Shared-service isolation canary for cross-identity visibility

[neerazz]

I built a small, AI-assisted test for a confinement failure that workload isolation alone does not catch: two identities communicating through one shared writable service.

Identity A writes and reads back a fresh nonce. Identity B probes the same object. A confirmed 403/404 is the expected boundary; the exact nonce is a failed boundary; redirects, timeouts, oversized bodies, and every other response remain inconclusive.

The repository includes thirteen unit tests and a Docker demo where clients A and B run in no-mount containers on separate networks. The demo detects both isolated and deliberately shared policies.

https://github.com/neerazz/shared-service-canary

Which native adapter would be most useful to this working group: OCI registry, S3-compatible store, or Artifactory?