chainlesschain 0.166.90 → 0.166.91

package/src/commands/hub.js

@@ -3464,7 +3464,11 @@ async function cmdDerivation(operation, reference, options = {}) {
         "Normalized entity deletion requires --confirm; raw archive is retained",
       );
     }
-    if (operation === "prune" && options.confirm !== true) {
+    if (
+      operation === "prune" &&
+      options.confirm !== true &&
+      options.dryRun !== true
+    ) {
       throw new Error("Retired derivation receipt pruning requires --confirm");
     }
     if (
@@ -3482,23 +3486,73 @@ async function cmdDerivation(operation, reference, options = {}) {
     if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000) {
       throw new Error("Derivation limit must be between 1 and 1000");
     }
-    const hub = await (options._getHub || getHub)();
+    const budget = {};
+    for (const name of ["maxVaultBytes", "minFreeBytes", "reserveBytes"]) {
+      if (options[name] === undefined) continue;
+      const value = Number(options[name]);
+      if (!Number.isSafeInteger(value) || value < 0)
+        throw new Error(`${name} must be a non-negative safe integer`);
+      budget[name] = value;
+    }
+    if (options.audit && (options.state || options.kind)) {
+      throw new Error(
+        "Consumer audit includes all kinds and states; omit --kind and --state",
+      );
+    }
+    if (
+      operation === "status" &&
+      Object.keys(budget).length &&
+      !options.storage
+    ) {
+      throw new Error(
+        "Storage budget options require --storage for derivation-status",
+      );
+    }
+    // Check before constructing a registry: full hub startup may rebuild indexes.
+    if (operation === "retry" && Object.keys(budget).length) {
+      const minimal = await (options._getHub || getHubMinimal)();
+      minimal.vault.assertStorageBudget(budget);
+    }
+    if (operation === "status" && options.storage) {
+      if (options.adapter !== undefined || options.scope !== undefined) {
+        throw new Error(
+          "Storage reports cover the whole vault; omit --adapter and --scope",
+        );
+      }
+      const minimal = await (options._getHub || getHubMinimal)();
+      const result = { storage: minimal.vault.assertStorageBudget(budget) };
+      printJson(result);
+      return result;
+    }
+    const hub = await (
+      options._getHub ||
+      (operation === "consumers" || (operation === "prune" && options.dryRun)
+        ? getHubMinimal
+        : getHub)
+    )();
     const filters = { adapter: options.adapter, scope: options.scope };
     let result;
     if (operation === "consumers") {
-      result = hub.vault.getDerivationStore().listConsumers({
-        state: options.state,
-        kind: options.kind,
-        afterConsumerId: options.after,
-        limit,
-      });
+      result = options.audit
+        ? hub.vault.getDerivationStore().auditConsumers({
+            afterConsumerId: options.after,
+            limit,
+          })
+        : hub.vault.getDerivationStore().listConsumers({
+            state: options.state,
+            kind: options.kind,
+            afterConsumerId: options.after,
+            limit,
+          });
     } else if (operation === "prune") {
       result = hub.vault.getDerivationStore().pruneRetiredConsumers({
         consumerIds: options.consumer,
-        activeConsumerId: hub.registry.consumerId,
+        activeConsumerId: hub.registry?.consumerId,
         limit,
+        ...(options.dryRun ? { dryRun: true } : {}),
       });
     } else if (operation === "retry") {
+      if (Object.keys(budget).length) hub.vault.assertStorageBudget(budget);
       result = await hub.registry.retryDerivations({ ...filters, limit });
     } else if (operation === "state") {
       result = hub.vault
@@ -3668,8 +3722,23 @@ export function registerHubCommand(program, dependencies = {}) {
       .option("--adapter <name>", "Filter by source adapter")
       .option("--scope <scope>", "Filter by source scope")
       .option("--json", "Output JSON");
+    command
+      .option("--max-vault-bytes <n>", "Preflight maximum DB + WAL + SHM bytes")
+      .option(
+        "--min-free-bytes <n>",
+        "Preflight minimum free disk bytes after reserve",
+      )
+      .option(
+        "--reserve-bytes <n>",
+        "Caller-estimated extra bytes for preflight (not a reservation)",
+      );
     if (operation === "retry")
       command.option("--limit <n>", "Maximum deliveries (1-1000)", "100");
+    else
+      command.option(
+        "--storage",
+        "Inspect storage only and check the supplied byte budget",
+      );
     command.action((options) => cmdDerivation(operation, null, options));
   }
 
