fix(sandbox): agree on the runtime root across the Windows setup marker - #901

Open

Vasanthdev2004 wants to merge 45 commits into

mainfrom

fix/windows-setup-marker-runtime-root

Commits on Sep 2, 2026

fix(sandbox): agree on the runtime root across the Windows setup marker
Vasanthdev2004
committed
e68fb87
fix(sandbox): create the Windows runtime roots the ACL plan grants
Vasanthdev2004
committed
920e26e
test(sandbox): keep the provisioning tests inside test-owned directories
Vasanthdev2004
committed
4791a0a
fix(sandbox): pin the Windows runtime root instead of deriving it twice
Vasanthdev2004
committed
2a71caf
test(sandbox): compare canonical spellings in the ownership guard
Vasanthdev2004
committed
6fcd522
test(sandbox): decide the alias skip by filesystem identity, not by the function under test
Vasanthdev2004
committed
1b4f880
fix(sandbox): name both plan hashes when the setup marker mismatches
Vasanthdev2004
committed
d64cc67
test(sandbox): assert the case-folding contract only where it exists
Vasanthdev2004
committed
b57d3e4
fix(sandbox): decide runtime-root containment on physical paths, not spellings
Vasanthdev2004
committed
3d5cdef
test(sandbox): alias the cache by its real spelling, not a stacked case alias
Vasanthdev2004
committed
851bf7b
fix(sandbox): retry the final-path buffer whenever the size is not a success value
Vasanthdev2004
committed
1811e7b
fix(sandbox): roll back runtime roots a failed setup created, and keep the provisioning tests in owned storage
Vasanthdev2004
committed
5fc455b
fix(sandbox): make the selected runtime root a setup-to-command contract, and refuse to provision through a link
Vasanthdev2004
committed
e3a65bc
fix(sandbox): record the runtime root, open it by handle, roll back completely
Vasanthdev2004
committed
62a835c
fix(sandbox): stop building the runtime tree through a path other users can name
Vasanthdev2004
committed
725967f
fix(sandbox): stamp the runtime tree through the handle that carries the ACE
Vasanthdev2004
committed
b116603
fix(sandbox): stop the sandbox rewriting the attestation about itself
Vasanthdev2004
committed
63322d0
fix(sandbox): make the ACL and its stamp one transaction, and fail setup without a runtime root
Vasanthdev2004
committed
e280f0e
test(sandbox): compare the DACL's entries, not the descriptor's SDDL
Vasanthdev2004
committed
bff135a
fix(sandbox): put the user boundary above every private fallback component
Vasanthdev2004
committed
b45b38d
fix(sandbox): attest the object before trusting the applied-plan marker
Vasanthdev2004
committed
072d3fe
fix(sandbox): make rollback prove it holds the object it changed
Vasanthdev2004
committed
29795b4
fix(sandbox): recognise the user-scoped fallback as an owned runtime tail
Vasanthdev2004
committed
c73e47a
fix(sandbox): attest the effective grant, not the presence of the SID
Vasanthdev2004
committed
fb96d06
fix(sandbox): attest the grant on both tiers, and roll back through one handle
Vasanthdev2004
committed
c965339
fix(sandbox): put the grant attestation on the launch gate, not in the marker
Vasanthdev2004
committed
9f34f4a
fix(sandbox): one sandbox-home authority, and keep the tests out of the real cache
Vasanthdev2004
committed
25075d0
fix(sandbox): hold the runtime lease through setup, and bind compensation to the object
Vasanthdev2004
committed
ddd236f
test(sandbox): give the lease tests the runtime root shape production uses
Vasanthdev2004
committed
4b2e10a
fix(sandbox): grant the stamp to the identity that validates it
Vasanthdev2004
committed
5737cb3
fix(sandbox): refuse compensation it cannot bind to this run's object
Vasanthdev2004
committed
da85c67
fix(sandbox): mutate compensation targets through the verified handle
Vasanthdev2004
committed
8b63915
test(sandbox): fail the rollback fixture on identity, not on a stale path
Vasanthdev2004
committed
fbd6b47
fix(sandbox): keep repair write when the reader is a repair identity
Vasanthdev2004
committed
c879333
fix(sandbox): treat only proven absence as a verified removal
Vasanthdev2004
committed
e7c23b3
fix(sandbox): carry the stamp reader across the elevation boundary
Vasanthdev2004
committed
7fb33c3
fix(sandbox): assemble rollback records from one object, not one name
Vasanthdev2004
committed
b3c0ac9
fix(sandbox): prove the runtime create and stamp records before mutating
Vasanthdev2004
committed
9a289b9
fix(sandbox): create the owned runtime tail from retained handles
Vasanthdev2004
committed
427e716
fix(doctor): ask whether a command would still select the recorded root
Vasanthdev2004
committed
fcedabf

Commits on Sep 3, 2026

fix(sandbox,doctor): fix the boundary each carried fact crosses
Vasanthdev2004
committed
bcbdd65

Commits on Sep 4, 2026