From 510519727082428ed08262650927272dc14c36b1 Mon Sep 17 00:00:00 2001
From: Omry Yadan <omry@yadan.net>
Date: Sat, 31 Oct 2026 01:35:06 +0800
Subject: [PATCH] E2.3.2: Apply and verify the mapped policy

Mapped creation must carry the exact compiled kernel policy through preparation, inhibited startup and trusted pre-release observation. Add one typed overlay over the existing strict ordinary parser, require independently supplied startup capability equality, and bind the full ABI/capability/policy tuple to the existing sandbox proof. Transmit and verify explicit no-removal/no-restart policy while preserving ordinary request serialization.

Keep public mapped execution inhibited and leave production F observations, effective runtime qualification and final entry-plan construction behind their existing gates. Retain the C1 diagnostic with a real production waiter and a host regression over its generated binding, create stdin and causal EOF.

Validation: fresh independent full review; Python packaging and CI-tool tests; targeted Go vet; all shipping/conformance Go packages; linux-amd64 build and CLI smoke. Retained WSL ordinary-tmpfs exclusion and explicit Docker skip apply; live runtime and exact-head PR CI remain separate gates.
---
 internal/dockerdeploy/mapped_sandbox_proof.go |  15 +-
 .../dockerdeploy/podman_application_create.go |   1 +
 internal/dockerdeploy/podman_mapped_policy.go | 157 +++++
 .../dockerdeploy/podman_mapped_policy_test.go | 590 ++++++++++++++++++
 internal/dockerdeploy/podman_mapped_waiter.go |  83 ++-
 .../dockerdeploy/podman_mapped_waiter_test.go |  21 +-
 .../dockerdeploy/podman_mapping_create.go     |  19 +-
 .../podman_mapping_integration_test.go        | 156 ++++-
 internal/probe/mapped_exec.go                 |  13 +
 9 files changed, 1021 insertions(+), 34 deletions(-)
 create mode 100644 internal/dockerdeploy/podman_mapped_policy.go
 create mode 100644 internal/dockerdeploy/podman_mapped_policy_test.go

diff --git a/internal/dockerdeploy/mapped_sandbox_proof.go b/internal/dockerdeploy/mapped_sandbox_proof.go
index c61cd7eb..13e96550 100644
--- a/internal/dockerdeploy/mapped_sandbox_proof.go
+++ b/internal/dockerdeploy/mapped_sandbox_proof.go
@@ -30,6 +30,8 @@ type mappedSandboxRequestV1 struct {
 	RuntimePolicy canonical.Digest     `json:"runtime_policy"`
 	NetworkPolicy canonical.Digest     `json:"network_policy"`
 	RequiredCode  []string             `json:"required_code"`
+	KernelPolicy  canonical.Digest     `json:"kernel_policy"`
+	KernelFacts   mappedKernelFactsV1  `json:"kernel_facts"`
 }
 
 type mappedCodePathV1 struct {
@@ -44,6 +46,8 @@ type mappedSandboxProofV1 struct {
 	Request       canonical.Digest
 	NetworkPolicy canonical.Digest
 	ReadOnlyRoot  bool
+	KernelPolicy  canonical.Digest
+	KernelFacts   mappedKernelFactsV1
 	// Code is F's complete closure from the pinned image, including loaders,
 	// interpreters and dependency search paths. ObservedCode is its live view.
 	Code, ObservedCode []mappedCodePathV1
@@ -66,7 +70,8 @@ func (a *ownedMappedWaiterV1) sandboxRequest() (mappedSandboxRequestV1, error) {
 		lock.FinalImage.RootFSSubject != p.state.Current.RootFSSubject {
 		return mappedSandboxRequestV1{}, fmt.Errorf("mapped sandbox generation or image changed")
 	}
-	body, _, err := podmanApplicationCreateRequest(p.spec, p.namespace)
+	create, err := p.request()
+	body := create.body
 	separator := slices.Index(body.Cmd, "--")
 	if err != nil || separator < 0 || separator+1 >= len(body.Cmd) || !mappedCodeAbsoluteV1(body.Cmd[separator+1]) {
 		return mappedSandboxRequestV1{}, fmt.Errorf("mapped sandbox executable is unavailable")
@@ -78,7 +83,9 @@ func (a *ownedMappedWaiterV1) sandboxRequest() (mappedSandboxRequestV1, error) {
 	slices.Sort(required)
 	// ReadBuildLock already validated the closed string-only network policy.
 	network, _ := canonical.Sum("mapped-network", "v1", lock.RuntimePolicy.Network)
-	return mappedSandboxRequestV1{a.binding, a.container, strconv.Itoa(a.pid), policy, network, slices.Compact(required)}, nil
+	return mappedSandboxRequestV1{Binding: a.binding, Container: a.container, PID: strconv.Itoa(a.pid),
+		RuntimePolicy: policy, NetworkPolicy: network, RequiredCode: slices.Compact(required),
+		KernelPolicy: canonical.Digest(p.policy.identity), KernelFacts: p.policy.facts()}, nil
 }
 
 func verifyMappedSandboxV1(ctx context.Context, state deploy.StateV1, evidence deploy.IdentityMappingEvidenceV1, request mappedSandboxRequestV1) error {
@@ -86,6 +93,9 @@ func verifyMappedSandboxV1(ctx context.Context, state deploy.StateV1, evidence d
 	if !ok || ctx.Err() != nil {
 		return fmt.Errorf("mapped sandbox observation provider is unavailable")
 	}
+	if err := request.KernelFacts.validate(); err != nil || request.KernelPolicy != request.KernelFacts.Identity {
+		return fmt.Errorf("mapped sandbox requires the exact compiled kernel policy tuple")
+	}
 	digest, err := canonical.Sum("mapped-sandbox", "v1", request)
 	if err != nil {
 		return err
@@ -97,6 +107,7 @@ func verifyMappedSandboxV1(ctx context.Context, state deploy.StateV1, evidence d
 		return fmt.Errorf("mapped sandbox observation failed: %w", err)
 	}
 	if ctx.Err() != nil || proof.Request != digest || proof.NetworkPolicy != request.NetworkPolicy || !proof.ReadOnlyRoot ||
+		proof.KernelPolicy != request.KernelPolicy || proof.KernelFacts != request.KernelFacts ||
 		len(proof.Code) == 0 || !slices.Equal(proof.Code, proof.ObservedCode) || proof.Mounts == nil {
 		return fmt.Errorf("mapped sandbox proof is missing, stale or substituted")
 	}
diff --git a/internal/dockerdeploy/podman_application_create.go b/internal/dockerdeploy/podman_application_create.go
index b6bf3674..ef9b006f 100644
--- a/internal/dockerdeploy/podman_application_create.go
+++ b/internal/dockerdeploy/podman_application_create.go
@@ -36,6 +36,7 @@ type podmanApplicationCreate struct {
 		CapDrop, CapAdd, SecurityOpt, Dns []string
 		Tmpfs                             map[string]string
 		Mounts                            []podmanApplicationMount
+		RestartPolicy                     *mappedRestartPolicyV1 `json:",omitempty"`
 	}
 }
 
