chainlesschain 0.166.89 → 0.166.91

package/src/lib/automation-engine.js

@@ -27,6 +27,16 @@ export const EXECUTION_STATUS = Object.freeze({
   SUCCESS: "success",
   FAILED: "failed",
   CANCELLED: "cancelled",
+  SIMULATED: "simulated",
+  UNSUPPORTED: "unsupported",
+  UNVERIFIED: "legacy-unverified",
+});
+
+export const AUTOMATION_EXECUTION_CAPABILITY = Object.freeze({
+  live: false,
+  simulation: true,
+  reason:
+    "Connector catalog only; live automation execution is not implemented",
 });
 
 export const TRIGGER_TYPE = Object.freeze({
@@ -125,12 +135,22 @@ export const CONNECTOR_CATALOG = Object.freeze([
 const CONNECTOR_INDEX = new Map(CONNECTOR_CATALOG.map((c) => [c.id, c]));
 
 export function listConnectors() {
-  return CONNECTOR_CATALOG.map((c) => ({ ...c, actions: [...c.actions] }));
+  return CONNECTOR_CATALOG.map((c) => ({
+    ...c,
+    actions: [...c.actions],
+    executionCapability: AUTOMATION_EXECUTION_CAPABILITY,
+  }));
 }
 
 export function getConnector(id) {
   const c = CONNECTOR_INDEX.get(id);
-  return c ? { ...c, actions: [...c.actions] } : null;
+  return c
+    ? {
+        ...c,
+        actions: [...c.actions],
+        executionCapability: AUTOMATION_EXECUTION_CAPABILITY,
+      }
+    : null;
 }
 
 /* ── Built-in flow templates ───────────────────────────────── */
@@ -462,14 +482,42 @@ function _rowToFlow(row) {
 
 function _rowToExecution(row) {
   if (!row) return null;
+  const outputData = _parseJSON(row.output_data, null);
+  const stepsLog = _parseJSON(row.steps_log, []);
+  const simulated =
+    row.test_mode === 1 ||
+    outputData?.simulated === true ||
+    stepsLog.some((step) => step.output?.simulated === true);
+  const adjudication = _parseJSON(row.error, null);
+  const confirmedApplied =
+    adjudication?.authority === "scheduler-adjudication" &&
+    adjudication?.decision === "confirmed_applied";
+  const legacyControlOnly =
+    row.status === EXECUTION_STATUS.SUCCESS &&
+    !confirmedApplied &&
+    stepsLog.every((step) => step.nodeType && step.nodeType !== "action") &&
+    (outputData == null ||
+      outputData.parallel === true ||
+      outputData.loop === true ||
+      (typeof outputData.branch === "string" && "expression" in outputData));
+  // Old releases persisted simulator results as success. Do not recover those
+  // rows as evidence that an external action was applied.
+  const status =
+    row.status === EXECUTION_STATUS.SUCCESS && simulated
+      ? EXECUTION_STATUS.SIMULATED
+      : legacyControlOnly
+        ? EXECUTION_STATUS.UNVERIFIED
+        : row.status;
   return {
     id: row.id,
     flowId: row.flow_id,
     triggerType: row.trigger_type,
     inputData: _parseJSON(row.input_data, null),
-    outputData: _parseJSON(row.output_data, null),
-    status: row.status,
-    stepsLog: _parseJSON(row.steps_log, []),
+    outputData,
+    status,
+    ...(status !== row.status ? { recordedStatus: row.status } : {}),
+    mode: simulated ? "simulation" : legacyControlOnly ? "unverified" : "live",
+    stepsLog,
     durationMs: row.duration_ms || 0,
     error: row.error || null,
     testMode: row.test_mode === 1,
@@ -1161,13 +1209,20 @@ export function executeFlow(db, flowId, options = {}) {
     executionAuthority = null,
     assertRuntimeBoundary = null,
   } = options;
+  if (typeof testMode !== "boolean") {
+    throw new TypeError("testMode must be a boolean");
+  }
   const execId =
     executionId === undefined
       ? _genId("exec")
       : _normalizeExecutionId(executionId);
   const existing = getExecution(db, execId);
   if (existing) {
-    return _resolveExistingExecution(existing, { flowId, triggerType });
+    return _resolveExistingExecution(existing, {
+      flowId,
+      triggerType,
+      testMode,
+    });
   }
   // Validate every declared action boundary before creating an execution row
   // or invoking the first effect. The per-node assertion below remains as the
@@ -1210,20 +1265,34 @@ export function executeFlow(db, flowId, options = {}) {
     // the winner from durable evidence instead of running the flow twice.
     const concurrent = getExecution(db, execId);
     if (!concurrent) throw error;
-    return _resolveExistingExecution(concurrent, { flowId, triggerType });
+    return _resolveExistingExecution(concurrent, {
+      flowId,
+      triggerType,
+      testMode,
+    });
   }
 
