_invalid");
   }
+  return buildLinuxBwrapDescriptorScrubbedLaunch({
+    scrubberChildFd,
+    preservedMaxFd: scrubberChildFd - 1,
+    executableChildFd: LINUX_BWRAP_SUPERVISOR_CHILD_FD,
+    executableArgs,
+  });
 }
 
 function attestLinuxBubblewrapCapabilities(runtime, supervisorLaunch) {
   let result;
   try {
-    result = runtime.spawnSync(supervisorLaunch.command, ["--help"], {
+    const stdio = [
+      "ignore",
+      "pipe",
+      "pipe",
+      supervisorLaunch.fd,
+      supervisorLaunch.scrubberFd,
+    ];
+    const invocation = linuxBubblewrapScrubbedInvocation(
+      supervisorLaunch,
+      ["--help"],
+      stdio,
+    );
+    result = runtime.spawnSync(invocation.command, invocation.args, {
       shell: false,
       encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe", supervisorLaunch.fd],
+      stdio,
       timeout: 10_000,
       env: {
         PATH: "/usr/bin:/bin",
@@ -6452,18 +7883,65 @@ function attestLinuxBubblewrapCapabilities(runtime, supervisorLaunch) {
   return { ok: true, reason: null };
 }
 
-function parseLinuxLddPaths(output) {
-  const paths = new Set();
-  for (const line of String(output || "").split(/\r?\n/)) {
+function parseLinuxLddResolution(output) {
+  const byDestination = new Map();
+  const byLoaderName = new Map();
+  const byBasename = new Map();
+  for (const rawLine of String(output || "").split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line) continue;
     if (line.includes("=> not found")) {
       throw new Error("runtime_dependency_missing");
     }
-    const resolved = line.match(/=>\s+(\/[^\s(]+)\s+\(/)?.[1];
-    const loader = line.match(/^\s*(\/[^\s(]+)\s+\(/)?.[1];
-    if (resolved) paths.add(resolved);
-    if (loader) paths.add(loader);
+    if (/^linux-vdso(?:\.so(?:\.\d+)?)?\s+\(/.test(line)) continue;
+    const resolved = line.match(
+      /^([A-Za-z0-9][A-Za-z0-9._+-]{0,254})\s+=>\s+(\/[^\s(]+)\s+\(/,
+    );
+    const direct = line.match(/^(\/[^\s(]+)\s+\(/);
+    if (!resolved && !direct) {
+      throw new Error("runtime_dependency_resolution_output_invalid");
+    }
+    const loaderName = resolved?.[1] || path.posix.basename(direct[1]);
+    const destination = resolved?.[2] || direct[1];
+    if (path.posix.normalize(destination) !== destination) {
+      throw new Error("runtime_dependency_outside_system_library_roots");
+    }
+    if (
+      !/^[A-Za-z0-9][A-Za-z0-9._+-]{0,254}$/.test(loaderName) ||
+      path.posix.basename(destination) !== loaderName
+    ) {
+      throw new Error("runtime_dependency_resolution_alias_unsupported");
+    }
+    const priorLoaderDestination = byLoaderName.get(loaderName);
+    if (
+      priorLoaderDestination !== undefined &&
+      priorLoaderDestination !== destination
+    ) {
+      throw new Error("runtime_dependency_resolution_ambiguous");
+    }
+    const basename = path.posix.basename(destination);
+    const priorBasenameDestination = byBasename.get(basename);
+    if (
+      priorBasenameDestination !== undefined &&
+      priorBasenameDestination !== destination
+    ) {
+      throw new Error("runtime_dependency_resolution_ambiguous");
+    }
+    byLoaderName.set(loaderName, destination);
+    byBasename.set(basename, destination);
+    const existing = byDestination.get(destination) || new Set();
+    existing.add(loaderName);
+    byDestination.set(destination, existing);
+  }
+  if (byDestination.size === 0) {
+    throw new Error("runtime_dependency_resolution_empty");
   }
-  return [...paths];
+  return [...byDestination.entries()]
+    .map(([destination, loaderNames]) => ({
+      destination,
+      loaderNames: [...loaderNames].sort(),
+    }))
+    .sort((left, right) => left.destination.localeCompare(right.destination));
 }
 
 function collectLinuxNodeRuntimeMounts(runtime, runtimeIdentity) {
@@ -6509,12 +7987,15 @@ function collectLinuxNodeRuntimeMounts(runtime, runtimeIdentity) {
     {
       source: runtimeIdentity.realPath,
       destination: "/opt/chainless/runtime/node",
+      loaderNames: [],
     },
   ];
-  for (const destination of parseLinuxLddPaths(result.stdout)) {
+  for (const { destination, loaderNames } of parseLinuxLddResolution(
+    result.stdout,
+  )) {
     if (
       path.posix.normalize(destination) !== destination ||
-      !["/lib/", "/lib64/", "/usr/lib/"].some((prefix) =>
+      !["/lib/", "/lib64/", "/usr/lib/", "/usr/lib64/"].some((prefix) =>
         destination.startsWith(prefix),
       )
     ) {
@@ -6524,14 +8005,18 @@ function collectLinuxNodeRuntimeMounts(runtime, runtimeIdentity) {
     if (!source) {
       throw new Error("runtime_dependency_unattested");
     }
-    mounts.push({ source, destination });
+    mounts.push({ source, destination, loaderNames });
   }
   if (runtime.fs.existsSync("/etc/ld.so.cache")) {
     const source = attestLinuxRootOwnedFile(runtime, "/etc/ld.so.cache");
     if (!source) {
       throw new Error("loader_cache_unattested");
     }
-    mounts.push({ source, destination: "/etc/ld.so.cache" });
+    mounts.push({
+      source,
+      destination: "/etc/ld.so.cache",
+      loaderNames: [],
+    });
   }
   const byDestination = new Map();
   for (const mount of mounts) {
@@ -6539,7 +8024,16 @@ function collectLinuxNodeRuntimeMounts(runtime, runtimeIdentity) {
     if (existing && existing.source !== mount.source) {
       throw new Error("runtime_mount_collision");
     }
-    byDestination.set(mount.destination, mount);
+    if (existing) {
+      existing.loaderNames = [
+        ...new Set([
+          ...(existing.loaderNames || []),
+          ...(mount.loaderNames || []),
+        ]),
+      ].sort();
+    } else {
+      byDestination.set(mount.destination, mount);
+    }
   }
   return [...byDestination.values()].sort((left, right) =>
     left.destination.localeCompare(right.destination),
@@ -6559,9 +8053,15 @@ function pinLinuxRuntimeMounts(runtime, runtimeMounts, runtimeIdentity) {
               mtimeMs: runtimeIdentity.mtimeMs,
             }
           : runtime.fs.statSync(mount.source);
-      mounts.push(
-        pinLinuxRegularFile(runtime, mount.source, mount.destination, expected),
-      );
+      mounts.push({
+        ...pinLinuxRegularFile(
+          runtime,
+          mount.source,
+          mount.destination,
+          expected,
+        ),
+        loaderNames: Object.freeze([...(mount.loaderNames || [])]),
+      });
     }
     return mounts;
   } catch (error) {
@@ -6570,15 +8070,22 @@ function pinLinuxRuntimeMounts(runtime, runtimeMounts, runtimeIdentity) {
   }
 }
 
-// Bind only the kernel-selected interpreter and the entry ELF's direct
-// DT_NEEDED names. This deliberately does not claim transitive or dlopen-time
-// closure; handleAtomic remains false for the wider launch chain.
