chati-dev 4.5.28 → 4.5.29

package/src/terminal/spawner.js

@@ -8,21 +8,30 @@
  */
 
 import { spawn, spawnSync } from 'child_process';
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { EventEmitter } from 'node:events';
 import {
-  closeSync, constants, fstatSync, fsyncSync, lstatSync, mkdirSync, mkdtempSync, openSync,
+  closeSync, constants, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, mkdtempSync, openSync,
   readFileSync, readSync, realpathSync, rmSync, writeSync,
 } from 'node:fs';
 import { homedir, hostname, tmpdir } from 'node:os';
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
-import { canonicalize, sha256 } from '@chati/core';
+import { canonicalize, sha256, directoryPathSync, openAtSync, mkdirAtSync, lstatAtSync, nativeExecutionGatePath,
+  createLinuxProcessInfoPipe, readLinuxProcessInfoPipe, captureLinuxNamespaceIdentity, observeLinuxNamespace } from '@chati/core';
+import { captureDarwinHostBootIdentity, createDarwinTerminalLaunchBinding, assertDarwinTerminalLaunch, assertDarwinTerminalCompletion } from '@chati/core';
 import { validateWriteScopes, buildIsolationEnv } from './isolation.js';
 import { getProvider } from './cli-registry.js';
 import { getRateLimiter } from './rate-limiter.js';
 import { recordModelSelection } from '../orchestrator/session-manager.js';
+import {
+  assertDarwinSealedLaunch, disposeDarwinSealedLaunch, prepareDarwinSealedLaunch, prepareDarwinAuthorityLaunch,
+  prepareDarwinBrowserObserverLaunch,
+} from './darwin-execution.js';
+import { PROVIDER_CONTROL_PLANE_DIRECTORIES } from './darwin-authority-policy.js';
+import { createDarwinVerificationBinding, projectVerificationExecutableBinding, verificationProcessCompleted } from './verification-process-facts.js';
 import {
   digestProviderExecutable, openPinnedProviderExecutable, openPinnedProviderSupportingExecutables,
+  sealedProviderRuntimeEnvironment, validateProviderExecutableBinding,
 } from '../installer-v2/provider-executable.js';
 import {
   installationAuthorityStateDirectory, signHostAuthorityPayload, verifyHostAuthorityPayload,
@@ -59,17 +68,18 @@ const OVERLOAD_PATTERNS = [/529/, /overloaded/i, /capacity/i, /too many requests
 
 let _counter = 0;
 const TERMINAL_AUTHORITY_STATE = new WeakMap();
+// Diagnostic observations are not receipts, cleanup proof or execution authority.
+const TERMINAL_DIAGNOSTIC_OBSERVATIONS = new WeakMap();
+const TERMINAL_ATTEMPT_DIAGNOSTICS = new WeakMap();
 const TERMINAL_AUTHORITY_DOMAIN = 'chati-terminal-receipt-v1';
 const TERMINAL_SECURITY_TEST_HOOKS = Symbol.for('chati.terminal.security-test-hooks');
 const READ_ONLY_PROVIDERS = new Set(['claude', 'codex', 'grok']);
 const BUBBLEWRAP_PATH = '/usr/bin/bwrap';
-const PROVIDER_CONTROL_PLANE_DIRECTORIES = Object.freeze([
-  '.chati', '.chati.dev', '.claude', '.codex', '.grok', '.agents',
-]);
 const PROCESS_TREE_SETTLE_WAIT = new Int32Array(new SharedArrayBuffer(4));
 const PRIVATE_PROMPT_MARKER = '<chati-private-prompt-file>';
 const CONTAINED_PROMPT_PATH = '/run/user/chati-private-prompt';
 const CONTAINED_PROVIDER_EXECUTABLE_PATH = '/run/user/chati-provider-executable';
+const CONTAINED_EXECUTION_GATE_PATH = '/run/user/chati-execution-gate';
 const AUTHORITY_SYSTEM_PATH = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin';
 const TEAM_CONTEXT_ENV_KEYS = Object.freeze([
   'CHATI_TEAM_ID', 'CHATI_TEAM_MEMBER', 'CHATI_TEAM_TASK_LIST', 'CHATI_TEAM_MAILBOX',
@@ -80,6 +90,40 @@ function runTerminalSecurityTestHook(name, payload) {
   if (hooks && typeof hooks[name] === 'function') hooks[name](payload);
 }
 
+function terminalAttemptSnapshot(handle, attempt) {
+  const observation = TERMINAL_DIAGNOSTIC_OBSERVATIONS.get(handle);
+  if (!observation) return null;
+  return Object.freeze({
+    attempt,
+    timeout_ms: Number.isSafeInteger(observation.timeout) && observation.timeout > 0 ? observation.timeout : null,
+    elapsed_ms: Number.isFinite(observation.elapsedMs) && observation.elapsedMs >= 0 ? Math.floor(observation.elapsedMs) : null,
+    exit_code: Number.isInteger(observation.exitCode) ? observation.exitCode : null,
+    timed_out: observation.timedOut === true,
+    termination_cause: observation.terminationCause,
+  });
+}
+
+function projectAttemptDiagnostics(attempts, exceptionStage = null) {
+  return Object.freeze({ schema_version: 1,
+    attempts: Object.freeze(attempts.map(row => Object.freeze({ ...row }))),
+    exception_stage: exceptionStage });
+}
+
+function rememberAttemptDiagnostics(target, attempts, exceptionStage = null) {
+  if (target !== null && (typeof target === 'object' || typeof target === 'function')) {
+    TERMINAL_ATTEMPT_DIAGNOSTICS.set(target, projectAttemptDiagnostics(attempts, exceptionStage));
+  }
+  return target;
+}
+
+/** Closed, content-free observations only. Reading this never signs, waits or kills. */
+export function getTerminalAttemptDiagnostics(handleOrError) {
+  const remembered = TERMINAL_ATTEMPT_DIAGNOSTICS.get(handleOrError);
+  if (remembered) return projectAttemptDiagnostics(remembered.attempts, remembered.exception_stage);
+  const observation = terminalAttemptSnapshot(handleOrError, 0);
+  return observation ? projectAttemptDiagnostics([observation]) : null;
+}
+
 function openPrivatePromptFile(prompt) {
   const directory = mkdtempSync(join(tmpdir(), 'chati-terminal-prompt-'));
   const path = join(directory, 'prompt');
@@ -189,6 +233,24 @@ function digestPinnedExecutable(descriptor, expected = null) {
   return Object.freeze({ digest, snapshot: after });
 }
 
+// Internal descriptor boundary, exported for deterministic race regressions on
+// disposable images. Runtime callers cannot select a different helper path.
+export function _pinNativeExecutionGateDescriptor(descriptor) {
+  const stat = fstatSync(descriptor);
+  const magic = Buffer.alloc(4); readSync(descriptor, magic, 0, 4, 0);
+  if (!stat.isFile() || stat.nlink !== 1 || (stat.mode & 0o022) !== 0
+    || (stat.mode & 0o111) === 0 || ![0, process.geteuid()].includes(stat.uid)
+    || magic.toString('hex') !== '7f454c46') {
+    return failContainment('execution admission requires a private pinned native helper');
+  }
+  runTerminalSecurityTestHook('afterExecutionGateMagicValidation', { descriptor });
+  const executable = digestPinnedExecutable(descriptor);
+  if (!sameExecutableSnapshot(executableSnapshot(stat), executable.snapshot)) {
+    return failContainment('execution admission helper changed between format validation and hashing');
+  }
+  return executable;
+}
+
 function currentBubblewrapTrust(descriptor) {
   const trustedDirectories = ['/', '/usr', '/usr/bin'].map((path) => ({ path, stat: lstatSync(path) }));
   const pathStat = lstatSync(BUBBLEWRAP_PATH);
@@ -258,8 +320,8 @@ function closeDirectoryChain(chain) {
 }
 
 function openPinnedDirectoryChain(path) {
-  if (process.platform !== 'linux') {
-    return failContainment('authority-bearing RAIL processes require Linux descriptor-pinned project storage');
+  if (!['linux', 'darwin'].includes(process.platform)) {
+    return failContainment(`authority-bearing RAIL processes require descriptor-pinned project storage; unsupported platform: ${process.platform}`);
   }
   const absolute = resolve(path);
   const descriptors = [];
@@ -270,18 +332,18 @@ function openPinnedDirectoryChain(path) {
     descriptors.push(descriptor);
     snapshots.push(directorySnapshot(fstatSync(descriptor)));
     for (const segment of absolute.slice(1).split(sep).filter(Boolean)) {
-      descriptor = openSync(
-        join(`/proc/self/fd/${descriptor}`, segment),
+      descriptor = openAtSync(
+        descriptor, segment,
         constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0),
       );
+      descriptors.push(descriptor);
       const stat = fstatSync(descriptor);
       if (!stat.isDirectory()) return failContainment('authority project chain must contain only real directories');
-      descriptors.push(descriptor);
       snapshots.push(directorySnapshot(stat));
     }
     return Object.freeze({
       path: absolute,
-      reference: `/proc/self/fd/${descriptors.at(-1)}`,
+      reference: process.platform === 'linux' ? `/proc/self/fd/${descriptors.at(-1)}` : directoryPathSync(descriptors.at(-1)),
       descriptors: Object.freeze(descriptors),
       snapshots: Object.freeze(snapshots),
       identity_digest: sha256({ path: absolute, snapshots }),
@@ -312,18 +374,17 @@ function assertPinnedDirectoryChain(chain) {
 function ensureScopedDirectory(projectChain, relativeDirectory) {
   const descriptors = [];
   const snapshots = [];
-  let reference = projectChain.reference;
+  let parentDescriptor = projectChain.descriptors.at(-1);
   try {
     for (const segment of relativeDirectory.split(sep).filter(Boolean)) {
-      const target = join(reference, segment);
-      try { mkdirSync(target, { mode: 0o700 }); }
+      try { mkdirAtSync(parentDescriptor, segment, { mode: 0o700 }); }
       catch (error) { if (error?.code !== 'EEXIST') throw error; }
-      const pathStat = lstatSync(target);
+      const pathStat = lstatAtSync(parentDescriptor, segment);
       if (pathStat.isSymbolicLink() || !pathStat.isDirectory()) {
         return failContainment('Planning write scope ancestors must be real directories');
       }
-      const descriptor = openSync(
-        target,
+      const descriptor = openAtSync(
+        parentDescriptor, segment,
         constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0),
       );
       const pinned = fstatSync(descriptor);
@@ -333,9 +394,9 @@ function ensureScopedDirectory(projectChain, relativeDirectory) {
       }
       descriptors.push(descriptor);
       snapshots.push(directorySnapshot(pinned));
-      reference = `/proc/self/fd/${descriptor}`;
+      parentDescriptor = descriptor;
     }
-    return Object.freeze({ descriptors, snapshots, reference });
+    return Object.freeze({ descriptors, snapshots, directoryDescriptor: parentDescriptor });
   } catch (error) {
     descriptors.reverse().forEach((descriptor) => { try { closeSync(descriptor); } catch { /* already closed */ } });
     if (error?.code === 'TERMINAL_CONTAINMENT_UNAVAILABLE') throw error;
@@ -376,9 +437,8 @@ function preparePinnedWriteScopes(projectChain, writeScope = []) {
         targetSnapshot = parent.snapshots.at(-1);
       } else {
         const name = rel.split(sep).at(-1);
-        const target = join(parent.reference, name);
-        const pathFlags = constants.O_RDWR | constants.O_CREAT | (constants.O_NOFOLLOW || 0);
-        targetDescriptor = openSync(target, pathFlags, 0o600);
+        const pathFlags = constants.O_RDWR | constants.O_CREAT | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0);
+        targetDescriptor = openAtSync(parent.directoryDescriptor, name, pathFlags, 0o600);
         const stat = fstatSync(targetDescriptor);
         if (!stat.isFile() || stat.nlink !== 1) {
           closeSync(targetDescriptor);
@@ -444,31 +504,134 @@ function hiddenInstallationAuthorityArgs() {
   }
 }
 
