owlrunkit 0.25.0 → 0.25.1

package/scripts/runkit-contract/lease-lifecycle.mjs

@@ -1,11 +1,9 @@
 import {
   existsSync,
   lstatSync,
-  mkdirSync,
   readFileSync,
   readdirSync,
   realpathSync,
-  rmSync,
 } from "node:fs";
 import path from "node:path";
 
@@ -16,6 +14,7 @@ import {
   validateExecutionPin,
   validateLeaseOwnedPaths,
 } from "./core-contract.mjs";
+import { acquireRunKitControlLock } from "./control-transaction-lock.mjs";
 import {
   assertAllowedKeys,
   loadActiveExecution,
@@ -179,33 +178,25 @@ export function assertExecutionUnclosed(executionRoot, runId) {
   }
 }
 
-function acquireControlLock(workspaceRoot) {
+function acquireControlLock(workspaceRoot, options) {
   const runtimeRoot = path.join(workspaceRoot, RUNTIME_ROOT);
   safeDirectory(workspaceRoot, runtimeRoot, "RunKit runtime directory");
   safeDirectory(runtimeRoot, path.join(runtimeRoot, "executions"), "Executions directory");
-  const lockPath = path.join(runtimeRoot, "control.lock");
-  try {
-    mkdirSync(lockPath);
-  } catch (error) {
-    if (error?.code === "EEXIST") throw new Error("Another RunKit control transaction is already active.");
-    throw error;
-  }
-  return () => rmSync(lockPath, { recursive: true, force: true });
+  return acquireRunKitControlLock(runtimeRoot, options);
 }
 
-export function withControlTransaction(workspaceRoot, operation) {
-  const release = acquireControlLock(workspaceRoot);
+export function withControlTransaction(workspaceRoot, operation, options) {
+  const release = acquireControlLock(workspaceRoot, options);
+  let result;
   try {
-    const result = operation();
-    if (result && typeof result.then === "function") {
-      return Promise.resolve(result).finally(release);
-    }
-    release();
-    return result;
+    result = operation();
+    if (result && typeof result.then === "function") return Promise.resolve(result).finally(release);
   } catch (error) {
     release();
     throw error;
   }
+  release();
+  return result;
 }
 
 export function acquireLeaseWithinControlTransaction({ workspaceRoot, runId, workItemId, ownedPaths }) {
@@ -251,7 +242,8 @@ export function acquireLeaseWithinControlTransaction({ workspaceRoot, runId, wor
 }
 
 export function acquireLease(args) {
-  return withControlTransaction(args.workspaceRoot, () => acquireLeaseWithinControlTransaction(args));
+  return withControlTransaction(args.workspaceRoot, () => acquireLeaseWithinControlTransaction(args),
+    { atomicLease: true });
 }
 
 export function inspectLeases({ workspaceRoot, runId }) {
@@ -300,7 +292,8 @@ export function releaseLeaseWithinControlTransaction({ workspaceRoot, runId, wor
 }
 
 export function releaseLease(args) {
-  return withControlTransaction(args.workspaceRoot, () => releaseLeaseWithinControlTransaction(args));
+  return withControlTransaction(args.workspaceRoot, () => releaseLeaseWithinControlTransaction(args),
+    { atomicLease: true });
 }
 
 export function restoreLeaseWithinControlTransaction({ workspaceRoot, runId, workItemId }) {

package/scripts/runkit-contract/linux-runtime.mjs

@@ -0,0 +1,13 @@
+import { lstatSync, realpathSync } from "node:fs";
+import path from "node:path";
+
+export function linuxRuntimeHelper() {
+  if (process.platform !== "linux" || !["arm64", "x64"].includes(process.arch)) return null;
+  const executable = path.join(import.meta.dirname, `peer-linux-${process.arch}`);
+  try {
+    if (realpathSync(executable) === executable && lstatSync(executable).isFile()) return executable;
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  return null;
+}

