diff --git a/SECURITY.md b/SECURITY.md
index d3faa07c..7a4123e2 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -15,11 +15,13 @@ execute hostile projects or hostile instructions safely.
   under the canonical workspace root, including through existing symlinks;
   newly created workspace symlinks may not target paths outside that root.
   Lexical inspection cannot prove every indirect effect of an arbitrary
-  program, so when an OS write sandbox is available it also confines the writes
-  performed inside a command or script (see [OS Write Sandbox](#os-write-sandbox)).
-  Bash is not a complete sandbox: shell commands and invoked programs still run
-  as the current OS user, reads and network are not confined in this stage, and
-  the sandbox is absent when the backend is unavailable.
+  program, so when an OS sandbox is available it also confines the writes and
+  the home-credential reads performed inside a command or script (see
+  [OS Write and Read Sandbox](#os-write-and-read-sandbox)). Bash is not a
+  complete sandbox: shell commands and invoked programs still run as the current
+  OS user, network is not confined in this stage, read confinement covers the
+  home secret locations rather than every workspace credential on every
+  platform, and the sandbox is absent when the backend is unavailable.
 
 ## `--allow` and `--yes`
 
@@ -49,13 +51,13 @@ predated the run.
 programs and therefore is not a network sandbox. Network isolation is a later
 stage of #502 and is independent of the write sandbox below.
 
-## OS Write Sandbox
+## OS Write and Read Sandbox
 
-`--sandbox auto|required|off` (default `auto`) adds an OS-level write sandbox at
-the two `sh -c` launch points: the model Bash tool (the `bash:verify` interval
-reuses the same function) and the verification/acceptance commands. The sandbox
-is defense in depth; the lexical checks still run first and can refuse a command
-before the shell starts.
+`--sandbox auto|required|off` (default `auto`) adds an OS-level write sandbox and
+a home-credential read sandbox at the two `sh -c` launch points: the model Bash
+tool (the `bash:verify` interval reuses the same function) and the
+verification/acceptance commands. The sandbox is defense in depth; the lexical
+checks still run first and can refuse a command before the shell starts.
 
 - What the OS closes (when the backend is available): a write performed inside a
   command or script that the lexical guard cannot see — `sh -c 'cp ...'`,
@@ -63,11 +65,39 @@ before the shell starts.
   `sed -i` — and creating a hardlink to an inode outside the workspace. The only
   writable locations are the workspace, the run's temp directory, the known
   dependency caches, and device files such as `/dev/null`.
-- What remains lexical-only: reads, network access, and every command run while
-  the backend is unavailable. `--allow bash:verify` and `--offline` are lexical
+- Read confinement (Issue #657) denies reading the home secret locations
+  (`.ssh`, `.aws`, `.gnupg`, `.netrc`, `.git-credentials`, `.npmrc`, `.pypirc`,
+  `.docker/config.json`, `.kube`, `.config/gh`, `.config/gcloud`) and, on macOS,
+  a workspace credential named by the #501 rule (`.env`, `.env.*`, `.envrc`,
+  `.npmrc`, `.pypirc`, `.netrc`, `.git-credentials`, `.ssh`, `service-account*.json`,
+  `*.private.key`, `*.private.pem`, `*.p12`, `*.pfx`); the three strict dotenv
+  templates (`.env.example`, `.env.sample`, `.env.template`) stay readable. The
+  list lives in one leaf module (`src/tools/os_sandbox/secret_locations.rs`) that
+  both backends import. Denial is decided by name and path: it closes a
+  credential reached through a non-secret symlink, a file named by an environment
+  variable such as `BASH_ENV`, and a name an interpreter assembles at run time
+  when that assembled name is itself a denied name. It does not deny a new name:
+  on macOS, renaming a credential inside the writable workspace, or copying it to
+  another name, leaves the credential readable under the new name.
+  - A secret reached from an off-list path through a bind mount, or through a
+    hardlink created outside the isolation, is not denied on either OS. Creating
+    such a hardlink inside the isolation is denied by the write sandbox.
+  On Linux only the home secret locations are denied: a workspace credential is
+  closed lexically for a named reference, and a non-secret symlink to it is not
+  closed by the read layer (decision 4 of #502). Linux rewrites the deny list as
+  a read-allow list rebuilt at each command's start, so a location created after
+  a command starts is not readable inside that command; listing a directory the
+  run did not allow fails by design: `ls /`, `ls $HOME`, and `echo $HOME/*` do
+  not work (the home's siblings are allowed, but `/` and `$HOME` themselves are
+  not listed). When a writable location (for example the workspace) is the home
+  itself or an ancestor of a home secret, the write allow list already grants
+  read on that secret's subtree, so the read layer cannot deny it; the status
+  then records that the read isolation is not effective instead of claiming it is
+  applied. An empty `HOME` is reported the same way.
+- What remains lexical-only: network access, and every command run while the
+  backend is unavailable. `--allow bash:verify` and `--offline` are lexical
   policies, so a command they admit can still start a script; only the sandbox
-  (when applied) constrains that script's writes. Reads and network are not
-  confined in this stage.
+  (when applied) constrains that script's writes and home-secret reads.
   - Runtime dependency setup runs outside the sandbox: the setup steps that
     execute `setup.py`, npm `postinstall`/`prepare` hooks, and similar
     install-time scripts run before or outside the confined `sh -c` launch
@@ -90,18 +120,25 @@ before the shell starts.
   warns once at startup, and records `bash_sandbox_status` with `applied=false`
   and a reason. `required` instead fails Bash and verifier commands with
   `bash_sandbox_unavailable`. `off` keeps the previous behavior. None of them
-  reports "sandboxed" when the sandbox was not applied.
+  reports "sandboxed" when the sandbox was not applied. The read isolation is
+  reported through the same event's `reason`: it names the applied read
+  isolation, or is empty for a fully confined sandbox (reads included).
 - The dependency caches (cargo registry/git/package-cache, npm, pip, Playwright
   browsers) stay writable so builds and tests work; they remain a contamination
   path outside the workspace. On macOS they live under `~/Library/Caches` and
   `~/.cargo`; on Linux under `~/.cargo`, `~/.npm`, and `~/.cache`. pnpm and yarn
-  stores are not allowed in this stage.
+  stores are not allowed in this stage. The home npm config (`~/.npmrc`) is a
+  read-denied secret, so an `npm` that reads a private-registry `~/.npmrc` fails
+  inside Bash: that is the intended consequence of not feeding registry tokens to
+  Bash, not a regression.
 
 macOS `mktemp` ignores `TMPDIR` and targets the per-user temp directory, which
 the sandbox denies. A `mktemp` inside the run temp directory (`mktemp -p
 "$TMPDIR"` or a template under `$TMPDIR`) succeeds; a bare `mktemp` does not.
-The applied-probe record is under
-`tests/corpus/apps/issue502-indirect-write/fixtures/macos-probe-results.md`.
+The applied write-probe record is under
+`tests/corpus/apps/issue502-indirect-write/fixtures/macos-probe-results.md`; the
+applied read-probe record is under
+`tests/corpus/apps/issue502-indirect-read/fixtures/macos-probe-results.md`.
 
 ## Child Process Environment
 
@@ -168,18 +205,21 @@ workspace credentials in this change.
   registration and before spawn.
 
 Because the refusal happens before any read, a rejected call returns an honest
-refusal that contains no credential bytes or expansion value. This is not a
-claim that no arbitrary Bash program can read a secret: dynamic variables,
-indirect scripts, encodings, hardlinks, copies, and TOCTOU are tracked
-separately by #502. Keep real secrets outside the agent workspace and edit the
-template files instead.
+refusal that contains no credential bytes or expansion value. This lexical layer
+is not a claim that no arbitrary Bash program can read a secret: dynamic
+variables, indirect scripts, encodings, hardlinks, copies, and TOCTOU are why the
+OS read sandbox above also denies the home secret locations (and, on macOS,
+workspace credentials) at the kernel; the remaining forms are tracked by #502.
+Keep real secrets outside the agent workspace and edit the template files
+instead.
 
 ## Backlog
 
-- OS write sandbox, remaining stages of #502: Linux write confinement (landlock),
-  read confinement, and network/dependency-install isolation. Stage 1a (macOS
-  Seatbelt write confinement and the shared leaf module) is implemented here;
-  the same leaf module is the seam the later stages extend.
+- OS sandbox, remaining stage of #502: network and dependency-install isolation.
+  Stage 1a (macOS Seatbelt write confinement and the shared leaf module), stage
+  1b (Linux Landlock write confinement), and stage 2 (home-credential read
+  confinement on both backends, Issue #657) are implemented here; the same leaf
+  module is the seam the later stage extends.
 - Container-sandboxed execution track: run Bash/verifier commands inside a
   per-workspace container or equivalent OS sandbox with a mounted workspace,
   minimal environment, and explicit network policy. Superseded in part by the
diff --git a/docs/guide/en/cli-reference.md b/docs/guide/en/cli-reference.md
index ca1cb51f..a14298c1 100644
--- a/docs/guide/en/cli-reference.md
+++ b/docs/guide/en/cli-reference.md
@@ -79,7 +79,7 @@ internal integration surface and is intentionally not a public user flag.
 | `--style` | `<STYLE>` | `default` | Pass the plan presentation/generation style. | [Inline flags](slash-commands.md#inline-flags) |
 | `--resume` | `<RESUME>` | none | Load the named saved minimal-loop session for a direct `--prompt` run. | [Session options](#conflicts-and-combinations) |
 | `--offline` | none | off | Block runtime dependency setup and Bash commands containing npm/pnpm/yarn/cargo install, curl, or wget. Provider/API requests and other network-capable commands are unaffected. | [Providers](providers.md) |
-| `--sandbox` | `<auto\|required\|off>` | `auto` | Select the OS write sandbox for Bash and verifier commands. `auto` applies it when the backend is available and otherwise continues with lexical checks only; `required` fails those commands when the backend is unavailable; `off` keeps the previous behavior. | [OS write sandbox](#os-write-sandbox) |
+| `--sandbox` | `<auto\|required\|off>` | `auto` | Select the OS write sandbox for Bash and verifier commands. `auto` applies it when the backend is available and otherwise continues with lexical checks only; `required` fails those commands when the backend is unavailable; `off` keeps the previous behavior. | [OS write and read sandbox](#os-write-and-read-sandbox) |
 | `--quiet` | none | off (`narration = "normal"`) | Suppress presentation narration. | [Top-level keys](configuration.md#top-level-keys) |
 | `--summary-json` | none | off | Append one machine-readable terminal run summary as the final stdout line. Omitting it preserves existing stdout bytes. | [Headless execution](../../user/headless.md) |
 | `--trace` | none | off | Opt in to scrubbed provider request and response traces under the active run directory. | [Troubleshooting](troubleshooting.md) |
@@ -98,27 +98,48 @@ internal integration surface and is intentionally not a public user flag.
 | `--footer` | `<on\|off>` | `on` | Control the fixed TUI footer; off keeps scrollback breadcrumbs. | [Footer problems](troubleshooting.md#footer-rendering-problems) |
 | `--no-footer` | none | off | Disable the fixed TUI footer. Equivalent in effect to `--footer off`. | [Footer problems](troubleshooting.md#footer-rendering-problems) |
 
-## OS write sandbox
+## OS write and read sandbox
 
-The `--sandbox auto|required|off` flag (default `auto`) controls an
-OS-level write sandbox for the model Bash tool and for verification/acceptance
-commands. The lexical checks still run first; the sandbox adds confinement for
-writes the lexical guard cannot see.
+The `--sandbox auto|required|off` flag (default `auto`) controls an OS-level
+write sandbox and a home-credential read sandbox for the model Bash tool and for
+verification/acceptance commands. The lexical checks still run first; the
+sandbox adds confinement for writes and reads the lexical guard cannot see.
 
 - **What the OS closes (when the backend is available):** writes performed inside
   a command or script — `sh -c 'cp ...'`, `eval`, `xargs`, `find -exec`, an
   interpreter's `open(..., 'w')`, `dd of=`, `sed -i` — and hardlinks to an inode
   outside the workspace. Only the workspace, the run's temp directory, the known
   dependency caches, and device files such as `/dev/null` are writable.
-- **What stays lexical-only:** reads, network access, and every command run when
-  the backend is unavailable. `--yes`, `--allow bash:verify`, and `--offline` do
-  not close an indirect write by themselves; only the sandbox, when applied,
-  does. `--allow bash:verify` admits a command by its classification only, so the
-  contents of any script it invokes are limited by the sandbox alone.
+- **Read confinement:** reading the home secret locations (`.ssh`, `.aws`,
+  `.gnupg`, `.netrc`, `.git-credentials`, `.npmrc`, `.pypirc`,
+  `.docker/config.json`, `.kube`, `.config/gh`, `.config/gcloud`) is denied, and
+  on macOS a workspace credential named by the #501 rule is denied too; the three
+  strict dotenv templates stay readable. This closes the reads the lexical guard
+  cannot see: a credential through a non-secret symlink, a file named by an
+  environment variable such as `BASH_ENV`, and a name an interpreter assembles at
+  run time when that assembled name is itself a denied name. On Linux only the
+  home secret locations are denied, so a non-secret symlink to a workspace
+  credential is not closed by the read layer. Denying the home npm config means
+  an `npm` that reads a private-registry `~/.npmrc` fails inside Bash. On Linux
+  the deny list becomes a read-allow list rebuilt at each command's start, so a
+  location created after a command starts is not readable inside that command;
+  `ls /`, `ls $HOME`, and `echo $HOME/*` fail by design. When a writable location
+  (for example the workspace) is the home or an ancestor of a home secret the
+  read layer cannot deny those secrets, and the status says the read isolation is
+  not effective instead of claiming it is applied; an empty `HOME` is reported
+  the same way.
+- **What stays lexical-only:** network access, and every command run when the
+  backend is unavailable. `--yes`, `--allow bash:verify`, and `--offline` do not
+  close an indirect write or a home-secret read by themselves; only the sandbox,
+  when applied, does. `--allow bash:verify` admits a command by its
+  classification only, so the contents of any script it invokes are limited by
+  the sandbox alone.
 - **Modes:** `auto` uses the backend when available and otherwise warns once and
   records `bash_sandbox_status` with `applied=false` and a reason, continuing
   with lexical checks only; `required` fails Bash and verifier commands with
-  `bash_sandbox_unavailable`; `off` keeps the previous behavior. On macOS the
+  `bash_sandbox_unavailable`; `off` keeps the previous behavior. The read
+  isolation is reported through the same event's `reason` (it names the applied
+  read isolation, or is empty for a fully confined sandbox). On macOS the
   backend is Seatbelt and is unavailable under a nested sandbox (`rc=71`); on
   Linux it is Landlock and is unavailable below ABI1 (kernel 5.13), when
   disabled, or when a seccomp filter denies it.
@@ -126,8 +147,10 @@ writes the lexical guard cannot see.
   builds and tests work; they remain a contamination path outside the workspace.
 
 macOS `mktemp` ignores `TMPDIR`; use `mktemp -p "$TMPDIR"` or a template under
-`$TMPDIR`. The applied-probe record is under
-`tests/corpus/apps/issue502-indirect-write/fixtures/macos-probe-results.md`.
+`$TMPDIR`. The applied write-probe record is under
+`tests/corpus/apps/issue502-indirect-write/fixtures/macos-probe-results.md`; the
+applied read-probe record is under
+`tests/corpus/apps/issue502-indirect-read/fixtures/macos-probe-results.md`.
 