@@ -3679,6 +3748,10 @@ export function registerHubCommand(program, dependencies = {}) {
       "List registered derivation consumers without retirement tokens",
     )
     .option("--state <state>", "Filter by active or retired")
+    .option(
+      "--audit",
+      "Inventory registered and historical consumers with retention reasons and receipt counts",
+    )
     .option("--kind <kind>", "Filter by ephemeral or persistent")
     .option("--after <id>", "Continue after a consumer ID")
     .option("--limit <n>", "Maximum consumers (1-1000)", "100")
@@ -3693,6 +3766,10 @@ export function registerHubCommand(program, dependencies = {}) {
     .requiredOption("--consumer <ids...>", "Retired consumer IDs (1-100)")
     .option("--limit <n>", "Maximum receipts removed (1-1000)", "100")
     .option("--confirm", "Confirm removal of these retired projection receipts")
+    .option(
+      "--dry-run",
+      "Validate IDs and preview bounded receipt cleanup without deletion",
+    )
     .option("--json", "Output JSON")
     .action((options) => cmdDerivation("prune", null, options));
 

package/src/data/changelog.json

@@ -1,16 +1,29 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.91",
+      "cliVersions": ["0.166.91"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.91: cross-platform release validation",
+          "body": "- Accept verified directory identities through the Windows Server 2025 native\n  file-information API, while retaining handle binding and reparse-point checks.\n- Preserve Windows native evaluator failure and cleanup evidence when the helper\n  cannot publish a settlement. Compare journal identities within their pathname\n  and descriptor domains on supported Node versions.\n- Keep literal audit search assertions independent of redacted operation text;\n  verify that unsafe legacy text remains omitted from query results.\n- Give the receipt signer deadline test enough admission time on hosted runners\n  and verify that the signer is actually invoked before its bounded timeout.\n- Regenerate the bundled CLI changelog from its canonical source.\n- Capture JetBrains transcript snapshots on the event dispatch thread during\n  cross-platform host validation, retaining the full transcript assertions.\n- Preserve equivalent protected Windows evaluator ACLs across .NET Framework\n  and PowerShell's .NET runtime through the native security API.\n- Retry cooperative lock release during nested safe owner reads without treating\n  it as corruption; losing a held lock still fails closed.\n- Pin the patched `shell-quote` dependency in both workspace and standalone\n  desktop installs to reject command injection after shell comment tokens.\n- Publish Session Core `0.3.16` and Personal Data Hub `0.4.64` before CLI\n  `0.166.91`, with exact dependency pins and public package verification.\n- Pair VS Code `0.37.136` and JetBrains `0.4.154` with CLI `0.166.91` after\n  the full exact-commit CLI and IDE validation workflows pass."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.90",
       "cliVersions": ["0.166.90"],
-      "date": null,
+      "date": "2026-10-06",
       "title": "",
       "sections": [
         {
           "heading": "Added - cc CLI 0.166.90: recoverable projections and project risk evidence",
-          "body": "- Publish Personal Data Hub `0.4.63` and Session Core `0.3.15` before the CLI,\n  with exact dependency pins and public tarball verification. Require the full\n  PDH suite with its declared native SQLCipher driver on Linux, Windows and macOS.\n- Publish Agent SDK `0.2.13` with Vitest `4.1.11` test tooling to remove the\n  vulnerable Tinypool dependency, and upgrade the workspace proxy-addr to\n  `2.0.8`. Require SDK build and tests on the exact Linux, Windows and macOS\n  release commit before OIDC publication.\n- Persist PDH projection receipts, recover incomplete derivations and support\n  bounded receipt retention. Harden RAG updates, audit redaction and capability\n  reporting so unavailable sources do not appear as successful live collection.\n- Add offline project risk evaluation and version-bound task description\n  previews. Session Core also supplies native SQLite action/read services and\n  saved rule/source reviews for the desktop project workbench; CLI previews\n  carry unverified snapshot authority and do not execute those desktop actions.\n- Pair VS Code `0.37.135` and JetBrains `0.4.153` with CLI `0.166.90` after\n  exact-commit release checks and public npm readback."
+          "body": "- Verified on 2026-10-06: exact release commit `28cff6adc8` passed complete\n  CLI CI, Strict Sandbox, IDE host and security gates. Session Core `0.3.15`,\n  Agent SDK `0.2.13`, PDH `0.4.63` and CLI `0.166.90` were published through\n  GitHub Actions OIDC with independent public archive verification. Open VSX\n  `0.37.135` and JetBrains `0.4.153` are public; both publication workflows\n  succeeded, and JetBrains approval/listing was independently read back.\n  Desktop workbench changes are outside the separate v5.0.3.138 installer.\n- Publish Personal Data Hub `0.4.63` and Session Core `0.3.15` before the CLI,\n  with exact dependency pins and public tarball verification. Require the full\n  PDH suite with its declared native SQLCipher driver on Linux, Windows and macOS.\n- Publish Agent SDK `0.2.13` with Vitest `4.1.11` test tooling to remove the\n  vulnerable Tinypool dependency, and upgrade the workspace proxy-addr to\n  `2.0.8`. Require SDK build and tests on the exact Linux, Windows and macOS\n  release commit before OIDC publication.\n- Persist PDH projection receipts, recover incomplete derivations and support\n  bounded receipt retention. Harden RAG updates, audit redaction and capability\n  reporting so unavailable sources do not appear as successful live collection.\n- Add offline project risk evaluation and version-bound task description\n  previews. Session Core also supplies native SQLite action/read services and\n  saved rule/source reviews for the desktop project workbench; CLI previews\n  carry unverified snapshot authority and do not execute those desktop actions.\n- Pair VS Code `0.37.135` and JetBrains `0.4.153` with CLI `0.166.90` after\n  exact-commit release checks and public npm readback."
         }
       ]
     },