+function buildDarwinAuthorityContainment({
+  args, cwd, readOnly, writeScope, terminalId, provider, providerExecutableBinding,
+  promptRecord, maskedReadPaths, councilToolIsolation, authorityContext,
+  verificationIsolation = false,
+}) {
+  if (providerExecutableBinding === undefined) {
+    throw Object.assign(new Error('authority-bearing provider launch requires an executable binding sealed by the installation'), { code: 'PROVIDER_EXECUTABLE_BINDING_REQUIRED' });
+  }
+  const binding = validateProviderExecutableBinding(providerExecutableBinding, { harnessId: provider });
+  const project = realpathSync(cwd);
+  let projectChain;
+  let stateChain;
+  let pinnedWriteScopes;
+  let darwinLaunch;
+  const maskedChains = [];
+  const controlPlaneChains = [];
+  try {
+    projectChain = openPinnedDirectoryChain(project);
+    if (!Array.isArray(maskedReadPaths)) return failContainment('masked read paths must be an array');
+    for (const requested of [...new Set(maskedReadPaths)]) {
+      const physical = realpathSync(requested);
+      if (pathContains(physical, project) || pathContains(project, physical)) {
+        return failContainment('masked read path must not overlap the authority working directory');
+      }
+      maskedChains.push(openPinnedDirectoryChain(physical));
+    }
+    for (const name of PROVIDER_CONTROL_PLANE_DIRECTORIES) {
+      let stat;
+      try { stat = lstatAtSync(projectChain.descriptors.at(-1), name); }
+      catch (error) { if (error.code === 'ENOENT') continue; throw error; }
+      if (stat.isSymbolicLink() || !stat.isDirectory()) return failContainment(`${name} control plane must be a real directory`);
+      controlPlaneChains.push(openPinnedDirectoryChain(join(project, name)));
+    }
+    pinnedWriteScopes = preparePinnedWriteScopes(projectChain, readOnly ? [] : writeScope);
+    let stateDirectory;
+    if (!verificationIsolation) {
+      stateDirectory = join(realpathSync(homedir()), provider === 'claude' ? '.claude' : provider === 'codex' ? '.codex' : '.grok');
+      try { mkdirSync(stateDirectory, { mode: 0o700 }); }
+      catch (error) { if (error.code !== 'EEXIST') throw error; }
+      // Descriptor traversal rejects a provider state symlink, including ancestors.
+      stateChain = openPinnedDirectoryChain(stateDirectory);
+    }
+    darwinLaunch = prepareDarwinAuthorityLaunch({
+      binding, harnessId: provider, projectDir: project, args, hasPrompt: Boolean(promptRecord),
+      promptDirectory: promptRecord?.directory, authorityContext, stateDirectory,
+      writeScopes: pinnedWriteScopes, maskedReadPaths: maskedChains.map(chain => chain.path), councilToolIsolation, verificationIsolation,
+      subjectReadOnly: verificationIsolation && readOnly === true,
+    });
+    const containment = Object.freeze({
+      kind: darwinLaunch.kind, id: `darwin:${terminalId}`,
+      command: darwinLaunch.command, args: darwinLaunch.args, darwinLaunch,
+      pinnedProjectChain: projectChain, pinnedStateChain: stateChain,
+      controlPlaneChains: Object.freeze(controlPlaneChains), maskedReadChains: Object.freeze(maskedChains),
+      pinnedWriteScopes, projectReference: projectChain.reference, projectIdentityDigest: projectChain.identity_digest,
+      providerExecutableBinding: binding,
+      digest: sha256({
+        kind: darwinLaunch.kind, helper_sha256: darwinLaunch.helperSha256, policy_digest: darwinLaunch.policyDigest,
+        provider_executable: binding, native_nonce: darwinLaunch.supervisorChannels.nonce,
+        project_identity_digest: projectChain.identity_digest,
+        state_identity_digest: stateChain?.identity_digest ?? null,
+        masked_identity_digests: maskedChains.map(chain => chain.identity_digest),
+      }),
+    });
+    assertAuthorityContainmentStable(containment);
+    return containment;
+  } catch (error) {
+    closeAuthorityContainment({ pinnedProjectChain: projectChain, pinnedStateChain: stateChain,
+      pinnedWriteScopes, controlPlaneChains, maskedReadChains: maskedChains });
+    if (darwinLaunch) try { disposeDarwinSealedLaunch(darwinLaunch); } catch (cleanupError) { error.darwinCleanupError = cleanupError; }
+    throw error;
+  }
+}
+
 function buildAuthorityContainment({
   args, cwd, readOnly, writeScope, terminalId, provider, providerExecutableBinding,
-  promptRecord = null, maskedReadPaths = [],
+  promptRecord = null, maskedReadPaths = [], councilToolIsolation = false, verificationIsolation = false,
+  observerDirectory = null,
+  executionAdmission = false,
+  authorityContext,
 }) {
+  if (process.platform === 'darwin') {
+    if (observerDirectory !== null) return failContainment('Darwin browser verification isolation is not implemented');
+    return buildDarwinAuthorityContainment({ args, cwd, readOnly, writeScope, terminalId, provider,
+      providerExecutableBinding, promptRecord, maskedReadPaths, councilToolIsolation, authorityContext, verificationIsolation });
+  }
   const trustedBubblewrap = requireBubblewrapContainment();
   if (providerExecutableBinding === undefined) {
     closeSync(trustedBubblewrap.descriptor);
     throw Object.assign(new Error('authority-bearing provider launch requires an executable binding sealed by the installation'), { code: 'PROVIDER_EXECUTABLE_BINDING_REQUIRED' });
   }
   let projectChain;
+  let observerChain;
   const maskedChains = [];
   let trustedProvider;
   let trustedSupportingProviders = [];
+  let admissionHelper;
   let pinnedWriteScopes;
-  const stateDirectory = join(homedir(), provider === 'claude' ? '.claude' : provider === 'codex' ? '.codex' : '.grok');
+  const stateDirectory = verificationIsolation ? '/run/user/chati-verification-home'
+    : join(homedir(), provider === 'claude' ? '.claude' : provider === 'codex' ? '.codex' : '.grok');
   let stateDirectoryArgs;
   let stateDirectoryDescriptor;
   const controlPlaneDescriptors = [];
   const controlPlaneArgs = [];
   try {
-    trustedProvider = openPinnedProviderExecutable(providerExecutableBinding, { harnessId: provider, projectDir: cwd });
+    if (executionAdmission) {
+      const descriptor = openSync(nativeExecutionGatePath(), constants.O_RDONLY | constants.O_NOFOLLOW);
+      admissionHelper = { descriptor };
+      admissionHelper.executable = _pinNativeExecutionGateDescriptor(descriptor);
+    }
+    trustedProvider = openPinnedProviderExecutable(providerExecutableBinding, {
+      harnessId: provider, projectDir: cwd, requireNativeImage: verificationIsolation,
+    });
     trustedSupportingProviders = openPinnedProviderSupportingExecutables(
       providerExecutableBinding, { harnessId: provider, projectDir: cwd },
     );
     projectChain = openPinnedDirectoryChain(cwd);
+    if (observerDirectory !== null) {
+      if (!verificationIsolation) return failContainment('observer tools require verification isolation');
+      const physical = realpathSync(observerDirectory);
+      const stat = lstatSync(physical);
+      if (pathContains(physical, cwd) || pathContains(cwd, physical)
+        || !stat.isDirectory() || stat.uid !== process.geteuid() || (stat.mode & 0o777) !== 0o700
+        || pathContains(physical, installationAuthorityStateDirectory())
+        || pathContains(installationAuthorityStateDirectory(), physical)) {
+        return failContainment('observer tools must be a separate private directory without authority keys');
+      }
+      observerChain = openPinnedDirectoryChain(physical);
+    }
     if (!Array.isArray(maskedReadPaths)) return failContainment('masked read paths must be an array');
     for (const requested of [...new Set(maskedReadPaths.map((entry) => resolve(String(entry))))]) {
       const physical = realpathSync(requested);
@@ -479,22 +642,27 @@ function buildAuthorityContainment({
     }
     pinnedWriteScopes = preparePinnedWriteScopes(projectChain, readOnly ? [] : writeScope);
     let stateStat;
-    try { stateStat = lstatSync(stateDirectory); }
-    catch (error) {
-      if (error?.code !== 'ENOENT') throw error;
-      mkdirSync(stateDirectory, { mode: 0o700 });
-      stateStat = lstatSync(stateDirectory);
-    }
-    if (!stateStat.isDirectory()) {
-      throw Object.assign(new Error('provider state path must be a real directory'), { code: 'TERMINAL_CONTAINMENT_UNAVAILABLE' });
-    }
-    stateDirectoryDescriptor = openSync(stateDirectory, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
-    const descriptorStat = fstatSync(stateDirectoryDescriptor);
-    if (descriptorStat.dev !== stateStat.dev || descriptorStat.ino !== stateStat.ino) {
-      throw Object.assign(new Error('provider state directory changed before containment'), { code: 'TERMINAL_CONTAINMENT_UNAVAILABLE' });
+    if (verificationIsolation) {
+      // Retain descriptor numbering without exposing any host provider state.
+      stateDirectoryDescriptor = openSync('/dev/null', constants.O_RDONLY);
+    } else {
+      try { stateStat = lstatSync(stateDirectory); }
+      catch (error) {
+        if (error?.code !== 'ENOENT') throw error;
+        mkdirSync(stateDirectory, { mode: 0o700 });
+        stateStat = lstatSync(stateDirectory);
+      }
+      if (!stateStat.isDirectory()) {
+        throw Object.assign(new Error('provider state path must be a real directory'), { code: 'TERMINAL_CONTAINMENT_UNAVAILABLE' });
+      }
+      stateDirectoryDescriptor = openSync(stateDirectory, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+      const descriptorStat = fstatSync(stateDirectoryDescriptor);
+      if (descriptorStat.dev !== stateStat.dev || descriptorStat.ino !== stateStat.ino) {
+        throw Object.assign(new Error('provider state directory changed before containment'), { code: 'TERMINAL_CONTAINMENT_UNAVAILABLE' });
+      }
     }
-    const physicalProject = realpathSync(projectChain.reference);
-    const physicalState = realpathSync(stateDirectory);
+    const physicalProject = directoryPathSync(projectChain.descriptors.at(-1));
+    const physicalState = verificationIsolation ? stateDirectory : realpathSync(stateDirectory);
     if (pathContains(physicalProject, physicalState) || pathContains(physicalState, physicalProject)) {
       throw Object.assign(new Error('provider state and project directories must not physically overlap inside authority containment'), { code: 'TERMINAL_CONTAINMENT_UNAVAILABLE' });
     }
@@ -515,23 +683,22 @@ function buildAuthorityContainment({
         throw Object.assign(new Error('masked read path overlaps provider state or executable authority'), { code: 'TERMINAL_CONTAINMENT_UNAVAILABLE' });
       }
     }
-    stateDirectoryArgs = ['--bind-fd', '4', stateDirectory];
+    stateDirectoryArgs = verificationIsolation ? ['--dir', stateDirectory] : ['--bind-fd', '4', stateDirectory];
     // Provider-specific configuration is control-plane material too. A RAIL
     // execution may write its scoped product files, but cannot rewrite a
     // harness hook, skill, rule or config and then rely on that change in the
     // same contained process.
     for (const name of PROVIDER_CONTROL_PLANE_DIRECTORIES) {
-      const target = join(projectChain.reference, name);
       let targetStat;
-      try { targetStat = lstatSync(target); }
+      try { targetStat = lstatAtSync(projectChain.descriptors.at(-1), name); }
       catch (error) { if (error?.code === 'ENOENT') continue; throw error; }
       if (targetStat.isSymbolicLink() || !targetStat.isDirectory()) {
         throw Object.assign(new Error(`${name} control plane must be a real directory`), { code: 'TERMINAL_CONTAINMENT_UNAVAILABLE' });
       }
-      const descriptor = openSync(target, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+      const descriptor = openAtSync(projectChain.descriptors.at(-1), name, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
       const pinned = fstatSync(descriptor);
       if (pinned.dev !== targetStat.dev || pinned.ino !== targetStat.ino
-        || !pathContains(physicalProject, realpathSync(target))) {
+        || !pathContains(physicalProject, directoryPathSync(descriptor))) {
         closeSync(descriptor);
         throw Object.assign(new Error(`${name} control plane changed before containment`), { code: 'TERMINAL_CONTAINMENT_UNAVAILABLE' });
       }
@@ -540,6 +707,7 @@ function buildAuthorityContainment({
       controlPlaneArgs.push('--ro-bind-fd', String(descriptorNumber), join(cwd, name));
     }
   } catch (error) {
+    if (admissionHelper) closeSync(admissionHelper.descriptor);
     controlPlaneDescriptors.forEach((descriptor) => closeSync(descriptor));
     if (stateDirectoryDescriptor !== undefined) closeSync(stateDirectoryDescriptor);
     if (trustedProvider?.descriptor !== undefined) closeSync(trustedProvider.descriptor);
@@ -547,6 +715,7 @@ function buildAuthorityContainment({
     for (const descriptor of pinnedWriteScopes?.descriptors ?? []) try { closeSync(descriptor); } catch { /* already closed */ }
     for (const chain of maskedChains) closeDirectoryChain(chain);
     closeDirectoryChain(projectChain);
+    closeDirectoryChain(observerChain);
     closeSync(trustedBubblewrap.descriptor);
     if (error?.code === 'TERMINAL_CONTAINMENT_UNAVAILABLE' || error?.code?.startsWith('PROVIDER_EXECUTABLE_')) throw error;
     throw Object.assign(new Error(`cannot prepare provider state directory: ${error.message}`), { code: 'TERMINAL_CONTAINMENT_UNAVAILABLE' });
@@ -558,6 +727,9 @@ function buildAuthorityContainment({
   const promptDescriptorNumber = 6 + controlPlaneDescriptors.length + writableScopeDescriptors.length;
   const providerDescriptorNumber = promptDescriptorNumber + (promptRecord ? 1 : 0);
   const supportingProviderDescriptorNumber = providerDescriptorNumber + 1;
+  const observerDescriptorNumber = supportingProviderDescriptorNumber + trustedSupportingProviders.length;
+  const admissionHelperDescriptorNumber = observerDescriptorNumber + (observerChain ? 1 : 0);
+  const admissionControlDescriptorNumber = admissionHelperDescriptorNumber + 1;
   const supportingProviderArgs = trustedSupportingProviders.flatMap((support, index) => [
     '--ro-bind-fd', String(supportingProviderDescriptorNumber + index),
     join(dirname(CONTAINED_PROVIDER_EXECUTABLE_PATH), basename(support.binding.executable_path)),
@@ -565,15 +737,40 @@ function buildAuthorityContainment({
   const maskedPathArgs = maskedChains
     .filter((chain) => !pathContains('/tmp', chain.path))
     .flatMap((chain) => ['--tmpfs', chain.path]);
+  // Council artifacts are untrusted input. The review CLIs receive every byte
+  // in their private prompt and must not need a shell, host files, MCPs or web
+  // tools to inspect them. Hide the host home, root account and command trees
+  // structurally, while re-binding only the selected provider state needed by
+  // the CLI transport itself. This remains defense in depth beside the
+  // provider-specific no-tools modes below.
+  const councilHomeIsolationArgs = stateDirectory.startsWith('/root/')
+    ? ['--tmpfs', '/root', '--dir', stateDirectory]
+    : ['--tmpfs', '/home', '--dir', dirname(stateDirectory), '--dir', stateDirectory, '--tmpfs', '/root'];
+  const councilToolIsolationArgs = councilToolIsolation
+    ? [
+      ...councilHomeIsolationArgs,
+      '--tmpfs', '/usr/bin', '--tmpfs', '/usr/sbin',
+      '--tmpfs', '/usr/local/bin', '--tmpfs', '/usr/local/sbin',
+    ]
+    : [];
   const containmentArgs = [
     '--die-with-parent', '--unshare-pid', '--unshare-ipc', '--unshare-cgroup-try',
-    '--ro-bind', '/', '/',
+    ...(verificationIsolation ? [
+      '--unshare-net', '--unshare-uts',
+      // Checks run untrusted project code: expose runtime system files only,
+      // not a read-only view of the operator's files, credentials or brain.
+      ...['/usr', '/bin', '/sbin', '/lib', '/lib64'].filter((path) => existsSync(path))
+        .flatMap((path) => ['--ro-bind', path, path]),
+      '--dir', '/etc',
+      ...(existsSync('/etc/ld.so.cache') ? ['--ro-bind', '/etc/ld.so.cache', '/etc/ld.so.cache'] : []),
+    ] : ['--ro-bind', '/', '/']),
     '--dev', '/dev', '--proc', '/proc',
+    ...councilToolIsolationArgs,
     '--tmpfs', '/run/user',
     '--tmpfs', '/tmp',
-    ...readOnlyTmpPathEntries(),
+    ...(verificationIsolation ? [] : readOnlyTmpPathEntries()),
     ...maskedPathArgs,
-    ...hiddenInstallationAuthorityArgs(),
+    ...(verificationIsolation ? [] : hiddenInstallationAuthorityArgs()),
     ...stateDirectoryArgs,
     pinnedWriteScopes.fullProject ? '--bind-fd' : '--ro-bind-fd', '5', cwd,
     ...controlPlaneArgs,
@@ -581,8 +778,12 @@ function buildAuthorityContainment({
     ...(promptRecord ? ['--ro-bind-fd', String(promptDescriptorNumber), CONTAINED_PROMPT_PATH] : []),
     '--ro-bind-fd', String(providerDescriptorNumber), CONTAINED_PROVIDER_EXECUTABLE_PATH,
     ...supportingProviderArgs,
+    ...(observerChain ? ['--ro-bind-fd', String(observerDescriptorNumber), '/run/chati-observer-tools'] : []),
+    ...(admissionHelper ? ['--ro-bind-fd', String(admissionHelperDescriptorNumber), CONTAINED_EXECUTION_GATE_PATH] : []),
+    ...(admissionHelper ? ['--info-fd', String(admissionControlDescriptorNumber + 1)] : []),
     '--chdir', cwd,
-    '--', CONTAINED_PROVIDER_EXECUTABLE_PATH, ...args,
+    '--', ...(admissionHelper ? [CONTAINED_EXECUTION_GATE_PATH, String(admissionControlDescriptorNumber), '30000'] : []),
+    CONTAINED_PROVIDER_EXECUTABLE_PATH, ...args,
   ];
   return Object.freeze({
     kind: 'bubblewrap_pid_namespace_v1',
@@ -596,8 +797,13 @@ function buildAuthorityContainment({