 ## Interactive REPL controls
 
diff --git a/docs/guide/ja/cli-reference.md b/docs/guide/ja/cli-reference.md
index 5abe8588..9e3e440a 100644
--- a/docs/guide/ja/cli-reference.md
+++ b/docs/guide/ja/cli-reference.md
@@ -78,7 +78,7 @@ Clap が生成する `-h`/`--help` と `-V`/`--version` は、以下のアプリ
 | `--style` | `<STYLE>` | `default` | plan の表示／生成スタイルを渡します。 | [インラインフラグ](slash-commands.md#インラインフラグ) |
 | `--resume` | `<RESUME>` | なし | 直接 `--prompt` 実行で、指定した保存済み minimal-loop セッションを読み込みます。 | [セッションオプション](#排他関係と組み合わせ) |
 | `--offline` | なし | オフ | runtime の依存関係セットアップと、npm/pnpm/yarn/cargo install、curl、wget を含む Bash コマンドを禁止します。provider/API 要求とその他のネットワーク可能なコマンドには影響しません。 | [プロバイダ](providers.md) |
-| `--sandbox` | `<auto\|required\|off>` | `auto` | モデルの Bash ツールと検証・受け入れコマンドに対する OS レベルの書き込みサンドボックスを選びます。`auto` は backend が使えれば適用し、使えなければ字句検査だけで続けます。`required` は backend が使えないときに対象コマンドを失敗させます。`off` は今までの挙動を保ちます。 | [OS 書き込みサンドボックス](#os-書き込みサンドボックス) |
+| `--sandbox` | `<auto\|required\|off>` | `auto` | モデルの Bash ツールと検証・受け入れコマンドに対する OS レベルの書き込みサンドボックスを選びます。`auto` は backend が使えれば適用し、使えなければ字句検査だけで続けます。`required` は backend が使えないときに対象コマンドを失敗させます。`off` は今までの挙動を保ちます。 | [OS 書き込み・読み取りサンドボックス](#os-書き込み読み取りサンドボックス) |
 | `--quiet` | なし | オフ（`narration = "normal"`） | プレゼンテーションのナレーションを抑制します。 | [トップレベルキー](configuration.md#トップレベルキー) |
 | `--summary-json` | なし | オフ | stdout 最終行へ機械可読な終端runサマリを1件追加します。省略時は既存stdout bytesを維持します。 | [Headless execution](../../user/headless.md) |
 | `--trace` | なし | オフ | active run の `trace/` directory に scrub 済み provider exchange を opt-in 保存します。 | [トラブルシューティング](troubleshooting.md) |
@@ -97,16 +97,17 @@ Clap が生成する `-h`/`--help` と `-V`/`--version` は、以下のアプリ
 | `--footer` | `<on\|off>` | `on` | 固定 TUI フッターを制御します。off でもスクロールバックの breadcrumb は残ります。 | [フッターの問題](troubleshooting.md#フッター描画の問題) |
 | `--no-footer` | なし | オフ | 固定 TUI フッターを無効にします。効果は `--footer off` と同じです。 | [フッターの問題](troubleshooting.md#フッター描画の問題) |
 
-## OS 書き込みサンドボックス
+## OS 書き込み・読み取りサンドボックス
 
-フラグ `--sandbox auto|required|off`（既定 `auto`）は、モデルの Bash ツールと検証・受け入れコマンドに対する OS レベルの書き込みサンドボックスを制御します。字句検査は先に働き、サンドボックスは字句検査から見えない書き込みを閉じ込めます。
+フラグ `--sandbox auto|required|off`（既定 `auto`）は、モデルの Bash ツールと検証・受け入れコマンドに対する OS レベルの書き込みサンドボックスと、home の資格情報の読み取りサンドボックスを制御します。字句検査は先に働き、サンドボックスは字句検査から見えない書き込みと読み取りを閉じ込めます。
 
 - **OS が閉じるもの（backend が使えるとき）：** コマンドやスクリプトの中の書き込み — `sh -c 'cp ...'`、`eval`、`xargs`、`find -exec`、インタープリタの `open(..., 'w')`、`dd of=`、`sed -i` — と、workspace の外の inode への hardlink です。書き込めるのは、workspace・run の一時ディレクトリ・既知の依存キャッシュ・`/dev/null` などのデバイスだけです。
-- **字句検査だけのもの：** 読み取り、ネットワーク、backend が使えないときの全コマンドです。`--yes`・`--allow bash:verify`・`--offline` は、それ自体では間接的な書き込みを閉じません。適用されたサンドボックスだけが閉じます。`--allow bash:verify` はコマンドを分類で通すだけなので、そのコマンドが呼ぶスクリプトの中身を制限するのはサンドボックスだけです。
-- **モード：** `auto` は backend が使えれば適用し、使えなければ起動時に一度警告し、`applied=false` と理由つきの `bash_sandbox_status` を記録して字句検査だけで続けます。`required` は Bash と検証コマンドを `bash_sandbox_unavailable` で失敗させます。`off` は今までの挙動を保ちます。macOS は Seatbelt で、入れ子の sandbox（`rc=71`）では未適用です。Linux は Landlock で、ABI1（kernel 5.13）未満・無効化・seccomp による拒否では未適用です。
+- **読み取りの隔離：** home の秘密の場所（`.ssh`・`.aws`・`.gnupg`・`.netrc`・`.git-credentials`・`.npmrc`・`.pypirc`・`.docker/config.json`・`.kube`・`.config/gh`・`.config/gcloud`）の読み取りを拒否し、macOS では #501 の規則に当たる workspace の資格情報も拒否します。厳密な dotenv テンプレート（`.env.example`・`.env.sample`・`.env.template`）は読めます。これにより、秘密でない名前の symlink 経由、`BASH_ENV` のような環境変数で名指す形、インタープリタが実行時に組み立てた名前が拒否一覧の名前そのものを指す場合など、字句検査から見えない読み取りを閉じます。Linux では home の秘密の場所だけを拒否するため、秘密でない名前の symlink 経由の workspace の資格情報は読み取りの隔離では閉じません。home の npm の設定を拒否するため、private registry の `~/.npmrc` を読む `npm` は Bash の中で失敗します。Linux は拒否リストをコマンドの起動ごとに読み取り許可リストへ展開し直すため、起動の後にできた場所はそのコマンドの中では読めません（`ls /`・`ls $HOME`・`echo $HOME/*` は意図どおり失敗します）。書き込みの許可の場所（たとえば workspace）が home そのものか home の秘密の場所の祖先のときは、書き込みの許可がその秘密の場所の下位も読ませるため読み取りでは閉じられず、status は適用と偽らず「読み取りの隔離が効かない」と記録します。HOME が空のときも同じです。
+- **字句検査だけのもの：** ネットワーク、backend が使えないときの全コマンドです。`--yes`・`--allow bash:verify`・`--offline` は、それ自体では間接的な書き込みや home の秘密の読み取りを閉じません。適用されたサンドボックスだけが閉じます。`--allow bash:verify` はコマンドを分類で通すだけなので、そのコマンドが呼ぶスクリプトの中身を制限するのはサンドボックスだけです。
+- **モード：** `auto` は backend が使えれば適用し、使えなければ起動時に一度警告し、`applied=false` と理由つきの `bash_sandbox_status` を記録して字句検査だけで続けます。`required` は Bash と検証コマンドを `bash_sandbox_unavailable` で失敗させます。`off` は今までの挙動を保ちます。読み取りの隔離は同じイベントの `reason` で報告します（適用中は read isolation を名指し、完全に閉じている場合は空です）。macOS は Seatbelt で、入れ子の sandbox（`rc=71`）では未適用です。Linux は Landlock で、ABI1（kernel 5.13）未満・無効化・seccomp による拒否では未適用です。
 - 依存キャッシュ（cargo・npm・pip・Playwright のブラウザ）はビルドとテストのために書き込み可能なままにします。workspace の外の汚染経路として残ります。
 
-macOS の `mktemp` は `TMPDIR` を見ません。`mktemp -p "$TMPDIR"` か `$TMPDIR` 配下のテンプレートを使ってください。適用の試験の記録は `tests/corpus/apps/issue502-indirect-write/fixtures/macos-probe-results.md` にあります。
+macOS の `mktemp` は `TMPDIR` を見ません。`mktemp -p "$TMPDIR"` か `$TMPDIR` 配下のテンプレートを使ってください。書き込みの適用の記録は `tests/corpus/apps/issue502-indirect-write/fixtures/macos-probe-results.md`、読み取りの適用の記録は `tests/corpus/apps/issue502-indirect-read/fixtures/macos-probe-results.md` にあります。
 
 ## 対話型 REPL の操作
 
diff --git a/src/tools/os_sandbox.rs b/src/tools/os_sandbox.rs
index 305c139a..705f226d 100644
--- a/src/tools/os_sandbox.rs
+++ b/src/tools/os_sandbox.rs
@@ -1,12 +1,14 @@
-//! OS write sandbox for model Bash and verifier commands (Issue #655).
+//! OS write and read sandbox for model Bash and verifier commands (Issues #655
+//! and #657).
 //!
-//! This is the common leaf module of the #502 write-confinement track. It wraps
-//! the `sh -c` launch point of the model Bash tool (including the `bash:verify`
+//! This is the common leaf module of the #502 confinement track. It wraps the
+//! `sh -c` launch point of the model Bash tool (including the `bash:verify`
 //! interval, which reuses the same function) and of verifier commands, so an
-//! indirect write that the lexical guard cannot see still fails when the OS
-//! backend is available.
+//! indirect write the lexical guard cannot see still fails, and since #657 an
+//! indirect read of a home secret location (or, on macOS, a workspace
+//! credential) fails as well, when the OS backend is available.
 //!
-//! Design (issue #655, decisions from #502):
+//! Design (issues #655 and #657, decisions from #502):
 //! - The backend writes a fixed profile; locations travel only through `-D`
 //!   parameters, never embedded in the profile string.
 //! - Availability is probed once at run start and stored process-wide, together
@@ -19,6 +21,11 @@
 //! - macOS uses Seatbelt (stage 1a); Linux uses Landlock (stage 1b). On any
 //!   other platform the backend is reported as unavailable rather than silently
 //!   pretending isolation.
+//! - The read layer is a deny list shared by both backends
+//!   ([`secret_locations`]); it is applied together with the write layer, and
+//!   `bash_sandbox_status` reports it through the existing `reason` field (a
+//!   `reason` that names the read isolation, or `None` for a fully confined
+//!   sandbox).
 
 use std::path::{Path, PathBuf};
 use std::process::Command;
@@ -30,12 +37,16 @@ use clap::ValueEnum;
 pub mod landlock;
 #[cfg(target_os = "macos")]
 pub mod seatbelt;
+/// The shared read-deny list (Issue #657). Compiled only where a read backend
+/// exists, so it is never dead code on other platforms.
+#[cfg(any(target_os = "macos", target_os = "linux"))]
+pub mod secret_locations;
 
 /// The macOS backend name used in `bash_sandbox_status`.
 pub const BACKEND_SEATBELT: &str = "seatbelt";
 /// The Linux backend name used in `bash_sandbox_status`.
 pub const BACKEND_LANDLOCK: &str = "landlock";
-/// The backend name on platforms without a write backend in this stage.
+/// The backend name on platforms without an OS sandbox backend in this stage.
 pub const BACKEND_NONE: &str = "none";
 
 /// The honest failure kind emitted when `required` cannot apply the sandbox.
@@ -44,13 +55,13 @@ pub const UNAVAILABLE_KIND: &str = "bash_sandbox_unavailable";
 /// The reason recorded when the sandbox is explicitly disabled.
 const DISABLED_REASON: &str = "disabled by --sandbox off";
 /// The reason recorded once a run has finished and its sandbox is torn down.
-const RUN_FINISHED_REASON: &str = "run finished; the OS write sandbox is no longer applied";
+const RUN_FINISHED_REASON: &str = "run finished; the OS sandbox is no longer applied";
 /// The refusal reason for a `required` run whose backend is available but whose
 /// policy is gone (for example after [`cleanup`]).
-const MISSING_POLICY_REASON: &str = "the OS write sandbox has no policy to apply";
-/// The reason recorded on platforms with no write-isolation backend in 1a/1b.
+const MISSING_POLICY_REASON: &str = "the OS sandbox has no policy to apply";
+/// The reason recorded on platforms with no OS backend in 1a/1b/2.
 #[cfg(not(any(target_os = "macos", target_os = "linux")))]
-const NO_PLATFORM_BACKEND: &str = "no OS write-isolation backend is available on this platform (macOS Seatbelt and Linux Landlock are supported)";
+const NO_PLATFORM_BACKEND: &str = "no OS sandbox backend is available on this platform (macOS Seatbelt and Linux Landlock are supported)";
 
 /// `--sandbox auto|required|off`. `auto` is the default.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, ValueEnum)]
@@ -86,25 +97,45 @@ pub enum SandboxAvailability {
     Unavailable(String),
 }
 
-/// The resolved write-allow list and the run temp directory.
+/// The resolved write-allow list, the run temp directory, and the home whose
+/// secret locations are denied for reading (Issue #657).
 #[derive(Debug, Clone)]
 pub struct SandboxPolicy {
     pub workspace_root: PathBuf,
     pub run_tmp_dir: PathBuf,
     pub caches: CachePaths,
+    /// The home whose secret locations the read backend denies. Resolved from
+    /// `HOME`; tests pass an explicit tempdir so they never touch the real home.
+    pub home: PathBuf,
 }
 
 impl SandboxPolicy {
-    /// Build a policy whose cache locations are resolved from `HOME`.
+    /// Build a policy whose cache locations and read-deny home are resolved from
+    /// `HOME`.
     pub fn new(workspace_root: &Path, run_tmp_dir: &Path) -> Self {
+        Self::with_home(workspace_root, run_tmp_dir, home_dir())
+    }
+
+    /// Build a policy with an explicit home, so a test can point the read deny
+    /// list at a tempdir without racing on the process `HOME`.
+    pub fn with_home(workspace_root: &Path, run_tmp_dir: &Path, home: PathBuf) -> Self {
         Self {
             workspace_root: workspace_root.to_path_buf(),
             run_tmp_dir: run_tmp_dir.to_path_buf(),
-            caches: resolve_cache_paths(),
+            caches: resolve_cache_paths(&home),
+            home,
         }
     }
 }
 
+/// The process home, or an empty path when `HOME` is unset. An empty home makes
+/// the read deny list empty ([`secret_locations::home_secret_locations`]).
+fn home_dir() -> PathBuf {
+    std::env::var_os("HOME")
+        .map(PathBuf::from)
+        .unwrap_or_default()
+}
+
 /// Known dependency caches allowed for writing (decision 2). pnpm and yarn
 /// stores are deliberately excluded in this stage.
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
@@ -123,6 +154,14 @@ pub struct SandboxStatus {
     pub mode: SandboxMode,
     pub backend: &'static str,
     pub applied: bool,
+    /// Whether the read isolation of Issue #657 is in force for the whole
+    /// workspace. It is applied together with the write backend, but is `false`
+    /// when no home secret location is known or, on Linux, when a writable
+    /// location is a home secret or an ancestor of one (its subtree then stays
+    /// readable), so the record never claims isolation the read layer cannot
+    /// provide. `bash_sandbox_status` reports it through the existing
+    /// [`SandboxStatus::reason`] field rather than a new event field.
+    pub read_isolation: bool,
     pub reason: Option<String>,
 }
 
@@ -131,6 +170,7 @@ impl SandboxStatus {
         mode: SandboxMode,
         availability: &SandboxAvailability,
         note: Option<String>,
+        read_isolation_effective: bool,
     ) -> Self {
         let applied = mode.uses_backend() && matches!(availability, SandboxAvailability::Available);
         let reason = if mode.uses_backend() {
@@ -147,6 +187,7 @@ impl SandboxStatus {
             mode,
             backend: backend_name(),
             applied,
+            read_isolation: applied && read_isolation_effective,
             reason,
         }
     }
@@ -183,18 +224,86 @@ fn backend_name() -> &'static str {
     }
 }
 
