owlrunkit 0.25.1 → 0.25.3

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.25.3
+
+- Accepts Bubblewrap on a verified read-only Linux system mount when the
+  platform remaps root and the system file owners appear as overflow UIDs.
+  RunKit runs the checked executable by descriptor and rechecks its identity
+  before starting each worker.
+- Ships the Linux helper build script and checksums with the npm package and
+  links to the exact corresponding public source tag from `SOURCE.md`.
+
+## 0.25.2
+
+- Supports managed Linux worker recovery with system Bubblewrap when Landlock
+  is unavailable. RunKit verifies the writable attempt, read-only sandbox
+  root, hidden host files, and seccomp process and network restrictions before
+  selecting the backend.
+- Keeps Landlock as the first Linux backend. If neither backend passes its
+  runtime probe, managed peer commands refuse to start.
+
 ## 0.25.1
 
 - Adds enforced Linux peer isolation for x86-64 and ARM64 with Landlock and

package/LINUX-HELPERS.sha256

@@ -1,2 +1,2 @@
-acbc0a76363cbb81700fdb3e7924c6b1403b30af82dbbda9ad8855a6bb53f988  peer-linux-arm64
-c6a4b270df2482f52ef1463b6ced5205f34c9abda8d4af0a55a1ac3273985436  peer-linux-x64
+39e177cebac50c87514e19df991266970a5814eb468ec716250d6e731a73a40d  peer-linux-x64
+ad5ecf24f6c13233edb43c8ce0b8aa91b15134e710252ae6e82de39630d67e0e  peer-linux-arm64

package/README.md

@@ -134,29 +134,9 @@ automatically promote an authoritative writer. Core successor, release
 compatibility, publication, Project Successor, and project adoption remain
 separate authority boundaries.
 
-## Current release
-
-`owlrunkit@0.25.1` is the version documented here. Its public surfaces
-include:
-
-- Project Driver and typed delivery lifecycle;
-- Quick and Formal verification with source-bound receipts;
-- controller/target worktree separation and foreign-candidate verification;
-- Team Delivery read-only recommendations and portable transfer packets;
-- bounded compact-session Hook Recovery;
-- optional native Codex Stop continuation on a bound RunKit file event;
-- managed local peer recovery for isolated macOS and Linux workers;
-- completed-project drift detection and read-only successor scaffolding;
-- fail-closed bootstrap, profile, registry, Core, and shared-Skill diagnostics.
-
-This repository is the public corresponding-source, documentation, issue,
-release, and trust surface for OwlRunKit. Day-to-day development remains in a
-private source repository; every GPL-covered npm release must map to an exact
-public source tag.
-
 ## Install
 
-This package is the lifecycle-stable, registry-gated `owlrunkit@0.25.1`
+This package is the lifecycle-stable, registry-gated `owlrunkit@0.25.3`
 artifact. Registry adoption remains fail-closed until its exact official npm
 version, shasum, integrity, and tarball URL are independently verified. Local
 tarballs remain candidate-test inputs and are never adoption provenance. Until
@@ -164,7 +144,7 @@ that registry evidence exists, use the package only for isolated candidate
 verification; do not treat the command below as available release truth.
 
 ```bash
-npm install --save-exact owlrunkit@0.25.1
+npm install --save-exact owlrunkit@0.25.3
 ```
 
 Use `npx --no-install owlrunkit` for project commands. The package bootstrap
@@ -180,9 +160,9 @@ the project Config must independently bind the same Core.
 ```bash
 npx --no-install owlrunkit --version
 npx --no-install owlrunkit bootstrap --workspace /absolute/path/to/project \
-  --exact owlrunkit@0.25.1 --dry-run
+  --exact owlrunkit@0.25.3 --dry-run
 npx --no-install owlrunkit bootstrap --workspace /absolute/path/to/project \
-  --exact owlrunkit@0.25.1 --apply
+  --exact owlrunkit@0.25.3 --apply
 npx --no-install owlrunkit init --workspace /absolute/path/to/project
 npx --no-install owlrunkit doctor --workspace /absolute/path/to/project
 npx --no-install owlrunkit inspect --workspace /absolute/path/to/project --json --compact
@@ -1060,10 +1040,16 @@ scratch directory is reported for inspection while it remains on disk.
 
 The macOS and Linux backends confine writes to the attempt and deny network
 connections and new worker processes. Linux supports x86-64 and ARM64 with
-Landlock ABI 3 or later, seccomp filtering, and `close_range`. The packaged
-helper checks the effective policy before a managed task starts. It terminates
-the worker if the supervisor process is killed. The host caller supplies the
-worker command and peer identity. Existing Desktop sessions and writers using
+seccomp filtering and `close_range`. RunKit tries Landlock ABI 3 or later
+first. If Landlock is unavailable, it can use a trusted system Bubblewrap
+executable with user and mount namespaces. The Bubblewrap probe verifies
+that the attempt is writable, host files are hidden, and new processes and
+network sockets are denied. If the probe fails, the task stays blocked.
+On Linux environments that remap root, RunKit can trust `/usr/bin/bwrap` on
+a dedicated read-only `/usr` system mount after verifying its mount identity
+and checking for writable aliases. It launches the verified file descriptor.
+On Linux, the worker is terminated if its supervisor is killed. The host
+caller supplies the worker command and peer identity. Existing Desktop sessions and writers using
 legacy shared-directory leases follow their own recovery procedure. An
 existing managed task remains pinned to the core that created it.
 

package/SOURCE.md

@@ -1,16 +1,15 @@
 # Corresponding source
 
 OwlRunKit is distributed under GPL-3.0-or-later. The corresponding public
-source for this release is [OwlRunKit v0.25.1](https://github.com/yeemio/owlrunkit/tree/v0.25.1).
-It includes the JavaScript runtime, C source and build script for the Linux
-helpers, package metadata, public contracts, and bundled integration resources.
+source is [OwlRunKit v0.25.3](https://github.com/yeemio/owlrunkit/tree/v0.25.3).
+The npm package includes the JavaScript runtime, read-only verifier, C source,
+and [Linux helper build script](packages/runkit/build-linux-helper.sh).
+The distributed helpers statically link musl and include its copyright notice.
 
 ## Rebuild the Linux helpers
 
-Check out the public tag, then run these commands from its root. The helper
-build uses the Alpine 3.22 image and the compiler and Linux headers from its
-package repository. Build on each architecture or use a Docker environment
-that supports both build platforms.
+From the public tag or unpacked npm package, run the build on Linux x86-64
+and ARM64 using Alpine 3.22 with `build-base` and `linux-headers`.
 
