Repository navigation

security: confine session workers and add standalone proxy - #346

Merged

ebursztein merged 465 commits into

0.7from

feat/206-worker-authority

Oct 14, 2026

Merged

security: confine session workers and add standalone proxy#346
ebursztein merged 465 commits into
0.7from
feat/206-worker-authority

This pull request is big! We're only showing the most recent 250 commits

Commits on Oct 14, 2026
- test(service): define unanchored commitment loss
  ebursztein
  committed
  d4b0150
- docs(architecture): define ledger commitment proof
  ebursztein
  committed
  7f5da5f
- fix(proto): keep proxy frames sparse
  ebursztein
  committed
  73a55f3
- refactor(logger): centralize ledger framing
  ebursztein
  committed
  0a98c14
- refactor(process): trim owner bootstrap
  ebursztein
  committed
  8b1389a
- test(citadel): follow confined worker ownership
  ebursztein
  committed
  5defb22
- style(tests): format gateway helper
  ebursztein
  committed
  919f11e
- test(sdk): type official client probes
  ebursztein
  committed
  dcfd9de
- test(isolation): type grant fixtures
  ebursztein
  committed
  2761e68
- test(ts-sdk): provide package sandbox home
  ebursztein
  committed
  eca00ef
- test(mcp): isolate packed package home
  ebursztein
  committed
  c9e4bb5
- fix(ts-sdk): preserve npm home during prewarm
  ebursztein
  committed
  1cc22e6
- fix(mcp): preserve npm home during prewarm
  ebursztein
  committed
  4c48aa7
- chore(deps): accept worker dependency graph
  ebursztein
  committed
  f2e6958
- test(docs): count isolation architecture page
  ebursztein
  committed
  715be0f
- test(ledger): move codec measurement to bench rail
  ebursztein
  committed
  c30cdfc
- fix(sdk-python): make package proof cold-cache safe
  ebursztein
  committed
  b5acffa
- security(foundation): support older Landlock ABIs
  ebursztein
  committed
  0b2ba62
- security(logger): prepare ledger before starting workers
  ebursztein
  committed
  e09d00e
- security(ledger): start workers after confinement
  ebursztein
  committed
  b357a6d
- security(proxy): confine before starting worker threads
  ebursztein
  committed
  5f85cc3
- test(proxy): authenticate ledger commitment channel
  ebursztein
  committed
  d9c94fe
- security(foundation): prepare logs before confinement
  ebursztein
  committed
  315447f
- security(gateway): confine before starting runtime threads
  ebursztein
  committed
  77e8c1c
- fix(gateway): forward standalone proxy routes
  ebursztein
  committed
  625bbcf
- security(core): prepare confined VM sockets reliably
  ebursztein
  committed
  65009df
- feat(proto): carry MCP tool schemas over owner IPC
  ebursztein
  committed
  fbf3bf5
- security(process): confine VM owners and cache authority
  ebursztein
  committed
  2400089
- test(logger): allow bounded large-body admission
  ebursztein
  committed
  eedda86
- security(service): own MCP discovery and worker fixtures
  ebursztein
  committed
  c6a9992
- docs(architecture): explain worker startup confinement
  ebursztein
  committed
  400b44e
- test(gate): qualify extracted worker owners
  ebursztein
  committed
  a24b608
- security(foundation): harden file target and watch boundaries
  ebursztein
  committed
  e430ea8
- test(foundation): gate Linux sandbox permission import
  ebursztein
  committed
  a2438ea
- test(core): stabilize managed lifecycle timing proof
  ebursztein
  committed
  61fe0b8
- fix(service): drain terminal ledger worker event
  ebursztein
  committed
  4acea96
- test(service): cover terminal event after child exit
  ebursztein
  committed
  44e9fde
- test(foundation): handle profiler thread on old Landlock
  ebursztein
  committed
  0213cc4
- docs(skills): align diagnostics with worker isolation