-/// The best-effort limitation of the applied backend, recorded in the
-/// `bash_sandbox_status` reason even while the sandbox is applied. The Linux
-/// Landlock backend names the operations an older ABI cannot close; other
-/// backends have none.
-fn backend_note() -> Option<String> {
+/// The read-isolation clause recorded in `bash_sandbox_status`'s reason while
+/// the read layer of Issue #657 is effective.
+const READ_ISOLATION_APPLIED: &str = "read isolation applied";
+/// The clause recorded when no home secret location is known to deny.
+#[cfg(any(target_os = "macos", target_os = "linux"))]
+const READ_ISOLATION_NO_HOME: &str =
+    "read isolation is not effective: no home secret location is known";
+
+/// Whether the read layer is effective for a policy, and the clause that reports
+/// it in the `bash_sandbox_status` reason.
+struct ReadIsolation {
+    effective: bool,
+    clause: String,
+}
+
+/// Classify the read isolation for a policy. It is ineffective when the home is
+/// unknown (an empty deny list) or, on Linux, when a write-allowed location is a
+/// home secret or an ancestor of one: the expansion cannot deny a location that
+/// the write allow list already grants read on, so those secrets stay readable.
+/// On macOS the read deny is applied after `(allow default)`, so a write-allowed
+/// location does not re-open a secret.
+#[cfg(any(target_os = "macos", target_os = "linux"))]
+fn read_isolation(policy: Option<&SandboxPolicy>) -> ReadIsolation {
+    let Some(policy) = policy else {
+        return ReadIsolation {
+            effective: false,
+            clause: "read isolation is not effective: no sandbox policy".to_string(),
+        };
+    };
+    let denied = secret_locations::home_secret_locations(&policy.home);
+    if denied.is_empty() {
+        return ReadIsolation {
+            effective: false,
+            clause: READ_ISOLATION_NO_HOME.to_string(),
+        };
+    }
+    #[cfg(target_os = "linux")]
+    {
+        let gaps = landlock::read_isolation_gaps(&landlock::allowed_paths(policy), &denied);
+        if !gaps.is_empty() {
+            return ReadIsolation {
+                effective: false,
+                clause: format!(
+                    "read isolation is not effective for {} home secret location(s) overlapped by a writable location",
+                    gaps.len()
+                ),
+            };
+        }
+    }
+    ReadIsolation {
+        effective: true,
+        clause: READ_ISOLATION_APPLIED.to_string(),
+    }
+}
+
+#[cfg(not(any(target_os = "macos", target_os = "linux")))]
+fn read_isolation(_policy: Option<&SandboxPolicy>) -> ReadIsolation {
+    ReadIsolation {
+        effective: false,
+        clause: "read isolation is not effective: no backend on this platform".to_string(),
+    }
+}
+
+/// The note recorded in the `bash_sandbox_status` reason while the sandbox is
+/// applied. On Linux it names the write operations an older ABI cannot close and
+/// the read-isolation clause; a fully closed ABI with effective reads has no
+/// note (`None`), which the event reads as fully confined. On other platforms it
+/// names the read-isolation clause.
+fn backend_note(read: &ReadIsolation) -> Option<String> {
     #[cfg(target_os = "linux")]
     {
-        landlock::limitation_note()
+        match landlock::limitation_note() {
+            Some(note) => Some(format!("{note}; {}", read.clause)),
+            None if read.effective => None,
+            None => Some(read.clause.clone()),
+        }
     }
     #[cfg(not(target_os = "linux"))]
     {
-        None
+        Some(read.clause.clone())
     }
 }
 
@@ -235,6 +344,7 @@ pub fn install(mode: SandboxMode, workspace_root: &Path, state_dir: &Path) -> Sa
             mode,
             backend: backend_name(),
             applied: false,
+            read_isolation: false,
             reason: None,
         }
     }
@@ -273,7 +383,8 @@ pub fn install_for_test(
 /// the one the run started in, so the fixed profile would confine it to the wrong
 /// workspace.
 #[cfg(not(test))]
-const DIFFERENT_WORKSPACE_REASON: &str = "workflow node runs in a workspace other than the run workspace; the OS write sandbox is not applied";
+const DIFFERENT_WORKSPACE_REASON: &str =
+    "workflow node runs in a workspace other than the run workspace; the OS sandbox is not applied";
 
 /// Reconcile the installed sandbox with the workspace a workflow child node runs
 /// in.
@@ -316,11 +427,13 @@ fn reconcile_workspace_impl(workspace_root: &Path) -> Option<SandboxStatus> {
             mismatched,
         )
     };
+    let read = read_isolation(policy.as_ref());
     if !mismatched || !mode.uses_backend() {
         return Some(SandboxStatus::from_parts(
             mode,
             &availability,
-            backend_note(),
+            backend_note(&read),
+            read.effective,
         ));
     }
     if !matches!(availability, SandboxAvailability::Available) {
@@ -329,11 +442,12 @@ fn reconcile_workspace_impl(workspace_root: &Path) -> Option<SandboxStatus> {
         return Some(SandboxStatus::from_parts(
             mode,
             &availability,
-            backend_note(),
+            backend_note(&read),
+            read.effective,
         ));
     }
     let availability = SandboxAvailability::Unavailable(DIFFERENT_WORKSPACE_REASON.to_string());
-    let status = SandboxStatus::from_parts(mode, &availability, None);
+    let status = SandboxStatus::from_parts(mode, &availability, None, false);
     *installed = Some(Installed {
         policy,
         mode,
@@ -347,7 +461,9 @@ fn store(
     policy: Option<SandboxPolicy>,
     availability: SandboxAvailability,
 ) -> SandboxStatus {
-    let status = SandboxStatus::from_parts(mode, &availability, backend_note());
+    let read = read_isolation(policy.as_ref());
+    let status =
+        SandboxStatus::from_parts(mode, &availability, backend_note(&read), read.effective);
     let mut installed = INSTALLED.lock().expect("sandbox state");
     *installed = Some(Installed {
         policy,
@@ -422,7 +538,13 @@ pub fn cleanup_guard() -> SandboxCleanupGuard {
 pub fn status() -> Option<SandboxStatus> {
     let installed = INSTALLED.lock().expect("sandbox state");
     installed.as_ref().map(|installed| {
-        SandboxStatus::from_parts(installed.mode, &installed.availability, backend_note())
+        let read = read_isolation(installed.policy.as_ref());
+        SandboxStatus::from_parts(
+            installed.mode,
+            &installed.availability,
+            backend_note(&read),
+            read.effective,
+        )
     })
 }
 
@@ -437,7 +559,7 @@ pub fn startup_warning() -> Option<String> {
     if status.mode == SandboxMode::Auto && !status.applied {
         let reason = status.reason.as_deref().unwrap_or("unknown reason");
         Some(format!(
-            "warning: OS write sandbox is unavailable ({reason}); Bash and verifier commands continue with lexical path checks only"
+            "warning: OS sandbox is unavailable ({reason}); Bash and verifier commands continue with lexical path checks only"
         ))
     } else {
         None
@@ -531,10 +653,11 @@ fn apply_backend(
     }
 }
 
-fn resolve_cache_paths() -> CachePaths {
-    let Some(home) = std::env::var_os("HOME").map(PathBuf::from) else {
+fn resolve_cache_paths(home: &Path) -> CachePaths {
+    if home.as_os_str().is_empty() {
         return CachePaths::default();
-    };
+    }
+    let home = home.to_path_buf();
     CachePaths {
         cargo_registry: existing_dir(home.join(".cargo/registry")),
         cargo_git: existing_dir(home.join(".cargo/git")),
@@ -566,9 +689,27 @@ mod tests {
             workspace_root: PathBuf::from("/tmp/os-sandbox-test-work"),
             run_tmp_dir: PathBuf::from("/tmp/os-sandbox-test-tmp"),
             caches: CachePaths::default(),
+            home: PathBuf::from("/tmp/os-sandbox-test-home"),
         }
     }
 
+    /// `SandboxPolicy::new` must take the home from the process `HOME` (through
+    /// `home_dir`); otherwise the read-deny list is built from an empty home and
+    /// every secret stays readable. Reads only the `HOME` value: it does not read
+    /// or list the home directory, and it does not mutate the environment.
+    #[test]
+    fn policy_new_resolves_home_from_the_environment() {
+        let Some(home) = std::env::var_os("HOME") else {
+            eprintln!("SKIP: HOME is not set");
+            return;
+        };
+        let policy = SandboxPolicy::new(
+            Path::new("/commandagent-home-test-ws"),
+            Path::new("/commandagent-home-test-tmp"),
+        );
+        assert_eq!(policy.home, PathBuf::from(home));
+    }
+
     #[test]
     fn required_and_unavailable_is_refused_with_the_honest_kind() {
         let _serial = SANDBOX_TEST_LOCK
diff --git a/src/tools/os_sandbox/landlock.rs b/src/tools/os_sandbox/landlock.rs
index 578d523b..ecb04c48 100644
--- a/src/tools/os_sandbox/landlock.rs
+++ b/src/tools/os_sandbox/landlock.rs
@@ -1,30 +1,46 @@
-//! Linux Landlock backend (Issue #656, stage 1b).
+//! Linux Landlock backend (Issue #656, stage 1b; read isolation in Issue #657,
+//! stage 2).
 //!
-//! Confines the writes of model Bash and verifier commands with Landlock. The
-//! ruleset and every allowed-location file descriptor are opened in the parent;
-//! the forked child's `pre_exec` runs only `prctl(PR_SET_NO_NEW_PRIVS)` and
-//! `landlock_restrict_self`, so no work that could allocate, lock, or log
-//! happens between `fork` and `exec`.
+//! Confines the writes and, since #657, the reads of model Bash and verifier
+//! commands with Landlock. The ruleset and every allowed-location file
+//! descriptor are opened in the parent; the forked child's `pre_exec` runs only
+//! `prctl(PR_SET_NO_NEW_PRIVS)` and `landlock_restrict_self`, so no work that
+//! could allocate, lock, or log happens between `fork` and `exec`.
 //!
-//! Design (issue #656, decisions from #502):
+//! Design (issues #656 and #657, decisions from #502):
 //! - ABI1 (kernel 5.13) is required. ABI2 (`refer`, link/rename across
 //!   directories) and ABI3 (`truncate`) are used best-effort; when they are
 //!   missing the still-open operations are named in the `bash_sandbox_status`
 //!   reason.
-//! - Reads and network are not handled, so they stay unchanged, matching 1a.
+//! - Read rights: the handled read set is `AccessFs::from_read(abi)`, i.e.
+//!   `Execute | ReadFile | ReadDir`. `ReadFile` opens a file for reading and
+//!   `ReadDir` lists a directory; `Execute` runs a file, and both the toolchain
+//!   (`cargo`, `rustup`, `node`, `python`, `git`) and the system binaries need
+//!   it, so the read allow list grants all three together. Landlock checks the
+//!   access on the file or directory that is opened, not on each ancestor path
+//!   component, so an allowed subtree needs no separate traversal grant; a
+//!   denied location is unreadable because no rule covers it. `ReadFile`,
+//!   `ReadDir`, and `Execute` are all present from ABI1, so the read layer adds
+//!   no new ABI requirement over the write layer.
+//! - Read isolation is a deny list rewritten as an allow list
+//!   ([`expand_read_allow`]): Landlock cannot deny part of an allowed tree, so
+//!   the home secret locations are expressed by allowing the siblings that do
+//!   not contain them.
+//! - Network is not handled, so it stays unchanged.
 //! - Availability is probed once at run start from the Landlock ABI query and a
 //!   child `restrict_self`, so a seccomp filter that denies either syscall is an
 //!   honest "unavailable" instead of a silent pass.
 
+use std::collections::HashSet;
 use std::os::fd::{AsRawFd, OwnedFd};
 use std::os::unix::process::CommandExt;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
 use std::sync::OnceLock;
 use std::time::Duration;
 
 use landlock::{
-    ABI, AccessFs, CompatLevel, Compatible, Ruleset, RulesetAttr, RulesetCreatedAttr,
+    ABI, Access, AccessFs, CompatLevel, Compatible, Ruleset, RulesetAttr, RulesetCreatedAttr,
     path_beneath_rules,
 };
 
@@ -139,7 +155,7 @@ fn query_abi() -> Result<u32, i32> {
 /// seccomp profile that allows creation but denies enforcement is still
 /// reported as unavailable.
 fn probe_restrict_self(abi: u32) -> Result<(), String> {
-    let fd = create_ruleset(abi, std::iter::empty::<PathBuf>())?;
+    let fd = probe_ruleset(abi)?;
     let raw = fd.as_raw_fd();
     let mut command = probe_command();
     // SAFETY: `pre_exec` runs after fork. The closure performs only the two
@@ -162,6 +178,26 @@ fn probe_restrict_self(abi: u32) -> Result<(), String> {
     }
 }
 
+/// The ruleset the availability probe enforces in its short-lived child.
+///
+/// It handles only the write accesses (ABI1) and allows no location, so the
+/// child keeps its read and execute access and can still `exec` the probe
+/// program. The probe only needs to confirm that `landlock_restrict_self` is
+/// enforceable (not denied by seccomp or the kernel); handling the read set here
+/// too would deny the child's own `exec` and be misread as "unavailable".
+fn probe_ruleset(abi: u32) -> Result<OwnedFd, String> {
+    let access = AccessFs::from_write(ABI::from(abi as i32));
+    let created = Ruleset::default()
+        // ABI1 must be enforceable; otherwise the backend is unavailable.
+        .set_compatibility(CompatLevel::HardRequirement)
+        .handle_access(access)
+        .map_err(|err| format!("landlock ruleset setup failed: {err}"))?
+        .create()
+        .map_err(|err| format!("landlock ruleset creation failed: {err}"))?;
+    Option::<OwnedFd>::from(created)
+        .ok_or_else(|| "landlock ruleset is not enforceable on this kernel".to_string())
+}
+
 fn probe_command() -> Command {
     for candidate in ["/bin/true", "/usr/bin/true"] {
         if std::path::Path::new(candidate).exists() {
@@ -181,14 +217,25 @@ fn probe_command() -> Command {
     command
 }
 