 ```sh
 mkdir -p .build
@@ -23,6 +22,7 @@ done
 (cd .build && sha256sum -c ../LINUX-HELPERS.sha256)
 ```
 
-The npm tarball contains both helper executables alongside their C source and
-the musl copyright notice. Its official registry version, shasum, integrity,
-and tarball URL identify the published package.
+The authoritative release is identified by the npm registry version, shasum,
+integrity, and tarball URL. Local directories, `file:` dependencies, local
+tarballs, Git URLs, workspace links, and mutable dist-tags are not accepted as
+formal cross-project adoption evidence.

package/integrations/codex/skills/owlcoda-runkit/SKILL.md

@@ -7,14 +7,14 @@ description: Run receipt-backed, project-owned work with OwlCoda RunKit. Use whe
 
 Use the bundled deterministic Core to coordinate work through project artifacts rather than chat memory. Require Node.js 20 or later.
 
-Bundled registry-gated artifact: standalone `owlrunkit@0.25.1`, bundling Contract
-`0.2` and Core `0.25.1` with manifest
-`sha256:0934a076b147847a4623bc89263b677c88088b493495fc74f11485985b7903b5`.
+Bundled registry-gated artifact: standalone `owlrunkit@0.25.3`, bundling Contract
+`0.2` and Core `0.25.3` with manifest
+`sha256:901f3b5da227555a1a6b65f9deb4efa71f8f3bf9c3f9a34b1a30034da8779d66`.
 Registry adoption remains fail-closed until exact official npm registry
-provenance for `owlrunkit@0.25.1` is independently verified. The
-published rollback baseline for this artifact is `owlrunkit@0.25.0`, with SHA-1
-`8cfb52126320bfdafc722bcc41db6cada19f91cc` and canonical npm tarball URL
-`https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.25.0.tgz`.
+provenance for `owlrunkit@0.25.3` is independently verified. The
+published rollback baseline for this artifact is `owlrunkit@0.25.2`, with SHA-1
+`0b4bc23778549cdd3537f2e78d55302b34237ded` and canonical npm tarball URL
+`https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.25.2.tgz`.
 The root `owlcoda` package has a separate version lifecycle.
 
 The session is an execution interface. Project artifacts are the system of record.
@@ -370,9 +370,9 @@ below has no CLI entry.
 
 ```bash
 npx --no-install owlrunkit bootstrap --workspace "$PROJECT_ROOT" \
-  --exact owlrunkit@0.25.1 --dry-run
+  --exact owlrunkit@0.25.3 --dry-run
 npx --no-install owlrunkit bootstrap --workspace "$PROJECT_ROOT" \
-  --exact owlrunkit@0.25.1 --apply
+  --exact owlrunkit@0.25.3 --apply
 npx --no-install owlrunkit init --workspace "$PROJECT_ROOT"
 npx --no-install owlrunkit inspect --json --workspace "$PROJECT_ROOT"
 npx --no-install owlrunkit inspect --json --compact --workspace "$PROJECT_ROOT"

