 Drew Newberry
|
a31a0938d8
|
feat(vm): run the supervisor outside the guest workload
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:38:16 -07:00 |
|
|
Drew Newberry
|
de2b42c6e6
|
fix(sandbox): bind reconnects to supervisor process
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 18:35:48 -07:00 |
|
|
Drew Newberry
|
48f108374c
|
fix(ci): refresh schema and dependency policy
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 16:49:15 -07:00 |
|
|
Drew Newberry
|
bda6fff5a2
|
refactor(sandbox): use a scratch runtime image
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 16:22:59 -07:00 |
|
|
Drew Newberry
|
d3d92a7ccc
|
refactor(isolation): use backend and runtime terminology
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-12 14:07:09 -07:00 |
|
|
Drew Newberry
|
07441545ba
|
fix(ci): validate sandbox binary linkage
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:16:22 -07:00 |
|
|
Drew Newberry
|
9b00cb6153
|
feat(config): configure the sandbox runtime image
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
97f26ac888
|
build(runtime): publish separate sandbox and supervisor images
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
2e25ae860d
|
fix(isolation): repair rebased sandbox CI
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
8189cf4ca4
|
fix(sandbox): fail closed across supervisor disconnects
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
31141e0407
|
fix(auth): validate refreshed credentials before rotation
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
46fc310ddf
|
fix(sandbox): align projected bootstrap bundle
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
bf42b59e48
|
test(sandbox): align topology session fixture
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
280cdef354
|
refactor(sandbox): consume dedicated backend crate
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
6a3d4a3040
|
feat(supervisor): rotate launch-scoped authentication
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
56a7f2a91d
|
feat(isolation): authenticate the Sandbox Protocol
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
c4a0eff0d6
|
refactor(sandbox): implement loopback connector
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
e184f374a0
|
ci(e2e): select migrated drivers per stack layer
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
f59d403882
|
fix(sandbox): bound control admission and retire stale mediation
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
7ec8eff932
|
fix(sandbox): bound network mediation and preserve socket authorization
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
fe6aad8327
|
fix(sandbox): return retained exec exit status to independent waiters
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
2b26edce70
|
test(sandbox): isolate credential probes from filtered threads
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
d3b921e96a
|
fix(sandbox): preserve accept thread ownership on musl
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:16 -07:00 |
|
|
Drew Newberry
|
31f5a739b2
|
fix(sandbox): reject private root redirects and adopt typed errors
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
d597aa17e5
|
fix(sandbox): harden boundary isolation and lifecycle ownership
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
807f8134ee
|
feat(isolation): split supervisor and sandbox runtimes
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
d69352fb53
|
feat(isolation): add terminal boundary operation
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
1f20080b15
|
fix(isolation): harden runtime boundary controls
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
9d0038f979
|
refactor(isolation): separate sandbox backend protocol
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
c72daa94c7
|
feat(isolation): add transport-neutral session authentication
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
ff45e457fd
|
refactor(isolation): generalize loopback protocol
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
48659ee92d
|
fix(isolation): bound mediation attach without nested retries
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
5c5057f82d
|
docs(isolation): describe mediated DNS channel
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
5c854272d8
|
test(isolation): import owned agent specification explicitly
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
95833cae5f
|
fix(isolation): validate wire state and propagate snapshot failures
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
49ac1be495
|
fix(isolation): validate remote confirmation through public contract
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
d741dcc698
|
fix(isolation): harden signals and separate process status from transport
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
64ee429ae2
|
feat(isolation): add boundary protocol and Linux primitives
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
14c02490e3
|
fix(mxc): initialize extended sandbox status
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
cc95700d51
|
feat(isolation): bind launches to sandbox sessions
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
406200dccc
|
refactor(isolation): unify typed network mediation
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
61235726de
|
refactor(isolation): generalize loopback connector
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
8e485acb0a
|
fix(isolation): clarify mediated DNS identity
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
de5aff292b
|
fix(isolation): validate confirmation for external backend implementations
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
b24b847f64
|
fix(isolation): seal confirmed boundary state
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
f72ec9efc5
|
feat(isolation): define capability-free launch contract
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
06a3a8a899
|
docs(isolation): remove unrelated driver inventory
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
175dc82a29
|
fix(isolation): tighten interface error and digest contracts
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
10deeccf42
|
feat(isolation): add mediated DNS transport
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|
|
Drew Newberry
|
f098913b4d
|
docs(agents): inventory the MXC driver
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
|
2026-09-11 15:12:15 -07:00 |
|