diff --git a/internal/dockerdeploy/podman_mapped_policy.go b/internal/dockerdeploy/podman_mapped_policy.go
new file mode 100644
index 00000000..ecb8f7ad
--- /dev/null
+++ b/internal/dockerdeploy/podman_mapped_policy.go
@@ -0,0 +1,157 @@
+package dockerdeploy
+
+import (
+	"fmt"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/omry/reploy/internal/canonical"
+	"github.com/omry/reploy/internal/mappedlaunch"
+	"github.com/omry/reploy/internal/probe"
+)
+
+type mappedRestartPolicyV1 struct {
+	Name              string
+	MaximumRetryCount int
+}
+
+// These names are in Linux capability-number order, matching the compiler's
+// closed v6.6 catalog. Setup authority never becomes an application grant.
+var mappedCapabilityNamesV1 = strings.Fields(`CHOWN DAC_OVERRIDE DAC_READ_SEARCH FOWNER FSETID KILL
+SETGID SETUID SETPCAP LINUX_IMMUTABLE NET_BIND_SERVICE NET_BROADCAST NET_ADMIN NET_RAW
+IPC_LOCK IPC_OWNER SYS_MODULE SYS_RAWIO SYS_CHROOT SYS_PTRACE SYS_PACCT SYS_ADMIN
+SYS_BOOT SYS_NICE SYS_RESOURCE SYS_TIME SYS_TTY_CONFIG MKNOD LEASE AUDIT_WRITE
+AUDIT_CONTROL SETFCAP MAC_OVERRIDE MAC_ADMIN SYSLOG WAKE_ALARM BLOCK_SUSPEND
+AUDIT_READ PERFMON BPF CHECKPOINT_RESTORE`)
+
+// Only this typed overlay can carry mapped compiler output into create. The
+// ordinary parser and its capability/profile allowlist stay unchanged.
+type mappedPodmanCreateRequestV1 struct {
+	body   podmanApplicationCreate
+	name   string
+	policy mappedSeccompPolicyV1
+}
+
+func mappedPodmanApplicationCreateRequestV1(spec CommandSpec, namespace string, policy mappedSeccompPolicyV1) (mappedPodmanCreateRequestV1, error) {
+	var result mappedPodmanCreateRequestV1
+	compiled, err := compileMappedSeccompV1(podmanDockerSeccompProfile, policy.abi, policy.finalCapabilities, policy.setupCapabilities, policy.kernelLastCapability)
+	if err != nil || policy != compiled {
+		return result, fmt.Errorf("mapped create requires an exact compiled kernel policy")
+	}
+	body, name, err := podmanApplicationCreateRequest(spec, namespace)
+	if err != nil {
+		return result, err
+	}
+	if body.Tty {
+		return result, fmt.Errorf("mapped create requires qualified non-TTY sandbox stdin transport")
+	}
+	if err := validateMappedCreateStartupV1(body.Cmd, policy); err != nil {
+		return result, err
+	}
+	setup := policy.finalCapabilities
+	for _, name := range body.HostConfig.CapAdd {
+		index := slices.Index(mappedCapabilityNamesV1, name)
+		if index < 0 {
+			return result, fmt.Errorf("mapped create has an unknown setup capability")
+		}
+		setup |= uint64(1) << index
+	}
+	if setup != policy.setupCapabilities {
+		return result, fmt.Errorf("mapped setup capabilities differ from the exact required union")
+	}
+	body.HostConfig.CapAdd = []string{}
+	for bit, name := range mappedCapabilityNamesV1 {
+		if setup&(uint64(1)<<bit) != 0 {
+			body.HostConfig.CapAdd = append(body.HostConfig.CapAdd, name)
+		}
+	}
+	slices.Sort(body.HostConfig.CapAdd)
+	for i, option := range body.HostConfig.SecurityOpt {
+		if strings.HasPrefix(option, "seccomp=") {
+			body.HostConfig.SecurityOpt[i] = "seccomp=" + policy.profile
+		}
+	}
+	body.HostConfig.AutoRemove = false
+	body.HostConfig.RestartPolicy = &mappedRestartPolicyV1{Name: "no", MaximumRetryCount: 0}
+	return mappedPodmanCreateRequestV1{body, name, policy}, nil
+}
+
+// Validate the two closed startup representations that can reach mapped
+// creation. Bare requests carry sandbox-exec directly. The owned waiter wraps
+// the same startup after its canonical binding and deadline; validate that
+// wrapper before any create rather than trusting the earlier waiter call.
+func validateMappedCreateStartupV1(command []string, policy mappedSeccompPolicyV1) error {
+	if len(command) == 0 {
+		return fmt.Errorf("mapped create requires a qualified startup command")
+	}
+	if command[0] == "sandbox-exec" {
+		_, err := mappedStartupCommandV1(command, policy)
+		return err
+	}
+	if command[0] != mappedlaunch.Command || len(command) < 5 || command[3] != "sandbox-exec" {
+		return fmt.Errorf("mapped create requires a fixed mapped-wait startup")
+	}
+	if _, err := mappedlaunch.DecodeBinding([]byte(command[1])); err != nil {
+		return fmt.Errorf("mapped waiter binding is invalid: %w", err)
+	}
+	if _, err := time.Parse(time.RFC3339Nano, command[2]); err != nil {
+		return fmt.Errorf("mapped waiter deadline is invalid: %w", err)
+	}
+	startup := append([]string{"sandbox-exec"}, command[4:]...)
+	if _, err := mappedStartupCommandV1(startup, policy); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Require the independent trusted startup argument to match the selected policy.
+// Omitted, duplicate or displaced arguments fail the actual probe parser before
+// any create or frame. This boundary must never infer a missing authority input.
+func mappedStartupCommandV1(command []string, policy mappedSeccompPolicyV1) ([]string, error) {
+	if len(command) == 0 || command[0] != "sandbox-exec" {
+		return nil, fmt.Errorf("mapped startup requires sandbox-exec")
+	}
+	args := slices.Clone(command[1:])
+	if err := probe.ValidateMappedSandboxArgumentsV1(args, policy.finalCapabilities); err != nil {
+		return nil, err
+	}
+	return append([]string{"sandbox-exec"}, args...), nil
+}
+
+// The expected tuple travels with the hashed instance request. F must return
+// fresh effective-policy evidence, not merely echo engine policy strings.
+type mappedKernelFactsV1 struct {
+	Identity             canonical.Digest `json:"identity"`
+	ABI                  string           `json:"abi"`
+	FinalCapabilities    string           `json:"final_capabilities"`
+	SetupCapabilities    string           `json:"setup_capabilities"`
+	KernelLastCapability string           `json:"kernel_last_capability"`
+}
+
+func (p mappedSeccompPolicyV1) facts() mappedKernelFactsV1 {
+	return mappedKernelFactsV1{canonical.Digest(p.identity), p.abi,
+		fmt.Sprintf("%016x", p.finalCapabilities), fmt.Sprintf("%016x", p.setupCapabilities),
+		fmt.Sprint(p.kernelLastCapability)}
+}
+
+func (f mappedKernelFactsV1) validate() error {
+	final, err := strconv.ParseUint(f.FinalCapabilities, 16, 64)
+	if err != nil || fmt.Sprintf("%016x", final) != f.FinalCapabilities {
+		return fmt.Errorf("invalid final kernel capabilities")
+	}
+	setup, err := strconv.ParseUint(f.SetupCapabilities, 16, 64)
+	if err != nil || fmt.Sprintf("%016x", setup) != f.SetupCapabilities {
+		return fmt.Errorf("invalid setup kernel capabilities")
+	}
+	last, err := strconv.Atoi(f.KernelLastCapability)
+	if err != nil || strconv.Itoa(last) != f.KernelLastCapability {
+		return fmt.Errorf("invalid kernel capability limit")
+	}
+	p, err := compileMappedSeccompV1(podmanDockerSeccompProfile, f.ABI, final, setup, last)
+	if err != nil || p.facts() != f {
+		return fmt.Errorf("kernel facts differ from the exact compiler result")
+	}
+	return nil
+}
diff --git a/internal/dockerdeploy/podman_mapped_policy_test.go b/internal/dockerdeploy/podman_mapped_policy_test.go
new file mode 100644
index 00000000..6b6cb727
--- /dev/null
+++ b/internal/dockerdeploy/podman_mapped_policy_test.go
@@ -0,0 +1,590 @@
+package dockerdeploy
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/omry/reploy/internal/canonical"
+)
+
+func mappedCreatePolicyFixtureV1(t *testing.T) mappedSeccompPolicyV1 {
+	t.Helper()
+	policy, err := compileMappedSeccompV1(podmanDockerSeccompProfile, "amd64", 0, 0, 40)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return policy
+}
+
+func mappedApplicationSpecFixtureV1(t *testing.T, final uint64) CommandSpec {
+	t.Helper()
+	spec := sameIDApplicationSpecWithIdentity(t, true, 0, 0)
+	spec.Args = slices.DeleteFunc(spec.Args, func(s string) bool { return s == "--tty" })
+	entry := slices.Index(spec.Args, "--entrypoint")
+	spec.Args = slices.Insert(spec.Args, entry+4, fmt.Sprintf("--mapped-capabilities=%016x", final))
+	return spec
+}
+
+func mappedPolicyForSpecFixtureV1(t *testing.T, spec CommandSpec, abi string, final uint64) mappedSeccompPolicyV1 {
+	t.Helper()
+	body, _, err := podmanApplicationCreateRequest(spec, "fixture-namespace")
+	if err != nil {
+		t.Fatal(err)
+	}
+	setup := final
+	for _, name := range body.HostConfig.CapAdd {
+		bit := slices.Index(mappedCapabilityNamesV1, name)
+		if bit < 0 {
+			t.Fatal("unknown fixture capability", name)
+		}
+		setup |= uint64(1) << bit
+	}
+	policy, err := compileMappedSeccompV1(podmanDockerSeccompProfile, abi, final, setup, 40)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return policy
+}
+
+func TestMappedCreatePolicyOverlayPreservesOrdinaryRequestV1(t *testing.T) {
+	spec := mappedApplicationSpecFixtureV1(t, 1<<18)
+	args := slices.Clone(spec.Args)
+	ordinary, _, err := podmanApplicationCreateRequest(spec, "fixture-namespace")
+	if err != nil {
+		t.Fatal(err)
+	}
+	before, _ := json.Marshal(ordinary)
+	policy := mappedPolicyForSpecFixtureV1(t, spec, "amd64", 1<<18)
+	request, err := mappedPodmanApplicationCreateRequestV1(spec, "fixture-namespace", policy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	body := request.body
+	if body.HostConfig.AutoRemove || body.HostConfig.RestartPolicy == nil || *body.HostConfig.RestartPolicy != (mappedRestartPolicyV1{Name: "no"}) ||
+		!body.HostConfig.ReadonlyRootfs || body.User != "0:0" || !slices.Equal(body.HostConfig.CapDrop, []string{"ALL"}) ||
+		!slices.Contains(body.HostConfig.CapAdd, "SYS_CHROOT") || !slices.Contains(body.HostConfig.CapAdd, "SETPCAP") ||
+		!slices.Contains(body.HostConfig.SecurityOpt, "seccomp="+policy.profile) || !slices.Contains(body.HostConfig.SecurityOpt, "no-new-privileges=true") {
+		t.Fatal("mapped overlay lost exact authority or fixed lifetime policy")
+	}
+	if body.Image != ordinary.Image || body.HostConfig.UsernsMode != ordinary.HostConfig.UsernsMode || !slices.Equal(body.Cmd, ordinary.Cmd) ||
+		!slices.Equal(body.Env, ordinary.Env) || body.Tty != ordinary.Tty || body.OpenStdin != ordinary.OpenStdin || request.name == "" {
+		t.Fatal("mapped overlay changed unrelated fields")
+	}
+	again, _, err := podmanApplicationCreateRequest(spec, "fixture-namespace")
+	after, _ := json.Marshal(again)
+	if err != nil || string(before) != string(after) || !ordinary.HostConfig.AutoRemove || ordinary.HostConfig.RestartPolicy != nil ||
+		strings.Contains(string(after), "RestartPolicy") || !slices.Equal(spec.Args, args) {
+		t.Fatal("ordinary request or source changed")
+	}
+}
+
+func TestMappedCreateRejectsInvalidCompilerResultV1(t *testing.T) {
+	spec := mappedApplicationSpecFixtureV1(t, 0)
+	good := mappedPolicyForSpecFixtureV1(t, spec, "amd64", 0)
+	for _, test := range []struct {
+		name   string
+		change func(*mappedSeccompPolicyV1)
+	}{
+		{"missing", func(p *mappedSeccompPolicyV1) { *p = mappedSeccompPolicyV1{} }},
+		{"profile", func(p *mappedSeccompPolicyV1) { p.profile += " " }},
+		{"identity", func(p *mappedSeccompPolicyV1) { p.identity = string(rendererDigest("a")) }},
+		{"ABI", func(p *mappedSeccompPolicyV1) { p.abi = "arm64" }},
+		{"final", func(p *mappedSeccompPolicyV1) { p.finalCapabilities = 1 }},
+		{"setup", func(p *mappedSeccompPolicyV1) { p.setupCapabilities |= 1 << 18 }},
+		{"kernel", func(p *mappedSeccompPolicyV1) { p.kernelLastCapability-- }},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			bad := good
+			test.change(&bad)
+			if _, err := mappedPodmanApplicationCreateRequestV1(spec, "fixture", bad); err == nil {
+				t.Fatal("invalid compiler result accepted")
+			}
+		})
+	}
+	for _, setup := range []uint64{good.setupCapabilities | 1<<18, 0} {
+		bad, err := compileMappedSeccompV1(podmanDockerSeccompProfile, good.abi, 0, setup, 40)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := mappedPodmanApplicationCreateRequestV1(spec, "fixture", bad); err == nil {
+			t.Fatal("inexact required setup union accepted")
+		}
+	}
+}
+
+func TestMappedStartupUsesActualProbeParserV1(t *testing.T) {
+	spec := sameIDApplicationSpec(t)
+	ordinary, _, err := podmanApplicationCreateRequest(spec, "fixture")
+	if err != nil {
+		t.Fatal(err)
+	}
+	policy := mappedPolicyForSpecFixtureV1(t, spec, "amd64", 0)
+	if _, err := mappedStartupCommandV1(ordinary.Cmd, policy); err == nil {
+		t.Fatal("missing independent startup ceiling was inferred from policy")
+	}
+	command := append([]string{"sandbox-exec", "--mapped-capabilities=0000000000000000"}, ordinary.Cmd[1:]...)
+	if again, err := mappedStartupCommandV1(command, policy); err != nil || !slices.Equal(again, command) {
+		t.Fatal("exact explicit argument not accepted", err)
+	}
+	for _, kind := range []string{"wrong final", "duplicate", "displaced", "uppercase", "private", "wrong command", "nonzero UID caps"} {
+		t.Run(kind, func(t *testing.T) {
+			bad := slices.Clone(command)
+			selected := policy
+			switch kind {
+			case "wrong final":
+				bad[1] = "--mapped-capabilities=0000000000000001"
+			case "duplicate":
+				bad = append(bad[:2:2], append([]string{bad[1]}, bad[2:]...)...)
+			case "displaced":
+				bad = append(bad[:3:3], append([]string{bad[1]}, bad[3:]...)...)
+			case "uppercase":
+				bad[1] = "--mapped-capabilities=000000000000000A"
+			case "private":
+				bad = append(bad[:2:2], append([]string{"--private-environment"}, bad[2:]...)...)
+			case "wrong command":
+				bad[0] = "restricted-exec"
+			case "nonzero UID caps":
+				selected.finalCapabilities = 1
+				bad[1] = "--mapped-capabilities=0000000000000001"
+			}
+			if _, err := mappedStartupCommandV1(bad, selected); err == nil {
+				t.Fatal("unqualified startup accepted")
+			}
+		})
+	}
+}
+
+func TestMappedCreateRejectsUnqualifiedStartupBeforeCreateV1(t *testing.T) {
+	for _, kind := range []string{"missing", "mismatch", "duplicate", "displaced", "private environment", "TTY", "unsupported mode", "nonzero UID caps"} {
+		t.Run(kind, func(t *testing.T) {
+			const final uint64 = 1 << 18
+			spec := mappedApplicationSpecFixtureV1(t, final)
+			entry := slices.Index(spec.Args, "--entrypoint")
+			switch kind {
+			case "missing":
+				spec.Args = slices.DeleteFunc(spec.Args, func(s string) bool { return s == "--mapped-capabilities=0000000000040000" })
+			case "mismatch":
+				index := slices.Index(spec.Args, "--mapped-capabilities=0000000000040000")
+				spec.Args[index] = "--mapped-capabilities=0000000000000000"
+			case "duplicate":
+				spec.Args = slices.Insert(spec.Args, entry+5, "--mapped-capabilities=0000000000040000")
+			case "displaced":
+				index := slices.Index(spec.Args, "--mapped-capabilities=0000000000040000")
+				spec.Args = slices.Delete(spec.Args, index, index+1)
+				spec.Args = slices.Insert(spec.Args, index+2, "--mapped-capabilities=0000000000040000")
+			case "private environment":
+				spec.Args = slices.Insert(spec.Args, entry+5, "--private-environment")
+			case "TTY":
+				spec.Args = slices.Insert(spec.Args, entry, "--tty")
+			case "unsupported mode":
+				spec.Args[entry+3] = "restricted-exec"
+			case "nonzero UID caps":
+				index := slices.Index(spec.Args, "--uid")
+				spec.Args[index+1] = "1000"
+			}
+			policy := mappedPolicyForSpecFixtureV1(t, spec, "amd64", final)
+			if _, err := mappedPodmanApplicationCreateRequestV1(spec, "fixture", policy); err == nil {
+				t.Fatal("unqualified startup reached the mapped create representation")
+			}
+		})
+	}
+}
+
+func TestMappedKernelFactsAreExactCompilerIdentityV1(t *testing.T) {
+	for _, abi := range []string{"amd64", "arm64"} {
+		p, err := compileMappedSeccompV1(podmanDockerSeccompProfile, abi, 1<<18, 1<<18|1<<8, 40)
+		if err != nil || p.facts().validate() != nil {
+			t.Fatal("valid exact tuple refused", err)
+		}
+		for _, field := range []string{"identity", "ABI", "final", "setup", "last", "decimal", "short hex"} {
+			t.Run(fmt.Sprint(abi, field), func(t *testing.T) {
+				f := p.facts()
+				switch field {
+				case "identity":
+					f.Identity = rendererDigest("a")
+				case "ABI":
+					f.ABI = "386"
+				case "final":
+					f.FinalCapabilities = "g000000000000000"
+				case "setup":
+					f.SetupCapabilities = "8000000000000000"
+				case "last":
+					f.KernelLastCapability = "63"
+				case "decimal":
+					f.KernelLastCapability = "040"
+				case "short hex":
+					f.FinalCapabilities = "40000"
+				}
+				if f.validate() == nil {
+					t.Fatal("invalid exact tuple accepted")
+				}
+			})
+		}
+	}
+}
+
+func TestMappedPolicyActualCreateTransportV1(t *testing.T) {
+	spec := mappedApplicationSpecFixtureV1(t, 1<<18)
+	policy := mappedPolicyForSpecFixtureV1(t, spec, "amd64", 1<<18)
+	request, err := mappedPodmanApplicationCreateRequestV1(spec, "exact-native-maps", policy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	id := strings.Repeat("b", 64)
+	var submitted map[string]json.RawMessage
+	var labels map[string]string
+	posts, inspections := 0, 0
+	client := newPodmanApplicationClient(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodPost {
+			posts++
+			if r.URL.Path != "/v1.44/containers/create" || r.URL.Query().Get("name") != request.name {
+				t.Error("wrong mapped create route")
+			}
+			if err := json.NewDecoder(r.Body).Decode(&submitted); err != nil {
+				t.Error(err)
+			}
+			if err := json.Unmarshal(submitted["Labels"], &labels); err != nil {
+				t.Error(err)
+			}
+			w.WriteHeader(http.StatusCreated)
+			fmt.Fprintf(w, `{"Id":%q}`, id)
+			return
+		}
+		inspections++
+		_ = json.NewEncoder(w).Encode(map[string]any{"Id": id, "Name": "/" + request.name, "Image": request.body.Image, "Config": map[string]any{"Labels": labels}})
+	})
+	got, err := client.createApplication(t.Context(), spec, request.body, request.name, request.body.Image, func(CommandSpec, RunOptions) error { t.Error("successful create removed"); return nil })
+	if err != nil || got != id || posts != 1 || inspections != 1 {
+		t.Fatal("mapped transport", got, err, posts, inspections)
+	}
+	var host map[string]json.RawMessage
+	if err := json.Unmarshal(submitted["HostConfig"], &host); err != nil {
+		t.Fatal(err)
+	}
+	if string(host["AutoRemove"]) != "false" || string(host["RestartPolicy"]) != `{"Name":"no","MaximumRetryCount":0}` || string(host["UsernsMode"]) != `"exact-native-maps"` {
+		t.Fatal("fixed mapped lifetime/map policy not transmitted", host)
+	}
+	var adds, drops, security []string
+	if json.Unmarshal(host["CapAdd"], &adds) != nil || json.Unmarshal(host["CapDrop"], &drops) != nil || json.Unmarshal(host["SecurityOpt"], &security) != nil {
+		t.Fatal("invalid mapped transport fields")
+	}
+	if !slices.Equal(adds, request.body.HostConfig.CapAdd) || !slices.Contains(adds, "SYS_CHROOT") || !slices.Equal(drops, []string{"ALL"}) || !slices.Equal(security, request.body.HostConfig.SecurityOpt) || !slices.Contains(security, "seccomp="+policy.profile) {
+		t.Fatal("mapped policy differs on wire")
+	}
+}
+
+func TestMappedWaiterRejectsUnboundPolicyBeforeCreateV1(t *testing.T) {
+	for _, kind := range []string{"missing", "corrupt profile", "wrong platform", "wrong ABI", "extra setup", "missing startup argument", "wrong final argument", "TTY", "private environment"} {
+		t.Run(kind, func(t *testing.T) {
+			f := newWaiterFixtureV1(t)
+			p := f.prepared
+			switch kind {
+			case "missing":
+				p.policy = mappedSeccompPolicyV1{}
+			case "corrupt profile":
+				p.policy.profile += " "
+			case "wrong platform":
+				p.state.Platform.OS = "darwin"
+			case "wrong ABI":
+				var err error
+				p.policy, err = compileMappedSeccompV1(podmanDockerSeccompProfile, "arm64", 0, p.policy.setupCapabilities, 40)
+				if err != nil {
+					t.Fatal(err)
+				}
+			case "extra setup":
+				var err error
+				p.policy, err = compileMappedSeccompV1(podmanDockerSeccompProfile, "amd64", 0, p.policy.setupCapabilities|1<<18, 40)
+				if err != nil {
+					t.Fatal(err)
+				}
+			case "missing startup argument":
+				index := slices.Index(p.spec.Args, "--mapped-capabilities=0000000000000000")
+				p.spec.Args = slices.Delete(p.spec.Args, index, index+1)
+			case "wrong final argument", "private environment":
+				entry := slices.Index(p.spec.Args, "--entrypoint") + 4
+				arg := "--mapped-capabilities=0000000000000001"
+				if kind == "private environment" {
+					arg = "--private-environment"
+				}
+				if kind == "wrong final argument" {
+					p.spec.Args[entry] = arg
+				} else {
+					p.spec.Args = slices.Insert(p.spec.Args, entry+1, arg)
+				}
+			case "TTY":
+				entry := slices.Index(p.spec.Args, "--entrypoint")
+				p.spec.Args = slices.Insert(p.spec.Args, entry, "--tty")
+			}
+			if a, err := startMappedWaiterWithBackendV1(f.ctx, p, f.binding, f.options, f.backend); err == nil || a != nil {
+				t.Fatal("unbound policy started", err)
+			}
+			if f.created != 0 || f.admissions != 0 || f.application.Load() != 0 {
+				t.Fatal("invalid policy reached effects")
+			}
+		})
+	}
+}
+
+func TestMappedRuntimePolicyRefusalBeforeFrameV1(t *testing.T) {
+	changes := []struct {
+		name   string
+		change func(map[string]any)
+	}{
+		{"missing automatic removal", func(h map[string]any) { delete(h, "AutoRemove") }},
+		{"null automatic removal", func(h map[string]any) { h["AutoRemove"] = nil }},
+		{"automatic removal", func(h map[string]any) { h["AutoRemove"] = true }},
+		{"missing restart policy", func(h map[string]any) { delete(h, "RestartPolicy") }},
+		{"empty restart name", func(h map[string]any) { h["RestartPolicy"] = map[string]any{"Name": "", "MaximumRetryCount": 0} }},
+		{"missing restart retries", func(h map[string]any) { h["RestartPolicy"] = map[string]any{"Name": "no"} }},
+		{"restart retries", func(h map[string]any) { h["RestartPolicy"] = map[string]any{"Name": "no", "MaximumRetryCount": 1} }},
+		{"restart always", func(h map[string]any) { h["RestartPolicy"] = map[string]any{"Name": "always", "MaximumRetryCount": 0} }},
+		{"missing security", func(h map[string]any) { delete(h, "SecurityOpt") }},
+		{"unconfined", func(h map[string]any) { h["SecurityOpt"] = []string{"seccomp=unconfined", "no-new-privileges=true"} }},
+		{"ordinary seed", func(h map[string]any) {
+			h["SecurityOpt"] = []string{"seccomp=" + string(podmanDockerSeccompProfile), "no-new-privileges=true"}
+		}},
+		{"missing NNP", func(h map[string]any) { h["SecurityOpt"] = []string{"seccomp=missing"} }},
+	}
+	for _, phase := range []string{"startup", "release"} {
+		for _, change := range changes {
+			t.Run(phase+"/"+change.name, func(t *testing.T) {
+				f := newWaiterFixtureV1(t)
+				mutate := func(o map[string]any) { change.change(o["HostConfig"].(map[string]any)) }
+				if phase == "startup" {
+					f.objectChange = mutate
+					a, err := startMappedWaiterWithBackendV1(f.ctx, f.prepared, f.binding, f.options, f.backend)
+					if err == nil || a != nil {
+						t.Fatal("bad startup observation accepted")
+					}
+				} else {
+					a := f.start(t)
+					f.mu.Lock()
+					f.objectChange = mutate
+					f.mu.Unlock()
+					if _, err := a.release(); err == nil {
+						t.Fatal("changed observation released")
+					}
+				}
+				if f.created != 1 || f.removed != 1 || f.admissions != 0 || f.application.Load() != 0 {
+					t.Fatal("refusal lost exact cleanup or admitted", f.created, f.removed, f.admissions)
+				}
+				select {
+				case <-f.frame:
+					t.Fatal("refusal sent release frame")
+				default:
+				}
+			})
+		}
+	}
+}
+
+func TestMappedSandboxRequiresFreshExactKernelPolicyV1(t *testing.T) {
+	for _, kind := range []string{"missing policy", "wrong policy", "missing tuple", "wrong ABI", "wrong final", "wrong setup", "wrong kernel", "stale instance"} {
+		t.Run(kind, func(t *testing.T) {
+			f := newWaiterFixtureV1(t)
+			a := f.start(t)
+			f.effect.sandboxChange = func(proof *mappedSandboxProofV1) {
+				switch kind {
+				case "missing policy":
+					proof.KernelPolicy = ""
+				case "wrong policy":
+					proof.KernelPolicy = rendererDigest("a")
+				case "missing tuple":
+					proof.KernelFacts = mappedKernelFactsV1{}
+				case "wrong ABI":
+					proof.KernelFacts.ABI = "arm64"
+				case "wrong final":
+					proof.KernelFacts.FinalCapabilities = "0000000000000001"
+				case "wrong setup":
+					proof.KernelFacts.SetupCapabilities = "0000000000000000"
+				case "wrong kernel":
+					proof.KernelFacts.KernelLastCapability = "39"
+				case "stale instance":
+					proof.Request = rendererDigest("a")
+				}
+			}
+			if _, err := a.release(); err == nil {
+				t.Fatal("wrong effective-policy proof released")
+			}
+			if f.removed != 1 || f.admissions != 0 || f.application.Load() != 0 {
+				t.Fatal("bad proof lost ownership/refusal")
+			}
+			select {
+			case <-f.frame:
+				t.Fatal("bad proof released frame")
+			default:
+			}
+		})
+	}
+}
+
+func TestMappedNativeCapabilitiesRefuseBeforeFrameV1(t *testing.T) {
+	for _, field := range []string{"BoundingCaps", "EffectiveCaps"} {
+		for _, phase := range []string{"startup", "release"} {
+			t.Run(field+"/"+phase, func(t *testing.T) {
+				f := newWaiterFixtureV1(t)
+				mutate := func(object map[string]any) { object[field] = []string{"CAP_SYS_ADMIN"} }
+				if phase == "startup" {
+					f.objectChange = mutate
+					if a, err := startMappedWaiterWithBackendV1(f.ctx, f.prepared, f.binding, f.options, f.backend); err == nil || a != nil {
+						t.Fatal("mismatched native capabilities started")
+					}
+				} else {
+					a := f.start(t)
+					f.mu.Lock()
+					f.objectChange = mutate
+					f.mu.Unlock()
+					if _, err := a.release(); err == nil {
+						t.Fatal("mismatched native capabilities released")
+					}
+				}
+				if f.removed != 1 || f.admissions != 0 || f.application.Load() != 0 {
+					t.Fatal("capability refusal lost exact cleanup or admitted")
+				}
+				select {
+				case <-f.frame:
+					t.Fatal("capability refusal sent release frame")
+				default:
+				}
+			})
+		}
+	}
+}
+
+func TestMappedNativeCapabilitySetsV1(t *testing.T) {
+	if mappedObservedCapabilitiesV1(nil, 0) {
+		t.Fatal("missing native set accepted")
+	}
+	for _, test := range []struct {
+		names []string
+		mask  uint64
+		want  bool
+	}{
+		{[]string{}, 0, true},
+		{[]string{"CAP_SETUID", "CAP_CHOWN"}, 1 | 1<<7, true},
+		{[]string{"CHOWN", "SETUID"}, 1 | 1<<7, true},
+		{[]string{}, 1, false},
+		{[]string{"CAP_CHOWN"}, 0, false},
+		{[]string{"CAP_CHOWN", "CHOWN"}, 1, false},
+		{[]string{"CAP_UNKNOWN"}, 0, false},
+		{[]string{"ALL"}, 0, false},
+		{[]string{"CAP_CAP_CHOWN"}, 1, false},
+	} {
+		if got := mappedObservedCapabilitiesV1(&test.names, test.mask); got != test.want {
+			t.Fatalf("native set %v mask %x: %v", test.names, test.mask, got)
+		}
+	}
+}
+
+func TestMappedNativeSecurityProvenanceV1(t *testing.T) {
+	profile := `{"defaultAction":"SCMP_ACT_ERRNO"}`
+	if mappedObservedSecurityV1(nil, profile) {
+		t.Fatal("missing security provenance accepted")
+	}
+	for _, nnp := range []string{"no-new-privileges", "no-new-privileges=true"} {
+		for _, value := range []string{profile, "/run/containers/seccomp-profile.json"} {
+			options := []string{"seccomp=" + value, nnp}
+			if !mappedObservedSecurityV1(&options, profile) {
+				t.Fatal("normalized Podman provenance rejected", options)
+			}
+		}
+	}
+	for _, options := range [][]string{
+		{}, {"no-new-privileges"}, {"seccomp=/profile"},
+		{"seccomp=unconfined", "no-new-privileges"},
+		{"seccomp=", "no-new-privileges"},
+		{"seccomp=default", "no-new-privileges"},
+		{"seccomp=/profile", "no-new-privileges=false"},
+		{"seccomp=/profile", "seccomp=/other"},
+		{"no-new-privileges", "no-new-privileges=true"},
+		{"seccomp=/a/../profile", "no-new-privileges"},
+		{"seccomp=/profile\x00", "no-new-privileges"},
+		{"seccomp=/profile", "no-new-privileges", "unmask=all"},
+	} {
+		if mappedObservedSecurityV1(&options, profile) {
+			t.Fatal("unqualified security provenance accepted", options)
+		}
+	}
+}
+
+func TestMappedRequestHashBindsKernelTupleV1(t *testing.T) {
+	f := newWaiterFixtureV1(t)
+	a := f.start(t)
+	r, err := a.sandboxRequest()
+	if err != nil {
+		t.Fatal(err)
+	}
+	original, err := canonical.Sum("mapped-sandbox", "v1", r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, field := range []string{"policy", "ABI", "final", "setup", "kernel"} {
+		changed := r
+		switch field {
+		case "policy":
+			changed.KernelPolicy = rendererDigest("a")
+		case "ABI":
+			changed.KernelFacts.ABI = "arm64"
+		case "final":
+			changed.KernelFacts.FinalCapabilities = "0000000000000001"
+		case "setup":
+			changed.KernelFacts.SetupCapabilities = "0000000000000000"
+		case "kernel":
+			changed.KernelFacts.KernelLastCapability = "39"
+		}
+		got, err := canonical.Sum("mapped-sandbox", "v1", changed)
+		if err != nil || got == original {
+			t.Fatal("kernel fact absent from request hash", field, err)
+		}
+		if err := verifyMappedSandboxV1(f.ctx, a.prepared.state, f.effect, changed); err == nil {
+			t.Fatal("invalid request tuple accepted", field)
+		}
+	}
+}
+
+func TestMappedNonemptyFinalPolicyUsesExactPrivateHandoffV1(t *testing.T) {
+	f := newWaiterFixtureV1(t)
+	for _, flag := range []string{"--uid", "--gid"} {
+		index := slices.Index(f.prepared.spec.Args, flag)
+		if index < 0 {
+			t.Fatal("fixture lacks explicit credential", flag)
+		}
+		f.prepared.spec.Args[index+1] = "0"
+	}
+	const final uint64 = 1 << 18 // SYS_CHROOT, separate from setup-only capabilities.
+	index := slices.Index(f.prepared.spec.Args, "--mapped-capabilities=0000000000000000")
+	f.prepared.spec.Args[index] = "--mapped-capabilities=0000000000040000"
+	f.prepared.policy = mappedPolicyForSpecFixtureV1(t, f.prepared.spec, "amd64", final)
+	a := f.start(t)
+	request, err := a.sandboxRequest()
+	if err != nil || request.KernelPolicy != canonical.Digest(f.prepared.policy.identity) || request.KernelFacts.FinalCapabilities != "0000000000040000" {
+		t.Fatal("final ceiling absent from exact private request", err)
+	}
+	if !slices.Contains(f.body.Cmd, "--mapped-capabilities=0000000000040000") || !slices.Contains(f.body.HostConfig.CapAdd, "SYS_CHROOT") ||
+		!slices.Contains(f.body.HostConfig.CapAdd, "SETPCAP") || f.body.HostConfig.AutoRemove {
+		t.Fatal("startup argument, container setup union and policy not coherent")
+	}
+	if _, err := a.release(); err != nil {
+		t.Fatal("injected exact handoff", err)
+	}
+	select {
+	case frame := <-f.frame:
+		if frame.Container != f.id {
+			t.Fatal("wrong released instance")
+		}
+	case <-f.ctx.Done():
+		t.Fatal("private handoff absent")
+	}
+	if err := <-f.startErr; err != nil {
+		t.Fatal(err)
+	}
+	if f.admissions != 1 {
+		t.Fatal("private handoff did not use the admission writer")
+	}
+	// This tests production orchestration with an injected trusted effect owner.
+	// It is neither a live-engine nor a kernel/effective-policy qualification.
+}
diff --git a/internal/dockerdeploy/podman_mapped_waiter.go b/internal/dockerdeploy/podman_mapped_waiter.go
index 54014527..56f2e650 100644
--- a/internal/dockerdeploy/podman_mapped_waiter.go
+++ b/internal/dockerdeploy/podman_mapped_waiter.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"path"
 	"slices"
 	"strings"
 	"sync"
@@ -70,10 +71,15 @@ func startMappedWaiterWithBackendV1(ctx context.Context, p *preparedMappedPodman
 		return nil, fmt.Errorf("mapped waiter requires a valid binding and admission deadline")
 	}
 	m := p.state.IdentityMapping
-	body, name, err := podmanApplicationCreateRequest(p.spec, p.namespace)
+	request, err := p.request()
+	body, name := request.body, request.name
 	if err != nil || body.Tty || len(body.Cmd) == 0 || body.Cmd[0] != "sandbox-exec" {
 		return nil, fmt.Errorf("mapped waiter requires qualified non-TTY sandbox stdin transport")
 	}
+	startup, err := mappedStartupCommandV1(body.Cmd, p.policy)
+	if err != nil {
+		return nil, err
+	}
 	if m == nil || m.PendingOperation == nil || m.PendingOperation.Native == nil || p.state.Current == nil ||
 		b.Installation != m.InstallationID || b.Operation != p.operation || b.Generation != p.state.Current.BuildLockDigest || b.Revision != m.Revision ||
 		m.PendingOperation.Native.Engine != p.endpoint || m.PendingOperation.Native.Process != name {
@@ -103,7 +109,7 @@ func startMappedWaiterWithBackendV1(ctx context.Context, p *preparedMappedPodman
 		prefix = append(prefix, "--label", key+"="+value)
 	}
 	copy.spec.Args = append(prefix, copy.spec.Args[entry:entry+3]...)
-	command := append([]string{mappedlaunch.Command, string(encoded), deadline.UTC().Format(time.RFC3339Nano)}, body.Cmd...)
+	command := append([]string{mappedlaunch.Command, string(encoded), deadline.UTC().Format(time.RFC3339Nano)}, startup...)
 	copy.spec.Args = append(copy.spec.Args, command...)
 	runContext, cancel := context.WithCancel(options.Context)
 	r, w := io.Pipe()
@@ -151,11 +157,16 @@ func startMappedWaiterWithBackendV1(ctx context.Context, p *preparedMappedPodman
 }
 