-function bindLinuxNativeDynamicRuntime(entryFormat, pinnedRuntimeMounts) {
+// Bind the kernel-selected interpreter and recursively parse every DT_NEEDED
+// edge reachable from the entry through the exact root-owned descriptors that
+// will be mounted into the sandbox. This proves only the loader's initial ELF
+// graph. It deliberately does not claim runtime dlopen closure; writable
+// scratch mounts and executable-created code remain outside this evidence.
+function bindLinuxNativeDynamicRuntime(
+  runtime,
+  entryFormat,
+  pinnedRuntimeMounts,
+) {
   if (entryFormat?.runtime !== "native-dynamic-elf") return null;
   if (
     !linuxSystemDynamicPath(entryFormat.interpreter) ||
     !Array.isArray(entryFormat.needed) ||
-    entryFormat.needed.length > LINUX_ELF_MAX_NEEDED_ENTRIES
+    entryFormat.needed.length > LINUX_ELF_MAX_NEEDED_ENTRIES ||
+    entryFormat.soname !== null
   ) {
     throw new Error("native_dynamic_metadata_invalid");
   }
@@ -6590,64 +8097,290 @@ function bindLinuxNativeDynamicRuntime(entryFormat, pinnedRuntimeMounts) {
       typeof mount?.fileId?.ino === "string" &&
       Number.isSafeInteger(mount?.bytes) &&
       mount.bytes > 0 &&
-      Number.isFinite(mount?.mtimeMs),
+      Number.isFinite(mount?.mtimeMs) &&
+      Array.isArray(mount?.loaderNames) &&
+      mount.loaderNames.every(
+        (name) =>
+          typeof name === "string" &&
+          /^[A-Za-z0-9][A-Za-z0-9._+-]{0,254}$/.test(name),
+      ),
   );
+  const resolveDependency = (dependency, { direct = false } = {}) => {
+    if (
+      typeof dependency !== "string" ||
+      !/^[A-Za-z0-9][A-Za-z0-9._+-]{0,254}$/.test(dependency) ||
+      path.posix.basename(dependency) !== dependency
+    ) {
+      throw new Error("native_dynamic_dependency_name_invalid");
+    }
+    const matches = systemMounts.filter(
+      (mount) =>
+        path.posix.basename(mount.destination) === dependency &&
+        mount.loaderNames.includes(dependency),
+    );
+    if (matches.length === 0) {
+      throw new Error(
+        direct
+          ? "native_dynamic_dependency_outside_direct_system_set"
+          : "native_dynamic_recursive_dependency_outside_system_graph",
+      );
+    }
+    if (matches.length !== 1) {
+      throw new Error(
+        direct
+          ? "native_dynamic_dependency_runtime_ambiguous"
+          : "native_dynamic_recursive_dependency_runtime_ambiguous",
+      );
+    }
+    return matches[0];
+  };
   const interpreterMount = systemMounts.find(
     (mount) => mount.destination === entryFormat.interpreter,
   );
   if (!interpreterMount) {
     throw new Error("native_dynamic_interpreter_outside_direct_system_set");
   }
-  const selected = new Map([[interpreterMount.destination, interpreterMount]]);
+  const selected = new Map();
+  const pending = [];
+  let selectedBytes = 0;
+  const select = (mount) => {
+    if (selected.has(mount.destination)) return;
+    if (selected.size >= LINUX_ELF_MAX_INITIAL_CLOSURE_FILES) {
+      throw new Error("native_dynamic_recursive_file_count_exceeded");
+    }
+    if (
+      !Number.isSafeInteger(mount.bytes) ||
+      mount.bytes <= 0 ||
+      selectedBytes > LINUX_ELF_MAX_INITIAL_CLOSURE_BYTES - mount.bytes
+    ) {
+      throw new Error("native_dynamic_recursive_bytes_exceeded");
+    }
+    selectedBytes += mount.bytes;
+    selected.set(mount.destination, mount);
+    pending.push(mount);
+  };
+  select(interpreterMount);
+  const edges = [];
   for (const dependency of entryFormat.needed) {
+    const target = resolveDependency(dependency, { direct: true });
+    edges.push({ from: "$entry", name: dependency, to: target.destination });
+    select(target);
+  }
+  const parsed = new Map();
+  for (let index = 0; index < pending.length; index += 1) {
+    const mount = pending[index];
+    const metadata = inspectLinuxNativeElf(runtime, mount.fd, mount, {
+      role: "dependency",
+    });
+    if (
+      metadata.soname !== null &&
+      (metadata.soname !== path.posix.basename(mount.destination) ||
+        !mount.loaderNames.includes(metadata.soname))
+    ) {
+      throw new Error("native_dependency_soname_alias_unsupported");
+    }
+    parsed.set(mount.destination, metadata);
+    for (const dependency of metadata.needed || []) {
+      if (edges.length >= LINUX_ELF_MAX_INITIAL_CLOSURE_EDGES) {
+        throw new Error("native_dynamic_recursive_edge_count_exceeded");
+      }
+      const target = resolveDependency(dependency);
+      edges.push({
+        from: mount.destination,
+        name: dependency,
+        to: target.destination,
+      });
+      select(target);
+    }
+  }
+  const members = [...selected.values()]
+    .map((mount) => {
+      const metadata = parsed.get(mount.destination);
+      if (!metadata) {
+        throw new Error("native_dynamic_recursive_member_unparsed");
+      }
+      return {
+        destination: mount.destination,
+        fileId: {
+          dev: mount.fileId.dev,
+          ino: mount.fileId.ino,
+        },
+        bytes: mount.bytes,
+        mtimeMs: mount.mtimeMs,
+        sha256: metadata.sha256,
+        loaderNames: [...mount.loaderNames],
+        needed: [...(metadata.needed || [])].sort(),
+        soname: metadata.soname,
+      };
+    })
+    .sort((left, right) => left.destination.localeCompare(right.destination));