package/integrations/codex/skills/owlcoda-runkit/assets/templates/config.json

@@ -2,9 +2,9 @@
   "schemaVersion": "OwlCodaRunKitConfigV2",
   "core": {
     "contractVersion": "0.2",
-    "coreVersion": "0.25.1",
-    "coreManifestSha256": "sha256:0934a076b147847a4623bc89263b677c88088b493495fc74f11485985b7903b5",
-    "coreSourceRef": "artifact:sha256:0934a076b147847a4623bc89263b677c88088b493495fc74f11485985b7903b5"
+    "coreVersion": "0.25.3",
+    "coreManifestSha256": "sha256:901f3b5da227555a1a6b65f9deb4efa71f8f3bf9c3f9a34b1a30034da8779d66",
+    "coreSourceRef": "artifact:sha256:901f3b5da227555a1a6b65f9deb4efa71f8f3bf9c3f9a34b1a30034da8779d66"
   },
   "authorizationPolicy": "external_explicit_authority_required"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "owlrunkit",
-  "version": "0.25.1",
+  "version": "0.25.3",
   "description": "Project Driver for cross-Agent project continuity and progression; execution, evidence, verification, and recovery are the underlying trust substrate.",
   "license": "GPL-3.0-or-later",
   "author": "yeemio <owlclaw@163.com>",

package/packages/attest/distribution-manifest-v1.json

@@ -42,6 +42,16 @@
     "sha256": "sha256:3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986"
   },
   "supportedProducerCoreIdentities": [
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.25.3",
+      "coreManifestSha256": "sha256:901f3b5da227555a1a6b65f9deb4efa71f8f3bf9c3f9a34b1a30034da8779d66"
+    },
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.25.2",
+      "coreManifestSha256": "sha256:da816d343597b91c30e4f96c0a3d765bf5c00d6013d6bee430f58bc701399acc"
+    },
     {
       "contractVersion": "0.2",
       "coreVersion": "0.25.1",

package/packages/attest/src/quick.mjs

@@ -23,6 +23,16 @@ import {
 export { validQuickReceiptShape } from "./quick-receipt-contract.mjs";
 
 export const SUPPORTED_QUICK_CORE_IDENTITIES = Object.freeze([
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.25.3",
+    coreManifestSha256: "sha256:901f3b5da227555a1a6b65f9deb4efa71f8f3bf9c3f9a34b1a30034da8779d66",
+  },
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.25.2",
+    coreManifestSha256: "sha256:da816d343597b91c30e4f96c0a3d765bf5c00d6013d6bee430f58bc701399acc",
+  },
   {
     contractVersion: "0.2",
     coreVersion: "0.25.1",

package/packages/runkit/build-linux-helper.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+set -eu
+
+case "$(uname -s)/$(uname -m)" in
+    Linux/x86_64) arch=x64 ;;
+    Linux/aarch64) arch=arm64 ;;
+    *) echo "Build the peer helper on Linux x86_64 or aarch64." >&2; exit 1 ;;
+esac
+
+if [ "$#" -ne 1 ] || [ ! -d "$1" ]; then
+    echo "Usage: sh build-linux-helper.sh <existing output directory>" >&2
+    exit 1
+fi
+
+source_dir=$(CDPATH= cd -- "$(dirname -- "$0")/../../scripts/runkit-contract" && pwd)
+"${CC:-cc}" -std=c11 -O2 -Wall -Wextra -Werror -static -s \
+    "$source_dir/peer-linux.c" -o "$1/peer-linux-$arch"

package/registry-release-policy-v2.json

@@ -2,7 +2,7 @@
   "schemaVersion": "OwlCodaRunKitRegistryReleasePolicyV2",
   "status": "release_artifact_registry_gated",
   "packageName": "owlrunkit",
-  "artifactVersion": "0.25.1",
+  "artifactVersion": "0.25.3",
   "registry": "https://registry.npmjs.org",
   "registryRequiredBeforeAdoption": true,
   "exactVersionRequired": true,
@@ -23,10 +23,10 @@
   ],
   "rollbackRelease": {
     "packageName": "owlrunkit",
-    "version": "0.25.0",
-    "shasum": "8cfb52126320bfdafc722bcc41db6cada19f91cc",
-    "integrity": "sha512-YgO+KFQ+wmiPVzTRJay9RIyIEYk9e4ViuM0otBIjF8RpkjLcALq2LUJRlo8vmymwxm7TtPCuSNc7UD2gNKFOAA==",
-    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.25.0.tgz"
+    "version": "0.25.2",
+    "shasum": "0b4bc23778549cdd3537f2e78d55302b34237ded",
+    "integrity": "sha512-a7EJwkR/3o0Pjuz2dxEKkbB6n7WowLloKtYuuyjfXGfZM3D6/IVphdRLBv7oh/lJPk511e/i0XGUfFxt+OhXzA==",
+    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.25.2.tgz"
   },
   "registryEvidenceMustBeExternal": true,
   "registryEvidenceSchemaVersion": "OwlCodaRunKitRegistryReleaseEvidenceV1",