 func (a *ownedMappedWaiterV1) observeContainer(ctx context.Context, client *podmanHealthcheckClient) (int, error) {
-	data, err := client.request(ctx, http.MethodGet, "/v1.44/containers/"+a.container+"/json", nil)
+	_, err := a.prepared.request()
+	if err != nil {
+		return 0, err
+	}
+	data, err := client.request(ctx, http.MethodGet, "/v"+client.version+"/libpod/containers/"+a.container+"/json", nil)
 	var object struct {
-		ID, Image    string
-		RestartCount *int
-		Config       struct {
+		ID, Image                   string
+		RestartCount                *int
+		BoundingCaps, EffectiveCaps *[]string
+		Config                      struct {
 			Labels          map[string]string
 			Entrypoint, Cmd []string
 			Tty             *bool
@@ -164,13 +175,24 @@ func (a *ownedMappedWaiterV1) observeContainer(ctx context.Context, client *podm
 			Running bool
 			Pid     int
 		}
-		HostConfig struct{ RestartPolicy *struct{ Name string } }
+		HostConfig struct {
+			AutoRemove    *bool
+			RestartPolicy *struct {
+				Name              string
+				MaximumRetryCount *int
+			}
+			SecurityOpt *[]string
+		}
 	}
 	entry := slices.Index(a.prepared.spec.Args, "--entrypoint")
 	if err != nil || json.Unmarshal(data, &object) != nil || object.ID != a.container || strings.TrimPrefix(object.Image, "sha256:") != strings.TrimPrefix(string(a.binding.Image), "sha256:") || object.Config.Tty == nil || *object.Config.Tty ||
 		object.Config.Labels["io.reploy.native-operation"] != a.binding.Operation || object.Config.Labels["io.reploy.native-installation"] != a.binding.Installation ||
 		!slices.Equal(object.Config.Entrypoint, []string{"/reploy-probe"}) || !slices.Equal(object.Config.Cmd, a.prepared.spec.Args[entry+3:]) ||
-		object.RestartCount == nil || *object.RestartCount != 0 || object.HostConfig.RestartPolicy == nil || object.HostConfig.RestartPolicy.Name != "" && object.HostConfig.RestartPolicy.Name != "no" {
+		object.RestartCount == nil || *object.RestartCount != 0 || object.HostConfig.AutoRemove == nil || *object.HostConfig.AutoRemove ||
+		object.HostConfig.RestartPolicy == nil || object.HostConfig.RestartPolicy.Name != "no" || object.HostConfig.RestartPolicy.MaximumRetryCount == nil || *object.HostConfig.RestartPolicy.MaximumRetryCount != 0 ||
+		!mappedObservedCapabilitiesV1(object.BoundingCaps, a.prepared.policy.setupCapabilities) ||
+		!mappedObservedCapabilitiesV1(object.EffectiveCaps, a.prepared.policy.setupCapabilities) ||
+		!mappedObservedSecurityV1(object.HostConfig.SecurityOpt, a.prepared.policy.profile) {
 		return 0, fmt.Errorf("mapped waiter runtime identity or inhibited command changed")
 	}
 	if !object.State.Running {
@@ -182,6 +204,51 @@ func (a *ownedMappedWaiterV1) observeContainer(ctx context.Context, client *podm
 	return object.State.Pid, nil
 }
 
