Function bubblewrap_args 

pub fn bubblewrap_args(
    inputs: &SandboxInputs,
    binary: &Path,
    args: &[String],
) -> Result<Vec<String>>

Build the bubblewrap argv tail for running binary args under the resolved sandbox. The caller uses program bwrap and passes this vector as args.

Write scope mirrors the Seatbelt profile: the whole filesystem is bound read-only, then session_cwd, the session-private scratch tmpdir, and each extra_write entry are bound writable — the mission dir and the shared system temp root are NOT writable (ticket sandbox-writable-scope). Mission metadata that an rw ancestor bind would otherwise cover (checkout mode) is masked back out, the bwrap analogue of the profile’s write deny; the operator’s real Cargo registry/git caches get explicit stacked ro-binds for the same reason (13th-pass review — they stay readable, a linked cache is the session’s registry, but never writable).

Mandatory validator containment (ticket validator-mandatory-containment — the bwrap analogue of the profile’s validator read-deny block): when SandboxInputs::validator_read_deny_roots is non-empty, each top-level source-tree entry of those roots ([validator_read_deny_entries]) is masked — directories shadowed by an empty tmpfs, files by a /dev/null ro-bind — so the whole-fs ro-bind no longer exposes the real checkout’s contents. The .git/.kranz carve-outs stay (git needs the shared object store; the snapshot lives under .kranz). The root’s own directory LISTING stays visible on both tiers (names, never contents): bwrap cannot close it without masking the carve-outs, and the Seatbelt side declines to (a literal deny on the root breaks mkdir -p under the snapshot). /dev/null needs no allow here — the bwrap argv mounts a real /dev (--dev /dev).