chati-dev 4.5.27 → 4.5.29

package/src/terminal/browser-observer.js

@@ -0,0 +1,95 @@
+import { createHash } from 'node:crypto';
+import { chmodSync, copyFileSync, lstatSync, mkdtempSync, readFileSync, realpathSync, rmSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import { dirname, isAbsolute, join } from 'node:path';
+import { validateBrowserObservationPlan } from '@chati/planning';
+export { validateBrowserObservationPlan } from '@chati/planning';
+import { browserRuntimeLayout, copyObserverRuntime, observerRuntimeDigest } from './browser-runtime.js';
+import { prepareExecutableSnapshot, assertExecutableSnapshot, disposeExecutableSnapshot } from './executable-snapshot.js';
+import { runIsolatedBrowserSupervisor } from './spawner.js';
+import { runDarwinBrowserObservation } from './darwin-browser-observer.js';
+import { browserObservationCompleted } from './browser-process-facts.js';
+
+const require = createRequire(import.meta.url);
+const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
+const bindingFor = (path) => ({ executable_path: realpathSync(path), executable_sha256: digest(readFileSync(path)) });
+function fail(message, code = 'BROWSER_OBSERVATION_INVALID') { throw Object.assign(new Error(message), { code }); }
+function text(value, limit = 8192) { return typeof value === 'string' && value.length > 0 && !value.includes('\0') && Buffer.byteLength(value) <= limit; }
+
+function cleanupResources(runtime, browserImage, application) {
+  let cleanupError;
+  for (const cleanup of [() => { if (runtime) rmSync(runtime, { recursive: true, force: true }); },
+    () => { if (browserImage) disposeExecutableSnapshot(browserImage); },
+    () => { if (application) disposeExecutableSnapshot(application); }]) {
+    try { cleanup(); } catch (error) { cleanupError ??= error; }
+  }
+  if (cleanupError) throw cleanupError;
+}
+
+/** Real local observation only. It does not select a commit, approve a policy,
+ * retain artifacts or sign evidence. The canonical RAIL observer owns those gates.
+ */
+export async function runIsolatedBrowserObservation(input = {}) {
+  if (!input || typeof input !== 'object' || !text(input.workingDir) || !isAbsolute(input.workingDir)) fail('browser requires an absolute disposable subject');
+  const { workingDir, ...planInput } = input;
+  const plan = structuredClone(validateBrowserObservationPlan(planInput));
+  if (process.platform === 'darwin' ? plan.application.listener_transport !== 'darwin_prebound_tcp_v1'
+    : Object.hasOwn(plan.application, 'listener_transport')) fail('application listener transport does not match this host', 'BROWSER_APPLICATION_LISTENER_TRANSPORT_REQUIRED');
+  const project = realpathSync(workingDir);
+  const nodeBinding = bindingFor(process.execPath);
+  let runtime; let application; let browserImage;
+  try {
+    const packagePath = require.resolve('playwright-core/package.json');
+    if (JSON.parse(readFileSync(packagePath, 'utf8')).version !== plan.browser.playwright_version) fail('installed Playwright does not match the approved driver version', 'BROWSER_DRIVER_DRIFT');
+    application = prepareExecutableSnapshot(plan.application.executable_binding, { projectDir: project, requireNativeImage: true });
+    browserImage = prepareExecutableSnapshot(plan.browser.executable_binding, { projectDir: project, requireNativeImage: true });
+    runtime = mkdtempSync(join(realpathSync(tmpdir()), 'chati-browser-observer-tools-'));
+    copyObserverRuntime(dirname(packagePath), join(runtime, 'playwright-core'), project);
+    copyFileSync(new URL('./browser-observer-driver.js', import.meta.url), join(runtime, 'observer-driver.mjs'));
+    const layout = browserRuntimeLayout(plan.browser.executable_binding.executable_path);
+    copyObserverRuntime(layout.source, join(runtime, 'chromium', layout.directory), project, { internalLinks: layout.internalLinks });
+    // Replace the launch image with bytes copied through the already pinned fd.