+// Native inspect exposes complete OCI sets. Compat CapAdd/CapDrop are deltas
+// from configurable engine defaults and cannot establish the selected set.
+func mappedObservedCapabilitiesV1(names *[]string, expected uint64) bool {
+	if names == nil {
+		return false
+	}
+	var observed uint64
+	for _, name := range *names {
+		bit := slices.Index(mappedCapabilityNamesV1, strings.TrimPrefix(name, "CAP_"))
+		if bit < 0 || observed&(uint64(1)<<bit) != 0 {
+			return false
+		}
+		observed |= uint64(1) << bit
+	}
+	return observed == expected
+}
+
+// Podman normalizes NNP and may retain an engine-side profile pathname rather
+// than inline bytes. This is provenance only: release still requires F's fresh
+// exact KernelPolicy/KernelFacts proof for this instance, never this pathname.
+func mappedObservedSecurityV1(options *[]string, profile string) bool {
+	if options == nil || len(*options) != 2 {
+		return false
+	}
+	var nnp, seccomp bool
+	for _, option := range *options {
+		switch {
+		case option == "no-new-privileges" || option == "no-new-privileges=true":
+			if nnp {
+				return false
+			}
+			nnp = true
+		case strings.HasPrefix(option, "seccomp="):
+			value := strings.TrimPrefix(option, "seccomp=")
+			if seccomp || value != profile && (!strings.HasPrefix(value, "/") || path.Clean(value) != value || strings.ContainsAny(value, "\x00\r\n")) {
+				return false
+			}
+			seccomp = true
+		default:
+			return false
+		}
+	}
+	return nnp && seccomp
+}
+
 type mappedWaiterEvidenceV1 struct {
 	deploy.IdentityMappingEvidenceV1
 	verify func(context.Context) error
diff --git a/internal/dockerdeploy/podman_mapped_waiter_test.go b/internal/dockerdeploy/podman_mapped_waiter_test.go
index b3e5d9d4..d799daed 100644
--- a/internal/dockerdeploy/podman_mapped_waiter_test.go
+++ b/internal/dockerdeploy/podman_mapped_waiter_test.go
@@ -43,6 +43,7 @@ func (e *waiterEffectFixtureV1) MappedSandbox(_ context.Context, _ deploy.StateV
 		code[i] = mappedCodePathV1{name, name}
 	}
 	proof := mappedSandboxProofV1{Request: digest, NetworkPolicy: request.NetworkPolicy, ReadOnlyRoot: true,
+		KernelPolicy: request.KernelPolicy, KernelFacts: request.KernelFacts,
 		Code: code, ObservedCode: slices.Clone(code), Mounts: []mappedSandboxMountV1{}}
 	if e.sandboxChange != nil {
 		e.sandboxChange(&proof)
@@ -132,7 +133,18 @@ func newWaiterFixtureV1(t *testing.T) *waiterFixtureV1 {
 			w.WriteHeader(500)
 			return
 		}
-		object := map[string]any{"Id": f.id, "Image": f.binding.Image, "RestartCount": 0, "Config": map[string]any{"Labels": f.body.Labels, "Entrypoint": f.body.Entrypoint, "Cmd": f.body.Cmd, "Tty": f.body.Tty}, "State": map[string]any{"Running": !f.stopped, "Pid": f.pid}, "HostConfig": map[string]any{"RestartPolicy": map[string]any{"Name": "no"}}}
+		if r.URL.Path != "/v"+f.client.version+"/libpod/containers/"+f.id+"/json" {
+			t.Errorf("unexpected mapped inspect route: %s", r.URL.Path)
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		caps := make([]string, 0, len(f.body.HostConfig.CapAdd))
+		for _, name := range f.body.HostConfig.CapAdd {
+			caps = append(caps, "CAP_"+name)
+		}
+		// Native Podman inspect exposes the complete OCI capability sets and
+		// normalized security options, not an echo of compat create arguments.
+		object := map[string]any{"Id": f.id, "Image": f.binding.Image, "RestartCount": 0, "BoundingCaps": caps, "EffectiveCaps": caps, "Config": map[string]any{"Labels": f.body.Labels, "Entrypoint": f.body.Entrypoint, "Cmd": f.body.Cmd, "Tty": f.body.Tty}, "State": map[string]any{"Running": !f.stopped, "Pid": f.pid}, "HostConfig": map[string]any{"RestartPolicy": map[string]any{"Name": "no", "MaximumRetryCount": 0}, "AutoRemove": false, "CapAdd": []string{}, "CapDrop": []string{"CAP_AUDIT_WRITE", "CAP_NET_RAW"}, "SecurityOpt": []string{"no-new-privileges", "seccomp=/run/containers/seccomp-profile.json"}}}
 		if f.objectChange != nil {
 			f.objectChange(object)
 		}
@@ -143,6 +155,8 @@ func newWaiterFixtureV1(t *testing.T) *waiterFixtureV1 {
 	spec := sameIDApplicationSpec(t)
 	spec.Args = slices.DeleteFunc(spec.Args, func(s string) bool { return s == "--tty" })
 	entry := slices.Index(spec.Args, "--entrypoint")
+	// Independent trusted startup input, checked against the compiled policy.
+	spec.Args = slices.Insert(spec.Args, entry+4, "--mapped-capabilities=0000000000000000")
 	spec.Args[entry+2] = string(lock.FinalImage.ConfigDigest)
 	name := spec.Args[slices.Index(spec.Args, "--name")+1]
 	empty := []deploy.IdentityMappingIntervalV1{}
@@ -156,6 +170,7 @@ func newWaiterFixtureV1(t *testing.T) *waiterFixtureV1 {
 		t.Fatal(err)
 	}
 	f.prepared = &preparedMappedPodmanCreateV1{ops: deploy.IdentityMappingOperationsV1{Operation: operation, Evidence: f.effect, ValidateProfileOwner: registry.ValidateRequirementProfileV1}, state: state, active: identitymapping.Geometry{Profile: "exact", UIDs: []identitymapping.Interval{{HostStart: 100000, Count: 1}}, GIDs: []identitymapping.Interval{{HostStart: 100000, Count: 1}}}, operation: "operation", spec: spec, endpoint: f.client.endpoint, version: f.client.version, namespace: "fixture-namespace"}
+	f.prepared.policy = mappedPolicyForSpecFixtureV1(t, spec, state.Platform.Architecture, 0)
 	f.binding = mappedlaunch.Binding{Schema: "mapped-release-v1", Installation: "installation", Operation: "operation", Generation: state.Current.BuildLockDigest, Revision: "1", Image: lock.FinalImage.ConfigDigest, Role: "app", Plan: rendererDigest("c")}
 	ctx, cancel := context.WithTimeout(t.Context(), 3*time.Second)
 	t.Cleanup(cancel)
@@ -175,12 +190,12 @@ func newWaiterFixtureV1(t *testing.T) *waiterFixtureV1 {
 			if f.createFailure {
 				return "", errors.New("uncertain create; journal retained")
 			}
-			body, _, err := podmanApplicationCreateRequest(p.spec, p.namespace)
+			request, err := p.request()
 			if err != nil {
 				return "", err
 			}
 			f.mu.Lock()
-			f.body = body
+			f.body = request.body
 			f.mu.Unlock()
 			return f.id, ctx.Err()
 		},
diff --git a/internal/dockerdeploy/podman_mapping_create.go b/internal/dockerdeploy/podman_mapping_create.go
index 3c48dd99..6bd2a7cf 100644
--- a/internal/dockerdeploy/podman_mapping_create.go
+++ b/internal/dockerdeploy/podman_mapping_create.go
@@ -23,9 +23,10 @@ type preparedMappedPodmanCreateV1 struct {
 	endpoint  string
 	version   string
 	namespace string
+	policy    mappedSeccompPolicyV1
 }
 
