owlrunkit 0.25.2 → 0.25.3

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.25.3
+
+- Accepts Bubblewrap on a verified read-only Linux system mount when the
+  platform remaps root and the system file owners appear as overflow UIDs.
+  RunKit runs the checked executable by descriptor and rechecks its identity
+  before starting each worker.
+- Ships the Linux helper build script and checksums with the npm package and
+  links to the exact corresponding public source tag from `SOURCE.md`.
+
 ## 0.25.2
 
 - Supports managed Linux worker recovery with system Bubblewrap when Landlock

package/LINUX-HELPERS.sha256

@@ -0,0 +1,2 @@
+39e177cebac50c87514e19df991266970a5814eb468ec716250d6e731a73a40d  peer-linux-x64
+ad5ecf24f6c13233edb43c8ce0b8aa91b15134e710252ae6e82de39630d67e0e  peer-linux-arm64

package/README.md

@@ -136,7 +136,7 @@ separate authority boundaries.
 
 ## Install
 
-This package is the lifecycle-stable, registry-gated `owlrunkit@0.25.2`
+This package is the lifecycle-stable, registry-gated `owlrunkit@0.25.3`
 artifact. Registry adoption remains fail-closed until its exact official npm
 version, shasum, integrity, and tarball URL are independently verified. Local
 tarballs remain candidate-test inputs and are never adoption provenance. Until
@@ -144,7 +144,7 @@ that registry evidence exists, use the package only for isolated candidate
 verification; do not treat the command below as available release truth.
 
 ```bash
-npm install --save-exact owlrunkit@0.25.2
+npm install --save-exact owlrunkit@0.25.3
 ```
 
