a3s-sandbox v0.3.0

a3s-sandbox 0.3.0

This release makes native lifecycle guarantees explicit, bounds observer and
cancellation cleanup, and tightens Windows AppContainer filesystem grants.

Migration

NativeSandbox::probe() now returns CapabilityReport. Wrappers returning
Result<()> can use .map(|_| ()). Hosts that require full descendant and
host-exit containment must call report.require_lifetime_containment().
Launcher availability alone does not establish either guarantee.

The bridge's probe response includes the full report with
runtime_probed=true. Initialize and static capability reports use false.
The Go SDK adds ProbeReport; its existing error-only Probe remains valid.

Fixes

• Bound live and completion observers; preserve typed cancellation,
  observer-timeout and unknown-settlement failures.
• Retain execution ownership while a caller is cancelled, including before
  the execution owner first polls.
• Stop Unix process groups after root exit while draining inherited pipes.
• Create Windows processes atomically inside a kill-on-close Job.
• Give independent Windows sandboxes distinct AppContainer SIDs and revoke
  their grants from the current ACL instead of restoring stale descriptors.
• Replace ineffective package-SID denials with restricted grants, restore
  inheritance, and remove parent delete-child rights over protected entries.
• Coordinate Windows ACL mutations with a host-global mutex and bounded waits.
• Preserve signal failures as nonzero CLI exits.
• Keep Go SDK close idempotent after forced bridge termination or a pipe-close race.
• Preserve the Go SDK, bridge, runtime-probed Linux cgroup quota support,
  credential hardlink checks and bubblewrap executable discovery.

Qualified scope

Windows requires Windows 10 / Server 2016 or newer and PowerShell 7. Linux
requires bubblewrap and usable unprivileged namespaces. Requested cgroup
quotas refuse when the host does not delegate the required controls.

macOS detached descendants and host-exit cleanup remain unqualified. Windows
host-exit admission remains unavailable until cross-host workspace ownership
and durable ACL/device/profile recovery are qualified. These restrictions
remain visible through the capability report. This release does not certify
new WSL2 or enterprise GA claims, and mediated network remains opt-in.

Native CI logs, source identities, SHA-256 checksums, signatures and an SBOM
accompany the release artifacts.

Install

cargo add a3s-sandbox@0.3.0
go get github.com/A3S-Lab/Sandbox/sdk/go@v0.3.0

The Go module is tagged separately as sdk/go/v0.3.0 on the same source commit.

Artifact identity and verification

• Source: 0f2bb18dc4f16a1ebe12bc282db5c1499ad5fe05
• Native qualification: https://github.com/A3S-Lab/Sandbox/actions/runs/39087183495
• Native archives: Linux x86_64, macOS arm64, Windows x86_64; each contains the CLI, relay and machine bridge.
• GPG signing fingerprint: CA2EC11396B6DFA259EB60C807C58356C3CD841F.
• SHA256SUMS.asc authenticates the complete asset manifest. Each native archive also carries its own detached signature and GitHub Sigstore provenance bundle.
• sbom.cdx.json, provenance.json, EVIDENCE.md and raw native CI logs accompany this release.

gpg --import RELEASE_SIGNING_KEY.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
shasum -a 256 -c SHA256SUMS

gh attestation verify a3s-sandbox-v0.3.0-aarch64-apple-darwin.tar.gz \
  --bundle a3s-sandbox-v0.3.0-aarch64-apple-darwin.tar.gz.sigstore.json \
  --repo A3S-Lab/Sandbox \
  --signer-workflow A3S-Lab/Sandbox/.github/workflows/ci.yml \
  --source-digest 0f2bb18dc4f16a1ebe12bc282db5c1499ad5fe05 \
  --deny-self-hosted-runners

