Repository navigation

security: confine session workers and add standalone proxy - #346

Draft

ebursztein wants to merge 256 commits into

0.7from

feat/206-worker-authority

This pull request is big! We're only showing the most recent 250 commits

Commits on Oct 8, 2026
- security(api): require preview owner identity
  ebursztein
  committed
  6d49a35
- security(service): mint preview peer identity
  ebursztein
  committed
  6d65e0b
- security(gateway): authenticate preview owner handoffs
  ebursztein
  committed
  3ea6684
- security(foundation): retain child identity until explicit reap
  ebursztein
  committed
  06b660c
- security(service): revoke worker authority before reap
  ebursztein
  committed
  2fee094
- security(foundation): centralize inherited descriptor closure
  ebursztein
  committed
  0423c45
- security(process): close ambient descriptors at entry
  ebursztein
  committed
  5ae0f9d
- security(gateway): close ambient descriptors before runtime
  ebursztein
  committed
  4d10756
- security(service): authenticate private DNS by peer identity
  ebursztein
  committed
  11bf70a
- security(process): remove private DNS bearer material
  ebursztein
  committed
  b1bdb05
- refactor(telemetry): allow brokered metric transport
  ebursztein
  committed
  43eba59
- feat(core): add bounded service byte requests
  ebursztein
  committed
  bc268b0
- test(core): check expired reservation clock
  ebursztein
  committed
  04b2397
- feat(process): add brokered metric transport
  ebursztein
  committed
  6a5435a
- security(service): broker worker metric export
  ebursztein
  committed
  bb4a787
- security(process): remove direct metric export
  ebursztein
  committed
  6aa544f
- security(service): cancel revoked broker work
  ebursztein
  committed
  9b8288c
- test(service): qualify metric broker end to end
  ebursztein
  committed
  06da166
- refactor(foundation): generalize descriptor channel
  ebursztein
  committed
  c7b9a18
- feat(proto): define upstream descriptor grants
  ebursztein
  committed
  7526551
- refactor(core): compile active policy once
  ebursztein
  committed
  2f8ba52
- refactor(process): use compiled policy snapshot
  ebursztein
  committed
  e451d25
- refactor(core): share upstream target selection
  ebursztein
  committed
  832598f
- test(citadel): record waitid observation shape
  ebursztein
  committed
  38596b6
- security(service): broker upstream socket grants
  ebursztein
  committed
  bf22841
- security(foundation): seal adopted descriptors on exec
  ebursztein
  committed
  619416d
- refactor(core): inject DNS datagram grants
  ebursztein
  committed
  bf536c8
- refactor(core): reload DNS grant order
  ebursztein
  committed
  d85fd8a
- security(proto): bind grants to active policy
  ebursztein
  committed
  182e674
- security(service): stamp upstream policy grants
  ebursztein
  committed
  219714b
- security(process): broker upstream DNS sockets
  ebursztein
  committed
  d9342c7
- refactor(core): inject upstream TCP grants
  ebursztein
  committed
  9d41262
- test(core): exercise MITM through TCP grants
  ebursztein
  committed
  ca096af
- security(process): broker MITM upstream TCP
  ebursztein
  committed
  ed3ba51
- test(service): stress upstream grant isolation
  ebursztein
  committed
  d2196f4
- security(core): add resolver without host authority
  ebursztein
  committed
  de5a5a0
- security(process): remove host resolver authority
  ebursztein
  committed
  501ecc0
- test(citadel): guard upstream grant boundary
  ebursztein
  committed
  0d88d74
- fix(citadel): scope sparse fields to serde types
  ebursztein
  committed
  38c8696
- style(python): sort standard library imports
  ebursztein
  committed
  81fb0c7
- test(citadel): record isolation dependency lock
  ebursztein
  committed
  1241b47
- test(gate): classify internal metric ingestion
  ebursztein
  committed
  ffe3d22
- test(service): split private name peer checks
  ebursztein
  committed
  c868fa6
- refactor(core): split MITM configuration fixtures
  ebursztein
  committed
  0d248e3
- fix(gate): refresh qualified debug image pin
  ebursztein
  committed
  837e84d
- test(api): approve internal metrics ingestion
  ebursztein
  committed
  76d20a5
- test(frontend): follow shared session errors