       ...(promptRecord ? [promptRecord.descriptor] : []),
       trustedProvider.descriptor,
       ...trustedSupportingProviders.map((support) => support.descriptor),
+      ...(observerChain ? [observerChain.descriptors.at(-1)] : []),
+      ...(admissionHelper ? [admissionHelper.descriptor] : []),
     ]),
+    admissionHelper,
+    admissionControlDescriptorNumber: admissionHelper ? admissionControlDescriptorNumber : null,
     pinnedProjectChain: projectChain,
+    observerChain,
     maskedReadChains: Object.freeze(maskedChains),
     pinnedWriteScopes,
     projectReference: projectChain.reference,
@@ -612,6 +818,7 @@ function buildAuthorityContainment({
     digest: sha256({
       binary: BUBBLEWRAP_PATH,
       binary_sha256: trustedBubblewrap.binaryDigest,
+      ...(admissionHelper ? { admission_helper_sha256: admissionHelper.executable.digest } : {}),
       provider_executable: trustedProvider.binding,
       supporting_provider_executables: trustedSupportingProviders.map((support) => support.binding),
       args: containmentArgs.slice(0, -args.length - 1),
@@ -623,12 +830,267 @@ function closeAuthorityContainment(containment) {
   const descriptors = new Set([
     ...(containment?.inheritedDescriptors ?? []),
     ...(containment?.pinnedProjectChain?.descriptors ?? []),
+    ...(containment?.pinnedStateChain?.descriptors ?? []),
     ...(containment?.pinnedWriteScopes?.descriptors ?? []),
+    ...(containment?.observerChain?.descriptors ?? []),
   ]);
   for (const descriptor of descriptors) {
     try { closeSync(descriptor); } catch { /* preserve the primary spawn result */ }
   }
   for (const chain of containment?.maskedReadChains ?? []) closeDirectoryChain(chain);
+  for (const chain of containment?.controlPlaneChains ?? []) closeDirectoryChain(chain);
+}
+
+function assertAuthorityContainmentStable(containment) {
+  runTerminalSecurityTestHook('beforeAuthorityExecutableRevalidation', { containment });
+  if (containment.darwinLaunch) {
+    assertDarwinSealedLaunch(containment.darwinLaunch);
+    for (const chain of [containment.pinnedProjectChain, containment.pinnedStateChain,
+      ...containment.controlPlaneChains, ...containment.maskedReadChains].filter(Boolean)) assertPinnedDirectoryChain(chain);
+    assertPinnedWriteScopes(containment.pinnedWriteScopes);
+    for (const entry of containment.pinnedWriteScopes.entries) {
+      const stat = lstatSync(entry.target);
+      const matches = entry.kind === 'directory'
+        ? sameDirectorySnapshot(directorySnapshot(stat), entry.snapshot)
+        : sameExecutableSnapshot(executableSnapshot(stat), entry.snapshot);
+      if (realpathSync(entry.target) !== entry.target || !matches) return failContainment('Darwin write scope pathname no longer names its pinned target');
+    }
+    return true;
+  }
+  currentBubblewrapTrust(containment.inheritedDescriptors[0]);
+  digestPinnedExecutable(containment.inheritedDescriptors[0], containment.trustedExecutable);
+  if (containment.admissionHelper) digestPinnedExecutable(containment.admissionHelper.descriptor, containment.admissionHelper.executable);
+  const executable = digestProviderExecutable(
+    containment.providerExecutableDescriptor, containment.trustedProviderExecutable.snapshot,
+  );
+  if (executable.sha256 !== containment.providerExecutableBinding.executable_sha256) {
+    throw Object.assign(new Error('provider executable changed after installation binding validation'), { code: 'PROVIDER_EXECUTABLE_DRIFT' });
+  }
+  containment.supportingProviderExecutableDescriptors.forEach((descriptor, index) => {
+    const supporting = digestProviderExecutable(descriptor, containment.trustedSupportingProviderExecutables[index].snapshot);
+    if (supporting.sha256 !== containment.supportingProviderExecutableBindings[index].executable_sha256) {
+      throw Object.assign(new Error('provider supporting executable changed after installation binding validation'), { code: 'PROVIDER_EXECUTABLE_DRIFT' });
+    }
+  });
+  assertPinnedDirectoryChain(containment.pinnedProjectChain);
+  if (containment.observerChain) assertPinnedDirectoryChain(containment.observerChain);
+  for (const chain of containment.maskedReadChains) assertPinnedDirectoryChain(chain);
+  assertPinnedWriteScopes(containment.pinnedWriteScopes);
+  return true;
+}
+
+/**
+ * Execute one frozen check in a disposable result workspace. This low-level
+ * observer reports process facts only. It cannot issue certificates, assert a
+ * verdict or choose the canonical attempt, plan or commit for its caller.
+ */
+export async function runIsolatedVerificationCheck(options = {}) {
+  return runIsolatedVerificationProcess(options);
+}
+
+/** Internal trusted observer entry point; not exposed through check plans or CLI. */
+export async function runIsolatedBrowserSupervisor({ observerDirectory, ...options } = {}) {
+  if (typeof observerDirectory !== 'string' || !isAbsolute(observerDirectory)) {
+    throw Object.assign(new Error('browser observer requires private read-only tools'), { code: 'VERIFICATION_CHECK_INVALID' });
+  }
+  return runIsolatedVerificationProcess(options, observerDirectory);
+}
+
+/** Separate trusted role, never selectable by an application check plan. */
+export async function runIsolatedDarwinBrowserObserver({ observerDirectory, applicationProject, proxyPort, baseBundleId, applicationSignal, ...options } = {}) {
+  if (process.platform !== 'darwin') return failContainment('Darwin browser observer requires an actual Mac');
+  if (!(applicationSignal instanceof AbortSignal)) return failContainment('browser observer requires its owned application lifetime signal');
+  return runIsolatedVerificationProcess(options, null,
+    structuredClone({ observerDirectory, applicationProject, proxyPort, baseBundleId }), applicationSignal);
+}
+
+async function runIsolatedVerificationProcess(options = {}, observerDirectory = null, darwinBrowserObserver = null, applicationSignal = null) {
+  // Canonical CI/acceptance opts into immutable source; standalone disposable
+  // diagnostics retain their existing writable-subject default. Never CLI input.
+  const { workingDir, executableBinding, args, stdin, timeoutMs, subjectReadOnly = false } = options;
+  const fields = ['workingDir', 'executableBinding', 'args', 'stdin', 'timeoutMs', 'subjectReadOnly'];
+  if (Object.keys(options).some((field) => !fields.includes(field))
+    || (Object.hasOwn(options, 'subjectReadOnly') && typeof options.subjectReadOnly !== 'boolean')
+    || (subjectReadOnly && darwinBrowserObserver !== null)
+    || typeof workingDir !== 'string' || !isAbsolute(workingDir)
+    || !Array.isArray(args) || args.length > 64
+    || args.some((arg) => typeof arg !== 'string' || arg.includes('\0') || Buffer.byteLength(arg) > 8192)
+    || typeof stdin !== 'string' || stdin.length === 0 || Buffer.byteLength(stdin) > 1000000
+    || !Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 1800000) {
+    throw Object.assign(new Error('verification check requires bounded script, arguments, working directory and timeout only'), { code: 'VERIFICATION_CHECK_INVALID' });
+  }
+  if (process.platform === 'darwin') {
+    if (observerDirectory !== null) return failContainment('Darwin browser verification isolation is not implemented');
+    return runDarwinVerificationProcess(options, darwinBrowserObserver, applicationSignal);
+  }
+  let containment;
+  let child;
+  try {
+    containment = buildAuthorityContainment({
+      args: [...args], cwd: resolve(workingDir), readOnly: subjectReadOnly, writeScope: subjectReadOnly ? [] : ['.'],
+      terminalId: generateTerminalId('verification'), providerExecutableBinding: executableBinding,
+      verificationIsolation: true,
+      observerDirectory,
+    });
+    assertAuthorityContainmentStable(containment);
+    child = spawn(containment.command, containment.args, {
+      cwd: '/', detached: true,
+      env: { PATH: AUTHORITY_SYSTEM_PATH, LANG: 'C.UTF-8', LC_ALL: 'C.UTF-8', TZ: 'UTC', TMPDIR: '/tmp',
+        ...(observerDirectory ? { XDG_CACHE_HOME: '/tmp/chati-observer-cache', PLAYWRIGHT_BROWSERS_PATH: '/run/chati-observer-tools/chromium' } : {}),
+      },
+      stdio: ['pipe', 'pipe', 'pipe', ...containment.inheritedDescriptors],
+    });
+  } finally {
+    closeAuthorityContainment(containment);
+  }
+  return new Promise((resolveResult, reject) => {
+    const chunks = { stdout: [], stderr: [] };
+    const outputLimit = 2 * 1024 * 1024;
+    let outputBytes = 0;
+    let timedOut = false;
+    let outputLimitExceeded = false;
+    let inputError = null;
+    let spawnError = null;
+    const terminate = () => {
+      try { signalProcessTree(child, child.pid, 'SIGKILL'); }
+      catch (error) { spawnError ??= error; }
+    };
+    const timer = setTimeout(() => { timedOut = true; terminate(); }, timeoutMs);
+    for (const stream of ['stdout', 'stderr']) {
+      child[stream].on('data', (chunk) => {
+        const remaining = Math.max(0, outputLimit - outputBytes);
+        if (remaining > 0) chunks[stream].push(chunk.subarray(0, remaining));
+        outputBytes += chunk.length;
+        if (outputBytes > outputLimit) { outputLimitExceeded = true; terminate(); }
+      });
+    }
+    child.once('error', (error) => { spawnError = error; });
+    child.stdin.on('error', (error) => { inputError = error.code || error.name; });
+    child.once('close', (exitCode, signal) => {
+      clearTimeout(timer);
+      if (spawnError) { reject(spawnError); return; }
+      if (!processTreeStopsAfterClose(child.pid, child.pid)) {
+        terminate();
+        reject(Object.assign(new Error('verification process group did not terminate'), { code: 'VERIFICATION_PROCESS_STILL_RUNNING' }));
+        return;
+      }
+      const stdout = Buffer.concat(chunks.stdout);
+      const stderr = Buffer.concat(chunks.stderr);
+      resolveResult(Object.freeze({
+        exit_code: exitCode, signal, timed_out: timedOut, output_limit_exceeded: outputLimitExceeded,
+        input_error: inputError, process_tree_stopped: true,
+        subject_read_only: subjectReadOnly,
+        stdout: stdout.toString('utf8'), stderr: stderr.toString('utf8'),
+        stdout_base64: stdout.toString('base64'), stderr_base64: stderr.toString('base64'),
+        stdout_sha256: createHash('sha256').update(stdout).digest('hex'),
+        stderr_sha256: createHash('sha256').update(stderr).digest('hex'),
+        captured_output_bytes: stdout.length + stderr.length,
+        stdin_sha256: createHash('sha256').update(stdin).digest('hex'),
+        executable_binding: containment.providerExecutableBinding,
+        containment_kind: containment.kind, containment_digest: containment.digest,
+      }));
+    });
+    child.stdin.end(stdin);
+  });
+}
+
+async function runDarwinVerificationProcess(options, browserObserver = null, applicationSignal = null) {
+  const { executableBinding, args, stdin, timeoutMs, subjectReadOnly = false } = options;
+  const workingDir = realpathSync(options.workingDir);
+  const context = { authority_kind: 'verification_check', invocation_id: randomUUID(),
+    launch_nonce: randomUUID(), executable_binding_digest: sha256(executableBinding) };
+  let containment; let child; let timer; let escalation; let drainTimer; let cancelObserver;
+  const assertStable = () => browserObserver ? assertDarwinSealedLaunch(containment.darwinLaunch) : assertAuthorityContainmentStable(containment);
+  try {
+    if (browserObserver) {
+      const launch = prepareDarwinBrowserObserverLaunch({ binding: executableBinding, args: [...args], projectDir: workingDir,
+        authorityContext: context, ...browserObserver });
+      containment = { darwinLaunch: launch, kind: launch.kind, providerExecutableBinding: structuredClone(executableBinding),
+        digest: sha256({ role: 'browser-observer', helper_sha256: launch.helperSha256, policy_digest: launch.policyDigest,
+          executable_binding: executableBinding, native_nonce: launch.supervisorChannels.nonce }) };
+    } else {
+      containment = buildAuthorityContainment({ args: [...args], cwd: workingDir,
+        readOnly: subjectReadOnly, writeScope: subjectReadOnly ? [] : ['.'],
+        terminalId: generateTerminalId('verification'), providerExecutableBinding: executableBinding,
+        verificationIsolation: true, authorityContext: context });
+    }
+    assertStable();
+    const launch = containment.darwinLaunch;
+    child = spawn(launch.command, launch.args, { cwd: '/', detached: true,
+      env: { PATH: '/usr/bin:/bin:/usr/sbin:/sbin', LANG: 'C.UTF-8', LC_ALL: 'C.UTF-8', TZ: 'UTC',
+        HOME: launch.temporaryDirectory, TMPDIR: launch.temporaryDirectory },
+      stdio: ['pipe', 'pipe', 'pipe', 'ignore', launch.projectDescriptor, ...launch.supervisorChannels.inheritedDescriptors] });
+    let ready; let setupError; let inputError = null; let spawnError = null;
+    let timedOut = false; let outputLimitExceeded = false; let outputBytes = 0;
+    const chunks = { stdout: [], stderr: [] };
+    const stop = (signal = 'SIGTERM') => {
+      if (child.exitCode !== null || child.signalCode !== null) return;
+      try { signalProcessTree(child, child.pid, signal); } catch (error) { spawnError ??= error; }
+      if (!escalation) escalation = setTimeout(() => {
+        if (child.exitCode !== null || child.signalCode !== null) return;
+        try { signalProcessTree(child, child.pid, 'SIGKILL'); } catch { /* failed completion is not success */ }
+      }, 2000);
+    };
+    const finished = new Promise((done, reject) => {
+      for (const stream of ['stdout', 'stderr']) child[stream].on('data', bytes => {
+        const available = Math.max(0, 2 * 1024 * 1024 - outputBytes);
+        if (available) chunks[stream].push(bytes.subarray(0, available));
+        outputBytes += bytes.length;
+        if (outputBytes > 2 * 1024 * 1024 && !outputLimitExceeded) { outputLimitExceeded = true; stop(); }
+      });
+      child.once('error', error => { spawnError = error; });
+      child.stdin.on('error', error => { inputError = error.code || error.name; });
+      // A detached writer may keep stdout open after the helper exits. Bound
+      // this drain and reject, never accept truncated output or wait forever.
+      child.once('exit', () => {
+        clearTimeout(timer); clearTimeout(escalation);
+        drainTimer = setTimeout(() => {
+          child.stdout.destroy(); child.stderr.destroy(); child.stdin.destroy();
+          reject(Object.assign(new Error('verification output did not close after native helper exit'), { code: 'VERIFICATION_OUTPUT_NOT_CLOSED' }));
+        }, 2000);
+      });
+      child.once('close', (exitCode, signal) => {
+        try {
+          if (setupError || spawnError) throw setupError || spawnError;
+          const completion = launch.supervisorChannels.readCompletion(exitCode);
+          assertStable();
+          const stdout = Buffer.concat(chunks.stdout); const stderr = Buffer.concat(chunks.stderr);
+          const facts = { exit_code: exitCode, signal, timed_out: timedOut, output_limit_exceeded: outputLimitExceeded,
+            input_error: inputError, process_tree_stopped: false, process_group_stopped: true,
+            subject_read_only: subjectReadOnly,
+            stdout: stdout.toString('utf8'), stderr: stderr.toString('utf8'),
+            stdout_base64: stdout.toString('base64'), stderr_base64: stderr.toString('base64'),
+            stdout_sha256: createHash('sha256').update(stdout).digest('hex'), stderr_sha256: createHash('sha256').update(stderr).digest('hex'),
+            captured_output_bytes: stdout.length + stderr.length, stdin_sha256: createHash('sha256').update(stdin).digest('hex'),
+            executable_binding: projectVerificationExecutableBinding(containment.providerExecutableBinding, executableBinding),
+            containment_kind: containment.kind, containment_digest: containment.digest,
+            darwin_verification_binding: createDarwinVerificationBinding({ context, helperSha256: launch.helperSha256,
+              policyDigest: launch.policyDigest, ready, completion, workingDir, executableBinding, args, stdin }) };
+          verificationProcessCompleted(facts, { ...options, workingDir });
+          done(Object.freeze(facts));
+        } catch (error) { reject(error); }
+      });
+    });
+    timer = setTimeout(() => { timedOut = true; stop(); }, timeoutMs);
+    if (applicationSignal) {
+      cancelObserver = () => { spawnError ??= Object.assign(new Error('browser application exited during observation'), { code: 'BROWSER_APPLICATION_EXITED' }); stop(); };
+      applicationSignal.addEventListener('abort', cancelObserver, { once: true });
+    }
+    try {
+      if (applicationSignal?.aborted) throw Object.assign(new Error('browser application already exited'), { code: 'BROWSER_APPLICATION_EXITED' });
+      ready = launch.supervisorChannels.readReady(child.pid, launch.verifiedCdhash);
+      assertStable();
+      launch.supervisorChannels.authorize();
+      child.stdin.end(stdin);
+    } catch (error) { setupError = error; stop('SIGKILL'); }
+    return await finished;
+  } finally {
+    if (cancelObserver) applicationSignal.removeEventListener('abort', cancelObserver);
+    clearTimeout(timer); clearTimeout(escalation); clearTimeout(drainTimer);
+    // No recursive cleanup of a potentially detached writer's mutable TMP.
+    try { if (containment?.darwinLaunch) disposeDarwinSealedLaunch(containment.darwinLaunch); }
+    finally { closeAuthorityContainment(containment); }
+  }
 }
 