package/src/lib/audit-logger.js

@@ -7,6 +7,17 @@ import crypto from "crypto";
 import { safeJsonParse } from "./safe-json.js";
 import { escapeLike } from "./sql-like.js";
 import { sanitizeAuditDetails } from "./audit-sanitizer.js";
+import auditDataPolicy from "@chainlesschain/session-core/audit-data-policy";
+import restrictedAudit from "@chainlesschain/session-core/restricted-audit-store";
+
+const { projectAuditMetadata, projectAuditField, validateRetentionDays } =
+  auditDataPolicy;
+
+// Host API: authorization must come from the invoking host, never event details.
+// No general audit query/export includes this separate store.
+export function createAuditDiagnostics(db, options) {
+  return new restrictedAudit.RestrictedAuditStore(db, options);
+}
 
 /**
  * Event types for audit logging.
@@ -117,7 +128,7 @@ export function sanitizeDetails(details) {
 }
 
 function sanitizeErrorMessage(value) {
-  const sanitized = sanitizeDetails(value);
+  const sanitized = projectAuditMetadata(value);
   if (sanitized == null) return null;
   return typeof sanitized === "object"
     ? JSON.stringify(sanitized)
@@ -131,23 +142,24 @@ export function logEvent(db, event) {
   ensureAuditTables(db);
 
   const id = crypto.randomUUID();
-  const sanitized = sanitizeDetails(event.details);
-  const risk =
-    event.riskLevel || assessRisk(event.eventType, event.operation, sanitized);
+  const sanitized = projectAuditMetadata(event.details);
+  const risk = Object.values(RISK_LEVELS).includes(event.riskLevel)
+    ? event.riskLevel
+    : assessRisk(event.eventType, event.operation || "unknown", sanitized);
 
