@@ -392,6 +392,14 @@ How to run it:
 
 Without `VINAYA_SANDBOX_CONFORMANCE=1`, an ordinary run of the test file runs only the command-list checks.
 
+### The credential-confinement probes — inside the Engine launch shape
+
+<!-- AEG:CLAIM: apps/cli/tests/sandbox-conformance/engine-attack-probes.ts contains:export const CREDENTIAL_PROBES -->
+<!-- AEG:CLAIM: apps/cli/tests/sandbox-conformance/sandbox-launch.ts contains:export function openEngineSandboxSession( -->
+The standalone conformance suite above launches each command from the standalone dispatch's own settings. A role the Engine runs launches from a different shape — Claude Code from the settings the Engine generates, Codex from the `config.toml` its generated `CODEX_HOME` holds — so a standalone denial says nothing about the Engine path. The credential-confinement rows of the fault-and-attack matrix are proved on the Engine shape by their own probes (`engine-attack-probes.ts`): each row has one command that reaches for the route it names, run inside the launch shape the Engine generates for a role, once under Claude Code and once under Codex (`openEngineSandboxSession`), through the same launch-env allowlist the Engine's own pre-spawn probe uses. The probes run against a throwaway home whose credential files hold only a generated canary — never the operator's real files — and report a leak as a boolean, so a failed run never prints a credential. A role granted no shell can run no probe at all, which that role asserts; a role with a shell runs every probe.
+
+Without the variable, the suite checks statically that every gate-14 row (worktree code, the system credential store, the git credential helper, the SSH agent) has a probe command and that the settings the Engine generates for every role carry the deny rule each adapter's launch shape can carry — or, where it cannot, that the row is recorded owed. Claude Code denies a file route through `filesystem.denyRead` and the Read tool's own `permissions.deny`; an ambient credential variable is closed for both adapters by the launch-env allowlist, which passes only `PATH`/`HOME`/`USER`/`LOGNAME` (Codex's `shell_environment_policy.filters` keeps the same variables out of a role's commands as a second layer). Codex's legacy sandbox, which the Engine's Codex launch requires (`sandbox_mode`), denies no file read: a credential-store file stays readable to a Codex role, so every file-route row stays owed on Codex with that reason recorded, never marked proved. The part of a gate-14 route Codex can still deny — the forge tokens, the askpass prompts, the SSH agent's pointer and the keyring's session bus, kept out by the env filter — is checked in every Codex role's generated config, so dropping one filter fails the check. The live run plants a real SSH agent holding a canary-commented key at the socket's default path under the throwaway home, so a role that reaches the agent without any variable is caught. An egress-containment row, which no sandbox setting expresses, stays owed on both adapters. A credential row leaves the owed list only when a pull request carries the pasted output of the probe run with the variable set, on Linux and on a Mac, under both adapters.
+
 ## 10. Required sources and their receipts — outside every worker's writable roots
 
 <!-- AEG:CLAIM: apps/cli/src/lib/source-manifest.ts contains:return runPath(runtimeDir, scope, { area: 'control', file: SOURCE_STORE_DIRNAME }) -->
 
@@ -15,6 +15,12 @@ import {
   suiteId
 } from '../../src/lib/dev-review-eval/registry'
 import { engineEvidenceOf, OPERATOR_EXIT_EXCLUSIONS } from '../../src/lib/dev-review-eval/exit-check'
+import {
+  CODEX_FILE_READ_RESIDUAL,
+  CREDENTIAL_PROBES,
+  CREDENTIAL_ROW_IDS,
+  OWED_REASONS
+} from '../sandbox-conformance/engine-attack-probes'
 import {
   FAULT_ATTACK_HEADING,
   type FaultAttackEntry,
@@ -300,6 +306,59 @@ describe('the fault-attack check fails on what it must', () => {
   })
 })
 