+  const orderedEdges = edges.sort((left, right) =>
+    `${left.from}\0${left.name}\0${left.to}`.localeCompare(
+      `${right.from}\0${right.name}\0${right.to}`,
+    ),
+  );
+  const digest = crypto
+    .createHash("sha256")
+    .update(
+      JSON.stringify({
+        version: 1,
+        scope: LINUX_NATIVE_DYNAMIC_RECURSIVE_SYSTEM_GRAPH_SCOPE,
+        mechanism: LINUX_NATIVE_DYNAMIC_RECURSIVE_SYSTEM_GRAPH_MECHANISM,
+        interpreter: entryFormat.interpreter,
+        directNeeded: [...entryFormat.needed].sort(),
+        members,
+        edges: orderedEdges,
+      }),
+    )
+    .digest("hex");
+  return Object.freeze({
+    scope: LINUX_NATIVE_DYNAMIC_RECURSIVE_SYSTEM_GRAPH_SCOPE,
+    mechanism: LINUX_NATIVE_DYNAMIC_RECURSIVE_SYSTEM_GRAPH_MECHANISM,
+    interpreter: entryFormat.interpreter,
+    dependencies: orderedEdges.length,
+    files: members.length,
+    bytes: selectedBytes,
+    digest,
+  });
+}
+
+/**
+ * Hash every regular file that will remain pathname-visible to a dynamic
+ * native target. The final namespace is built only from these descriptor
+ * mounts and a read-only synthetic root, so this set is the complete input to
+ * the kernel ELF loader and libc dlopen pathname resolution. Anonymous
+ * executable memory and a malicious program's own ELF loader are intentionally
+ * outside this narrower, enforceable claim.
+ */
+function buildLinuxRuntimePathnameLoadSet(
+  runtime,
+  pinnedMounts,
+  pluginTreeSnapshot,
+  nativeDynamicClosure,
+) {
+  if (
+    nativeDynamicClosure?.scope !==
+      LINUX_NATIVE_DYNAMIC_RECURSIVE_SYSTEM_GRAPH_SCOPE ||
+    nativeDynamicClosure?.mechanism !==
+      LINUX_NATIVE_DYNAMIC_RECURSIVE_SYSTEM_GRAPH_MECHANISM ||
+    pluginTreeSnapshot?.scope !== LINUX_PLUGIN_TREE_SNAPSHOT_SCOPE ||
+    !Array.isArray(pinnedMounts) ||
+    pinnedMounts.length < 1 ||
+    pinnedMounts.length > LINUX_NATIVE_RUNTIME_PATHNAME_CLOSURE_MAX_FILES
+  ) {
+    throw new Error("native_runtime_pathname_load_set_invalid");
+  }
+  const destinations = new Set();
+  let totalBytes = 0;
+  const members = pinnedMounts.map((mount) => {
+    const destination = mount?.destination;
+    const pluginFile =
+      typeof destination === "string" &&
+      linuxPathWithin("/opt/chainless/plugin", destination);
+    const runtimeFile = destination === "/opt/chainless/runtime/node";
+    const systemLibrary = linuxSystemDynamicPath(destination);
+    const loaderCache = destination === "/etc/ld.so.cache";
     if (
-      typeof dependency !== "string" ||
-      !/^[A-Za-z0-9][A-Za-z0-9._+-]{0,254}$/.test(dependency)
+      typeof destination !== "string" ||
+      !path.posix.isAbsolute(destination) ||
+      path.posix.normalize(destination) !== destination ||
+      destinations.has(destination) ||
+      (!pluginFile && !runtimeFile && !systemLibrary && !loaderCache) ||
+      !Number.isInteger(mount?.fd)
     ) {
-      throw new Error("native_dynamic_dependency_name_invalid");
+      throw new Error("native_runtime_pathname_load_set_member_invalid");
     }
-    const matches = systemMounts.filter(
-      (mount) => path.posix.basename(mount.destination) === dependency,
-    );
-    if (matches.length === 0) {
-      throw new Error("native_dynamic_dependency_outside_direct_system_set");
+    destinations.add(destination);
+    const before = runtime.fs.fstatSync(mount.fd);
+    const bytes = Number(before.size);
+    if (
+      !before.isFile() ||
+      !Number.isSafeInteger(bytes) ||
+      bytes < 0 ||
+      bytes > LINUX_ATTESTED_FILE_MAX_BYTES ||
+      String(before.dev) !== String(mount.fileId?.dev) ||
+      String(before.ino) !== String(mount.fileId?.ino) ||
+      bytes !== Number(mount.bytes) ||
+      Number(before.mtimeMs) !== Number(mount.mtimeMs) ||
+      totalBytes > LINUX_NATIVE_RUNTIME_PATHNAME_CLOSURE_MAX_BYTES - bytes
+    ) {
+      throw new Error("native_runtime_pathname_load_set_member_changed");
     }
-    if (matches.length !== 1) {
-      throw new Error("native_dynamic_dependency_runtime_ambiguous");
+    const sha256 = hashLinuxOpenFile(runtime, mount.fd, bytes);
+    const after = runtime.fs.fstatSync(mount.fd);
+    if (
+      !linuxOpenStatMatches(before, after) ||
+      ((pluginFile || runtimeFile) &&
+        (mount.contentSnapshot?.mechanism !== LINUX_ENTRY_SNAPSHOT_MECHANISM ||
+          mount.contentSnapshot?.sha256 !== sha256 ||
+          (runtimeFile &&
+            mount.contentSnapshot?.scope !==
+              LINUX_PLUGIN_RUNTIME_SNAPSHOT_SCOPE)))
+    ) {
+      throw new Error("native_runtime_pathname_load_set_member_changed");
     }
-    selected.set(matches[0].destination, matches[0]);
-  }
-  const members = [...selected.values()]
-    .map((mount) => ({
-      destination: mount.destination,
+    totalBytes += bytes;
+    return {
+      destination,
+      sourceKind: pluginFile
+        ? "plugin-content-snapshot"
+        : runtimeFile
+          ? "broker-node-runtime"
+          : systemLibrary
+            ? "root-owned-system-library"
+            : "root-owned-loader-cache",
       fileId: {
-        dev: mount.fileId.dev,
-        ino: mount.fileId.ino,
+        dev: String(after.dev),
+        ino: String(after.ino),
       },
-      bytes: mount.bytes,
-      mtimeMs: mount.mtimeMs,
-    }))
-    .sort((left, right) => left.destination.localeCompare(right.destination));
+      sha256,
+      bytes,
