Conformance group: a sandbox's credential reaches its own store and nothing else (003 T030–T033, FR-018 – FR-021, quickstart Scenario 4).

The load-bearing check is that the credential is refused elsewhere

013-FR-008 and 013-FR-009 are the claims that make the credential model worth having, and both are negative: the credential must fail against another sandbox's store and against the platform's. Everything else here is supporting.

A check that merely confirms the role exists, or that the sandbox can reach its own database, passes against a credential with superuser privileges. The grants have to be shown to restrict, and the only way to show that is to point the credential somewhere it should not reach and watch it be turned away. That is why every check below performs the attempt rather than inspecting a grant table: a grant that reads correctly and does not apply is exactly the defect this group was written after finding.

Reading your own credential is expected to SUCCEED

Step 1 of Scenario 4, and the check that most often gets written backwards. Tenant code can always read its own credential — the application inside the sandbox needs it to reach its own database. Containment comes from the credential granting nothing elsewhere, not from hiding it.

A suite asserting the read fails is testing concealment, which is not the guarantee and cannot be one: any process that can open the connection can recover the credential from its own configuration.

The host supplies the probe, because this library has no database concept

ex_sandbox depends on Elixir/OTP and nothing else (012-FR-001) — no Postgrex, no repo, no notion of a data store at all. So it cannot itself attempt a connection, and these checks take a probe from the host:

use ExSandbox.Conformance,
  mechanism: MyMechanism,
  credential_probe: MyApp.CredentialProbe

The probe implements ExSandbox.Conformance.Credentials.Probe. A host that supplies none reports host capability unavailable for this group — the third outcome, distinct from pass and fail (012-FR-016). That is not an exclusion under 012-FR-011: the consumer cannot request it to skip a check it would otherwise fail, it follows from the host genuinely having no data store, and it is reported rather than hidden.

A mechanism with no data store at all is the case this covers honestly. One that has a data store and no probe gets a loud "unavailable" rather than a quiet pass, which is the distinction that matters.