-func prepareMappedPodmanCreateV1(ctx context.Context, ops deploy.IdentityMappingOperationsV1, expected deploy.StateV1, active identitymapping.Geometry, operationID string, spec CommandSpec) (*preparedMappedPodmanCreateV1, error) {
+func prepareMappedPodmanCreateV1(ctx context.Context, ops deploy.IdentityMappingOperationsV1, expected deploy.StateV1, active identitymapping.Geometry, operationID string, spec CommandSpec, policy mappedSeccompPolicyV1) (*preparedMappedPodmanCreateV1, error) {
 	state, err := ops.ObserveEffects(ctx, expected, active, operationID)
 	if err != nil {
 		return nil, err
@@ -40,16 +41,18 @@ func prepareMappedPodmanCreateV1(ctx context.Context, ops deploy.IdentityMapping
 	}
 	spec = pinDockerEndpointV1(spec, target.Endpoint)
 	spec.Args, spec.Env = slices.Clone(spec.Args), slices.Clone(spec.Env)
-	p := &preparedMappedPodmanCreateV1{ops: ops, state: state, active: active, operation: operationID, spec: spec, endpoint: target.Endpoint}
+	p := &preparedMappedPodmanCreateV1{ops: ops, state: state, active: active, operation: operationID, spec: spec, endpoint: target.Endpoint, policy: policy}
 	client, namespace, err := p.observe(ctx)
 	if err != nil {
 		return nil, err
 	}
 	defer client.http.CloseIdleConnections()
-	body, _, err := podmanApplicationCreateRequest(spec, namespace)
+	p.namespace = namespace
+	request, err := p.request()
 	if err != nil {
 		return nil, err
 	}
+	body := request.body
 	// Storage preparation belongs to F; this internal seam cannot grant access
 	// to external host binds or implicitly create persistent named volumes.
 	for _, mount := range body.HostConfig.Mounts {
@@ -68,6 +71,13 @@ func prepareMappedPodmanCreateV1(ctx context.Context, ops deploy.IdentityMapping
 	return p, nil
 }
 
