owlrunkit 0.25.1 → 0.25.2

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.25.2
+
+- Supports managed Linux worker recovery with system Bubblewrap when Landlock
+  is unavailable. RunKit verifies the writable attempt, read-only sandbox
+  root, hidden host files, and seccomp process and network restrictions before
+  selecting the backend.
+- Keeps Landlock as the first Linux backend. If neither backend passes its
+  runtime probe, managed peer commands refuse to start.
+
 ## 0.25.1
 
 - Adds enforced Linux peer isolation for x86-64 and ARM64 with Landlock and

package/README.md

@@ -134,29 +134,9 @@ automatically promote an authoritative writer. Core successor, release
 compatibility, publication, Project Successor, and project adoption remain
 separate authority boundaries.
 
-## Current release
-
-`owlrunkit@0.25.1` is the version documented here. Its public surfaces
-include:
-
-- Project Driver and typed delivery lifecycle;
-- Quick and Formal verification with source-bound receipts;
-- controller/target worktree separation and foreign-candidate verification;
-- Team Delivery read-only recommendations and portable transfer packets;
-- bounded compact-session Hook Recovery;
-- optional native Codex Stop continuation on a bound RunKit file event;
-- managed local peer recovery for isolated macOS and Linux workers;
-- completed-project drift detection and read-only successor scaffolding;
-- fail-closed bootstrap, profile, registry, Core, and shared-Skill diagnostics.
-
-This repository is the public corresponding-source, documentation, issue,
-release, and trust surface for OwlRunKit. Day-to-day development remains in a
-private source repository; every GPL-covered npm release must map to an exact
-public source tag.
-
 ## Install
 
-This package is the lifecycle-stable, registry-gated `owlrunkit@0.25.1`
+This package is the lifecycle-stable, registry-gated `owlrunkit@0.25.2`
 artifact. Registry adoption remains fail-closed until its exact official npm
 version, shasum, integrity, and tarball URL are independently verified. Local
 tarballs remain candidate-test inputs and are never adoption provenance. Until
@@ -164,7 +144,7 @@ that registry evidence exists, use the package only for isolated candidate
 verification; do not treat the command below as available release truth.
 
 ```bash
-npm install --save-exact owlrunkit@0.25.1
+npm install --save-exact owlrunkit@0.25.2
 ```
 