   const stepsLog = [];
-  let finalStatus = EXECUTION_STATUS.SUCCESS;
+  let finalStatus = testMode
+    ? EXECUTION_STATUS.SIMULATED
+    : EXECUTION_STATUS.UNSUPPORTED;
   let finalError = null;
   let outputData = null;
 
   try {
     const ordered = _topoOrder(flow.nodes, flow.edges);
+    if (!testMode) {
+      finalError = AUTOMATION_EXECUTION_CAPABILITY.reason;
+      outputData = {
+        executed: false,
+        code: "AUTOMATION_EXECUTION_UNSUPPORTED",
+        capability: AUTOMATION_EXECUTION_CAPABILITY,
+      };
+    }
     const stepInputs = new Map();
     stepInputs.set("__initial__", inputData);
 
-    for (const node of ordered) {
+    for (const node of testMode ? ordered : []) {
       const stepStart = Date.now();
       const parentEdges = flow.edges.filter((e) => e.to === node.id);
       let merged;
@@ -1251,7 +1320,7 @@ export function executeFlow(db, flowId, options = {}) {
         nodeType: node.type || "action",
         connector: node.connector || null,
         action: node.action || null,
-        status: "success",
+        status: EXECUTION_STATUS.SIMULATED,
         durationMs: Date.now() - stepStart,
         output,
       });
@@ -1389,8 +1458,15 @@ function _normalizeExecutionId(value) {
   return value;
 }
 
-function _resolveExistingExecution(existing, { flowId, triggerType }) {
-  if (existing.flowId !== flowId || existing.triggerType !== triggerType) {
+function _resolveExistingExecution(
+  existing,
+  { flowId, triggerType, testMode },
+) {
+  if (
+    existing.flowId !== flowId ||
+    existing.triggerType !== triggerType ||
+    existing.testMode !== testMode
+  ) {
     const error = new Error(
       `Execution id is already bound to another automation request: ${existing.id}`,
     );
@@ -1407,7 +1483,7 @@ function _resolveExistingExecution(existing, { flowId, triggerType }) {
   return existing;
 }
 
-export function fireTrigger(db, triggerId, inputData = {}) {
+export function fireTrigger(db, triggerId, inputData = {}, options = {}) {
   const trig = getTrigger(db, triggerId);
   if (!trig) throw new Error(`Trigger not found: ${triggerId}`);
   if (!trig.enabled) throw new Error(`Trigger disabled: ${triggerId}`);
@@ -1434,6 +1510,7 @@ export function fireTrigger(db, triggerId, inputData = {}) {
   return executeFlow(db, trig.flowId, {
     inputData,
     triggerType: trig.type,
+    testMode: options.testMode ?? false,
   });
 }
 