-/// Create a ruleset that denies the ABI's write accesses outside `allowed`,
-/// returning its file descriptor for the child to enforce.
-fn create_ruleset(abi: u32, allowed: impl IntoIterator<Item = PathBuf>) -> Result<OwnedFd, String> {
-    let access = AccessFs::from_write(ABI::from(abi as i32));
+/// Create a ruleset that denies every handled read and write access outside
+/// `writable` (read+write+execute) and `read_only` (read+execute), returning its
+/// file descriptor for the child to enforce.
+///
+/// `handle_access` uses `from_all(abi)` so both the read layer and the write
+/// layer are enforced; `Execute | ReadFile | ReadDir` all exist from ABI1, so
+/// this adds no ABI requirement over the write layer.
+fn create_ruleset(
+    abi: u32,
+    writable: impl IntoIterator<Item = PathBuf>,
+    read_only: impl IntoIterator<Item = PathBuf>,
+) -> Result<OwnedFd, String> {
+    let abi = ABI::from(abi as i32);
+    let read_access = AccessFs::from_read(abi);
+    let full_access = AccessFs::from_all(abi);
     let created = Ruleset::default()
         // ABI1 must be enforceable; otherwise the backend is unavailable.
         .set_compatibility(CompatLevel::HardRequirement)
-        .handle_access(access)
+        .handle_access(full_access)
         .map_err(|err| format!("landlock ruleset setup failed: {err}"))?
         // Rules are best-effort so a file location silently drops directory-only
         // accesses instead of failing the whole ruleset.
@@ -196,8 +243,11 @@ fn create_ruleset(abi: u32, allowed: impl IntoIterator<Item = PathBuf>) -> Resul
         .create()
         .map_err(|err| format!("landlock ruleset creation failed: {err}"))?;
     let created = created
-        .add_rules(path_beneath_rules(allowed, access))
-        .map_err(|err| format!("landlock rule failed: {err}"))?;
+        .add_rules(path_beneath_rules(writable, full_access))
+        .map_err(|err| format!("landlock write rule failed: {err}"))?;
+    let created = created
+        .add_rules(path_beneath_rules(read_only, read_access))
+        .map_err(|err| format!("landlock read rule failed: {err}"))?;
     Option::<OwnedFd>::from(created)
         .ok_or_else(|| "landlock ruleset is not enforceable on this kernel".to_string())
 }
@@ -265,7 +315,11 @@ pub fn wrap(command: &mut Command, policy: &SandboxPolicy) -> Result<(), String>
     if test_hooks::wrap_should_fail() {
         return Err("landlock ruleset could not be built (test hook)".to_string());
     }
-    let fd = create_ruleset(detected_abi(), allowed_paths(policy))?;
+    let fd = create_ruleset(
+        detected_abi(),
+        allowed_paths(policy),
+        read_allow_paths(policy),
+    )?;
     // Point tools at the run temp directory, which the ruleset allows.
     command.env("TMPDIR", &policy.run_tmp_dir);
     let raw = fd.as_raw_fd();
@@ -283,7 +337,13 @@ pub fn wrap(command: &mut Command, policy: &SandboxPolicy) -> Result<(), String>
 
 /// The locations the sandbox leaves writable: the workspace, the run temp
 /// directory, the known dependency caches, and the device files that exist.
-fn allowed_paths(policy: &SandboxPolicy) -> Vec<PathBuf> {
+/// These also get the read and execute rights, because a location that is
+/// writable must be readable and its binaries executable.
+///
+/// Because each of these locations also grants read on its whole subtree, a
+/// writable location that is a home secret or an ancestor of one re-opens that
+/// secret; [`read_isolation_gaps`] detects it.
+pub(crate) fn allowed_paths(policy: &SandboxPolicy) -> Vec<PathBuf> {
     let mut paths = vec![policy.workspace_root.clone(), policy.run_tmp_dir.clone()];
     paths.extend(existing(policy.caches.cargo_registry.clone()));
     paths.extend(existing(policy.caches.cargo_git.clone()));
@@ -291,9 +351,7 @@ fn allowed_paths(policy: &SandboxPolicy) -> Vec<PathBuf> {
     paths.extend(existing(policy.caches.npm.clone()));
     paths.extend(existing(policy.caches.pip.clone()));
     paths.extend(existing(policy.caches.playwright.clone()));
-    if let Some(home) = std::env::var_os("HOME").map(PathBuf::from) {
-        paths.extend(cache_paths(&home));
-    }
+    paths.extend(cache_paths(&policy.home));
     for device in DEVICE_PATHS {
         let path = PathBuf::from(device);
         if path.exists() {
@@ -303,6 +361,113 @@ fn allowed_paths(policy: &SandboxPolicy) -> Vec<PathBuf> {
     paths
 }
 
+/// The read-only locations: the expansion of the home secret deny list into its
+/// complement (see [`expand_read_allow`]). Without this, handling the read
+/// rights would make every location unreadable. `home_secret_locations`
+/// canonicalizes each location, so a symlinked secret location (`~/.ssh` that
+/// points outside the home) denies its target too.
+fn read_allow_paths(policy: &SandboxPolicy) -> Vec<PathBuf> {
+    expand_read_allow(&super::secret_locations::home_secret_locations(
+        &policy.home,
+    ))
+}
+
+/// The home secret locations whose read denial a writable location defeats, so
+/// the read layer is not fully effective. A secret is defeated when a writable
+/// location is the same path or an ancestor of it (the write allow then grants
+/// read on the secret's subtree) or, more narrowly, when the writable location
+/// is *inside* the secret (only that subtree is readable, but the denial is
+/// still partial). Both writable and denied paths are canonicalized first, so a
+/// workspace or cache reached through a symlink is compared by its real path.
+/// Pure apart from that canonicalization.
+pub(crate) fn read_isolation_gaps(writable: &[PathBuf], denied: &[PathBuf]) -> Vec<PathBuf> {
+    let writable: Vec<PathBuf> = writable
+        .iter()
+        .map(|path| canonicalize_or_keep(path))
+        .collect();
+    denied
+        .iter()
+        .filter(|secret| {
+            let secret = secret.as_path();
+            writable
+                .iter()
+                .any(|root| secret.starts_with(root) || root.starts_with(secret))
+        })
+        .cloned()
+        .collect()
+}
+
+/// Canonicalize a path, keeping it as-is when it does not exist or cannot be
+/// resolved.
+fn canonicalize_or_keep(path: &Path) -> PathBuf {
+    path.canonicalize().unwrap_or_else(|_| path.to_path_buf())
+}
+
+/// Rewrite a deny list into a read-allow list for Landlock.
+///
+/// Landlock is an allow list: an object is readable only if some rule covers it,
+/// and a rule on a directory also covers its whole subtree, so a deny list must
+/// be expressed as its complement. For every directory on the path to a denied
+/// location, allow each child that does not contain a denied location, and
+/// recurse into the children that do; the denied location itself is never
+/// allowed, so only its subtree stays unreadable. The toolchain, git, and the
+/// system locations are covered because their top-level and home siblings are
+/// allowed here.
+///
+/// The expansion reads the directories once, when the run starts, so a location
+/// created under an expanded directory afterwards is not readable in this run.
+fn expand_read_allow(denied: &[PathBuf]) -> Vec<PathBuf> {
+    expand_read_allow_from(std::path::Path::new("/"), denied)
+}
+
+/// [`expand_read_allow`] from an explicit root, so a test can drive the same
+/// walk inside a tempdir instead of the filesystem root.
+///
+/// An empty deny list (for example when `HOME` is unset) has no location to
+/// protect, so the walk allows every child of the root and reads stay unchanged
+/// rather than becoming unreadable.
+fn expand_read_allow_from(root: &std::path::Path, denied: &[PathBuf]) -> Vec<PathBuf> {
+    let mut allow = Vec::new();
+    let mut frontier = vec![root.to_path_buf()];
+    let mut visited: HashSet<PathBuf> = HashSet::new();
+    while let Some(directory) = frontier.pop() {
+        if !visited.insert(directory.clone()) {
+            continue;
+        }
+        let Ok(entries) = std::fs::read_dir(&directory) else {
+            continue;
+        };
+        for entry in entries.flatten() {
+            let path = entry.path();
+            // `path_beneath_rules` opens each allowed path with `O_PATH`, which
+            // follows symlinks, so a rule for a symlink entry would attach to
+            // its target. A link that points at a secret would then open that
+            // secret (and a secret location that is itself a link would open
+            // its target). Skip symlink entries: the target is decided by the
+            // real path, which the walk reaches on its own when it is outside a
+            // secret and leaves unmatched when it is a secret.
+            let Ok(file_type) = entry.file_type() else {
+                continue;
+            };
+            if file_type.is_symlink() {
+                continue;
+            }
+            if denied.iter().any(|secret| secret == &path) {
+                // The denied location itself stays unreadable and is not opened.
+                continue;
+            }
+            if denied.iter().any(|secret| secret.starts_with(&path)) {
+                // A strict ancestor of a denied location: open up its own
+                // children without reading the denied subtree.
+                frontier.push(path);
+            } else {
+                allow.push(path);
+            }
+        }
+    }
+    allow
+}
+
 /// The Linux dependency caches allowed for writing (decision 2). Only those that
 /// exist are returned.
 fn cache_paths(home: &std::path::Path) -> Vec<PathBuf> {
@@ -414,6 +579,25 @@ mod tests {
         }
     }
 
+    /// The availability probe must still let its child `exec`. The probe ruleset
+    /// handles only the write accesses, so the child keeps read/execute; a
+    /// regression that also handles the read set (without allowing the probe's
+    /// own reads) makes the child fail with EACCES and the backend be
+    /// misreported as unavailable.
+    #[test]
+    fn probe_child_can_exec_under_the_probe_ruleset() {
+        // Use the raw ABI query, not `detected_abi()`: the latter is 0 when the
+        // probe itself fails, which would hide the regression under test.
+        let abi = match query_abi() {
+            Ok(abi) if abi >= 1 => abi,
+            _ => {
+                eprintln!("SKIP: landlock is unavailable on this kernel");
+                return;
+            }
+        };
+        probe_restrict_self(abi).expect("the probe child must exec under the probe ruleset");
+    }
+
     #[test]
     fn an_enforcement_failure_is_unavailable_and_names_the_kernel_and_abi() {
         let Detected::Unavailable(reason) = decide(
@@ -427,6 +611,131 @@ mod tests {
         assert!(reason.contains("landlock ABI 2"), "{reason}");
     }
 
+    #[test]
+    fn read_allow_expansion_keeps_siblings_and_excludes_denied_subtrees() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        std::fs::create_dir_all(root.join("secret/inner")).unwrap();
+        std::fs::write(root.join("secret/inner/key"), "CANARY\n").unwrap();
+        std::fs::create_dir_all(root.join("nested/gh")).unwrap();
+        std::fs::create_dir_all(root.join("nested/other")).unwrap();
+        std::fs::create_dir_all(root.join("public")).unwrap();
+        let denied = vec![root.join("secret"), root.join("nested/gh")];
+
+        let allow = expand_read_allow_from(root, &denied);
+        assert!(allow.contains(&root.join("public")), "{allow:?}");
+        // A directory that only contains denied locations is opened up for its
+        // own non-denied children, not allowed wholesale.
+        assert!(allow.contains(&root.join("nested/other")), "{allow:?}");
+        assert!(!allow.contains(&root.join("nested")), "{allow:?}");
+        assert!(
+            allow.iter().all(|path| !path.starts_with(&denied[0])),
+            "{allow:?}"
+        );
+        assert!(
+            allow.iter().all(|path| !path.starts_with(&denied[1])),
+            "{allow:?}"
+        );
+    }
+
+    #[test]
+    fn read_isolation_gaps_reports_secrets_covered_by_writable_locations() {
+        let home = PathBuf::from("/home/alice");
+        let denied = vec![home.join(".ssh"), home.join(".aws")];
+
+        // A writable location that is the home itself covers both secrets.
+        assert_eq!(
+            read_isolation_gaps(std::slice::from_ref(&home), &denied),
+            denied
+        );
+
+        // A writable location inside one secret covers only that secret.
+        let workspace = home.join(".ssh/workspace");
+        assert_eq!(
+            read_isolation_gaps(&[workspace], &denied),
+            vec![home.join(".ssh")]
+        );
+
+        // A writable location outside the secrets covers none.
+        assert!(read_isolation_gaps(&[PathBuf::from("/tmp/work")], &denied).is_empty());
+    }
+
+    #[test]
+    fn read_isolation_gaps_canonicalizes_writable_locations() {
+        let dir = tempfile::tempdir().unwrap();
+        let real = dir.path().join("real");
+        std::fs::create_dir_all(real.join(".ssh")).unwrap();
+        let link = dir.path().join("link");
+        std::os::unix::fs::symlink(&real, &link).unwrap();
+        let denied = vec![real.canonicalize().unwrap().join(".ssh")];
+
+        // The workspace is reached through a symlink, so only canonicalizing the
+        // writable location reveals that it is the secret's ancestor.
+        assert_eq!(read_isolation_gaps(&[link], &denied), denied);
+    }
+
+    #[test]
+    fn an_empty_deny_list_allows_every_child_so_reads_stay_open() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        std::fs::create_dir_all(root.join("one")).unwrap();
+        std::fs::create_dir_all(root.join("two")).unwrap();
+        let allow = expand_read_allow_from(root, &[]);
+        assert!(allow.contains(&root.join("one")), "{allow:?}");
+        assert!(allow.contains(&root.join("two")), "{allow:?}");
+    }
+
+    #[test]
+    fn expand_read_allow_skips_a_symlink_that_points_at_a_secret() {
+        let dir = tempfile::tempdir().unwrap();
+        let home = dir.path().canonicalize().unwrap();
+        std::fs::create_dir_all(home.join(".ssh")).unwrap();
+        let key = home.join(".ssh/id_ed25519");
+        std::fs::write(&key, "CANARY\n").unwrap();
+        let note = home.join("notes.txt");
+        std::os::unix::fs::symlink(&key, &note).unwrap();
+        let denied = vec![home.join(".ssh")];
+
+        let allow = expand_read_allow_from(&home, &denied);
+        assert!(
+            !allow.contains(&note),
+            "the symlink entry must not be allowed: {allow:?}"
+        );
+        let key = key.canonicalize().unwrap();
+        assert!(
+            allow
+                .iter()
+                .all(|path| path.canonicalize().ok().as_ref() != Some(&key)),
+            "no rule may reach the secret inode: {allow:?}"
+        );
+    }
+
+    #[test]
+    fn expand_read_allow_skips_a_secret_location_that_is_a_symlink() {
+        let dir = tempfile::tempdir().unwrap();
+        let home = dir.path().canonicalize().unwrap();
+        std::fs::create_dir_all(&home).unwrap();
+        let outside = dir.path().join("outside");
+        std::fs::create_dir_all(&outside).unwrap();
+        std::fs::write(outside.join("id_rsa"), "CANARY\n").unwrap();
+        let ssh = home.join(".ssh");
+        std::os::unix::fs::symlink(&outside, &ssh).unwrap();
+        let outside = outside.canonicalize().unwrap();
+        let denied = vec![outside.clone()];
+
+        let allow = expand_read_allow_from(&home, &denied);
+        assert!(
+            !allow.contains(&ssh),
+            "the symlink entry must not be allowed: {allow:?}"
+        );
+        assert!(
+            allow
+                .iter()
+                .all(|path| path.canonicalize().ok().as_ref() != Some(&outside)),
+            "no rule may reach the secret target inode: {allow:?}"
+        );
+    }
+
     #[test]
     fn limitation_note_reports_the_abi2_and_abi3_gaps() {
         let abi1 = limitation_for("6.1.0", 1).expect("ABI 1 has gaps");
diff --git a/src/tools/os_sandbox/seatbelt.rs b/src/tools/os_sandbox/seatbelt.rs
index 4f089852..23ad60f3 100644
--- a/src/tools/os_sandbox/seatbelt.rs
+++ b/src/tools/os_sandbox/seatbelt.rs
@@ -1,17 +1,22 @@
-//! macOS Seatbelt backend (Issue #655, stage 1a).
+//! macOS Seatbelt backend (Issue #655, stage 1a; read isolation in Issue #657,
+//! stage 2).
 //!
-//! Applies a fixed write-confinement profile through `sandbox-exec`. The
-//! profile is a constant string; the workspace, the run temp directory, and the
-//! allowed caches travel only as `-D` parameters, so no location is embedded in
-//! the profile text. Reads and network are left as they are (`allow default`
-//! then `deny file-write*`), and the only re-allowed writes are the workspace,
-//! the run temp directory, the known dependency caches, and device files.
+//! Applies a write-confinement profile and, since #657, a read-confinement
+//! layer through `sandbox-exec`. The profile is assembled from a constant; every
+//! location travels only as a `-D` parameter, so no path is embedded in the
+//! profile text. `(allow default)` keeps everything else open, then
+//! `(deny file-write*)` confines writes to the workspace, the run temp
+//! directory, the known dependency caches, and device files, and `(deny
+//! file-read*)` denies the home secret locations and the workspace credential
+//! names. Read isolation is a deny list (decision 4 of #502): everything that is
+//! not a credential stays readable, so a toolchain, git, and the system files
+//! keep working.
 