 Use `npx --no-install owlrunkit` for project commands. The package bootstrap
@@ -180,9 +160,9 @@ the project Config must independently bind the same Core.
 ```bash
 npx --no-install owlrunkit --version
 npx --no-install owlrunkit bootstrap --workspace /absolute/path/to/project \
-  --exact owlrunkit@0.25.1 --dry-run
+  --exact owlrunkit@0.25.2 --dry-run
 npx --no-install owlrunkit bootstrap --workspace /absolute/path/to/project \
-  --exact owlrunkit@0.25.1 --apply
+  --exact owlrunkit@0.25.2 --apply
 npx --no-install owlrunkit init --workspace /absolute/path/to/project
 npx --no-install owlrunkit doctor --workspace /absolute/path/to/project
 npx --no-install owlrunkit inspect --workspace /absolute/path/to/project --json --compact
@@ -1060,10 +1040,13 @@ scratch directory is reported for inspection while it remains on disk.
 
 The macOS and Linux backends confine writes to the attempt and deny network
 connections and new worker processes. Linux supports x86-64 and ARM64 with
-Landlock ABI 3 or later, seccomp filtering, and `close_range`. The packaged
-helper checks the effective policy before a managed task starts. It terminates
-the worker if the supervisor process is killed. The host caller supplies the
-worker command and peer identity. Existing Desktop sessions and writers using
+seccomp filtering and `close_range`. RunKit tries Landlock ABI 3 or later
+first. If Landlock is unavailable, it can use a trusted system Bubblewrap
+executable with user and mount namespaces. The Bubblewrap probe verifies
+that the attempt is writable, host files are hidden, and new processes and
+network sockets are denied. If the probe fails, the task stays blocked.
+On Linux, the worker is terminated if its supervisor is killed. The host
+caller supplies the worker command and peer identity. Existing Desktop sessions and writers using
 legacy shared-directory leases follow their own recovery procedure. An
 existing managed task remains pinned to the core that created it.
 

package/SOURCE.md

@@ -1,28 +1,14 @@
-# Corresponding source
-
-OwlRunKit is distributed under GPL-3.0-or-later. The corresponding public
-source for this release is [OwlRunKit v0.25.1](https://github.com/yeemio/owlrunkit/tree/v0.25.1).
-It includes the JavaScript runtime, C source and build script for the Linux
-helpers, package metadata, public contracts, and bundled integration resources.
-
-## Rebuild the Linux helpers
-
-Check out the public tag, then run these commands from its root. The helper
-build uses the Alpine 3.22 image and the compiler and Linux headers from its
-package repository. Build on each architecture or use a Docker environment
-that supports both build platforms.
-
-```sh
-mkdir -p .build
-for platform in linux/arm64 linux/amd64; do
-  docker run --rm --platform "$platform" \
-    -v "$PWD:/source:ro" -v "$PWD/.build:/out" \
-    alpine:3.22@sha256:49340b346798875b5592e5d420241f2f9cfba5f47e62ebb1446a1b34734e898f \
-    sh -ec 'apk add --no-cache build-base linux-headers; sh /source/packages/runkit/build-linux-helper.sh /out'
-done
-(cd .build && sha256sum -c ../LINUX-HELPERS.sha256)
-```
-
-The npm tarball contains both helper executables alongside their C source and
-the musl copyright notice. Its official registry version, shasum, integrity,
-and tarball URL identify the published package.
+# Source
+
+OwlRunKit is maintained in the private OwlCoda source repository. The npm
+tarball contains the JavaScript runtime, the read-only verifier and the C
+source for the two Linux helper binaries. The distributed binaries link musl
+statically and include its copyright notice. Build the helper on each supported
+Linux architecture with `sh packages/runkit/build-linux-helper.sh <output>`
+in Alpine Linux with `build-base` and `linux-headers`, then pass their output directory to
+`packages/runkit/build-package.mjs --linux-helpers`.
+
+The authoritative release is identified by the npm registry version, shasum,
+integrity, and tarball URL. Local directories, `file:` dependencies, local
+tarballs, Git URLs, workspace links, and mutable dist-tags are not accepted as
+formal cross-project adoption evidence.

package/integrations/codex/skills/owlcoda-runkit/SKILL.md

@@ -7,14 +7,14 @@ description: Run receipt-backed, project-owned work with OwlCoda RunKit. Use whe
 
 Use the bundled deterministic Core to coordinate work through project artifacts rather than chat memory. Require Node.js 20 or later.
 
-Bundled registry-gated artifact: standalone `owlrunkit@0.25.1`, bundling Contract
-`0.2` and Core `0.25.1` with manifest
-`sha256:0934a076b147847a4623bc89263b677c88088b493495fc74f11485985b7903b5`.
+Bundled registry-gated artifact: standalone `owlrunkit@0.25.2`, bundling Contract
+`0.2` and Core `0.25.2` with manifest
+`sha256:da816d343597b91c30e4f96c0a3d765bf5c00d6013d6bee430f58bc701399acc`.
 Registry adoption remains fail-closed until exact official npm registry
-provenance for `owlrunkit@0.25.1` is independently verified. The
-published rollback baseline for this artifact is `owlrunkit@0.25.0`, with SHA-1
-`8cfb52126320bfdafc722bcc41db6cada19f91cc` and canonical npm tarball URL
-`https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.25.0.tgz`.
+provenance for `owlrunkit@0.25.2` is independently verified. The
+published rollback baseline for this artifact is `owlrunkit@0.25.1`, with SHA-1
+`755bdcef5f6df55977ee64d2d4391d1098c00168` and canonical npm tarball URL
+`https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.25.1.tgz`.
 The root `owlcoda` package has a separate version lifecycle.
 
 The session is an execution interface. Project artifacts are the system of record.
@@ -370,9 +370,9 @@ below has no CLI entry.
 
