chainlesschain 0.165.3 → 0.165.5

package/src/lib/execution-location-target.js

@@ -16,12 +16,21 @@ import {
 } from "./secure-file-identity.js";
 import { canonicalJson } from "./scheduler-kernel/contract.js";
 import { executionBroker } from "./process-execution-broker/index.js";
+import {
+  MAX_EXECUTION_LOCATION_RESULT_BUNDLE_BYTES,
+  normalizeExecutionLocationResultBundle,
+  verifyExecutionLocationResultBundle,
+} from "./execution-location-result.js";
 
 export const EXECUTION_LOCATION_PROFILE_SCHEMA =
   "cc-execution-location-profile/v1";
 export { EXECUTION_LOCATION_TARGET_ATTESTATION_SCHEMA };
 export const EXECUTION_LOCATION_TARGET_RESUME_SCHEMA =
   "cc-execution-location-target-resume/v1";
+export const EXECUTION_LOCATION_TARGET_RESULT_COLLECTION_SCHEMA =
+  "cc-execution-location-target-result-collection/v1";
+export const EXECUTION_LOCATION_TARGET_RESULT_COLLECTION_REQUEST_SCHEMA =
+  "cc-execution-location-target-result-collection-request/v1";
 
 const SESSION_LOCATION_AUTHORITY_SCHEMA =
   "cc-session-execution-location-authority/v1";
@@ -34,6 +43,8 @@ const COMMIT_RE = /^[a-f0-9]{40,64}$/u;
 const MAX_PROFILE_BYTES = 1024 * 1024;
 const MAX_PROBE_BYTES = 1024 * 1024;
 const MAX_REPLICA_BYTES = 64 * 1024 * 1024;
+const RESULT_MEDIA_TYPE_RE =
+  /^[a-z0-9][a-z0-9!#$&^_.+-]{0,126}\/[a-z0-9][a-z0-9!#$&^_.+-]{0,126}$/u;
 
 function digest(domain, value) {
   return `sha256:${createHash("sha256")
@@ -480,6 +491,14 @@ function runTargetCommand(profile, cliArgs, deps = {}, options = {}) {
     ((file, args, spawnOptions) =>
       executionBroker.spawnSync(file, args, spawnOptions));
   try {
+    const maxBuffer = Number(options.maxBuffer ?? MAX_PROBE_BYTES);
+    if (
+      !Number.isSafeInteger(maxBuffer) ||
+      maxBuffer < 1 ||
+      maxBuffer > MAX_EXECUTION_LOCATION_RESULT_BUNDLE_BYTES
+    ) {
+      throw new Error("target command output boundary is invalid");
+    }
     const result = spawnSync(invocation.file, invocation.args, {
       origin: "execution-location:target",
       scope: "execution-location",
@@ -487,7 +506,7 @@ function runTargetCommand(profile, cliArgs, deps = {}, options = {}) {
       shell: false,
       encoding: "utf8",
       timeout: options.interactive ? undefined : 30000,
-      maxBuffer: options.interactive ? undefined : MAX_PROBE_BYTES,
+      maxBuffer: options.interactive ? undefined : maxBuffer,
       ...(options.input == null ? {} : { input: options.input }),
       stdio: options.interactive
         ? "inherit"
@@ -795,9 +814,11 @@ function transferTargetSessionStore(
     receipt.targetFactsDigest !== receiptMaterial.targetFactsDigest ||
     receipt.profileDigest !== receiptMaterial.profileDigest ||
     receipt.targetEvidenceId !== receiptMaterial.targetEvidenceId ||
+    // Target prepare records a fresh observedAt, so its attestation digest is
+    // expected to differ from the earlier source-side probe. The receipt is
+    // rehashed here and the next target `location show` validates that digest
+    // against the canonical handoff binding before resume.
     !SHA256_RE.test(receipt.attestationDigest || "") ||
-    (receipt.handoffAppended === true &&
-      receipt.attestationDigest !== attestation.attestationDigest) ||
     typeof receipt.replicaInstalled !== "boolean" ||
     typeof receipt.handoffAppended !== "boolean" ||
     receipt.receiptDigest !== expectedReceiptDigest
@@ -839,6 +860,222 @@ function verifySourceAuthorityBeforeResume(handoff, readSourceAuthority) {
   });
 }
 