   db.prepare(
     `INSERT INTO audit_log (id, event_type, operation, actor, target, details, risk_level, ip_address, user_agent, success, error_message)
      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   ).run(
     id,
-    event.eventType || EVENT_TYPES.SYSTEM,
-    event.operation || "unknown",
-    event.actor || null,
-    event.target || null,
+    projectAuditField("eventType", event.eventType || EVENT_TYPES.SYSTEM),
+    projectAuditField("operation", event.operation || "unknown"),
+    projectAuditField("actor", event.actor || null),
+    projectAuditField("target", event.target || null),
     sanitized == null ? null : JSON.stringify(sanitized),
     risk,
-    event.ipAddress || null,
-    event.userAgent || null,
+    event.ipAddress ? projectAuditField("ipAddress", event.ipAddress) : null,
+    event.userAgent ? projectAuditField("userAgent", event.userAgent) : null,
     event.success !== false ? 1 : 0,
     sanitizeErrorMessage(event.errorMessage),
   );
@@ -220,8 +232,21 @@ export function queryLogs(db, filters = {}) {
   const rows = db.prepare(sql).all(...params);
   return rows.map((r) => ({
     ...r,
+    event_type: projectAuditField("eventType", r.event_type),
+    operation: projectAuditField("operation", r.operation),
     // One corrupt details cell must not throw out of the whole query.
-    details: safeJsonParse(r.details, null),
+    details: projectAuditMetadata(safeJsonParse(r.details, null)),
+    error_message: sanitizeErrorMessage(
+      safeJsonParse(r.error_message, r.error_message),
+    ),
+    actor: projectAuditField("actor", r.actor),
+    target: projectAuditField("target", r.target),
+    ip_address: r.ip_address
+      ? projectAuditField("ipAddress", r.ip_address)
+      : null,
+    user_agent: r.user_agent
+      ? projectAuditField("userAgent", r.user_agent)
+      : null,
     success: r.success === 1,
   }));
 }
@@ -333,6 +358,7 @@ export function exportLogs(db, format = "json", filters = {}) {
  * Delete old audit logs.
  */
 export function purgeLogs(db, daysToKeep = 90) {
+  validateRetentionDays(daysToKeep);
   ensureAuditTables(db);
 
   const cutoff = new Date();
@@ -502,7 +528,7 @@ export function logEventV2(
   if (_logStatesV2.has(logId)) {
     throw new Error(`Log already registered: ${logId}`);
   }
-  const sanitized = sanitizeDetails(details);
+  const sanitized = projectAuditMetadata(details);
   const risk = riskLevel || assessRisk(eventType, operation, sanitized);
   if (!RISK_LEVELS_V2.includes(risk)) {
     throw new Error(`Invalid riskLevel: ${risk}`);
@@ -510,14 +536,14 @@ export function logEventV2(
   const now = Date.now();
   const entry = {
     logId,
-    eventType,
-    operation,
-    actor: actor || null,
-    target: target || null,
+    eventType: projectAuditField("eventType", eventType),
+    operation: projectAuditField("operation", operation),
+    actor: projectAuditField("actor", actor || null),
+    target: projectAuditField("target", target || null),
     details: sanitized ?? null,
     riskLevel: risk,
-    ipAddress: ipAddress || null,
-    userAgent: userAgent || null,
+    ipAddress: ipAddress ? projectAuditField("ipAddress", ipAddress) : null,
+    userAgent: userAgent ? projectAuditField("userAgent", userAgent) : null,
     success: success !== false,
     errorMessage: sanitizeErrorMessage(errorMessage),
     status: LOG_STATUS_V2.ACTIVE,
@@ -539,8 +565,8 @@ export function logEventV2(
       _alertStatesV2.set(alertId, {
         alertId,
         logId,
-        actor,
-        operation,
+        actor: entry.actor,
+        operation: entry.operation,
         riskLevel: risk,
         status: ALERT_STATUS_V2.OPEN,
         reason: null,

package/src/lib/checkpoint-restore-saga.js

@@ -464,6 +464,16 @@ function isMissingPathError(error) {
   return error?.code === "ENOENT" || error?.cause?.code === "ENOENT";
 }
 
+function hasMissingLockPathCause(error) {
+  // A bounded owner read wraps secure-parent errors, which themselves wrap
+  // ENOENT when a cooperating process detaches its released lock directory.
+  // Only unlocked lock inspection uses this; losing our held owner still fails.
+  for (let depth = 0; error && depth < 8; depth++, error = error.cause) {
+    if (error.code === "ENOENT") return true;
+  }
+  return false;
+}
+
 function attachCommitState(error, details) {
   if (!error || typeof error !== "object") return error;
   for (const [key, value] of Object.entries(details)) {
@@ -1887,7 +1897,7 @@ export class CheckpointRestoreSagaStore {
       // The same valid release can happen after readdir observed owner.json
       // but before its lstat/read. Only tolerate absence during the unlocked
       // pre/postflight inspection; losing our own owner still fails closed.
-      if (isMissingPathError(cause) && !requireOwner) return null;
+      if (hasMissingLockPathCause(cause) && !requireOwner) return null;
       throw sagaError(
         CHECKPOINT_RESTORE_SAGA_ERROR_CODES.LOCK_FAILED,
         "Saga state lock owner is corrupt or unbounded",