 ```bash
 npx --no-install owlrunkit bootstrap --workspace "$PROJECT_ROOT" \
-  --exact owlrunkit@0.25.1 --dry-run
+  --exact owlrunkit@0.25.2 --dry-run
 npx --no-install owlrunkit bootstrap --workspace "$PROJECT_ROOT" \
-  --exact owlrunkit@0.25.1 --apply
+  --exact owlrunkit@0.25.2 --apply
 npx --no-install owlrunkit init --workspace "$PROJECT_ROOT"
 npx --no-install owlrunkit inspect --json --workspace "$PROJECT_ROOT"
 npx --no-install owlrunkit inspect --json --compact --workspace "$PROJECT_ROOT"

package/integrations/codex/skills/owlcoda-runkit/assets/templates/config.json

@@ -2,9 +2,9 @@
   "schemaVersion": "OwlCodaRunKitConfigV2",
   "core": {
     "contractVersion": "0.2",
-    "coreVersion": "0.25.1",
-    "coreManifestSha256": "sha256:0934a076b147847a4623bc89263b677c88088b493495fc74f11485985b7903b5",
-    "coreSourceRef": "artifact:sha256:0934a076b147847a4623bc89263b677c88088b493495fc74f11485985b7903b5"
+    "coreVersion": "0.25.2",
+    "coreManifestSha256": "sha256:da816d343597b91c30e4f96c0a3d765bf5c00d6013d6bee430f58bc701399acc",
+    "coreSourceRef": "artifact:sha256:da816d343597b91c30e4f96c0a3d765bf5c00d6013d6bee430f58bc701399acc"
   },
   "authorizationPolicy": "external_explicit_authority_required"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "owlrunkit",
-  "version": "0.25.1",
+  "version": "0.25.2",
   "description": "Project Driver for cross-Agent project continuity and progression; execution, evidence, verification, and recovery are the underlying trust substrate.",
   "license": "GPL-3.0-or-later",
   "author": "yeemio <owlclaw@163.com>",

package/packages/attest/distribution-manifest-v1.json

@@ -42,6 +42,11 @@
     "sha256": "sha256:3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986"
   },
   "supportedProducerCoreIdentities": [
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.25.2",
+      "coreManifestSha256": "sha256:da816d343597b91c30e4f96c0a3d765bf5c00d6013d6bee430f58bc701399acc"
+    },
     {
       "contractVersion": "0.2",
       "coreVersion": "0.25.1",

package/packages/attest/src/quick.mjs

@@ -23,6 +23,11 @@ import {
 export { validQuickReceiptShape } from "./quick-receipt-contract.mjs";
 
 export const SUPPORTED_QUICK_CORE_IDENTITIES = Object.freeze([
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.25.2",
+    coreManifestSha256: "sha256:da816d343597b91c30e4f96c0a3d765bf5c00d6013d6bee430f58bc701399acc",
+  },
   {
     contractVersion: "0.2",
     coreVersion: "0.25.1",

package/registry-release-policy-v2.json

@@ -2,7 +2,7 @@
   "schemaVersion": "OwlCodaRunKitRegistryReleasePolicyV2",
   "status": "release_artifact_registry_gated",
   "packageName": "owlrunkit",
-  "artifactVersion": "0.25.1",
+  "artifactVersion": "0.25.2",
   "registry": "https://registry.npmjs.org",
   "registryRequiredBeforeAdoption": true,
   "exactVersionRequired": true,
@@ -23,10 +23,10 @@
   ],
   "rollbackRelease": {
     "packageName": "owlrunkit",
-    "version": "0.25.0",
-    "shasum": "8cfb52126320bfdafc722bcc41db6cada19f91cc",
-    "integrity": "sha512-YgO+KFQ+wmiPVzTRJay9RIyIEYk9e4ViuM0otBIjF8RpkjLcALq2LUJRlo8vmymwxm7TtPCuSNc7UD2gNKFOAA==",
-    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.25.0.tgz"
+    "version": "0.25.1",
+    "shasum": "755bdcef5f6df55977ee64d2d4391d1098c00168",
+    "integrity": "sha512-+s+PHZXemJIgBo8ScT65+OngqniojRFMxpoUOTjp/Xkq/szB8FqEUOH1BFlokMz6dx64FSOKb30rDPZWC2lS4w==",
+    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.25.1.tgz"
   },
   "registryEvidenceMustBeExternal": true,
   "registryEvidenceSchemaVersion": "OwlCodaRunKitRegistryReleaseEvidenceV1",

