Under the hood

SandboxPlan

How a portable policy is matched to real host capabilities before a workload is allowed to run.

Match policy to real capabilities

A portable rule is useful only if the chosen environment can honor it. Sandbox Policy checks that match before Warden starts the workload.

A SandboxPlan contains already-resolved filesystem rules, network mode and destinations, process requirements, required backend capabilities and the originating MIR digest. It is immutable after sealing.

CODE

canonical MIR + named backend capabilities
                    │
                    ▼
        validate semantic coverage
                    │
                    ▼
             sealed SandboxPlan

Keep execution mechanics separate

no PID or process handle;
no Seatbelt profile text;
no Bubblewrap argv;
no proxy credentials;
no lifecycle state;
no conditional authorization rule.

Those belong to Warden, Netd or the policy frontend.

Preserve traceability

The plan retains the source MIR digest. Warden then creates its own mechanical plan digest after host-specific lowering. Execution receipts can therefore distinguish the portable decision from the concrete execution mechanics.