  ebursztein
  committed
  21cd01b
- test(ironbank): follow split Anthropic fixtures
  ebursztein
  committed
  1d9a79c
- fix(container): budget image unpack separately
  ebursztein
  committed
  7e79306
- fix(test): qualify mock helper imports
  ebursztein
  committed
  27e8920
- test(service): preserve startup failure coverage
  ebursztein
  committed
  b870f80
- test(ironbank): flush plugin import ledger
  ebursztein
  committed
  9f1edd6
- fix(gate): track shared worktree processes
  ebursztein
  committed
  7d28f83
- fix(core): expire caller-owned workspace attributes
  ebursztein
  committed
  6cd640f
- perf(service): cache effective plugin policy
  ebursztein
  committed
  3e07b3f
Commits on Oct 9, 2026
- security(foundation): confine Linux workers
  ebursztein
  committed
  21adddb
- security(service): scope VM owner routes
  ebursztein
  committed
  0c91b63
- refactor(core): reuse prepared service channels
  ebursztein
  committed
  0817b10
- refactor(process): stamp readiness sentinels
  ebursztein
  committed
  decd0e8
- refactor(service): require stamped worker readiness
  ebursztein
  committed
  3c81d04
- security(process): confine Linux VM owners
  ebursztein
  committed
  563fc4a
- fix(foundation): close inherited descriptors without procfs
  ebursztein
  committed
  696abc7
- fix(core): launch images without stage chmod
  ebursztein
  committed
  126635e
- feat(proto): define gateway descriptor grants
  ebursztein
  committed
  6425a79
- refactor(gateway): consume granted service channels
  ebursztein
  committed
  38ca38c
- security(service): broker gateway connections
  ebursztein
  committed
  390b351
- fix(service): validate gateway readiness stamps
  ebursztein
  committed
  dc21dfc
- security(gateway): confine Linux API worker
  ebursztein
  committed
  1346d1e
- fix(service): own gateway marker cleanup
  ebursztein
  committed
  98bd063
- security(gateway): attest denied Linux authority
  ebursztein
  committed
  aec5d55
- test(gateway): broker confined service grants
  ebursztein
  committed
  e8423bb
- fix(logger): keep flush scratch state confined
  ebursztein
  committed
  0ec90f2
- feat(proto): broker guest metadata changes
  ebursztein
  committed
  a8c3a21
- security(foundation): contain guest mode changes
  ebursztein
  committed
  c1bc0aa
- style(proto): format metadata grant records
  ebursztein
  committed
  09ab450
- security(service): broker guest mode changes
  ebursztein
  committed
  27298b0
- security(core): broker VirtioFS mode changes
  ebursztein
  committed
  ab7c6c3
- security(process): delegate guest metadata authority
  ebursztein
  committed
  1091209
- security(process): attest confined owner authority
  ebursztein
  committed
  273d5f0
- docs(changelog): record confined metadata fixes
  ebursztein
  committed
  fd9a590
- security(foundation): confine macOS workers
  ebursztein
  committed
  c0821f5
- security(gateway): install macOS worker policy
  ebursztein
  committed
  12872b6
- security(process): install macOS owner policy
  ebursztein
  committed
  a2fcde2
- docs(changelog): record macOS worker confinement
  ebursztein
  committed
  7b4ccf5
- feat(proto): define ledger channel authority
  ebursztein
  committed
  47b82fd
- feat(logger): define typed ledger operations
  ebursztein
  committed
  56bae0f
- feat(logger): serve typed ledger operations
  ebursztein
  committed
  bc49bf6
- feat(proto): frame ledger descriptor grants
  ebursztein
  committed
  7466aa1
- feat(ledger): own each session database
  ebursztein
  committed
  570cdd8
- security(foundation): confine ledger workers
  ebursztein
  committed
  ad6266b
- security(ledger): confine session owners
  ebursztein
  committed
  6289e13
- security(proxy): apply atomic policy revisions
  ebursztein
  committed
  0eb5b31
- security(process): bind grants to request policy
  ebursztein
  committed
  a51b357
- security(proxy): scope engine capabilities
  ebursztein
  committed
  ff94dc4
- refactor(process): construct proxy engine
  ebursztein
  committed
  17389de
- security(foundation): add descriptor-only proxy role
  ebursztein
  committed
  1645039
- feat(proto): frame proxy capability grants
  ebursztein
  committed
  9527680
- security(proxy): confine capability worker
  ebursztein
