Skip to main content Crate capsule_runtime Copy item path Source pub use artifact_config::configured_artifact_names ;pub use artifact_config::lower_artifact_config ;pub use artifact_config::ARTIFACT_CONFIG_ENV ;pub use artifact_config::MAX_ARTIFACT_CONFIG_BYTES ;pub use artifact_supply::SourceSupply ;pub use artifact_supply::SourcedArtifact ;pub use containment::applied_mechanism ;pub use containment::check_containment_floor ;pub use containment::containment_shortfall_reason ;pub use containment::detect_containment_decision ;pub use containment::detect_sealed_shortfall ;pub use containment::detect_userns_grant ;pub use containment::doctor_runtime_dir ;pub use containment::explain_scope ;pub use containment::install_from_places ;pub use containment::read_only_advisory_for ;pub use containment::render_install ;pub use containment::render_read_only ;pub use containment::render_records_dir ;pub use containment::render_routes ;pub use containment::render_runtime_dir ;pub use containment::render_temp_dir ;pub use containment::resolve_runtime_dir_reach ;pub use containment::resolve_runtime_dir_reaches ;pub use containment::route_table ;pub use containment::uncovered_route_warning ;pub use containment::warn_on_uncovered_routes ;pub use containment::ContainmentDecision ;pub use containment::DoctorDirReports ;pub use containment::ExportsFilesReport ;pub use containment::FilesystemBoundaryReport ;pub use containment::FilesystemRestriction ;pub use containment::ImagesReport ;pub use containment::PreopenReport ;pub use containment::PreopenSurface ;pub use containment::Route ;pub use containment::RouteInputs ;pub use containment::RouteReport ;pub use containment::RuntimeDirReach ;pub use containment::RuntimeDirReport ;pub use containment::ScopeReport ;pub use containment::ShortfallCause ;pub use containment::StateStoreReport ;pub use containment::TempDirReport ;pub use containment::UnconfinedReport ;pub use containment::HOST_PROCESS_MECHANISM ;pub use containment::UNCONFINED_APPLIES_TO ;pub use diagnostic::diagnostic_workdir ;pub use diagnostic::set_diagnostic_workdir ;pub use diagnostic::Emitted ;pub use murmur_home::usable_murmur_home ;pub use murmur_home::HomeUnusable ;pub use murmur_home::HOME_UNUSABLE_HINT ;pub use namespace_probe::MountAttempt ;pub use namespace_probe::MountAttemptError ;pub use namespace_probe::MountStep ;pub use namespace_probe::NamespaceReading ;pub use network_namespace::check_egress_namespace ;pub use network_namespace::detect_egress_namespace_failure ;pub use network_namespace::skip_without_egress_namespace ;pub use network_namespace::CreationStep ;pub use network_namespace::EgressNamespaceBlocker ;pub use network_namespace::EgressNamespaceFailure ;pub use network_namespace::NamespaceAttemptError ;pub use records_dir::records_dir_root ;pub use records_dir::records_group ;pub use records_dir::records_group_under ;pub use records_dir::RecordsDir ;pub use records_dir::HOME_SUBDIR ;pub use records_dir::HOOKS_SUBDIR ;pub use records_dir::RECORDS_DIR_ENV ;pub use records_dir::RECORDS_DIR_NAME ;pub use records_dir::RESULTS_SUBDIR ;pub use records_dir::RESULT_FILE ;pub use runtime_dir::runtime_dir_inside_warning ;pub use runtime_dir::runtime_dir_placement ;pub use runtime_dir::RuntimeDirPlacement ;pub use runtime_dir::RUNTIME_DIR_ENV ;pub use runtime_dir::RUNTIME_DIR_GUEST_PATH ;pub use session_check::copy_tree_into ;pub use session_check::walk_tree ;pub use session_check::CheckOutcome ;pub use session_check::CheckResult ;pub use session_check::CheckRunner ;pub use session_check::SessionCheck ;pub use session_check::TreeEntry ;pub use sealed::classify_installed_profile ;pub use sealed::classify_profile_attachment ;pub use sealed::inspect_installed_profile ;pub use sealed::inspect_profile_attachment ;pub use sealed::InstalledProfileState ;pub use sealed::ProfileAttachment ;pub use sealed::SealedBlocker ;pub use sealed::SealedShortfall ;pub use sealed::UsernsGrant ;pub use sealed::SEALED_APPARMOR_ATTACHMENT_PATHS ;pub use sealed::SEALED_APPARMOR_PROFILE_PATH ;pub use sealed::SEALED_APPARMOR_PROFILE_SHA256 ;pub use child_launch::child_workdir_for ;pub use child_launch::format_workdir_identity ;pub use child_launch::launch_child_capsule ;pub use child_launch::parse_workdir_identity ;pub use child_launch::ChildLaunchRequest ;pub use child_launch::LaunchedChild ;pub use child_launch::ParentWorkdirSource ;pub use child_launch::MUR_BINARY_ENV ;pub use child_launch::PARENT_WORKDIR_SNAPSHOT_FLAG ;pub use child_launch::READINESS_TOKENS_FLAG ;pub use child_launch::WORKDIR_IDENTITY_FLAG ;pub use delegation::CompletionAddress ;pub use delegation::Spawner ;pub use delegation::SpawnerHandle ;pub use delegation_plane::DelegationLaunch ;pub use delegation_plane::DelegationOrigin ;pub use delegation_plane::DelegationPlane ;pub use delegation_plane::DelegationRequest ;pub use delegation_plane::DelegationResult ;pub use delegation_plane::StartedDelegation ;pub use delegation_plane::DELEGATION_RESULT_TIMEOUT ;pub use delegation_plane::DELEGATION_TIMEOUT_ENV ;pub use door_auth::door_posture ;pub use door_auth::is_loopback_bind ;pub use door_auth::public_door_bind_warning ;pub use door_auth::public_door_warning ;pub use door_auth::render_public_door_warning ;pub use door_auth::AuthRefusal ;pub use door_auth::DoorAuth ;pub use door_auth::DoorExposure ;pub use door_auth::DoorGrant ;pub use door_auth::DoorToken ;pub use door_auth::PublicDoorDisclosure ;pub use door_auth::DOOR_TOKEN_ENV ;pub use errors::RuntimeError ;pub use errors::UnreachableEntrypoint ;pub use formation::FormationId ;pub use formation::FormationPeer ;pub use formation::FormationPeers ;pub use formation_credentials::FormationAuthority ;pub use formation_credentials::FormationBundle ;pub use formation_credentials::FormationMember ;pub use formation_credentials::FormationToken ;pub use formation_credentials::FormationVerifier ;pub use formation_credentials::FormationVerifyKey ;pub use formation_credentials::FORMATION_CALL_SCOPES ;pub use formation_credentials::FORMATION_CHANNEL_ENV ;pub use host_warnings::host_warnings_reported ;pub use host_warnings::host_warnings_reported_in ;pub use host_warnings::HOST_WARNINGS_REPORTED_ENV ;pub use lanes::TaskLane ;pub use lifeline::ChildLifeline ;pub use lifeline::FormationLifeline ;pub use lifeline::MemberLifeline ;pub use lifeline::SpawnerLifeline ;pub use lifeline::FORMATION_LIFELINE_ENV ;pub use lifeline::SPAWNER_LIFELINE_ENV ;pub use limits::ExecutionLimits ;pub use origin::TaskOrigin ;pub use origin::TaskProvenance ;pub use origin::TrustClass ;pub use peer_handoff::audience_from_card ;pub use peer_handoff::handle_id ;pub use peer_handoff::handle_peer_request ;pub use peer_handoff::is_peer_path ;pub use peer_handoff::mint ;pub use peer_handoff::stored_path_for ;pub use peer_handoff::verify ;pub use peer_handoff::HandleError ;pub use peer_handoff::HandlePayload ;pub use peer_handoff::MintedHandle ;pub use peer_handoff::PeerError ;pub use peer_handoff::PeerMintKey ;pub use peer_handoff::PeerPlane ;pub use peer_handoff::HANDLE_ID_HEADER ;pub use peer_handoff::PEER_INBOX_DIR ;pub use peer_handoff::PEER_PATH_PREFIX ;pub use registration::check_roost_health ;pub use registration::deregister_session ;pub use registration::register_session ;pub use registration::SessionOutcome ;pub use resource_plane::check_export_root ;pub use resource_plane::check_peer_files_root ;pub use resource_plane::handle_resource_request ;pub use resource_plane::reason_phrase ;pub use resource_plane::symlink_policy ;pub use resource_plane::DeclaredExport ;pub use resource_plane::ListEntry ;pub use resource_plane::ListResponse ;pub use resource_plane::ReadResponse ;pub use resource_plane::ResourceError ;pub use resource_plane::ResourcePlane ;pub use resource_plane::ResourceResponse ;pub use resource_plane::SymlinkPolicy ;pub use resource_plane::RESOURCE_PATH_PREFIX ;pub use resources::HostResourceLimits ;pub use retention::find_context_dirs ;pub use retention::list_records ;pub use retention::locate_message ;pub use retention::prune_records ;pub use retention::prune_sessions ;pub use retention::read_context_dir ;pub use retention::remove_record ;pub use retention::truncate_record ;pub use retention::ContextContents ;pub use retention::ContextDir ;pub use retention::HarnessSessionEntry ;pub use retention::MessageLocation ;pub use retention::MessageStatus ;pub use retention::PrunedRecord ;pub use retention::PrunedSession ;pub use retention::RecordSummary ;pub use retention::RemovedRecord ;pub use retention::TruncationMarker ;pub use retention::TruncationOutcome ;pub use roster::admit_roster ;pub use roster::admit_roster_file ;pub use roster::caller_overflow_fix ;pub use roster::caller_overflow_warning ;pub use roster::AdmittedMember ;pub use roster::AdmittedRoster ;pub use roster::CallerOverflow ;pub use roster::RosterEdge ;pub use roster::RosterRefusal ;pub use running::Liveness ;pub use running::ProcessState ;pub use running::RunningGuard ;pub use running::RunningRecord ;pub use running::SignalOutcome ;pub use runtime::check_env_allow_reaches_guests ;pub use runtime::check_no_reserved_tool_names ;pub use runtime::has_subprocess_route_at_staging ;pub use runtime::launch_session ;pub use runtime::launch_session_handling_sigterm ;pub use runtime::secret_shaped_env_grants ;pub use runtime::stage_session ;pub use runtime::stripped_env_allow_entries ;pub use runtime::undeclarable_runtime_pin_role ;pub use runtime::warn_on_gateway_endpoint_in_network_allow ;pub use runtime::warn_on_interpreter_runtime_grants ;pub use runtime::warn_on_launch_only_gateway_credential ;pub use runtime::warn_on_secret_shaped_env_grants ;pub use runtime::warn_on_unmetered_gateways ;pub use runtime::warn_on_userns_restriction_disabled_host_wide ;pub use runtime::warn_on_workdir_exec ;pub use runtime::SecretShapedEnvGrant ;pub use runtime::StrippedEnvAllowEntry ;pub use spawn_credential::SpawnApproval ;pub use spawn_credential::SpawnCredential ;pub use spawn_envelope::EnvelopeAxis ;pub use spawn_envelope::EnvelopeViolation ;pub use spawn_envelope::SpawnEnvelope ;pub use staged_runtime::check_staged_runtime_floor ;pub use state_store::ensure_state_store ;pub use state_store::state_store_reports ;pub use state_store::validate_store_name ;pub use state_store::STATE_PREOPEN_NAME ;pub use types::capability_policy_from_runtime_manifest ;pub use types::ArtifactRequest ;pub use types::CapabilityPolicy ;pub use types::InstalledArtifactSummary ;pub use types::LaunchEnding ;pub use types::LaunchResult ;pub use types::LockExpectation ;pub use types::ResolvedLockArtifact ;pub use types::ResumeMode ;pub use types::ResumeRequest ;pub use types::StageRequest ;pub use types::StagedSession ;pub use workdir_fs::EntryKind ;pub use workdir_fs::RefusalReason ;pub use workdir_fs::WorkdirError ;pub use workdir_fs::WorkdirOperation ;pub use workdir_fs::WorkdirRefusal ;pub use workdir_fs::WorkdirRoot ;pub use runtime_dir::SESSION_ID_PLACEHOLDER ;pub use workdir_snapshot::copy_workdir ;pub use workdir_snapshot::ParentWorkdirReport ;pub use workdir_snapshot::SkipReason ;pub use workdir_snapshot::SkippedEntry ;pub use workdir_snapshot::SnapshotError ;pub use workdir_snapshot::SnapshotLimits ;pub use workdir_snapshot::WorkdirSnapshot ;pub use workdir_writes::render_runtime_writes ;pub use workdir_writes::RuntimeWriteCondition ;pub use workdir_writes::RuntimeWriteKind ;pub use workdir_writes::RuntimeWriteReport ;artifact artifact_config Operator-authored per-artifact configuration: the config: block on an artifact’s entry in
the capsule operator’s own manifest, lowered to compact JSON and delivered to that artifact
alone as ARTIFACT_CONFIG_ENV artifact_supply Where a runtime pull finds an artifact the session’s stores do not hold. background_command The runtime-provided background-command tool: the state of a shell command that was moved
to the background, a wait for it, or a stop of it, named by the work id its shell call
returned. bindings child_launch Launching a delegated child as an operating-system process of the parent’s own runtime. containment Containment classes: what an operator declares versus what a session actually achieves . delegation Which capsule delegated to this one, and how a delegated child says that it finished. delegation_plane Handing one task to one sub-capsule, and learning what became of it. detached Shell commands that were moved out of the foreground and run on in the background. diagnostic The runtime’s one way to write a line to standard output or standard error. door_auth Who may call the A2A door: the tokens a capsule declaring network.authentication mints at
launch, the check every gated request passes, and the refusals it answers with. errors formation The formation a session belongs to, and the one id that names it. formation_credentials Who in a formation may call whom: the credential a formation launcher issues for each roster
edge, the check every member’s door makes, and the channel a member’s runtime is handed its
credentials and its callees’ addresses on. formation_launch Launching a formation: every member of an admitted roster as a mur run subprocess of its own,
