Shadow failure case

IsolationSession: a second deprovision reports success instead of stale_id

Artifact isolationsession-a-second-deprovision-reports-succes-e68a6b4000 · generated 2026-10-10T21:31:14.061960+00:00 · source: microsoft/mxc #1429

This is the automatic first artifact from a falsification-bounty submission. It is redacted and public-safe by default; the next step is to turn the failure into a reusable proof, guardrail, or diagnosis.
Request private audit Follow the failure feed

Observed agent action

A second deprovision call on an already-deprovisioned sandboxId returns exit code 0 with an empty error object instead of failing.

Expected boundary

deprovision should fail with error.code 'stale_id' and nativeCode '0x80070490' once the agent user it targets no longer exists, matching start/stop/exec behavior.

Runtime context

IsolationSessionBackend::deprovision in src/mxc-sdk/src/backends/isolation_session/common/state_aware.rs calls deprovision_agent_user, whose StalePromotion::Eligible classification in manager.rs would promote ERROR_NOT_FOUND to stale_id but never fires.

Evidence supplied

The issue reporter traced the promotion logic as correctly wired and concluded the underlying RemoveUser call is likely returning success for an agent user that no longer exists, leaving nothing to promote.

Evidence needed next

Commercial routing

Use the public artifact for broadly useful redacted failures; use the private audit path when the evidence is sensitive or the operator needs a concrete fix, guardrail, or receipt proof.

Next proof step

Convert the submitted failure into the smallest reusable control: a deterministic guardrail, receipt proof, public autopsy entry, or private diagnosis if evidence is sensitive.