+      mtimeMs: Number(after.mtimeMs),
+      mountMode:
+        mount.mountMode === "ro-bind-data" ? "ro-bind-data" : "ro-bind-fd",
+    };
+  });
+  members.sort((left, right) =>
+    left.destination.localeCompare(right.destination),
+  );
+  const loaderCacheVisible = members.some(
+    ({ sourceKind }) => sourceKind === "root-owned-loader-cache",
+  );
+  if (
+    totalBytes < 1 ||
+    !members.some(
+      ({ sourceKind }) => sourceKind === "plugin-content-snapshot",
+    ) ||
+    !members.some(({ sourceKind }) => sourceKind === "broker-node-runtime") ||
+    loaderCacheVisible !== runtime.fs.existsSync("/etc/ld.so.cache")
+  ) {
+    throw new Error("native_runtime_pathname_load_set_incomplete");
+  }
   const digest = crypto
     .createHash("sha256")
     .update(
       JSON.stringify({
         version: 1,
-        scope: LINUX_NATIVE_DYNAMIC_DIRECT_SYSTEM_SET_SCOPE,
-        mechanism: LINUX_NATIVE_DYNAMIC_DIRECT_SYSTEM_SET_MECHANISM,
-        interpreter: entryFormat.interpreter,
-        needed: [...entryFormat.needed].sort(),
+        scope: LINUX_NATIVE_RUNTIME_PATHNAME_CLOSURE_SCOPE,
+        mechanism: LINUX_NATIVE_RUNTIME_PATHNAME_CLOSURE_MECHANISM,
+        initialDynamicLoadClosureDigest: nativeDynamicClosure.digest,
+        pluginTreeContentSnapshotDigest: pluginTreeSnapshot.digest,
         members,
       }),
     )
     .digest("hex");
   return Object.freeze({
-    scope: LINUX_NATIVE_DYNAMIC_DIRECT_SYSTEM_SET_SCOPE,
-    mechanism: LINUX_NATIVE_DYNAMIC_DIRECT_SYSTEM_SET_MECHANISM,
-    interpreter: entryFormat.interpreter,
-    dependencies: entryFormat.needed.length,
+    scope: LINUX_NATIVE_RUNTIME_PATHNAME_CLOSURE_SCOPE,
+    mechanism: LINUX_NATIVE_RUNTIME_PATHNAME_CLOSURE_MECHANISM,
     files: members.length,
+    bytes: totalBytes,
     digest,
+    policyBound: true,
+    writableFilesystems: false,
+    procfsMounted: false,
+    devfsMounted: false,
+    scratchWritable: false,
+    descriptorReopenPaths: false,
   });
 }
 
@@ -6669,6 +8402,7 @@ function buildLinuxBubblewrapPolicyArgs(
   pinnedMounts,
   environment,
   seccompFilter,
+  { runtimePathnameClosure = false } = {},
 ) {
   const directories = new Set([
     "/opt",
@@ -6720,9 +8454,9 @@ function buildLinuxBubblewrapPolicyArgs(
   }
   // FD 3 is also the descriptor-backed executable used to start bubblewrap.
   // Consume and close it during setup, then obscure this staging copy with the
-  // later /run tmpfs. The target can still observe bubblewrap itself as the
-  // PID-namespace supervisor through procfs; this only contains the inherited
-  // launch descriptor and its temporary setup path.
+  // later /run tmpfs. The ordinary profile can still observe bubblewrap itself
+  // as the PID-namespace supervisor through procfs. The dynamic-native runtime
+  // closure profile does not mount procfs at all.
   args.push(
     "--perms",
     "0000",
@@ -6743,40 +8477,56 @@ function buildLinuxBubblewrapPolicyArgs(
       args.push("--ro-bind-fd", String(mount.childFd), mount.destination);
     }
   }
-  args.push(
-    "--seccomp",
-    String(seccompFilter.childFd),
-    "--remount-ro",
-    "/",
-    "--perms",
-    "1777",
-    "--size",
-    String(64 * 1024 * 1024),
-    "--tmpfs",
-    "/tmp",
-    "--perms",
-    "0755",
-    "--size",
-    String(16 * 1024 * 1024),
-    "--tmpfs",
-    "/run",
-    "--perms",
-    "1777",
-    "--size",
-    String(32 * 1024 * 1024),
-    "--tmpfs",
-    "/var/tmp",
-    "--perms",
-    "0700",
-    "--size",
-    String(16 * 1024 * 1024),
-    "--tmpfs",
-    "/home/sandbox",
-    "--proc",
-    "/proc",
-    "--dev",
-    "/dev",
-  );
+  args.push("--seccomp", String(seccompFilter.childFd), "--remount-ro", "/");
+  if (runtimePathnameClosure) {
+    // bubblewrap creates its root tmpfs with MS_NOSUID|MS_NODEV, not NOEXEC.
+    // Keeping any writable tmpfs would therefore let an untrusted native write
+    // a new .so and dlopen it. Only an empty /run overlay is retained to hide
+    // the consumed supervisor staging copy, and it is remounted read-only
+    // before the target starts. /tmp, /var/tmp, HOME, procfs, and devfs remain
+    // empty directories on the read-only synthetic root.
+    args.push(
+      "--perms",
+      "0755",
+      "--size",
+      String(16 * 1024 * 1024),
+      "--tmpfs",
+      "/run",
+      "--remount-ro",
+      "/run",
+    );
+  } else {
+    args.push(
+      "--perms",
+      "1777",
+      "--size",
+      String(64 * 1024 * 1024),
+      "--tmpfs",
+      "/tmp",
+      "--perms",
+      "0755",
+      "--size",
+      String(16 * 1024 * 1024),
+      "--tmpfs",
+      "/run",
+      "--perms",
+      "1777",
+      "--size",
+      String(32 * 1024 * 1024),
+      "--tmpfs",
+      "/var/tmp",
+      "--perms",
+      "0700",
+      "--size",
+      String(16 * 1024 * 1024),
+      "--tmpfs",
+      "/home/sandbox",
+      "--proc",
+      "/proc",
+      "--dev",
+      "/dev",
+    );
+  }
   for (const key of Object.keys(environment).sort()) {
     args.push("--setenv", key, environment[key]);
   }
@@ -6886,25 +8636,28 @@ function probeLinuxBubblewrapPolicy(
     // These pipes connect the host Broker to bwrap and are created before
     // bwrap installs the target seccomp filter. The nested runtime probe above
     // inherits a regular-file descriptor and never requests UV_CREATE_PIPE.
