1 files changed, 16 insertions, 16 deletions
diff --git a/tests/Agent.Windows.Tests/SecurityPolicyTests.cs b/tests/Agent.Windows.Tests/SecurityPolicyTests.cs
index d0c32a8..6dbc9ab 100644
--- a/tests/Agent.Windows.Tests/SecurityPolicyTests.cs
+++ b/tests/Agent.Windows.Tests/SecurityPolicyTests.cs
@@ -17,19 +17,20 @@ namespace Agent.Windows.Tests;
 public sealed class SecurityPolicyTests
 {
     [Fact]
-    public void Approval_store_uses_atomic_replace_and_a_user_only_dacl()
+    public void Applied_configuration_store_uses_atomic_replace_and_a_user_only_dacl()
     {
         using TestDirectory directory = new();
-        string storePath = Path.Combine(directory.Path, "protected", "executable-approvals.json");
-        var store = new ExecutableApprovalStore(storePath);
-        string executable = Environment.ProcessPath!;
-        store.Approve(new("self", "executable", executable, executable,
-            EntryExecutablePolicy.ComputeSha256(executable), null, DateTimeOffset.UtcNow));
-
-        Assert.Single(store.List());
-        Assert.Empty(Directory.EnumerateFiles(Path.GetDirectoryName(storePath)!, "*.tmp"));
+        string configPath = Path.Combine(directory.Path, "agent.yaml");
+        File.WriteAllText(configPath, "schema_version: 2");
+        string storeRoot = Path.Combine(directory.Path, "protected");
+        var store = new AppliedConfigurationStore(configPath, storeRoot);
+        store.Save(new(2, Path.GetFullPath(configPath), new string('A', 64), [], [],
+            new("none", []), new("normal", 4096, 16, 1800), DateTimeOffset.UtcNow));
+
+        Assert.NotNull(store.Load());
+        Assert.Empty(Directory.EnumerateFiles(storeRoot, "*.tmp"));
         DirectorySecurity security = FileSystemAclExtensions.GetAccessControl(
-            new DirectoryInfo(Path.GetDirectoryName(storePath)!), AccessControlSections.Access);
+            new DirectoryInfo(storeRoot), AccessControlSections.Access);
         Assert.True(security.AreAccessRulesProtected);
         using var identity = System.Security.Principal.WindowsIdentity.GetCurrent();
         var rules = security.GetAccessRules(true, false, typeof(System.Security.Principal.SecurityIdentifier))
@@ -147,23 +148,22 @@ public sealed class SecurityPolicyTests
         Directory.CreateDirectory(secondTarget);
         CreateJunction(junctionPath, firstTarget);
         string configPath = Path.Combine(directory.Path, "agent.yaml");
-        File.WriteAllText(configPath, "schema_version: 1");
+        File.WriteAllText(configPath, "schema_version: 2");
         string stores = Path.Combine(directory.Path, "stores");
         var configuration = new AgentConfiguration
         {
             Sandbox = new SandboxOptions { Profile = "development", Workspaces = [junctionPath] }
         };
-        var resolver = new SandboxEnvironmentResolver(configPath, configuration,
-            new SandboxResolutionStore(configPath, stores, protectDirectory: false),
-            new ExecutableApprovalStore(Path.Combine(stores, "approvals.json"), protectDirectory: false));
-        _ = resolver.Confirm();
+        var resolver = new AppliedSandboxConfiguration(configPath, configuration,
+            new AppliedConfigurationStore(configPath, stores, protectDirectory: false));
+        _ = resolver.Apply();
         Directory.Delete(junctionPath);
         CreateJunction(junctionPath, secondTarget);
 
         ConfigurationException error = Assert.Throws<ConfigurationException>(() => resolver.Compile(
             Path.Combine(directory.Path, "journals"), Path.Combine(directory.Path, "backups")));
 
-        Assert.Equal("sandbox.resolution_changed", error.Code);
+        Assert.Equal("sandbox.configuration_not_applied", error.Code);
         Directory.Delete(junctionPath);
     }