 function signalProcessTree(child, processGroupId, signal) {
@@ -655,7 +1117,55 @@ function processTreeStopsAfterClose(childPid, processGroupId) {
   return false;
 }
 
-function terminalAuthorityReceipt(material) {
+async function stopDarwinAuthority(runtime) {
+  const child = runtime.child;
+  const wasRunning = !runtime.finalized;
+  if (wasRunning) runtime.killRequested = true;
+  const signalHelper = (signal) => {
+    // The native helper owns a SEPARATE admitted provider process group. On
+    // Darwin its own zombie-only group may report EPERM. Never interpret a
+    // lookup of that group (or a reused PID after close) as provider lifetime.
+    if (child.exitCode === null && child.signalCode === null) {
+      try { child.kill(signal); } catch { /* only private completion can prove cleanup */ }
+    }
+  };
+  const waitForClose = async () => {
+    let timer;
+    try {
+      return await Promise.race([
+        runtime.exitPromise.then(() => true),
+        new Promise(resolve => { timer = setTimeout(() => resolve(false), 5000); }),
+      ]);
+    } finally { clearTimeout(timer); }
+  };
+  if (wasRunning) {
+    signalHelper('SIGTERM');
+    if (!(await waitForClose())) {
+      signalHelper('SIGKILL');
+      if (!(await waitForClose())) {
+        throw Object.assign(new Error('native Darwin helper did not close with a private completion'),
+          { code: 'TERMINAL_PROCESS_TREE_UNRESOLVED' });
+      }
+    }
+  }
+  // SIGKILL/ESRCH/helper exit alone is never positive completion evidence.
+  // readCompletion in finalize validates the original READY/GO binding and
+  // scoped group emptiness; detached descendants remain explicitly unknown.
+  if (runtime.timeoutCleanupFailure) throw runtime.timeoutCleanupFailure;
+  if (!runtime.darwinCompletion) {
+    throw Object.assign(new Error('Darwin cleanup requires its private supervisor observation'),
+      { code: 'DARWIN_COMPLETION_OBSERVATION_REQUIRED' });
+  }
+  return { killed: wasRunning, exitCode: runtime.exitCode };
+}
+
+function terminalAuthorityReceipt(material, { launchReceipt } = {}) {
+  if (material.purpose === 'terminal_launch' && material.process_containment_kind === 'darwin_scoped_process_group_v1') {
+    assertDarwinTerminalLaunch(material);
+  }
+  if (launchReceipt?.process_containment_kind === 'darwin_scoped_process_group_v1') {
+    assertDarwinTerminalCompletion(material, launchReceipt);
+  }
   const signed = signHostAuthorityPayload(canonicalize(material), {
     domain: TERMINAL_AUTHORITY_DOMAIN,
   });
@@ -727,10 +1237,18 @@ export function getTerminalCompletionAuthorityReceipt(handle) {
   if (runtime.outputOverflow) {
     throw Object.assign(new Error('terminal output exceeded the authority capture limit'), { code: 'TERMINAL_OUTPUT_OVERFLOW' });
   }
-  if (!processTreeStopsAfterClose(runtime.child.pid, runtime.processGroupId)) {
+  if (state.launchReceipt.darwin_launch_binding && !runtime.darwinCompletion) {
+    throw Object.assign(new Error('Darwin completion requires its private supervisor observation'), { code: 'DARWIN_COMPLETION_OBSERVATION_REQUIRED' });
+  }
+  if (!state.launchReceipt.darwin_launch_binding
+    && !processTreeStopsAfterClose(runtime.child.pid, runtime.processGroupId)) {
     try { signalProcessTree(runtime.child, runtime.processGroupId, 'SIGKILL'); } catch { /* fail closed below */ }
     throw Object.assign(new Error('terminal process group remained active after the provider CLI exited'), { code: 'TERMINAL_PROCESS_GROUP_STILL_RUNNING' });
   }
+  if (state.launchReceipt.process_namespace_identity
+    && observeLinuxNamespace(state.launchReceipt.process_namespace_identity, { timeoutMs: 500 }).status !== 'exited') {
+    throw Object.assign(new Error('the exact provider namespace has not finished exiting'), { code: 'TERMINAL_NAMESPACE_STILL_RUNNING' });
+  }
   if (!state.completionReceipt) {
     const stdout = runtime.stdout.join('');
     let railResult = null;
@@ -762,6 +1280,13 @@ export function getTerminalCompletionAuthorityReceipt(handle) {
       schema_version: 1,
       purpose: 'terminal_completion',
       launch_receipt_digest: sha256(state.launchReceipt),
+      ...(state.launchReceipt.process_namespace_identity ? {
+        process_namespace_identity_digest: sha256(state.launchReceipt.process_namespace_identity),
+      } : {}),
+      ...(runtime.darwinCompletion ? {
+        darwin_launch_binding_digest: sha256(state.launchReceipt.darwin_launch_binding),
+        darwin_completion_observation: runtime.darwinCompletion,
+      } : {}),
       terminal_id: identity.terminal_id,
       invocation_id: state.context.invocation_id,
       launch_nonce: state.context.launch_nonce,
@@ -790,12 +1315,15 @@ export function getTerminalCompletionAuthorityReceipt(handle) {
       } : {}),
       ...(railResult || {}),
       completed_at: runtime.completedAt,
-    });
+      process_time_kind: 'provider-invocation-wall-time',
+      process_elapsed_ms: runtime.processElapsedMs,
+    }, { launchReceipt: state.launchReceipt });
   }
   return state.completionReceipt;
 }
 