package/sbom.spdx.json

@@ -2,8 +2,8 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "owlrunkit-0.25.1",
-  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.25.1",
+  "name": "owlrunkit-0.25.3",
+  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.25.3",
   "creationInfo": {
     "created": "2026-11-11T00:00:00Z",
     "creators": [
@@ -14,7 +14,7 @@
     {
       "name": "owlrunkit",
       "SPDXID": "SPDXRef-Package-OwlRunKit",
-      "versionInfo": "0.25.1",
+      "versionInfo": "0.25.3",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "GPL-3.0-or-later",
@@ -24,7 +24,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/owlrunkit@0.25.1"
+          "referenceLocator": "pkg:npm/owlrunkit@0.25.3"
         }
       ]
     }

package/scripts/runkit-contract/core-contract.mjs

@@ -14,7 +14,7 @@ import { fileURLToPath } from "node:url";
 import { parseProjectControlState } from "./project-control-parser.mjs";
 
 export const CONTRACT_VERSION = "0.2";
-export const CORE_VERSION = "0.25.1";
+export const CORE_VERSION = "0.25.3";
 export const RUNTIME_ROOT = ".owlcoda/runkit";
 
 const CORE_FILES = [
@@ -44,6 +44,7 @@ const CORE_FILES = [
   "linux-runtime.mjs",
   "offline-store.mjs",
   "outcome-presentation.mjs",
+  "peer-linux-bwrap.mjs",
   "peer-linux.c",
   "peer-recovery.mjs",
   "onboarding-doctor.mjs",