package/scripts/runkit-contract/peer-linux.MUSL-COPYRIGHT

@@ -0,0 +1,193 @@
+musl as a whole is licensed under the following standard MIT license:
+
+----------------------------------------------------------------------
+Copyright © 2005-2020 Rich Felker, et al.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+----------------------------------------------------------------------
+
+Authors/contributors include:
+
+A. Wilcox
+Ada Worcester
+Alex Dowad
+Alex Suykov
+Alexander Monakov
+Andre McCurdy
+Andrew Kelley
+Anthony G. Basile
+Aric Belsito
+Arvid Picciani
+Bartosz Brachaczek
+Benjamin Peterson
+Bobby Bingham
+Boris Brezillon
+Brent Cook
+Chris Spiegel
+Clément Vasseur
+Daniel Micay
+Daniel Sabogal
+Daurnimator
+David Carlier
+David Edelsohn
+Denys Vlasenko
+Dmitry Ivanov
+Dmitry V. Levin
+Drew DeVault
+Emil Renner Berthing
+Fangrui Song
+Felix Fietkau
+Felix Janda
+Gianluca Anzolin
+Hauke Mehrtens
+He X
+Hiltjo Posthuma
+Isaac Dunham
+Jaydeep Patil
+Jens Gustedt
+Jeremy Huntwork
+Jo-Philipp Wich
+Joakim Sindholt
+John Spencer
+Julien Ramseier
+Justin Cormack
+Kaarle Ritvanen
+Khem Raj
+Kylie McClain
+Leah Neukirchen
+Luca Barbato
+Luka Perkov
+M Farkas-Dyck (Strake)
+Mahesh Bodapati
+Markus Wichmann
+Masanori Ogino
+Michael Clark
+Michael Forney
+Mikhail Kremnyov
+Natanael Copa
+Nicholas J. Kain
+orc
+Pascal Cuoq
+Patrick Oppenlander
+Petr Hosek
+Petr Skocik
+Pierre Carrier
+Reini Urban
+Rich Felker
+Richard Pennington
+Ryan Fairfax
+Samuel Holland
+Segev Finer
+Shiz
+sin
+Solar Designer
+Stefan Kristiansson
+Stefan O'Rear
+Szabolcs Nagy
+Timo Teräs
+Trutz Behn
+Valentin Ochs
+Will Dietz
+William Haddon
+William Pitcock
+
+Portions of this software are derived from third-party works licensed
+under terms compatible with the above MIT license:
+
+The TRE regular expression implementation (src/regex/reg* and
+src/regex/tre*) is Copyright © 2001-2008 Ville Laurikari and licensed
+under a 2-clause BSD license (license text in the source files). The
+included version has been heavily modified by Rich Felker in 2012, in
+the interests of size, simplicity, and namespace cleanliness.
+
+Much of the math library code (src/math/* and src/complex/*) is
+Copyright © 1993,2004 Sun Microsystems or
+Copyright © 2003-2011 David Schultz or
+Copyright © 2003-2009 Steven G. Kargl or
+Copyright © 2003-2009 Bruce D. Evans or
+Copyright © 2008 Stephen L. Moshier or
+Copyright © 2017-2018 Arm Limited
+and labelled as such in comments in the individual source files. All
+have been licensed under extremely permissive terms.
+
+The ARM memcpy code (src/string/arm/memcpy.S) is Copyright © 2008
+The Android Open Source Project and is licensed under a two-clause BSD
+license. It was taken from Bionic libc, used on Android.
+
+The AArch64 memcpy and memset code (src/string/aarch64/*) are
+Copyright © 1999-2019, Arm Limited.
+
+The implementation of DES for crypt (src/crypt/crypt_des.c) is
+Copyright © 1994 David Burren. It is licensed under a BSD license.
+
+The implementation of blowfish crypt (src/crypt/crypt_blowfish.c) was
+originally written by Solar Designer and placed into the public
+domain. The code also comes with a fallback permissive license for use
+in jurisdictions that may not recognize the public domain.
+
+The smoothsort implementation (src/stdlib/qsort.c) is Copyright © 2011
+Valentin Ochs and is licensed under an MIT-style license.
+
+The x86_64 port was written by Nicholas J. Kain and is licensed under
+the standard MIT terms.
+
+The mips and microblaze ports were originally written by Richard
+Pennington for use in the ellcc project. The original code was adapted
+by Rich Felker for build system and code conventions during upstream
+integration. It is licensed under the standard MIT terms.
+
+The mips64 port was contributed by Imagination Technologies and is
+licensed under the standard MIT terms.
+
+The powerpc port was also originally written by Richard Pennington,
+and later supplemented and integrated by John Spencer. It is licensed
+under the standard MIT terms.
+
+All other files which have no copyright comments are original works
+produced specifically for use as part of this library, written either
+by Rich Felker, the main author of the library, or by one or more
+contibutors listed above. Details on authorship of individual files
+can be found in the git version control history of the project. The
+omission of copyright and license comments in each file is in the
+interest of source tree size.
+
+In addition, permission is hereby granted for all public header files
+(include/* and arch/*/bits/*) and crt files intended to be linked into
+applications (crt/*, ldso/dlstart.c, and arch/*/crt_arch.h) to omit
+the copyright notice and permission notice otherwise required by the
+license, and to use these files without any requirement of
+attribution. These files include substantial contributions from:
+
+Bobby Bingham
+John Spencer
+Nicholas J. Kain
+Rich Felker
+Richard Pennington
+Stefan Kristiansson
+Szabolcs Nagy
+
+all of whom have explicitly granted such permission.
+
+This file previously contained text expressing a belief that most of
+the files covered by the above exception were sufficiently trivial not
+to be subject to copyright, resulting in confusion over whether it
+negated the permissions granted in the license. In the spirit of
+permissive licensing, and of not having licensing issues being an
+obstacle to adoption, that text has been removed.

