{"version":"2.1.251","anchor":"kept-eval-sandboxes-can-be-sealed-after-a-run","canonical_anchor":"kept-eval-sandboxes-can-be-sealed-after-a-run","heading":"Kept eval sandboxes can be sealed after a run","tier":"internal","area":"Plugin Eval","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251\/e\/kept-eval-sandboxes-can-be-sealed-after-a-run","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251","markdown":"### Kept eval sandboxes can be sealed after a run\n\nKept eval sandboxes can be sealed unreadable after a run, with ownership and path checks.\n\n**What**\n\nThe internal eval harness can now seal a sandbox directory it keeps after a run, setting it unreadable and verifying ownership, inode and that it is not the home or temp directory, with explicit failure messages on Windows and when running as root. It also indexes staging directories for stub artifacts produced during a run.\n\n**Details**\n\n- Harness code only, not reachable from a normal session.\n\n**Evidence**\n\n`eval kept-sandbox seal did not take`\n\n- Area: Plugin Eval\n- Tier: Under the hood\n- Useful: 1\/5\n- Signal: 3\/5"}