Drew Newberry
77929d9c14
* feat(isolation): publish backend protocol contracts independently of runtime Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(isolation): expose trusted launch and registry data contracts Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(isolation): name the required capability sandbox Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(sandbox): align protocol and compute capability names Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(sandbox): finalize public protocol contract names Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(isolation)!: activate backend contracts in sandbox runtime and driver selection Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(sandbox): simplify runtime and fix backend example Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(examples): organize WASI backend in Rust Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(sandbox): defer protocol conformance fixtures Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(examples): add supervised V8 backend demo Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(examples): stream V8 guest output with default policy Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(examples): handle V8 rejections and roll back failed launches Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(examples): align V8 crypto dependencies with CI AWS-LC Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(sandbox): represent Sandbox Protocol operations in protobuf Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(isolation): replace backend traits with RPC clients Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(proto): remove legacy isolation protocol reservations Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(proto): clarify Sandbox Protocol names Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(isolation): clarify authentication bootstrap and supervisor APIs Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(isolation): simplify policy enforcement confirmation Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(sandbox): rotate launch generations and stabilize retry sessions Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(sandbox): remove redundant backend adapters and TCP flags Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(sandbox): repair Docker restarts and macOS lint Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(isolation): simplify RPC contracts and backend registration Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(sandbox): deliver TCP denials before closing the RPC Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
OpenShell process supervisor
This crate manages workload processes and SSH sessions through the admitted isolation backend.
Bounded streaming uploads
The CLI's built-in uploads use the openshell-upload-v1 SSH subsystem. Russh
returns SSH receive credit before the supervisor consumes channel data, so this
subsystem returns its own credit and uses SSH for everything else. The gateway
relays the channel without interpreting it.
The client sends one JSON plan line with the destination, then the raw tar
stream, then SSH EOF. When the plan arrives, the supervisor starts the
extractor through the ordinary BoundaryExec path, with the same workload
identity, environment, working directory and filesystem policy as other SSH
children. Startup runs inline, like an exec request.
Stdout carries only big-endian u64 totals of archive bytes that InputTask
has written through BoundaryInput::write_all. The first total, zero, means
extraction started. Extractor stdout and stderr are both sent as SSH stderr,
so extractor output cannot forge credit. The client keeps at most 1 MiB beyond
the last total outstanding; the supervisor rejects input beyond that window.
The existing 4 MiB pending-input guard remains active.
After the extractor exits successfully and stdin has drained, the supervisor sends the final total, then the exit status. The client succeeds only when the status is zero and the final total equals the bytes it sent. A malformed plan, credit violation, extended data or EOF before the plan fails the upload with exit status 74. A rejection wins until the supervisor reports the exit result, even after the extractor exits. Rejection, channel close or disconnect terminates the extractor. Extraction writes directly to the destination, so failures can leave partially extracted files; there is no rollback or atomic replacement.
The CLI requires supervisor support for this subsystem before sending archive data. It does not fall back to the previous unpaced exec-stdin upload path. Ordinary exec stdin and SFTP retain their existing input-budget behavior.