Struct ValidatorContainment 

pub struct ValidatorContainment {
    pub sandbox: Option<ResolvedSandbox>,
    pub note: Option<String>,
}

The outcome of resolving one validator session’s MANDATORY containment (ticket validator-mandatory-containment). The validator is the adversarial reader the whole gate rests on; its isolation must not depend on the operator opting into enforcement, so sandbox.enforce: off (the default) no longer means an unwrapped validator — where the platform has a process-sandbox tier and the selected backend can apply it, the session is wrapped regardless.

Fields

sandbox: Option<ResolvedSandbox>

The sandbox to attach to the validator’s crate::backend::SessionSpec — Some whenever a wrap applies (the role’s own enforced sandbox plus the read-deny roots, or the mandatory fs-tier wrap under enforce: off), None only when containment degraded (see note).

note: Option<String>

The LOUD operator-facing posture note when containment could not be applied AND the operator opted into the degrade (validatorAllowUncontainedDegrade) — an unsupported platform, a linux without bwrap, or a backend that does not honor the resolved sandbox. The orchestrator surfaces it as a decision per validator spawn (so every validation round carries it); None when the session is contained. Without the opt-in the resolution FAILS CLOSED instead (ticket validator-containment-degrade-fail-closed, 14th-pass review): the degrade reopens the modify→use→restore path the mandatory-containment work was built to close, so snapshot separation plus the after-fingerprint tripwire alone are no longer the default posture.

Trait Implementations

impl Debug for ValidatorContainment

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.