package/scripts/runkit-contract/peer-linux.c

@@ -0,0 +1,243 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+#define _GNU_SOURCE
+#include <errno.h>
+#include <fcntl.h>
+#include <linux/audit.h>
+#include <linux/filter.h>
+#include <linux/landlock.h>
+#include <linux/seccomp.h>
+#include <sched.h>
+#include <signal.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/file.h>
+#include <sys/ioctl.h>
+#include <sys/prctl.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/syscall.h>
+#include <sys/xattr.h>
+#include <unistd.h>
+
+// ABI 3 added this bit. The runtime still checks that the kernel supports it.
+#ifndef LANDLOCK_ACCESS_FS_TRUNCATE
+#define LANDLOCK_ACCESS_FS_TRUNCATE (1ULL << 14)
+#endif
+
+#if defined(__aarch64__)
+#define NATIVE_AUDIT_ARCH AUDIT_ARCH_AARCH64
+#define GLIBC_LOADER "/lib/ld-linux-aarch64.so.1"
+#define MUSL_LOADER "/lib/ld-musl-aarch64.so.1"
+#elif defined(__x86_64__) && !defined(__ILP32__)
+#define NATIVE_AUDIT_ARCH AUDIT_ARCH_X86_64
+#define GLIBC_LOADER "/lib64/ld-linux-x86-64.so.2"
+#define MUSL_LOADER "/lib/ld-musl-x86_64.so.1"
+#else
+#error Unsupported OwlRunKit peer architecture
+#endif
+
+extern char **environ;
+
+static void fail(const char *operation)
+{
+    perror(operation);
+    _exit(125);
+}
+
+static void allow_path(int ruleset, const char *path, uint64_t rights, int optional)
+{
+    int fd = open(path, O_PATH | O_CLOEXEC);
+    if (fd < 0) {
+        if (optional && errno == ENOENT)
+            return;
+        fail(path);
+    }
+    struct landlock_path_beneath_attr rule = { .allowed_access = rights, .parent_fd = fd };
+    if (syscall(SYS_landlock_add_rule, ruleset, LANDLOCK_RULE_PATH_BENEATH, &rule, 0) < 0)
+        fail("landlock_add_rule");
+    close(fd);
+}
+
+static void restrict_files(const char *directory, const char *worker)
+{
+    const uint64_t read_tree = LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR;
+    const uint64_t work = read_tree | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_TRUNCATE |
+        LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_REMOVE_FILE |
+        LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_REFER;
+    const struct landlock_ruleset_attr rules = { .handled_access_fs = work |
+        LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_BLOCK |
+        LANDLOCK_ACCESS_FS_MAKE_SOCK | LANDLOCK_ACCESS_FS_MAKE_FIFO | LANDLOCK_ACCESS_FS_MAKE_SYM };
+    long abi = syscall(SYS_landlock_create_ruleset, NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);
+    if (abi < 0)
+        fail("landlock_create_ruleset version");
+    if (abi < 3) {
+        errno = EOPNOTSUPP;
+        fail("Landlock ABI 3 is required");
+    }
+    int fd = syscall(SYS_landlock_create_ruleset, &rules, sizeof rules, 0);
+    if (fd < 0)
+        fail("landlock_create_ruleset");
+    if (worker) {
+        allow_path(fd, directory, work, 0);
+        allow_path(fd, worker, LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_EXECUTE, 0);
+        allow_path(fd, "/lib", read_tree, 1);
+        allow_path(fd, "/lib64", read_tree, 1);
+        allow_path(fd, "/usr/lib", read_tree, 1);
+        allow_path(fd, "/usr/lib64", read_tree, 1);
+        allow_path(fd, GLIBC_LOADER, LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_EXECUTE, 1);
+        allow_path(fd, MUSL_LOADER, LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_EXECUTE, 1);
+        allow_path(fd, "/etc/ld.so.cache", LANDLOCK_ACCESS_FS_READ_FILE, 1);
+        allow_path(fd, "/dev/null", LANDLOCK_ACCESS_FS_READ_FILE, 1);
+    }
+    if (syscall(SYS_landlock_restrict_self, fd, 0) < 0)
+        fail("landlock_restrict_self");
+    close(fd);
+}
+
+#define ALLOW_SYSCALL(name) \
+    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SYS_##name, 0, 1), \
+    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW)
+#define DENIED (SECCOMP_RET_ERRNO | EPERM)
+
+static void restrict_syscalls(void)
+{