 Use `npx --no-install owlrunkit` for project commands. The package bootstrap
@@ -160,9 +160,9 @@ the project Config must independently bind the same Core.
 ```bash
 npx --no-install owlrunkit --version
 npx --no-install owlrunkit bootstrap --workspace /absolute/path/to/project \
-  --exact owlrunkit@0.25.2 --dry-run
+  --exact owlrunkit@0.25.3 --dry-run
 npx --no-install owlrunkit bootstrap --workspace /absolute/path/to/project \
-  --exact owlrunkit@0.25.2 --apply
+  --exact owlrunkit@0.25.3 --apply
 npx --no-install owlrunkit init --workspace /absolute/path/to/project
 npx --no-install owlrunkit doctor --workspace /absolute/path/to/project
 npx --no-install owlrunkit inspect --workspace /absolute/path/to/project --json --compact
@@ -1045,6 +1045,9 @@ first. If Landlock is unavailable, it can use a trusted system Bubblewrap
 executable with user and mount namespaces. The Bubblewrap probe verifies
 that the attempt is writable, host files are hidden, and new processes and
 network sockets are denied. If the probe fails, the task stays blocked.
+On Linux environments that remap root, RunKit can trust `/usr/bin/bwrap` on
+a dedicated read-only `/usr` system mount after verifying its mount identity
+and checking for writable aliases. It launches the verified file descriptor.
 On Linux, the worker is terminated if its supervisor is killed. The host
 caller supplies the worker command and peer identity. Existing Desktop sessions and writers using
 legacy shared-directory leases follow their own recovery procedure. An

package/SOURCE.md

@@ -1,12 +1,26 @@
-# Source
-
-OwlRunKit is maintained in the private OwlCoda source repository. The npm
-tarball contains the JavaScript runtime, the read-only verifier and the C
-source for the two Linux helper binaries. The distributed binaries link musl
-statically and include its copyright notice. Build the helper on each supported
-Linux architecture with `sh packages/runkit/build-linux-helper.sh <output>`
-in Alpine Linux with `build-base` and `linux-headers`, then pass their output directory to
-`packages/runkit/build-package.mjs --linux-helpers`.
+# Corresponding source
+
+OwlRunKit is distributed under GPL-3.0-or-later. The corresponding public
+source is [OwlRunKit v0.25.3](https://github.com/yeemio/owlrunkit/tree/v0.25.3).
+The npm package includes the JavaScript runtime, read-only verifier, C source,
+and [Linux helper build script](packages/runkit/build-linux-helper.sh).
+The distributed helpers statically link musl and include its copyright notice.
+
+## Rebuild the Linux helpers
+
+From the public tag or unpacked npm package, run the build on Linux x86-64
+and ARM64 using Alpine 3.22 with `build-base` and `linux-headers`.
+
+```sh
+mkdir -p .build
+for platform in linux/arm64 linux/amd64; do
+  docker run --rm --platform "$platform" \
+    -v "$PWD:/source:ro" -v "$PWD/.build:/out" \
+    alpine:3.22@sha256:49340b346798875b5592e5d420241f2f9cfba5f47e62ebb1446a1b34734e898f \
+    sh -ec 'apk add --no-cache build-base linux-headers; sh /source/packages/runkit/build-linux-helper.sh /out'
+done
+(cd .build && sha256sum -c ../LINUX-HELPERS.sha256)
+```
 
 The authoritative release is identified by the npm registry version, shasum,
 integrity, and tarball URL. Local directories, `file:` dependencies, local

package/integrations/codex/skills/owlcoda-runkit/SKILL.md

@@ -7,14 +7,14 @@ description: Run receipt-backed, project-owned work with OwlCoda RunKit. Use whe
 
 Use the bundled deterministic Core to coordinate work through project artifacts rather than chat memory. Require Node.js 20 or later.
 
-Bundled registry-gated artifact: standalone `owlrunkit@0.25.2`, bundling Contract
-`0.2` and Core `0.25.2` with manifest
-`sha256:da816d343597b91c30e4f96c0a3d765bf5c00d6013d6bee430f58bc701399acc`.
+Bundled registry-gated artifact: standalone `owlrunkit@0.25.3`, bundling Contract
+`0.2` and Core `0.25.3` with manifest
+`sha256:901f3b5da227555a1a6b65f9deb4efa71f8f3bf9c3f9a34b1a30034da8779d66`.
 Registry adoption remains fail-closed until exact official npm registry
-provenance for `owlrunkit@0.25.2` is independently verified. The
-published rollback baseline for this artifact is `owlrunkit@0.25.1`, with SHA-1
-`755bdcef5f6df55977ee64d2d4391d1098c00168` and canonical npm tarball URL
-`https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.25.1.tgz`.
+provenance for `owlrunkit@0.25.3` is independently verified. The
+published rollback baseline for this artifact is `owlrunkit@0.25.2`, with SHA-1
+`0b4bc23778549cdd3537f2e78d55302b34237ded` and canonical npm tarball URL
+`https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.25.2.tgz`.
 The root `owlcoda` package has a separate version lifecycle.
 
 The session is an execution interface. Project artifacts are the system of record.
@@ -370,9 +370,9 @@ below has no CLI entry.
 
 ```bash
 npx --no-install owlrunkit bootstrap --workspace "$PROJECT_ROOT" \
-  --exact owlrunkit@0.25.2 --dry-run
+  --exact owlrunkit@0.25.3 --dry-run
 npx --no-install owlrunkit bootstrap --workspace "$PROJECT_ROOT" \
-  --exact owlrunkit@0.25.2 --apply
+  --exact owlrunkit@0.25.3 --apply
 npx --no-install owlrunkit init --workspace "$PROJECT_ROOT"
 npx --no-install owlrunkit inspect --json --workspace "$PROJECT_ROOT"
 npx --no-install owlrunkit inspect --json --compact --workspace "$PROJECT_ROOT"

