tiny.sandbox.audit

1const std = @import("std");23pub const Runner = enum {4    staging,5    bubblewrap_overlay,6    macos_staging,7    windows_staging,8};910pub const Filesystem = enum {11    copied,12    overlay,13};1415pub const Process = enum {16    host,17    bubblewrap_namespace,18};1920pub const Network = enum {21    inherited,22    bubblewrap_namespace,23};2425pub const Environment = enum {26    inherited,27    replaced,28};2930/// Describes the backend configuration that supported an execution result,31/// reported across filesystem, process, network, and environment dimensions.32/// The backend constructs this record directly from the selected runner and run33/// plan rather than from runtime measurements.34///35/// Callers evaluate each dimension independently because one configuration36/// choice implies nothing about another. For example, a Linux Bubblewrap run37/// can establish a private process namespace while still sharing the host38/// network namespace.39pub const Audit = struct {40    runner: Runner = .staging,41    filesystem: Filesystem = .copied,42    process: Process = .host,43    network: Network = .inherited,44    environment: Environment = .inherited,45};4647test "audit records effective staging isolation" {48    const audit = Audit{};49    try std.testing.expectEqual(Runner.staging, audit.runner);50    try std.testing.expectEqual(Filesystem.copied, audit.filesystem);51    try std.testing.expectEqual(Process.host, audit.process);52    try std.testing.expectEqual(Network.inherited, audit.network);53    try std.testing.expectEqual(Environment.inherited, audit.environment);54}

1pub const audit = @import("audit.zig");