package/scripts/runkit-contract/peer-linux-bwrap.mjs

@@ -0,0 +1,204 @@
+import { spawn, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  accessSync, closeSync, constants, fstatSync, lstatSync, mkdtempSync, openSync,
+  readFileSync, realpathSync, rmSync, statfsSync, writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+export const BUBBLEWRAP_PEER_BACKEND = "linux_bubblewrap_seccomp_v1";
+
+const SANDBOX_HELPER = "/owlrunkit-helper";
+const SANDBOX_WORKER = "/owlrunkit-worker";
+const WORK = "/work";
+const SYSTEM_BWRAP = "/usr/bin/bwrap";
+const FD_EXECUTABLE = "/proc/self/fd/3";
+const OVERFLOW_UID = 65534;
+const PROC_SUPER_MAGIC = 0x9fa0;
+const CAP_SYS_ADMIN = 1n << 21n;
+const MAX_EXECUTABLE_BYTES = 1024 * 1024;
+
+function rootOwnedPath(file, stat) {
+  if (stat.uid !== 0) return false;
+  let parent = path.dirname(file);
+  for (;;) {
+    const entry = lstatSync(parent);
+    if (!entry.isDirectory() || entry.uid !== 0 || (entry.mode & 0o022)) return false;
+    const next = path.dirname(parent);
+    if (parent === next) return true;
+    parent = next;
+  }
+}
+
+export function readOnlySystemBubblewrapIssue({ uid, uidMap, root, systemDirectories, mountId, mountInfo }) {
+  if (uid === 0 || uid === OVERFLOW_UID || uidMap.trim().split(/\s+/u).join(" ") !== `${uid} 0 1`) {
+    return "the caller is not the single mapped parent root UID";
+  }
+  if (!root.isDirectory() || root.uid !== uid || (root.mode & 0o022)
+    || !systemDirectories.every(entry =>
+      entry.isDirectory() && entry.uid === OVERFLOW_UID && !(entry.mode & 0o022))) {
+    return "the system directories do not match the remapped ownership boundary";
+  }
+
+  const mounts = mountInfo.trim().split("\n").map(line => {
+    const [description, filesystem] = line.split(" - ");
+    const [id, , device, , target, flags] = description.split(" ");
+    return { id, device, target, flags: flags?.split(",") ?? [], type: filesystem?.split(" ")[0] };
+  });
+  const system = mounts.find(mount => mount.id === mountId);
+  if (system?.target !== "/usr" || system.type !== "overlay"
+    || !["ro", "nosuid", "nodev"].every(flag => system.flags.includes(flag))) {
+    return "the opened executable is not on the protected read-only /usr mount";
+  }
+  if (mounts.some(mount => mount.device === system.device && mount.flags.includes("rw"))) {
+    return "the /usr mount has a writable alias";
+  }
+  return null;
+}
+
+function readOnlySystemPathIssue(file, stat, fd) {
+  if (file !== SYSTEM_BWRAP || stat.uid !== OVERFLOW_UID || process.getuid() !== process.geteuid()) {
+    return "the executable is outside the remapped system path";
+  }
+  if (statfsSync("/proc/self").type !== PROC_SUPER_MAGIC) return "the kernel mount information is unavailable";
+  const capabilities = /^CapPrm:\s*([0-9a-f]+)$/imu.exec(readFileSync("/proc/self/status", "utf8"))?.[1];
+  if (!capabilities || (BigInt(`0x${capabilities}`) & CAP_SYS_ADMIN)) {
+    return "the caller can reconfigure its system mounts or that capability could not be checked";
+  }
+  const mountId = /^mnt_id:\s*(\d+)$/mu.exec(readFileSync(`/proc/self/fdinfo/${fd}`, "utf8"))?.[1];
+  if (!mountId) return "the kernel did not identify the executable mount";
+  return readOnlySystemBubblewrapIssue({
+    uid: process.geteuid(),
+    uidMap: readFileSync("/proc/self/uid_map", "utf8"),
+    root: lstatSync("/"),
+    systemDirectories: [lstatSync("/usr"), lstatSync("/usr/bin")],
+    mountId,
+    mountInfo: readFileSync("/proc/self/mountinfo", "utf8"),
+  });
+}
+
+function openTrustedBubblewrap(expected) {
+  const directories = ["/usr/bin", "/bin", "/usr/local/bin", ...(process.env.PATH ?? "").split(":")];
+  const candidates = expected ? [expected.executable]
+    : [...new Set(directories)].filter(path.isAbsolute).map(dir => path.join(dir, "bwrap"));
+  let systemRejection;
+  for (const candidate of candidates) {
+    let fd;
+    let trusted = false;
+    try {
+      const executable = realpathSync(candidate);
+      if (expected && executable !== expected.executable) continue;
+      accessSync(executable, constants.X_OK);
+      fd = openSync(executable, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+      const stat = fstatSync(fd);
+      if (!stat.isFile() || (stat.mode & 0o6022) || stat.size > MAX_EXECUTABLE_BYTES) continue;
+      let trust = "root_owned";
+      if (!rootOwnedPath(executable, stat)) {
+        const issue = readOnlySystemPathIssue(executable, stat, fd);
+        if (issue) {
+          if (executable === SYSTEM_BWRAP) systemRejection = issue;
+          continue;
+        }
+        trust = "read_only_system_mount";
+      }
+      const sandboxDigest = `sha256:${createHash("sha256").update(readFileSync(fd)).digest("hex")}`;
+      if (expected && (expected.sandboxDigest !== sandboxDigest || expected.trust !== trust)) continue;
+      trusted = true;
+      return { executable, fd, sandboxDigest, trust };
+    } catch (error) {
+      if (!["ENOENT", "EACCES", "ENOTDIR", "ELOOP"].includes(error.code)) throw error;
+    } finally {
+      if (fd !== undefined && !trusted) closeSync(fd);
+    }
+  }
+  return { reason: ["trusted system Bubblewrap not found", systemRejection].filter(Boolean).join(": ") };
+}
+
+export function spawnBubblewrapPeer(backend, args, options) {
+  const launcher = openTrustedBubblewrap(backend);
+  if (launcher.fd === undefined) {
+    throw new Error(`Bubblewrap executable or trust changed after its self-test: ${launcher.reason}`);
+  }
+  try {
+    return spawn(FD_EXECUTABLE, args, { ...options, stdio: [...options.stdio, launcher.fd] });
+  } finally {
+    closeSync(launcher.fd);
+  }
+}
+
+export function bubblewrapPeerArgs({ helper, directory, worker, args, environment }) {
+  return [
+    "--unshare-user", "--new-session", "--die-with-parent", "--clearenv", "--cap-drop", "ALL",
+    "--ro-bind-try", "/lib", "/lib",
+    "--ro-bind-try", "/lib64", "/lib64",
+    "--ro-bind-try", "/usr/lib", "/usr/lib",
+    "--ro-bind-try", "/usr/lib64", "/usr/lib64",
+    "--ro-bind-try", "/etc/ld.so.cache", "/etc/ld.so.cache",
+    "--dev-bind", "/dev/null", "/dev/null",
+    "--ro-bind", helper, SANDBOX_HELPER,
+    "--ro-bind", worker, SANDBOX_WORKER,
+    "--bind", directory, WORK, "--remount-ro", "/", "--chdir", WORK,
+    ...Object.entries({ ...environment, TMPDIR: WORK, OPENSSL_CONF: "/dev/null" })
+      .flatMap(([key, value]) => ["--setenv", key, value]),
+    "--", SANDBOX_HELPER, "run-bwrap", SANDBOX_WORKER, ...args,
+  ];
+}
+
+const probeWorker = `
+  const assert = require('node:assert/strict');
+  const fs = require('node:fs');
+  const net = require('node:net');
+  const { spawnSync } = require('node:child_process');
+  assert.equal(process.cwd(), '/work');
+  assert.equal(fs.readFileSync('probe-input', 'utf8'), 'from host');
+  assert.throws(() => fs.readFileSync(process.argv[1]), { code: 'ENOENT' });
+  assert.throws(() => fs.writeFileSync('/probe-outside-work', 'no'), { code: 'EROFS' });
+  assert.equal(spawnSync(process.execPath, ['--version']).error?.code, 'EPERM');
+  const server = net.createServer();
+  server.once('error', error => {
+    assert.equal(error.code, 'EPERM');
+    fs.writeFileSync('probe-result', 'confined');
+  });
+  server.listen(0, '127.0.0.1', () => {
+    server.close();
+    throw new Error('socket unexpectedly succeeded');
+  });
+`;
+
+export function probeBubblewrapPeer(helper) {
+  const directory = mkdtempSync(path.join(realpathSync(tmpdir()), "owlrunkit-bwrap-probe-"));
+  let launcher;
+  try {
+    launcher = openTrustedBubblewrap();
+    if (launcher.fd === undefined) return { available: false, reason: launcher.reason };
+    const outside = path.join(directory, "outside");
+    const work = path.join(directory, "work");
+    writeFileSync(outside, "outside", { flag: "wx", mode: 0o600 });
+    // Keep the sentinel outside the only writable bind.
+    const scratch = mkdtempSync(work);
+    writeFileSync(path.join(scratch, "probe-input"), "from host", { flag: "wx", mode: 0o600 });
+    const result = spawnSync(FD_EXECUTABLE, bubblewrapPeerArgs({
+      helper, directory: scratch, worker: realpathSync(process.execPath),
+      args: ["-e", probeWorker, outside], environment: {},
+    }), {
+      cwd: scratch, env: {}, stdio: ["ignore", "ignore", "pipe", launcher.fd],
+      encoding: "utf8", timeout: 5000, maxBuffer: 65536,
+    });
+    if (result.status !== 0) {
+      return { available: false, reason: result.stderr?.trim() || result.error?.code
+        || `Bubblewrap self-test exited ${result.status}` };
+    }
+    const confirmation = path.join(scratch, "probe-result");
+    if (readFileSync(confirmation, "utf8") !== "confined") {
+      return { available: false, reason: "Bubblewrap self-test did not confirm enforcement" };
+    }
+    const { executable, sandboxDigest, trust } = launcher;
+    return { available: true, id: BUBBLEWRAP_PEER_BACKEND, executable, sandboxDigest, trust, helper };
+  } catch (error) {
+    return { available: false, reason: `Bubblewrap self-test failed: ${error.code ?? error.message}` };
+  } finally {
+    if (launcher?.fd !== undefined) closeSync(launcher.fd);
+    rmSync(directory, { recursive: true, force: true });
+  }
+}