package/integrations/codex/skills/owlcoda-runkit/assets/templates/config.json

@@ -2,9 +2,9 @@
   "schemaVersion": "OwlCodaRunKitConfigV2",
   "core": {
     "contractVersion": "0.2",
-    "coreVersion": "0.25.2",
-    "coreManifestSha256": "sha256:da816d343597b91c30e4f96c0a3d765bf5c00d6013d6bee430f58bc701399acc",
-    "coreSourceRef": "artifact:sha256:da816d343597b91c30e4f96c0a3d765bf5c00d6013d6bee430f58bc701399acc"
+    "coreVersion": "0.25.3",
+    "coreManifestSha256": "sha256:901f3b5da227555a1a6b65f9deb4efa71f8f3bf9c3f9a34b1a30034da8779d66",
+    "coreSourceRef": "artifact:sha256:901f3b5da227555a1a6b65f9deb4efa71f8f3bf9c3f9a34b1a30034da8779d66"
   },
   "authorizationPolicy": "external_explicit_authority_required"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "owlrunkit",
-  "version": "0.25.2",
+  "version": "0.25.3",
   "description": "Project Driver for cross-Agent project continuity and progression; execution, evidence, verification, and recovery are the underlying trust substrate.",
   "license": "GPL-3.0-or-later",
   "author": "yeemio <owlclaw@163.com>",

package/packages/attest/distribution-manifest-v1.json

@@ -42,6 +42,11 @@
     "sha256": "sha256:3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986"
   },
   "supportedProducerCoreIdentities": [
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.25.3",
+      "coreManifestSha256": "sha256:901f3b5da227555a1a6b65f9deb4efa71f8f3bf9c3f9a34b1a30034da8779d66"
+    },
     {
       "contractVersion": "0.2",
       "coreVersion": "0.25.2",

package/packages/attest/src/quick.mjs

@@ -23,6 +23,11 @@ import {
 export { validQuickReceiptShape } from "./quick-receipt-contract.mjs";
 
 export const SUPPORTED_QUICK_CORE_IDENTITIES = Object.freeze([
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.25.3",
+    coreManifestSha256: "sha256:901f3b5da227555a1a6b65f9deb4efa71f8f3bf9c3f9a34b1a30034da8779d66",
+  },
   {
     contractVersion: "0.2",
     coreVersion: "0.25.2",

package/packages/runkit/build-linux-helper.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+set -eu
+
+case "$(uname -s)/$(uname -m)" in
+    Linux/x86_64) arch=x64 ;;
+    Linux/aarch64) arch=arm64 ;;
+    *) echo "Build the peer helper on Linux x86_64 or aarch64." >&2; exit 1 ;;
+esac
+
+if [ "$#" -ne 1 ] || [ ! -d "$1" ]; then
+    echo "Usage: sh build-linux-helper.sh <existing output directory>" >&2
+    exit 1
+fi
+
+source_dir=$(CDPATH= cd -- "$(dirname -- "$0")/../../scripts/runkit-contract" && pwd)
+"${CC:-cc}" -std=c11 -O2 -Wall -Wextra -Werror -static -s \
+    "$source_dir/peer-linux.c" -o "$1/peer-linux-$arch"

package/registry-release-policy-v2.json

@@ -2,7 +2,7 @@
   "schemaVersion": "OwlCodaRunKitRegistryReleasePolicyV2",
   "status": "release_artifact_registry_gated",
   "packageName": "owlrunkit",
-  "artifactVersion": "0.25.2",
+  "artifactVersion": "0.25.3",
   "registry": "https://registry.npmjs.org",
   "registryRequiredBeforeAdoption": true,
   "exactVersionRequired": true,
@@ -23,10 +23,10 @@
   ],
   "rollbackRelease": {
     "packageName": "owlrunkit",
-    "version": "0.25.1",
-    "shasum": "755bdcef5f6df55977ee64d2d4391d1098c00168",
-    "integrity": "sha512-+s+PHZXemJIgBo8ScT65+OngqniojRFMxpoUOTjp/Xkq/szB8FqEUOH1BFlokMz6dx64FSOKb30rDPZWC2lS4w==",
-    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.25.1.tgz"
+    "version": "0.25.2",
+    "shasum": "0b4bc23778549cdd3537f2e78d55302b34237ded",
+    "integrity": "sha512-a7EJwkR/3o0Pjuz2dxEKkbB6n7WowLloKtYuuyjfXGfZM3D6/IVphdRLBv7oh/lJPk511e/i0XGUfFxt+OhXzA==",
+    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.25.2.tgz"
   },
   "registryEvidenceMustBeExternal": true,
   "registryEvidenceSchemaVersion": "OwlCodaRunKitRegistryReleaseEvidenceV1",