+func (p *preparedMappedPodmanCreateV1) request() (mappedPodmanCreateRequestV1, error) {
+	if p == nil || p.state.Platform.OS != "linux" || p.state.Platform.Architecture != p.policy.abi {
+		return mappedPodmanCreateRequestV1{}, fmt.Errorf("mapped policy ABI differs from selected Linux image platform")
+	}
+	return mappedPodmanApplicationCreateRequestV1(p.spec, p.namespace, p.policy)
+}
+
 func (p *preparedMappedPodmanCreateV1) observe(ctx context.Context) (*podmanHealthcheckClient, string, error) {
 	if p == nil || ctx == nil {
 		return nil, "", fmt.Errorf("mapped create requires its invocation context and preparation")
@@ -112,10 +122,11 @@ func (p *preparedMappedPodmanCreateV1) create(ctx context.Context, raw commandRu
 	if client.version != p.version || namespace != p.namespace {
 		return "", fmt.Errorf("mapped Podman engine identity or parent namespace changed after preparation")
 	}
-	body, name, err := podmanApplicationCreateRequest(p.spec, namespace)
+	request, err := p.request()
 	if err != nil {
 		return "", err
 	}
+	body, name := request.body, request.name
 	image, err := p.verifyImage(ctx, client)
 	if err != nil {
 		return "", err
diff --git a/internal/dockerdeploy/podman_mapping_integration_test.go b/internal/dockerdeploy/podman_mapping_integration_test.go
index eec77f4f..ed909635 100644
--- a/internal/dockerdeploy/podman_mapping_integration_test.go
+++ b/internal/dockerdeploy/podman_mapping_integration_test.go
@@ -3,6 +3,7 @@
 package dockerdeploy
 
 import (
+	"bytes"
 	"context"
 	"crypto/rand"
 	"encoding/hex"
@@ -14,6 +15,7 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"slices"
 	"strconv"
@@ -25,6 +27,7 @@ import (
 	"github.com/omry/reploy/internal/canonical"
 	"github.com/omry/reploy/internal/deploy"
 	"github.com/omry/reploy/internal/identitymapping"
+	"github.com/omry/reploy/internal/mappedlaunch"
 	"github.com/omry/reploy/internal/providers"
 	"github.com/omry/reploy/internal/providers/registry"
 )
@@ -43,16 +46,51 @@ func (mappedCreateFixtureEvidenceV1) Verify(context.Context, deploy.StateV1) err
 	return errors.New("fixture never grants lifecycle admission")
 }
 