 use std::path::Path;
 use std::process::{Command, Stdio};
 use std::time::Duration;
 
-use super::{SandboxAvailability, SandboxPolicy};
+use super::{SandboxAvailability, SandboxPolicy, secret_locations};
 
 const SANDBOX_EXEC: &str = "/usr/bin/sandbox-exec";
 const PROBE_PROFILE: &str = "(version 1)(allow default)";
@@ -20,9 +25,11 @@ const PROBE_TIMEOUT: Duration = Duration::from_secs(10);
 /// defined. It matches nothing on a real system.
 const UNSET_PATH: &str = "/commandagent-sandbox-unset";
 
-/// The fixed profile. `(allow default)` keeps reads and network unchanged;
-/// `(deny file-write*)` then confines every write to the parameters below.
-const PROFILE: &str = r#"
+/// The fixed write profile. `(allow default)` keeps everything else open;
+/// `(deny file-write*)` then confines every write to the parameters below. The
+/// read-deny rules are appended per run by [`profile`], because the number of
+/// home secret locations is fixed but their names travel as parameters.
+const WRITE_PROFILE: &str = r#"
 (version 1)
 (allow default)
 (deny file-write*)
@@ -37,6 +44,25 @@ const PROFILE: &str = r#"
 (allow file-write* (regex #"^/dev/"))
 "#;
 
+/// The profile for a run, with `deny_count` home secret locations and the
+/// workspace credential rules. Seatbelt applies the last matching rule, so the
+/// template re-allow comes after the workspace credential deny and keeps the
+/// three strict dotenv templates readable.
+fn profile(deny_count: usize) -> String {
+    let mut profile = String::from(WRITE_PROFILE);
+    for index in 0..deny_count {
+        profile.push_str(&format!(
+            "(deny file-read* (subpath (param \"RDENY_HOME_{index}\")))\n"
+        ));
+    }
+    profile.push_str("(deny file-read* (regex (param \"RDENY_WS\")))\n");
+    profile.push_str("(allow file-read* (regex (param \"RALLOW_WS_TEMPLATE\")))\n");
+    // Re-deny a template below a secret-named directory, so the re-allow above
+    // cannot open `.ssh/.env.example`.
+    profile.push_str("(deny file-read* (regex (param \"RDENY_WS_TEMPLATE\")))\n");
+    profile
+}
+
 /// Start `sandbox-exec` with a do-nothing profile. A nested sandbox reports
 /// rc=71 (`Operation not permitted`), which is an honest "unavailable".
 pub fn probe() -> SandboxAvailability {
@@ -84,8 +110,9 @@ fn classify_probe_exit(success: bool, status: Option<String>) -> SandboxAvailabi
 /// Standard I/O is intentionally left unset: it does not survive the transfer,
 /// so callers set it on the returned command.
 pub fn wrap(command: Command, policy: &SandboxPolicy) -> Command {
+    let home_secrets = secret_locations::home_secret_locations(&policy.home);
     let mut wrapped = Command::new(SANDBOX_EXEC);
-    wrapped.arg("-p").arg(PROFILE);
+    wrapped.arg("-p").arg(profile(home_secrets.len()));
     define(&mut wrapped, "WS", Some(&policy.workspace_root));
     define(&mut wrapped, "TMP", Some(&policy.run_tmp_dir));
     define(
@@ -111,6 +138,25 @@ pub fn wrap(command: Command, policy: &SandboxPolicy) -> Command {
         policy.caches.cargo_package_cache.as_deref(),
     );
 
+    for (index, location) in home_secrets.iter().enumerate() {
+        define(&mut wrapped, &format!("RDENY_HOME_{index}"), Some(location));
+    }
+    define_text(
+        &mut wrapped,
+        "RDENY_WS",
+        &secret_locations::workspace_credential_regex(&policy.workspace_root),
+    );
+    define_text(
+        &mut wrapped,
+        "RALLOW_WS_TEMPLATE",
+        &secret_locations::workspace_template_regex(&policy.workspace_root),
+    );
+    define_text(
+        &mut wrapped,
+        "RDENY_WS_TEMPLATE",
+        &secret_locations::workspace_template_under_secret_regex(&policy.workspace_root),
+    );
+
     wrapped.arg(command.get_program());
     for arg in command.get_args() {
         wrapped.arg(arg);
@@ -139,6 +185,12 @@ fn define(command: &mut Command, name: &str, path: Option<&Path>) {
     command.arg("-D").arg(format!("{name}={value}"));
 }
 
+/// Define a parameter whose value is already a literal string (a generated
+/// regex), so it is not canonicalized as a path.
+fn define_text(command: &mut Command, name: &str, value: &str) {
+    command.arg("-D").arg(format!("{name}={value}"));
+}
+
 fn canonical(path: &Path) -> String {
     path.canonicalize()
         .unwrap_or_else(|_| path.to_path_buf())
@@ -150,6 +202,34 @@ fn canonical(path: &Path) -> String {
 mod tests {
     use super::*;
 