@@ -1445,31 +1522,64 @@ export function getExecution(db, execId) {
 
 export function listExecutions(db, filters = {}) {
   const { flowId, status, limit = 50 } = filters;
-  let rows;
-  if (flowId && status) {
-    rows = db
-      .prepare(
-        `SELECT * FROM auto_executions WHERE flow_id = ? AND status = ? ORDER BY started_at DESC LIMIT ?`,
-      )
-      .all(flowId, status, limit);
-  } else if (flowId) {
-    rows = db
-      .prepare(
-        `SELECT * FROM auto_executions WHERE flow_id = ? ORDER BY started_at DESC LIMIT ?`,
-      )
-      .all(flowId, limit);
-  } else if (status) {
-    rows = db
+  if (!Number.isSafeInteger(limit) || limit < 0) {
+    throw new RangeError(
+      "Execution history limit must be a non-negative integer",
+    );
+  }
+  if (limit === 0) return [];
+
+  const clauses = [];
+  const params = [];
+  if (flowId) {
+    clauses.push("flow_id = ?");
+    params.push(flowId);
+  }
+  const needsLegacyProjection = [
+    EXECUTION_STATUS.SUCCESS,
+    EXECUTION_STATUS.SIMULATED,
+    EXECUTION_STATUS.UNVERIFIED,
+  ].includes(status);
+  if (status) {
+    if (needsLegacyProjection && status !== EXECUTION_STATUS.SUCCESS) {
+      clauses.push("status IN (?, ?)");
+      params.push(status, EXECUTION_STATUS.SUCCESS);
+    } else {
+      clauses.push("status = ?");
+      params.push(status);
+    }
+  }
+  const where = clauses.length > 0 ? ` WHERE ${clauses.join(" AND ")}` : "";
+  if (!needsLegacyProjection) {
+    return db
       .prepare(
-        `SELECT * FROM auto_executions WHERE status = ? ORDER BY started_at DESC LIMIT ?`,
+        `SELECT * FROM auto_executions${where} ORDER BY started_at DESC LIMIT ?`,
       )
-      .all(status, limit);
-  } else {
-    rows = db
-      .prepare(`SELECT * FROM auto_executions ORDER BY started_at DESC LIMIT ?`)
-      .all(limit);
+      .all(...params, limit)
+      .map(_rowToExecution);
+  }
+
+  // A stored success can project to simulated/unverified. Scan only candidate
+  // statuses in bounded pages and stop once the caller's normalized limit is
+  // met, instead of loading all execution payloads into memory. The id tie
+  // breaker keeps page boundaries stable when timestamps are identical.
+  const pageSize = 128;
+  const statement = db.prepare(
+    `SELECT * FROM auto_executions${where} ORDER BY started_at DESC, id DESC LIMIT ? OFFSET ?`,
+  );
+  const executions = [];
+  let offset = 0;
+  while (executions.length < limit) {
+    const rows = statement.all(...params, pageSize, offset);
+    for (const row of rows) {
+      const execution = _rowToExecution(row);
+      if (execution.status === status) executions.push(execution);
+      if (executions.length === limit) return executions;
+    }
+    if (rows.length < pageSize) break;
+    offset += rows.length;
   }
-  return rows.map(_rowToExecution);
+  return executions;
 }
 
 /* ── Stats ─────────────────────────────────────────────────── */
@@ -1477,7 +1587,7 @@ export function listExecutions(db, filters = {}) {
 export function getStats(db) {
   const flowsByStatus = {};
   for (const status of Object.values(FLOW_STATUS)) flowsByStatus[status] = 0;
-  for (const row of db.data?.get("auto_flows") || []) {
+  for (const row of db.prepare("SELECT * FROM auto_flows").all()) {
     flowsByStatus[row.status] = (flowsByStatus[row.status] || 0) + 1;
   }
 