+    const unsigned thread_flags = CLONE_VM | CLONE_FS | CLONE_FILES | CLONE_SIGHAND | CLONE_THREAD |
+        CLONE_SYSVSEM | CLONE_SETTLS | CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID | CLONE_CHILD_SETTID;
+    const unsigned pid = (unsigned)getpid();
+    struct sock_filter instructions[] = {
+        BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, arch)),
+        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, NATIVE_AUDIT_ARCH, 1, 0),
+        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL_PROCESS),
+        BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),
+
+        // glibc retries via clone when clone3 is unavailable. Its pointer
+        // arguments cannot be safely checked by a seccomp BPF program.
+        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SYS_clone3, 0, 1),
+        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | ENOSYS),
+        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SYS_clone, 0, 6),
+        BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, args[0])),
+        BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, CLONE_THREAD, 0, 3),
+        BPF_STMT(BPF_ALU | BPF_AND | BPF_K, ~thread_flags),
+        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 0, 1),
+        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
+        BPF_STMT(BPF_RET | BPF_K, DENIED),
+        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SYS_tgkill, 0, 4),
+        BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, args[0])),
+        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, pid, 0, 1),
+        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
+        BPF_STMT(BPF_RET | BPF_K, DENIED),
+
+        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SYS_ioctl, 0, 6),
+        BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, args[1])),
+        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, FIONBIO, 3, 0),
+        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, FIONREAD, 2, 0),
+        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, TCGETS, 1, 0),
+        BPF_STMT(BPF_RET | BPF_K, DENIED),
+        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
+
+        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SYS_fcntl, 0, 11),
+        BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, args[1])),
+        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_GETFD, 8, 0),
+        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_SETFD, 7, 0),
+        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_GETFL, 6, 0),
+        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_DUPFD, 5, 0),
+        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_DUPFD_CLOEXEC, 4, 0),
+        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_SETFL, 0, 2),
+        BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, args[2])),
+        BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, O_ASYNC, 0, 1),
+        BPF_STMT(BPF_RET | BPF_K, DENIED),
+        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
+
+        // Data and path operations below are subject to Landlock. Operations
+        // it cannot confine, such as chmod and xattrs, stay denied.
+        ALLOW_SYSCALL(execve),
+        ALLOW_SYSCALL(read), ALLOW_SYSCALL(write), ALLOW_SYSCALL(readv), ALLOW_SYSCALL(writev),
+        ALLOW_SYSCALL(pread64), ALLOW_SYSCALL(pwrite64), ALLOW_SYSCALL(lseek), ALLOW_SYSCALL(close),
+        ALLOW_SYSCALL(openat), ALLOW_SYSCALL(fstat), ALLOW_SYSCALL(newfstatat), ALLOW_SYSCALL(statx),
+        ALLOW_SYSCALL(faccessat), ALLOW_SYSCALL(faccessat2), ALLOW_SYSCALL(getdents64),
+        ALLOW_SYSCALL(getcwd), ALLOW_SYSCALL(chdir), ALLOW_SYSCALL(fchdir), ALLOW_SYSCALL(readlinkat),
+        ALLOW_SYSCALL(mkdirat), ALLOW_SYSCALL(unlinkat), ALLOW_SYSCALL(renameat),
+        ALLOW_SYSCALL(renameat2), ALLOW_SYSCALL(linkat), ALLOW_SYSCALL(symlinkat),