+    #[test]
+    fn profile_denies_each_home_location_and_re_allows_templates_last() {
+        let built = profile(3);
+        assert!(built.contains("(deny file-write*)"), "{built}");
+        for index in 0..3 {
+            assert!(
+                built.contains(&format!(
+                    "(deny file-read* (subpath (param \"RDENY_HOME_{index}\")))"
+                )),
+                "{built}"
+            );
+        }
+        assert!(!built.contains("RDENY_HOME_3"), "{built}");
+        let deny_ws = built
+            .find("(deny file-read* (regex (param \"RDENY_WS\")))")
+            .expect("workspace deny rule");
+        let allow_template = built
+            .find("(allow file-read* (regex (param \"RALLOW_WS_TEMPLATE\")))")
+            .expect("template allow rule");
+        let deny_template = built
+            .find("(deny file-read* (regex (param \"RDENY_WS_TEMPLATE\")))")
+            .expect("template re-deny rule");
+        assert!(
+            deny_ws < allow_template && allow_template < deny_template,
+            "the template re-allow must sit between the deny and the re-deny: {built}"
+        );
+    }
+
     #[test]
     fn probe_classifies_a_zero_exit_as_available() {
         assert_eq!(
diff --git a/src/tools/os_sandbox/secret_locations.rs b/src/tools/os_sandbox/secret_locations.rs
new file mode 100644
index 00000000..e49adaea
--- /dev/null
+++ b/src/tools/os_sandbox/secret_locations.rs
@@ -0,0 +1,257 @@
+//! The single read-deny list shared by the macOS and Linux read backends
+//! (Issue #657, stage 2 of #502).
+//!
+//! The credential-name rule is aligned with the #501 leaf
+//! (`src/tools/sensitive_path.rs`): the workspace basenames and path sequences
+//! below mirror `sensitive_name_rule` and `path_rule`, and the three strict
+//! dotenv templates stay readable. The home list adds the places that only exist
+//! outside a workspace: `~/.gnupg`, the `gh`/`gcloud` configuration, and the
+//! kube config. Both backends import this module so the deny list cannot drift
+//! between platforms.
+//!
+//! Positions travel to the backends as locations only: the Seatbelt profile
+//! receives each home location as a `-D` parameter and the workspace rules as
+//! generated regexes; the Landlock backend expands the same location list into a
+//! read-allow list. Every path is canonicalized first, so a symlinked secret
+//! location denies its target and a workspace under a symlinked root still
+//! matches. No secret bytes and no credential value ever appear here.
+
+use std::path::{Path, PathBuf};
+
+/// Home-relative secret locations whose reads are denied (Issue #657). Aligned
+/// with #501's credential rule (`sensitive_name_rule` and `path_rule`) plus the
+/// home-specific places called out in the design: `.gnupg`, the `gh`/`gcloud`
+/// configuration, and `.kube`.
+///
+/// `.docker/config.json` is a file; the rest are directories.
+const HOME_SECRET_LOCATIONS: &[&str] = &[
+    ".ssh",
+    ".aws",
+    ".gnupg",
+    ".netrc",
+    ".git-credentials",
+    ".npmrc",
+    ".pypirc",
+    ".docker/config.json",
+    ".kube",
+    ".config/gh",
+    ".config/gcloud",
+];
+
+/// The home secret locations as canonical absolute paths under `home`. Returns
+/// an empty list when `home` is empty, so a run without `HOME` denies nothing
+/// rather than resolving names relative to the process working directory. Each
+/// location is canonicalized, so a symlinked location (`~/.ssh` pointing outside
+/// the home) denies its target as well.
+pub fn home_secret_locations(home: &Path) -> Vec<PathBuf> {
+    if home.as_os_str().is_empty() {
+        return Vec::new();
+    }
+    let home = canonicalize_or_keep(home);
+    HOME_SECRET_LOCATIONS
+        .iter()
+        .map(|relative| canonicalize_or_keep(&home.join(relative)))
+        .collect()
+}
+
+/// Canonicalize a path, keeping it as-is when it does not exist or cannot be
+/// resolved.
+fn canonicalize_or_keep(path: &Path) -> PathBuf {
+    path.canonicalize().unwrap_or_else(|_| path.to_path_buf())
+}
+
+/// The workspace credential basenames denied for reading, mirroring #501's
+/// `sensitive_name_rule` (Issue #657). `.env.*` matches every variant; the three
+/// strict templates are re-allowed by [`workspace_template_regex`], which the
+/// Seatbelt profile applies after this rule. The whole rule is case-insensitive,
+/// so `.ENV`, `.Env.local`, and `SERVICE-ACCOUNT.json` are refused on a
+/// case-insensitive filesystem, matching #501's lowercased comparison.
+#[cfg(target_os = "macos")]
+const WORKSPACE_CREDENTIAL_BASENAMES: &[&str] = &[
+    r"\.env",
+    r"\.env\.[^/]*",
+    r"\.envrc",
+    r"\.npmrc",
+    r"\.pypirc",
+    r"\.netrc",
+    r"\.git-credentials",
+    r"\.ssh",
+    r"service-account[^/]*\.json",
+    r"[^/]*\.private\.key",
+    r"[^/]*\.private\.pem",
+    r"[^/]*\.p12",
+    r"[^/]*\.pfx",
+];
+
+/// The workspace credential path sequences denied for reading, mirroring #501's
+/// `path_rule` (Issue #657): the credential is a fixed parent/child pair.
+#[cfg(target_os = "macos")]
+const WORKSPACE_CREDENTIAL_PATH_SEQUENCES: &[&str] = &[
+    r"\.aws/credentials",
+    r"\.docker/config\.json",
+    r"\.config/gcloud/application_default_credentials\.json",
+];
+
+/// The strict dotenv template basenames re-allowed as files.
+#[cfg(target_os = "macos")]
+const WORKSPACE_TEMPLATE_PATTERN: &str = r"\.env\.(example|sample|template)";
+
+/// A Seatbelt regex that matches a credential file anywhere under `workspace`,
+/// including every file beneath a credential-named directory. The root is
+/// canonicalized (Seatbelt matches the resolved path), the rule is
+/// case-insensitive, and the trailing `(/.*)?$` denies a secret directory's
+/// contents (`.ssh/id_rsa`, `.env.d/x`), matching #501's parent rule.
+#[cfg(target_os = "macos")]
+pub fn workspace_credential_regex(workspace: &Path) -> String {
+    let names = case_fold(
+        &WORKSPACE_CREDENTIAL_BASENAMES
+            .iter()
+            .chain(WORKSPACE_CREDENTIAL_PATH_SEQUENCES)
+            .copied()
+            .collect::<Vec<_>>()
+            .join("|"),
+    );
+    format!("^{}/(.*/)?({names})(/.*)?$", rooted_regex(workspace))
+}
+
+/// A Seatbelt regex that re-allows the three strict dotenv template files. The
+/// Seatbelt profile applies this rule after [`workspace_credential_regex`]
+/// (last match wins), so a template stays readable while `.env.example.local`
+/// and every other variant remain denied. A template under a secret-named
+/// directory is re-denied by [`workspace_template_under_secret_regex`].
+#[cfg(target_os = "macos")]
+pub fn workspace_template_regex(workspace: &Path) -> String {
+    format!(
+        "^{}/(.*/)?{}$",
+        rooted_regex(workspace),
+        case_fold(WORKSPACE_TEMPLATE_PATTERN)
+    )
+}
+
+/// A Seatbelt regex that re-denies a template file below a secret-named
+/// directory (for example `.ssh/.env.example`), so the template re-allow cannot
+/// open a file inside a credential directory.
+#[cfg(target_os = "macos")]
+pub fn workspace_template_under_secret_regex(workspace: &Path) -> String {
+    let names = case_fold(&WORKSPACE_CREDENTIAL_BASENAMES.join("|"));
+    format!(
+        "^{}/(.*/)?({names})/(.*/)?{}$",
+        rooted_regex(workspace),
+        case_fold(WORKSPACE_TEMPLATE_PATTERN)
+    )
+}
+
+/// Fold every ASCII letter in a regex fragment to an `[aA]` class, so the rule
+/// matches case-insensitively on a case-sensitive volume too. Regex
+/// metacharacters and the one class used here (`[^/]`, which holds no letter)
+/// are left as-is.
+#[cfg(target_os = "macos")]
+fn case_fold(pattern: &str) -> String {
+    let mut folded = String::with_capacity(pattern.len() * 3);
+    for character in pattern.chars() {
+        if character.is_ascii_alphabetic() {
+            folded.push('[');
+            folded.push(character.to_ascii_lowercase());
+            folded.push(character.to_ascii_uppercase());
+            folded.push(']');
+        } else {
+            folded.push(character);
+        }
+    }
+    folded
+}
+
+/// The regex-escaped, canonicalized workspace root.
+#[cfg(target_os = "macos")]
+fn rooted_regex(workspace: &Path) -> String {
+    escape_regex(&canonicalize_or_keep(workspace).to_string_lossy())
+}
+
+/// Escape the regex metacharacters in a literal path so it can be embedded in a
+/// Seatbelt regex. `/` is not a metacharacter and is left as is.
+#[cfg(target_os = "macos")]
+fn escape_regex(value: &str) -> String {
+    let mut escaped = String::with_capacity(value.len());
+    for character in value.chars() {
+        if matches!(
+            character,
+            '.' | '[' | ']' | '(' | ')' | '{' | '}' | '*' | '+' | '?' | '^' | '$' | '|' | '\\'
+        ) {
+            escaped.push('\\');
+        }
+        escaped.push(character);
+    }
+    escaped
+}
+
+#[cfg(all(test, target_os = "macos"))]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn home_secret_locations_are_under_home_and_empty_home_is_empty() {
+        let home = Path::new("/home/alice");
+        let locations = home_secret_locations(home);
+        assert_eq!(locations.len(), HOME_SECRET_LOCATIONS.len());
+        assert!(locations.contains(&home.join(".ssh")));
+        assert!(locations.contains(&home.join(".docker/config.json")));
+        assert!(locations.contains(&home.join(".config/gh")));
+        assert!(home_secret_locations(Path::new("")).is_empty());
+    }
+
+    #[test]
+    fn home_secret_locations_follow_a_symlink_to_its_target() {
+        let dir = tempfile::tempdir().unwrap();
+        let home = dir.path().join("home");
+        let outside = dir.path().join("outside");
+        std::fs::create_dir_all(&home).unwrap();
+        std::fs::create_dir_all(&outside).unwrap();
+        std::os::unix::fs::symlink(&outside, home.join(".ssh")).unwrap();
+
+        let locations = home_secret_locations(&home);
+        assert!(
+            locations.contains(&outside.canonicalize().unwrap()),
+            "{locations:?}"
+        );
+    }
+
+    #[test]
+    fn workspace_regex_canonicalizes_the_root_and_denies_subdirectories() {
+        let dir = tempfile::tempdir().unwrap();
+        let real = dir.path().join("real");
+        std::fs::create_dir_all(&real).unwrap();
+        let link = dir.path().join("link");
+        std::os::unix::fs::symlink(&real, &link).unwrap();
+        let real = real.canonicalize().unwrap();
+
+        // The root is the canonical path, the credential names are case-folded,
+        // the path sequences are present, and a secret directory's contents are
+        // denied.
+        let deny = workspace_credential_regex(&link);
+        assert!(deny.starts_with('^'), "{deny}");
+        assert!(deny.contains(r"\.[eE][nN][vV]"), "{deny}");
+        assert!(deny.contains(r"\.[aA][wW][sS]/[cC]"), "{deny}");
+        assert!(deny.ends_with("(/.*)?$"), "{deny}");
+        // The rule is anchored at the canonical workspace root: a credential
+        // inside the workspace matches, but the same name outside it does not.
+        // Built with the `regex` crate so a mutation that empties the escaped
+        // root (which would deny the name everywhere) is caught.
+        let deny_re = regex::Regex::new(&deny).expect("the deny regex must compile");
+        assert!(
+            deny_re.is_match(&format!("{}/.env", real.display())),
+            "{deny}"
+        );
+        assert!(!deny_re.is_match("/elsewhere/.env"), "{deny}");
+
+        // The template re-allow folds the template name and stays anchored.
+        let allow = workspace_template_regex(&link);
+        assert!(allow.starts_with('^'), "{allow}");
+        assert!(allow.contains(r"\.[eE][nN][vV]\."), "{allow}");
+        assert!(allow.ends_with('$'), "{allow}");
+
+        // The template re-deny requires a secret component before the template.
+        let re_deny = workspace_template_under_secret_regex(&link);
+        assert!(re_deny.contains(r"\.[sS][sS][hH]"), "{re_deny}");
+        assert!(re_deny.ends_with('$'), "{re_deny}");
+    }
+}
diff --git a/tests/corpus/apps/issue502-indirect-read/expectations.toml b/tests/corpus/apps/issue502-indirect-read/expectations.toml
new file mode 100644
index 00000000..ec3eee3e
--- /dev/null
+++ b/tests/corpus/apps/issue502-indirect-read/expectations.toml
@@ -0,0 +1,17 @@
+case_id = "issue502-indirect-read"
+source = "Issue #657 (stage 2 of #502): the lexical Bash guard cannot see a credential read whose name does not appear literally, so `cat notes.txt` through a symlink, `cat \"$BASH_ENV\"`, and a name an interpreter assembles from a heredoc are closed by the OS read sandbox instead. This corpus declares the indirect-read table; tests/issue502_os_sandbox_read.rs drives each row through the Seatbelt and Landlock read layers and asserts the home key canary never reaches the output."
+acceptance_passed = true
+primary_reason = "pass"
+
+[compile]
+expect = "not_checked"
+
+[fixture_contains]
+fixtures/indirect-cases.jsonl = [
+  "\"id\": \"home-direct\"",
+  "\"id\": \"home-symlink\"",
+  "\"id\": \"home-bash-env\"",
+  "\"id\": \"home-python-assembled\"",
+  "\"id\": \"workspace-template\"",
+  "\"id\": \"inside-read\""
+]
diff --git a/tests/corpus/apps/issue502-indirect-read/fixtures/indirect-cases.jsonl b/tests/corpus/apps/issue502-indirect-read/fixtures/indirect-cases.jsonl
new file mode 100644
index 00000000..73ad1755
--- /dev/null
+++ b/tests/corpus/apps/issue502-indirect-read/fixtures/indirect-cases.jsonl
@@ -0,0 +1,6 @@
+{"id": "home-direct", "command": "cat \"$HOME/.ssh/id_ed25519\"", "lexicalR": true, "exitNonzero": true, "note": "a directly named home secret; the lexical guard already refuses the .ssh component"}
+{"id": "home-symlink", "command": "cat \"$HOME/notes.txt\"", "lexicalR": false, "exitNonzero": true, "note": "a non-secret symlink name resolves to the key; only the OS read layer closes it"}
+{"id": "home-bash-env", "command": "cat \"$BASH_ENV\"", "lexicalR": false, "exitNonzero": true, "note": "a file named by a read-through environment variable (: contains no literal .ssh)"}
+{"id": "home-python-assembled", "command": "python3 - <<'PY'\nimport os, sys\nhome = os.environ[\"HOME\"]\nname = \".\" + \"s\" + \"sh\" + \"/\" + \"id_\" + \"ed25519\"\nsys.stdout.write(open(home + \"/\" + name).read())\nPY", "lexicalR": false, "exitNonzero": true, "note": "a name an interpreter assembles at run time from a heredoc"}
+{"id": "workspace-template", "command": "cat .env.example", "lexicalR": false, "exitNonzero": false, "note": "a strict dotenv template stays readable"}
+{"id": "inside-read", "command": "cat a.txt", "lexicalR": false, "exitNonzero": false, "note": "control: an ordinary workspace read stays allowed"}
diff --git a/tests/corpus/apps/issue502-indirect-read/fixtures/macos-probe-results.md b/tests/corpus/apps/issue502-indirect-read/fixtures/macos-probe-results.md
new file mode 100644
index 00000000..b2432ded
--- /dev/null
+++ b/tests/corpus/apps/issue502-indirect-read/fixtures/macos-probe-results.md
@@ -0,0 +1,62 @@
+# macOS Seatbelt applied read-probe record (Issue #657, stage 2)
+
+Recorded on a non-nested macOS environment where `sandbox-exec -p
+'(version 1)(allow default)' true` succeeds (`rc=0`). Drive this record with
+the commands below if it needs to be reproduced; the corpus table
+`indirect-cases.jsonl` is the machine-checked part and
+`tests/issue502_os_sandbox_read.rs` runs it.
+
+## Read layer used
+
+The fixed write profile gains a read-deny layer: each home secret location
+(`~/.ssh`, `~/.aws`, `~/.gnupg`, `~/.netrc`, `~/.git-credentials`, `~/.npmrc`,
+`~/.pypirc`, `~/.docker/config.json`, `~/.kube`, `~/.config/gh`,
+`~/.config/gcloud`) is passed as a `-D` parameter and denied with `(deny
+file-read* (subpath …))`; a generated regex denies the workspace credential
+names and a second, later regex re-allows the three strict dotenv templates.
+Reads are otherwise unchanged (`(allow default)`), so the toolchain, git, and
+the system stay readable.
+
+## Read-escape probes (must fail)
+
+| command form | sandbox outcome | home key canary |
+| --- | --- | --- |
+| `cat "$HOME/.ssh/id_ed25519"` | denied | not leaked |
+| `cat "$HOME/notes.txt"` (symlink to the key) | denied | not leaked |
+| `cat "$BASH_ENV"` (`BASH_ENV` = the key) | denied | not leaked |
+| `python3 - <<'PY' …` (assembles the name) | denied | not leaked |
+| `cat <workspace>/link.txt` (symlink to `.env`) | denied | workspace `.env` canary not leaked |
+| `cat <workspace>/.env` | denied | workspace `.env` canary not leaked |
+
+## Required tools inside the sandbox (must succeed)
+
+| command | outcome |
+| --- | --- |
+| `cat <workspace>/.env.example` | success (template) |
+| `git status --porcelain` | success |
+| `cargo --version` | success |
+| `node -e '…'` | success |
+| `python3 -c '…'` | success |
+| a workspace read (`cat a.txt`) | success |
+| a non-credential home read (`~/.config/other/settings`) | success |
+
+## Linux (Issue #657, stage 2)
+
+The Landlock read layer denies the same home secret list by rewriting it as a
+read-allow list, and keeps the toolchain, git, and the system readable and
+executable (recorded by `linux_applied_toolchain_git_and_system_are_readable_and_executable`).
+A workspace credential is closed lexically for a named reference; a non-secret
+symlink to it is not closed by the Linux read layer (decision 4) and is recorded
+as a documented gap by
+`linux_workspace_credential_symlink_is_not_closed_by_read_isolation`. Denying the
+home npm config means an `npm` that reads a private-registry `~/.npmrc` fails
+inside Bash (the consequence of not feeding registry tokens to Bash).
+
+## Unavailable-backend probes
+
+A simulated nested sandbox (`rc=71`) is covered by
+`tests/issue502_os_sandbox_read.rs`: `required` fails honestly with
+`bash_sandbox_unavailable` and `auto` records a reason and continues with lexical
+checks only, so `bash_sandbox_status` states the read isolation through its
+`reason` (a named clause while applied, or an empty reason for a fully confined
+sandbox) rather than a new field.
