A demonstration from Puck of work underway to allow the compositor to tell which Spectrum VM a Wayland window belongs to, using the draft security-contexts protocol. More information in her mailing list post.