0xdhx f3ce2dbab5 docs(#3156): name the isolation this helper does NOT provide ...

Found by the pre-push adversarial review of this round, and worth recording in
the code rather than only in the PR thread.

installSpawnHome() creates one sandbox home per test-FILE process, not one per
spawn, so two installer spawns in the same file share .gsd state. The
containment claim is unaffected -- nothing reaches the developer's real home --
and it is strictly better than the status quo it replaces, which shared the real
home and every byte of its state. But "contained" and "isolated from each other"
are different properties, and only the first is claimed.

2026-08-08 06:18:09 -05:00

44 KiB

Raw Blame History

View Raw