Validation commands
This page describes Evolver’s command validator, not every Desktop tool. Validation commands should test the change and specify their working directory, runtime, file scope, and handling of secrets. This validator defaults to 60 seconds per command, with a maximum of 120 seconds.
Command requirements
- Use an explicit executable and arguments instead of interpolating untrusted text into a shell.
- Fix the working directory and read only the configuration and dependencies required for validation.
- Do not print tokens, private keys, or complete environment variables in arguments, output, or diagnostics.
- Preserve exit status together with assertions, file diffs, or artifact checks.
- Review any test that writes databases, publishes artifacts, or calls production services separately.
Platform isolation
On Linux, isolation depends on the boundary the host can actually establish, not its operating-system name alone. Check isolationTier in the result:
| Value | Boundary |
|---|---|
read-only | No network, hidden home directory, read-only root filesystem, and cgroup resource limits |
no-network | Private filesystem root, read-only checkout, private HOME and process space, and no network; no aggregate cgroup resource limits |
none | No namespace isolation; process and path hardening only |
Windows and macOS do not have this Linux namespace boundary. Commands can still access the network and user home directory. The isolated boolean does not distinguish the two isolation strengths; retain isolationTier in the review record. When the caller requires isolation and the host cannot meet its minimum tier, the validator refuses before starting a command.
Validation record
Retain at least:
command / arguments
working directory
platform and versions
timeout
exit status
key assertions and redacted output
touched files or external effects
Passing does not prove the goal was verified
For compatibility, this sandbox entry point returns passed: true for an empty command list. That means there was nothing to execute, not that tests ran or the feature was verified. Check the plan first, then inspect executed results, skipped entries, and the relevant assertions.
Missing scripts, scripts outside the allowed root, symlinked scripts, and unresolvable paths are recorded with skip reasons. Repair paths or supply the missing script when a required check was skipped; an unexecuted check is not completed coverage. Sandbox setup or cleanup failure is also a failure, even if the command exits with 0.
Failure handling
Treat timeouts, signal termination, and missing output as failures rather than converting them to success. A command changed by redaction must not be executed or used for promotion because it is no longer the command that was reviewed.
Related pages
EvoX Docs · Security · Execution boundaries