package/sbom.spdx.json

@@ -2,8 +2,8 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "owlrunkit-0.25.1",
-  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.25.1",
+  "name": "owlrunkit-0.25.2",
+  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.25.2",
   "creationInfo": {
     "created": "2026-11-11T00:00:00Z",
     "creators": [
@@ -14,7 +14,7 @@
     {
       "name": "owlrunkit",
       "SPDXID": "SPDXRef-Package-OwlRunKit",
-      "versionInfo": "0.25.1",
+      "versionInfo": "0.25.2",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "GPL-3.0-or-later",
@@ -24,7 +24,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/owlrunkit@0.25.1"
+          "referenceLocator": "pkg:npm/owlrunkit@0.25.2"
         }
       ]
     }

package/scripts/runkit-contract/core-contract.mjs

@@ -14,7 +14,7 @@ import { fileURLToPath } from "node:url";
 import { parseProjectControlState } from "./project-control-parser.mjs";
 
 export const CONTRACT_VERSION = "0.2";
-export const CORE_VERSION = "0.25.1";
+export const CORE_VERSION = "0.25.2";
 export const RUNTIME_ROOT = ".owlcoda/runkit";
 
 const CORE_FILES = [
@@ -44,6 +44,7 @@ const CORE_FILES = [
   "linux-runtime.mjs",
   "offline-store.mjs",
   "outcome-presentation.mjs",
+  "peer-linux-bwrap.mjs",
   "peer-linux.c",
   "peer-recovery.mjs",
   "onboarding-doctor.mjs",

