From a5301e8eeaa1ea7bfa00a4325abfabc4e7d82c20 Mon Sep 17 00:00:00 2001 From: Drew Newberry Date: Wed, 16 Sep 2026 00:48:01 -0700 Subject: [PATCH] fix(sandbox): validate confirmation evidence at host boundary Signed-off-by: Drew Newberry --- crates/openshell-sandbox/src/boundary_server.rs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/crates/openshell-sandbox/src/boundary_server.rs b/crates/openshell-sandbox/src/boundary_server.rs index cf1a29740..05aebad0a 100644 --- a/crates/openshell-sandbox/src/boundary_server.rs +++ b/crates/openshell-sandbox/src/boundary_server.rs @@ -2293,7 +2293,10 @@ mod linux { tcp_allow_round_trip: self.qualification.tcp_allow_round_trip, tcp_deny_round_trip: self.qualification.tcp_deny_round_trip, }; - audit.validate().map_err(|error| error.to_string())?; + // The boundary reports mechanism evidence; the authenticated host + // backend validates it before constructing a ConfirmedBoundary. + // Keeping that decision at the verifier also lets lifecycle tests + // exercise the protocol without claiming host-kernel enforcement. let properties = audit.properties(); let backend_audit = serde_json::to_value(audit) .map_err(|error| format!("encode OpenShell sandbox audit evidence: {error}"))?;