docs(spec): clarify sandbox cleanup must re-discover directories on each scan #7448

Closed
HAL9000 wants to merge 1 commits from spec/arch-sandbox-cleanup-discovery into master

1 Commits

Author SHA1 Message Date
HAL9000 3ed5854a62 docs(spec): clarify sandbox cleanup must re-discover directories on each scan
CI / lint (pull_request) Successful in 29s
CI / quality (pull_request) Successful in 34s
CI / push-validation (pull_request) Successful in 17s
CI / security (pull_request) Successful in 1m0s
CI / helm (pull_request) Successful in 39s
CI / build (pull_request) Successful in 44s
CI / integration_tests (pull_request) Successful in 4m0s
CI / typecheck (pull_request) Successful in 4m21s
CI / e2e_tests (pull_request) Successful in 4m45s
CI / unit_tests (pull_request) Successful in 11m19s
CI / docker (pull_request) Successful in 1m36s
CI / coverage (pull_request) Successful in 13m53s
CI / status-check (pull_request) Successful in 1s
CI / benchmark-publish (pull_request) Has been skipped
CI / benchmark-regression (pull_request) Successful in 56m56s
Bug #7443 found that CleanupService._get_sandbox_dirs() permanently caches
the list of sandbox directories from the first scan. Since the cleanup service
is a long-running singleton, sandboxes created after the first scan are never
discovered and never cleaned up.

Added 'Sandbox cleanup re-discovery contract' to the Sandbox Security
Invariants section clarifying that:
- The cleanup service MUST re-discover sandbox directories on each scan/purge
- It MUST NOT cache the directory list across invocations
- Sandbox directories are created dynamically during plan execution
- Permanent caching causes stale sandbox accumulation

Refs: bug #7443 (CleanupService stale sandbox directory cache)
2026-04-12 17:02:06 +00:00