Dependency review

Decision

The coding-tools product remains standard-library-first. Spice core is pinned at v0.1.0-preview.1.0.20260806200749-524424a04df0, and the toolchain is pinned at v0.1.0-preview.1.0.20260806203056-d0b9ac086bd6. Spice Agent is pinned at v0.0.0-20260806225954-af79fc7fe4ad for its public immutable tool contract, including explicit effect, replay-safety, fingerprint, and execution-failure semantics.

golang.org/x/sys/windows v0.47.0 is the sole non-framework runtime package and is compiled only on Windows for Job Object ownership and typed status classification around root-contained atomic replacement.

Maintenance and license

Filesystem, process, context, hashing, and atomic-file behavior use Go’s supported standard library under its BSD-style license. x/sys is maintained by the Go project, uses a BSD-3-Clause license, follows the Go vulnerability and release process, and exposes the Windows Job Object APIs missing from the standard library. Version 0.47.0 is checksum-pinned and reviewed as a direct Windows dependency.

Security and ownership

• A Suite is instance-owned and rooted at one validated absolute path.
• Construction performs no filesystem or process operation.
• Read pages, writes, and total captured output default to 256 KiB and may not exceed 512 KiB; commands default to two minutes and may not exceed 30 minutes. JSON construction is additionally checked by Spice Agent’s 1 MiB public payload bound.
• Capability metadata discloses read, write, and process risk but is not represented as a sandbox or permission boundary.
• Effect and replay metadata is explicit and fingerprinted. Read is read-only/safe; replace is mutating/idempotent because repeated create and stale-protected replace calls cannot duplicate a committed file mutation; shell is mutating/unsafe.
• os.Root rejects traversal and link escape for read/replace operations. Shell rejects and revalidates link components before its path-based process start. Same-user concurrent mutation remains explicitly trusted.
• Replace performs expected-digest checks before and immediately before atomic commit. This is stale detection, not an external-writer filesystem CAS.
• Windows existing-target replacement remains inside os.Root. Retries are bounded and cancellation-aware for access-denied, sharing, and lock statuses; every attempt repeats the digest and regular non-symbolic-link checks. A real ACL denial exhausts to replace_failed; retryability does not assert that an error was transient.
• Windows Job Objects and Unix process groups provide bounded cleanup for the managed launcher and ordinary descendants. Deliberately detached Unix processes and Windows children created before Job Object attachment may escape; these primitives are not a sandbox. Incomplete launcher cleanup is returned explicitly as an uncertain, never-replayable failure.

Observability

Results contain byte counts, exit classification, truncation, timeout, managed- cleanup completion, and replace commit/durability state. Validation and operating-system failures remain model-visible results. Cancellation and host delivery failures use bounded, correlated execution errors that preserve context.Canceled or context.DeadlineExceeded. File contents, command output, environment values, arguments, and raw operating-system diagnostics are excluded from general diagnostics.

Build-only dependencies

The Spice toolchain is authorized through the standard Go tool directive and normal module selection. Committed vendor data makes compiler and product verification available offline. No custom plugin or dependency registry exists.