@@ -1486,15 +1596,16 @@ export function getStats(db) {
     execByStatus[status] = 0;
   let totalDuration = 0;
   let execCount = 0;
-  for (const row of db.data?.get("auto_executions") || []) {
-    execByStatus[row.status] = (execByStatus[row.status] || 0) + 1;
+  for (const row of db.prepare("SELECT * FROM auto_executions").all()) {
+    const { status } = _rowToExecution(row);
+    execByStatus[status] = (execByStatus[status] || 0) + 1;
     totalDuration += row.duration_ms || 0;
     execCount++;
   }
 
   const triggersByType = {};
   for (const type of Object.values(TRIGGER_TYPE)) triggersByType[type] = 0;
-  for (const row of db.data?.get("auto_triggers") || []) {
+  for (const row of db.prepare("SELECT * FROM auto_triggers").all()) {
     triggersByType[row.type] = (triggersByType[row.type] || 0) + 1;
   }
 
@@ -1528,6 +1639,7 @@ export function getStats(db) {
 
 export function getConfig() {
   return {
+    executionCapability: AUTOMATION_EXECUTION_CAPABILITY,
     connectors: CONNECTOR_CATALOG.length,
     templates: FLOW_TEMPLATES.length,
     flowStatuses: Object.values(FLOW_STATUS),

package/src/lib/checkpoint-restore-saga.js

@@ -464,6 +464,16 @@ function isMissingPathError(error) {
   return error?.code === "ENOENT" || error?.cause?.code === "ENOENT";
 }
 
+function hasMissingLockPathCause(error) {
+  // A bounded owner read wraps secure-parent errors, which themselves wrap
+  // ENOENT when a cooperating process detaches its released lock directory.
+  // Only unlocked lock inspection uses this; losing our held owner still fails.
+  for (let depth = 0; error && depth < 8; depth++, error = error.cause) {
+    if (error.code === "ENOENT") return true;
+  }
+  return false;
+}
+
 function attachCommitState(error, details) {
   if (!error || typeof error !== "object") return error;
   for (const [key, value] of Object.entries(details)) {
@@ -1887,7 +1897,7 @@ export class CheckpointRestoreSagaStore {
       // The same valid release can happen after readdir observed owner.json
       // but before its lstat/read. Only tolerate absence during the unlocked
       // pre/postflight inspection; losing our own owner still fails closed.
-      if (isMissingPathError(cause) && !requireOwner) return null;
+      if (hasMissingLockPathCause(cause) && !requireOwner) return null;
       throw sagaError(
         CHECKPOINT_RESTORE_SAGA_ERROR_CODES.LOCK_FAILED,
         "Saga state lock owner is corrupt or unbounded",

package/src/lib/eval/verify01-host-evidence.js

@@ -149,13 +149,46 @@ export function inspectIdeProtocol(records, { prompt, comparison } = {}) {
       resultRecords[0].event.session_id === sessionId,
     "IDE terminal is missing or ambiguous",
   );
+  const terminal = resultRecords[0].event;
+  // Persistent headless streams emit one lifecycle end after stdin closes.
+  // Accept only that exact, same-session one-turn trailer; task output after
+  // the result stays ambiguous. Keep the complete capture intact.
+  const trailing = outputs.slice(outputs.indexOf(resultRecords[0]) + 1);
+  const end = trailing[0]?.event;
+  const lifecycleFrames = outputs.filter(
+    (record) =>
+      record.event.type === "system" && record.event.subtype === "end",
+  );
+  const lifecycleEnded =
+    trailing.length === 1 &&
+    lifecycleFrames.length === 1 &&
+    end.type === "system" &&
+    end.subtype === "end" &&
+    end.session_id === sessionId &&
+    end.turns === 1 &&
+    terminal.turn === 1 &&
+    Object.keys(end).every((key) =>
+      ["type", "subtype", "session_id", "turns", "trace_id", "seq"].includes(
+        key,
+      ),
+    ) &&
+    (end.trace_id === undefined ||
+      (typeof end.trace_id === "string" &&
+        end.trace_id === terminal.trace_id)) &&
+    (end.seq === undefined ||
+      (Number.isSafeInteger(end.seq) &&
+        Number.isSafeInteger(terminal.seq) &&
+        end.seq === terminal.seq + 1));
+  const taskOutputs = lifecycleEnded ? outputs.slice(0, -1) : outputs;
   const parsed = verifyAgentTerminal(
-    outputs.map((record) => JSON.stringify(record.event)).join("\n"),
+    taskOutputs.map((record) => JSON.stringify(record.event)).join("\n"),
   );
-  const terminal = resultRecords[0].event;
+  if (lifecycleFrames.length > 0 && !lifecycleEnded)
+    parsed.terminalVerified = false;
   // A complete explicit failure is an observation. It never becomes success.
   const knownFailure =
-    outputs.at(-1) === resultRecords[0] &&
+    taskOutputs.at(-1) === resultRecords[0] &&
+    (lifecycleFrames.length === 0 || lifecycleEnded) &&
     terminal.is_error === true &&
     typeof terminal.subtype === "string" &&
     terminal.subtype.length > 0 &&