package/sbom.spdx.json

@@ -2,8 +2,8 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "owlrunkit-0.25.2",
-  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.25.2",
+  "name": "owlrunkit-0.25.3",
+  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.25.3",
   "creationInfo": {
     "created": "2026-11-11T00:00:00Z",
     "creators": [
@@ -14,7 +14,7 @@
     {
       "name": "owlrunkit",
       "SPDXID": "SPDXRef-Package-OwlRunKit",
-      "versionInfo": "0.25.2",
+      "versionInfo": "0.25.3",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "GPL-3.0-or-later",
@@ -24,7 +24,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/owlrunkit@0.25.2"
+          "referenceLocator": "pkg:npm/owlrunkit@0.25.3"
         }
       ]
     }

package/scripts/runkit-contract/core-contract.mjs

@@ -14,7 +14,7 @@ import { fileURLToPath } from "node:url";
 import { parseProjectControlState } from "./project-control-parser.mjs";
 
 export const CONTRACT_VERSION = "0.2";
-export const CORE_VERSION = "0.25.2";
+export const CORE_VERSION = "0.25.3";
 export const RUNTIME_ROOT = ".owlcoda/runkit";
 
 const CORE_FILES = [

package/scripts/runkit-contract/peer-linux-bwrap.mjs

@@ -1,6 +1,8 @@
-import { spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import {
-  accessSync, constants, lstatSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync,
+  accessSync, closeSync, constants, fstatSync, lstatSync, mkdtempSync, openSync,
+  readFileSync, realpathSync, rmSync, statfsSync, writeFileSync,
 } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
@@ -10,29 +12,119 @@ export const BUBBLEWRAP_PEER_BACKEND = "linux_bubblewrap_seccomp_v1";
 const SANDBOX_HELPER = "/owlrunkit-helper";
 const SANDBOX_WORKER = "/owlrunkit-worker";
 const WORK = "/work";
+const SYSTEM_BWRAP = "/usr/bin/bwrap";
+const FD_EXECUTABLE = "/proc/self/fd/3";
+const OVERFLOW_UID = 65534;
+const PROC_SUPER_MAGIC = 0x9fa0;
+const CAP_SYS_ADMIN = 1n << 21n;
+const MAX_EXECUTABLE_BYTES = 1024 * 1024;
 