a3s-sandbox v0.2.0

a3s-sandbox 0.2.0

Highlights

• Gate 8 — credential containment (secrets never land).
  NativeSandbox::execute_with_secrets accepts host-held secret environment
  entries and delivers only a3s:secret:<NAME> sentinels to the child; the
  host re-injects real bytes at the mediation point. Entries fail closed
  without mediated_network, on reserved names, on collisions with explicit
  env entries, or on malformed entries. The CONNECT/HTTP mediator now also
  mediates absolute-form plain HTTP under the existing network.allow
  authority, and typed SecretHeaderInjection rules inject
  {header}: {value_prefix}<secret> on matching origins, replacing any
  client-supplied instance so sentinels never leak upstream. https://
  absolute forms, chunked bodies, oversized bodies, and
  control-character-bearing secrets all fail closed (TLS interception stays
  a non-goal).
• Gate 9 slice 1 — Linux mediated SOCKS5. Socks5Mediator::bind_unix
  hosts SOCKS5 on a bind-mounted scratch socket; the in-guest relay wrapper
  starts one TCP→Unix relay per mediated protocol (HTTP 24731, SOCKS 24732).
  mediated_socks is now claimed on Linux with live netns wire proofs.
  Windows SOCKS and non-macOS unix-socket allowlists stay fail-closed.
• Gate 10 slice 1 — typed policy grants. NetworkGrant +
  NativeSandbox::apply_network_grant: the only sanctioned broadening path.
  Digest-pinned lineage (stale approvals refuse and are audited), minimal
  widening (a deny-all baseline gains mediated_network scoped to exactly
  the granted origin), idempotent regrants, and GrantApplied audit events.
  A macOS live test proves the full loop: denied command → grant → the same
  command flows.

Notes

• Breaking: ConnectMediator::bind* constructors now take a
  secrets: Option<Arc<HashMap<String, String>>> parameter (pass None for
  the previous behavior). New capability claims follow THREAT_MODEL.md.
• Claim B (mediated-network-as-default) remains refused pending
  independent review; grants make scoped, user-approved activation possible
  without changing the default profile.

Verify

cargo test --all-targets
GATE7_SOAK_ROUNDS=256 ./scripts/collect-release-evidence.sh

Provenance

• commit: 031849a (v0.2.0 tag)
• tag: v0.2.0
• claim: deny-all production boundary (Claim A) with opt-in secrets/grants; mediation remains off by default
• mediated-as-default: NO (Claim B refused pending independent review)

Collector evidence (macOS arm64, soak 256)

# a3s-sandbox release evidence

- collected: 2026-09-25T15:15:54Z
- host: Darwin arm64
- git: 031849a4c6b7255a87e0ceb9bf64979ccdc5b27f
- crate: 0.2.0
- dirty: 0 paths

## fmt
- cargo fmt --all -- --check: OK

## clippy
- cargo clippy --all-targets -- -D warnings: OK

## tests
- cargo test --all-targets: OK

## Gate 7 soak (optional longer via GATE7_SOAK_ROUNDS)
- soak rounds=256: OK

## Windows mediation live proof (when on Windows)
- skipped (not a Windows host); rely on Windows CI / docs/WINDOWS_WSL_GA.md

## SBOM
- wrote /Users/roylin/code/a3s/crates/sandbox/release-out/sbom.cdx.json

## release binaries + provenance
- sign-release artifacts in /Users/roylin/code/a3s/crates/sandbox/release-out

## remaining external gates

v0.1.4

Fixed

• Linux set_rlimit works on both glibc and musl (u32 + as _), unblocking a3s-code Node SDK *-unknown-linux-musl builds.

a3s-sandbox 0.1.3

a3s-sandbox 0.1.3

Gate 7 mediation + assurance release.

Highlights

• mediated_http claimed on macOS, Linux, and Windows after live OS fence proofs
• Gate 7 fuzz/soak starters, SBOM, and release evidence helpers
• Default A3S Bash profile remains network deny-all (mediation opt-in)

Install

a3s-sandbox = "0.1.3"

Notes

• Independent review is still required before mediated network may become a default profile
• Attached darwin-arm64 bins are host-local build artifacts; prefer crates.io for library consumers
• See CHANGELOG.md and docs/RELEASE_CHECKLIST.md