-    result = runtime.spawnSync(
-      supervisorLaunch.command,
+    const stdio = linuxStdioWithPinnedMounts(null, pinnedDescriptors, {
+      probe: true,
+      supervisorFd: supervisorLaunch.fd,
+      scrubberFd: supervisorLaunch.scrubberFd,
+    });
+    const invocation = linuxBubblewrapScrubbedInvocation(
+      supervisorLaunch,
       [...policyArgs, "--", "/opt/chainless/runtime/node", "-e", probeSource],
-      {
-        cwd: "/",
-        shell: false,
-        encoding: "utf8",
-        stdio: linuxStdioWithPinnedMounts(null, pinnedDescriptors, {
-          probe: true,
-          supervisorFd: supervisorLaunch.fd,
-        }),
-        timeout: 15_000,
-        env: {
-          PATH: "/usr/bin:/bin",
-          LANG: "C",
-          LC_ALL: "C",
-        },
-      },
+      stdio,
     );
+    result = runtime.spawnSync(invocation.command, invocation.args, {
+      cwd: "/",
+      shell: false,
+      encoding: "utf8",
+      stdio,
+      timeout: 15_000,
+      env: {
+        PATH: "/usr/bin:/bin",
+        LANG: "C",
+        LC_ALL: "C",
+      },
+    });
   } catch {
     return linuxBubblewrapProbe(
       true,
@@ -6948,7 +8701,99 @@ function probeLinuxBubblewrapPolicy(
     supervisorBinding,
     null,
     null,
+    null,
+    true,
+  );
+}
+
+function probeLinuxRuntimePathnameClosurePolicy(
+  runtime,
+  supervisorLaunch,
+  supervisorBinding,
+  policyArgs,
+  pinnedDescriptors,
+  targetRuntime,
+  contentSnapshot = null,
+) {
+  const probeSource = [
+    'const fs = require("node:fs");',
+    `const sentinel = ${JSON.stringify(
+      LINUX_BWRAP_NATIVE_RUNTIME_CLOSURE_PROBE_SENTINEL,
+    )};`,
+    "const writableCandidates = [",
+    '  "/unapproved-runtime.so", "/tmp/unapproved-runtime.so",',
+    '  "/run/unapproved-runtime.so", "/var/tmp/unapproved-runtime.so",',
+    '  "/home/sandbox/unapproved-runtime.so",',
+    '  "/opt/chainless/plugin/unapproved-runtime.so",',
+    "];",
+    "for (const candidate of writableCandidates) {",
+    "  try {",
+    '    fs.writeFileSync(candidate, "not-approved");',
+    "    process.exit(71);",
+    "  } catch {}",
+    "}",
+    "const absentPaths = [",
+    '  "/proc/self/exe", "/proc/1/exe", "/proc/self/fd/0",',
+    '  "/dev/null", "/dev/fd/0",',
+    `  ${JSON.stringify(LINUX_BWRAP_SUPERVISOR_HIDDEN_PATH)},`,
+    "];",
+    "for (const candidate of absentPaths) {",
+    "  try {",
+    "    fs.lstatSync(candidate);",
+    "    process.exit(72);",
+    "  } catch (error) {",
+    '    if (error?.code !== "ENOENT") process.exit(73);',
+    "  }",
+    "}",
+    'if (fs.readdirSync("/proc").length !== 0) process.exit(74);',
+    'if (fs.readdirSync("/dev").length !== 0) process.exit(75);',
+    "process.stdout.write(sentinel);",
+  ].join("\n");
+  let result;
+  try {
+    const stdio = linuxStdioWithPinnedMounts(null, pinnedDescriptors, {
+      probe: true,
+      supervisorFd: supervisorLaunch.fd,
+      scrubberFd: supervisorLaunch.scrubberFd,
+    });
+    const invocation = linuxBubblewrapScrubbedInvocation(
+      supervisorLaunch,
+      [...policyArgs, "--", "/opt/chainless/runtime/node", "-e", probeSource],
+      stdio,
+    );
+    result = runtime.spawnSync(invocation.command, invocation.args, {
+      cwd: "/",
+      shell: false,
+      encoding: "utf8",
+      stdio,
+      timeout: 15_000,
+      env: {
+        PATH: "/usr/bin:/bin",
+        LANG: "C",
+        LC_ALL: "C",
+      },
+    });
+  } catch {
+    return linuxBubblewrapProbe(
+      true,
+      false,
+      "runtime_pathname_closure_probe_spawn_failed",
+      targetRuntime,
+      contentSnapshot,
+      supervisorBinding,
+    );
+  }
+  const runnable =
+    !result?.error &&
+    result?.status === 0 &&
+    String(result.stdout) === LINUX_BWRAP_NATIVE_RUNTIME_CLOSURE_PROBE_SENTINEL;
+  return linuxBubblewrapProbe(
     true,
+    runnable,
+    runnable ? null : "runtime_pathname_closure_probe_failed",
+    targetRuntime,
+    contentSnapshot,
+    supervisorBinding,
   );
 }
 
@@ -6979,7 +8824,7 @@ export function applyLinuxSandbox(
     profile: sandboxOpts.profileName || "default",
     backend: "linux-prlimit",
     command,
-    args,
+    args: invocation.inputArgs,
     options: { ...(spawnOpts || {}) },
   };
   if (runtime.platform !== "linux") {
@@ -7106,6 +8951,7 @@ export function applyLinuxSandbox(
     let nativeDynamicClosure = null;
     try {
       nativeDynamicClosure = bindLinuxNativeDynamicRuntime(
+        runtime,
         validation.entryFormat,
         pinnedRuntimeMounts,
       );
@@ -7119,7 +8965,7 @@ export function applyLinuxSandbox(
         runtimeProbe: linuxBubblewrapProbe(
           false,
           false,
-          error.message || "native_dynamic_direct_system_set_unattested",
+          error.message || "native_dynamic_recursive_system_graph_unattested",
           validation.entryRuntime,
         ),
         reason: "linux_bwrap_native_runtime_unattested",
@@ -7199,6 +9045,7 @@ export function applyLinuxSandbox(
     }
 
     let entrySnapshot = null;
+    let runtimeFileSnapshot = null;
     let pluginTreeSnapshot = null;
     const pluginTreeFileSnapshots = [];
     let probePinnedMounts = pinnedMounts;
@@ -7278,6 +9125,24 @@ export function applyLinuxSandbox(
         finalMounts[index] = fileSnapshot.finalMount;
         probeMounts[index] = fileSnapshot.probeMount;
       }
+      let rawRuntimeMount = null;
+      if (validation.entryRuntime === "native-dynamic-elf") {
+        const runtimeIndex = pinnedMounts.findIndex(
+          (mount) => mount.destination === "/opt/chainless/runtime/node",
+        );
+        if (runtimeIndex < 0) {
+          throw new Error("native_runtime_snapshot_mount_missing");
+        }
+        rawRuntimeMount = pinnedMounts[runtimeIndex];