-function trustedBubblewrap() {
+function rootOwnedPath(file, stat) {
+  if (stat.uid !== 0) return false;
+  let parent = path.dirname(file);
+  for (;;) {
+    const entry = lstatSync(parent);
+    if (!entry.isDirectory() || entry.uid !== 0 || (entry.mode & 0o022)) return false;
+    const next = path.dirname(parent);
+    if (parent === next) return true;
+    parent = next;
+  }
+}
+
+export function readOnlySystemBubblewrapIssue({ uid, uidMap, root, systemDirectories, mountId, mountInfo }) {
+  if (uid === 0 || uid === OVERFLOW_UID || uidMap.trim().split(/\s+/u).join(" ") !== `${uid} 0 1`) {
+    return "the caller is not the single mapped parent root UID";
+  }
+  if (!root.isDirectory() || root.uid !== uid || (root.mode & 0o022)
+    || !systemDirectories.every(entry =>
+      entry.isDirectory() && entry.uid === OVERFLOW_UID && !(entry.mode & 0o022))) {
+    return "the system directories do not match the remapped ownership boundary";
+  }
+
+  const mounts = mountInfo.trim().split("\n").map(line => {
+    const [description, filesystem] = line.split(" - ");
+    const [id, , device, , target, flags] = description.split(" ");
+    return { id, device, target, flags: flags?.split(",") ?? [], type: filesystem?.split(" ")[0] };
+  });
+  const system = mounts.find(mount => mount.id === mountId);
+  if (system?.target !== "/usr" || system.type !== "overlay"
+    || !["ro", "nosuid", "nodev"].every(flag => system.flags.includes(flag))) {
+    return "the opened executable is not on the protected read-only /usr mount";
+  }
+  if (mounts.some(mount => mount.device === system.device && mount.flags.includes("rw"))) {
+    return "the /usr mount has a writable alias";
+  }
+  return null;
+}
+
+function readOnlySystemPathIssue(file, stat, fd) {
+  if (file !== SYSTEM_BWRAP || stat.uid !== OVERFLOW_UID || process.getuid() !== process.geteuid()) {
+    return "the executable is outside the remapped system path";
+  }
+  if (statfsSync("/proc/self").type !== PROC_SUPER_MAGIC) return "the kernel mount information is unavailable";
+  const capabilities = /^CapPrm:\s*([0-9a-f]+)$/imu.exec(readFileSync("/proc/self/status", "utf8"))?.[1];
+  if (!capabilities || (BigInt(`0x${capabilities}`) & CAP_SYS_ADMIN)) {
+    return "the caller can reconfigure its system mounts or that capability could not be checked";
+  }
+  const mountId = /^mnt_id:\s*(\d+)$/mu.exec(readFileSync(`/proc/self/fdinfo/${fd}`, "utf8"))?.[1];
+  if (!mountId) return "the kernel did not identify the executable mount";
+  return readOnlySystemBubblewrapIssue({
+    uid: process.geteuid(),
+    uidMap: readFileSync("/proc/self/uid_map", "utf8"),
+    root: lstatSync("/"),
+    systemDirectories: [lstatSync("/usr"), lstatSync("/usr/bin")],
+    mountId,
+    mountInfo: readFileSync("/proc/self/mountinfo", "utf8"),
+  });
+}
+
+function openTrustedBubblewrap(expected) {
   const directories = ["/usr/bin", "/bin", "/usr/local/bin", ...(process.env.PATH ?? "").split(":")];
-  for (const directory of new Set(directories)) {
-    if (!path.isAbsolute(directory)) continue;
+  const candidates = expected ? [expected.executable]
+    : [...new Set(directories)].filter(path.isAbsolute).map(dir => path.join(dir, "bwrap"));
+  let systemRejection;
+  for (const candidate of candidates) {
+    let fd;
+    let trusted = false;
     try {
-      const file = realpathSync(path.join(directory, "bwrap"));
-      const stat = lstatSync(file);
-      if (!stat.isFile() || stat.uid !== 0 || (stat.mode & 0o6022)) continue;
-      accessSync(file, constants.X_OK);
-      let parent = path.dirname(file);
-      for (;;) {
-        const entry = lstatSync(parent);
-        if (!entry.isDirectory() || entry.uid !== 0 || (entry.mode & 0o022)) break;
-        const next = path.dirname(parent);
-        if (parent === next) return file;
-        parent = next;
+      const executable = realpathSync(candidate);
+      if (expected && executable !== expected.executable) continue;
+      accessSync(executable, constants.X_OK);
+      fd = openSync(executable, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+      const stat = fstatSync(fd);
+      if (!stat.isFile() || (stat.mode & 0o6022) || stat.size > MAX_EXECUTABLE_BYTES) continue;
+      let trust = "root_owned";
+      if (!rootOwnedPath(executable, stat)) {
+        const issue = readOnlySystemPathIssue(executable, stat, fd);
+        if (issue) {
+          if (executable === SYSTEM_BWRAP) systemRejection = issue;
+          continue;
+        }
+        trust = "read_only_system_mount";
       }
+      const sandboxDigest = `sha256:${createHash("sha256").update(readFileSync(fd)).digest("hex")}`;
+      if (expected && (expected.sandboxDigest !== sandboxDigest || expected.trust !== trust)) continue;
+      trusted = true;
+      return { executable, fd, sandboxDigest, trust };
     } catch (error) {
-      if (!["ENOENT", "EACCES", "ENOTDIR"].includes(error.code)) throw error;
+      if (!["ENOENT", "EACCES", "ENOTDIR", "ELOOP"].includes(error.code)) throw error;
+    } finally {
+      if (fd !== undefined && !trusted) closeSync(fd);
     }
   }
-  return null;
+  return { reason: ["trusted system Bubblewrap not found", systemRejection].filter(Boolean).join(": ") };
+}
+
+export function spawnBubblewrapPeer(backend, args, options) {
+  const launcher = openTrustedBubblewrap(backend);
+  if (launcher.fd === undefined) {
+    throw new Error(`Bubblewrap executable or trust changed after its self-test: ${launcher.reason}`);
+  }
+  try {
+    return spawn(FD_EXECUTABLE, args, { ...options, stdio: [...options.stdio, launcher.fd] });
+  } finally {
+    closeSync(launcher.fd);
+  }
 }
 