+function normalizeResultCollectionItem(entry, label) {
+  const mediaType = String(entry?.mediaType || "").toLowerCase();
+  const filePath = safePath(entry?.path, `${label} path`);
+  if (!RESULT_MEDIA_TYPE_RE.test(mediaType)) {
+    throw new TypeError(`${label} media type is invalid`);
+  }
+  return { mediaType, path: filePath };
+}
+
+export function createExecutionLocationTargetResultCollectionRequest(
+  input = {},
+) {
+  const profile = normalizeExecutionLocationProfile(input.profile);
+  const target = safeName(
+    input.target ?? profile.target,
+    "result collection target",
+    32,
+  );
+  if (target !== profile.target) {
+    throw new TypeError("result collection target does not match profile");
+  }
+  const requestId = safeName(
+    input.requestId,
+    "result collection request id",
+    128,
+  );
+  const sessionId = safeName(input.sessionId, "result collection session id");
+  const resultId = safeName(input.resultId, "result id", 128);
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(resultId)) {
+    throw new TypeError("result id is invalid");
+  }
+  const targetFactsDigest = String(
+    input.expectedTargetFactsDigest || "",
+  ).toLowerCase();
+  const handoffId = String(input.expectedHandoffId || "").toLowerCase();
+  if (!SHA256_RE.test(targetFactsDigest)) {
+    throw new TypeError("expected target facts digest is invalid");
+  }
+  if (!SHA256_RE.test(handoffId)) {
+    throw new TypeError("expected result handoff id is invalid");
+  }
+  const artifacts = (input.artifacts ?? []).map((entry, index) =>
+    normalizeResultCollectionItem(entry, `result artifact ${index}`),
+  );
+  const evidence = (input.evidence ?? []).map((entry, index) =>
+    normalizeResultCollectionItem(entry, `result evidence ${index}`),
+  );
+  if (artifacts.length + evidence.length > 64) {
+    throw new TypeError("result collection item list is invalid");
+  }
+  const material = {
+    schema: EXECUTION_LOCATION_TARGET_RESULT_COLLECTION_REQUEST_SCHEMA,
+    requestId,
+    sessionId,
+    target,
+    profileDigest: profile.profileDigest,
+    targetFactsDigest,
+    handoffId,
+    resultId,
+    summaryPath: safePath(input.summaryPath, "result summary path"),
+    diffPath: safePath(input.diffPath, "result diff path"),
+    artifacts,
+    evidence,
+  };
+  return Object.freeze({
+    ...material,
+    requestDigest: digest(
+      "chainlesschain.execution-location.target-result-collection-request.v1\0",
+      material,
+    ),
+  });
+}
+
+export function collectExecutionLocationTargetResult(input = {}, deps = {}) {
+  const profile = normalizeExecutionLocationProfile(input.profile);
+  validateProfileHandoff(profile, input.handoff);
+  const expectedTargetFactsDigest = safeString(
+    input.expectedTargetFactsDigest,
+    "expected target facts digest",
+    80,
+  ).toLowerCase();
+  if (!SHA256_RE.test(expectedTargetFactsDigest)) {
+    throw new Error("expected target facts digest is invalid");
+  }
+  const sourceBefore = verifySourceAuthorityBeforeResume(
+    input.handoff,
+    input.readSourceAuthority,
+  );
+  const attestation = attestExecutionLocationTarget(
+    { profile, handoff: input.handoff },
+    deps,
+  );
+  if (attestation.targetFactsDigest !== expectedTargetFactsDigest) {
+    throw new Error("target facts digest changed before result collection");
+  }
+  const resultId = safeName(input.resultId, "result id", 128);
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(resultId)) {
+    throw new TypeError("result id is invalid");
+  }
+  const expectedHandoffId = String(input.expectedHandoffId || "");
+  if (!SHA256_RE.test(expectedHandoffId)) {
+    throw new TypeError("expected result handoff id is invalid");
+  }
+  const summaryPath = safePath(input.summaryPath, "result summary path");
+  const diffPath = safePath(input.diffPath, "result diff path");
