0f6825c3b9
Add a static trusted sandbox init
2026-07-19 22:38:37 +09:00
73e3e9fdee
Fix rootless launches with subordinate ID maps
...
Resolve and verify canonical caller subordinate ranges, launch preparation and runtime workers through mapped causal acquisition, and keep runsc in the existing user namespace. Repair descriptor-relative OCI cleanup and absent-mount recovery so failed launches can progress to the corrected path.
2026-07-19 19:51:47 +09:00
897578e7cb
Consume shared sandbox destinations at runtime boundaries
2026-07-19 05:25:32 +09:00
22325aa76a
Decouple client contracts and close private role registries
2026-07-19 03:44:30 +09:00
e7dd95aea6
Remove phase vocabulary from Lazaret interfaces
2026-07-18 22:35:48 +09:00
917409fcc6
Integrate routed Git workspaces with persistent state
2026-07-18 02:08:14 +09:00
f21a847991
Integrate exact production recovery before cold start
2026-07-17 23:23:19 +09:00
71b0266cf2
Run non-interactive sessions through production coordination
2026-07-17 23:23:19 +09:00
bc04112c77
Bind production cold start to installed Lazaret authorities
2026-07-17 23:23:19 +09:00
b2f178d25e
Bind cold start to production authorities
2026-07-17 23:23:19 +09:00
407b75b1ff
Add confined host escalation transport
2026-07-15 19:59:51 +09:00
fd78804fc7
Compose foreground sandbox process lifetimes
2026-07-15 19:30:43 +09:00
c3a76ec8c4
Add generation-bound TLS control face
...
Create ephemeral trust anchors, publish an exact-profile Unix control socket, and persist generation-authorized mTLS session registration through the Domain Store.
2026-07-15 18:19:18 +09:00
e6d6406c64
Implement exact State Anchor mount and lease lifecycle
2026-07-15 17:33:59 +09:00
e4d9cc2dc9
Add the lock-owned transactional Domain Store
2026-07-15 14:10:50 +09:00
b438dd5201
Bootstrap verified Rust implementation workspace
2026-07-13 02:25:59 +09:00
