Struct SandboxRecord 

pub struct SandboxRecord {
    pub enforcing: bool,
    pub mode: String,
    pub granted_digest: String,
    pub dropped: Vec<DroppedGrant>,
}

What the sandbox actually installed, recorded at the moment it sealed.

A seatbelt profile cannot be widened after sandbox_init, so this is fixed for the process’s lifetime — the same lifetime as the lock file it rides in. Without it, profile.yaml is the only readable account of an agent’s permissions, and it describes what was asked for rather than what took effect.

Fields

enforcing: bool

False means the kernel sandbox is NOT installed and only advisory hooks remain — the agent then has MORE access than its profile grants, which is the opposite of every other failure here and the one worth shouting.

mode: String

"macos-sbpl", "linux-landlock", "advisory-only", …

granted_digest: String

Digest of entitlements.filesystem as sealed. Comparing it against the profile on disk answers “were grants changed since this agent started” without anyone tracking that — and unlike card_digest it does not move when an unrelated field does, so it cannot raise a false alarm.

dropped: Vec<DroppedGrant>

Grants that did not reach the kernel. Empty is the normal case.

Trait Implementations

impl Clone for SandboxRecord

fn clone(&self) -> SandboxRecord

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxRecord

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SandboxRecord

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for SandboxRecord

fn eq(&self, other: &SandboxRecord) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for SandboxRecord

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SandboxRecord