31e9ab0f2d
Replace external reachability with an owned canary
2026-07-19 22:39:31 +09:00
73e3e9fdee
Fix rootless launches with subordinate ID maps
...
Resolve and verify canonical caller subordinate ranges, launch preparation and runtime workers through mapped causal acquisition, and keep runsc in the existing user namespace. Repair descriptor-relative OCI cleanup and absent-mount recovery so failed launches can progress to the corrected path.
2026-07-19 19:51:47 +09:00
247819250b
Replace lexical Rust fragments with real modules
2026-07-19 05:12:57 +09:00
ee9201b057
Decompose oversized Rust files by responsibility
2026-07-19 03:02:44 +09:00
3f9b1b3543
Close hostile recovery and concurrency gaps
2026-07-18 05:47:15 +09:00
917409fcc6
Integrate routed Git workspaces with persistent state
2026-07-18 02:08:14 +09:00
2bc5982a62
Enforce exact recovery ownership before cold start
2026-07-17 23:23:19 +09:00
3b76b59bdf
Require fresh State Anchor absence before lease release
2026-07-17 23:23:19 +09:00
4dd2b150d2
Compose selected State Anchor paths over prepared roots
2026-07-17 23:23:19 +09:00
33ac0ba4ee
Compose cold-start resources under Runtime Supervisor ownership
2026-07-17 23:23:19 +09:00
49d5def1a9
Bind sandbox handoff authority and restore verifier gates
2026-07-17 23:23:19 +09:00
ba6a075839
Implement supervised rootless network readiness
2026-07-15 23:26:37 +09:00
903ff837d6
Enforce sandbox causal edge stdio policies
2026-07-15 19:30:43 +09:00
fd78804fc7
Compose foreground sandbox process lifetimes
2026-07-15 19:30:43 +09:00
