Correct the caller-configured user-namespace topology, bind modeled network readiness to the live sandbox and helper, and keep physical canary, topology, encoding, and capability predicates in compact specification tables below the model boundary.
Make Rust records and fixed codec tests the implementation-shape owner, remove the Mermaid category registry, and state the ownership boundary in the authoritative specification.
Promote Host Coordinator + Runtime Supervisor + attached runsc as the product
architecture in the specification, and extend the TLA+ model with generation-scoped
identities, multi-role durable intent, network readiness, prepared-lower lease, and
connectivity-helper ownership. TLC-checked; trim product prose that the model now owns.
- Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`.
- Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths.
- Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery.
- Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations.
Overhaul the architectural specification (specification.md) and reorganize
the developer journals to incorporate the new Domain Anchor model. This scopes
sandbox container names, lockfiles, control sockets, and State Anchor persistent
overlay filesystem layers to unique (agent, workspace) hash pairings.
- Add Domain Anchor and Domain Root definitions to glossary and expansion tokens.
- Specify the Ephemeral Session Coordinator pattern with hold-to-bind locking.
- Document Git Sentry nested read-only mount layout replacing the legacy Git Shadow.
- Renamed and reorganized research sub-journals, embedding executable Python logic in-place.
- Include `redb` for embedded transactional state.