package/scripts/runkit-contract/peer-linux.c

@@ -18,6 +18,7 @@
 #include <sys/prctl.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
+#include <sys/statvfs.h>
 #include <sys/syscall.h>
 #include <sys/xattr.h>
 #include <unistd.h>
@@ -61,7 +62,7 @@ static void allow_path(int ruleset, const char *path, uint64_t rights, int optio
     close(fd);
 }
 
-static void restrict_files(const char *directory, const char *worker)
+static void restrict_files(const char *directory, const char *worker, int probe)
 {
     const uint64_t read_tree = LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR;
     const uint64_t work = read_tree | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_TRUNCATE |
@@ -71,9 +72,18 @@ static void restrict_files(const char *directory, const char *worker)
         LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_BLOCK |
         LANDLOCK_ACCESS_FS_MAKE_SOCK | LANDLOCK_ACCESS_FS_MAKE_FIFO | LANDLOCK_ACCESS_FS_MAKE_SYM };
     long abi = syscall(SYS_landlock_create_ruleset, NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);
-    if (abi < 0)
+    if (abi < 0) {
+        if (probe && (errno == ENOSYS || errno == EOPNOTSUPP)) {
+            perror("landlock_create_ruleset version");
+            _exit(77);
+        }
         fail("landlock_create_ruleset version");
+    }
     if (abi < 3) {
+        if (probe) {
+            fputs("Landlock ABI 3 is required\n", stderr);
+            _exit(77);
+        }
         errno = EOPNOTSUPP;
         fail("Landlock ABI 3 is required");
     }
@@ -160,7 +170,7 @@ static void restrict_syscalls(void)
         ALLOW_SYSCALL(faccessat), ALLOW_SYSCALL(faccessat2), ALLOW_SYSCALL(getdents64),
         ALLOW_SYSCALL(getcwd), ALLOW_SYSCALL(chdir), ALLOW_SYSCALL(fchdir), ALLOW_SYSCALL(readlinkat),
         ALLOW_SYSCALL(mkdirat), ALLOW_SYSCALL(unlinkat), ALLOW_SYSCALL(renameat),
-        ALLOW_SYSCALL(renameat2), ALLOW_SYSCALL(linkat), ALLOW_SYSCALL(symlinkat),
+        ALLOW_SYSCALL(renameat2), ALLOW_SYSCALL(linkat),
         ALLOW_SYSCALL(truncate), ALLOW_SYSCALL(ftruncate), ALLOW_SYSCALL(fsync), ALLOW_SYSCALL(fdatasync),
         ALLOW_SYSCALL(dup), ALLOW_SYSCALL(dup3), ALLOW_SYSCALL(pipe2),
         ALLOW_SYSCALL(mmap), ALLOW_SYSCALL(munmap), ALLOW_SYSCALL(mprotect), ALLOW_SYSCALL(mremap),
@@ -181,7 +191,7 @@ static void restrict_syscalls(void)
         ALLOW_SYSCALL(arch_prctl), ALLOW_SYSCALL(access), ALLOW_SYSCALL(open),
         ALLOW_SYSCALL(stat), ALLOW_SYSCALL(lstat), ALLOW_SYSCALL(readlink),
         ALLOW_SYSCALL(mkdir), ALLOW_SYSCALL(rmdir), ALLOW_SYSCALL(unlink),
-        ALLOW_SYSCALL(rename), ALLOW_SYSCALL(link), ALLOW_SYSCALL(symlink),
+        ALLOW_SYSCALL(rename), ALLOW_SYSCALL(link),
         ALLOW_SYSCALL(dup2), ALLOW_SYSCALL(pipe), ALLOW_SYSCALL(epoll_wait), ALLOW_SYSCALL(poll),
 #endif
         BPF_STMT(BPF_RET | BPF_K, DENIED),
@@ -193,6 +203,19 @@ static void restrict_syscalls(void)
         fail("seccomp filter");
 }
 