  committed
  1dd2e8a
- feat(proto): carry proxy policy revisions
  ebursztein
  committed
  e44f32f
- feat(proxy): compile path-free runtime policy
  ebursztein
  committed
  1a2844a
- security(proxy): apply policy inside worker
  ebursztein
  committed
  f021ac0
- security(service): supervise per-session proxy workers
  ebursztein
  committed
  626a013
- security(packaging): ship confined workers
  ebursztein
  committed
  6e9adc9
- security(install): require confined workers
  ebursztein
  committed
  0983e10
- security(service): supervise ledger worker protocol
  ebursztein
  committed
  71d8079
- security(service): serialize ledger worker lifetimes
  ebursztein
  committed
  f488ac5
- security(install): pin ledger worker path
  ebursztein
  committed
  2af1b3f
- feat(logger): write through ledger descriptors
  ebursztein
  committed
  dc87aa2
- feat(proto): grant ledger channels to workers
  ebursztein
  committed
  d3efd45
- test(service): use authenticated readiness stamps
  ebursztein
  committed
  7293848
- security(service): grant VM ledger authority
  ebursztein
  committed
  b11d6b2
- security(process): write through supervised ledger
  ebursztein
  committed
  54ff7af
- feat(logger): add authenticated ledger client
  ebursztein
  committed
  6aaf4da
- refactor(logger): share named query dispatch
  ebursztein
  committed
  bcca744
- fix(logger): bound history offsets for sqlite
  ebursztein
  committed
  85e3ba9
- security(service): read sessions through ledger grants
  ebursztein
  committed
  356856e
- security(process): stop delegating ledger paths
  ebursztein
  committed
  ecffcf4
- fix(service): reconnect failed ledger readers
  ebursztein
  committed
  3248a5f
- fix(logger): bound unread export delivery
  ebursztein
  committed
  6c1ed6c
- feat(proto): define proxy traffic handoff
  ebursztein
  committed
  d15f215
- feat(proto): type proxy traffic grants
  ebursztein
  committed
  28f8727
- refactor(proxy): distinguish traffic grants
  ebursztein
  committed
  b6526fb
- feat(service): broker guest traffic to proxy workers
  ebursztein
  committed
  2c6b3e8
- feat(process): surrender proxy traffic descriptors
  ebursztein
  committed
  70a9c11
- feat(proto): bind proxy ledger grants
  ebursztein
  committed
  b5347d4
- feat(proxy): authenticate ledger capability
  ebursztein
  committed
  ba48571
- feat(service): grant proxy ledger authority
  ebursztein
  committed
  f35678b
- feat(proto): define proxy credential capability
  ebursztein
  committed
  f695021
- feat(proxy): consume credential capability
  ebursztein
  committed
  0a707fd
- feat(service): broker proxy credentials
  ebursztein
  committed
  9471bb2
- feat(service): grant proxy upstream broker
  ebursztein
  committed
  a808faa
- refactor(core): share upstream grant client
  ebursztein
  committed
  20031cc
- refactor(process): use shared upstream client
  ebursztein
  committed
  c21a1d2
- feat(proxy): adopt upstream authority
  ebursztein
  committed
  fddd50a
- style(process): format upstream adoption
  ebursztein
  committed
  09599ab
- feat(proto): define private-name capability
  ebursztein
  committed
  6588f5a
- feat(service): grant private-name capability
  ebursztein
  committed
  35af9af
- feat(proxy): consume private-name capability
  ebursztein
  committed
  399e997
- feat(proto): reject premature proxy traffic
  ebursztein
  committed
  84b289f
- feat(proxy): serve authenticated HTTP traffic
  ebursztein
  committed
  2d35805
- refactor(core): share guest DNS sessions
  ebursztein
  committed
  193740f
- refactor(process): use shared DNS sessions
  ebursztein
  committed
  5369d1c
- feat(proxy): serve authenticated DNS traffic
  ebursztein
  committed
  2f9b2bb
- security(process): surrender guest DNS traffic
  ebursztein
  committed
  08d0226
- refactor(core): unify MCP policy snapshots
  ebursztein
  committed
  885a0a6
- feat(proto): bootstrap proxy MCP capability
  ebursztein
  committed
  c3163a1
- refactor(core): share MCP aggregator driver
  ebursztein
  committed
  4f95656
- refactor(process): use shared MCP driver
  ebursztein
  committed
  a821a2b
- feat(core): observe MCP driver closure
  ebursztein
  committed
  067af62
- feat(proto): preserve proxy MCP runtime limits
  ebursztein