+  const artifactInput = input.artifacts ?? [];
+  const evidenceInput = input.evidence ?? [];
+  if (!Array.isArray(artifactInput) || !Array.isArray(evidenceInput)) {
+    throw new TypeError("result collection item list is invalid");
+  }
+  const artifacts = artifactInput.map((entry, index) =>
+    normalizeResultCollectionItem(entry, `result artifact ${index}`),
+  );
+  const evidence = evidenceInput.map((entry, index) =>
+    normalizeResultCollectionItem(entry, `result evidence ${index}`),
+  );
+  if (artifacts.length + evidence.length > 64) {
+    throw new TypeError("result collection item list is invalid");
+  }
+  const request = createExecutionLocationTargetResultCollectionRequest({
+    requestId: input.requestId,
+    sessionId: input.handoff?.session?.sessionId,
+    target: profile.target,
+    profile,
+    expectedTargetFactsDigest,
+    expectedHandoffId,
+    resultId,
+    summaryPath,
+    diffPath,
+    artifacts,
+    evidence,
+  });
+  const args = [
+    "session",
+    "location",
+    "result-pack",
+    input.handoff.session.sessionId,
+    "--result-id",
+    resultId,
+    "--summary",
+    summaryPath,
+    "--diff",
+    diffPath,
+  ];
+  for (const entry of artifacts) {
+    args.push("--artifact", `${entry.mediaType}=${entry.path}`);
+  }
+  for (const entry of evidence) {
+    args.push("--evidence", `${entry.mediaType}=${entry.path}`);
+  }
+  args.push("--json");
+  const raw = runTargetCommand(profile, args, deps, {
+    maxBuffer: MAX_EXECUTION_LOCATION_RESULT_BUNDLE_BYTES,
+  });
+  let bundleInput;
+  try {
+    bundleInput = JSON.parse(String(raw));
+  } catch {
+    throw new Error("target result bundle output is not one exact JSON object");
+  }
+  const bundle = normalizeExecutionLocationResultBundle(bundleInput);
+  const sourceAfter = verifySourceAuthorityBeforeResume(
+    input.handoff,
+    input.readSourceAuthority,
+  );
+  const verification = verifyExecutionLocationResultBundle({
+    bundle,
+    sourceAuthority: sourceAfter,
+    expectedHandoffId,
+  });
+  if (
+    bundle.session.handoffId !== expectedHandoffId ||
+    bundle.session.target.profileDigest !== profile.profileDigest ||
+    bundle.session.target.targetEvidenceId !== profile.evidenceId ||
+    bundle.session.target.targetFactsDigest !== expectedTargetFactsDigest ||
+    sourceBefore.headHash !== sourceAfter.headHash ||
+    sourceBefore.eventCount !== sourceAfter.eventCount
+  ) {
+    throw new Error(
+      "target result bundle does not match the accepted handoff authority",
+    );
+  }
+  const material = {
+    schema: EXECUTION_LOCATION_TARGET_RESULT_COLLECTION_SCHEMA,
+    requestId: request.requestId,
+    requestDigest: request.requestDigest,
+    resultId,
+    target: profile.target,
+    profileDigest: profile.profileDigest,
+    targetFactsDigest: expectedTargetFactsDigest,
+    collectionAttestationDigest: attestation.attestationDigest,
+    handoffId: bundle.session.handoffId,
+    sourceAuthority: sourceAfter,
+    targetHeadHash: bundle.session.target.headHash,
+    targetEventCount: bundle.session.target.eventCount,
+    bundleDigest: bundle.bundleDigest,
+    verificationDigest: verification.verificationDigest,
+    applied: false,
+    continuity: "single-fixed-command-response",
+    gaps: [
+      "returned-result-bytes-not-durable",
+      "cross-host-concurrent-writer-fencing-not-durable",
+      "returned-result-not-applied",
+    ],
+  };
+  return Object.freeze({
+    ...material,
+    bundle,
+    verification,
+    collectionDigest: digest(
+      "chainlesschain.execution-location.target-result-collection.v1\0",
+      material,
+    ),
+  });
+}
+
 export function resumeExecutionLocationTarget(input = {}, deps = {}) {
   const profile = normalizeExecutionLocationProfile(input.profile);
   validateProfileHandoff(profile, input.handoff);