+        runtimeFileSnapshot = createLinuxRegularFileSnapshot(
+          runtime,
+          rawRuntimeMount,
+          validation.contract.runtimeIdentity,
+          linuxPluginRuntimeSnapshotContract(),
+        );
+        finalMounts[runtimeIndex] = runtimeFileSnapshot.finalMount;
+        probeMounts[runtimeIndex] = runtimeFileSnapshot.probeMount;
+      }
       pluginTreeSnapshot = buildLinuxPluginTreeSnapshotAttestation(
         finalMounts,
         sandboxEntry,
@@ -7286,12 +9151,14 @@ export function applyLinuxSandbox(
       pinnedMounts = finalMounts;
       probePinnedMounts = probeMounts;
       entryMount = entrySnapshot.finalMount;
-      closeLinuxPinnedMounts(runtime, rawPluginMounts);
+      closeLinuxPinnedMounts(runtime, [...rawPluginMounts, rawRuntimeMount]);
     } catch (error) {
       closeLinuxPinnedMounts(runtime, pinnedMounts);
       closeLinuxPinnedMounts(runtime, [
         entrySnapshot?.probeMount,
         entrySnapshot?.finalMount,
+        runtimeFileSnapshot?.probeMount,
+        runtimeFileSnapshot?.finalMount,
         ...pluginTreeFileSnapshots.flatMap((snapshot) => [
           snapshot.probeMount,
           snapshot.finalMount,
@@ -7313,14 +9180,53 @@ export function applyLinuxSandbox(
       });
     }
 
+    let runtimePathnameLoadSet = null;
+    if (validation.entryRuntime === "native-dynamic-elf") {
+      try {
+        runtimePathnameLoadSet = buildLinuxRuntimePathnameLoadSet(
+          runtime,
+          pinnedMounts,
+          pluginTreeSnapshot,
+          nativeDynamicClosure,
+        );
+      } catch (error) {
+        closeLinuxPinnedMounts(runtime, pinnedMounts);
+        closeLinuxPinnedMounts(runtime, [
+          entrySnapshot?.probeMount,
+          runtimeFileSnapshot?.probeMount,
+          ...pluginTreeFileSnapshots.map((snapshot) => snapshot.probeMount),
+        ]);
+        return createSandboxPlan({
+          ...base,
+          backend: null,
+          candidateBackend: LINUX_BWRAP_BACKEND,
+          policyAttested: false,
+          runtimeProbe: linuxBubblewrapProbe(
+            false,
+            false,
+            error.message || "native_runtime_pathname_load_set_unattested",
+            validation.entryRuntime,
+          ),
+          reason: "linux_bwrap_native_runtime_load_set_unattested",
+          guarantees: [],
+        });
+      }
+    }
+
     let probeSeccompFilter;
     let seccompFilter;
     const pluginTreeProbeMounts = pluginTreeFileSnapshots.map(
       (snapshot) => snapshot.probeMount,
     );
     try {
-      probeSeccompFilter = pinLinuxNetworkSeccompFilter(runtime);
-      seccompFilter = pinLinuxNetworkSeccompFilter(runtime);
+      const runtimePathnameClosure =
+        validation.entryRuntime === "native-dynamic-elf";
+      probeSeccompFilter = pinLinuxNetworkSeccompFilter(runtime, {
+        runtimePathnameClosure,
+      });
+      seccompFilter = pinLinuxNetworkSeccompFilter(runtime, {
+        runtimePathnameClosure,
+      });
       const seccompChildFd = LINUX_BWRAP_FIRST_MOUNT_FD + pinnedMounts.length;
       probeSeccompFilter.childFd = seccompChildFd;
       seccompFilter.childFd = seccompChildFd;
@@ -7333,6 +9239,7 @@ export function applyLinuxSandbox(
         runtime,
         [
           entrySnapshot?.probeMount,
+          runtimeFileSnapshot?.probeMount,
           ...pluginTreeProbeMounts,
           probeSeccompFilter,
           seccompFilter,
@@ -7355,12 +9262,15 @@ export function applyLinuxSandbox(
     }
     const pinnedDescriptors = [...pinnedMounts, seccompFilter];
     const probeDescriptors = [...probePinnedMounts, probeSeccompFilter];
+    let descriptorScrubberPin;
     const closeStrongLinuxResources = (...extra) => {
       closeLinuxPinnedMounts(runtime, [
         ...pinnedDescriptors,
         probeSeccompFilter,
         entrySnapshot?.probeMount,
+        runtimeFileSnapshot?.probeMount,
         ...pluginTreeProbeMounts,
+        descriptorScrubberPin,
         ...extra,
       ]);
     };
@@ -7370,9 +9280,11 @@ export function applyLinuxSandbox(
     let finalLaunch;
     try {
       supervisorPin = pinLinuxBubblewrapSupervisor(runtime);
+      descriptorScrubberPin = pinLinuxBubblewrapDescriptorScrubber(runtime);
       capabilityLaunch = openLinuxBubblewrapSupervisorLaunch(
         runtime,
         supervisorPin,
+        descriptorScrubberPin,
       );
     } catch (error) {
       closeStrongLinuxResources(supervisorPin);
@@ -7417,7 +9329,11 @@ export function applyLinuxSandbox(
       });
     }
     try {
-      probeLaunch = openLinuxBubblewrapSupervisorLaunch(runtime, supervisorPin);
+      probeLaunch = openLinuxBubblewrapSupervisorLaunch(
+        runtime,
+        supervisorPin,
+        descriptorScrubberPin,
+      );
     } catch (error) {
       closeStrongLinuxResources(supervisorPin, probeLaunch);
       return createSandboxPlan({
@@ -7438,15 +9354,56 @@ export function applyLinuxSandbox(
       });
     }
     const environment = linuxSandboxEnvironment();
+    const runtimePathnameClosure =
+      validation.entryRuntime === "native-dynamic-elf" &&
+      runtimePathnameLoadSet !== null;
     const policyArgs = buildLinuxBubblewrapPolicyArgs(
       pluginTree.directories,
       pinnedMounts,
       environment,
       seccompFilter,
+      { runtimePathnameClosure },
+    );
+    const probePolicyArgs = buildLinuxBubblewrapPolicyArgs(
+      pluginTree.directories,
+      probePinnedMounts,
+      environment,
+      probeSeccompFilter,
+      { runtimePathnameClosure },
     );
+    // The closure probe must exercise the exact ordered mount policy later
+    // used for the untrusted target. Only the backing parent descriptors,
+    // stdio, and command differ between the two launches; their child FD
+    // numbers and every bwrap policy option are identical.