  committed
  64be80d
- feat(proxy): consume MCP capability
  ebursztein
  committed
  d2a0d50
- feat(proto): hand off proxy MCP channels
  ebursztein
  committed
  f9ebed5
- feat(core): surrender proxy MCP capability
  ebursztein
  committed
  675b5d2
- feat(service): broker proxy MCP capability
  ebursztein
  committed
  c2112d8
- feat(process): grant scoped MCP to proxy
  ebursztein
  committed
  f77199e
- security(process): surrender guest HTTP traffic
  ebursztein
  committed
  f10cc2d
- feat(proto): bound proxy metric relay
  ebursztein
  committed
  8fe95b6
- feat(service): broker proxy metric export
  ebursztein
  committed
  137b83a
- feat(proto): identify proxy metric grants
  ebursztein
  committed
  61e5c6b
- feat(service): identify proxy metric grants
  ebursztein
  committed
  41e2c0b
- feat(proxy): export brokered session metrics
  ebursztein
  committed
  c13bd0a
- feat(proto): coordinate frozen session clones
  ebursztein
  committed
  ee14ca6
- security(process): remove clone path authority
  ebursztein
  committed
  4d2a461
- feat(proto): authorize ledger snapshots
  ebursztein
  committed
  035b2d3
- feat(logger): own coherent fork snapshots
  ebursztein
  committed
  0756443
- refactor(core): split ledger-free session clone
  ebursztein
  committed
  0a17615
- security(service): coordinate path-free session clones
  ebursztein
  committed
  06f4a99
- refactor(core): isolate mutable owner state
  ebursztein
  committed
  29d7dab
- feat(proto): fix owner checkpoint location
  ebursztein
  committed
  0847cab
- refactor(service): confine checkpoint state path
  ebursztein
  committed
  71a3baa
- security(process): deny session ledger paths
  ebursztein
  committed
  f88b781
- feat(core): pin standalone model upstreams
  ebursztein
  committed
  3103e8c
- feat(proxy): serve fixed provider traffic
  ebursztein
  committed
  1a02fff
- feat(api): define standalone proxy leases
  ebursztein
  committed
  a716d2e
- feat(python-sdk): add proxy lease operations
  ebursztein
  committed
  f320de6
- feat(typescript-sdk): add proxy lease operations
  ebursztein
  committed
  13e575b
- feat(rust-sdk): add proxy lease operations
  ebursztein
  committed
  75cbfab
- style(api): format proxy lease route
  ebursztein
  committed
  1b47331
- security(service): supervise standalone proxy leases
  ebursztein
  committed
  5cd67aa
- feat(cli): add standalone model proxy
  ebursztein
  committed
  450cea8
- test(mock-server): add SDK failure controls
  ebursztein
  committed
  bf690f3
- fix(mock-server): escape streamed response text
  ebursztein
  committed
  c84d760
- test(python-sdk): probe standalone OpenAI endpoint
  ebursztein
  committed
  4846b87
- test(typescript-sdk): probe standalone OpenAI endpoint
  ebursztein
  committed
  0adb828
- test(ironbank): prove standalone model proxy
  ebursztein
  committed
  f538a25
- chore(surface): register standalone proxy API
  ebursztein
  committed
  c0931c4
- test(ci): execute confined workers on both hosts
  ebursztein
  committed
  2f19b63
- fix(mcp): sync linked SDK dependency lock
  ebursztein
  committed
  0fdff40
- docs(architecture): document confined host workers
  ebursztein
  committed
  fe4d85b
- merge(0.7): integrate current release line
  ebursztein
  committed
  a914af9
- fix(foundation): gate legacy syscalls by architecture
  ebursztein
  committed
  c7b7dc0
- refactor(archive): isolate block codec implementations
  ebursztein
  committed
  adf2a2b
- refactor(logger): thread archive codec authority
  ebursztein
  committed
  b82efd8
- feat(archive): assign the zstd block codec id
  ebursztein
  committed
  4d4990b
- security(ledger): confine streaming zstd archives
  ebursztein
  committed
  e71513b
- test(citadel): pin confined zstd ownership
  ebursztein
  committed
  0d3f195
- test(ledger): measure archive codec tradeoffs
  ebursztein
  committed
  dca38bb
- feat(proto): define producer ledger commitments
  ebursztein
  committed
  6bd5f9e
- feat(proto): grant trusted ledger checkpoint channels
  ebursztein
  committed
  fb00695
- security(logger): bind records to producer commitments
  ebursztein
  committed
  0a24e9a
- security(service): anchor producer commitments externally
  ebursztein
  committed
  c2576dd