package/scripts/runkit-contract/peer-linux-bwrap.mjs

@@ -0,0 +1,109 @@
+import { spawnSync } from "node:child_process";
+import {
+  accessSync, constants, lstatSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+export const BUBBLEWRAP_PEER_BACKEND = "linux_bubblewrap_seccomp_v1";
+
+const SANDBOX_HELPER = "/owlrunkit-helper";
+const SANDBOX_WORKER = "/owlrunkit-worker";
+const WORK = "/work";
+
+function trustedBubblewrap() {
+  const directories = ["/usr/bin", "/bin", "/usr/local/bin", ...(process.env.PATH ?? "").split(":")];
+  for (const directory of new Set(directories)) {
+    if (!path.isAbsolute(directory)) continue;
+    try {
+      const file = realpathSync(path.join(directory, "bwrap"));
+      const stat = lstatSync(file);
+      if (!stat.isFile() || stat.uid !== 0 || (stat.mode & 0o6022)) continue;
+      accessSync(file, constants.X_OK);
+      let parent = path.dirname(file);
+      for (;;) {
+        const entry = lstatSync(parent);
+        if (!entry.isDirectory() || entry.uid !== 0 || (entry.mode & 0o022)) break;
+        const next = path.dirname(parent);
+        if (parent === next) return file;
+        parent = next;
+      }
+    } catch (error) {
+      if (!["ENOENT", "EACCES", "ENOTDIR"].includes(error.code)) throw error;
+    }
+  }
+  return null;
+}
+
+export function bubblewrapPeerArgs({ helper, directory, worker, args, environment }) {
+  return [
+    "--unshare-user", "--new-session", "--die-with-parent", "--clearenv", "--cap-drop", "ALL",
+    "--ro-bind-try", "/lib", "/lib",
+    "--ro-bind-try", "/lib64", "/lib64",
+    "--ro-bind-try", "/usr/lib", "/usr/lib",
+    "--ro-bind-try", "/usr/lib64", "/usr/lib64",
+    "--ro-bind-try", "/etc/ld.so.cache", "/etc/ld.so.cache",
+    "--dev-bind", "/dev/null", "/dev/null",
+    "--ro-bind", helper, SANDBOX_HELPER,
+    "--ro-bind", worker, SANDBOX_WORKER,
+    "--bind", directory, WORK, "--remount-ro", "/", "--chdir", WORK,
+    ...Object.entries({ ...environment, TMPDIR: WORK, OPENSSL_CONF: "/dev/null" })
+      .flatMap(([key, value]) => ["--setenv", key, value]),
+    "--", SANDBOX_HELPER, "run-bwrap", SANDBOX_WORKER, ...args,
+  ];
+}
+
+const probeWorker = `
+  const assert = require('node:assert/strict');
+  const fs = require('node:fs');
+  const net = require('node:net');
+  const { spawnSync } = require('node:child_process');
+  assert.equal(process.cwd(), '/work');
+  assert.equal(fs.readFileSync('probe-input', 'utf8'), 'from host');
+  assert.throws(() => fs.readFileSync(process.argv[1]), { code: 'ENOENT' });
+  assert.throws(() => fs.writeFileSync('/probe-outside-work', 'no'), { code: 'EROFS' });
+  assert.equal(spawnSync(process.execPath, ['--version']).error?.code, 'EPERM');
+  const server = net.createServer();
+  server.once('error', error => {
+    assert.equal(error.code, 'EPERM');
+    fs.writeFileSync('probe-result', 'confined');
+  });
+  server.listen(0, '127.0.0.1', () => {
+    server.close();
+    throw new Error('socket unexpectedly succeeded');
+  });
+`;
+
+export function probeBubblewrapPeer(helper) {
+  const executable = trustedBubblewrap();
+  if (!executable) return { available: false, reason: "trusted system Bubblewrap not found" };
+  const directory = mkdtempSync(path.join(realpathSync(tmpdir()), "owlrunkit-bwrap-probe-"));
+  try {
+    const outside = path.join(directory, "outside");
+    const work = path.join(directory, "work");
+    writeFileSync(outside, "outside", { flag: "wx", mode: 0o600 });
+    // Keep the sentinel outside the only writable bind.
+    const scratch = mkdtempSync(work);
+    writeFileSync(path.join(scratch, "probe-input"), "from host", { flag: "wx", mode: 0o600 });
+    const result = spawnSync(executable, bubblewrapPeerArgs({
+      helper, directory: scratch, worker: realpathSync(process.execPath),
+      args: ["-e", probeWorker, outside], environment: {},
+    }), {
+      cwd: scratch, env: {}, stdio: ["ignore", "ignore", "pipe"],
+      encoding: "utf8", timeout: 5000, maxBuffer: 65536,
+    });
+    if (result.status !== 0) {
+      return { available: false, reason: result.stderr?.trim() || result.error?.code
+        || `Bubblewrap self-test exited ${result.status}` };
+    }
+    const confirmation = path.join(scratch, "probe-result");
+    if (readFileSync(confirmation, "utf8") !== "confined") {
+      return { available: false, reason: "Bubblewrap self-test did not confirm enforcement" };
+    }
+    return { available: true, id: BUBBLEWRAP_PEER_BACKEND, executable, helper };
+  } catch (error) {
+    return { available: false, reason: `Bubblewrap self-test failed: ${error.code ?? error.message}` };
+  } finally {
+    rmSync(directory, { recursive: true, force: true });
+  }
+}

package/scripts/runkit-contract/peer-linux.c

@@ -18,6 +18,7 @@
 #include <sys/prctl.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
+#include <sys/statvfs.h>
 #include <sys/syscall.h>
 #include <sys/xattr.h>
 #include <unistd.h>
@@ -61,7 +62,7 @@ static void allow_path(int ruleset, const char *path, uint64_t rights, int optio
     close(fd);
 }
 