peers first and the entry member last, and every member stopped once the entry member’s process
has ended. guest_roots The host folders a WASM tool is handed beyond the work folder: its extra roots . host_paths Host folders the operator lends every contained capsule on this host: the host_paths: list in
~/.murmur/config.yaml. host_warnings Host-level warnings: stated once per launch, not once per process. lanes Which queued task runs next. lifeline Lifelines: pipes through which a process learns that another process it depends on has ended. limits Per-guest execution limits: epoch-based deadlines and store resource caps. mac_token One opaque token grammar, and the memory-only key that seals it. model_limits Each driver choice’s per-turn output cap, context window, input ceiling and input budget,
resolved once at launch. murmur_home The murmur home, ~/.murmur, and the modes of what it holds. namespace_probe The one place the host’s namespaces are probed. network_namespace The capsule’s own network namespace: the structural half of the mechanism that replaced the
seccomp-notify connect/sendto supervisor. origin Why a task woke the capsule, and how far its content is trusted. peer_handoff Peer file handoff: runtime-minted handles over a two-sided grant. plan precompile Compiling WASM artifacts ahead of their first launch. process_driver Loading a process driver: the artifact a transport: process manifest names under
inference.driver, which knows how to drive one harness CLI. provider_tool Tools that are a provider’s own tools, and the safety checks a driver attaches to a call. records_dir The session’s records directory: every record the runtime writes about a session, outside the
workdir the capsule’s commands can write, and kept after the session ends. registration What a session tells mur-roost about itself at launch, and what it is handed back. resource_plane The resource plane: the read-only file surface a capsule declares under exports.files. resources Host-process resource bounds for every native subprocess this runtime spawns. retention Retention: what bounds the three stores that grow, and what it costs to bound them. roster Roster admission: a parsed roster.yaml checked against the stores and the project’s
murmur.lock, and either bound to exact artifacts with its reachability expanded into edges, or
refused whole. running The machine-wide map of capsules that are currently running: one record per session, at
~/.murmur/running/<session_id>.json. An agent session writes its record once its A2A door is
bound and names the door in url; a script capsule binds no door, writes its record when its
session starts, and holds "url": null. runtime runtime_dir The session’s runtime directory: every file the runtime writes for its own use, outside the
workdir the capsule’s commands can write. sealed The sealed containment mechanism: a private mount namespace pivoted onto a composed root. security Process-level hardening against the /proc/<pid>/environ side channel. session_check One command run in a session’s work folder after the session has ended, under the containment
the session’s own commands had: what mur eval run judges a case’s work by. session_status Where an agent session stands: what the runtime-provided session-status tool reports, the
hard deadline a session runs under, and the one notice an agent is given before it. spawn_credential The two secrets a delegated spawn travels on, and the headers they travel in. spawn_envelope The capability ceiling a spawned capsule must fit inside, and the comparison that refuses one
that does not. staged_runtime capabilities.shell.staged_runtime: staging a pinned host runtime tree into a capsule root.state_store Durable, capsule-scoped state stores: ~/.murmur/state/<store>/, granted per artifact by
capabilities.state and mounted into a guest as a second WASI preopen named
STATE_PREOPEN_NAMESTATE_DIR_ENV temp_dir The session’s temporary folder: tmp/ in the session’s records directory, which every shell
command, plan shell step and native tool reaches as $TMPDIR, $TMP and $TEMP, and on Linux
as a literal /tmp wherever the host can give a command a private mount namespace. tool_names The tool name of an artifact inside one staged session. types workdir_fs Every runtime write, append, create, removal and decision-read inside a capsule’s workdir,