  ebursztein
  committed
  d2afd3a
- security(config): replace unsafe YAML parser
  ebursztein
  committed
  911e013
- docs(security): document strict Sigma parsing
  ebursztein
  committed
  e041889
- chore(deps): accept safe YAML parser graph
  ebursztein
  committed
  344a8d7
- test(proxy): bank coverage gain
  ebursztein
  committed
  241ed37
- fix(proxy): preserve traffic capacity under churn
  ebursztein
  committed
  11ad870
- perf(logger): pipeline commitment admission
  ebursztein
  committed
  9fd8780
- perf(logger): reuse commitment event encoding
  ebursztein
  committed
  666a539
- fix(service): keep proxy alive after capacity rejection
  ebursztein
  committed
  4d1a1d7
- security(foundation): contain guest timestamp updates
  ebursztein
  committed
  e0c82c0
- security(proto): broker guest timestamp updates
  ebursztein
  committed
  6c187fe
- security(core): broker guest timestamp mutations
  ebursztein
  committed
  b7fdada
- security(service): broker guest timestamp updates
  ebursztein
  committed
  31c7ecc
- test(citadel): lower Unix boundary debt
  ebursztein
  committed
  12336f6
- docs(changelog): record worker reliability fixes
  ebursztein
  committed
  3fa967a
- docs(architecture): explain brokered guest metadata
  ebursztein
  committed
  bd2dd48
- refactor(proto): split guest metadata codec
  ebursztein
  committed
  a17ffa0
- test(core): split VirtioFS metadata coverage
  ebursztein
  committed
  fc4dc62
- test(citadel): lower VirtioFS shape debt
  ebursztein
  committed
  bf1bca1
- test(foundation): contain coverage profiles
  ebursztein
  committed
  0734bf7
- test(service): contain coverage profiles
  ebursztein
  committed
  b394eac
- test(gate): ratchet proxy coverage
  ebursztein
  committed
  37d83a4
- test(bench): ratchet the complete VM startup
  ebursztein
  committed
  f372ffc
- perf(service): aggregate gateway status reads
  ebursztein
  committed
  ea2e037
- perf(gateway): fetch one status snapshot
  ebursztein
  committed
  a1cde93
- chore(gate): reconcile merged release inventories
  ebursztein
  committed
  d6e3df2
- chore(api): approve internal gateway snapshot
  ebursztein
  committed
  16acf1a
- feat(telemetry): define shared cache metrics
  ebursztein
  committed
  abed1f1
- feat(cache): centralize observable cache mechanics
  ebursztein
  committed
  4b1f9e8
- fix(bench): resolve seeded route templates
  ebursztein
  committed
  a1aa35a
- feat(cache): add keyed identity storage
  ebursztein
  committed
  ce485e9
- perf(service): unify polled route caches
  ebursztein
  committed
  39cfb7f
- feat(cache): support domain freshness predicates
  ebursztein
  committed
  1085db7
- perf(core): unify bounded network caches
  ebursztein
  committed
  6a7fc74
- fix(bench): compare repeated benchmark runs
  ebursztein
  committed
  9833c71
- fix(bench): expose slow asset rebuilds
  ebursztein
  committed
  671e3d9
- feat(cache): expose metrics for domain caches
  ebursztein
  committed
  c34c285
- perf(logger): share bounded query cache
  ebursztein
  committed
  d971fb8
- perf(service): observe image catalog cache
  ebursztein
  committed
  0d8b21a
- test(citadel): keep one cache authority
  ebursztein
  committed
  d420b8b
- docs(architecture): define runtime cache ownership
  ebursztein
  committed
  5a47725
- perf(cache): reuse registered metric handles
  ebursztein
  committed
  adad955
- feat(bench): measure concurrent route RPS
  ebursztein
  committed
  bcdd855
- docs(benchmark): define route RPS coverage
  ebursztein
  committed
  665c0a3
- fix(test): make seeded body archive private
  ebursztein
  committed
  056b98a
- fix(test): secure seeded ledger files
  ebursztein
  committed
  45a219d
- fix(test): secure seeded body generations