package/src/lib/knowledge-graph.js

@@ -239,6 +239,33 @@ export function getEntity(id) {
   return e ? _strip(e) : null;
 }
 
+/** Replace supplied entity fields while preserving identity and relationships. */
+export function updateEntity(db, id, config = {}) {
+  const current = _entities.get(id);
+  if (!current) throw new Error(`Entity not found: ${id}`);
+  const name = String(config.name ?? current.name).trim();
+  const type = String(config.type ?? current.type).trim();
+  if (!name) throw new Error("entity name is required");
+  if (!type) throw new Error("entity type is required");
+  const entity = {
+    ...current,
+    name,
+    type,
+    properties: Object.hasOwn(config, "properties")
+      ? config.properties
+      : current.properties,
+    tags: Object.hasOwn(config, "tags")
+      ? Array.isArray(config.tags)
+        ? [...config.tags]
+        : null
+      : current.tags,
+    updatedAt: Number(config.now ?? Date.now()),
+  };
+  _persistEntity(db, entity);
+  _entities.set(id, entity);
+  return _strip(entity);
+}
+
 export function listEntities(opts = {}) {
   let rows = [..._entities.values()];
   if (opts.type) {

package/src/lib/personal-data-hub-wiring.js

@@ -368,6 +368,17 @@ async function loadBm25() {
 let _hub = null;
 let _initPromise = null;
 let _bm25 = null;
+let _processExitHook = null;
+
+function installProcessExitHook() {
+  if (_processExitHook) return;
+  _processExitHook = (code) => {
+    // exit callbacks are synchronous. Nonzero exits keep the generation active;
+    // exit(0) still has to pass the registry's in-flight operation guard.
+    close({ retireConsumer: code === 0 });
+  };
+  process.once("exit", _processExitHook);
+}
 
 // LLM override — see file header. Default cli-side hub uses a direct
 // OllamaClient; when the desktop main process embeds this wiring via
@@ -453,6 +464,11 @@ async function initHub() {
     kgSink = new CcKgSink({
       addEntity: kgMod.addEntity,
       addRelation: kgMod.addRelation,
+      updateEntity: kgMod.updateEntity,
+      getEntity: kgMod.getEntity,
+      removeEntity: kgMod.removeEntity,
+      listRelations: kgMod.listRelations,
+      removeRelation: kgMod.removeRelation,
       db: null,
     });
   }
@@ -550,6 +566,8 @@ async function initHub() {
     vault,
     kgSink: kgSink ? kgSink.write.bind(kgSink) : null,
     ragSink: ragSink ? ragSink.write.bind(ragSink) : null,
+    kgRemove: kgSink?.remove?.bind(kgSink) || null,
+    ragRemove: ragSink?.remove?.bind(ragSink) || null,
     entityResolver,
     adbReadiness: {
       probe: adbReadinessProbe,
@@ -557,6 +575,20 @@ async function initHub() {
     },
   });
 