- feat(core): adopt ledger checkpoint channels
  ebursztein
  committed
  a5591cd
- feat(process): attach trusted ledger checkpoints
  ebursztein
  committed
  4821a70
- feat(proxy): attach trusted ledger checkpoints
  ebursztein
  committed
  93834a0
- feat(logger): expose canonical commitment hashing
  ebursztein
  committed
  3f79eaf
- test(service): reuse canonical commitment hashing
  ebursztein
  committed
  098bab4
- test(ledger): exercise committed producer records
  ebursztein
  committed
  339b1eb
- style(service): format commitment verification
  ebursztein
  committed
  29035ae
- test(ledger): preserve commitments across retention
  ebursztein
  committed
  421de73
- test(service): define unanchored commitment loss
  ebursztein
  committed
  358ae5b
- docs(architecture): define ledger commitment proof
  ebursztein
  committed
  9c02b75
- fix(proto): keep proxy frames sparse
  ebursztein
  committed
  7bc0f3d
- refactor(logger): centralize ledger framing
  ebursztein
  committed
  74f704a
- refactor(process): trim owner bootstrap
  ebursztein
  committed
  0d50c7e
- test(citadel): follow confined worker ownership
  ebursztein
  committed
  e47f786
- style(tests): format gateway helper
  ebursztein
  committed
  85223c9
- test(sdk): type official client probes
  ebursztein
  committed
  a1fcc12
- test(isolation): type grant fixtures
  ebursztein
  committed
  39b2487
- test(ts-sdk): provide package sandbox home
  ebursztein
  committed
  e9a0ca5
- test(mcp): isolate packed package home
  ebursztein
  committed
  40d1391
- fix(ts-sdk): preserve npm home during prewarm
  ebursztein
  committed
  1183618
- fix(mcp): preserve npm home during prewarm
  ebursztein
  committed
  6557f58
- style(tests): sort hermetic model imports
  ebursztein
  committed
  73afa1c
- chore(deps): accept worker dependency graph
  ebursztein
  committed
  a641e3f
- test(docs): count isolation architecture page
  ebursztein
  committed
  e2ffd81
- test(ledger): move codec measurement to bench rail
  ebursztein
  committed
  ad1d6ee
- fix(sdk-python): make package proof cold-cache safe
  ebursztein
  committed
  4cefa6a
- security(foundation): support older Landlock ABIs
  ebursztein
  committed
  c3bcb8f
- security(logger): prepare ledger before starting workers
  ebursztein
  committed
  a93e387
- security(ledger): start workers after confinement
  ebursztein
  committed
  8df00d1
- security(proxy): confine before starting worker threads
  ebursztein
  committed
  4262cc4
- test(proxy): authenticate ledger commitment channel
  ebursztein
  committed
  3e58da6
- security(foundation): prepare logs before confinement
  ebursztein
  committed
  634fc6a
- security(gateway): confine before starting runtime threads
  ebursztein
  committed
  3e78c3e
- fix(gateway): forward standalone proxy routes
  ebursztein
  committed
  1778ed6
- security(core): prepare confined VM sockets reliably
  ebursztein
  committed
  5892cad
- feat(proto): carry MCP tool schemas over owner IPC
  ebursztein
  committed
  f488268
- security(process): confine VM owners and cache authority
  ebursztein
  committed
  1847ea4
- test(logger): allow bounded large-body admission
  ebursztein
  committed
  b13d2f0
- security(service): own MCP discovery and worker fixtures
  ebursztein
  committed
  d30366a
- docs(architecture): explain worker startup confinement
  ebursztein
  committed
  77350cf
- test(gate): qualify extracted worker owners
  ebursztein
  committed
  f2b6062
- security(foundation): harden file target and watch boundaries
  ebursztein
  committed
  2156148
Commits on Oct 10, 2026
- merge(0.7): refresh worker authority candidate
  ebursztein
  committed
  a1b8cb0
- test(foundation): gate Linux sandbox permission import
  ebursztein
  committed
  0fbf996
- test(core): stabilize managed lifecycle timing proof
  ebursztein
  committed
  1c26e86
- fix(service): drain terminal ledger worker event
  ebursztein
  committed
  3153cad
- test(service): cover terminal event after child exit
  ebursztein
  committed
  9f2caa3
- test(foundation): handle profiler thread on old Landlock
  ebursztein
  committed
  ea857f3
- docs(skills): align diagnostics with worker isolation
  ebursztein
  committed
  0b63536

Commits

Commits on Oct 8, 2026

Commits on Oct 9, 2026