diff --git a/tests/issue502_os_sandbox_read.rs b/tests/issue502_os_sandbox_read.rs
new file mode 100644
index 00000000..a077bde2
--- /dev/null
+++ b/tests/issue502_os_sandbox_read.rs
@@ -0,0 +1,951 @@
+#![cfg(unix)]
+
+//! Issue #657 (stage 2 of #502): OS read confinement for model Bash and
+//! verifier commands. The lexical guard cannot see a credential read whose name
+//! does not appear literally (`cat notes.txt` through a symlink, `cat
+//! "$BASH_ENV"`, or a name an interpreter assembles at run time). This file
+//! drives the macOS Seatbelt and Linux Landlock read layers through the same
+//! `wrap_command` the two launch points use, so those indirect reads fail. The
+//! corpus table `indirect-cases.jsonl` is the machine-checked part.
+//!
+//! Every fixture is built inside one test tempdir: the fake home, the canary
+//! "key", and the symlinks never touch the real home or `~/.ssh`. The home is
+//! passed to the backend as a policy argument (`SandboxPolicy::with_home`), so
+//! no test mutates the process `HOME` and parallel tests cannot race on it. The
+//! workspace root is deliberately left un-canonicalized (a system temp dir under
+//! `/var/folders/...` on macOS), so the macOS cases prove the regexes canonicalize
+//! it.
+//!
+//! The macOS applied cases are `#[cfg(target_os = "macos")]` and no-op when the
+//! backend is unavailable (a nested sandbox reports rc=71). The Linux applied
+//! cases are `#[cfg(target_os = "linux")]` and fail under CI when Landlock is
+//! unavailable, so the runner cannot silently lose the read backend. The kernel
+//! and Landlock ABI are printed for the record.
+
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+use std::sync::{Mutex, MutexGuard};
+use std::time::Duration;
+
+use commandagent::bounded_process::{self, BoundedProcessOutput};
+#[cfg(target_os = "linux")]
+use commandagent::tools::bash::path_confinement_rejection;
+use commandagent::tools::os_sandbox::{self, SandboxAvailability, SandboxMode, SandboxPolicy};
+use commandagent::tools::sensitive_path::command_references_secret;
+use serde::Deserialize;
+
+/// The fake home `~/.ssh/id_ed25519` canary. Never a real key.
+const HOME_KEY_CANARY: &str = "HOME_KEY_CANARY_657";
+/// The fake home `~/.config/gh/hosts.yml` canary.
+const GH_CANARY: &str = "HOME_GH_CANARY_657";
+/// The content of every fake workspace credential (never a real secret).
+const WS_CANARY: &str = "WORKSPACE_SECRET_CANARY_657";
+/// The content of a readable dotenv template.
+const TEMPLATE_OK: &str = "TEMPLATE_OK_657";
+/// The nested-sandbox reason used to simulate an unavailable backend.
+const NESTED: &str = "sandbox-exec probe exited with exit status: 71";
+const TIMEOUT: Duration = Duration::from_secs(120);
+
+/// The sandbox state is process-wide, so the tests that install it serialize.
+static SANDBOX_LOCK: Mutex<()> = Mutex::new(());
+
+fn sandbox_lock() -> MutexGuard<'static, ()> {
+    SANDBOX_LOCK
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner())
+}
+
+/// A workspace (`ws`) and a sibling fake home (`home`) inside one un-canonical
+/// test tempdir. The home holds fake key material and the workspace holds fake
+/// credentials in the shapes #501 denies: a plain `.env`, mixed-case names, a
+/// credential-named directory with a child, a template below a credential
+/// directory, the path-sequence credentials, and non-secret symlink aliases.
+struct Fixture {
+    _dir: tempfile::TempDir,
+    root: PathBuf,
+    home: PathBuf,
+    ssh_secret: PathBuf,
+    gh_secret: PathBuf,
+}
+
+fn fixture() -> Fixture {
+    let dir = tempfile::tempdir().expect("create tempdir");
+    let ws = dir.path().join("ws");
+    let home = dir.path().join("home");
+    std::fs::create_dir_all(&ws).unwrap();
+    std::fs::create_dir_all(home.join(".ssh")).unwrap();
+    std::fs::create_dir_all(home.join(".config/gh")).unwrap();
+    std::fs::create_dir_all(home.join(".config/other")).unwrap();
+    std::fs::write(home.join(".ssh/id_ed25519"), format!("{HOME_KEY_CANARY}\n")).unwrap();
+    std::fs::write(home.join(".config/gh/hosts.yml"), format!("{GH_CANARY}\n")).unwrap();
+    std::fs::write(home.join(".config/other/settings"), "OTHER_OK\n").unwrap();
+    std::fs::write(ws.join("a.txt"), "x\n").unwrap();
+
+    // Workspace credentials, in the shapes #501 denies.
+    std::fs::write(ws.join(".env"), format!("{WS_CANARY}\n")).unwrap();
+    std::fs::write(ws.join(".Env.local"), format!("{WS_CANARY}\n")).unwrap();
+    std::fs::write(ws.join("SERVICE-ACCOUNT.json"), format!("{WS_CANARY}\n")).unwrap();
+    std::fs::create_dir_all(ws.join(".SSH")).unwrap();
+    std::fs::write(ws.join(".SSH/id_rsa"), format!("{WS_CANARY}\n")).unwrap();
+    std::fs::create_dir_all(ws.join(".env.d")).unwrap();
+    std::fs::write(ws.join(".env.d/x"), format!("{WS_CANARY}\n")).unwrap();
+    std::fs::create_dir_all(ws.join(".aws")).unwrap();
+    std::fs::write(ws.join(".aws/credentials"), format!("{WS_CANARY}\n")).unwrap();
+    std::fs::create_dir_all(ws.join(".docker")).unwrap();
+    std::fs::write(ws.join(".docker/config.json"), format!("{WS_CANARY}\n")).unwrap();
+    std::fs::create_dir_all(ws.join(".config/gcloud")).unwrap();
+    std::fs::write(
+        ws.join(".config/gcloud/application_default_credentials.json"),
+        format!("{WS_CANARY}\n"),
+    )
+    .unwrap();
+    // Templates: a plain one, a subdir one, and one below a credential directory
+    // (which must stay denied).
+    std::fs::write(ws.join(".env.example"), format!("{TEMPLATE_OK}\n")).unwrap();
+    std::fs::create_dir_all(ws.join("sub")).unwrap();
+    std::fs::write(ws.join("sub/.env.example"), format!("{TEMPLATE_OK}\n")).unwrap();
+    std::fs::write(ws.join(".SSH/.env.example"), format!("{WS_CANARY}\n")).unwrap();
+
+    // Non-secret symlink aliases: `notes.txt` for the home key, `link.txt` for
+    // the workspace `.env`.
+    std::os::unix::fs::symlink(home.join(".ssh/id_ed25519"), home.join("notes.txt")).unwrap();
+    std::os::unix::fs::symlink(ws.join(".env"), ws.join("link.txt")).unwrap();
+
+    Fixture {
+        ssh_secret: home.join(".ssh/id_ed25519"),
+        gh_secret: home.join(".config/gh/hosts.yml"),
+        _dir: dir,
+        root: ws,
+        home,
+    }
+}
+
+fn run_tmp_path(fixture: &Fixture) -> PathBuf {
+    fixture._dir.path().join("run-tmp")
+}
+
+#[cfg(target_os = "macos")]
+fn backend_available() -> bool {
+    matches!(os_sandbox::probe(), SandboxAvailability::Available)
+}
+
+/// Install an available sandbox for `home` and create its run temp dir.
+fn install_available_for(workspace: &Path, run_tmp: &Path, home: &Path) {
+    std::fs::create_dir_all(run_tmp).unwrap();
+    os_sandbox::install_for_test(
+        SandboxMode::Auto,
+        SandboxPolicy::with_home(workspace, run_tmp, home.to_path_buf()),
+        SandboxAvailability::Available,
+    );
+}
+
+/// Install an available sandbox for the fixture's workspace and fake home.
+fn install_available(fixture: &Fixture) {
+    install_available_for(&fixture.root, &run_tmp_path(fixture), &fixture.home);
+}
+
+/// Install an explicit available policy and return its status, for the status
+/// tests that do not run a command.
+fn install_status(workspace: &Path, run_tmp: &Path, home: &Path) -> os_sandbox::SandboxStatus {
+    install_available_for(workspace, run_tmp, home);
+    os_sandbox::status().expect("installed")
+}
+
+/// Build `sh -c <command>`, set `envs`, and apply the installed sandbox
+/// directly, bypassing the lexical guard, so the OS read layer is measured on
+/// its own.
+fn run_wrapped_env(root: &Path, command: &str, envs: &[(&str, &str)]) -> BoundedProcessOutput {
+    let mut process = Command::new("sh");
+    process.arg("-c").arg(command).current_dir(root);
+    for (key, value) in envs {
+        process.env(key, value);
+    }
+    let mut process = os_sandbox::wrap_command(process).expect("available sandbox wraps");
+    process.stdout(Stdio::piped()).stderr(Stdio::piped());
+    bounded_process::run_with_timeout(&mut process, TIMEOUT).expect("spawn wrapped command")
+}
+
+fn run_wrapped(root: &Path, command: &str) -> BoundedProcessOutput {
+    run_wrapped_env(root, command, &[])
+}
+
+/// Assert a credential read fails under the OS layer and leaks no canary.
+fn assert_read_denied(root: &Path, command: &str, envs: &[(&str, &str)], canary: &str) {
+    let output = run_wrapped_env(root, command, envs);
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        !stdout.contains(canary) && !stderr.contains(canary),
+        "the canary must not leak for `{command}`; stdout={stdout:?} stderr={stderr:?}"
+    );
+    assert!(
+        !output.success(),
+        "the read must fail for `{command}`; stdout={stdout:?} stderr={stderr:?}"
+    );
+}
+
+/// Assert a read succeeds and returns the expected content.
+fn assert_read_allowed(root: &Path, command: &str, expected: &str) {
+    let output = run_wrapped(root, command);
+    assert!(
+        output.success(),
+        "the read must succeed for `{command}`; stderr={}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    assert!(
+        String::from_utf8_lossy(&output.stdout).contains(expected),
+        "`{command}` must return {expected:?}; stdout={:?}",
+        String::from_utf8_lossy(&output.stdout)
+    );
+}
+
+/// One row of the machine-checked read table.
+#[derive(Deserialize)]
+struct IndirectReadCase {
+    id: String,
+    command: String,
+    /// Whether the lexical guard already refuses the command.
+    #[serde(rename = "lexicalR")]
+    lexical_r: bool,
+    /// Whether the read fails once the OS layer is applied.
+    #[serde(rename = "exitNonzero")]
+    exit_nonzero: bool,
+}
+
+fn indirect_cases() -> Vec<IndirectReadCase> {
+    let path = Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("tests/corpus/apps/issue502-indirect-read/fixtures/indirect-cases.jsonl");
+    let text = std::fs::read_to_string(&path)
+        .unwrap_or_else(|error| panic!("read {}: {error}", path.display()));
+    text.lines()
+        .filter(|line| !line.trim().is_empty())
+        .map(|line| serde_json::from_str(line).unwrap_or_else(|error| panic!("{line:?}: {error}")))
+        .collect()
+}
+
+/// Drive the corpus rows through the applied read layer. `HOME` and `BASH_ENV`
+/// point at the fake home key, so a row can read it only through a name that
+/// does not show up lexically.
+fn drive_indirect_reads(fixture: &Fixture) {
+    let home = fixture.home.to_string_lossy().into_owned();
+    let ssh = fixture.ssh_secret.to_string_lossy().into_owned();
+    for case in indirect_cases() {
+        assert_eq!(
+            command_references_secret(&case.command).is_some(),
+            case.lexical_r,
+            "{}: the lexical decision must be unchanged",
+            case.id
+        );
+        let output = run_wrapped_env(
+            &fixture.root,
+            &case.command,
+            &[("HOME", home.as_str()), ("BASH_ENV", ssh.as_str())],
+        );
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        assert_eq!(
+            !output.success(),
+            case.exit_nonzero,
+            "{}: OS read outcome; stdout={stdout:?} stderr={stderr:?}",
+            case.id
+        );
+        assert!(
+            !stdout.contains(HOME_KEY_CANARY) && !stderr.contains(HOME_KEY_CANARY),
+            "{}: the home key must not leak; stdout={stdout:?} stderr={stderr:?}",
+            case.id
+        );
+    }
+}
+
+// ---------------------------------------------------------------------------
+// The lexical layer is unchanged and shared: a workspace credential named
+// directly is refused, a non-secret symlink name is not.
+// ---------------------------------------------------------------------------
+
+#[test]
+fn workspace_dotenv_reference_is_lexical_and_a_symlink_name_is_not() {
+    assert!(
+        command_references_secret("cat .env").is_some(),
+        "a directly named workspace credential stays refused lexically"
+    );
+    assert!(
+        command_references_secret("cat link.txt").is_none(),
+        "a non-secret symlink name is not a lexical reference"
+    );
+}
+
+/// With no home secret location known (an empty `HOME`), the read layer has
+/// nothing to deny, so the status must say the read isolation is ineffective
+/// rather than claim it is applied. This uses the explicit install seam, so it
+/// needs no backend.
+#[test]
+fn empty_home_reports_ineffective_read_isolation() {
+    let _guard = sandbox_lock();
+    let fixture = fixture();
+    let status = install_status(&fixture.root, &run_tmp_path(&fixture), Path::new(""));
+    assert!(status.applied, "{status:?}");
+    assert!(!status.read_isolation, "{status:?}");
+    assert!(
+        status
+            .reason
+            .as_deref()
+            .is_some_and(|reason| reason.contains("read isolation is not effective")),
+        "{status:?}"
+    );
+    os_sandbox::reset_for_test();
+}
+
+// ---------------------------------------------------------------------------
+// macOS (Issue #657, stage 2): the Seatbelt read layer denies home secrets and
+// workspace credentials, and keeps the strict templates readable.
+// ---------------------------------------------------------------------------
+
+/// The applied read set on macOS: every indirect home-secret form fails and the
+/// canary never appears. The home is the fake tempdir, never the real one.
+#[cfg(target_os = "macos")]
+#[test]
+fn applied_indirect_reads_are_denied_on_macos() {
+    let _guard = sandbox_lock();
+    if !backend_available() {
+        eprintln!("SKIP: sandbox backend unavailable (nested sandbox?)");
+        return;
+    }
+    let fixture = fixture();
+    install_available(&fixture);
+
+    drive_indirect_reads(&fixture);
+
+    // A lower- and an upper-case home secret path, and a non-credential sibling.
+    assert_read_denied(
+        &fixture.root,
+        &format!("cat '{}'", fixture.gh_secret.display()),
+        &[],
+        GH_CANARY,
+    );
+    assert_read_denied(
+        &fixture.root,
+        &format!(
+            "cat '{}'",
+            fixture.home.join(".config/GH/hosts.yml").display()
+        ),
+        &[],
+        GH_CANARY,
+    );
+    let other = fixture.home.join(".config/other/settings");
+    assert_read_allowed(
+        &fixture.root,
+        &format!("cat '{}'", other.display()),
+        "OTHER_OK",
+    );
+    assert_read_allowed(&fixture.root, "cat a.txt", "x");
+
+    os_sandbox::reset_for_test();
+}
+
+/// The workspace credential rule denies the case-insensitive names, a
+/// credential-named directory's contents, the #501 path sequences, and a
+/// template below a credential directory, while the plain and subdir templates
+/// stay readable. The workspace root is not canonicalized, so this also proves
+/// the regex root is canonicalized.
+#[cfg(target_os = "macos")]
+#[test]
+fn applied_workspace_credentials_are_denied_but_templates_stay_readable() {
+    let _guard = sandbox_lock();
+    if !backend_available() {
+        eprintln!("SKIP: sandbox backend unavailable (nested sandbox?)");
+        return;
+    }
+    let fixture = fixture();
+    install_available(&fixture);
+
+    for command in [
+        "cat .env",
+        "cat link.txt",
+        "cat .Env.local",
+        "cat SERVICE-ACCOUNT.json",
+        "cat .SSH/id_rsa",
+        "cat .env.d/x",
+        "cat .aws/credentials",
+        "cat .docker/config.json",
+        "cat .config/gcloud/application_default_credentials.json",
+        "cat .SSH/.env.example",
+    ] {
+        assert_read_denied(&fixture.root, command, &[], WS_CANARY);
+    }
+    assert_read_allowed(&fixture.root, "cat .env.example", TEMPLATE_OK);
+    assert_read_allowed(&fixture.root, "cat sub/.env.example", TEMPLATE_OK);
+
+    os_sandbox::reset_for_test();
+}
+
+/// A workspace below a symlinked directory is still confined: the workspace
+/// regex root is canonicalized, so Seatbelt's resolved path matches.
+#[cfg(target_os = "macos")]
+#[test]
+fn applied_workspace_under_a_symlinked_root_is_denied() {
+    let _guard = sandbox_lock();
+    if !backend_available() {
+        eprintln!("SKIP: sandbox backend unavailable (nested sandbox?)");
+        return;
+    }
+    let fixture = fixture();
+    let real = fixture._dir.path().join("real");
+    std::fs::create_dir_all(real.join("ws")).unwrap();
+    std::fs::write(real.join("ws/.env"), format!("{WS_CANARY}\n")).unwrap();
+    std::fs::write(real.join("ws/.env.example"), format!("{TEMPLATE_OK}\n")).unwrap();
+    let link = fixture._dir.path().join("link");
+    std::os::unix::fs::symlink(&real, &link).unwrap();
+    let workspace = link.join("ws"); // deliberately not canonicalized
+    let run_tmp = fixture._dir.path().join("link-run-tmp");
+    install_available_for(&workspace, &run_tmp, &fixture.home);
+
+    assert_read_denied(&workspace, "cat .env", &[], WS_CANARY);
+    assert_read_allowed(&workspace, "cat .env.example", TEMPLATE_OK);
+
+    os_sandbox::reset_for_test();
+}
+
+/// The run-start status reports the applied read isolation through the existing
+/// `reason` field, not a new event field.
+#[cfg(target_os = "macos")]
+#[test]
+fn applied_status_reports_read_isolation_in_the_reason() {
+    let _guard = sandbox_lock();
+    if !backend_available() {
+        eprintln!("SKIP: sandbox backend unavailable (nested sandbox?)");
+        return;
+    }
+    let fixture = fixture();
+    install_available(&fixture);
+
+    let status = os_sandbox::status().expect("installed");
+    assert!(status.applied, "{status:?}");
+    assert!(status.read_isolation, "{status:?}");
+    assert_eq!(
+        status.reason.as_deref(),
+        Some("read isolation applied"),
+        "{status:?}"
+    );
+
+    os_sandbox::reset_for_test();
+}
+
+/// On macOS the read deny is applied after `(allow default)`, so a workspace
+/// that is the home itself does not re-open a secret: the status still reports
+/// the read isolation applied and the secret stays denied.
+#[cfg(target_os = "macos")]
+#[test]
+fn applied_workspace_equal_to_home_still_denies_secrets() {
+    let _guard = sandbox_lock();
+    if !backend_available() {
+        eprintln!("SKIP: sandbox backend unavailable (nested sandbox?)");
