ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

docs: formalize protocol identity and transition to regular-file escalation mailbox

Browse source 
- Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`.
- Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths.
- Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery.
- Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations.
This commit is contained in:
ms2k 2026-06-30 02:31:56 +09:00
commit 682d7c7db7
1 changed files with 408 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/example.toml
View file

@ -24,10 +24,10 @@ default_deny = [
]
[escalation]
# Set to true to enable the agent-to-host escalation Unix Domain Socket server on the host.
# Set to true to enable agent-to-host escalation through Lazaret's host-private control plane.
enabled = true
# socket_dir is optional. Lazaret defaults to a private directory beneath
# runtime_dir is optional. Lazaret defaults to a private directory beneath
# $XDG_RUNTIME_DIR.
# Host commands that the agent is allowed to execute on the host automatically