performed relative to a held directory descriptor with no symbolic link followed. workdir_snapshot Copying a delegating capsule’s work folder into a delegated child’s own, before the child
process starts. workdir_writes What the runtime itself writes inside the capsule’s work folder, declared rather than
discovered. report_eprint eprint! for report output, through report_to_stderrreport_eprintln eprintln! for report output, through report_to_stderrreport_print print! for report output, through report_to_stdoutreport_println println! for report output, through report_to_stdout().runtime_err runtime_out!eprintln!. See to_stderrruntime_out Write a formatted line to standard output, falling back to logs/bootstrap.log. BackstopMatch The pattern that makes the credential backstop drop a name, verbatim, and where it came from. CgroupScopeReport What became of this session’s cgroup scope, carried into --explain-scope, into
session_start.effective_grants.cgroup_scope and into mur doctor’s cgroup scope: line. DerivedInterpreterRuntime What staging derived for one allowlisted interpreter. DoneCheck lifecycle.done_check: the command whose exit status says whether a task’s work is done, and
how many times per task a failing run may reopen the task; see LifecycleConfig::done_checkHostFactsCache Where stagings keep host facts: ~/.murmur/host_facts, or a directory a test names. HostFactsKept How many allowlisted binaries keep_host_facts HostFactsUse One examined binary, and where this staging’s facts about it came from. HostProbe The host facts the tier decision is made from, taken together as one reading. InterpreterRuntimes What one staging derived for its allowlisted binaries. IoMaxReport The declared I/O ceiling and what became of it, carried into --explain-scope, into
session_start.effective_grants and into W-SEC-021. KeepWorking lifecycle.keep_working: what the runtime sends when a task’s attempt ends at a turn end, and
how many times per task it does so. Both fields are required; see
LifecycleConfig::keep_workingLifecycleConfig LifecycleOverride Lifecycle override: allows a parent (mur-roost) or CLI flag to constrain
the lifecycle down from what the manifest declares. PlanTraceAppender A third O_APPEND handle to the session’s trace.jsonl, held by a plan run. ResourceTraceAppender A second, independent O_APPEND handle to the session’s trace.jsonl, used by the resource
plane, by the peer plane’s listener, and by the peer-handoff tools in the agent loop. ScopeProbe What probe_scopeio.max ceiling would apply on it. ToolchainHelperReport Everything warn_on_unreachable_toolchain_helpersunprobed. ToolchainHelperWarning One compiler driver whose helper subprocess has no Execute-carrying grant under sealed. TrustStorePath One host path staging granted as part of the trust store. UnprobedToolchainDriver One compiler driver whose -print-prog-name= probe could not be run, so W-SEC-012 was not
evaluated for the helpers named in unchecked_helpers. A2aError The A2A errors, A2A v1.0 §5.4, in code order. AfterTask BackstopPatternSource Which list a credential backstop pattern came from. CgroupScopeStatus Whether this session’s subprocesses get a delegated cgroup v2 scope, the precondition every
capsule that can run a native subprocess is refused without (E-RUN-012). HostFactsReason Why a binary’s facts were worked out instead of kept. HostFactsSource IoMaxStatus Whether the declared capabilities.resources.cgroup_io_bytes_per_sec ceiling is actually on
this session’s cgroup scope. MurmurError The errors a door answers a completion with: murmur’s own protocol riding on SendMessage
with x-murmur-task-origin: completion, so none of them is an A2A error. SwapControl Whether this kernel gives a cgroup a memory.swap.max to write, as mur doctor reports it. TaskAcceptance A2A_EXTENSIONS_HEADER The HTTP header a client activates A2A extensions in, and the header a response lists the
extensions it activated in. Matched case-insensitively. A2A_PROTOCOL_VERSION The one A2A protocol version the door speaks, and the value every murmur client sends in
A2A_VERSION_HEADER A2A_VERSION_HEADER The HTTP header an A2A request names its protocol version in. Matched case-insensitively. SCOPE_SWAP_MAX memory.swap.max for every scope: no swap at all.SERVED_WIT_PACKAGES Every murmur:* WIT package declared under crates/capsule-runtime/wit/, paired with the one