+static void verify_bubblewrap_root(void)
+{
+    char directory[sizeof "/work"];
+    struct statvfs root, work;
+    if (!getcwd(directory, sizeof directory) || strcmp(directory, "/work") != 0 ||
+        statvfs("/", &root) < 0 || statvfs("/work", &work) < 0 ||
+        !(root.f_flag & ST_RDONLY) || (work.f_flag & ST_RDONLY) ||
+        access("/proc/self", F_OK) == 0 || errno != ENOENT) {
+        fputs("Unexpected Bubblewrap filesystem boundary\n", stderr);
+        _exit(125);
+    }
+}
+
 int main(int argc, char **argv)
 {
     if (argc == 2 && strcmp(argv[1], "lock") == 0) {
@@ -203,21 +226,30 @@ int main(int argc, char **argv)
         fail("control flock");
     }
     int probe = argc == 2 && strcmp(argv[1], "probe") == 0;
-    if (!probe && (argc < 5 || strcmp(argv[1], "run") != 0))
+    int bubblewrap = argc >= 3 && strcmp(argv[1], "run-bwrap") == 0;
+    if (!probe && !bubblewrap && (argc < 5 || strcmp(argv[1], "run") != 0))
         return 125;
+    char **worker_argv = probe ? NULL : &argv[bubblewrap ? 2 : 4];
     if (!probe) {
-        char *end;
-        long parent = strtol(argv[2], &end, 10);
-        if (*end || parent <= 0 || prctl(PR_SET_PDEATHSIG, SIGKILL) < 0 || getppid() != parent)
+        long parent = getppid();
+        if (!bubblewrap) {
+            char *end;
+            parent = strtol(argv[2], &end, 10);
+            if (*end)
+                return 125;
+        }
+        if (parent <= 0 || prctl(PR_SET_PDEATHSIG, SIGKILL) < 0 || getppid() != parent)
             return 125;
+        if (bubblewrap)
+            verify_bubblewrap_root();
         struct stat worker;
-        if (stat(argv[4], &worker) < 0)
+        if (stat(worker_argv[0], &worker) < 0)
             fail("stat worker");
         if (worker.st_mode & (S_ISUID | S_ISGID)) {
             errno = EPERM;
             fail("set-id workers are unsupported");
         }
-        if (getxattr(argv[4], "security.capability", NULL, 0) >= 0) {
+        if (getxattr(worker_argv[0], "security.capability", NULL, 0) >= 0) {
             errno = EPERM;
             fail("file capabilities on workers are unsupported");
         }
@@ -228,7 +260,8 @@ int main(int argc, char **argv)
         fail("close inherited descriptors");
     if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
         fail("no_new_privs");
-    restrict_files(probe ? NULL : argv[3], probe ? NULL : argv[4]);
+    if (!bubblewrap)
+        restrict_files(probe ? NULL : argv[3], probe ? NULL : worker_argv[0], probe);
     restrict_syscalls();
     if (probe) {
         if (open("/etc/passwd", O_RDONLY) >= 0 || errno != EACCES ||
@@ -238,6 +271,6 @@ int main(int argc, char **argv)
         }
         return 0;
     }
-    execve(argv[4], &argv[4], environ);
+    execve(worker_argv[0], worker_argv, environ);
     fail("execve worker");
 }

package/scripts/runkit-contract/peer-recovery.mjs

@@ -10,6 +10,9 @@ import path from "node:path";
 
 import { RUNTIME_ROOT, currentCoreIdentity } from "./core-contract.mjs";
 import { linuxRuntimeHelper } from "./linux-runtime.mjs";
+import {
+  BUBBLEWRAP_PEER_BACKEND, bubblewrapPeerArgs, probeBubblewrapPeer, spawnBubblewrapPeer,
+} from "./peer-linux-bwrap.mjs";
 import { safeIdentifier } from "./provenance-common.mjs";
 import { resolveVerificationEnvelopeBackendV1 } from "./verification-envelope.mjs";
 