+        ALLOW_SYSCALL(truncate), ALLOW_SYSCALL(ftruncate), ALLOW_SYSCALL(fsync), ALLOW_SYSCALL(fdatasync),
+        ALLOW_SYSCALL(dup), ALLOW_SYSCALL(dup3), ALLOW_SYSCALL(pipe2),
+        ALLOW_SYSCALL(mmap), ALLOW_SYSCALL(munmap), ALLOW_SYSCALL(mprotect), ALLOW_SYSCALL(mremap),
+        ALLOW_SYSCALL(madvise), ALLOW_SYSCALL(brk),
+        ALLOW_SYSCALL(rt_sigaction), ALLOW_SYSCALL(rt_sigprocmask), ALLOW_SYSCALL(rt_sigreturn),
+        ALLOW_SYSCALL(sigaltstack), ALLOW_SYSCALL(getpid), ALLOW_SYSCALL(getppid), ALLOW_SYSCALL(gettid),
+        ALLOW_SYSCALL(getuid), ALLOW_SYSCALL(geteuid), ALLOW_SYSCALL(getgid), ALLOW_SYSCALL(getegid),
+        ALLOW_SYSCALL(getgroups), ALLOW_SYSCALL(uname), ALLOW_SYSCALL(sysinfo),
+        ALLOW_SYSCALL(set_tid_address), ALLOW_SYSCALL(set_robust_list), ALLOW_SYSCALL(rseq),
+        ALLOW_SYSCALL(getrandom), ALLOW_SYSCALL(futex), ALLOW_SYSCALL(sched_yield),
+        ALLOW_SYSCALL(sched_getaffinity), ALLOW_SYSCALL(clock_gettime),
+        ALLOW_SYSCALL(clock_nanosleep), ALLOW_SYSCALL(nanosleep), ALLOW_SYSCALL(gettimeofday),
+        ALLOW_SYSCALL(epoll_create1), ALLOW_SYSCALL(epoll_ctl), ALLOW_SYSCALL(epoll_pwait),
+        ALLOW_SYSCALL(epoll_pwait2), ALLOW_SYSCALL(eventfd2), ALLOW_SYSCALL(ppoll),
+        ALLOW_SYSCALL(getsockname), ALLOW_SYSCALL(getpeername), ALLOW_SYSCALL(getsockopt),
+        ALLOW_SYSCALL(getrlimit), ALLOW_SYSCALL(exit), ALLOW_SYSCALL(exit_group),
+#ifdef __x86_64__
+        ALLOW_SYSCALL(arch_prctl), ALLOW_SYSCALL(access), ALLOW_SYSCALL(open),
+        ALLOW_SYSCALL(stat), ALLOW_SYSCALL(lstat), ALLOW_SYSCALL(readlink),
+        ALLOW_SYSCALL(mkdir), ALLOW_SYSCALL(rmdir), ALLOW_SYSCALL(unlink),
+        ALLOW_SYSCALL(rename), ALLOW_SYSCALL(link), ALLOW_SYSCALL(symlink),
+        ALLOW_SYSCALL(dup2), ALLOW_SYSCALL(pipe), ALLOW_SYSCALL(epoll_wait), ALLOW_SYSCALL(poll),
+#endif
+        BPF_STMT(BPF_RET | BPF_K, DENIED),
+    };
+    const struct sock_fprog filter = {
+        .len = sizeof instructions / sizeof instructions[0], .filter = instructions,
+    };
+    if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &filter) < 0)
+        fail("seccomp filter");
+}
+
+int main(int argc, char **argv)
+{
+    if (argc == 2 && strcmp(argv[1], "lock") == 0) {
+        if (flock(3, LOCK_EX | LOCK_NB) == 0)
+            return 0;
+        if (errno == EWOULDBLOCK)
+            return 73;
+        fail("control flock");
+    }
+    int probe = argc == 2 && strcmp(argv[1], "probe") == 0;
+    if (!probe && (argc < 5 || strcmp(argv[1], "run") != 0))
+        return 125;
+    if (!probe) {
+        char *end;
+        long parent = strtol(argv[2], &end, 10);
+        if (*end || parent <= 0 || prctl(PR_SET_PDEATHSIG, SIGKILL) < 0 || getppid() != parent)
+            return 125;
+        struct stat worker;
+        if (stat(argv[4], &worker) < 0)
+            fail("stat worker");
+        if (worker.st_mode & (S_ISUID | S_ISGID)) {
+            errno = EPERM;
+            fail("set-id workers are unsupported");
+        }
+        if (getxattr(argv[4], "security.capability", NULL, 0) >= 0) {
+            errno = EPERM;
+            fail("file capabilities on workers are unsupported");
+        }
+        if (errno != ENODATA && errno != ENOTSUP)
+            fail("getxattr worker capabilities");
+    }
+    if (syscall(SYS_close_range, 3U, ~0U, 0) < 0)
+        fail("close inherited descriptors");
+    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
+        fail("no_new_privs");
+    restrict_files(probe ? NULL : argv[3], probe ? NULL : argv[4]);
+    restrict_syscalls();
+    if (probe) {
+        if (open("/etc/passwd", O_RDONLY) >= 0 || errno != EACCES ||
+            socket(AF_INET, SOCK_STREAM, 0) >= 0 || errno != EPERM) {
+            fputs("Linux peer enforcement self-test failed\n", stderr);
+            return 125;
+        }
+        return 0;
+    }
+    execve(argv[4], &argv[4], environ);
+    fail("execve worker");
+}