 export function bubblewrapPeerArgs({ helper, directory, worker, args, environment }) {
@@ -75,21 +167,22 @@ const probeWorker = `
 `;
 
 export function probeBubblewrapPeer(helper) {
-  const executable = trustedBubblewrap();
-  if (!executable) return { available: false, reason: "trusted system Bubblewrap not found" };
   const directory = mkdtempSync(path.join(realpathSync(tmpdir()), "owlrunkit-bwrap-probe-"));
+  let launcher;
   try {
+    launcher = openTrustedBubblewrap();
+    if (launcher.fd === undefined) return { available: false, reason: launcher.reason };
     const outside = path.join(directory, "outside");
     const work = path.join(directory, "work");
     writeFileSync(outside, "outside", { flag: "wx", mode: 0o600 });
     // Keep the sentinel outside the only writable bind.
     const scratch = mkdtempSync(work);
     writeFileSync(path.join(scratch, "probe-input"), "from host", { flag: "wx", mode: 0o600 });
-    const result = spawnSync(executable, bubblewrapPeerArgs({
+    const result = spawnSync(FD_EXECUTABLE, bubblewrapPeerArgs({
       helper, directory: scratch, worker: realpathSync(process.execPath),
       args: ["-e", probeWorker, outside], environment: {},
     }), {
-      cwd: scratch, env: {}, stdio: ["ignore", "ignore", "pipe"],
+      cwd: scratch, env: {}, stdio: ["ignore", "ignore", "pipe", launcher.fd],
       encoding: "utf8", timeout: 5000, maxBuffer: 65536,
     });
     if (result.status !== 0) {
@@ -100,10 +193,12 @@ export function probeBubblewrapPeer(helper) {
     if (readFileSync(confirmation, "utf8") !== "confined") {
       return { available: false, reason: "Bubblewrap self-test did not confirm enforcement" };
     }
-    return { available: true, id: BUBBLEWRAP_PEER_BACKEND, executable, helper };
+    const { executable, sandboxDigest, trust } = launcher;
+    return { available: true, id: BUBBLEWRAP_PEER_BACKEND, executable, sandboxDigest, trust, helper };
   } catch (error) {
     return { available: false, reason: `Bubblewrap self-test failed: ${error.code ?? error.message}` };
   } finally {
+    if (launcher?.fd !== undefined) closeSync(launcher.fd);
     rmSync(directory, { recursive: true, force: true });
   }
 }

package/scripts/runkit-contract/peer-recovery.mjs

@@ -10,7 +10,9 @@ import path from "node:path";
 