version of it this host links and resolves, sorted by package name. STREAM_EXTENSION_URI URI of the agent-card extension that lists the murmur frames the capsule’s stream can write,
and the A2A-Extensions value a client sends to receive them. It is the address of that
extension’s section in the reference docs, on the streaming protocol page beside the frames it
names. Every murmur frame on the wire sits under metadata keyed by this URI. WIT_LEVELS_FILE The repository path of the committed WIT level table, for messages that name it. active_swap_areas How many swap areas /proc/swaps lists as active, or None where it cannot be read. capsule_writable_roots The trees a session placed at placement lets its commands write, as
derive_interpreter_runtimes cgroup_delegation_available Whether this host can hand the runtime a delegated cgroup v2 scope — the precondition
[prepare_scope] fails closed on. check_interpreted_entrypoints_reachable Refuses a sealed capsule whose capabilities.shell.allow names a script that nothing
declared could make importable inside the composed root. credential_backstop_drops Whether the credential backstop would drop a variable of this name — the same question
[strip_credential_shaped_vars] answers per entry, asked of a name alone. See
credential_backstop_match credential_backstop_match The first credential backstop pattern that matches name, or None when the backstop keeps
it — the one decision procedure behind [strip_credential_shaped_vars],
credential_backstop_dropsW-SEC-024 and the E-CAP-016 staging refusal. derive_interpreter_runtimes The runtime directories of each shell_allow binary that is a recognised interpreter. derive_trust_store The trust-store paths this host has, for a capsule allowlisting shell_allow and reaching
network_allow: empty unless both are non-empty. detect_landlock_abi The kernel’s Landlock ABI version, or None when there is no Landlock (off Linux always), from
a reading taken here. explain_scope_probe What mur run --explain-scope reports for policy’s cgroup scope and io.max, on the terms
a launch reports them: probe_scopecgroup_* field, else the probe with io.max written
only when cgroup_io_bytes_per_sec is declared. find_on_path The first executable named binary on this process’s PATH, or None when there is none. io_max_device_available Whether the filesystem behind path has a block device an io.max ceiling can name. keep_host_facts Fills cache with the entries derive_interpreter_runtimes landlock_doctor_lines The lines mur doctor prints under its Landlock heading for a kernel reporting
kernel_abi: what the kernel offers, what the runtime builds at, and what a capsule loses on
this host below [LANDLOCK_TARGET_ABI]. murmur_state_name Murmur’s word for the A2A v1.0 task state wire, or None for TASK_STATE_UNSPECIFIED and
anything that is not a v1.0 state name. preopen_reports The filesystem surface each of the given artifacts will be preopened into, resolved but not
opened, one entry per artifact that has a guest. probe_scope Answers “would a launch get its cgroup scope here, and would the declared io.max ceiling
apply on it?” by doing what a launch does, against a throwaway cgroup created and removed
inside this call: [delegated_base], then the scope directory through the same
[create_scope_dir] [prepare_scope] calls, then the io.max write. probe_swap_control Probe whether this kernel exposes memory.swap.max, without creating or moving anything. render_cgroup_scope The cgroup scope: line --explain-scope and mur doctor print, without indentation or a
trailing newline, so the two cannot word one answer differently. requires_process_bounding Does this policy give the capsule any way to run a native subprocess at all? served_wit_level The WIT level this host serves: the newest level in WIT_LEVELS_FILE skip_without_host_support Whether a test that launches a subprocess-capable capsule must stand down on this host,
printing the blocker when it must. warn_on_unreachable_toolchain_helpers Warns (W-SEC-012, non-fatal, once per uncovered helper) when a sealed capsule allowlists a
known compiler driver whose helper binaries have no grant carrying the Landlock Execute
right. Returns what it warned about so the decision is assertable without capturing stderr. wit_levels Every committed WIT level, oldest first, parsed once from WIT_LEVELS_FILE