iceweasel-oai c2eb1f42a0 Add a sandbox integrity runner with outcome and timing metrics (#51842) ...

## What changed

Export `run_integrity_checks` from `exec-server` to check whether the effective filesystem policy permits writing containment dependencies on Linux, macOS, and Windows. Run preparation and checks on a blocking worker, limit waiting to five seconds, and keep results observational without affecting execution.

Skip mismatched sandbox backends, full-disk-write policies, and `EscalatedSandboxWithRestrictions` overrides. Continue checking ordinary configured policies with root write access and deny restrictions.

Record check outcomes, preparation time, and total duration with bounded metric tags that omit filesystem paths.

## Testing

Add coverage for findings, clean results, missing dependencies, preparation errors, eligibility rules, and timeouts. Verify that timed-out workers emit no late results and that metrics contain no filesystem paths.

GitOrigin-RevId: a234f4a2f629f9bb090da622cea352c99456cb00

2026-10-07 21:52:20 +00:00

..

src

Add a sandbox integrity runner with outcome and timing metrics (#51842)

2026-10-07 21:52:20 +00:00

BUILD.bazel

Rename the read-only Seatbelt platform defaults policy (#41449)

2026-08-29 02:49:33 +00:00

Cargo.toml

Use descriptor-safe helpers for executable test fixtures (#50018)

2026-10-01 15:57:03 +00:00