-/** Wait for an authority terminal and propagate timeout cleanup proof failures. */
+/** Wait for an authority terminal and propagate cleanup/private completion failures.
+ * Darwin completion proves the scoped process group, not all detached descendants. */
 export async function waitForTerminal(handle) {
   const state = TERMINAL_AUTHORITY_STATE.get(handle);
   if (!state) {
@@ -818,6 +1346,10 @@ export async function waitForTerminal(handle) {
     if (!cleanup.ok) throw cleanup.error;
   }
   if (runtime.timeoutCleanupFailure) throw runtime.timeoutCleanupFailure;
+  // Planning's retry wrapper must not accept output or retry an exited helper
+  // without a complete, bound private observation. The other Darwin consumers
+  // use this same wait boundary; none may interpret an exit event as proof.
+  if (state.launchReceipt.darwin_launch_binding) getTerminalCompletionAuthorityReceipt(handle);
   return handle;
 }
 
@@ -869,11 +1401,18 @@ const BLOCKED_ENV_EXACT = ['CLAUDECODE'];
  * User-configured vars like CLAUDE_API_KEY are preserved.
  *
  * @param {Record<string, string>} env - Source environment (typically process.env)
+ * @param {object} [options] - Explicit child provider and secret policy
  * @returns {Record<string, string>} Cleaned environment (new object)
  */
-export function cleanParentEnv(env) {
+export function cleanParentEnv(env, { provider, allowProviderSecrets = true } = {}) {
   const cleaned = {};
   for (const [key, value] of Object.entries(env)) {
+    // setup-token is an authentication credential, not parent session state.
+    // Unknown/other providers and secret-free launches must still strip it.
+    if (key === 'CLAUDE_CODE_OAUTH_TOKEN' && provider === 'claude' && allowProviderSecrets) {
+      cleaned[key] = value;
+      continue;
+    }
     if (BLOCKED_ENV_EXACT.includes(key)) continue;
     if (BLOCKED_ENV_PREFIXES.some(prefix => key.startsWith(prefix))) continue;
     cleaned[key] = value;
@@ -888,10 +1427,10 @@ const AUTHORITY_PROVIDER_SECRET_PREFIXES = Object.freeze({
 });
 const AUTHORITY_SECRET_NAME = /(API[_-]?KEY|ACCESS[_-]?KEY|PRIVATE[_-]?KEY|PASSWORD|SECRET|TOKEN|CREDENTIAL|AUTH[_-]?SOCK)/i;
 