+  // Both projections are in memory. A fresh registry consumer must rebuild
+  // from durable desired state before serving retrieval; leave failures
+  // visible and explicitly retryable instead of blocking startup forever.
+  if (typeof registry.retryDerivations === "function") {
+    for (let page = 0; page < 100; page += 1) {
+      const result = await registry.retryDerivations({ limit: 1000 });
+      if (!result.remaining) break;
+      // A referenced KG endpoint can occur on a later page. Visit fresh
+      // work before concluding that a failed dependency is unrecoverable.
+      if (result.summary?.pending > 0) continue;
+      if (!result.succeeded || result.unsupported || result.blocked) break;
+    }
+  }
+
   const engine = new AnalysisEngine({
     vault,
     llm,
@@ -2106,6 +2138,7 @@ export async function getHub() {
     _initPromise = initHub()
       .then((h) => {
         _hub = h;
+        installProcessExitHook();
         return h;
       })
       .catch((err) => {
@@ -2226,6 +2259,7 @@ export async function getHubMinimal() {
     _hubMinimalInitPromise = initHubMinimal()
       .then((h) => {
         _hubMinimal = h;
+        installProcessExitHook();
         return h;
       })
       .catch((err) => {
@@ -2236,7 +2270,11 @@ export async function getHubMinimal() {
   return _hubMinimalInitPromise;
 }
 
-export function close() {
+export function close({ retireConsumer = true } = {}) {
+  if (_processExitHook) {
+    process.removeListener("exit", _processExitHook);
+    _processExitHook = null;
+  }
   if (_hub && _hub.aichatHealthChecker) {
     try {
       _hub.aichatHealthChecker.stop();
@@ -2245,6 +2283,11 @@ export function close() {
     }
   }
   if (_hub && _hub.vault) {
+    try {
+      if (retireConsumer) _hub.registry?.retireDerivationConsumer?.();
+    } catch {
+      // Busy/unknown generations retain their receipts for explicit recovery.
+    }
     try {
       _hub.vault.close();
     } catch {

package/src/lib/process-execution-broker/index.js

@@ -46,6 +46,7 @@ import {
   SANDBOX_BOUNDARIES,
 } from "./platform-sandbox.js";
 import { normalizeLinuxCgroupPolicy } from "./linux-cgroup-v2.js";
+import { consumeWindowsNativeEvaluatorPolicy } from "./windows-native-evaluator.js";
 import { acquireLinuxSubreaperHelper } from "./linux-subreaper-helper.js";
 import { spawnLinuxSubreaperChild } from "./linux-subreaper-process.js";
 import {
@@ -1625,7 +1626,49 @@ class ProcessExecutionBroker extends EventEmitter {
       requiredBoundaries,
       launch,
     );
-    return { profile, requiredBoundaries, linuxCgroup, executionContract };
+    const wallTimeMs = rawPolicy?.limits?.wallTimeMs;
+    if (wallTimeMs !== undefined) {
+      if (
+        !Number.isSafeInteger(wallTimeMs) ||
+        wallTimeMs < 1 ||
+        wallTimeMs > 3600000
+      ) {
+        throw this._sandboxBoundaryError(
+          "invalid_wall_time_limit",
+          "Native wall-time limit must be an integer from 1 to 3600000 milliseconds",
+        );
+      }
+      if (!requiredBoundaries.includes(SANDBOX_BOUNDARIES.RESOURCE_LIMITS)) {
+        requiredBoundaries.push(SANDBOX_BOUNDARIES.RESOURCE_LIMITS);
+      }
+    }
+    const windowsNativeEvaluator =
+      rawPolicy?.windowsNativeEvaluator === undefined
+        ? null
+        : consumeWindowsNativeEvaluatorPolicy(
+            rawPolicy.windowsNativeEvaluator,
+            launch,
+            options,
+          );
+    if (windowsNativeEvaluator) {
+      for (const boundary of [
+        SANDBOX_BOUNDARIES.FILESYSTEM,
+        SANDBOX_BOUNDARIES.NETWORK,
+        SANDBOX_BOUNDARIES.PROCESS_TREE,
+        SANDBOX_BOUNDARIES.RESOURCE_LIMITS,
+      ]) {
+        if (!requiredBoundaries.includes(boundary))
+          requiredBoundaries.push(boundary);
+      }
+    }
+    return {
+      profile,
+      requiredBoundaries,
+      linuxCgroup,
+      executionContract,
+      ...(windowsNativeEvaluator ? { windowsNativeEvaluator } : {}),
+      ...(wallTimeMs !== undefined ? { wallTimeMs } : {}),
+    };
   }
 