package/scripts/runkit-contract/peer-recovery.mjs

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import {
-  closeSync, constants, existsSync, fsyncSync, linkSync, lstatSync, mkdirSync,
+  accessSync, closeSync, constants, existsSync, fsyncSync, linkSync, lstatSync, mkdirSync,
   mkdtempSync, openSync, readSync, readdirSync, realpathSync, unlinkSync,
   watch, writeFileSync,
 } from "node:fs";
@@ -9,6 +9,7 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 
 import { RUNTIME_ROOT, currentCoreIdentity } from "./core-contract.mjs";
+import { linuxRuntimeHelper } from "./linux-runtime.mjs";
 import { safeIdentifier } from "./provenance-common.mjs";
 import { resolveVerificationEnvelopeBackendV1 } from "./verification-envelope.mjs";
 
@@ -195,9 +196,29 @@ function projection(task, state) {
   };
 }
 
+export function resolvePeerRecoveryBackend() {
+  if (process.platform === "linux") {
+    try {
+      const executable = linuxRuntimeHelper();
+      if (!executable) return { available: false };
+      const result = spawnSync(executable, ["probe"], {
+        timeout: 3000, env: {}, stdio: ["ignore", "ignore", "pipe"], encoding: "utf8",
+      });
+      if (result.status === 0) {
+        return { available: true, id: "linux_landlock_seccomp_v1", executable,
+          digest: digest(regularBytes(executable, CHECKPOINT_LIMIT)) };
+      }
+      return { available: false, reason: result.stderr?.trim() || result.error?.code };
+    } catch (error) { return { available: false, reason: error.code }; }
+  }
+  return resolveVerificationEnvelopeBackendV1();
+}
+
 function requireBackend() {
-  const backend = resolveVerificationEnvelopeBackendV1();
-  if (!backend.available) throw new Error("peer_recovery_enforced_backend_unavailable");
+  const backend = resolvePeerRecoveryBackend();
+  if (!backend.available) {
+    throw new Error(["peer_recovery_enforced_backend_unavailable", backend.reason].filter(Boolean).join(": "));
+  }
   return backend;
 }
 
@@ -357,34 +378,57 @@ function reportExit(task, attemptId, processExit) {
   }
 }
 