-export function cleanAuthorityEnv(env, provider) {
-  const allowedPrefixes = AUTHORITY_PROVIDER_SECRET_PREFIXES[provider] || [];
+export function cleanAuthorityEnv(env, provider, { allowProviderSecrets = true } = {}) {
+  const allowedPrefixes = allowProviderSecrets ? (AUTHORITY_PROVIDER_SECRET_PREFIXES[provider] || []) : [];
   const cleaned = {};
-  for (const [key, value] of Object.entries(cleanParentEnv(env))) {
+  for (const [key, value] of Object.entries(cleanParentEnv(env, { provider, allowProviderSecrets }))) {
     if (AUTHORITY_SECRET_NAME.test(key) && !allowedPrefixes.some((prefix) => key.startsWith(prefix))) continue;
     cleaned[key] = value;
   }
@@ -920,8 +1459,10 @@ export function cleanAuthorityEnv(env, provider) {
  * @property {number} [timeout]        - Max execution time in ms
  * @property {function} [beforeProcessSpawn] - Read-only preparation after containment is pinned
  * @property {function} [beforeAuthoritySpawn] - Final synchronous authority reservation before spawn
+ * @property {function} [afterAuthoritySpawn] - Commit dispatch with (receipt, handle) before positive-GO
  * @property {string[]} [maskedReadPaths] - Canonical host paths hidden from an authority provider
  * @property {string} [auditProjectDir] - Canonical CHATI project used only for the host-side model audit
+ * @property {boolean} [councilToolIsolation] - Disable local tools for an untrusted council subject
  */
 
 /**
@@ -976,6 +1517,7 @@ export function buildSpawnCommand(config) {
 
   const env = {
     ...isolationEnv,
+    ...(config.providerExecutableBinding !== undefined ? sealedProviderRuntimeEnvironment(config.provider) : {}),
     CHATI_TERMINAL_ID: terminalId,
     CHATI_AGENT: config.agent,
     CHATI_TASK_ID: config.taskId,
@@ -1050,47 +1592,93 @@ export function spawnTerminal(config) {
         throw Object.assign(new Error(`authorityContext.${field} is required`), { code: 'INVALID_TERMINAL_AUTHORITY_CONTEXT' });
       }
     }
+    // Only callers with an explicit Darwin lifetime/cleanup contract are enabled.
+    if (process.platform === 'darwin'
+      && !['rail_execution', 'rail_review', 'rail_adjudication', 'planning_execution', 'council_gate'].includes(authorityContext.authority_kind)) {
+      throw Object.assign(new Error(`Darwin lifetime and cleanup are not integrated for ${authorityContext.authority_kind}`), {
+        code: 'DARWIN_AUTHORITY_CONSUMER_UNAVAILABLE',
+      });
+    }
   }
 
   const readOnly = Array.isArray(config.writeScope) && config.writeScope.length === 0;
   if (config.beforeProcessSpawn !== undefined && typeof config.beforeProcessSpawn !== 'function') {
     throw Object.assign(new Error('beforeProcessSpawn must be a function'), { code: 'INVALID_TERMINAL_PRESPAWN_HOOK' });
   }
+
+  // Snapshot the eligibility before caller hooks. The sealed Claude transport
+  // needs its own auth even when council subjects have no tools/host secrets.
+  // This is not a prefix exception and does not change general secret filtering.
+  const councilClaudeTransportAuth = actualProvider === 'claude' && readOnly
+    && config.councilToolIsolation === true && authorityContext?.authority_kind === 'council_gate';
   if (config.beforeAuthoritySpawn !== undefined
     && (authorityContext === undefined || typeof config.beforeAuthoritySpawn !== 'function')) {
     throw Object.assign(new Error('beforeAuthoritySpawn requires an authority context and callback'), { code: 'INVALID_TERMINAL_PRESPAWN_HOOK' });
   }
+  if (config.afterAuthoritySpawn !== undefined
+    && (authorityContext?.authority_kind !== 'rail_execution' || typeof config.afterAuthoritySpawn !== 'function')) {
+    throw Object.assign(new Error('afterAuthoritySpawn requires a RAIL execution authority and synchronous durable-dispatch callback'), { code: 'INVALID_TERMINAL_ADMISSION_HOOK' });
+  }
 
   const detachedProcessGroup = authorityContext !== undefined && process.platform !== 'win32';
   let promptRecord;
   let containment;
   let sealedProvider;
+  let darwinLaunch;
+  let darwinCompletionError;
+  let darwinReady;
+  let darwinRuntimeOwned = false;
+  let darwinDisposed = false;
+  const disposeDarwin = (validate = false) => {
+    if (!darwinLaunch || darwinDisposed) return;
+    darwinDisposed = true;
+    try { if (validate) assertDarwinSealedLaunch(darwinLaunch); }
+    catch (error) { darwinCompletionError = error; }
+    try { disposeDarwinSealedLaunch(darwinLaunch); }
+    catch (error) { darwinCompletionError ??= error; }
+  };
   let executionWorktreeBaseline;
+  let executionAdmissionReceipt;
+  let darwinHostBootIdentity;
+  let executionNamespaceIdentity;
+  let processInfoPipe;
   let spawnArgs = args;
   let child;
+  let processStartedTick;
   try {
     if (promptFile !== null) {
       promptRecord = openPrivatePromptFile(promptFile);
-      spawnArgs = materializePrivatePromptArgs(args, authorityContext === undefined
-        ? '/proc/self/fd/3'
+      spawnArgs = materializePrivatePromptArgs(args, authorityContext === undefined || process.platform === 'darwin'
+        ? (process.platform === 'darwin' ? '/dev/fd/3' : '/proc/self/fd/3')
         : CONTAINED_PROMPT_PATH);
     }
     containment = authorityContext === undefined ? null : buildAuthorityContainment({
       args: spawnArgs, cwd: resolve(cwd), readOnly, terminalId, provider: actualProvider,
       writeScope: config.writeScope, providerExecutableBinding: config.providerExecutableBinding, promptRecord,
       maskedReadPaths: config.maskedReadPaths,
+      councilToolIsolation: config.councilToolIsolation === true,
+      executionAdmission: config.afterAuthoritySpawn !== undefined,
+      authorityContext,
     });
+    darwinLaunch = containment?.darwinLaunch;
     if (!containment && config.providerExecutableBinding !== undefined) {
-      if (process.platform !== 'linux') {
+      if (process.platform === 'darwin') {
+        darwinLaunch = prepareDarwinSealedLaunch({
+          binding: config.providerExecutableBinding, harnessId: actualProvider,
+          projectDir: cwd, args: spawnArgs, hasPrompt: Boolean(promptRecord),
+          promptDirectory: promptRecord?.directory,
+        });
+      } else if (process.platform === 'linux') {
+        sealedProvider = openPinnedProviderExecutable(config.providerExecutableBinding, {
+          harnessId: actualProvider,
+          projectDir: cwd,
+        });
+      } else {
         throw Object.assign(
-          new Error('sealed Planning provider execution requires Linux descriptor execution'),
+          new Error('sealed Planning provider execution is unavailable on this platform'),
           { code: 'PROVIDER_EXECUTABLE_UNSUPPORTED' },
         );
       }
-      sealedProvider = openPinnedProviderExecutable(config.providerExecutableBinding, {
-        harnessId: actualProvider,
-        projectDir: cwd,
-      });
     }
     const auditProjectDir = config.auditProjectDir ? resolve(config.auditProjectDir) : null;
     if (containment && auditProjectDir && auditProjectDir !== resolve(cwd)
@@ -1121,28 +1709,9 @@ export function spawnTerminal(config) {
     }
 