   _stripSandboxControlOptions(options) {
@@ -3660,6 +3703,12 @@ class ProcessExecutionBroker extends EventEmitter {
       ...(sandboxPolicy.executionContract
         ? { executionContract: sandboxPolicy.executionContract }
         : {}),
+      ...(sandboxPolicy.wallTimeMs !== undefined
+        ? { limits: Object.freeze({ wallTimeMs: sandboxPolicy.wallTimeMs }) }
+        : {}),
+      ...(sandboxPolicy.windowsNativeEvaluator
+        ? { windowsNativeEvaluator: sandboxPolicy.windowsNativeEvaluator }
+        : {}),
     });
     // Keep the legacy string profile in argument four. The built-in adapter
     // reserves argument five for runtime injection, so the typed request is
@@ -3667,6 +3716,12 @@ class ProcessExecutionBroker extends EventEmitter {
     const sandboxAdapter = this._sandboxAdapter;
     const applySandboxAdapter = sandboxAdapter.applySandbox;
     const builtInSandboxAdapter = applySandboxAdapter === _applySandbox;
+    if (sandboxPolicy.wallTimeMs !== undefined && !builtInSandboxAdapter) {
+      throw this._sandboxBoundaryError(
+        "native_wall_time_adapter_unattested",
+        "Native wall-time enforcement requires the built-in Windows supervisor",
+      );
+    }
     // Never dispatch the built-in through a mutable Function property or a
     // global reflective helper after consulting an injected adapter getter.
     // The lexical import is the identity we checked and the implementation we
@@ -3690,6 +3745,41 @@ class ProcessExecutionBroker extends EventEmitter {
         ]);
     let plan;
     try {
+      if (
+        sandboxPolicy.wallTimeMs !== undefined &&
+        (!rawPlan?.applied ||
+          rawPlan.platform !== "win32" ||
+          ![
+            "windows-job-restricted-token",
+            "windows-appcontainer-job-restricted-token",
+          ].includes(rawPlan.backend) ||
+          rawPlan.windowsWallTimeMs !== sandboxPolicy.wallTimeMs)
+      ) {
+        throw this._sandboxBoundaryError(
+          "native_wall_time_limit_unavailable",
+          `The requested native wall-time limit was not enforced: ${rawPlan?.reason || "unattested_plan"}`,
+          {
+            requiredBoundaries,
+            actualGuarantees: rawPlan?.guarantees || [],
+            sandboxBackend: rawPlan?.backend,
+            sandboxCandidateBackend: rawPlan?.candidateBackend,
+            sandboxRuntimeProbe: rawPlan?.runtimeProbe,
+            sandboxCandidateReason: rawPlan?.reason,
+          },
+        );
+      }
+      if (
+        sandboxPolicy.windowsNativeEvaluator &&
+        (rawPlan.backend !== "windows-appcontainer-job-restricted-token" ||
+          rawPlan.policyAttested !== true ||
+          rawPlan.windowsNativeEvaluatorDigest !==
+            sandboxPolicy.windowsNativeEvaluator.manifestDigest)
+      ) {
+        throw this._sandboxBoundaryError(
+          "native_evaluator_plan_unattested",
+          "The staged native evaluator policy was not enforced",
+        );
+      }
       plan = this._validateSandboxPlan(rawPlan, {
         command,
         args: Object.freeze([...(args || [])]),