package/src/lib/managed-tool-checkpoint.js

@@ -15,6 +15,9 @@ export const MANAGED_TOOL_CHECKPOINT_ERROR = Object.freeze({
   SETTLEMENT_FAILED: "MANAGED_TOOL_CHECKPOINT_SETTLEMENT_FAILED",
 });
 
+export const MANAGED_TOOL_CHECKPOINT_BINDING_SCHEMA =
+  "cc-managed-tool-checkpoint-binding/v1";
+
 const DIRECT_FILE_ONLY_TOOLS = new Set([
   "write_file",
   "edit_file",
@@ -33,6 +36,14 @@ const DEFAULT_READ_ONLY_TOOLS = new Set([
   "search_sessions",
 ]);
 
+export function managedToolCheckpointRequired(toolName, readOnly = undefined) {
+  const normalized = boundedBinding(toolName, "unknown-tool");
+  return !(
+    readOnly === true ||
+    (readOnly !== false && DEFAULT_READ_ONLY_TOOLS.has(normalized))
+  );
+}
+
 function checkpointError(code, message, details = {}, cause = null) {
   const error = new Error(message, cause ? { cause } : undefined);
   error.name = "ManagedToolCheckpointError";
@@ -69,6 +80,41 @@ function skippedCheckpoint(reason, toolName) {
   });
 }
 
+export function managedToolCheckpointBinding(handle) {
+  if (!handle || handle.skipped === true) return null;
+  const prepared = handle.prepared;
+  if (
+    !prepared ||
+    prepared.id !== handle.transactionId ||
+    prepared.checkpointId !== handle.checkpointId ||
+    typeof prepared.checkpoint?.digest !== "string" ||
+    typeof prepared.stateDigest !== "string" ||
+    !Object.values(WORKSPACE_TRANSACTION_COVERAGE).includes(
+      prepared.coverage,
+    ) ||
+    !Object.values(WORKSPACE_TRANSACTION_COVERAGE).includes(
+      prepared.fileCoverage,
+    ) ||
+    typeof prepared.externalSideEffects !== "boolean"
+  ) {
+    throw checkpointError(
+      MANAGED_TOOL_CHECKPOINT_ERROR.INVALID_ARGUMENT,
+      "managed tool checkpoint prepared binding is malformed",
+    );
+  }
+  return Object.freeze({
+    schema: MANAGED_TOOL_CHECKPOINT_BINDING_SCHEMA,
+    authority: "process-broker-workspace-transaction-prepared",
+    transactionId: handle.transactionId,
+    checkpointId: handle.checkpointId,
+    checkpointDigest: prepared.checkpoint.digest,
+    preparedStateDigest: prepared.stateDigest,
+    coverage: prepared.coverage,
+    fileCoverage: prepared.fileCoverage,
+    externalSideEffects: prepared.externalSideEffects,
+  });
+}
+
 /**
  * Prepare one managed checkpoint before a mutating agent tool call.
  *
@@ -79,10 +125,7 @@ function skippedCheckpoint(reason, toolName) {
 export function beginManagedToolCheckpoint(options = {}) {
   if (options.enabled !== true) return null;
   const toolName = boundedBinding(options.toolName, "unknown-tool");
-  const readOnly =
-    options.readOnly === true ||
-    (options.readOnly !== false && DEFAULT_READ_ONLY_TOOLS.has(toolName));
-  if (readOnly) return null;
+  if (!managedToolCheckpointRequired(toolName, options.readOnly)) return null;
   if (
     typeof options.unmanagedWriterReason === "string" &&
     options.unmanagedWriterReason.trim()

package/src/lib/mcp-stdio-executable-identity.js

@@ -24,6 +24,10 @@ import {
   reattestMcpStdioPackageMaterialization,
   resolveMcpStdioPackageMaterialization,
 } from "./mcp-stdio-package-materialization.js";
+import {
+  isMcpStdioCapsuleNativeCodePolicy,
+  mcpStdioCapsuleNativeCodePolicyDigest,
+} from "./mcp-stdio-native-code-policy.js";
 import {
   isMcpStdioCodeInjectionEnvironmentKey,
   sanitizeMcpStdioHostEnvironment,
@@ -48,11 +52,13 @@ export const MCP_STDIO_RUNTIME_KIND_INVALID_CODE =
 export const MCP_STDIO_CAPSULE_SANDBOX_CONTRACT_KIND =
   "strict-mcp-node-capsule";
 export const MCP_STDIO_CAPSULE_CODE_SNAPSHOT_BOUNDARY = "code-snapshot";
+export const MCP_STDIO_CAPSULE_NATIVE_ADDON_BOUNDARY = "native-addon-loading";
 export const MCP_STDIO_CAPSULE_REQUIRED_BOUNDARIES = Object.freeze([
   MCP_STDIO_CAPSULE_CODE_SNAPSHOT_BOUNDARY,
   "filesystem",
   "network",
   "process-tree",
+  MCP_STDIO_CAPSULE_NATIVE_ADDON_BOUNDARY,
 ]);
 