  ebursztein
  committed
  778e19e
- fix(bench): isolate route status assets
  ebursztein
  committed
  684ef2b
- perf(cache): keep resident loads on read path
  ebursztein
  committed
  6f98d9a
- fix(bench): compare throughput in the right direction
  ebursztein
  committed
  cf61840
- fix(bench): reject partial load failures
  ebursztein
  committed
  2ead85e
- fix(proxy): sustain supported HTTP concurrency
  ebursztein
  committed
  962cd0b
- feat(proto): share bounded DNS session capacity
  ebursztein
  committed
  755c0c6
- refactor(core): use shared DNS session bound
  ebursztein
  committed
  eecac2d
- fix(agent): sustain dual-stack DNS bursts
  ebursztein
  committed
  26eb4e2
- docs(benchmark): require zero-error load runs
  ebursztein
  committed
  8aaedfb
- refactor(core): import shared DNS session bound
  ebursztein
  committed
  66dfe21
- docs(proto): keep DNS session contract concise
  ebursztein
  committed
  f09f838
- test(bench): resolve benchmark helpers safely
  ebursztein
  committed
  2d2adeb
- chore(gate): record cache and benchmark surfaces
  ebursztein
  committed
  60d124e
- docs(service): avoid stale path wording
  ebursztein
  committed
  559f204
- feat(bench): measure managed lifecycle RPS
  ebursztein
  committed
  236e84c
- refactor(bench): keep route collector bounded
  ebursztein
  committed
  d790196
- fix(ci): cover shared infrastructure crates
  ebursztein
  committed
  23ae846
- test(docs): record cache architecture page
  ebursztein
  committed
  75bf6eb
- test(release): follow shared crypto ownership
  ebursztein
  committed
  5b27037
- test(sdkgen): generate contract-valid string samples
  ebursztein
  committed
  ecbdb38
- fix(build): preserve dependency-minimal crypto consumers
  ebursztein
  committed
  c5e7f70
- test(build): reconcile shared ownership inventories
  ebursztein
  committed
  941d1b0
- fix(build): type lazy digest bindings
  ebursztein
  committed
  3b24dae
- fix(gate): exclude qualification artifacts from build contexts
  ebursztein
  committed
  2c4401a
- test(gate): ratchet measured crate coverage
  ebursztein
  committed
  cb85c60
- test(sdk): preserve shared crypto ownership
  ebursztein
  committed
  2f6c23c
- feat(bench): measure load resource pressure
  ebursztein
  committed
  9efa102
- fix(bench): retain pressure evidence on load failure
  ebursztein
  committed
  e8a9ff5
- fix(bench): report pressure on guest load failure
  ebursztein
  committed
  b414f8b
- refactor(proto): share upstream grant capacity
  ebursztein
  committed
  b4b86dc
- refactor(proxy): use shared grant capacity
  ebursztein
  committed
  0b9cf8f
- fix(service): sustain brokered network bursts
  ebursztein
  committed
  2446a12
- fix(core): preserve upstream denial cause
  ebursztein
  committed
  d030680
- perf(proto): support 512 network clients
  ebursztein
  committed
  e0377be
- test(agent): prove 512-client DNS burst
  ebursztein
  committed
  6b486e9
- test(service): prove 512-client resolve burst
  ebursztein
  committed
  fe1a8f3
- style(agent): format DNS burst assertion
  ebursztein
  committed
  b8ae9c9
- refactor(proto): generate runtime limits from config
  ebursztein
  committed
  bcf0a8e
- docs(skills): centralize runtime limit guidance
  ebursztein
  committed
  cedb958
- test(citadel): keep runtime limits config-owned
  ebursztein
  committed
  6240c4a
- perf(bench): drive HTTP load without guest threads
  ebursztein
  committed
  eccb998
- fix(bench): reject starved MITM load runs
  ebursztein
  committed
  dc33bdc
- feat(bench): measure proportional process memory
  ebursztein
  committed
  64f0f01
- docs(bench): require async load and proportional memory
  ebursztein
  committed
  2b191d6