+describe('the credential-confinement rows record Engine evidence, owed shrink-only', () => {
+  const owedList = JSON.parse(readFileSync(join(import.meta.dir, 'engine-evidence-owed.json'), 'utf8')) as {
+    owed: string[]
+  }
+  const byId = new Map(loaded.value.components.map((entry) => [entry.row.id, entry.row]))
+
+  it('lists every credential row and fails while any has no recorded Engine evidence, printing the owed count', () => {
+    // "Recorded" is a live-gated test entry or a stated owed reason; a row with no entry names itself in the failure.
+    const unrecorded = CREDENTIAL_ROW_IDS.filter((id) => {
+      const row = byId.get(id)
+      return row === undefined || engineEvidenceOf(row) === undefined
+    })
+    expect(unrecorded).toEqual([])
+    const owed = CREDENTIAL_ROW_IDS.filter((id) => owedList.owed.includes(id))
+    // The owed list only shrinks under engine-evidence.test.ts's ceiling; this prints where the credential rows stand.
+    console.log(`credential-confinement Engine evidence: ${owed.length} of ${CREDENTIAL_ROW_IDS.length} rows owed`)
+  })
+
+  const cutoverOf = new Map(
+    rawShard.components.map((row) => [row.id, (row.faultAttack as { cutover?: string }).cutover])
+  )
+
+  it('records, for each pass-or-accepted credential row, denial on both adapters or its residual risk', () => {
+    for (const probe of CREDENTIAL_PROBES) {
+      const id = `fault-attack:${probe.row}`
+      if (cutoverOf.get(id) !== 'pass-or-accepted') continue
+      const row = byId.get(id)
+      if (row === undefined) throw new Error(`no row for ${probe.row}`)
+      const deniedBoth = Object.values(probe.byAdapter).every((d) => d.kind !== 'owed')
+      const state = engineEvidenceOf(row)
+      const namesResidual = state?.state === 'owed' && state.reason === CODEX_FILE_READ_RESIDUAL
+      expect(deniedBoth || namesResidual).toBe(true)
+    }
+  })
+
+  it('records a recognized owed reason on each credential row an adapter cannot deny, and the ruling reason where it applies', () => {
+    for (const probe of CREDENTIAL_PROBES) {
+      const owedReasons = Object.values(probe.byAdapter)
+        .filter((d) => d.kind === 'owed')
+        .map((d) => (d as { reason: string }).reason)
+      if (owedReasons.length === 0) continue
+      const row = byId.get(`fault-attack:${probe.row}`)
+      const state = row === undefined ? undefined : engineEvidenceOf(row)
+      expect(state?.state).toBe('owed')
+      if (state?.state === 'owed') {
+        expect([...OWED_REASONS]).toContain(state.reason)
+        // The row's recorded owed reason is one its probe's own adapters name — never a reason from elsewhere.
+        expect(owedReasons).toContain(state.reason)
+      }
+    }
+  })
+})
+
 /** The run-control and governed-effects rows the Engine runner's fault-injection scenarios prove, under both vendors. */
 const ENGINE_FAULT_INJECTION_ROWS = [
   'fault-attack:03-controller-process-death',
 
