fix(sandbox): keep Windows restricted-token SIDs narrow and fail closed on DenyRead - #1006

Open

euxaristia wants to merge 9 commits into

Gitlawb:mainfrom

euxaristia:fix/windows-sandbox-restricted-token-sids-v2

Commits on Sep 1, 2026

Reject unsupported DenyRead profiles upfront during sandbox setup
euxaristia
committed
90d056a

Commits on Sep 2, 2026

Migrate legacy Windows DenyWrite ACEs, randomize smoke probes, and clean dead descendant machinery.
euxaristia
committed
a84626f

Commits on Sep 4, 2026

Use /d /c for denied-write probe command and verify ownership on cleanup.
euxaristia
committed
6c4d6c3
Honor NoInherit in legacy ACL migration and verify probe ownership.
euxaristia
committed
92bdafa
Preserve DenyRead bits when migrating combined legacy deny ACEs.
euxaristia
committed
5c46b75