coulomb/sand-boxer
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Refuse stale installed owner packages despite matching version metadata
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-09 23:02:29 +02:00
parent be42de7caf
commit 7a61383e59
4 changed files with 86 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/bwrap-runtime.md
View file

@ -237,10 +237,15 @@ owner discrepancy for bwrap. It is not a claim that every remote backend's exter
hosts/templates/tools are packaged or admitted. The ephemeral Messages binding may
select an exact runtime path/digest; usual overlap and default-deny checks apply.
Required `make check`: lint clean, 201 tests passed. Rein's
Required `make check`: lint clean, 205 tests passed. Rein's
`scripts/prove-metered-runtime.py` consumes the candidate to test installed imports,
packaged definitions, explicit one-cycle bootstrap, actual pinned CLI/metered stream,
insufficient-capacity refusal and teardown against fixtures. The resulting receipt
belongs to `prj-helixforge-factory/evidence/2026-09-09-owner-bootstrap.json`.
Production installation and credential-holder/empty-egress profile/placement admission
remain SAND-WP-0015-T04 and HFACT-WP-0001-T03/T04; no prior profile is promoted.
The first standalone candidate exposed a stale cached local wheel despite current
Git metadata. Owner builds now refresh all local distributions and compare every
installed package source/definition file with its tracked source; stale, missing or
extra files refuse the build. Four content-conformance regressions cover that gap.