internal/

Package safetext holds the single predicate every untrusted single-line identifier in this module is validated against — grant fields, execution IDs, and proxy credentials alike.

Fixture policies for backend tests.

Package windows owns the configuration and setup vocabulary for the Windows sandbox backends.

Package winpath provides fail-closed, handle-derived Windows path identity.