fix(sandbox): agree on the runtime root across the Windows setup marker - #901

Open

Vasanthdev2004 wants to merge 54 commits into

mainfrom

fix/windows-setup-marker-runtime-root

Commits on Sep 2, 2026

fix(sandbox): agree on the runtime root across the Windows setup marker
Vasanthdev2004
committed
e68fb87
fix(sandbox): create the Windows runtime roots the ACL plan grants
Vasanthdev2004
committed
920e26e
test(sandbox): keep the provisioning tests inside test-owned directories
Vasanthdev2004
committed
4791a0a
fix(sandbox): pin the Windows runtime root instead of deriving it twice
Vasanthdev2004
committed
2a71caf
test(sandbox): compare canonical spellings in the ownership guard
Vasanthdev2004
committed
6fcd522
test(sandbox): decide the alias skip by filesystem identity, not by the function under test
Vasanthdev2004
committed
1b4f880
fix(sandbox): name both plan hashes when the setup marker mismatches
Vasanthdev2004
committed
d64cc67
test(sandbox): assert the case-folding contract only where it exists
Vasanthdev2004
committed
b57d3e4
fix(sandbox): decide runtime-root containment on physical paths, not spellings
Vasanthdev2004
committed
3d5cdef
test(sandbox): alias the cache by its real spelling, not a stacked case alias
Vasanthdev2004
committed
851bf7b
fix(sandbox): retry the final-path buffer whenever the size is not a success value
Vasanthdev2004
committed
1811e7b
fix(sandbox): roll back runtime roots a failed setup created, and keep the provisioning tests in owned storage
Vasanthdev2004
committed
5fc455b
fix(sandbox): make the selected runtime root a setup-to-command contract, and refuse to provision through a link
Vasanthdev2004
committed
e3a65bc
fix(sandbox): record the runtime root, open it by handle, roll back completely
Vasanthdev2004
committed
62a835c
fix(sandbox): stop building the runtime tree through a path other users can name
Vasanthdev2004
committed
725967f
fix(sandbox): stamp the runtime tree through the handle that carries the ACE
Vasanthdev2004
committed
b116603
fix(sandbox): stop the sandbox rewriting the attestation about itself
Vasanthdev2004
committed
63322d0
fix(sandbox): make the ACL and its stamp one transaction, and fail setup without a runtime root
Vasanthdev2004
committed
e280f0e
test(sandbox): compare the DACL's entries, not the descriptor's SDDL
Vasanthdev2004
committed
bff135a
fix(sandbox): put the user boundary above every private fallback component
Vasanthdev2004
committed
b45b38d
fix(sandbox): attest the object before trusting the applied-plan marker
Vasanthdev2004
committed
072d3fe
fix(sandbox): make rollback prove it holds the object it changed
Vasanthdev2004
committed
29795b4
fix(sandbox): recognise the user-scoped fallback as an owned runtime tail
Vasanthdev2004
committed
c73e47a
fix(sandbox): attest the effective grant, not the presence of the SID
Vasanthdev2004
committed
fb96d06
fix(sandbox): attest the grant on both tiers, and roll back through one handle
Vasanthdev2004
committed
c965339
fix(sandbox): put the grant attestation on the launch gate, not in the marker
Vasanthdev2004
committed
9f34f4a
fix(sandbox): one sandbox-home authority, and keep the tests out of the real cache
Vasanthdev2004
committed
25075d0
fix(sandbox): hold the runtime lease through setup, and bind compensation to the object
Vasanthdev2004
committed
ddd236f
test(sandbox): give the lease tests the runtime root shape production uses
Vasanthdev2004
committed
4b2e10a
fix(sandbox): grant the stamp to the identity that validates it
Vasanthdev2004
committed
5737cb3
fix(sandbox): refuse compensation it cannot bind to this run's object
Vasanthdev2004
committed
da85c67
fix(sandbox): mutate compensation targets through the verified handle
Vasanthdev2004
committed
8b63915
test(sandbox): fail the rollback fixture on identity, not on a stale path
Vasanthdev2004
committed
fbd6b47
fix(sandbox): keep repair write when the reader is a repair identity
Vasanthdev2004
committed
c879333
fix(sandbox): treat only proven absence as a verified removal
Vasanthdev2004
committed
e7c23b3
fix(sandbox): carry the stamp reader across the elevation boundary
Vasanthdev2004
committed
7fb33c3
fix(sandbox): assemble rollback records from one object, not one name
Vasanthdev2004
committed
b3c0ac9
fix(sandbox): prove the runtime create and stamp records before mutating
Vasanthdev2004
committed
9a289b9
fix(sandbox): create the owned runtime tail from retained handles
Vasanthdev2004
committed
427e716
fix(doctor): ask whether a command would still select the recorded root
Vasanthdev2004
committed
fcedabf

Commits on Sep 3, 2026

fix(sandbox,doctor): fix the boundary each carried fact crosses
Vasanthdev2004
committed
bcbdd65

Commits on Sep 4, 2026

Commits on Sep 5, 2026

Commits on Sep 7, 2026

Commits on Sep 12, 2026

Merge origin/main into fix/windows-setup-marker-runtime-root
Vasanthdev2004
committed
8bebff7