73e3e9fdee
Fix rootless launches with subordinate ID maps
...
Resolve and verify canonical caller subordinate ranges, launch preparation and runtime workers through mapped causal acquisition, and keep runsc in the existing user namespace. Repair descriptor-relative OCI cleanup and absent-mount recovery so failed launches can progress to the corrected path.
2026-07-19 19:51:47 +09:00
5376aa90f9
Make ID-map artifact identity encoding explicit
2026-07-19 05:43:28 +09:00
247819250b
Replace lexical Rust fragments with real modules
2026-07-19 05:12:57 +09:00
30cd36dcdd
Expose typed Prepared Lower failures
2026-07-19 03:18:50 +09:00
d25942596f
Implement exact bootstrap recovery and artifact GC
2026-07-17 23:23:19 +09:00
4dd2b150d2
Compose selected State Anchor paths over prepared roots
2026-07-17 23:23:19 +09:00
b35582a9e6
Refuse prepared-lower child mount crossings
2026-07-17 23:23:19 +09:00
4cf7a5e595
Refuse inexact production selector authorities
2026-07-17 23:23:19 +09:00
c0b139256e
Confine image preparation beneath retained storage authority
2026-07-17 23:23:19 +09:00
898271c430
Complete nested prepared-lower reclaim ordering
2026-07-15 15:48:46 +09:00
0dfd7767b5
Close prepared-lower identity and reclaim races
2026-07-15 15:48:46 +09:00
5458460717
Implement verified OCI prepared-lower lifecycle
2026-07-15 15:48:46 +09:00