@@ -208,7 +211,14 @@ export function resolvePeerRecoveryBackend() {
         return { available: true, id: "linux_landlock_seccomp_v1", executable,
           digest: digest(regularBytes(executable, CHECKPOINT_LIMIT)) };
       }
-      return { available: false, reason: result.stderr?.trim() || result.error?.code };
+      const reason = result.stderr?.trim() || result.error?.code;
+      if (result.status !== 77) return { available: false, reason };
+      const fallback = probeBubblewrapPeer(executable);
+      if (!fallback.available) {
+        return { available: false, reason: [reason, fallback.reason].filter(Boolean).join("; ") };
+      }
+      const helperHash = digest(regularBytes(executable, CHECKPOINT_LIMIT));
+      return { ...fallback, digest: digest(JSON.stringify([helperHash, fallback.sandboxDigest])) };
     } catch (error) { return { available: false, reason: error.code }; }
   }
   return resolveVerificationEnvelopeBackendV1();
@@ -409,7 +419,8 @@ export async function runPeerTask({ workspaceRoot, taskId, agent, generation, co
   const directory = mkdtempSync(path.join(realpathSync(tmpdir()), "owlrunkit-peer-"));
   materialize(checkpoint(task, state).files, directory);
   const attempt = { id, directory, backend: backend.id,
-    ...(backend.digest ? { backendSha256: backend.digest } : {}) };
+    ...(backend.digest ? { backendSha256: backend.digest } : {}),
+    ...(backend.trust ? { backendTrust: backend.trust } : {}) };
   const claimed = append(task, state, {
     attempt, phase: "running", processExit: null, event: "peer_attempt_started",
   });
@@ -420,17 +431,39 @@ export async function runPeerTask({ workspaceRoot, taskId, agent, generation, co
   }
 
   return new Promise((resolve, reject) => {
-    const args = backend.id === "linux_landlock_seccomp_v1"
-      ? ["run", String(process.pid), directory]
-      : ["-p", sandboxPolicy(executable, directory)];
-    const child = spawn(backend.executable, [...args, executable, ...command.slice(1)], {
-      cwd: directory, env: {
-        PATH: "/usr/bin:/bin", TMPDIR: directory, OWLRUNKIT_PEER_ATTEMPT: id,
-        OWLRUNKIT_PEER_PATHS: JSON.stringify(state.paths),
-        // An isolated worker cannot read host OpenSSL configuration.
-        ...(backend.id === "linux_landlock_seccomp_v1" ? { OPENSSL_CONF: "/dev/null" } : {}),
-      }, stdio: ["pipe", "pipe", "pipe"],
-    });
+    const environment = {
+      PATH: "/usr/bin:/bin", TMPDIR: directory, OWLRUNKIT_PEER_ATTEMPT: id,
+      OWLRUNKIT_PEER_PATHS: JSON.stringify(state.paths),
+    };
+    let args;
+    let env = environment;
+    if (backend.id === BUBBLEWRAP_PEER_BACKEND) {
+      args = bubblewrapPeerArgs({
+        helper: backend.helper, directory, worker: executable,
+        args: command.slice(1), environment,
+      });
+      env = {};
+    } else if (backend.id === "linux_landlock_seccomp_v1") {
+      args = ["run", String(process.pid), directory, executable, ...command.slice(1)];
+      // An isolated worker cannot read host OpenSSL configuration.
+      env.OPENSSL_CONF = "/dev/null";
+    } else {
+      args = ["-p", sandboxPolicy(executable, directory), executable, ...command.slice(1)];
+    }
+    const options = {
+      cwd: directory, env, stdio: ["pipe", "pipe", "pipe"],
+    };
+    let child;
+    try {
+      child = backend.id === BUBBLEWRAP_PEER_BACKEND
+        ? spawnBubblewrapPeer(backend, args, options)
+        : spawn(backend.executable, args, options);
+    } catch (error) {
+      try {
+        resolve(reportExit(task, id, { code: null, signal: null, protocolError: error.message, diagnostic: null }));
+      } catch (reportError) { reject(reportError); }
+      return;
+    }
     let watcher, pending = Buffer.alloc(0), sentWake, protocolError = null;
     let diagnostic = Buffer.alloc(0);
     const stop = error => {

package/scripts/runkit-contract/project-cli-resolver.mjs

@@ -28,10 +28,18 @@ const SELF_NORMALIZED_QUICK_CORE_VERSIONS = new Set([
   "0.24.1",
   "0.25.0",
   "0.25.1",
+  "0.25.2",
+  "0.25.3",
 ]);
 const EXACT_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/;
 const SHA256_REF = /^sha256:[a-f0-9]{64}$/;
 const TRUSTED_PRIOR_CORE_IDENTITIES = new Map([
+  ["0.25.2", new Set([
+    "sha256:da816d343597b91c30e4f96c0a3d765bf5c00d6013d6bee430f58bc701399acc",
+  ])],
+  ["0.25.1", new Set([
+    "sha256:0934a076b147847a4623bc89263b677c88088b493495fc74f11485985b7903b5",
+  ])],
   ["0.25.0", new Set([
     "sha256:20e75c386f1408f11e908a6d3ee1a39316d9728d5719fa06f8d6a5aa45abd83e",
   ])],