Integrate routed Git workspaces with persistent state

crates/lazaret-runtime-supervisor/Cargo.toml

@@ -11,6 +11,7 @@ path = "src/main.rs"
 
 [dependencies]
 lazaret-core = { version = "=0.0.0", path = "../lazaret-core" }
+lazaret-ignored-workspace = { version = "=0.0.0", path = "../lazaret-ignored-workspace" }
 lazaret-linux = { version = "=0.0.0", path = "../lazaret-linux" }
 lazaret-state-anchor = { version = "=0.0.0", path = "../lazaret-state-anchor" }
 oci-spec.workspace = true

crates/lazaret-runtime-supervisor/src/main.rs

@@ -7,6 +7,13 @@ fn main() {
         }
         return;
     }
+    if let Some(result) = lazaret_ignored_workspace::dispatch_private_router(&arguments) {
+        if let Err(error) = result {
+            eprintln!("ignored workspace router failed: {error}");
+            std::process::exit(1);
+        }
+        return;
+    }
     if let Some(result) =
         lazaret_runtime_supervisor::supervision::dispatch_private_runtime_role(&arguments)
     {

crates/lazaret-runtime-supervisor/src/sandbox.rs

@@ -625,6 +625,25 @@ pub fn production_sandbox_layout() -> Result<SandboxLayoutV1, SandboxBuildError>
 /// Refuses changed host authority, namespace mismatch, invalid paths, or encoding failures.
 pub fn build_sandbox_bundle(
     request: SandboxBuildRequest<'_>,
+) -> Result<SandboxBundle, SandboxBuildError> {
+    let workspace_source = host_path(request.configuration.workspace().canonical_label())?;
+    build_sandbox_bundle_from_source(request, workspace_source)
+}
+
+/// Builds deterministic OCI bytes using a generation-local routed workspace source.
+///
+/// # Errors
+/// Refuses an invalid source, changed host authority, namespace mismatch, or encoding failure.
+pub fn build_sandbox_bundle_with_workspace(
+    request: SandboxBuildRequest<'_>,
+    workspace_source: PathBuf,
+) -> Result<SandboxBundle, SandboxBuildError> {
+    build_sandbox_bundle_from_source(request, workspace_source)
+}
+
+fn build_sandbox_bundle_from_source(
+    request: SandboxBuildRequest<'_>,
+    workspace_source: PathBuf,
 ) -> Result<SandboxBundle, SandboxBuildError> {
     require_network_namespace(request.expected_network_namespace)?;
     request
@@ -648,6 +667,7 @@ pub fn build_sandbox_bundle(
         request.configuration,
         request.terminal.as_ref(),
         &paths.control_sources,
+        workspace_source,
     )?;
     let process = build_process(
         request.configuration,
@@ -873,10 +893,11 @@ fn build_mounts(
     configuration: &ResolvedDomainConfiguration,
     terminal: Option<&StagedHostTerminal>,
     control_sources: &Path,
+    workspace_source: PathBuf,
 ) -> Result<Vec<Mount>, SandboxBuildError> {
     let mut mounts = standard_mounts()?;
     mounts.push(bind_mount(
-        host_path(configuration.workspace().canonical_label())?,
+        workspace_source,
         PathBuf::from(WORKSPACE_DESTINATION),
         false,
         false,

crates/lazaret-runtime-supervisor/tests/sandbox_builder.rs

@@ -13,7 +13,7 @@ use lazaret_runtime_supervisor::sandbox::{
     MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION, NETWORK_NAMESPACE_PATH, RootProcess,
     SANDBOX_INIT_DESTINATION, SandboxBuildErrorKind, SandboxBuildRequest, SandboxBundle,
     TERMINFO_ROOT_DESTINATION, WORKSPACE_DESTINATION, build_sandbox_bundle,
-    production_sandbox_layout, stage_host_terminal,
+    build_sandbox_bundle_with_workspace, production_sandbox_layout, stage_host_terminal,
 };
 use serde_json::Value;
 use tempfile::TempDir;
@@ -324,6 +324,20 @@ fn deterministic_snapshot_has_only_private_namespaces_and_fixed_runtime_shape()
     );
 }
 
+#[test]
+fn routed_workspace_source_replaces_only_the_workspace_bind_source() {
+    let fixture = Fixture::new();
+    let routed = fixture.tree.path().join("runtime/routed-workspace");
+    let bundle =
+        build_sandbox_bundle_with_workspace(fixture.request(root_process([])), routed.clone())
+            .unwrap();
+    let specification = value(&bundle);
+    assert_eq!(
+        mounts(&specification)[WORKSPACE_DESTINATION]["source"],
+        routed.to_string_lossy().as_ref()
+    );
+}
+
 fn assert_runtime_command(bundle: &SandboxBundle, fixture: &Fixture) {
     assert_eq!(bundle.command().program(), OsStr::new("runsc"));
     let runtime_domain = String::from_utf8(