package/src/lib/eval/verify01-host-evidence.js

@@ -149,13 +149,46 @@ export function inspectIdeProtocol(records, { prompt, comparison } = {}) {
       resultRecords[0].event.session_id === sessionId,
     "IDE terminal is missing or ambiguous",
   );
+  const terminal = resultRecords[0].event;
+  // Persistent headless streams emit one lifecycle end after stdin closes.
+  // Accept only that exact, same-session one-turn trailer; task output after
+  // the result stays ambiguous. Keep the complete capture intact.
+  const trailing = outputs.slice(outputs.indexOf(resultRecords[0]) + 1);
+  const end = trailing[0]?.event;
+  const lifecycleFrames = outputs.filter(
+    (record) =>
+      record.event.type === "system" && record.event.subtype === "end",
+  );
+  const lifecycleEnded =
+    trailing.length === 1 &&
+    lifecycleFrames.length === 1 &&
+    end.type === "system" &&
+    end.subtype === "end" &&
+    end.session_id === sessionId &&
+    end.turns === 1 &&
+    terminal.turn === 1 &&
+    Object.keys(end).every((key) =>
+      ["type", "subtype", "session_id", "turns", "trace_id", "seq"].includes(
+        key,
+      ),
+    ) &&
+    (end.trace_id === undefined ||
+      (typeof end.trace_id === "string" &&
+        end.trace_id === terminal.trace_id)) &&
+    (end.seq === undefined ||
+      (Number.isSafeInteger(end.seq) &&
+        Number.isSafeInteger(terminal.seq) &&
+        end.seq === terminal.seq + 1));
+  const taskOutputs = lifecycleEnded ? outputs.slice(0, -1) : outputs;
   const parsed = verifyAgentTerminal(
-    outputs.map((record) => JSON.stringify(record.event)).join("\n"),
+    taskOutputs.map((record) => JSON.stringify(record.event)).join("\n"),
   );
-  const terminal = resultRecords[0].event;
+  if (lifecycleFrames.length > 0 && !lifecycleEnded)
+    parsed.terminalVerified = false;
   // A complete explicit failure is an observation. It never becomes success.
   const knownFailure =
-    outputs.at(-1) === resultRecords[0] &&
+    taskOutputs.at(-1) === resultRecords[0] &&
+    (lifecycleFrames.length === 0 || lifecycleEnded) &&
     terminal.is_error === true &&
     typeof terminal.subtype === "string" &&
     terminal.subtype.length > 0 &&

package/src/lib/process-execution-broker/index.js

@@ -46,6 +46,7 @@ import {
   SANDBOX_BOUNDARIES,
 } from "./platform-sandbox.js";
 import { normalizeLinuxCgroupPolicy } from "./linux-cgroup-v2.js";
+import { consumeWindowsNativeEvaluatorPolicy } from "./windows-native-evaluator.js";
 import { acquireLinuxSubreaperHelper } from "./linux-subreaper-helper.js";
 import { spawnLinuxSubreaperChild } from "./linux-subreaper-process.js";
 import {
@@ -1625,7 +1626,49 @@ class ProcessExecutionBroker extends EventEmitter {
       requiredBoundaries,
       launch,
     );
-    return { profile, requiredBoundaries, linuxCgroup, executionContract };
+    const wallTimeMs = rawPolicy?.limits?.wallTimeMs;
+    if (wallTimeMs !== undefined) {
+      if (
+        !Number.isSafeInteger(wallTimeMs) ||
+        wallTimeMs < 1 ||
+        wallTimeMs > 3600000
+      ) {
+        throw this._sandboxBoundaryError(
+          "invalid_wall_time_limit",
+          "Native wall-time limit must be an integer from 1 to 3600000 milliseconds",
+        );
+      }
+      if (!requiredBoundaries.includes(SANDBOX_BOUNDARIES.RESOURCE_LIMITS)) {
+        requiredBoundaries.push(SANDBOX_BOUNDARIES.RESOURCE_LIMITS);
+      }
+    }
+    const windowsNativeEvaluator =
+      rawPolicy?.windowsNativeEvaluator === undefined
+        ? null
+        : consumeWindowsNativeEvaluatorPolicy(
+            rawPolicy.windowsNativeEvaluator,
+            launch,
+            options,
+          );
+    if (windowsNativeEvaluator) {
+      for (const boundary of [
+        SANDBOX_BOUNDARIES.FILESYSTEM,
+        SANDBOX_BOUNDARIES.NETWORK,
+        SANDBOX_BOUNDARIES.PROCESS_TREE,
+        SANDBOX_BOUNDARIES.RESOURCE_LIMITS,
+      ]) {
+        if (!requiredBoundaries.includes(boundary))
+          requiredBoundaries.push(boundary);
+      }
+    }
+    return {
+      profile,
+      requiredBoundaries,
+      linuxCgroup,
+      executionContract,
+      ...(windowsNativeEvaluator ? { windowsNativeEvaluator } : {}),
+      ...(wallTimeMs !== undefined ? { wallTimeMs } : {}),
+    };
   }
 