+    const browserPath = join(runtime, 'chromium', layout.executable);
+    const browserStat = lstatSync(browserPath);
+    if (!browserStat.isFile() || browserStat.nlink !== 1) fail('copied browser launch image must be a single regular file');
+    copyFileSync(browserImage.executablePath, browserPath);
+    copyFileSync(application.executablePath, join(runtime, 'application'));
+    chmodSync(join(runtime, 'application'), 0o500);
+    assertExecutableSnapshot(application); assertExecutableSnapshot(browserImage);
+    const runtime_digest = observerRuntimeDigest(runtime);
+    const config = { ...plan, working_dir: project, browser_file: layout.executable };
+    let facts; let darwin;
+    if (process.platform === 'darwin') {
+      darwin = await runDarwinBrowserObservation({ workingDir: project, runtimeDirectory: runtime,
+        browserFile: layout.executable, nodeBinding, plan });
+      facts = darwin.facts;
+    } else {
+      const supervisor = readFileSync(new URL('./browser-observer-supervisor.js', import.meta.url), 'utf8');
+      facts = await runIsolatedBrowserSupervisor({ workingDir: project, executableBinding: nodeBinding,
+        args: ['--input-type=module'], stdin: `const configuration = ${JSON.stringify(config)};\n${supervisor}`,
+        timeoutMs: plan.timeout_ms, observerDirectory: runtime });
+    }
+    if (observerRuntimeDigest(runtime) !== runtime_digest) fail('observer runtime changed during observation', 'BROWSER_RUNTIME_DRIFT');
+    const process_facts = Object.fromEntries(Object.entries(facts).filter(([key]) => !['stdout', 'stderr', 'stdout_base64', 'stderr_base64'].includes(key)));
+    const base = { schema_version: 1, evidence_class: 'real-browser-observation', tool: 'chati-playwright-api-v1',
+      runtime_digest, node_binding: nodeBinding, application_binding: plan.application.executable_binding,
+      browser_binding: plan.browser.executable_binding, playwright_version: plan.browser.playwright_version, process_facts,
+      ...(darwin ? { darwin_browser_binding: darwin.binding, application_stopped: false,
+        application_group_stopped: darwin.binding.application.process_group_stopped } : {}) };
+    if (facts.exit_code !== 0 || facts.signal !== null || facts.timed_out || facts.output_limit_exceeded || facts.input_error) {
+      return Object.freeze({ ...base, passed: false, error_code: facts.timed_out ? 'BROWSER_OBSERVATION_TIMEOUT' : 'BROWSER_OBSERVER_PROCESS_FAILED', steps: [], artifacts: [] });
+    }
+    let observed;
+    try { observed = JSON.parse(facts.stdout); } catch { fail('trusted browser observer returned invalid output', 'BROWSER_OBSERVER_OUTPUT_INVALID'); }
+    // Subprocess output describes the scenario, never the host's private
+    // process bindings. In particular it cannot replace Darwin app completion.
+    const result = { ...observed, ...base };
+    if (!browserObservationCompleted(result, { workingDir: project, ...plan })) {
+      return Object.freeze({ ...base, passed: false, error_code: 'BROWSER_OBSERVER_PROCESS_FAILED', steps: [], artifacts: [] });
+    }
+    return Object.freeze(result);
+  } finally {
+    cleanupResources(runtime, browserImage, application);
+  }
+}

package/src/terminal/browser-process-facts.js

@@ -0,0 +1,75 @@
+/** Typed browser completion, not a certificate or native authentication source.
+ * The canonical caller obtains these facts only from its private observer. */
+import { createHash } from 'node:crypto';
+import { readFileSync, realpathSync } from 'node:fs';
+import { isAbsolute, join, relative, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { sha256 } from '@chati/core';
+import { verificationProcessCompleted } from './verification-process-facts.js';
+
+function invalid() { throw Object.assign(new Error('browser requires bound observer, application and endpoint completion'), { code: 'BROWSER_COMPLETION_INVALID' }); }
+function canonicalPath(value) { return typeof value === 'string' && isAbsolute(value) && resolve(value) === value
+  && !Array.from(value).some(character => character.codePointAt(0) < 32 || character.codePointAt(0) === 127); }
+function contains(root, child) { const part = relative(root, child); return !part || (part !== '..' && !part.startsWith('../') && !isAbsolute(part)); }
+const hash = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+
+export function darwinBrowserObserverInvocation({ runtimeDirectory, workingDir, browserFile, proxyPort, nodeBinding, plan }) {
+  if (!canonicalPath(runtimeDirectory) || !canonicalPath(workingDir) || typeof browserFile !== 'string'
+    || isAbsolute(browserFile) || browserFile.split('/').some(part => !part || part === '.' || part === '..')
+    || !Number.isInteger(proxyPort) || proxyPort < 1024 || proxyPort > 65535) invalid();
+  const config = { hostname: plan.hostname, application: { port: plan.application.port }, timeout_ms: plan.timeout_ms, steps: plan.steps };
+  const options = { executablePath: join(runtimeDirectory, 'chromium', browserFile),
+    proxy: { server: `http://127.0.0.1:${proxyPort}`, bypass: '<-loopback>' },
+    args: ['--host-resolver-rules=MAP * ~NOTFOUND, EXCLUDE 127.0.0.1', '--use-mock-keychain'] };
+  const stdin = `import { chromium } from ${JSON.stringify(pathToFileURL(join(runtimeDirectory, 'playwright-core/index.mjs')).href)};
+import { observeBrowserScenario } from ${JSON.stringify(pathToFileURL(join(runtimeDirectory, 'observer-driver.mjs')).href)};
+const observed = await observeBrowserScenario({ chromium, config: ${JSON.stringify(config)}, launchOptions: ${JSON.stringify(options)}, isApplicationAlive: () => true });
+process.stdout.write(JSON.stringify(observed));\n`;
+  // The host's private application lifetime signal aborts this process on app
+  // death; the driver does not pretend to authenticate another process itself.
