51ff63a3aa
Add coordinator-owned interactive session terminals
2026-07-17 23:23:19 +09:00
3b76b59bdf
Require fresh State Anchor absence before lease release
2026-07-17 23:23:19 +09:00
4dd2b150d2
Compose selected State Anchor paths over prepared roots
2026-07-17 23:23:19 +09:00
71b0266cf2
Run non-interactive sessions through production coordination
2026-07-17 23:23:19 +09:00
308c5a1b56
Bind cross-process configuration by identity
2026-07-17 23:23:19 +09:00
b35582a9e6
Refuse prepared-lower child mount crossings
2026-07-17 23:23:19 +09:00
4cf7a5e595
Refuse inexact production selector authorities
2026-07-17 23:23:19 +09:00
bc04112c77
Bind production cold start to installed Lazaret authorities
2026-07-17 23:23:19 +09:00
c0b139256e
Confine image preparation beneath retained storage authority
2026-07-17 23:23:19 +09:00
fbd332c31f
Require explicit canonical network readiness targets
2026-07-17 23:23:19 +09:00
c8acf116d6
Restore pre-publication network readiness semantics
2026-07-17 23:23:19 +09:00
fc5b2b6ca0
Confine runtime staging to retained authority
2026-07-17 23:23:19 +09:00
b2f178d25e
Bind cold start to production authorities
2026-07-17 23:23:19 +09:00
a9c9cf7ab3
Fail teardown when control withdrawal fails
2026-07-17 23:23:19 +09:00
da7557b850
Route production control through lifecycle ownership
2026-07-17 23:23:19 +09:00
33ac0ba4ee
Compose cold-start resources under Runtime Supervisor ownership
2026-07-17 23:23:19 +09:00
510dfccf5a
Route lifecycle admission through the control registry
2026-07-17 23:23:19 +09:00
671473106c
Orchestrate normal domain lifecycle through adapters
2026-07-17 23:23:19 +09:00
49d5def1a9
Bind sandbox handoff authority and restore verifier gates
2026-07-17 23:23:19 +09:00
cf914bdf51
Narrow confined path authority at runtime handoff
2026-07-17 23:23:19 +09:00
1cac1e04c2
Restore specification and model authority boundaries
2026-07-17 23:23:19 +09:00
95104fa4e7
Implement fail-closed ignored workspace routing
2026-07-16 13:04:12 +09:00
ba6a075839
Implement supervised rootless network readiness
2026-07-15 23:26:37 +09:00
407b75b1ff
Add confined host escalation transport
2026-07-15 19:59:51 +09:00
903ff837d6
Enforce sandbox causal edge stdio policies
2026-07-15 19:30:43 +09:00
b653293840
Clarify sandbox causal edge descriptors
2026-07-15 19:30:43 +09:00
fd78804fc7
Compose foreground sandbox process lifetimes
2026-07-15 19:30:43 +09:00
3171c41399
Verify irreversible capability removal
2026-07-15 19:30:09 +09:00
18afbeaa91
Make control identity mode umask-independent
...
Set and validate the publication identity through its retained descriptor so restrictive process masks cannot weaken or remove the required mode.
2026-07-15 18:19:18 +09:00
c3a76ec8c4
Add generation-bound TLS control face
...
Create ephemeral trust anchors, publish an exact-profile Unix control socket, and persist generation-authorized mTLS session registration through the Domain Store.
2026-07-15 18:19:18 +09:00
8886436841
Refuse inconsistent State Anchor acquisition checkpoints
2026-07-15 17:41:05 +09:00
48c10e9a7a
Make State Anchor acquisition resumable and descriptor-confined
2026-07-15 17:33:59 +09:00
e6d6406c64
Implement exact State Anchor mount and lease lifecycle
2026-07-15 17:33:59 +09:00
27bc3d835e
Validate persisted network readiness fingerprints
2026-07-15 17:12:07 +09:00
304fb225d6
Implement canonical network readiness derivation
2026-07-15 16:58:30 +09:00
d274e1835d
Pin protocol claim and signing vectors
2026-07-15 16:18:38 +09:00
af8669c165
Implement generation-bound protocol cryptography
2026-07-15 15:56:31 +09:00
fba5471352
Permit integrated OCI schema dependency lines
2026-07-15 15:50:16 +09:00
898271c430
Complete nested prepared-lower reclaim ordering
2026-07-15 15:48:46 +09:00
0dfd7767b5
Close prepared-lower identity and reclaim races
2026-07-15 15:48:46 +09:00
5458460717
Implement verified OCI prepared-lower lifecycle
2026-07-15 15:48:46 +09:00
54f3a08b91
Confine terminfo injection to runtime control state
2026-07-15 15:16:25 +09:00
cf5948e8be
Build deterministic OCI sandbox specifications
2026-07-15 14:59:43 +09:00
bf8a3de567
Validate every Domain Store metadata row
2026-07-15 14:28:22 +09:00
1fd87ba1bd
Validate every singleton Domain Store row
2026-07-15 14:22:43 +09:00
e4d9cc2dc9
Add the lock-owned transactional Domain Store
2026-07-15 14:10:50 +09:00
96b494a8bb
Add the transactional prepared-artifact catalog
2026-07-15 13:40:52 +09:00
2d4ec2ed8b
Generalize benchmark qualification environment
2026-07-15 02:49:39 +09:00
c1b40f923a
Integrate core record modularization
2026-07-15 02:16:30 +09:00
6301eeba3e
Split record modules without changing wire behavior
2026-07-15 02:09:18 +09:00