     if (config.beforeProcessSpawn) config.beforeProcessSpawn();
+    if (darwinLaunch) assertDarwinSealedLaunch(darwinLaunch);
     if (containment) {
-      runTerminalSecurityTestHook('beforeAuthorityExecutableRevalidation', { containment });
-      currentBubblewrapTrust(containment.inheritedDescriptors[0]);
-      digestPinnedExecutable(containment.inheritedDescriptors[0], containment.trustedExecutable);
-      const providerExecutable = digestProviderExecutable(
-        containment.providerExecutableDescriptor,
-        containment.trustedProviderExecutable.snapshot,
-      );
-      if (providerExecutable.sha256 !== containment.providerExecutableBinding.executable_sha256) {
-        throw Object.assign(new Error('provider executable changed after installation binding validation'), { code: 'PROVIDER_EXECUTABLE_DRIFT' });
-      }
-      containment.supportingProviderExecutableDescriptors.forEach((descriptor, index) => {
-        const supportingExecutable = digestProviderExecutable(
-          descriptor, containment.trustedSupportingProviderExecutables[index].snapshot,
-        );
-        if (supportingExecutable.sha256 !== containment.supportingProviderExecutableBindings[index].executable_sha256) {
-          throw Object.assign(new Error('provider supporting executable changed after installation binding validation'), { code: 'PROVIDER_EXECUTABLE_DRIFT' });
-        }
-      });
-      assertPinnedDirectoryChain(containment.pinnedProjectChain);
-      for (const chain of containment.maskedReadChains) assertPinnedDirectoryChain(chain);
-      assertPinnedWriteScopes(containment.pinnedWriteScopes);
+      assertAuthorityContainmentStable(containment);
     } else if (sealedProvider) {
       const providerExecutable = digestProviderExecutable(
         sealedProvider.descriptor,
@@ -1155,26 +1724,65 @@ export function spawnTerminal(config) {
     if (executionWorktreeBaseline) {
       executionWorktreeBaseline = assertRailExecutionWorktreeBaselineUnchanged(executionWorktreeBaseline);
     }
+    if (darwinLaunch?.supervisorChannels) darwinHostBootIdentity = captureDarwinHostBootIdentity();
+    if (containment?.admissionHelper || (darwinLaunch?.supervisorChannels && config.afterAuthoritySpawn)) {
+      if (containment.admissionHelper) processInfoPipe = [...createLinuxProcessInfoPipe()];
+      if (!executionWorktreeBaseline) {
+        throw Object.assign(new Error('execution admission requires an observed canonical repository baseline'), { code: 'EXECUTION_ADMISSION_BASE_REQUIRED' });
+      }
+      executionAdmissionReceipt = terminalAuthorityReceipt({
+        schema_version: 1, purpose: 'terminal_execution_admission', authority_kind: 'rail_execution',
+        execution_admission_protocol: 'native-positive-go-v1',
+        execution_admission_helper_sha256: containment.admissionHelper?.executable.digest ?? darwinLaunch.helperSha256,
+        invocation_id: authorityContext.invocation_id, launch_nonce: authorityContext.launch_nonce,
+        terminal_id: terminalId, task_id: config.taskId,
+        supervisor_process_id: `process://chati/${process.pid}`, supervisor_hostname: hostname(),
+        ...(darwinHostBootIdentity ? { darwin_host_boot_identity: darwinHostBootIdentity } : {}),
+        working_dir: resolve(cwd), project_identity_digest: containment.projectIdentityDigest,
+        prompt_digest: sha256(config.prompt ?? ''), provider_id: authorityContext.provider_id,
+        harness_id: actualProvider, model_id: actualModel, reasoning_configuration: actualReasoningConfiguration,
+        provider_executable_path: containment.providerExecutableBinding.executable_path,
+        provider_executable_sha256: containment.providerExecutableBinding.executable_sha256,
+        execution_base_commit_ref: executionWorktreeBaseline.base_commit_ref,
+        execution_launch_head_ref: executionWorktreeBaseline.launch_head_ref,
+        execution_repository_identity_digest: executionWorktreeBaseline.repository_identity_digest,
+        execution_preexisting_commits_digest: executionWorktreeBaseline.preexisting_commits_digest,
+        execution_worktree_clean: true,
+      });
+    }
     if (config.beforeAuthoritySpawn) {
       config.beforeAuthoritySpawn(Object.freeze({
         working_dir: resolve(cwd),
         project_identity_digest: containment.projectIdentityDigest,
+        ...(executionAdmissionReceipt ? { admission_receipt: executionAdmissionReceipt } : {}),
       }));
+      runTerminalSecurityTestHook('afterAuthorityLaunchReservation', {});
     }
     if (executionWorktreeBaseline) {
       executionWorktreeBaseline = assertRailExecutionWorktreeBaselineUnchanged(executionWorktreeBaseline);
     }
     const sealedProviderDescriptorNumber = 3 + (promptRecord ? 1 : 0);
     const spawnCommand = containment?.command
+      ?? darwinLaunch?.command
       ?? (sealedProvider ? `/proc/self/fd/${sealedProviderDescriptorNumber}` : command);
-    child = spawn(spawnCommand, containment?.args ?? spawnArgs, {
-      cwd: containment ? '/' : cwd,
+    processStartedTick = process.hrtime.bigint();
+    child = spawn(spawnCommand, containment?.args ?? darwinLaunch?.args ?? spawnArgs, {
+      cwd: containment || darwinLaunch ? '/' : cwd,
       env: {
-        ...(containment ? cleanAuthorityEnv(process.env, actualProvider) : cleanParentEnv(process.env)), ...env,
-        ...(containment ? { TMPDIR: '/tmp', TMP: '/tmp', TEMP: '/tmp' } : {}),
+        ...(containment ? cleanAuthorityEnv(process.env, actualProvider, {
+          allowProviderSecrets: config.councilToolIsolation !== true,
+        }) : cleanParentEnv(process.env, {
+          provider: actualProvider, allowProviderSecrets: config.councilToolIsolation !== true,
+        })), ...env,
+        ...(containment && councilClaudeTransportAuth && typeof process.env.CLAUDE_CODE_OAUTH_TOKEN === 'string'
+          ? { CLAUDE_CODE_OAUTH_TOKEN: process.env.CLAUDE_CODE_OAUTH_TOKEN } : {}),
+        ...(containment ? Object.fromEntries(['TMPDIR', 'TMP', 'TEMP'].map(key => [key, darwinLaunch?.temporaryDirectory ?? '/tmp'])) : {}),
       },
-      stdio: containment
-        ? ['pipe', 'pipe', 'pipe', ...containment.inheritedDescriptors]
+      stdio: darwinLaunch
+        ? ['pipe', 'pipe', 'pipe', promptRecord ? promptRecord.descriptor : 'ignore', darwinLaunch.projectDescriptor,
+            ...(darwinLaunch.supervisorChannels?.inheritedDescriptors ?? [])]
+        : containment
+        ? ['pipe', 'pipe', 'pipe', ...containment.inheritedDescriptors, ...(containment.admissionHelper ? ['pipe', processInfoPipe[1]] : [])]
         : [
             'pipe', 'pipe', 'pipe',
             ...(promptRecord ? [promptRecord.descriptor] : []),
@@ -1182,23 +1790,49 @@ export function spawnTerminal(config) {
           ],
       detached: detachedProcessGroup,
     });
+    // Post-spawn identity reads may throw synchronously. Register ownership
+    // cleanup first so the error path cannot strand a private file prompt.
     if (promptRecord) {
       child.once('exit', () => cleanupPrivatePromptFile(promptRecord));
       child.once('error', () => cleanupPrivatePromptFile(promptRecord));
     }
+    if (darwinLaunch) {
+      // Until the trusted runtime owns completion, failed setup still owns its
+      // resources. Authority launches must keep the completion pipe alive past
+      // exit and read it only after stdio has drained on close.
+      if (darwinLaunch.supervisorChannels) {
+        child.once('close', () => { if (!darwinRuntimeOwned) disposeDarwin(true); });
+      } else child.once('exit', () => disposeDarwin(true));
+      child.once('error', () => { if (!darwinRuntimeOwned) disposeDarwin(); });
+    }
+    if (processInfoPipe) {
+      closeSync(processInfoPipe[1]); processInfoPipe[1] = null;
+      const info = JSON.parse(readLinuxProcessInfoPipe(processInfoPipe[0]));
+      runTerminalSecurityTestHook('beforeLinuxNamespaceIdentityCapture', { info, child });
+      executionNamespaceIdentity = captureLinuxNamespaceIdentity(info, child.pid);
+    }
+    if (darwinLaunch?.supervisorChannels) {
+      darwinReady = darwinLaunch.supervisorChannels.readReady(child.pid, darwinLaunch.verifiedCdhash);
+      assertAuthorityContainmentStable(containment);
+    }
     if (containment) {
       assertPinnedDirectoryChain(containment.pinnedProjectChain);
     }
   } catch (error) {
+    if (darwinLaunch?.supervisorChannels) {
+      try { darwinLaunch.supervisorChannels.dispose(); } catch (cleanupError) { error.darwinChannelCleanupError = cleanupError; }
+    }
     if (child?.pid) {
       try { signalProcessTree(child, detachedProcessGroup ? child.pid : null, 'SIGKILL'); } catch { /* reservation remains fail-closed */ }
     }
     throw error;
   } finally {
+    for (const fd of processInfoPipe ?? []) if (fd !== null) closeSync(fd);
     if (containment) closeAuthorityContainment(containment);
     if (sealedProvider?.descriptor !== undefined) try { closeSync(sealedProvider.descriptor); } catch { /* child inherited its own descriptor */ }
     if (promptRecord) try { closeSync(promptRecord.descriptor); } catch { /* containment already closed it */ }
     if (promptRecord && !child) cleanupPrivatePromptFile(promptRecord);
+    if (darwinLaunch && !child) disposeDarwin();
   }
   const processGroupId = detachedProcessGroup ? child.pid : null;
 
@@ -1222,13 +1856,17 @@ export function spawnTerminal(config) {
     stderrBytes: 0,
     outputOverflow: false,
     completedAt: null,
+    processElapsedMs: null,
     killRequested: false,
     finalized: false,
     exitPromise: new Promise((resolveExit) => { resolveAuthorityExit = resolveExit; }),
     cleanupFailureSignal: new Promise((resolveFailure) => { signalAuthorityCleanupFailure = resolveFailure; }),
+    signalCleanupFailure: signalAuthorityCleanupFailure,
     timeoutCleanupPromise: null,
     timeoutCleanupSettled: false,
     timeoutCleanupFailure: null,
+    darwinCompletion: null,
+    darwinStopPromise: null,
   };
   const processFacade = runtime ? new EventEmitter() : child;
   if (runtime) {
@@ -1238,7 +1876,9 @@ export function spawnTerminal(config) {
     });
     Object.defineProperty(processFacade, 'kill', {
       enumerable: true,
-      value: (signal) => signalProcessTree(child, processGroupId, signal),
+      value: (signal) => darwinLaunch?.supervisorChannels
+        ? (child.exitCode === null && child.signalCode === null ? child.kill(signal) : false)
+        : signalProcessTree(child, processGroupId, signal),
     });
   }
 
@@ -1255,6 +1895,21 @@ export function spawnTerminal(config) {
     startedAt: new Date().toISOString(),
     timeout,
   };
+  const diagnosticObservation = {
+    timeout, elapsedMs: null, exitCode: null, timedOut: false, terminationCause: 'unknown',
+  };
+  TERMINAL_DIAGNOSTIC_OBSERVATIONS.set(handle, diagnosticObservation);
+  const observeTermination = (code, signal, error = false) => {
+    if (diagnosticObservation.elapsedMs !== null) return;
+    diagnosticObservation.elapsedMs = Number(process.hrtime.bigint() - processStartedTick) / 1e6;
+    diagnosticObservation.exitCode = Number.isInteger(code) ? code : null;
+    if (diagnosticObservation.terminationCause === 'unknown') {
+      diagnosticObservation.terminationCause = error ? 'spawn_error'
+        : signal ? 'signal' : Number.isInteger(code) ? 'exit' : 'unknown';
+    }
+  };
+  child.once(runtime ? 'close' : 'exit', (code, signal) => observeTermination(code, signal));
+  child.once('error', () => observeTermination(null, null, true));
 
   if (runtime) {
     Object.defineProperties(handle, {
@@ -1277,7 +1932,8 @@ export function spawnTerminal(config) {
       provider_executable_path: containment.providerExecutableBinding.executable_path,
       provider_executable_sha256: containment.providerExecutableBinding.executable_sha256,
     });
-    const launchReceipt = terminalAuthorityReceipt({
+    let launchReceipt;
+    try { launchReceipt = terminalAuthorityReceipt({
       schema_version: 1,
       purpose: 'terminal_launch',
       authority_kind: context.authority_kind,
@@ -1290,6 +1946,17 @@ export function spawnTerminal(config) {
       process_containment_kind: containment.kind,
       process_containment_id: containment.id,
       process_containment_digest: containment.digest,
+      ...(executionNamespaceIdentity ? { process_namespace_identity: executionNamespaceIdentity } : {}),
+      ...(darwinReady ? {
+        darwin_launch_binding: createDarwinTerminalLaunchBinding({ helperSha256: darwinLaunch.helperSha256,
+          policyDigest: darwinLaunch.policyDigest, ready: darwinReady, writeScopes: containment.pinnedWriteScopes,
+          hostBootIdentity: darwinHostBootIdentity }),
+      } : {}),
+      ...(executionAdmissionReceipt ? {
+        execution_admission_protocol: 'native-positive-go-v1',
+        execution_admission_helper_sha256: containment.admissionHelper?.executable.digest ?? darwinLaunch.helperSha256,
+        execution_admission_receipt_digest: sha256(executionAdmissionReceipt),
+      } : {}),
       project_identity_digest: containment.projectIdentityDigest,
       agent: config.agent,
       task_id: config.taskId,
@@ -1314,7 +1981,13 @@ export function spawnTerminal(config) {
         execution_worktree_clean: true,
       } : {}),
       started_at: handle.startedAt,
-    });
+    }); } catch (error) {
+      if (darwinLaunch?.supervisorChannels) {
+        try { darwinLaunch.supervisorChannels.dispose(); } catch (cleanupError) { error.darwinChannelCleanupError = cleanupError; }
+        try { signalProcessTree(child, processGroupId, 'SIGKILL'); } catch { /* no positive GO has been sent */ }
+      }
+      throw error;
+    }
     TERMINAL_AUTHORITY_STATE.set(handle, {
       context: Object.freeze({ ...context }),
       identity,
@@ -1338,6 +2011,7 @@ export function spawnTerminal(config) {
     if (runtime[key] + bytes > MAX_AUTHORITY_OUTPUT_BYTES) {
       if (!runtime.outputOverflow) {
         runtime.outputOverflow = true;
+        if (diagnosticObservation.terminationCause === 'unknown') diagnosticObservation.terminationCause = 'output_limit';
         runtime.stderr.push(`terminal output exceeded ${MAX_AUTHORITY_OUTPUT_BYTES} byte authority limit`);
         runtime.killRequested = true;
         try { signalProcessTree(child, processGroupId, 'SIGKILL'); } catch { /* process already exited */ }
@@ -1375,6 +2049,18 @@ export function spawnTerminal(config) {
       runtime.status = runtime.killRequested ? 'killed' : 'exited';
       runtime.exitCode = Number.isInteger(code) ? code : -1;
       runtime.completedAt = new Date().toISOString();
+      runtime.processElapsedMs = Number(process.hrtime.bigint() - processStartedTick) / 1e6;
+      if (darwinLaunch?.supervisorChannels) {
+        try {
+          if (error) throw error;
+          runtime.darwinCompletion = darwinLaunch.supervisorChannels.readCompletion(code);
+        } catch (completionError) { darwinCompletionError = completionError; }
+        disposeDarwin(true);
+        if (darwinCompletionError) {
+          runtime.timeoutCleanupFailure = darwinCompletionError;
+          signalAuthorityCleanupFailure(darwinCompletionError);
+        }
+      }
       if (error) runtime.stderr.push(`spawn error: ${error.message}`);
       if (error && processFacade.listenerCount('error') > 0) processFacade.emit('error', error);
       processFacade.emit('exit', runtime.exitCode);
@@ -1385,10 +2071,12 @@ export function spawnTerminal(config) {
     // never omit output that arrived after the OS process exited.
     child.once('close', (code) => finalize(code));
     child.once('error', (error) => finalize(-1, error));
+    darwinRuntimeOwned = Boolean(darwinLaunch?.supervisorChannels);
   } else {
     child.on('exit', (code) => {
       handle.status = 'exited';
-      handle.exitCode = code;
+      handle.exitCode = darwinCompletionError ? -1 : code;
+      if (darwinCompletionError) handle.stderr.push(`Darwin sealed execution cleanup: ${darwinCompletionError.message}`);
     });
 