-func mappedCreateIntegrationSpecV1(t *testing.T, name, image, nonce, endpoint string) CommandSpec {
+func mappedCreateDiagnosticStartupV1(t *testing.T, binding mappedlaunch.Binding, nonce string, wait time.Duration) []string {
+	t.Helper()
+	encoded, err := canonical.Marshal(binding)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return []string{mappedlaunch.Command, string(encoded), time.Now().Add(wait).UTC().Format(time.RFC3339Nano), "sandbox-exec", "--mapped-capabilities=0000000000000000", "--uid", "0", "--gid", "0", "--public", "deny", "--local", "deny", "--ambiguous", "require-both", "--", "/probe", "admission-wait", nonce, "cap-report"}
+}
+
+func mappedCreateIntegrationSpecV1(t *testing.T, name, image, nonce, endpoint string, binding mappedlaunch.Binding) CommandSpec {
 	t.Helper()
 	profile, err := materializePodmanDockerSeccomp()
 	if err != nil {
 		t.Fatal(err)
 	}
-	args := []string{"create", "--name", name, "--user", "0:0", "--pull", "never", "--read-only", "--cap-drop", "ALL", "--security-opt", "seccomp=" + profile, "--security-opt", "no-new-privileges=true", "--network", "none", "--tmpfs", "/run:rw,noexec,nosuid,nodev,size=4m,mode=1777", "--label", "io.reploy.c1-fixture=" + nonce, "--entrypoint", "/reploy-probe", image, "admission-wait", nonce, "cap-report"}
+	args := []string{"create", "--name", name, "--user", "0:0", "--interactive", "--pull", "never", "--read-only", "--cap-drop", "ALL", "--security-opt", "seccomp=" + profile, "--security-opt", "no-new-privileges=true", "--network", "none", "--tmpfs", "/run:rw,noexec,nosuid,nodev,size=4m,mode=1777", "--label", "io.reploy.c1-fixture=" + nonce, "--entrypoint", "/reploy-probe", image}
+	args = append(args, mappedCreateDiagnosticStartupV1(t, binding, nonce, 2*time.Minute)...)
 	return CommandSpec{Name: "docker", Args: args, Env: []string{"DOCKER_HOST=" + endpoint, "DOCKER_CONTEXT="}, builtinSeccompIndex: slices.Index(args, "seccomp="+profile)}
 }
 
+func mappedCreateDiagnosticBindingV1(t *testing.T, state deploy.StateV1, image, operationID string) mappedlaunch.Binding {
+	t.Helper()
+	if state.IdentityMapping == nil || state.IdentityMapping.PendingOperation == nil || state.IdentityMapping.PendingOperation.ExpectedGeneration == nil {
+		t.Fatal("diagnostic binding requires the exact pending generation")
+	}
+	generation := state.IdentityMapping.PendingOperation.ExpectedGeneration
+	imageDigest := canonical.Digest(image)
+	if err := imageDigest.Validate(); err != nil {
+		t.Fatal(err)
+	}
+	binding := mappedlaunch.Binding{Schema: "mapped-release-v1", Installation: state.IdentityMapping.InstallationID, Operation: operationID, Generation: generation.BuildLockDigest, Revision: state.IdentityMapping.PendingOperation.ExpectedRevision, Image: imageDigest, Role: "app", Plan: rendererDigest("c")}
+	if err := binding.Validate(); err != nil {
+		t.Fatalf("diagnostic binding is not canonical: %v", err)
+	}
+	encoded, err := canonical.Marshal(binding)
+	if err != nil {
+		t.Fatal(err)
+	}
+	decoded, err := mappedlaunch.DecodeBinding(encoded)
+	if err != nil || decoded != binding {
+		t.Fatalf("diagnostic binding did not round-trip canonically: %v", err)
+	}
+	return binding
+}
+
 func mappedCreateIntegrationStateV1(t *testing.T, image, endpoint string) (deploy.IdentityMappingOperationsV1, deploy.StateV1) {
 	t.Helper()
 	dir, _ := stageProviderBuildRunState(t, false)
@@ -140,8 +178,69 @@ func readMappedKernelIntervalsV1(t *testing.T, pid int, kind string) []identitym
 	return values
 }
 