- feat(proto): define network descriptor budget
  ebursztein
  committed
  110114b
- feat(foundation): enforce process descriptor floors
  ebursztein
  committed
  1ef971c
- fix(agent): sustain 512 relayed connections
  ebursztein
  committed
  e6da6f2
- test(citadel): bind descriptor budget to client cap
  ebursztein
  committed
  9f66cc4
- refactor(proto): derive descriptor budget from client cap
  ebursztein
  committed
  cb51e7b
- fix(proto): preserve connection replacement capacity
  ebursztein
  committed
  a685dc2
- fix(proxy): raise the host descriptor floor
  ebursztein
  committed
  eda7f94
- fix(process): raise the relay descriptor floor
  ebursztein
  committed
  6d0ffcd
- fix(service): raise the broker descriptor floor
  ebursztein
  committed
  530cc6b
- test(citadel): require descriptor floors on the relay path
  ebursztein
  committed
  77dc1f0
- test(proxy): derive replacement overlap from config
  ebursztein
  committed
  45e50f6
- docs(skills): preserve network limit relationships
  ebursztein
  committed
  4287582
- style(proto): retain the source boundary
  ebursztein
  committed
  30caa17
- fix(bench): reject retried proxy refusals
  ebursztein
  committed
  57a1fb2
- fix(proto): cover pooled connection lifecycle
  ebursztein
  committed
  a9d139f
- test(proxy): cover every pooled connection phase
  ebursztein
  committed
  71d2a8a
- docs(skills): model pooled connection phases
  ebursztein
  committed
  dea965f
- fix(bench): bind load clients to keepalive connections
  ebursztein
  committed
  707b741
- docs(skills): bind load clients to keepalive connections
  ebursztein
  committed
  b81431d
- fix(bench): reuse logical DNS load sockets
  ebursztein
  committed
  f9439e3
- docs(skills): require persistent DNS load clients
  ebursztein
  committed
  cf6b7f3
- refactor(process): extract aggregator lifecycle
  ebursztein
  committed
  8cb5219
- feat(proto): bound ledger admission batches
  ebursztein
  committed
  7c11bb3
- feat(service): reserve ledger commitments in batches
  ebursztein
  committed
  3e43356
- perf(proto): bound ledger coalescing delay
  ebursztein
  committed
  666c01e
- perf(logger): coalesce remote ledger admissions
  ebursztein
  committed
  ffb64e0
- refactor(process): use shared ledger queue limit
  ebursztein
  committed
  596b0b1
- refactor(proxy): use shared ledger queue limit
  ebursztein
  committed
  5d5f531
- test(citadel): guard ledger runtime limits
  ebursztein
  committed
  358676d
- docs(skills): centralize ledger load limits
  ebursztein
  committed
  27cd01c
- fix(bench): expose configured DNS load ceiling
  ebursztein
  committed
  f9e2fcc
- fix(bench): derive DNS curve from runtime limit
  ebursztein
  committed
  892d314
- test(citadel): guard DNS load capacity source
  ebursztein
  committed
  1cb9cf0
- perf(proto): absorb ledger flush overlap
  ebursztein
  committed
  46ced55
- perf(logger): use shared producer queue capacity
  ebursztein
  committed
  db842e9
- test(citadel): guard ledger owner queue capacity
  ebursztein
  committed
  d9bf155
- perf(logger): preserve admission batches through SQLite
  ebursztein
  committed
  b4823ba
- docs(config): explain ledger event budget
  ebursztein
  committed
  d0b41c2
- test(citadel): guard ledger batch authority
  ebursztein
  committed
  a964887
- perf(proto): bound ledger disk flush interval
  ebursztein
  committed
  2431bf1
- perf(logger): keep periodic flush below admission deadline
  ebursztein
  committed
  8163204
- feat(bench): expose ledger flush limits
  ebursztein
  committed
  f626708
- test(citadel): guard ledger flush limits
  ebursztein
  committed
  2a1f07a
- perf(logger): expose slow disk flushes
  ebursztein
  committed
  1ef432c
- perf(logger): split slow flush phase timing
