# Mod Sandboxing

This document covers `TODOS.phase-72.72.14.1.3`: sandbox policy enforcement for
`.mayamod` execution.

## Runtime Surface

- module: `V2Modding`
- policy: `FV2ModSandboxPolicy`
- request: `FV2ModSandboxRequest`
- decision: `FV2ModSandboxDecision`
- helper functions: `BuildDefaultModSandboxPolicy`, `IsPathInsideModRoot`, and
  `EvaluateModSandboxRequest`
- automation: `V2/ue/Source/V2Tests/Private/Modding/ModLoadingSystem.spec.cpp`
- contract: `V2/ue/Content/V2/Modding/ModSandboxing_V2_Contract.json`

## Policy

The default sandbox denies filesystem access outside the mod root, denies
network access, denies native code, caps script memory at 256 MiB, caps
mod-scoped storage at 104,857,600 bytes, and caps script timeouts at 100 ms.

`IsPathInsideModRoot` canonicalizes paths, collapses relative segments, rejects
`..`, and only allows a requested path when it equals the mod root or sits below
the mod root. `EvaluateModSandboxRequest` returns explicit issue types for
filesystem escape, network denial, native-code denial, memory overflow, storage
overflow, and timeout overflow.

Later scripting and asset-loading tasks consume this policy instead of opening
new filesystem, network, or resource-limit paths directly.

## Verification

```bash
python3 V2/ue/Tools/check-v2-mod-sandboxing.py
python3 V2/ue/Tools/check-v2-mod-loading-system.py
python3 V2/ue/Tools/check-v2-ci-workflow.py
python3 V2/tools/validate-v2-docs.py
python3 -m py_compile V2/ue/Tools/check-v2-mod-sandboxing.py V2/ue/Tools/check-v2-mod-loading-system.py V2/ue/Tools/check-v2-ci-workflow.py
python3 -m json.tool V2/ue/Content/V2/Modding/ModSandboxing_V2_Contract.json
```