+    if (
+      runtimePathnameClosure &&
+      JSON.stringify(probePolicyArgs) !== JSON.stringify(policyArgs)
+    ) {
+      closeStrongLinuxResources(supervisorPin, probeLaunch);
+      return createSandboxPlan({
+        ...base,
+        backend: null,
+        candidateBackend: LINUX_BWRAP_BACKEND,
+        policyAttested: false,
+        runtimeProbe: linuxBubblewrapProbe(
+          true,
+          false,
+          "runtime_pathname_closure_probe_policy_mismatch",
+          validation.entryRuntime,
+          null,
+          supervisorPin.attestation,
+        ),
+        reason: "linux_bwrap_policy_probe_failed",
+        guarantees: [],
+      });
+    }
     const targetArgs = validation.entryRuntime.startsWith("native-")
-      ? [sandboxEntry, ...args]
-      : ["/opt/chainless/runtime/node", sandboxEntry, ...args.slice(1)];
+      ? [sandboxEntry, ...validation.argsSnapshot]
+      : [
+          "/opt/chainless/runtime/node",
+          sandboxEntry,
+          ...validation.argsSnapshot.slice(1),
+        ];
     const snapshotPolicyBinding = entrySnapshot
       ? {
           scope: entrySnapshot.attestation.scope,
@@ -7462,13 +9419,23 @@ export function applyLinuxSandbox(
           targetMode: entrySnapshot.attestation.targetMode,
         }
       : null;
+    const descriptorScrubberPolicy = linuxBwrapDescriptorScrubberPolicyBinding(
+      descriptorScrubberPin.attestation,
+      {
+        scrubberChildFd: LINUX_BWRAP_FIRST_MOUNT_FD + pinnedDescriptors.length,
+        preservedMaxFd:
+          LINUX_BWRAP_FIRST_MOUNT_FD + pinnedDescriptors.length - 1,
+        executableChildFd: LINUX_BWRAP_SUPERVISOR_CHILD_FD,
+      },
+    );
     const policyDigest = crypto
       .createHash("sha256")
       .update(
         JSON.stringify({
-          version: 4,
+          version: 6,
           backend: LINUX_BWRAP_BACKEND,
           supervisor: supervisorPin.attestation,
+          descriptorScrubber: descriptorScrubberPolicy,
           contract: {
             kind: validation.contract.kind,
             pluginRoot: validation.contract.pluginRoot,
@@ -7510,6 +9477,9 @@ export function applyLinuxSandbox(
           ...(nativeDynamicClosure
             ? { initialDynamicLoadClosure: nativeDynamicClosure }
             : {}),
+          ...(runtimePathnameLoadSet
+            ? { runtimeSharedLibraryPathnameLoadSet: runtimePathnameLoadSet }
+            : {}),
           pluginTreeContentSnapshot: pluginTreeSnapshot,
           seccomp: {
             arch: seccompFilter.arch,
@@ -7524,19 +9494,30 @@ export function applyLinuxSandbox(
       )
       .digest("hex");
     const policyProbe = Object.freeze(
-      probeLinuxBubblewrapPolicy(
-        runtime,
-        probeLaunch,
-        supervisorPin.attestation,
-        policyArgs,
-        probeDescriptors,
-        validation.entryRuntime,
-      ),
+      runtimePathnameClosure
+        ? probeLinuxRuntimePathnameClosurePolicy(
+            runtime,
+            probeLaunch,
+            supervisorPin.attestation,
+            probePolicyArgs,
+            probeDescriptors,
+            validation.entryRuntime,
+            entrySnapshot?.attestation,
+          )
+        : probeLinuxBubblewrapPolicy(
+            runtime,
+            probeLaunch,
+            supervisorPin.attestation,
+            probePolicyArgs,
+            probeDescriptors,
+            validation.entryRuntime,
+          ),
     );
     closeLinuxPinnedMounts(runtime, [
       probeLaunch,
       probeSeccompFilter,
       entrySnapshot?.probeMount,
+      runtimeFileSnapshot?.probeMount,
       ...pluginTreeProbeMounts,
     ]);
     probeLaunch = null;
@@ -7562,7 +9543,13 @@ export function applyLinuxSandbox(
       sandboxOpts.sync,
       { sealedEntry: entrySnapshot !== null },
     );
-    if (!finalValidation.ok) {
+    const launchArgumentsChanged =
+      finalValidation.ok &&
+      (finalValidation.argsSnapshot.length !== validation.argsSnapshot.length ||
+        finalValidation.argsSnapshot.some(
+          (value, index) => value !== validation.argsSnapshot[index],
+        ));
+    if (!finalValidation.ok || launchArgumentsChanged) {
       closeStrongLinuxResources(supervisorPin, finalLaunch);
       return createSandboxPlan({
         ...base,
@@ -7573,7 +9560,11 @@ export function applyLinuxSandbox(
         runtimeProbe: linuxBubblewrapProbe(
           true,
           false,
-          `post_probe_${finalValidation.reason}`,
+          `post_probe_${
+            finalValidation.ok
+              ? "launch_arguments_changed"
+              : finalValidation.reason
+          }`,
           validation.entryRuntime,
           null,
           supervisorPin.attestation,
@@ -7583,6 +9574,14 @@ export function applyLinuxSandbox(
       });
     }
     try {
+      if (runtimeFileSnapshot) {
+        attestLinuxRegularFileSnapshot(
+          runtime,
+          runtimeFileSnapshot.finalMount,
+          runtimeFileSnapshot.attestation,
+          linuxPluginRuntimeSnapshotContract(),
+        );
+      }
       attestLinuxPluginTreeSnapshot(
         runtime,
         pinnedMounts,
@@ -7612,6 +9611,11 @@ export function applyLinuxSandbox(
     }
     try {
       attestLinuxBubblewrapSupervisorPin(runtime, supervisorPin);
+      attestLinuxBubblewrapSupervisorPin(
+        runtime,
+        descriptorScrubberPin,
+        "descriptor_scrubber",
+      );
     } catch (error) {
       closeStrongLinuxResources(supervisorPin, finalLaunch);