+  return { workingDir, executableBinding: nodeBinding, args: ['--input-type=module'], stdin, timeoutMs: plan.timeout_ms };
+}
+
+export function browserObservationCompleted(observed, expected) {
+  if (observed?.process_facts?.containment_kind !== 'darwin_scoped_process_group_v1') {
+    return observed?.process_facts?.containment_kind === 'bubblewrap_pid_namespace_v1'
+      && observed.process_facts.process_tree_stopped === true && observed.application_stopped === true
+      && !Object.hasOwn(observed, 'darwin_browser_binding');
+  }
+  const binding = observed.darwin_browser_binding;
+  const fields = ['schema_version', 'runtime_directory', 'observer_working_dir', 'browser_file', 'proxy_port', 'base_bundle_id', 'application'];
+  if (!binding || Object.keys(binding).length !== fields.length || fields.some(key => !Object.hasOwn(binding, key))
+    || binding.schema_version !== 1 || !canonicalPath(expected?.workingDir)
+    || !canonicalPath(binding.runtime_directory) || !canonicalPath(binding.observer_working_dir)
+    || [binding.runtime_directory, binding.observer_working_dir].some(path => contains(path, expected.workingDir) || contains(expected.workingDir, path))
+    || contains(binding.runtime_directory, binding.observer_working_dir) || contains(binding.observer_working_dir, binding.runtime_directory)
+    || typeof binding.base_bundle_id !== 'string' || binding.base_bundle_id.length > 200
+    || !/^(?:[A-Za-z0-9-]+\.)+[A-Za-z0-9-]+$/.test(binding.base_bundle_id)
+    || expected.application?.listener_transport !== 'darwin_prebound_tcp_v1'
+    || observed.application_stopped !== false || observed.application_group_stopped !== true) invalid();
+  const nodeBinding = { executable_path: realpathSync(process.execPath),
+    executable_sha256: createHash('sha256').update(readFileSync(process.execPath)).digest('hex') };
+  if (sha256(observed.node_binding) !== sha256(nodeBinding)
+    || sha256(observed.application_binding) !== sha256(expected.application.executable_binding)
+    || sha256(observed.browser_binding) !== sha256(expected.browser.executable_binding)) invalid();
+  const invocation = darwinBrowserObserverInvocation({ runtimeDirectory: binding.runtime_directory,
+    workingDir: binding.observer_working_dir, browserFile: binding.browser_file,
+    proxyPort: binding.proxy_port, nodeBinding, plan: expected });
+  if (!verificationProcessCompleted(observed.process_facts, invocation)
+    || observed.process_facts.exit_code !== 0 || observed.process_facts.signal !== null
+    || observed.process_facts.timed_out !== false || observed.process_facts.output_limit_exceeded !== false
+    || observed.process_facts.input_error !== null) invalid();
+  const app = binding.application;
+  if (!app || app.listener_transport !== expected.application.listener_transport
+    || !verificationProcessCompleted(app, { workingDir: expected.workingDir, executableBinding: expected.application.executable_binding,
+    args: expected.application.args, stdin: expected.application.stdin }) || app.error_code !== null || app.signal !== null
+    || app.timed_out !== false || app.output_limit_exceeded !== false || app.input_error !== null || app.requested_stop !== true
+    || app.darwin_verification_binding.completion.supervisor_signal !== 15
+    || !(app.darwin_verification_binding.completion.signal === 15 || app.darwin_verification_binding.completion.exit_code === 0)
+    || app.endpoint_proof?.nonce !== app.darwin_verification_binding.ready.nonce || app.endpoint_proof.closed !== true
+    || !hash(app.endpoint_proof.proof_chain_sha256) || !Number.isSafeInteger(app.endpoint_proof.positive_proofs)
+    || !Number.isSafeInteger(app.proxy?.connections_proved) || app.proxy.connections_proved < 2
+    || app.endpoint_proof.positive_proofs < app.proxy.connections_proved || app.proxy.owner_rejections !== 0
+    || app.proxy.policy_violations !== 0 || app.proxy.closed !== true || app.proxy.timed_out !== false || app.proxy.active_connections !== 0) invalid();
+  return true;
+}

package/src/terminal/browser-runtime.js

@@ -0,0 +1,131 @@
+// Private tool assembly. Never copy the application workspace into the observer.