-static void restrict_files(const char *directory, const char *worker)
+static void restrict_files(const char *directory, const char *worker, int probe)
 {
     const uint64_t read_tree = LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR;
     const uint64_t work = read_tree | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_TRUNCATE |
@@ -71,9 +72,18 @@ static void restrict_files(const char *directory, const char *worker)
         LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_BLOCK |
         LANDLOCK_ACCESS_FS_MAKE_SOCK | LANDLOCK_ACCESS_FS_MAKE_FIFO | LANDLOCK_ACCESS_FS_MAKE_SYM };
     long abi = syscall(SYS_landlock_create_ruleset, NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);
-    if (abi < 0)
+    if (abi < 0) {
+        if (probe && (errno == ENOSYS || errno == EOPNOTSUPP)) {
+            perror("landlock_create_ruleset version");
+            _exit(77);
+        }
         fail("landlock_create_ruleset version");
+    }
     if (abi < 3) {
+        if (probe) {
+            fputs("Landlock ABI 3 is required\n", stderr);
+            _exit(77);
+        }
         errno = EOPNOTSUPP;
         fail("Landlock ABI 3 is required");
     }
@@ -160,7 +170,7 @@ static void restrict_syscalls(void)
         ALLOW_SYSCALL(faccessat), ALLOW_SYSCALL(faccessat2), ALLOW_SYSCALL(getdents64),
         ALLOW_SYSCALL(getcwd), ALLOW_SYSCALL(chdir), ALLOW_SYSCALL(fchdir), ALLOW_SYSCALL(readlinkat),
         ALLOW_SYSCALL(mkdirat), ALLOW_SYSCALL(unlinkat), ALLOW_SYSCALL(renameat),
-        ALLOW_SYSCALL(renameat2), ALLOW_SYSCALL(linkat), ALLOW_SYSCALL(symlinkat),
+        ALLOW_SYSCALL(renameat2), ALLOW_SYSCALL(linkat),
         ALLOW_SYSCALL(truncate), ALLOW_SYSCALL(ftruncate), ALLOW_SYSCALL(fsync), ALLOW_SYSCALL(fdatasync),
         ALLOW_SYSCALL(dup), ALLOW_SYSCALL(dup3), ALLOW_SYSCALL(pipe2),
         ALLOW_SYSCALL(mmap), ALLOW_SYSCALL(munmap), ALLOW_SYSCALL(mprotect), ALLOW_SYSCALL(mremap),
@@ -181,7 +191,7 @@ static void restrict_syscalls(void)
         ALLOW_SYSCALL(arch_prctl), ALLOW_SYSCALL(access), ALLOW_SYSCALL(open),
         ALLOW_SYSCALL(stat), ALLOW_SYSCALL(lstat), ALLOW_SYSCALL(readlink),
         ALLOW_SYSCALL(mkdir), ALLOW_SYSCALL(rmdir), ALLOW_SYSCALL(unlink),
-        ALLOW_SYSCALL(rename), ALLOW_SYSCALL(link), ALLOW_SYSCALL(symlink),
+        ALLOW_SYSCALL(rename), ALLOW_SYSCALL(link),
         ALLOW_SYSCALL(dup2), ALLOW_SYSCALL(pipe), ALLOW_SYSCALL(epoll_wait), ALLOW_SYSCALL(poll),
 #endif
         BPF_STMT(BPF_RET | BPF_K, DENIED),
@@ -193,6 +203,19 @@ static void restrict_syscalls(void)
         fail("seccomp filter");
 }
 