 const STORE_LABEL = "MCP stdio executable identity";
@@ -852,6 +858,10 @@ function issueCapsuleSandboxExecutionContract({
   materialization,
 }) {
   if (!materialization) return null;
+  const nativeCodePolicy = materialization.identity?.capsule?.nativeCodePolicy;
+  if (!isMcpStdioCapsuleNativeCodePolicy(nativeCodePolicy)) {
+    throw new Error("MCP materialized capsule native-code policy is invalid");
+  }
   const capsuleRoot = attestCapsuleRoot(materialization.capsuleRoot);
   const entryIdentity = attestation.identity.entrypoints.find(
     (entry) => entry.argIndex === 0,
@@ -878,6 +888,7 @@ function issueCapsuleSandboxExecutionContract({
       attestation.identity.command,
       path.resolve(process.execPath),
     ),
+    nativeCodePolicy: Object.freeze({ ...nativeCodePolicy }),
   });
   issuedCapsuleSandboxContracts.set(
     contract,
@@ -888,6 +899,8 @@ function issueCapsuleSandboxExecutionContract({
       cwd: capsuleRoot.realPath,
       identityDigest: attestation.identityDigest,
       requiredBoundaries: MCP_STDIO_CAPSULE_REQUIRED_BOUNDARIES,
+      nativeCodePolicyDigest:
+        mcpStdioCapsuleNativeCodePolicyDigest(nativeCodePolicy),
     }),
   );
   return contract;
@@ -918,6 +931,9 @@ export function consumeMcpStdioCapsuleSandboxExecutionContract(
     issued.requiredBoundaries.every((boundary) =>
       requiredBoundaries.includes(boundary),
     ) &&
+    isMcpStdioCapsuleNativeCodePolicy(contract.nativeCodePolicy) &&
+    mcpStdioCapsuleNativeCodePolicyDigest(contract.nativeCodePolicy) ===
+      issued.nativeCodePolicyDigest &&
     args.length === issued.args.length &&
     args.every((value, index) => value === issued.args[index])
   );

package/src/lib/mcp-stdio-native-code-policy.js

@@ -0,0 +1,74 @@
+import crypto from "node:crypto";
+
+/**
+ * Materialized MCP capsules are JavaScript-only products. They do not admit
+ * package-provided native addons: esbuild emits one CJS file, retains only
+ * Node builtins as externals, and the immutable capsule prelude replaces
+ * process.dlopen before package code runs. Platform runtime libraries and V8's
+ * own executable memory remain part of the trusted Node/OS runtime base and are
+ * deliberately not represented as an arbitrary shared-library closure.
+ */
+export const MCP_STDIO_CAPSULE_NATIVE_CODE_POLICY = Object.freeze({
+  schema: "chainlesschain.mcp-stdio-native-code-policy/v1",
+  contractVersion: 1,
+  mode: "deny-package-native-addons",
+  capsuleFormat: "single-bundled-cjs",
+  nativeAddonLoading: "denied",
+  nativeAddonDenialMechanism:
+    "immutable-process-dlopen-guard-plus-bundled-js-only-v1",
+  hostRuntimeSharedLibraries: "platform-runtime-tcb",
+  anonymousExecutableMemory: "node-runtime-tcb",
+  sharedLibraryClosure: false,
+});
+
+const POLICY_KEYS = Object.freeze(
+  Object.keys(MCP_STDIO_CAPSULE_NATIVE_CODE_POLICY).sort(),
+);
+
+function canonicalPolicy(value) {
+  return JSON.stringify(
+    Object.fromEntries(POLICY_KEYS.map((key) => [key, value[key]])),
+  );
+}
+
+export const MCP_STDIO_CAPSULE_NATIVE_CODE_POLICY_DIGEST = crypto
+  .createHash("sha256")
+  .update(canonicalPolicy(MCP_STDIO_CAPSULE_NATIVE_CODE_POLICY))
+  .digest("hex");
+
+export function isMcpStdioCapsuleNativeCodePolicy(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const keys = Object.keys(value).sort();
+  return (
+    keys.length === POLICY_KEYS.length &&
+    keys.every((key, index) => key === POLICY_KEYS[index]) &&
+    POLICY_KEYS.every(
+      (key) => value[key] === MCP_STDIO_CAPSULE_NATIVE_CODE_POLICY[key],
+    )
+  );
+}
+
+export function mcpStdioCapsuleNativeCodePolicyDigest(value) {
+  if (!isMcpStdioCapsuleNativeCodePolicy(value)) {
+    throw new TypeError("MCP capsule native-code policy is invalid");
+  }
+  return crypto
+    .createHash("sha256")
+    .update(canonicalPolicy(value))
+    .digest("hex");
+}
+
+export function mcpStdioCapsuleNativeCodeEvidence(value) {
+  const digest = mcpStdioCapsuleNativeCodePolicyDigest(value);
+  return Object.freeze({
+    nativeCodePolicyBound: true,
+    nativeCodePolicySchema: value.schema,
+    nativeCodePolicyDigest: digest,
+    nativeCodePolicyMode: value.mode,
+    capsuleNativeCodeFormat: value.capsuleFormat,
+    nativeAddonLoading: value.nativeAddonLoading,
+    nativeAddonDenialMechanism: value.nativeAddonDenialMechanism,
+    hostRuntimeSharedLibraries: value.hostRuntimeSharedLibraries,
+    anonymousExecutableMemory: value.anonymousExecutableMemory,
+  });
+}

