[andersalm]

Runtime confines macOS model file access to admitted payloads, the pinned engine bundle, operator artifacts, the private journal and Runtime-owned sockets. Runtime owns descriptor verification and serialized Init authority. This protects other Home files while admission uses the existing provider process.

The candidate preserves all ten task paths from the accepted independent security review. It includes the independently reviewed #154 matcher as a dependency. PR #155 needs human approval and integration before this PR merges into develop.

Validation: the four basic gates pass. Accepted focused checks cover bridge and broker tests, child and descendant restrictions, socket lifecycle, late admission, outside symlinks, artifact writes and network ownership. All eight checks pass at 6f19912 in CI run 36801365883.

The exact installed candidate passes signed-in Home → visible Marketplace Get → Available → Open in Assistant → composer Send → readable SmolLM2 reply. The native completed journal binds the run to Assistant and the admitted offer. Built and installed Runtime SHA-256 is f946cc102dad1943772bb4a3a13a70e6db34a64f8bc402668a3dde16e69bddaf. Home, Marketplace and Assistant served files match source and installed hashes.

Cold readiness passes through the Runtime-issued signed Marketplace capsule. The offer, descriptor bytes, mtime and ctime remain unchanged. The earlier cold helper stopped at a hidden-window visibility precondition; that partial UI result is retained separately from the successful cold Runtime read. Automated reply media was inspected; human review and UX acceptance remain separate gates. All owned fixture processes stopped and the port is reusable. #141 owns exact receipts and results.

[andersalm]

Independent adversarial review (Claude Opus, run by the operator for Anders, 2 October; different model family from the author).
VERDICT: PASS, with one condition before merge: CI never runs the macOS-gated confinement tests, so run them on a Mac and record the result here (for example cargo test -p elastos-runtime test_confined_model_child_and_descendant_cannot_open_external_socket). This PR also contains #155's code; merge #155 first.
Non-blocking, for #99/#166: the profile still starts from (allow default) except files and outbound network, leaving mach-lookup, signals to same-uid processes and network-bind open; reads cover every admitted payload, not only the selected model.

[andersalm]

Mac condition for the operator’s adversarial PASS is complete at 6f19912ec019d085ec840aedac151c0ff974d988, source tree 359e14ca….
cargo test --release --locked -p elastos-runtime --lib confined -- --test-threads=1 --nocapture passed all four tests on this Apple Silicon Mac: child/descendant external socket refusal, exact text schema, Runtime run binding, and refresh socket ownership. Tests took0.63s after17.52s compilation.
The child/descendant probe exercises allowed files and owned sockets plus refused unrelated files, network and artifact writes. Cleanup is part of the passing test; source files are unchanged.
Dependency #155 merged as 0cba4e67; this closes the review condition before the normal develop merge.