-export async function runPeerTask({ workspaceRoot, taskId, agent, generation, command }) {
-  const backend = requireBackend();
-  safeIdentifier(agent, "current peer");
+function workerExecutable(command) {
   if (!Array.isArray(command) || !path.isAbsolute(command[0] ?? "")) {
     throw new Error("peer_recovery_absolute_worker_required");
   }
   const executable = realpathSync(command[0]);
   if (!lstatSync(executable).isFile()) throw new Error("peer_recovery_worker_invalid");
+  accessSync(executable, constants.X_OK);
+  return executable;
+}
+
+function existingHandoff(task, state, agent, generation) {
+  if (state.owner !== agent || state.generation !== generation || state.phase === "ready") return null;
+  const result = projection(task, state);
+  return state.phase === "exited" ? { ...result, exitCode: 2 } : result;
+}
+
+export async function runPeerTask({ workspaceRoot, taskId, agent, generation, command, handoff = false }) {
+  const backend = requireBackend();
+  safeIdentifier(agent, "current peer");
+  const executable = workerExecutable(command);
   const task = taskDirectory(workspaceRoot, taskId);
   const state = current(task);
   if (state.phase !== "ready" || state.owner !== agent || state.generation !== generation) {
+    const prior = handoff && existingHandoff(task, state, agent, generation);
+    if (prior) return prior;
     throw new Error("peer_recovery_attempt_not_available");
   }
   const id = randomUUID();
   const directory = mkdtempSync(path.join(realpathSync(tmpdir()), "owlrunkit-peer-"));
   materialize(checkpoint(task, state).files, directory);
-  const attempt = { id, directory, backend: backend.id };
+  const attempt = { id, directory, backend: backend.id,
+    ...(backend.digest ? { backendSha256: backend.digest } : {}) };
   const claimed = append(task, state, {
     attempt, phase: "running", processExit: null, event: "peer_attempt_started",
   });
-  if (!claimed) throw new Error("peer_recovery_attempt_already_claimed");
+  if (!claimed) {
+    const prior = handoff && existingHandoff(task, current(task), agent, generation);
+    if (prior) return prior;
+    throw new Error("peer_recovery_attempt_already_claimed");
+  }
 
   return new Promise((resolve, reject) => {
-    const child = spawn(backend.executable, ["-p", sandboxPolicy(executable, directory),
-      executable, ...command.slice(1)], {
+    const args = backend.id === "linux_landlock_seccomp_v1"
+      ? ["run", String(process.pid), directory]
+      : ["-p", sandboxPolicy(executable, directory)];
+    const child = spawn(backend.executable, [...args, executable, ...command.slice(1)], {
       cwd: directory, env: {
         PATH: "/usr/bin:/bin", TMPDIR: directory, OWLRUNKIT_PEER_ATTEMPT: id,
         OWLRUNKIT_PEER_PATHS: JSON.stringify(state.paths),
+        // An isolated worker cannot read host OpenSSL configuration.
+        ...(backend.id === "linux_landlock_seccomp_v1" ? { OPENSSL_CONF: "/dev/null" } : {}),
       }, stdio: ["pipe", "pipe", "pipe"],
     });
     let watcher, pending = Buffer.alloc(0), sentWake, protocolError = null;
@@ -440,3 +484,12 @@ export async function runPeerTask({ workspaceRoot, taskId, agent, generation, co
     } catch (error) { stop(error); }
   });
 }
+
+export async function recoverAndRunPeerTask(options, command) {
+  workerExecutable(command);
+  const recovered = await recoverPeerTask(options);
+  if (recovered.generation !== options.generation + 1 || recovered.owner !== options.agent) {
+    return recovered;
+  }
+  return runPeerTask({ ...options, generation: recovered.generation, command, handoff: true });
+}

package/scripts/runkit-contract/project-cli-resolver.mjs

@@ -27,10 +27,14 @@ const SELF_NORMALIZED_QUICK_CORE_VERSIONS = new Set([
   "0.24.0",
   "0.24.1",
   "0.25.0",
+  "0.25.1",
 ]);
 const EXACT_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/;
 const SHA256_REF = /^sha256:[a-f0-9]{64}$/;
 const TRUSTED_PRIOR_CORE_IDENTITIES = new Map([
+  ["0.25.0", new Set([
+    "sha256:20e75c386f1408f11e908a6d3ee1a39316d9728d5719fa06f8d6a5aa45abd83e",
+  ])],
   ["0.24.1", new Set([
     "sha256:94aaa2e3a6d504374fa78cfcd341e31b33087806c9ddf5f84b3d3b47a6328e08",
   ])],