       return createSandboxPlan({
@@ -7633,7 +9637,11 @@ export function applyLinuxSandbox(
       });
     }
     try {
-      finalLaunch = openLinuxBubblewrapSupervisorLaunch(runtime, supervisorPin);
+      finalLaunch = openLinuxBubblewrapSupervisorLaunch(
+        runtime,
+        supervisorPin,
+        descriptorScrubberPin,
+      );
     } catch (error) {
       closeStrongLinuxResources(supervisorPin, finalLaunch);
       return createSandboxPlan({
@@ -7655,8 +9663,9 @@ export function applyLinuxSandbox(
       });
     }
     const supervisorBinding = supervisorPin.attestation;
-    closeLinuxPinnedMounts(runtime, [supervisorPin]);
+    closeLinuxPinnedMounts(runtime, [supervisorPin, descriptorScrubberPin]);
     supervisorPin = null;
+    descriptorScrubberPin = null;
     const capsuleContract =
       validation.contract.kind === MCP_STDIO_CAPSULE_SANDBOX_CONTRACT_KIND;
     const baseRuntimeProbe = linuxBubblewrapProbe(
@@ -7668,12 +9677,17 @@ export function applyLinuxSandbox(
       supervisorBinding,
       pluginTreeSnapshot,
       nativeDynamicClosure,
+      runtimePathnameLoadSet,
       policyProbe.runtimeDetachedChildSpawnVerified === true,
     );
+    const descriptorBoundRuntimeProbe = {
+      ...baseRuntimeProbe,
+      descriptorScrubber: descriptorScrubberPolicy,
+    };
     const runtimeProbe = Object.freeze(
       capsuleContract
         ? {
-            ...baseRuntimeProbe,
+            ...descriptorBoundRuntimeProbe,
             mcpCapsuleCodeSnapshot: true,
             entrySnapshotAtomic: true,
             runtimeLaunchAtomic: true,
@@ -7687,51 +9701,81 @@ export function applyLinuxSandbox(
             runtimeLaunchPath: "/opt/chainless/runtime/node",
             entrySnapshotPath: sandboxEntry,
           }
-        : baseRuntimeProbe,
+        : descriptorBoundRuntimeProbe,
     );
-    const options = {
-      ...spawnOpts,
-      cwd: "/",
-      shell: false,
-      detached: false,
-      env: {
-        PATH: "/usr/bin:/bin",
-        LANG: "C",
-        LC_ALL: "C",
-      },
-      stdio: Object.freeze(
-        linuxStdioWithPinnedMounts(spawnOpts?.stdio, pinnedDescriptors, {
-          supervisorFd: finalLaunch.fd,
-        }),
-      ),
-    };
     let pinsClosed = false;
     const cleanup = () => {
       if (pinsClosed) return;
       pinsClosed = true;
       closeLinuxPinnedMounts(runtime, [...pinnedDescriptors, finalLaunch]);
     };
-    return createSandboxPlan({
-      ...base,
-      applied: true,
-      enforcement: LINUX_BWRAP_BACKEND,
-      backend: LINUX_BWRAP_BACKEND,
-      candidateBackend: null,
-      policyAttested: true,
-      policyDigest,
-      runtimeProbe,
-      reason: null,
-      guarantees: [
-        SANDBOX_BOUNDARIES.FILESYSTEM,
-        SANDBOX_BOUNDARIES.NETWORK,
-        SANDBOX_BOUNDARIES.PROCESS_TREE,
-        ...(capsuleContract ? [SANDBOX_BOUNDARIES.CODE_SNAPSHOT] : []),
-      ],
-      command: finalLaunch.command,
-      args: [...policyArgs, "--", ...targetArgs],
-      options,
-      cleanup,
-    });
+    try {
+      const stdio = linuxStdioWithPinnedMounts(
+        spawnOpts?.stdio,
+        pinnedDescriptors,
+        {
+          supervisorFd: finalLaunch.fd,
+          scrubberFd: finalLaunch.scrubberFd,
+        },
+      );
+      const invocation = linuxBubblewrapScrubbedInvocation(
+        finalLaunch,
+        [...policyArgs, "--", ...targetArgs],
+        stdio,
+      );
+      const options = {
+        ...spawnOpts,
+        cwd: "/",
+        shell: false,
+        detached: false,
+        env: {
+          PATH: "/usr/bin:/bin",
+          LANG: "C",
+          LC_ALL: "C",
+        },
+        stdio: Object.freeze(stdio),
+      };
+      return createSandboxPlan({
+        ...base,
+        applied: true,
+        enforcement: LINUX_BWRAP_BACKEND,
+        backend: LINUX_BWRAP_BACKEND,
+        candidateBackend: null,
+        policyAttested: true,
+        policyDigest,
+        runtimeProbe,
+        reason: null,
+        guarantees: [
+          SANDBOX_BOUNDARIES.FILESYSTEM,
+          SANDBOX_BOUNDARIES.NETWORK,
+          SANDBOX_BOUNDARIES.PROCESS_TREE,
+          ...(capsuleContract ? [SANDBOX_BOUNDARIES.CODE_SNAPSHOT] : []),
+        ],
+        command: invocation.command,
+        args: invocation.args,
+        options,
+        cleanup,
+      });
+    } catch (error) {
+      cleanup();
+      return createSandboxPlan({
+        ...base,
+        backend: null,
+        candidateBackend: LINUX_BWRAP_BACKEND,
+        policyAttested: false,
+        policyDigest,
+        runtimeProbe: linuxBubblewrapProbe(
+          true,
+          false,
+          `post_probe_${error.message || "final_plan_construction_failed"}`,
+          validation.entryRuntime,
+          null,
+          supervisorBinding,
+        ),
+        reason: "linux_bwrap_execution_contract_changed",
+        guarantees: [],
+      });
+    }
   }
 
   const prlimitParts = [];
@@ -7864,7 +9908,14 @@ export function applySandbox(
 
   // Dispatch to platform handler
   if (runtime.platform === "darwin") {
-    return applyMacSandbox(command, args, spawnOpts, profile, runtimeOverrides);
+    return applyMacSandbox(
+      command,
+      args,
+      spawnOpts,
+      profile,
+      runtimeOverrides,
+      runtimeInjected ? null : MACOS_MCP_CODE_SNAPSHOT_ISSUER,
+    );
   }
   if (runtime.platform === "win32") {
     return applyWindowsSandbox(