+// This host check exercises the actual production dispatcher without requiring
+// a live engine. The production /reploy-probe waits on a real pipe for the
+// release frame; the conformance payload remains a separate /probe argv target.
+func TestMappedC1ProductionDispatcherWaitsWithoutReleaseV1(t *testing.T) {
+	probe := filepath.Join(t.TempDir(), "reploy-probe")
+	build := exec.CommandContext(t.Context(), "go", "build", "-buildvcs=false", "-o", probe, "../../cmd/reploy-probe")
+	if output, err := build.CombinedOutput(); err != nil {
+		t.Fatalf("build production probe: %v\n%s", err, output)
+	}
+	digest := canonical.Digest("sha256:" + strings.Repeat("a", 64))
+	state := deploy.StateV1{IdentityMapping: &deploy.IdentityMappingStateV1{
+		InstallationID: "c1-host-fixture",
+		PendingOperation: &deploy.IdentityMappingOperationV1{
+			OperationID:        "c1-host-operation",
+			ExpectedRevision:   "1",
+			ExpectedGeneration: &deploy.EnvironmentGenerationState{BuildLockDigest: digest},
+		},
+	}}
+	binding := mappedCreateDiagnosticBindingV1(t, state, string(digest), "c1-host-operation")
+	spec := mappedCreateIntegrationSpecV1(t, "c1-host-fixture", string(digest), "0123456789abcdef0123456789abcdef", "unix:///tmp/c1-host-fixture.sock", binding)
+	policy := mappedCreatePolicyFixtureV1(t)
+	request, err := mappedPodmanApplicationCreateRequestV1(spec, "c1-host-namespace", policy)
+	if err != nil {
+		t.Fatalf("generated C1 request rejected by strict mapped constructor: %v", err)
+	}
+	body := request.body
+	if request.policy != policy || policy.finalCapabilities != 0 || policy.setupCapabilities != 0 || body.Tty || !body.OpenStdin || !body.StdinOnce || !body.AttachStdin || !body.HostConfig.ReadonlyRootfs || !slices.Equal(body.HostConfig.CapDrop, []string{"ALL"}) || len(body.HostConfig.CapAdd) != 0 || body.HostConfig.AutoRemove || body.HostConfig.RestartPolicy == nil || *body.HostConfig.RestartPolicy != (mappedRestartPolicyV1{Name: "no", MaximumRetryCount: 0}) {
+		t.Fatalf("generated C1 request changed the exact fixed policy or stdin tuple: policy=%+v body=%+v", request.policy, body)
+	}
+	if err := validateMappedCreateStartupV1(body.Cmd, policy); err != nil {
+		t.Fatalf("generated C1 startup failed the actual parser: %v", err)
+	}
+	command := slices.Clone(body.Cmd)
+	input, inputWriter, err := os.Pipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer input.Close()
+	defer inputWriter.Close()
+	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
+	defer cancel()
+	process := exec.CommandContext(ctx, probe, command...)
+	process.Stdin = input
+	var stdout, stderr bytes.Buffer
+	process.Stdout, process.Stderr = &stdout, &stderr
+	if err := process.Start(); err != nil {
+		t.Fatal(err)
+	}
+	if err := inputWriter.Close(); err != nil {
+		t.Fatal(err)
+	}
+	err = process.Wait()
+	if err == nil || ctx.Err() != nil || !strings.Contains(stderr.String(), "read mapped release header") || !strings.Contains(stderr.String(), "EOF") {
+		t.Fatalf("production mapped waiter did not report the expected causal EOF: err=%v context=%v stderr=%q", err, ctx.Err(), stderr.String())
+	}
+	if stdout.Len() != 0 {
+		t.Fatalf("conformance payload ran before release frame: stdout=%q stderr=%q", stdout.String(), stderr.String())
+	}
+}
+
 // Opt in only on a disposable eligible host. The image contains the existing
-// conformance probe at /probe and /reploy-probe, with no host data mounted.
+// production probe at /reploy-probe and conformance payload at /probe, with no
+// host data mounted. The production waiter remains inhibited until its frame.
 func TestMappedPodmanCreateLiveV1(t *testing.T) {
 	endpoint, image := os.Getenv("REPLOY_C1_TEST_ENDPOINT"), os.Getenv("REPLOY_C1_TEST_IMAGE")
 	if endpoint == "" && image == "" {
@@ -165,8 +264,9 @@ func TestMappedPodmanCreateLiveV1(t *testing.T) {
 			if err != nil {
 				t.Fatalf("real B Configure: %v", err)
 			}
-			firstSpec := mappedCreateIntegrationSpecV1(t, "reploy-c1-"+nonce, image, nonce, endpoint)
-			if _, err := prepareMappedPodmanCreateV1(t.Context(), ops, intent, active, operationID, firstSpec); err == nil {
+			binding := mappedCreateDiagnosticBindingV1(t, intent, image, operationID)
+			firstSpec := mappedCreateIntegrationSpecV1(t, "reploy-c1-"+nonce, image, nonce, endpoint, binding)
+			if _, err := prepareMappedPodmanCreateV1(t.Context(), ops, intent, active, operationID, firstSpec, mappedCreatePolicyFixtureV1(t)); err == nil {
 				t.Fatal("intent granted a dispatchable preparation")
 			}
 			pending, err := ops.BeginEffects(t.Context(), intent, operationID)
@@ -176,25 +276,25 @@ func TestMappedPodmanCreateLiveV1(t *testing.T) {
 			if profile == "exact" {
 				checkMappedEngineRefusalsV1(t, ops, pending, active, operationID, firstSpec)
 			}
-			if _, err := prepareMappedPodmanCreateV1(t.Context(), ops, pending, active, "foreign-operation", firstSpec); err == nil {
+			if _, err := prepareMappedPodmanCreateV1(t.Context(), ops, pending, active, "foreign-operation", firstSpec, mappedCreatePolicyFixtureV1(t)); err == nil {
 				t.Fatal("foreign operation admitted")
 			}
-			if _, err := prepareMappedPodmanCreateV1(t.Context(), ops, intent, active, operationID, firstSpec); err == nil {
+			if _, err := prepareMappedPodmanCreateV1(t.Context(), ops, intent, active, operationID, firstSpec, mappedCreatePolicyFixtureV1(t)); err == nil {
 				t.Fatal("stale revision admitted")
 			}
 			foreign := firstSpec
 			foreign.Args = slices.Clone(firstSpec.Args)
 			foreign.Args[slices.Index(foreign.Args, "--entrypoint")+2] = string(rendererDigest("a"))
-			if _, err := prepareMappedPodmanCreateV1(t.Context(), ops, pending, active, operationID, foreign); err == nil || !strings.Contains(err.Error(), "selected generation") {
+			if _, err := prepareMappedPodmanCreateV1(t.Context(), ops, pending, active, operationID, foreign, mappedCreatePolicyFixtureV1(t)); err == nil || !strings.Contains(err.Error(), "selected generation") {
 				t.Fatal("foreign image was not rejected by current-generation binding", err)
 			}
 			for repeat := 0; repeat < 2; repeat++ {
 				t.Run(strconv.Itoa(repeat), func(t *testing.T) {
-					spec := mappedCreateIntegrationSpecV1(t, fmt.Sprintf("reploy-c1-%s-%d", nonce, repeat), image, nonce, endpoint)
+					spec := mappedCreateIntegrationSpecV1(t, fmt.Sprintf("reploy-c1-%s-%d", nonce, repeat), image, nonce, endpoint, binding)
 					if repeat == 1 {
 						spec.Args[slices.Index(spec.Args, "--entrypoint")+2] = pending.Current.Reference
 					}
-					prepared, err := prepareMappedPodmanCreateV1(t.Context(), ops, pending, active, operationID, spec)
+					prepared, err := prepareMappedPodmanCreateV1(t.Context(), ops, pending, active, operationID, spec, mappedCreatePolicyFixtureV1(t))
 					if err != nil {
 						t.Fatal("production C1 preparation", err)
 					}
@@ -233,11 +333,23 @@ func TestMappedPodmanCreateLiveV1(t *testing.T) {
 							t.Error("exact fixture cleanup", err)
 						}
 					}()
-					// Private test starts only the trusted waiter. No product payload
-					// admission or public mapped execution is exercised or claimed.
-					if _, err := client.request(t.Context(), http.MethodPost, "/v1.44/containers/"+ownedID+"/start", nil); err != nil {
+					// Private test starts only the trusted production waiter. The
+					// conformance payload at /probe is after the mapped release
+					// frame and is never reached by this diagnostic.
+					startContext, cancelStart := context.WithTimeout(t.Context(), 30*time.Second)
+					defer cancelStart()
+					input, inputWriter, err := os.Pipe()
+					if err != nil {
 						t.Fatal(err)
 					}
+					defer input.Close()
+					defer inputWriter.Close()
+					start := prepared.spec
+					start.Args = []string{"start", "--attach", "--interactive", ownedID}
+					startErr := make(chan error, 1)
+					go func() {
+						startErr <- runCommandWithoutDockerPreflight(start, RunOptions{Context: startContext, Stdin: input})
+					}()
 					var pid int
 					deadline := time.Now().Add(20 * time.Second)
 					for time.Now().Before(deadline) {
@@ -277,6 +389,16 @@ func TestMappedPodmanCreateLiveV1(t *testing.T) {
 					if _, err := unmappedRuntimeDocumentV1(state); err == nil {
 						t.Fatal("public mapped-execution guard was bypassed")
 					}
+					cancelStart()
+					_ = inputWriter.Close()
+					select {
+					case err := <-startErr:
+						if err != nil && !strings.Contains(err.Error(), "context canceled") {
+							t.Logf("trusted waiter stopped after bounded diagnostic cancellation: %v", err)
+						}
+					case <-time.After(5 * time.Second):
+						t.Error("trusted waiter did not stop after bounded diagnostic cancellation")
+					}
 				})
 			}
 		})
@@ -302,7 +424,7 @@ func checkMappedEngineRefusalsV1(t *testing.T, ops deploy.IdentityMappingOperati
 			spec.Args = slices.Clone(spec.Args)
 			if kind == "remote" {
 				spec.Env = []string{"DOCKER_HOST=tcp://127.0.0.1:1", "DOCKER_CONTEXT="}
-				if _, err := prepareMappedPodmanCreateV1(t.Context(), ops, pending, active, operationID, spec); err == nil {
+				if _, err := prepareMappedPodmanCreateV1(t.Context(), ops, pending, active, operationID, spec, mappedCreatePolicyFixtureV1(t)); err == nil {
 					t.Fatal("remote endpoint admitted")
 				}
 				return
@@ -371,7 +493,7 @@ func checkMappedEngineRefusalsV1(t *testing.T, ops deploy.IdentityMappingOperati
 			case "invalid generated policy":
 				spec.Args = slices.Delete(spec.Args, slices.Index(spec.Args, "--read-only"), slices.Index(spec.Args, "--read-only")+1)
 			}
-			if _, err := prepareMappedPodmanCreateV1(t.Context(), ops, pending, active, operationID, spec); err == nil {
+			if _, err := prepareMappedPodmanCreateV1(t.Context(), ops, pending, active, operationID, spec, mappedCreatePolicyFixtureV1(t)); err == nil {
 				t.Fatal("incompatible engine admitted")
 			}
 		})
@@ -446,7 +568,7 @@ func checkMappedEngineRefusalsV1(t *testing.T, ops deploy.IdentityMappingOperati
 			go server.Serve(listener)
 			defer server.Close()
 			spec.Env = []string{"DOCKER_HOST=unix://" + path, "DOCKER_CONTEXT="}
-			p, err := prepareMappedPodmanCreateV1(t.Context(), ops, pending, active, operationID, spec)
+			p, err := prepareMappedPodmanCreateV1(t.Context(), ops, pending, active, operationID, spec, mappedCreatePolicyFixtureV1(t))
 			if err != nil {
 				t.Fatal("valid preparation fixture", err)
 			}
@@ -474,7 +596,7 @@ func checkMappedEngineRefusalsV1(t *testing.T, ops deploy.IdentityMappingOperati
 
 // A selected incompatible host must fail before contacting the endpoint.
 func TestMappedPodmanCreateRejectsMissingAuthorityBeforeEngineV1(t *testing.T) {
-	if _, err := prepareMappedPodmanCreateV1(t.Context(), deploy.IdentityMappingOperationsV1{}, deploy.StateV1{}, mappedGeometryFixtureV1("exact"), "unowned", CommandSpec{Env: []string{"DOCKER_HOST=unix://" + filepath.Join(t.TempDir(), "absent.sock")}}); err == nil {
+	if _, err := prepareMappedPodmanCreateV1(t.Context(), deploy.IdentityMappingOperationsV1{}, deploy.StateV1{}, mappedGeometryFixtureV1("exact"), "unowned", CommandSpec{Env: []string{"DOCKER_HOST=unix://" + filepath.Join(t.TempDir(), "absent.sock")}}, mappedCreatePolicyFixtureV1(t)); err == nil {
 		t.Fatal("unowned create preparation succeeded")
 	}
 }
diff --git a/internal/probe/mapped_exec.go b/internal/probe/mapped_exec.go
index 6c835349..c8bb3b37 100644
--- a/internal/probe/mapped_exec.go
+++ b/internal/probe/mapped_exec.go
@@ -12,6 +12,19 @@ import (
 // inhibited. Ordinary sandbox/restricted-exec parsing does not accept it.
 const mappedCapabilityArgumentV1 = "--mapped-capabilities="
 
+// ValidateMappedSandboxArgumentsV1 lets the host use the actual startup parser
+// before creating an inhibited instance. It grants no runtime qualification.
+func ValidateMappedSandboxArgumentsV1(args []string, ceiling uint64) error {
+	plan, err := parseMappedSandboxExecPlanV1(args)
+	if err != nil {
+		return err
+	}
+	if plan.MappedCapabilities == nil || *plan.MappedCapabilities != ceiling {
+		return fmt.Errorf("mapped startup capability argument differs from selected policy")
+	}
+	return nil
+}
+
 func parseMappedSandboxExecPlanV1(args []string) (sandboxExecPlanV1, error) {
 	var ceiling *uint64
 	if len(args) > 0 && strings.HasPrefix(args[0], mappedCapabilityArgumentV1) {