package/src/lib/mcp-stdio-package-materialization.js

@@ -25,6 +25,10 @@ import {
   writeSecurityStore,
 } from "./durable-security-store.js";
 import { sanitizeMcpStdioHostEnvironment } from "./mcp-stdio-environment.js";
+import {
+  isMcpStdioCapsuleNativeCodePolicy,
+  MCP_STDIO_CAPSULE_NATIVE_CODE_POLICY,
+} from "./mcp-stdio-native-code-policy.js";
 
 export const MCP_STDIO_PACKAGE_MATERIALIZATION_REQUIRED_CODE =
   "CC_MCP_STDIO_PACKAGE_MATERIALIZATION_REQUIRED";
@@ -36,9 +40,9 @@ export const MCP_STDIO_PACKAGE_MATERIALIZATION_CHANGED_CODE =
   "CC_MCP_STDIO_PACKAGE_MATERIALIZATION_CHANGED";
 
 const MATERIALIZATION_SCHEMA =
-  "chainlesschain.mcp-stdio-package-materialization/v5";
-const MATERIALIZATION_VERSION = 5;
-const CAPSULE_SCHEMA = "chainlesschain.mcp-stdio-node-capsule/v4";
+  "chainlesschain.mcp-stdio-package-materialization/v6";
+const MATERIALIZATION_VERSION = 6;
+const CAPSULE_SCHEMA = "chainlesschain.mcp-stdio-node-capsule/v5";
 const CAPSULE_RELATIVE_PATH = "capsule/server.cjs";
 const CAPSULE_BUILDER = "esbuild-wasm";
 const CAPSULE_BUILDER_VERSION = "0.28.1";
@@ -1504,6 +1508,7 @@ async function buildCapsule({
           ? CAPSULE_EXECUTION_CONTEXT_ISOLATION
           : "not-required",
     }),
+    nativeCodePolicy: MCP_STDIO_CAPSULE_NATIVE_CODE_POLICY,
   });
 }
 
@@ -1563,6 +1568,7 @@ function validateManifest(manifest) {
     ) ||
     manifest.capsule?.builtinPolicy?.schema !== CAPSULE_BUILTIN_POLICY_SCHEMA ||
     manifest.capsule?.builtinPolicy?.mode !== "static-external-only" ||
+    !isMcpStdioCapsuleNativeCodePolicy(manifest.capsule?.nativeCodePolicy) ||
     !Array.isArray(manifest.capsule?.builtinPolicy?.allowedBuiltins) ||
     manifest.capsule.builtinPolicy.allowedBuiltins.some(
       (name) => typeof name !== "string" || !NODE_BUILTINS.has(name),
@@ -1743,6 +1749,9 @@ function verifyPublishedGeneration(root, record, expectedFingerprint) {
             ...manifest.capsule.builtinPolicy.executionContextBuiltins,
           ]),
         }),
+        nativeCodePolicy: Object.freeze({
+          ...manifest.capsule.nativeCodePolicy,
+        }),
       }),
       closureDigest: manifest.closureDigest,
       fileCount: manifest.fileCount,