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { cpSync, lstatSync, readFileSync, readdirSync, readlinkSync, realpathSync } from 'node:fs';
+import { basename, dirname, isAbsolute, join, relative, sep } from 'node:path';
+import { sha256 } from '@chati/core';
+import { installationAuthorityStateDirectory } from '../installer-v2/installation-authority.js';
+
+const digest = bytes => createHash('sha256').update(bytes).digest('hex');
+function fail(message) { throw Object.assign(new Error(message), { code: 'BROWSER_OBSERVATION_INVALID' }); }
+function inside(root, target) { const part = relative(root, target); return part === '' || (part !== '..' && !part.startsWith(`..${sep}`) && !isAbsolute(part)); }
+
+export function browserRuntimeLayout(executable, platform = process.platform) {
+  if (platform === 'darwin' && executable.split(sep).some(part => part.endsWith('.app'))) {
+    const source = dirname(dirname(dirname(executable)));
+    if (basename(dirname(executable)) !== 'MacOS' || basename(dirname(dirname(executable))) !== 'Contents'
+      || !basename(source).endsWith('.app')) fail('unsupported browser app bundle layout');
+    return { source, directory: basename(source), executable: join(basename(source), relative(source, executable)), internalLinks: true };
+  }
+  return { source: dirname(executable), directory: '', executable: basename(executable), internalLinks: false };
+}
+
+export function parseDarwinBrowserBundleInfo(info, executableName) {
+  if (!info || info.CFBundlePackageType !== 'APPL' || info.CFBundleExecutable !== executableName
+    || typeof info.CFBundleIdentifier !== 'string' || info.CFBundleIdentifier.length > 200
+    || !/^(?:[A-Za-z0-9-]+\.)+[A-Za-z0-9-]+$/.test(info.CFBundleIdentifier)) {
+    fail('Darwin browser requires the intact main Chromium application bundle identity');
+  }
+  return info.CFBundleIdentifier;
+}
+
+// Qualified Darwin arm64 Playwright Chromium153.0.8010.12 headless artifact.
+// BaseBundleID is a compiled rendezvous namespace, NOT its codesign identifier
+// or CFBundleIdentifier (this flat image has no Info.plist). Future artifacts
+// need qualification; neither a filename nor a caller-supplied hash is trust.
+const DARWIN_HEADLESS_NAMESPACES = Object.freeze({
+  a0bfe7b4da4787b66058477d696cd1d09065d25f06a548947722b9af77ee8282: 'org.chromium.Chromium',
+});
+
+export function darwinHeadlessRendezvousNamespace(executable, executableSha256) {
+  if (browserRuntimeLayout(executable, 'darwin').internalLinks || basename(executable) !== 'chrome-headless-shell'
+    || !Object.hasOwn(DARWIN_HEADLESS_NAMESPACES, executableSha256)) {
+    fail('Darwin headless browser artifact has no qualified rendezvous namespace');
+  }
+  return DARWIN_HEADLESS_NAMESPACES[executableSha256];
+}
+
+export function readDarwinBrowserRendezvousNamespace(executable) {
+  if (process.platform !== 'darwin') fail('Darwin bundle inspection requires the actual Mac');
+  const layout = browserRuntimeLayout(executable, 'darwin');
+  if (!layout.internalLinks) {
+    const stat = lstatSync(executable);
+    if (!stat.isFile() || stat.nlink !== 1 || stat.size > 1024 * 1024 * 1024) fail('headless browser must be a bounded regular copied image');
+    return darwinHeadlessRendezvousNamespace(executable, digest(readFileSync(executable)));
+  }
+  const infoPath = join(layout.source, 'Contents', 'Info.plist');
+  const stat = lstatSync(infoPath);
+  if (!stat.isFile() || stat.nlink !== 1 || stat.size > 65536) fail('browser bundle metadata must be a bounded regular copied file');
+  const contents = execFileSync('/usr/bin/plutil', ['-convert', 'json', '-o', '-', infoPath], {
+    encoding: 'utf8', timeout: 5000, maxBuffer: 65536, env: { PATH: '/usr/bin:/bin' }, stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  return parseDarwinBrowserBundleInfo(JSON.parse(contents), basename(executable));
+}
+
+function internalLink(root, path) {
+  const link = readlinkSync(path);
+  if (!link || isAbsolute(link)) fail('observer runtime link must be relative and internal');
+  let resolved;
+  try { resolved = realpathSync(path); } catch { fail('observer runtime link is dangling or cyclic'); }
+  if (!inside(root, resolved) || inside(resolved, path)) fail('observer runtime link escapes its bundle or forms an ancestor cycle');
+  const target = lstatSync(resolved);
+  if (!target.isFile() && !target.isDirectory()) fail('observer runtime link targets a special file');
+  return { link, resolved, directory: target.isDirectory() };
+}
+
+export function copyObserverRuntime(source, target, project, { internalLinks = false } = {}) {
+  const physical = realpathSync(source);
+  const authority = installationAuthorityStateDirectory();
+  if (inside(project, physical) || inside(physical, project)
+    || inside(authority, physical) || inside(physical, authority)) fail('observer runtime cannot overlap tested application code or private authority storage');
+  let bytes = 0; let files = 0;
+  cpSync(physical, target, { recursive: true, errorOnExist: true, force: false, verbatimSymlinks: true, filter(path) {
+    const stat = lstatSync(path);
+    if (stat.isSymbolicLink() && internalLinks) internalLink(physical, path);
+    else if (!stat.isDirectory() && !stat.isFile()) fail('observer runtime must not contain symlinks or special files');
+    files += 1; bytes += stat.isFile() ? stat.size : 0;
+    if (files > 20000 || bytes > 1024 * 1024 * 1024) fail('observer runtime exceeds the bounded tool-copy budget');
+    return true;
+  } });
+  // Recheck the copy itself before any process can execute from it. Relative
+  // framework links must resolve within the copied bundle, never the source.