     child.on('error', (err) => {
@@ -1401,6 +2089,8 @@ export function spawnTerminal(config) {
   // Enforce timeout — kill process if it exceeds max execution time
   const timeoutTimer = setTimeout(() => {
     if (handle.status === 'running') {
+      diagnosticObservation.timedOut = true;
+      if (diagnosticObservation.terminationCause === 'unknown') diagnosticObservation.terminationCause = 'runtime_timeout';
       (runtime?.stderr ?? handle.stderr).push(`timeout: process exceeded ${timeout}ms limit`);
       if (runtime) {
         runtime.timeoutCleanupPromise = killTerminal(handle).then(
@@ -1426,6 +2116,32 @@ export function spawnTerminal(config) {
   // Clear timer when process exits normally
   child.on('close', () => clearTimeout(timeoutTimer));
 
+  if (config.afterAuthoritySpawn || darwinLaunch?.supervisorChannels) {
+    const channel = darwinLaunch?.supervisorChannels ? null : child.stdio[containment.admissionControlDescriptorNumber];
+    // No provider code has executed. A failed commit closes the private channel
+    // and the native helper rejects EOF; it never interprets closure as GO.
+    channel?.on('error', () => {});
+    try {
+      // Hand ownership to the caller before invoking its journal write, so a
+      // synchronous failure still allows it to await normal cleanup proof.
+      const committed = config.afterAuthoritySpawn?.(getTerminalLaunchAuthorityReceipt(handle), handle);
+      if (committed && typeof committed.then === 'function') {
+        Promise.resolve(committed).catch(() => {});
+        throw Object.assign(new Error('execution admission cannot await an uncommitted asynchronous dispatch'), { code: 'ASYNC_TERMINAL_ADMISSION_FORBIDDEN' });
+      }
+      runTerminalSecurityTestHook('beforeExecutionAdmissionGo', { handle });
+      if (darwinLaunch?.supervisorChannels) darwinLaunch.supervisorChannels.authorize();
+      else channel.end('G');
+    } catch (error) {
+      if (darwinLaunch?.supervisorChannels) {
+        try { darwinLaunch.supervisorChannels.dispose(); } catch (cleanupError) { error.darwinChannelCleanupError = cleanupError; }
+      } else channel.destroy();
+      runtime.killRequested = true;
+      try { signalProcessTree(child, processGroupId, 'SIGKILL'); } catch { /* gate still rejects EOF */ }
+      throw error;
+    }
+  }
+
   return handle;
 }
 
@@ -1572,9 +2288,23 @@ export function killTerminal(handle) {
     return Promise.resolve({ killed: false, exitCode: handle?.exitCode ?? null });
   }
 
+  const diagnosticObservation = TERMINAL_DIAGNOSTIC_OBSERVATIONS.get(handle);
+  if (diagnosticObservation?.elapsedMs === null && diagnosticObservation.terminationCause === 'unknown') {
+    diagnosticObservation.terminationCause = 'stop_requested';
+  }
+
   const authorityState = TERMINAL_AUTHORITY_STATE.get(handle);
   const rawProcess = authorityState?.runtime?.child ?? handle.process;
   const processGroupId = authorityState?.runtime?.processGroupId ?? null;
+  if (authorityState?.launchReceipt.darwin_launch_binding) {
+    const { runtime } = authorityState;
+    runtime.darwinStopPromise ??= stopDarwinAuthority(runtime).catch(error => {
+      runtime.timeoutCleanupFailure = error;
+      runtime.signalCleanupFailure(error);
+      throw error;
+    });
+    return runtime.darwinStopPromise;
+  }
   if (authorityState) {
     authorityState.runtime.killRequested = true;
     return (async () => {
@@ -1702,7 +2432,7 @@ export function isTransientFailure(exitCode, stderr) {
  * Non-transient failures are returned immediately without retry.
  *
  * @param {SpawnConfig} config
- * @param {{ maxRetries?: number, baseDelay?: number, shouldRetry?: function }} [retryOptions={}]
+ * @param {{ maxRetries?: number, baseDelay?: number, shouldRetry?: function, beforeAttempt?: function }} [retryOptions={}]
  * @returns {Promise<TerminalHandle>}
  */
 export async function spawnTerminalWithRetry(config, retryOptions = {}) {
@@ -1713,57 +2443,84 @@ export async function spawnTerminalWithRetry(config, retryOptions = {}) {
   const enableModelFallback = retryOptions.enableModelFallback === true;
 
   let lastHandle = null;
-
-  for (let attempt = 0; attempt <= maxRetries; attempt++) {
-    const handle = spawnTerminal(config);
-    lastHandle = handle;
-
-    // Wait for process to exit
+  let currentHandle = null;
+  let exceptionStage = null;
+  const attempts = [];
+  const observeCurrent = () => {
+    if (!currentHandle) return;
+    const observation = terminalAttemptSnapshot(currentHandle, attempts.length);
+    if (observation) attempts.push(observation);
+    currentHandle = null;
+  };
+  const spawnObserved = async (attemptConfig, beforeAttempt) => {
+    exceptionStage = 'before_attempt';
+    beforeAttempt?.();
+    exceptionStage = 'spawn';
+    currentHandle = spawnTerminal(attemptConfig);
+    const handle = currentHandle;
+    exceptionStage = 'wait';
     await waitForTerminal(handle);
+    observeCurrent();
+    exceptionStage = null;
+    return handle;
+  };
 
-    // Success — return immediately
-    if (handle.exitCode === 0) {
-      handle.retryCount = attempt;
-      return handle;
-    }
-
-    // Check if failure is transient and retries remain
-    const combinedOutput = [...(handle.stdout || []), ...(handle.stderr || [])];
-    if (attempt < maxRetries && shouldRetry(handle.exitCode, combinedOutput, handle)) {
-      const delay = baseDelay * Math.pow(2, attempt);
-      await new Promise(resolve => setTimeout(resolve, delay));
-      continue;
-    }
-
-    // Non-transient or out of retries — return as-is
-    break;
-  }
+  try {
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+      const handle = await spawnObserved(config, () => retryOptions.beforeAttempt?.({ attempt }));
+      lastHandle = handle;
 
-  // Model fallback: if all retries exhausted with overload errors, try with downgraded model
-  if (enableModelFallback && lastHandle && lastHandle.exitCode !== 0) {
-    const stderrStr = Array.isArray(lastHandle.stderr) ? lastHandle.stderr.join('') : (lastHandle.stderr || '');
-    const isOverload = OVERLOAD_PATTERNS.some(p => p.test(stderrStr));
-    const fallbackModel = MODEL_DOWNGRADE_MAP[config.model];
+      handle.retryCount = attempt;
 
-    if (isOverload && fallbackModel) {
-      const fallbackConfig = { ...config, model: fallbackModel };
-      const fallbackHandle = spawnTerminal(fallbackConfig);
+      // Success — return immediately
+      if (handle.exitCode === 0) {
+        handle.retryCount = attempt;
+        return rememberAttemptDiagnostics(handle, attempts);
+      }
 
-      await waitForTerminal(fallbackHandle);
+      // Check if failure is transient and retries remain
+      const combinedOutput = [...(handle.stdout || []), ...(handle.stderr || [])];
+      exceptionStage = 'retry_decision';
+      const retry = attempt < maxRetries && shouldRetry(handle.exitCode, combinedOutput, handle);
+      exceptionStage = null;
+      if (retry) {
+        const delay = baseDelay * Math.pow(2, attempt);
+        await new Promise(resolve => setTimeout(resolve, delay));
+        continue;
+      }
 
-      // Record fallback metadata
-      fallbackHandle.modelFallback = {
-        original: config.model,
-        actual: fallbackModel,
-        reason: 'overload_exhausted_retries',
-        timestamp: new Date().toISOString(),
-      };
+      // Non-transient or out of retries — return as-is
+      break;
+    }
 
-      fallbackHandle.retryCount = maxRetries;
-      return fallbackHandle;
+    // Model fallback: if all retries exhausted with overload errors, try with downgraded model
+    if (enableModelFallback && lastHandle && lastHandle.exitCode !== 0) {
+      const stderrStr = Array.isArray(lastHandle.stderr) ? lastHandle.stderr.join('') : (lastHandle.stderr || '');
+      const isOverload = OVERLOAD_PATTERNS.some(p => p.test(stderrStr));
+      const fallbackModel = MODEL_DOWNGRADE_MAP[config.model];
+
+      if (isOverload && fallbackModel) {
+        const fallbackConfig = { ...config, model: fallbackModel };
+        const fallbackHandle = await spawnObserved(fallbackConfig);
+
+        // Record fallback metadata
+        fallbackHandle.modelFallback = {
+          original: config.model,
+          actual: fallbackModel,
+          reason: 'overload_exhausted_retries',
+          timestamp: new Date().toISOString(),
+        };
+
+        fallbackHandle.retryCount = maxRetries;
+        return rememberAttemptDiagnostics(fallbackHandle, attempts);
+      }
     }
-  }
 
-  if (lastHandle) lastHandle.retryCount = lastHandle.retryCount ?? maxRetries;
-  return lastHandle;
+    if (lastHandle) lastHandle.retryCount = lastHandle.retryCount ?? maxRetries;
+    return rememberAttemptDiagnostics(lastHandle, attempts);
+  } catch (error) {
+    observeCurrent();
+    rememberAttemptDiagnostics(error, attempts, exceptionStage);
+    throw error;
+  }
 }