@@ -1143,7 +1143,7 @@
           "owed": "No test that names this row's full id proves it on the standalone backend yet."
         },
         "engine": {
-          "owed": "No test that names this row's full id proves it on the Engine backend yet."
+          "owed": "Codex denies credential reads only through a beta permission profile, which is ignored while sandbox_mode is set; the Engine’s Codex launch requires sandbox_mode."
         }
       },
       "decisionRule": "Must pass: green on the Engine backend before cutover. No known-failure entry is admitted for this row.",
@@ -1198,7 +1198,7 @@
           "owed": "No test that names this row's full id proves it on the standalone backend yet."
         },
         "engine": {
-          "owed": "No test that names this row's full id proves it on the Engine backend yet."
+          "owed": "Reads are open by design and no sandbox setting inspects outbound content; proving a planted canary never leaves needs an outbound-capture harness this probe does not run."
         }
       },
       "decisionRule": "Must pass: green on the Engine backend before cutover. No known-failure entry is admitted for this row.",
@@ -1253,7 +1253,7 @@
           "owed": "No test that names this row's full id proves it on the standalone backend yet."
         },
         "engine": {
-          "owed": "No test that names this row's full id proves it on the Engine backend yet."
+          "owed": "Codex denies credential reads only through a beta permission profile, which is ignored while sandbox_mode is set; the Engine’s Codex launch requires sandbox_mode."
         }
       },
       "decisionRule": "Must pass: green on the Engine backend before cutover. No known-failure entry is admitted for this row.",
@@ -1803,7 +1803,7 @@
           "owed": "No test that names this row's full id proves it on the standalone backend yet."
         },
         "engine": {
-          "owed": "No test that names this row's full id proves it on the Engine backend yet."
+          "owed": "Codex denies credential reads only through a beta permission profile, which is ignored while sandbox_mode is set; the Engine’s Codex launch requires sandbox_mode."
         }
       },
       "decisionRule": "Must pass: green on the Engine backend before cutover. No known-failure entry is admitted for this row.",
@@ -1858,7 +1858,7 @@
           "owed": "No test that names this row's full id proves it on the standalone backend yet."
         },
         "engine": {
-          "owed": "No test that names this row's full id proves it on the Engine backend yet."
+          "owed": "Codex denies credential reads only through a beta permission profile, which is ignored while sandbox_mode is set; the Engine’s Codex launch requires sandbox_mode."
         }
       },
       "decisionRule": "Must pass: green on the Engine backend before cutover. No known-failure entry is admitted for this row.",
@@ -1913,7 +1913,7 @@
           "owed": "No test that names this row's full id proves it on the standalone backend yet."
         },
         "engine": {
-          "owed": "No test that names this row's full id proves it on the Engine backend yet."
+          "owed": "Codex denies credential reads only through a beta permission profile, which is ignored while sandbox_mode is set; the Engine’s Codex launch requires sandbox_mode."
         }
       },
       "decisionRule": "Must pass: green on the Engine backend before cutover. No known-failure entry is admitted for this row.",
@@ -2188,7 +2188,10 @@
           "owed": "No test that names this row's full id proves it on the standalone backend yet."
         },
         "engine": {
-          "owed": "No test that names this row's full id proves it on the Engine backend yet."
+          "test": "apps/cli/tests/sandbox-conformance/sandbox-conformance.test.ts",
+          "liveGated": {
+            "variable": "VINAYA_SANDBOX_CONFORMANCE"
+          }
         }
       },
       "decisionRule": "Must pass: green on the Engine backend before cutover. No known-failure entry is admitted for this row.",
@@ -2903,7 +2906,7 @@
           "owed": "No test that names this row's full id proves it on the standalone backend yet."
         },
         "engine": {
-          "owed": "No test that names this row's full id proves it on the Engine backend yet."
+          "owed": "Residual risk: Codex’s legacy sandbox settings deny no file read, so a credential-store file stays readable to a Codex role; recorded for the Principal’s cutover acceptance."
         }
       },
       "decisionRule": "Pass or accepted: the test runs and its result is recorded; the Engine path either holds the boundary or the residual risk is stated. A residual risk needs the Principal's explicit acceptance in the cutover authorization evidence (gate 17, §6.24). The test keeps running either way.",
@@ -3068,7 +3071,7 @@
           "owed": "No test that names this row's full id proves it on the standalone backend yet."
         },
         "engine": {
-          "owed": "No test that names this row's full id proves it on the Engine backend yet."
+          "owed": "Reads are open by design and no sandbox setting inspects outbound content; proving a planted canary never leaves needs an outbound-capture harness this probe does not run."
         }
       },
       "decisionRule": "Must pass: green on the Engine backend before cutover. No known-failure entry is admitted for this row.",
@@ -3178,7 +3181,7 @@
           "owed": "No test that names this row's full id proves it on the standalone backend yet."
         },
         "engine": {
-          "owed": "No test that names this row's full id proves it on the Engine backend yet."
+          "owed": "Residual risk: Codex’s legacy sandbox settings deny no file read, so a credential-store file stays readable to a Codex role; recorded for the Principal’s cutover acceptance."
         }
       },
       "decisionRule": "Pass or accepted: the test runs and its result is recorded; the Engine path either holds the boundary or the residual risk is stated. A residual risk needs the Principal's explicit acceptance in the cutover authorization evidence (gate 17, §6.24). The test keeps running either way.",
 
@@ -52,6 +52,9 @@ export const SUITE_INPUTS: readonly string[] = [
   // The driver code that builds each agent's sandbox settings.
   'apps/cli/src/lib/dispatch.ts',
   'apps/cli/src/lib/worker-boundary.ts',
+  // The Engine's own launch-shape generators and the launcher the credential probes run inside.
+  'harness/adapters/agents/',
+  'processes/vinaya/executing/',
   'apps/cli/src/lib/task-tools/dev-tools-registration.ts',
   // Where the task's required-source store lives, which both sandboxes must not write.
   'apps/cli/src/lib/source-manifest.ts',