+static void verify_bubblewrap_root(void)
+{
+    char directory[sizeof "/work"];
+    struct statvfs root, work;
+    if (!getcwd(directory, sizeof directory) || strcmp(directory, "/work") != 0 ||
+        statvfs("/", &root) < 0 || statvfs("/work", &work) < 0 ||
+        !(root.f_flag & ST_RDONLY) || (work.f_flag & ST_RDONLY) ||
+        access("/proc/self", F_OK) == 0 || errno != ENOENT) {
+        fputs("Unexpected Bubblewrap filesystem boundary\n", stderr);
+        _exit(125);
+    }
+}
+
 int main(int argc, char **argv)
 {
     if (argc == 2 && strcmp(argv[1], "lock") == 0) {
@@ -203,21 +226,30 @@ int main(int argc, char **argv)
         fail("control flock");
     }
     int probe = argc == 2 && strcmp(argv[1], "probe") == 0;
-    if (!probe && (argc < 5 || strcmp(argv[1], "run") != 0))
+    int bubblewrap = argc >= 3 && strcmp(argv[1], "run-bwrap") == 0;
+    if (!probe && !bubblewrap && (argc < 5 || strcmp(argv[1], "run") != 0))
         return 125;
+    char **worker_argv = probe ? NULL : &argv[bubblewrap ? 2 : 4];
     if (!probe) {
-        char *end;
-        long parent = strtol(argv[2], &end, 10);
-        if (*end || parent <= 0 || prctl(PR_SET_PDEATHSIG, SIGKILL) < 0 || getppid() != parent)
+        long parent = getppid();
+        if (!bubblewrap) {
+            char *end;
+            parent = strtol(argv[2], &end, 10);
+            if (*end)
+                return 125;
+        }
+        if (parent <= 0 || prctl(PR_SET_PDEATHSIG, SIGKILL) < 0 || getppid() != parent)
             return 125;
+        if (bubblewrap)
+            verify_bubblewrap_root();
         struct stat worker;
-        if (stat(argv[4], &worker) < 0)
+        if (stat(worker_argv[0], &worker) < 0)
             fail("stat worker");
         if (worker.st_mode & (S_ISUID | S_ISGID)) {
             errno = EPERM;
             fail("set-id workers are unsupported");
         }
-        if (getxattr(argv[4], "security.capability", NULL, 0) >= 0) {
+        if (getxattr(worker_argv[0], "security.capability", NULL, 0) >= 0) {
             errno = EPERM;
             fail("file capabilities on workers are unsupported");
         }
@@ -228,7 +260,8 @@ int main(int argc, char **argv)
         fail("close inherited descriptors");
     if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
         fail("no_new_privs");
-    restrict_files(probe ? NULL : argv[3], probe ? NULL : argv[4]);
+    if (!bubblewrap)
+        restrict_files(probe ? NULL : argv[3], probe ? NULL : worker_argv[0], probe);
     restrict_syscalls();
     if (probe) {
         if (open("/etc/passwd", O_RDONLY) >= 0 || errno != EACCES ||
@@ -238,6 +271,6 @@ int main(int argc, char **argv)
         }
         return 0;
     }
-    execve(argv[4], &argv[4], environ);
+    execve(worker_argv[0], worker_argv, environ);
     fail("execve worker");
 }

package/scripts/runkit-contract/peer-recovery.mjs

@@ -10,6 +10,7 @@ import path from "node:path";
 
 import { RUNTIME_ROOT, currentCoreIdentity } from "./core-contract.mjs";
 import { linuxRuntimeHelper } from "./linux-runtime.mjs";
+import { BUBBLEWRAP_PEER_BACKEND, bubblewrapPeerArgs, probeBubblewrapPeer } from "./peer-linux-bwrap.mjs";
 import { safeIdentifier } from "./provenance-common.mjs";
 import { resolveVerificationEnvelopeBackendV1 } from "./verification-envelope.mjs";
 