+  observerRuntimeDigest(target);
+}
+
+export function observerRuntimeDigest(path) {
+  path = realpathSync(path);
+  const entries = [];
+  const directories = new Map();
+  function visit(directory) {
+    const edges = []; directories.set(directory, edges);
+    for (const name of readdirSync(directory).sort()) {
+      const file = join(directory, name); const stat = lstatSync(file);
+      if (stat.isDirectory()) { edges.push(file); visit(file); }
+      else if (stat.isFile() && stat.nlink === 1) entries.push({ path: relative(path, file), mode: stat.mode & 0o777, sha256: digest(readFileSync(file)) });
+      else if (stat.isSymbolicLink()) {
+        const link = internalLink(path, file);
+        entries.push({ path: relative(path, file), kind: 'symlink', target: link.link });
+        if (link.directory) edges.push(link.resolved);
+      }
+      else fail('observer runtime copy changed identity');
+    }
+  }
+  visit(path);
+  // A/B -> B and B/A -> A are individually resolvable internal links, yet
+  // together create an unbounded traversal. Check the directory graph without
+  // following links while copying/hashing; shared DAG destinations are valid.
+  const active = new Set(); const completed = new Set();
+  const stack = [{ directory: path, index: 0 }]; active.add(path);
+  while (stack.length) {
+    const frame = stack.at(-1); const edges = directories.get(frame.directory);
+    if (!edges) fail('observer runtime directory target changed identity');
+    if (frame.index === edges.length) {
+      active.delete(frame.directory); completed.add(frame.directory); stack.pop(); continue;
+    }
+    const child = edges[frame.index++];
+    if (active.has(child)) fail('observer runtime contains a directory cycle');
+    if (completed.has(child)) continue;
+    active.add(child); stack.push({ directory: child, index: 0 });
+  }
+  return sha256(entries);
+}

package/src/terminal/darwin-authority-policy.js

@@ -0,0 +1,213 @@
+/** Scoped Darwin authority policy. Kernel acceptance and effective permissions
+ * must be exercised on macOS; generating SBPL is not containment evidence. */
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { PROVIDER_CONTROL_PLANE_DIRECTORIES } from '@chati/core';
+export { PROVIDER_CONTROL_PLANE_DIRECTORIES };
+function fail(message) { throw Object.assign(new Error(message), { code: 'DARWIN_AUTHORITY_POLICY_INVALID' }); }
+function path(value) {
+  if (typeof value !== 'string' || !isAbsolute(value) || resolve(value) !== value
+    || Buffer.byteLength(value) > 900
+    || Array.from(value).some(character => character.codePointAt(0) < 32 || character.codePointAt(0) === 127)) fail('policy paths must be bounded canonical absolute paths');
+  return value;
+}
+function quote(value) { return JSON.stringify(path(value)); }
+function contains(root, candidate) {
+  const entry = relative(root, candidate);
+  return !entry || (entry !== '..' && !entry.startsWith('../') && !isAbsolute(entry));
+}
+function overlaps(left, right) { return contains(left, right) || contains(right, left); }
+const literal = value => `(literal ${quote(value)})`;
+const subtree = value => `(subpath ${quote(value)})`;
+function rule(action, operations, filters) {
+  if (!filters.length) return '';
+  return `(${action} ${operations} ${[...new Set(filters)].join(' ')})\n`;
+}
+
+// Explicit runtime roots only. In particular, /System would also expose the
+// writable Data volume. No operator home, provider state, socket or credential
+// service is made available to builder-controlled verification scripts.
+const VERIFICATION_SYSTEM_ROOTS = Object.freeze(['/bin', '/sbin', '/usr/bin', '/usr/sbin', '/usr/lib', '/usr/share',
+  '/System/Library', '/Library/Apple/System/Library', '/System/Cryptexes', '/System/Volumes/Preboot/Cryptexes']);
+
+// Application role only. This never grants outbound access, even to the trusted
+// proxy. The observer has its own sandbox and private writable runtime.
+export function darwinBrowserApplicationProfile({ applicationPort, observerDirectory, ...inputs }) {
+  if (!Number.isInteger(applicationPort) || applicationPort < 1024 || applicationPort > 65535) fail('browser application requires its frozen unprivileged port');
+  path(observerDirectory);
+  if (observerDirectory === '/' || [...VERIFICATION_SYSTEM_ROOTS, inputs.project, inputs.temporaryDirectory,
+    inputs.snapshotDirectory, inputs.launcherDirectory, inputs.authorityDirectory].some(value => overlaps(path(value), observerDirectory))) {
+    fail('browser observer tools must be separate from application and system roots');
+  }
+  const profile = darwinVerificationProfile({ ...inputs, maskedReadPaths: [...(inputs.maskedReadPaths ?? []), observerDirectory] })
+    // The already-bound fd11 is the capability. No new bind or implicit listen
+    // is allowed: localhost in SBPL also matches wildcard bind on actual XNU.
