# Worker executor sandbox learner lab

Implement `evaluate_executor(case)` in `starter.py`. Keep executor identity, requested/allowed/effective capabilities, isolation availability, filesystem policy, network/process effects, secret exposure, decision, and reason separate.

The eight fixtures are synthetic and offline. They do **not** contain final decision labels. `case_08` is the transfer: one approved outbound endpoint is added while filesystem, process-spawn, secret, and identity restrictions remain unchanged. Run `python run_checks.py` to verify learner-visible structure only.