[vanedaltro]

Superseded by the consolidated draft #76 against main, following the user-requested limit on open goal PRs. This PR head is contained in the published #76 branch; its commits, source branch and verification evidence are retained. Closed as superseded, not merged.

Compose the Linux native helper's Landlock profile and bubblewrap arguments in Rust, using the protected mount behavior verified in #73. The builder keeps workspace reads/writes independent, anchors protected ancestors, binds immutable resources read-only, masks private directories/files, and retains writable scratch. It uses private namespaces and an explicit mandatory shell flag; no ordinary command or production App launch changes here.

Private procfs is created explicitly. Host /proc and /dev bootstrap binds are refused; the optional private-procfs read grant masks init/sys. Inputs, helper target frames, generated arguments and profile bytes are bounded. Composition performs no filesystem IO or executable discovery.

Actual-helper regressions pass on Linux x64/arm64 at 546641f (run 40954544764):

• All eight read/write/shell combinations, constructor-time policy, threads, child inheritance, JSON-RPC tool receipts and private file/directory/alias checks.
• Protected parent/grandparent renames and package writes, with positive sibling writes/public renames.
• Private procfs and /proc/self/root aliases under both workspace read settings.
• Six missing-safeguard controls with precise named assertion failures and restored positive suites.

Local macOS checks pass: 10 policy unit tests (including the pure Linux backend), eight existing packaged macOS entry tests, Sandbox all-target Clippy with Rust warnings denied, syntax-only compilation of both C fixtures, formatting, workflow YAML/seven Bash blocks, provenance-script syntax, diff checks, 107 strict OpenSpec items and spec lint (zero errors, 25 warnings). The C compiler reports two deprecated Seatbelt SDK calls. Hosted Linux x64/arm64 jobs pass seven policy unit tests and eight native entry tests, including all three new regressions. All six source-mutation controls fail their precise assertions, followed by passing restored suites. Retained provenance independently matches the exact test-merge source hash; helper hashes are job-reported because binaries were not retained. See the implementation notes and committed evidence for exact checkout and job identifiers. The evidence-only follow-up does not change the tested implementation.

This is a production library component, not native host activation or an execution permit. Canonical immutable resource/ancestor admission, complete aliases/configuration/trust ceilings, generation-bound start and child settlement remain caller obligations. The private IP namespace is not certification of pathname UNIX-socket/host-IPC, proxy or secret isolation; those intersections remain required before activation. The helper ABI floor and explicit support/design gates are unchanged. No parent capability requirement is closed.

Stacked on #73. Scope/review: openspec/changes/complete-plugin-hook-runtime/linux-policy-composition.md. Do not merge automatically.