+    + `(allow network-inbound (local tcp "localhost:${applicationPort}"))\n`;
+  if (Buffer.byteLength(profile) > 65536) fail('browser application policy exceeds its bounded native profile size');
+  return profile;
+}
+
+// Observer role only. The host derives Chromium's BaseBundleID namespace from
+// its runtime (qualified headless artifact or main application bundle), never
+// from an application-selected Mach name, environment variable or plan field.
+export function darwinBrowserObserverProfile({ proxyPort, observerDirectory, applicationProject, baseBundleId, ...inputs }) {
+  if (!Number.isInteger(proxyPort) || proxyPort < 1024 || proxyPort > 65535
+    || typeof baseBundleId !== 'string' || baseBundleId.length > 200
+    || !/^(?:[A-Za-z0-9-]+\.)+[A-Za-z0-9-]+$/.test(baseBundleId)) fail('browser observer requires its private proxy and sealed bundle identity');
+  const roots = [...VERIFICATION_SYSTEM_ROOTS, inputs.project, inputs.temporaryDirectory,
+    inputs.snapshotDirectory, inputs.launcherDirectory, inputs.authorityDirectory].map(path);
+  for (const value of [observerDirectory, applicationProject]) {
+    if (path(value) === '/' || roots.some(other => overlaps(other, value))) fail('observer and application roots must be separate from private/system roots');
+  }
+  if (overlaps(observerDirectory, applicationProject)) fail('observer tools cannot overlap application code');
+  const protectedPaths = [observerDirectory];
+  for (let parent = dirname(observerDirectory); ; parent = dirname(parent)) {
+    protectedPaths.push(parent);
+    if (parent === dirname(parent)) break;
+  }
+  let profile = darwinVerificationProfile({ ...inputs, maskedReadPaths: [...(inputs.maskedReadPaths ?? []), applicationProject] });
+  profile += rule('allow', 'file-read* file-map-executable', [subtree(observerDirectory)]);
+  profile += `(allow network-outbound (remote tcp "localhost:${proxyPort}"))\n`;
+  // Anonymous socketpair IPC only: no pathname bind/connect rule is added.
+  profile += '(allow system-socket (socket-domain AF_UNIX))\n';
+  // Chromium's inner sandbox limits lookup to the actual browser PID. Its
+  // rendezvous server selects registered child ports by kernel audit token.
+  // This outer regex is not itself per-invocation identity authentication.
+  // #"..." is an SBPL regex literal, not a JSON-decoded string. Literal-dot
+  // character classes avoid duplicating the escape layer at this boundary.
+  const rendezvous = `^${baseBundleId.replaceAll('.', '[.]')}[.]MachPortRendezvousServer[.][1-9][0-9]*$`;
+  profile += `(allow mach-register mach-lookup (global-name-regex #${JSON.stringify(rendezvous)}))\n`;
+  profile += '(allow mach-lookup (global-name "com.apple.logd") (global-name "com.apple.system.logger") (global-name "com.apple.system.opendirectoryd.libinfo") (global-name "com.apple.system.opendirectoryd.membership") (global-name "com.apple.FontObjectsServer") (global-name "com.apple.fonts"))\n';
+  // Chromium registers its native power monitor during startup. This exact
+  // class capability is NOT read-only: a compromised observer could affect
+  // host sleep/energy. It belongs to the immutable observer family (Node,
+  // driver, browser and descendants), never to the separate application.
+  // Chromium's own child sandbox remains enabled; no global OS setting changes.
+  profile += '(allow iokit-open-user-client (iokit-user-client-class "RootDomainUserClient"))\n';
+  profile += '(allow file-read-data (literal "/private/etc/passwd"))\n';
+  profile += rule('deny', 'file-read* file-map-executable', ['/Library/Keychains', '/System/Library/Keychains'].map(subtree));
+  profile += rule('deny', 'file-write*', [subtree(observerDirectory), ...protectedPaths.map(literal)]);
+  if (Buffer.byteLength(profile) > 65536) fail('browser observer policy exceeds its bounded native profile size');
+  return profile;
+}
+
+export function darwinVerificationProfile({ project, temporaryDirectory, snapshotDirectory, launcherDirectory,
+  launcherPath, executablePath, authorityDirectory, maskedReadPaths = [], subjectReadOnly = false }) {
+  if (typeof subjectReadOnly !== 'boolean') fail('verification subject access must be an explicit boolean');
+  const roots = [project, temporaryDirectory, snapshotDirectory, launcherDirectory, authorityDirectory];
+  roots.forEach(value => { if (path(value) === '/') fail('verification roots must not be the filesystem root'); });
+  for (const [index, value] of roots.entries()) {
+    if (roots.slice(index + 1).some(other => overlaps(value, other))
+      || VERIFICATION_SYSTEM_ROOTS.some(other => overlaps(value, other))) fail('verification roots must be separate from each other and system runtime roots');
+  }
+  if (!contains(launcherDirectory, path(launcherPath)) || !contains(snapshotDirectory, path(executablePath))) fail('verification executables must belong to sealed snapshots');
+  if (!Array.isArray(maskedReadPaths)) fail('verification read masks must be explicit');
+  const masked = [...new Set(maskedReadPaths.map(path))];
+  if (masked.some(value => value === '/' || roots.slice(0, 4).some(root => overlaps(value, root)))) fail('verification masks overlap required runtime roots');
+  const controlPlane = PROVIDER_CONTROL_PLANE_DIRECTORIES.map(name => join(project, name));
+  const protectedTrees = [snapshotDirectory, launcherDirectory, authorityDirectory, ...controlPlane, ...masked];
+  const ancestors = new Set([project, temporaryDirectory]);
+  for (const target of [...roots, ...protectedTrees]) {
+    for (let parent = dirname(target); ; parent = dirname(parent)) {
+      ancestors.add(parent);
+      if (parent === dirname(parent)) break;
+    }
+  }
+  let profile = '(version 1)\n(deny default)\n';
+  profile += '(allow process-fork process-exec)\n(allow process-info* (target same-sandbox))\n(allow signal (target same-sandbox))\n';
+  profile += '(allow file-read-metadata)\n';
+  // dyld opens the root directory while locating its shared cache. This literal
+  // grant permits directory enumeration only, not descendant reads or writes.
