[vanedaltro]

Plugin hosts need safer bootstrap and process ownership before native capability enforcement can be activated. This PR consolidates #70–#75 into a foundations milestone. The production App still uses the legacy sandbox; native capability enforcement and the full implementation goal remain incomplete.

Changes

• Sanitize plugin bootstrap environment and runtime lookup; exclude relative/empty PATH entries, package/Location directories and shims resolving into them.
• Retain process, scratch and proxy ownership through initialization failure and cancellation. Revoke proxy access promptly, await tree settlement, and retain scratch on unconfirmed waits.
• Add generation-bound package preparation, bounded native helpers and policy composers, and private-root inventory foundations. Package-worker wait errors now retain staging and avoid signalling an uncertain cached PID, including automatic child disposal.
• Add isolated Linux/macOS confinement experiments, adversarial controls and source-bound evidence. Experimental broker behavior is not activated in production.

Verification

Local macOS: all 66 sandbox library tests pass, including a real lost-wait regression; sandbox library/test Clippy with warnings denied, formatting and diff checks pass. Strict OpenSpec: 107 passed. Spec lint: zero errors, 25 warnings. The C build emits two deprecated Seatbelt SDK warnings.

Linux capacity run passed on x64/arm64: four capacity/recovery cases per architecture and the precise wrong-cap counterexample, with cancellation, mutation and descendant regressions. Retained receipts remain bound to their actual tested revisions. All CI for the final head must be green before merge.

Follow-up goal

The user authorized this foundations milestone, followed by one implementation PR. Remaining scope stays tracked: production native admission/enforcement and support/design gates, remaining plugin protocol/callback/hook operations, daily coding surfaces, and the full binary hex editor. Passing probes or explicit refusals do not complete these features.

See delivery rules, package preparation, host ownership, and capacity proof.