 import { RUNTIME_ROOT, currentCoreIdentity } from "./core-contract.mjs";
 import { linuxRuntimeHelper } from "./linux-runtime.mjs";
-import { BUBBLEWRAP_PEER_BACKEND, bubblewrapPeerArgs, probeBubblewrapPeer } from "./peer-linux-bwrap.mjs";
+import {
+  BUBBLEWRAP_PEER_BACKEND, bubblewrapPeerArgs, probeBubblewrapPeer, spawnBubblewrapPeer,
+} from "./peer-linux-bwrap.mjs";
 import { safeIdentifier } from "./provenance-common.mjs";
 import { resolveVerificationEnvelopeBackendV1 } from "./verification-envelope.mjs";
 
@@ -216,8 +218,7 @@ export function resolvePeerRecoveryBackend() {
         return { available: false, reason: [reason, fallback.reason].filter(Boolean).join("; ") };
       }
       const helperHash = digest(regularBytes(executable, CHECKPOINT_LIMIT));
-      const sandboxHash = digest(regularBytes(fallback.executable, CHECKPOINT_LIMIT));
-      return { ...fallback, digest: digest(JSON.stringify([helperHash, sandboxHash])) };
+      return { ...fallback, digest: digest(JSON.stringify([helperHash, fallback.sandboxDigest])) };
     } catch (error) { return { available: false, reason: error.code }; }
   }
   return resolveVerificationEnvelopeBackendV1();
@@ -418,7 +419,8 @@ export async function runPeerTask({ workspaceRoot, taskId, agent, generation, co
   const directory = mkdtempSync(path.join(realpathSync(tmpdir()), "owlrunkit-peer-"));
   materialize(checkpoint(task, state).files, directory);
   const attempt = { id, directory, backend: backend.id,
-    ...(backend.digest ? { backendSha256: backend.digest } : {}) };
+    ...(backend.digest ? { backendSha256: backend.digest } : {}),
+    ...(backend.trust ? { backendTrust: backend.trust } : {}) };
   const claimed = append(task, state, {
     attempt, phase: "running", processExit: null, event: "peer_attempt_started",
   });
@@ -448,9 +450,20 @@ export async function runPeerTask({ workspaceRoot, taskId, agent, generation, co
     } else {
       args = ["-p", sandboxPolicy(executable, directory), executable, ...command.slice(1)];
     }
-    const child = spawn(backend.executable, args, {
+    const options = {
       cwd: directory, env, stdio: ["pipe", "pipe", "pipe"],
-    });
+    };
+    let child;
+    try {
+      child = backend.id === BUBBLEWRAP_PEER_BACKEND
+        ? spawnBubblewrapPeer(backend, args, options)
+        : spawn(backend.executable, args, options);
+    } catch (error) {
+      try {
+        resolve(reportExit(task, id, { code: null, signal: null, protocolError: error.message, diagnostic: null }));
+      } catch (reportError) { reject(reportError); }
+      return;
+    }
     let watcher, pending = Buffer.alloc(0), sentWake, protocolError = null;
     let diagnostic = Buffer.alloc(0);
     const stop = error => {

package/scripts/runkit-contract/project-cli-resolver.mjs

@@ -29,10 +29,14 @@ const SELF_NORMALIZED_QUICK_CORE_VERSIONS = new Set([
   "0.25.0",
   "0.25.1",
   "0.25.2",
+  "0.25.3",
 ]);
 const EXACT_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/;
 const SHA256_REF = /^sha256:[a-f0-9]{64}$/;
 const TRUSTED_PRIOR_CORE_IDENTITIES = new Map([
+  ["0.25.2", new Set([
+    "sha256:da816d343597b91c30e4f96c0a3d765bf5c00d6013d6bee430f58bc701399acc",
+  ])],
   ["0.25.1", new Set([
     "sha256:0934a076b147847a4623bc89263b677c88088b493495fc74f11485985b7903b5",
   ])],