@@ -208,7 +209,15 @@ export function resolvePeerRecoveryBackend() {
         return { available: true, id: "linux_landlock_seccomp_v1", executable,
           digest: digest(regularBytes(executable, CHECKPOINT_LIMIT)) };
       }
-      return { available: false, reason: result.stderr?.trim() || result.error?.code };
+      const reason = result.stderr?.trim() || result.error?.code;
+      if (result.status !== 77) return { available: false, reason };
+      const fallback = probeBubblewrapPeer(executable);
+      if (!fallback.available) {
+        return { available: false, reason: [reason, fallback.reason].filter(Boolean).join("; ") };
+      }
+      const helperHash = digest(regularBytes(executable, CHECKPOINT_LIMIT));
+      const sandboxHash = digest(regularBytes(fallback.executable, CHECKPOINT_LIMIT));
+      return { ...fallback, digest: digest(JSON.stringify([helperHash, sandboxHash])) };
     } catch (error) { return { available: false, reason: error.code }; }
   }
   return resolveVerificationEnvelopeBackendV1();
@@ -420,16 +429,27 @@ export async function runPeerTask({ workspaceRoot, taskId, agent, generation, co
   }
 
   return new Promise((resolve, reject) => {
-    const args = backend.id === "linux_landlock_seccomp_v1"
-      ? ["run", String(process.pid), directory]
-      : ["-p", sandboxPolicy(executable, directory)];
-    const child = spawn(backend.executable, [...args, executable, ...command.slice(1)], {
-      cwd: directory, env: {
-        PATH: "/usr/bin:/bin", TMPDIR: directory, OWLRUNKIT_PEER_ATTEMPT: id,
-        OWLRUNKIT_PEER_PATHS: JSON.stringify(state.paths),
-        // An isolated worker cannot read host OpenSSL configuration.
-        ...(backend.id === "linux_landlock_seccomp_v1" ? { OPENSSL_CONF: "/dev/null" } : {}),
-      }, stdio: ["pipe", "pipe", "pipe"],
+    const environment = {
+      PATH: "/usr/bin:/bin", TMPDIR: directory, OWLRUNKIT_PEER_ATTEMPT: id,
+      OWLRUNKIT_PEER_PATHS: JSON.stringify(state.paths),
+    };
+    let args;
+    let env = environment;
+    if (backend.id === BUBBLEWRAP_PEER_BACKEND) {
+      args = bubblewrapPeerArgs({
+        helper: backend.helper, directory, worker: executable,
+        args: command.slice(1), environment,
+      });
+      env = {};
+    } else if (backend.id === "linux_landlock_seccomp_v1") {
+      args = ["run", String(process.pid), directory, executable, ...command.slice(1)];
+      // An isolated worker cannot read host OpenSSL configuration.
+      env.OPENSSL_CONF = "/dev/null";
+    } else {
+      args = ["-p", sandboxPolicy(executable, directory), executable, ...command.slice(1)];
+    }
+    const child = spawn(backend.executable, args, {
+      cwd: directory, env, stdio: ["pipe", "pipe", "pipe"],
     });
     let watcher, pending = Buffer.alloc(0), sentWake, protocolError = null;
     let diagnostic = Buffer.alloc(0);

package/scripts/runkit-contract/project-cli-resolver.mjs

@@ -28,10 +28,14 @@ const SELF_NORMALIZED_QUICK_CORE_VERSIONS = new Set([
   "0.24.1",
   "0.25.0",
   "0.25.1",
+  "0.25.2",
 ]);
 const EXACT_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/;
 const SHA256_REF = /^sha256:[a-f0-9]{64}$/;
 const TRUSTED_PRIOR_CORE_IDENTITIES = new Map([
+  ["0.25.1", new Set([
+    "sha256:0934a076b147847a4623bc89263b677c88088b493495fc74f11485985b7903b5",
+  ])],
   ["0.25.0", new Set([
     "sha256:20e75c386f1408f11e908a6d3ee1a39316d9728d5719fa06f8d6a5aa45abd83e",
   ])],

package/LINUX-HELPERS.sha256

@@ -1,2 +0,0 @@
-acbc0a76363cbb81700fdb3e7924c6b1403b30af82dbbda9ad8855a6bb53f988  peer-linux-arm64
-c6a4b270df2482f52ef1463b6ced5205f34c9abda8d4af0a55a1ac3273985436  peer-linux-x64