+        return;
+    }
+    let fixture = fixture();
+    let status = install_status(&fixture.home, &run_tmp_path(&fixture), &fixture.home);
+    assert!(status.applied, "{status:?}");
+    assert!(status.read_isolation, "{status:?}");
+    assert_eq!(
+        status.reason.as_deref(),
+        Some("read isolation applied"),
+        "{status:?}"
+    );
+
+    assert_read_denied(
+        &fixture.home,
+        &format!("cat '{}'", fixture.ssh_secret.display()),
+        &[],
+        HOME_KEY_CANARY,
+    );
+    os_sandbox::reset_for_test();
+}
+
+/// A symlinked home secret location (`~/.ssh` pointing outside the home) denies
+/// its canonical target.
+#[cfg(target_os = "macos")]
+#[test]
+fn applied_symlinked_home_secret_location_denies_its_target() {
+    let _guard = sandbox_lock();
+    if !backend_available() {
+        eprintln!("SKIP: sandbox backend unavailable (nested sandbox?)");
+        return;
+    }
+    let fixture = fixture();
+    let home = fixture._dir.path().join("home2");
+    let outside = fixture._dir.path().join("outside");
+    std::fs::create_dir_all(&home).unwrap();
+    std::fs::create_dir_all(&outside).unwrap();
+    std::fs::write(outside.join("id_rsa"), format!("{HOME_KEY_CANARY}\n")).unwrap();
+    std::os::unix::fs::symlink(&outside, home.join(".ssh")).unwrap();
+    let run_tmp = fixture._dir.path().join("home2-run-tmp");
+    install_available_for(&fixture.root, &run_tmp, &home);
+
+    assert_read_denied(
+        &fixture.root,
+        &format!("cat '{}/.ssh/id_rsa'", home.display()),
+        &[],
+        HOME_KEY_CANARY,
+    );
+    os_sandbox::reset_for_test();
+}
+
+/// The model Bash launch point is wired to the same read layer: an indirect read
+/// the lexical guard accepts still fails.
+#[cfg(target_os = "macos")]
+#[test]
+fn applied_launch_point_denies_an_indirect_read() {
+    let _guard = sandbox_lock();
+    if !backend_available() {
+        eprintln!("SKIP: sandbox backend unavailable (nested sandbox?)");
+        return;
+    }
+    let fixture = fixture();
+    install_available(&fixture);
+
+    let command = format!("cat '{}'", fixture.home.join("notes.txt").display());
+    assert!(
+        command_references_secret(&command).is_none(),
+        "the lexical guard must pass this form so the read layer is what blocks it"
+    );
+    let outcome = commandagent::tools::bash::run_structured_cancel_and_force(
+        &command,
+        &fixture.root,
+        false,
+        TIMEOUT,
+        || false,
+        || false,
+    )
+    .expect("bash launch");
+    assert!(!outcome.is_success(), "{outcome:?}");
+    assert!(
+        !outcome.summary.contains(HOME_KEY_CANARY),
+        "{}",
+        outcome.summary
+    );
+
+    os_sandbox::reset_for_test();
+}
+
+// ---------------------------------------------------------------------------
+// Linux (Issue #657, stage 2): the Landlock read layer denies home secrets and
+// keeps the toolchain, git, and the system readable and executable.
+// ---------------------------------------------------------------------------
+
+/// Ask the kernel for its Landlock ABI without going through the backend, so a
+/// mutated `landlock::detected_abi()` cannot make these tests agree with
+/// themselves.
+#[cfg(target_os = "linux")]
+fn kernel_landlock_abi() -> u32 {
+    const LANDLOCK_CREATE_RULESET_VERSION: libc::c_uint = 1;
+    let ret = unsafe {
+        libc::syscall(
+            libc::SYS_landlock_create_ruleset,
+            std::ptr::null::<libc::c_void>(),
+            0usize,
+            LANDLOCK_CREATE_RULESET_VERSION,
+        )
+    };
+    if ret < 0 { 0 } else { ret as u32 }
+}
+
+#[cfg(target_os = "linux")]
+fn landlock_kernel_release() -> String {
+    commandagent::tools::os_sandbox::landlock::kernel_release_label()
+}
+
+/// The ABI-gated outcome for an ABI-dependent Linux test.
+#[cfg(target_os = "linux")]
+#[derive(Debug, PartialEq, Eq)]
+enum AbiGate {
+    Continue,
+    Skip(String),
+    Fail(String),
+}
+
+/// The skip/fail reasons name the kernel and the ABI, so a missing read backend
+/// is never hidden under CI.
+#[cfg(target_os = "linux")]
+fn abi_gate(ci: bool, abi: u32, required_abi: u32, kernel: &str) -> AbiGate {
+    if abi >= required_abi {
+        AbiGate::Continue
+    } else if ci {
+        AbiGate::Fail(format!(
+            "CI: Landlock ABI {abi} (kernel {kernel}) is below the required ABI{required_abi}"
+        ))
+    } else {
+        AbiGate::Skip(format!(
+            "SKIP: Landlock ABI {abi} (kernel {kernel}) < {required_abi}"
+        ))
+    }
+}
+
+/// The read layer needs ABI1, the same as the write layer, so this mostly pins
+/// the CI contract: an ABI below 1 fails under CI and skips otherwise.
+#[cfg(target_os = "linux")]
+fn require_abi_or_ci_fail(abi: u32, required_abi: u32) -> bool {
+    match abi_gate(
+        std::env::var_os("CI").is_some(),
+        abi,
+        required_abi,
+        &landlock_kernel_release(),
+    ) {
+        AbiGate::Continue => true,
+        AbiGate::Skip(reason) => {
+            eprintln!("{reason}");
+            false
+        }
+        AbiGate::Fail(reason) => panic!("{reason}"),
+    }
+}
+
+/// Append the kernel release and Landlock ABI to `$GITHUB_STEP_SUMMARY` once per
+/// process, when that variable is set. Best effort.
+#[cfg(target_os = "linux")]
+fn record_kernel_and_abi_in_step_summary() {
+    use std::sync::Once;
+
+    static ONCE: Once = Once::new();
+    ONCE.call_once(|| {
+        let Some(path) = std::env::var_os("GITHUB_STEP_SUMMARY") else {
+            return;
+        };
+        let line = format!(
+            "issue502/657 landlock read: kernel={} abi={}\n",
+            landlock_kernel_release(),
+            kernel_landlock_abi()
+        );
+        let _ = std::fs::OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(path)
+            .and_then(|mut file| std::io::Write::write_all(&mut file, line.as_bytes()));
+    });
+}
+
+/// Print the kernel release and Landlock ABI, and refuse a silent skip under
+/// CI: a GitHub Actions Linux runner must have an applied read backend. A read
+/// layer that is not applied cannot be distinguished from "unavailable", so the
+/// backend must be available or the test fails under CI.
+#[cfg(target_os = "linux")]
+fn require_landlock_backend() -> bool {
+    use commandagent::tools::os_sandbox::landlock;
+    record_kernel_and_abi_in_step_summary();
+    let abi = kernel_landlock_abi();
+    let kernel = landlock::kernel_release_label();
+    let available = matches!(os_sandbox::probe(), SandboxAvailability::Available);
+    let reported = landlock::detected_abi();
+    eprintln!("issue502/657 landlock read: kernel={kernel} abi={abi} detected_abi={reported}");
+    if available {
+        assert_eq!(
+            reported, abi,
+            "detected_abi() must equal the kernel ABI queried independently"
+        );
+    }
+    if std::env::var_os("CI").is_some() {
+        assert!(
+            available,
+            "CI: the Landlock backend must be available (kernel {kernel}, abi {abi})"
+        );
+    }
+    available
+}
+
+/// The applied read set on Linux: every indirect home-secret form fails and the
+/// canary never appears.
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_applied_indirect_reads_are_denied() {
+    let _guard = sandbox_lock();
+    if !require_landlock_backend() {
+        eprintln!("SKIP: Landlock backend unavailable");
+        return;
+    }
+    let abi = kernel_landlock_abi();
+    if !require_abi_or_ci_fail(abi, 1) {
+        return;
+    }
+    let fixture = fixture();
+    install_available(&fixture);
+
+    drive_indirect_reads(&fixture);
+    assert_read_denied(
+        &fixture.root,
+        &format!("cat '{}'", fixture.gh_secret.display()),
+        &[],
+        GH_CANARY,
+    );
+
+    let other = fixture.home.join(".config/other/settings");
+    assert_read_allowed(
+        &fixture.root,
+        &format!("cat '{}'", other.display()),
+        "OTHER_OK",
+    );
+    assert_read_allowed(&fixture.root, "cat a.txt", "x");
+
+    os_sandbox::reset_for_test();
+}
+
+/// A symlinked home secret location (`~/.ssh` pointing outside the home) denies
+/// its canonical target on Linux too: the expansion canonicalizes each location
+/// before building the read-allow list.
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_applied_symlinked_home_secret_location_denies_its_target() {
+    let _guard = sandbox_lock();
+    if !require_landlock_backend() {
+        eprintln!("SKIP: Landlock backend unavailable");
+        return;
+    }
+    let fixture = fixture();
+    let home = fixture._dir.path().join("home2");
+    let outside = fixture._dir.path().join("outside");
+    std::fs::create_dir_all(&home).unwrap();
+    std::fs::create_dir_all(&outside).unwrap();
+    std::fs::write(outside.join("id_rsa"), format!("{HOME_KEY_CANARY}\n")).unwrap();
+    std::os::unix::fs::symlink(&outside, home.join(".ssh")).unwrap();
+    let run_tmp = fixture._dir.path().join("home2-run-tmp");
+    install_available_for(&fixture.root, &run_tmp, &home);
+
+    assert_read_denied(
+        &fixture.root,
+        &format!("cat '{}/.ssh/id_rsa'", home.display()),
+        &[],
+        HOME_KEY_CANARY,
+    );
+    os_sandbox::reset_for_test();
+}
+
+/// When a writable location is the home (or an ancestor of a secret), the write
+/// allow list already grants read on the secret's subtree, so the read layer
+/// cannot deny it. The status must say so instead of claiming the read isolation
+/// is applied. This uses the explicit install seam, so it needs no backend.
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_workspace_equal_to_home_reports_ineffective_read_isolation() {
+    let _guard = sandbox_lock();
+    let fixture = fixture();
+    let status = install_status(&fixture.home, &run_tmp_path(&fixture), &fixture.home);
+    assert!(status.applied, "{status:?}");
+    assert!(!status.read_isolation, "{status:?}");
+    assert!(
+        status
+            .reason
+            .as_deref()
+            .is_some_and(|reason| reason.contains("read isolation is not effective for")),
+        "{status:?}"
+    );
+    os_sandbox::reset_for_test();
+}
+
+/// The Linux read layer denies only the home secret locations. A workspace
+/// `.env` named directly is closed by the lexical guard; a non-secret symlink to
+/// it is not closed by the read layer (documented limitation, decision 4), so
+/// this test records that gap instead of hiding it.
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_workspace_credential_symlink_is_not_closed_by_read_isolation() {
+    let _guard = sandbox_lock();
+    if !require_landlock_backend() {
+        eprintln!("SKIP: Landlock backend unavailable");
+        return;
+    }
+    let fixture = fixture();
+    install_available(&fixture);
+
+    assert!(
+        command_references_secret("cat .env").is_some(),
+        "a directly named workspace credential is refused lexically"
+    );
+    assert!(command_references_secret("cat link.txt").is_none());
+    assert!(path_confinement_rejection("cat link.txt", &fixture.root).is_none());
+    let output = run_wrapped(&fixture.root, "cat link.txt");
+    assert!(
+        output.success(),
+        "the Linux read layer does not close a workspace-credential symlink; stderr={}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    os_sandbox::reset_for_test();
+}
+
+/// The applied read list keeps the toolchain, git, and the system locations
+/// readable and executable, and the writable run temp directory usable.
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_applied_toolchain_git_and_system_are_readable_and_executable() {
+    let _guard = sandbox_lock();
+    if !require_landlock_backend() {
+        eprintln!("SKIP: Landlock backend unavailable");
+        return;
+    }
+    let fixture = fixture();
+    install_available(&fixture);
+
+    let script = r#"
+for tool in cargo rustc rustup npm node python3 git; do
+  if command -v "$tool" >/dev/null 2>&1; then
+    "$tool" --version >/dev/null || { echo "FAIL $tool"; exit 1; }
+  fi
+done
+ls /usr >/dev/null && ls /etc >/dev/null && ls /proc >/dev/null && ls /dev >/dev/null
+echo TOOLCHAIN_OK
+"#;
+    let output = run_wrapped(&fixture.root, script);
+    assert!(
+        output.success() && String::from_utf8_lossy(&output.stdout).contains("TOOLCHAIN_OK"),
+        "the toolchain, git, and system locations must stay readable and executable; stderr={}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    os_sandbox::reset_for_test();
+}
+
+/// The run-start status reports the read isolation through the existing reason:
+/// an older ABI leaves a write operation open and the reason names the read
+/// isolation with it; a fully closed ABI leaves no reason, which means fully
+/// confined (reads included).
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_installed_status_reports_read_isolation() {
+    let _guard = sandbox_lock();
+    if !require_landlock_backend() {
+        eprintln!("SKIP: Landlock backend unavailable");
+        return;
+    }
+    let fixture = fixture();
+    let state_dir = fixture._dir.path().join("state");
+
+    let status = os_sandbox::install(SandboxMode::Auto, &fixture.root, &state_dir);
+    assert_eq!(status.backend, "landlock", "{status:?}");
+    assert!(status.applied, "{status:?}");
+    assert!(status.read_isolation, "{status:?}");
+    if let Some(reason) = status.reason.as_deref() {
+        assert!(reason.contains("read isolation applied"), "{reason}");
+    }
+    let reported = os_sandbox::status().expect("installed");
+    assert_eq!(reported.read_isolation, status.read_isolation);
+    assert_eq!(reported.reason, status.reason);
+
+    os_sandbox::cleanup();
+    os_sandbox::reset_for_test();
+}
+
+/// A dependency-less `cargo build` succeeds with the read layer applied. Ignored
+/// by default; run explicitly to record the applied result.
+#[cfg(target_os = "linux")]
+#[test]
+#[ignore = "heavy: run explicitly to record the applied result"]
+fn linux_applied_cargo_build_succeeds() {
+    let _guard = sandbox_lock();
+    if !require_landlock_backend() {
+        return;
+    }
+    let fixture = fixture();
+    install_available(&fixture);
+    let src = fixture.root.join("src");
+    std::fs::create_dir_all(&src).unwrap();
+    std::fs::write(
+        fixture.root.join("Cargo.toml"),
+        "[package]\nname = \"issue502-read-probe\"\nversion = \"0.1.0\"\nedition = \"2021\"\n\n[workspace]\n",
+    )
+    .unwrap();
+    std::fs::write(src.join("main.rs"), "fn main() {}\n").unwrap();
+
+    let output = run_wrapped(&fixture.root, "cargo build");
+    assert!(
+        output.success(),
+        "cargo build failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    assert!(
+        fixture
+            .root
+            .join("target/debug/issue502-read-probe")
+            .is_file()
+    );
+    os_sandbox::reset_for_test();
+}
+
+/// A cached, offline `npm ci` succeeds with the read layer applied, unless the
+/// private-registry `~/.npmrc` it would read is a home secret (the documented
+/// consequence of denying home npm config). Ignored by default; run explicitly
+/// to record the applied result.
+#[cfg(target_os = "linux")]
+#[test]
+#[ignore = "heavy: run explicitly to record the applied result"]
+fn linux_applied_npm_ci_succeeds_when_cached() {
+    let _guard = sandbox_lock();
+    if !require_landlock_backend() {
+        return;
+    }
+    let fixture = fixture();
+    install_available(&fixture);
+    std::fs::write(
+        fixture.root.join("package.json"),
+        "{\"name\":\"issue502-read-probe\",\"version\":\"0.1.0\",\"private\":true}\n",
+    )
+    .unwrap();
+    std::fs::write(
+        fixture.root.join("package-lock.json"),
+        "{\"name\":\"issue502-read-probe\",\"version\":\"0.1.0\",\"lockfileVersion\":3,\"requires\":true,\"packages\":{\"\":{\"name\":\"issue502-read-probe\",\"version\":\"0.1.0\"}}}\n",
+    )
+    .unwrap();
+
+    let output = run_wrapped_env(
+        &fixture.root,
+        "npm ci --offline",
+        &[("NEXT_TELEMETRY_DISABLED", "1")],
+    );
+    assert!(
+        output.success(),
+        "npm ci failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    os_sandbox::reset_for_test();
+}
+
+/// The ABI gate: a too-old ABI fails under CI, skips on a local run, and a new
+/// enough ABI continues. The kernel and the queried ABI appear in the reason.
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_abi_gate_fails_under_ci_and_skips_otherwise() {
+    let kernel = "6.1.0-generic";
+    assert!(
+        matches!(
+            abi_gate(true, 0, 1, kernel),
+            AbiGate::Fail(reason) if reason.contains(kernel) && reason.contains('0')
+        ),
+        "{:?}",
+        abi_gate(true, 0, 1, kernel)
+    );
+    assert!(matches!(abi_gate(false, 0, 1, kernel), AbiGate::Skip(_)));
+    assert_eq!(abi_gate(false, 1, 1, kernel), AbiGate::Continue);
+    assert_eq!(abi_gate(true, 1, 1, kernel), AbiGate::Continue);
+    assert_eq!(abi_gate(false, 8, 1, kernel), AbiGate::Continue);
+}
+
+// ---------------------------------------------------------------------------
+// Shared unavailable path: `required` fails honestly and `auto` continues.
+// ---------------------------------------------------------------------------
+
+#[test]
+fn required_and_unavailable_fail_honestly_and_auto_continues() {
+    let _guard = sandbox_lock();
+    let fixture = fixture();
+
+    for mode in [SandboxMode::Required, SandboxMode::Auto] {
+        os_sandbox::install_for_test(
+            mode,
+            SandboxPolicy::with_home(&fixture.root, &run_tmp_path(&fixture), fixture.home.clone()),
+            SandboxAvailability::Unavailable(NESTED.to_string()),
+        );
+        let status = os_sandbox::status().unwrap();
+        assert!(!status.applied, "{status:?}");
+        assert!(!status.read_isolation, "{status:?}");
+        assert_eq!(status.reason.as_deref(), Some(NESTED), "{status:?}");
+    }
+
+    assert!(NESTED.contains("71"));
+    os_sandbox::reset_for_test();
+}