   _stripSandboxControlOptions(options) {
@@ -3660,6 +3703,12 @@ class ProcessExecutionBroker extends EventEmitter {
       ...(sandboxPolicy.executionContract
         ? { executionContract: sandboxPolicy.executionContract }
         : {}),
+      ...(sandboxPolicy.wallTimeMs !== undefined
+        ? { limits: Object.freeze({ wallTimeMs: sandboxPolicy.wallTimeMs }) }
+        : {}),
+      ...(sandboxPolicy.windowsNativeEvaluator
+        ? { windowsNativeEvaluator: sandboxPolicy.windowsNativeEvaluator }
+        : {}),
     });
     // Keep the legacy string profile in argument four. The built-in adapter
     // reserves argument five for runtime injection, so the typed request is
@@ -3667,6 +3716,12 @@ class ProcessExecutionBroker extends EventEmitter {
     const sandboxAdapter = this._sandboxAdapter;
     const applySandboxAdapter = sandboxAdapter.applySandbox;
     const builtInSandboxAdapter = applySandboxAdapter === _applySandbox;
+    if (sandboxPolicy.wallTimeMs !== undefined && !builtInSandboxAdapter) {
+      throw this._sandboxBoundaryError(
+        "native_wall_time_adapter_unattested",
+        "Native wall-time enforcement requires the built-in Windows supervisor",
+      );
+    }
     // Never dispatch the built-in through a mutable Function property or a
     // global reflective helper after consulting an injected adapter getter.
     // The lexical import is the identity we checked and the implementation we
@@ -3690,6 +3745,41 @@ class ProcessExecutionBroker extends EventEmitter {
         ]);
     let plan;
     try {
+      if (
+        sandboxPolicy.wallTimeMs !== undefined &&
+        (!rawPlan?.applied ||
+          rawPlan.platform !== "win32" ||
+          ![
+            "windows-job-restricted-token",
+            "windows-appcontainer-job-restricted-token",
+          ].includes(rawPlan.backend) ||
+          rawPlan.windowsWallTimeMs !== sandboxPolicy.wallTimeMs)
+      ) {
+        throw this._sandboxBoundaryError(
+          "native_wall_time_limit_unavailable",
+          `The requested native wall-time limit was not enforced: ${rawPlan?.reason || "unattested_plan"}`,
+          {
+            requiredBoundaries,
+            actualGuarantees: rawPlan?.guarantees || [],
+            sandboxBackend: rawPlan?.backend,
+            sandboxCandidateBackend: rawPlan?.candidateBackend,
+            sandboxRuntimeProbe: rawPlan?.runtimeProbe,
+            sandboxCandidateReason: rawPlan?.reason,
+          },
+        );
+      }
+      if (
+        sandboxPolicy.windowsNativeEvaluator &&
+        (rawPlan.backend !== "windows-appcontainer-job-restricted-token" ||
+          rawPlan.policyAttested !== true ||
+          rawPlan.windowsNativeEvaluatorDigest !==
+            sandboxPolicy.windowsNativeEvaluator.manifestDigest)
+      ) {
+        throw this._sandboxBoundaryError(
+          "native_evaluator_plan_unattested",
+          "The staged native evaluator policy was not enforced",
+        );
+      }
       plan = this._validateSandboxPlan(rawPlan, {
         command,
         args: Object.freeze([...(args || [])]),

package/src/lib/process-execution-broker/platform-sandbox.js

@@ -783,6 +783,8 @@ function normalizeSandboxRequest(profileOrRequest, explicitRequest) {
     profile,
     requiredBoundaries,
     sync: request.sync === true,
+    wallTimeMs: request.limits?.wallTimeMs,
+    windowsNativeEvaluator: request.windowsNativeEvaluator || null,
     pty: request.pty === true,
     linuxCgroup: normalizeLinuxCgroupPolicy(request.linuxCgroup),
     executionContract:
@@ -2106,6 +2108,12 @@ export function applyMacSandbox(
       reason: "platform_mismatch",
     });
   }
+  if (sandboxOpts.limits?.wallTimeMs !== undefined) {
+    return createSandboxPlan({
+      ...base,
+      reason: "native_wall_time_limit_unsupported",
+    });
+  }
 
