Issues

• Source-only ironbank checks run in the VM functional phase instead of Citadel

  google/capsem#298 · Filter by author ebursztein opened on Oct 4, 2026

• Service startup prewarm reports 'hash mismatch' for installed VM assets after an update

  google/capsem#297 · Filter by author ebursztein opened on Oct 4, 2026

• Minimal Capsem runtime with OCI application images (replaces profiles)

  type:feature
  google/capsem#289 · Filter by author ebursztein opened on Oct 3, 2026

• Updater: let the new binary validate staged profiles when a binary update ships with them

  google/capsem#288 · Filter by author ebursztein opened on Oct 2, 2026

• A published-port stream stalls 8 s in one direction during a 16-stream reset burst (hosted runner)

  google/capsem#282 · Filter by author ebursztein opened on Oct 1, 2026

• Exec latency on Linux/KVM is bimodal (75-85 ms vs 110-140 ms) and 4-6x the 1.0-era baseline

  google/capsem#281 · Filter by author ebursztein opened on Oct 1, 2026

• capsem-core credential_broker test races global state under cargo test threads

  google/capsem#278 · Filter by author ebursztein opened on Sep 29, 2026
  1

• sccache caches no workspace crate: the workspace wrapper makes every call non-cacheable

  google/capsem#277 · Filter by author ebursztein opened on Sep 29, 2026

• Disk budget: build box cache maxima sum to 839 GiB on a 484 GiB disk

  google/capsem#276 · Filter by author ebursztein opened on Sep 29, 2026
  2

• cache: test-temp namespaces of retired authorities are never reclaimed

  google/capsem#272 · Filter by author ebursztein opened on Sep 28, 2026

• Stop merging with pr-gate red; make guest-feature removal fail pre-merge with the profile-first instruction

  google/capsem#253 · Filter by author ebursztein opened on Sep 25, 2026

• Changing one guest diagnostics file costs ~11 min per arch of full rootfs rebuild

  google/capsem#241 · Filter by author ebursztein opened on Sep 24, 2026

• Parallel execs on one VM: completion blocks the control loop, no concurrency test; command pool as a possible later design (low priority)

  component:servicecomponent: vmtype:feature
  google/capsem#240 · Filter by author ebursztein opened on Sep 24, 2026

• Restore content-based file typing with Magika v2 (pure Rust) once it is production-ready

  google/capsem#234 · Filter by author ebursztein opened on Sep 24, 2026

• Add prompt injectiopn classifier

  Feature

  google/capsem#233 · Filter by author ebursztein opened on Sep 23, 2026
  

• Make protocol benchmark accounting and timing trustworthy

  google/capsem#232 · Filter by author ebursztein opened on Sep 21, 2026

• Make upstream mocks prove real streaming and current provider/MCP contracts

  google/capsem#231 · Filter by author ebursztein opened on Sep 21, 2026

• Flaky: mounted_mcp_routes_are_profile_scoped_mechanics_only fails intermittently in the full service run

  google/capsem#226 · Filter by author ebursztein opened on Sep 19, 2026

• P1: Enforce cross-VM host isolation, extract the sandboxed proxy, add capsem proxy, and document the architecture

  google/capsem#206 · Filter by author ebursztein opened on Sep 14, 2026
  4

• VM Freeze on capsem-pty-agent Exit

  google/capsem#198 · Filter by author tholop opened on Sep 9, 2026

• Error installing capsem 0.6.3 on macOS

  google/capsem#197 · Filter by author achernya opened on Sep 8, 2026
  1

• URLs spanning multiple lines are corrupted by margins in capsem shell

  google/capsem#196 · Filter by author ia0 opened on Sep 8, 2026

• ci: make Codecov publication a blocking gate after reliability soak

  component: CI
  google/capsem#190 · Filter by author ebursztein opened on Sep 1, 2026
  1

• [triage:process-blocking-terminal-io] Remaining synchronous terminal I/O runs on Tokio workers

  google/capsem#189 · Filter by author ebursztein opened on Aug 28, 2026

• [triage:service-live-log-buffering] Active service log stream remains empty during live route handling

  google/capsem#188 · Filter by author ebursztein opened on Aug 28, 2026