+  profile += '(allow file-read-data (literal "/"))\n';
+  profile += rule('allow', 'file-read* file-map-executable', [...VERIFICATION_SYSTEM_ROOTS,
+    project, temporaryDirectory, snapshotDirectory, launcherDirectory].map(subtree));
+  profile += '(allow file-read-data (literal "/dev/random") (literal "/dev/urandom"))\n';
+  profile += '(allow file-ioctl file-read-data file-write-data (literal "/dev/null"))\n';
+  // uv_os_uname reads this public kernel version; Node imports node:os while
+  // loading other builtins and cannot initialize when this exact query fails.
+  profile += '(allow sysctl-read (sysctl-name "kern.version"))\n';
+  profile += '(allow sysctl-read (sysctl-name-prefix "hw.") (sysctl-name "kern.ostype") (sysctl-name "kern.osrelease") (sysctl-name "kern.osversion") (sysctl-name "kern.osproductversion") (sysctl-name "kern.maxfilesperproc") (sysctl-name "kern.argmax") (sysctl-name "kern.hostname") (sysctl-name "kern.tcsm_available") (sysctl-name "kern.tcsm_enable"))\n';
+  profile += rule('allow', 'file-write*', (subjectReadOnly ? [temporaryDirectory] : [project, temporaryDirectory]).map(subtree));
+  profile += rule('deny', 'file-read* file-map-executable', [authorityDirectory, ...controlPlane, ...masked].map(subtree));
+  profile += rule('deny', 'file-write*', [...protectedTrees.map(subtree), ...[...ancestors].map(literal)]);
+  if (Buffer.byteLength(profile) > 65536) fail('verification policy exceeds its bounded native profile size');
+  return profile;
+}
+
+export function darwinAuthorityProfile({
+  project, stateDirectory, temporaryDirectory, snapshotDirectory, launcherDirectory,
+  launcherPath, executablePath, supportingExecutablePaths = [], authorityDirectory,
+  promptDirectory, writeScopes, maskedReadPaths = [], councilToolIsolation = false, homeDirectory,
+}) {
+  const roots = { project, stateDirectory, temporaryDirectory, snapshotDirectory, launcherDirectory, authorityDirectory, homeDirectory };
+  for (const [key, value] of Object.entries(roots)) if (path(value) === '/') fail(`${key} must not be the filesystem root`);
+  path(launcherPath); path(executablePath);
+  if (!contains(launcherDirectory, launcherPath) || !contains(snapshotDirectory, executablePath)) fail('native executables must belong to their sealed snapshots');
+  if (!Array.isArray(supportingExecutablePaths) || supportingExecutablePaths.some(value => !contains(snapshotDirectory, path(value)))) fail('supporting executables must belong to the provider snapshot');
+  if (typeof councilToolIsolation !== 'boolean' || !Array.isArray(maskedReadPaths)
+    || !writeScopes || typeof writeScopes.fullProject !== 'boolean' || !Array.isArray(writeScopes.entries)) fail('explicit scoped policy inputs are required');
+  if (writeScopes.fullProject && writeScopes.entries.length) fail('full-project and partial write scopes cannot be combined');
+  // Exclude accidental broad grants around the private authority and snapshots.