   if (
     Array.isArray(sandboxOpts.requiredBoundaries) &&
@@ -4205,10 +4213,14 @@ function windowsAppContainerPolicyDigest({
       },
       job: {
         killOnClose: true,
+        wallTimeMs: launchSpec.wallTimeMs,
         activeProcessLimit: launchSpec.activeProcessLimit,
         cpuSeconds: launchSpec.cpuSeconds,
         processMemoryBytes: launchSpec.processMemoryBytes,
       },
+      ...(launchSpec.nativeEvaluator
+        ? { nativeEvaluator: launchSpec.nativeEvaluator }
+        : {}),
       execution: {
         contractKind: executionContract?.kind || null,
         contentSnapshot: snapshotLocks.length > 0,
@@ -4310,6 +4322,15 @@ export function applyWindowsSandbox(
   if (runtime.platform !== "win32") {
     return unavailablePlan("platform_mismatch");
   }
+  const wallTimeMs = sandboxOpts.limits?.wallTimeMs ?? 0;
+  if (
+    sandboxOpts.limits?.wallTimeMs !== undefined &&
+    (!Number.isSafeInteger(wallTimeMs) ||
+      wallTimeMs < 1 ||
+      wallTimeMs > 3600000)
+  ) {
+    return unavailablePlan("windows_wall_time_limit_invalid");
+  }
   let windowsDirectory;
   try {
     windowsDirectory = path.win32.resolve(runtime.windowsDir());
@@ -4499,6 +4520,7 @@ export function applyWindowsSandbox(
     }
   }
   const launchSpec = {
+    wallTimeMs,
     cpuSeconds: Number(limits.cpu || 0),
     processMemoryBytes: Number(
       limits.as || (profile === "strict" ? 256 * 1024 * 1024 : 0),
@@ -4516,6 +4538,9 @@ export function applyWindowsSandbox(
     windowsHide: invocation.options.windowsHide === true,
     workingDirectory: targetWorkingDirectory,
     environment: targetEnvironment,
+    ...(sandboxOpts.windowsNativeEvaluator
+      ? { nativeEvaluator: sandboxOpts.windowsNativeEvaluator }
+      : {}),
   };
   if (entrySnapshot.locks) {
     launchSpec.launchPathLocks = entrySnapshot.locks;
@@ -4917,6 +4942,9 @@ export function applyWindowsSandbox(
     policyAttested: requiresAppContainer ? true : null,
     policyDigest: appContainerPolicyDigest,
     adapterTempRootAttestation: adapterSource.tempRootAttestation,
+    windowsWallTimeMs: wallTimeMs || null,
+    windowsNativeEvaluatorDigest:
+      sandboxOpts.windowsNativeEvaluator?.manifestDigest || null,
     runtimeProbe: entrySnapshotRuntimeProbe,
     guarantees: [
       ...(requiresAppContainer
@@ -8896,6 +8924,13 @@ export function applyLinuxSandbox(
     });
   }
 
+  if (sandboxOpts.limits?.wallTimeMs !== undefined) {
+    return createSandboxPlan({
+      ...base,
+      reason: "native_wall_time_limit_unsupported",
+    });
+  }
+
   const { limits = {} } = sandboxOpts;
   const requiredBoundaries = Array.isArray(sandboxOpts.requiredBoundaries)
     ? sandboxOpts.requiredBoundaries
@@ -9984,7 +10019,14 @@ export function applySandbox(
     pty: sandboxRequest.pty,
     linuxCgroup: sandboxRequest.linuxCgroup,
     executionContract: sandboxRequest.executionContract,
+    windowsNativeEvaluator: sandboxRequest.windowsNativeEvaluator,
   };
+  if (sandboxRequest.wallTimeMs !== undefined) {
+    profile.limits = {
+      ...profile.limits,
+      wallTimeMs: sandboxRequest.wallTimeMs,
+    };
+  }
 
   const applyRequestedLinuxCgroup = (plan) =>
     applyLinuxCgroupV2ToPlan(plan, sandboxRequest.linuxCgroup, {