topolyte

Windows ACL write-restriction sandbox provider for DeepSeek Harness with NON-BLOCKING workspace grant materialization: the eager inheritable-ACE walk runs in a grant-helper child process (fire-and-forget), so a large workspace's first provision never free