+  const privateRoots = [stateDirectory, temporaryDirectory, snapshotDirectory, launcherDirectory, authorityDirectory];
+  for (let index = 0; index < privateRoots.length; index++) {
+    if (overlaps(project, privateRoots[index])) fail('private runtime roots cannot overlap the project');
+    for (const other of privateRoots.slice(index + 1)) if (overlaps(privateRoots[index], other)) fail('private runtime roots must be distinct');
+  }
+  const controlPlane = PROVIDER_CONTROL_PLANE_DIRECTORIES.map(name => join(project, name));
+  const scopedWrites = writeScopes.fullProject ? [subtree(project)] : writeScopes.entries.map(entry => {
+    path(entry?.target);
+    if (!['file', 'directory'].includes(entry.kind) || entry.target === project || !contains(project, entry.target)
+      || controlPlane.some(value => overlaps(value, entry.target))) fail('write scope escapes the product tree or overlaps its control plane');
+    return entry.kind === 'file' ? literal(entry.target) : subtree(entry.target);
+  });
+  const masked = [...new Set(maskedReadPaths.map(path))];
+  for (const denied of masked) {
+    if (denied === '/' || overlaps(denied, project) || privateRoots.slice(0, 4).some(value => overlaps(denied, value))) {
+      fail('masked paths must not overlap project or required private runtime roots');
+    }
+  }
+  if (promptDirectory) {
+    path(promptDirectory);
+    if (privateRoots.some(value => overlaps(value, promptDirectory)) || overlaps(project, promptDirectory)) fail('private prompt must be separate from writable/private runtime roots');
+  }
+  const protectedTrees = [...controlPlane, snapshotDirectory, launcherDirectory, authorityDirectory,
+    ...masked, ...(promptDirectory ? [promptDirectory] : [])];
+  const ancestors = new Set([project, stateDirectory, temporaryDirectory]);
+  for (const target of [...protectedTrees, ...writeScopes.entries.map(entry => entry.target)]) {
+    for (let parent = dirname(target); ; parent = dirname(parent)) {
+      ancestors.add(parent);
+      if (parent === dirname(parent)) break;
+    }
+  }
+  const executableFilters = [launcherPath, executablePath, ...supportingExecutablePaths].map(literal);
+  let profile = '(version 1)\n(deny default)\n';
+  profile += '(allow process-fork)\n(allow process-info* (target same-sandbox))\n(allow signal (target same-sandbox))\n';
+  // No task-port grant: the provider must not inspect/modify its supervisor.
+  profile += councilToolIsolation ? rule('allow', 'process-exec', executableFilters) : '(allow process-exec)\n';
+  profile += '(allow file-read* file-map-executable)\n';
+  profile += '(allow sysctl-read (sysctl-name-prefix "hw.") (sysctl-name "kern.ostype") (sysctl-name "kern.osrelease") (sysctl-name "kern.osversion") (sysctl-name "kern.osproductversion") (sysctl-name "kern.maxfilesperproc") (sysctl-name "kern.argmax") (sysctl-name "kern.hostname") (sysctl-name "kern.tcsm_available") (sysctl-name "kern.tcsm_enable"))\n';
+  profile += '(allow sysctl-write (sysctl-name "kern.tcsm_enable"))\n';
+  profile += '(allow sysctl-read (sysctl-name "kern.version"))\n';
+  profile += '(allow mach-lookup (global-name "com.apple.SecurityServer") (global-name "com.apple.securityd.xpc") (global-name "com.apple.trustd.agent") (global-name "com.apple.system.opendirectoryd.libinfo") (global-name "com.apple.system.opendirectoryd.membership") (global-name "com.apple.system.logger") (global-name "com.apple.logd"))\n';
+  // IP transport is allowed for providers and product tests. Host Unix sockets,
+  // Apple Events, unrestricted Mach services and privileged task ports are not.
+  profile += '(allow network-outbound (remote ip "*:*"))\n(allow network-bind network-inbound (local ip "*:*"))\n';
+  // Apple's DNS client uses this system-owned Unix endpoint. This does not
+  // grant SSH-agent, Docker, arbitrary XPC, or other host socket access.
+  profile += '(allow system-socket (socket-domain AF_UNIX))\n(allow network-outbound (remote unix-socket (literal "/private/var/run/mDNSResponder")))\n';
+  profile += '(allow file-ioctl file-read-data file-write-data (literal "/dev/null"))\n';
+  profile += rule('allow', 'file-write*', [...scopedWrites, subtree(stateDirectory), subtree(temporaryDirectory)]);
+  if (councilToolIsolation) {
+    const homes = [...new Set(['/Users', '/var/root', '/private/var/root', homeDirectory])].map(subtree);
+    const visible = [project, stateDirectory, temporaryDirectory, snapshotDirectory, launcherDirectory,
+      ...(promptDirectory ? [promptDirectory] : [])];
+    profile += rule('deny', 'file-read* file-map-executable', [
+      `(require-all (require-any ${homes.join(' ')}) ${visible.map(value => `(require-not ${subtree(value)})`).join(' ')})`,
+      ...['/bin', '/sbin', '/usr/bin', '/usr/sbin', '/usr/local/bin', '/usr/local/sbin', '/opt/homebrew/bin', '/opt/homebrew/sbin'].map(subtree),
+    ]);
+  }
+  // Denials remain last. A later write allow must not reopen a protected path.
+  profile += rule('deny', 'file-read* file-map-executable', [authorityDirectory, ...masked].map(subtree));
+  profile += rule('deny', 'file-write*', [...protectedTrees.map(subtree), ...[...ancestors].map(literal)]);
+  if (Buffer.byteLength(profile) > 65536) fail('scoped policy exceeds its bounded native profile size');
+  return profile;
+}