  ebursztein
  committed
  fd20fbe
- perf(logger): keep telemetry off live flushes
  ebursztein
  committed
  8252f3e
- feat(archive): expose independent durability handle
  ebursztein
  committed
  7738e0f
- perf(logger): move archive sync off admission path
  ebursztein
  committed
  27c8db7
- perf(build): optimize ledger sqlite in dev
  ebursztein
  committed
  13167b7
- test(bench): preserve failed load measurements
  ebursztein
  committed
  1d6ca6c
- test(bench): retain rejected load evidence
  ebursztein
  committed
  b9d1029
- perf(logger): batch archive index writes
  ebursztein
  committed
  1b2e0d1
- test(bench): attribute ledger resource pressure
  ebursztein
  committed
  2d9a80d
- fix(logger): bound producer queues by events
  ebursztein
  committed
  0c3a57b
- security(core): preserve supplemental ledger admission
  ebursztein
  committed
  aa9c723
- feat(proto): centralize DNS and ledger capacity limits
  ebursztein
  committed
  9403ff6
- feat(foundation): size datagram receive buffers
  ebursztein
  committed
  948b979
- fix(agent): absorb supported DNS bursts
  ebursztein
  committed
  496a48c
- refactor(core): split security event engine
  ebursztein
  committed
  7fa2325
- perf(logger): bound archive publication memory
  ebursztein
  committed
  866179f
- feat(bench): collect raw guest protocol samples
  ebursztein
  committed
  5957186
- test(bench): measure model and MCP VM pressure
  ebursztein
  committed
  ef54dce
- test(bench): drive load rails to configured capacity
  ebursztein
  committed
  a2498ee
- feat(bench): register multi-VM MITM scaling
  ebursztein
  committed
  2934848
- feat(bench): measure multi-VM MITM scaling
  ebursztein
  committed
  97d1456
- feat(bench): expose MITM fixture pressure
  ebursztein
  committed
  a87034a
- fix(bench): isolate MITM fanout cohorts
  ebursztein
  committed
  b40ac4c
- feat(bench): extend MITM scale to host saturation
  ebursztein
  committed
  97cad89
- docs(skills): codify multi-VM capacity proof
  ebursztein
  committed
  f165d51
- test(citadel): require one runtime cache authority
  ebursztein
  committed
  4bac11d
- feat(proto): centralize runtime cache limits
  ebursztein
  committed
  d398591
- refactor(core): use shared runtime cache limits
  ebursztein
  committed
  b057017
- refactor(logger): use shared runtime cache limits
  ebursztein
  committed
  371ce50
- refactor(service): use shared runtime cache limits
  ebursztein
  committed
  a5f8c2c
- refactor(cli): use shared update cache lifetime
  ebursztein
  committed
  ab1a52b
- feat(bench): report runtime cache limits
  ebursztein
  committed
  83cefbb
- test(citadel): guard runtime cache consumers
  ebursztein
  committed
  3de43e1
- docs(skills): enforce runtime cache authority
  ebursztein
  committed
  71d94fa
- docs(architecture): explain runtime capacity and scaling
  ebursztein
  committed
  675aca1
- style(gate): iterate MITM fanout pairs
  ebursztein
  committed
  f82051e
- fix(bench): classify MCP load failures
  ebursztein
  committed
  7146f23
- test(citadel): merge runtime cache wiring guard
  ebursztein
  committed
  ea8b0c9
- style(citadel): match gate import order
  ebursztein
  committed
  32692dd
- fix(proto): preserve shared build cache paths
  ebursztein
  committed
  e12dc65
- test(bench): keep new load helpers type safe
  ebursztein
  committed
  8aac384
- test(citadel): own benchmark helper sources
  ebursztein
  committed
  24bd567
- chore(gate): reconcile exact source identities
  ebursztein
  committed
  2a3ec41
- test(proxy): enforce capacity invariant at compile time
  ebursztein
  committed
  748b90a
- perf(service): release commitment locks promptly
  ebursztein
  committed
  e292cbc
- fix(foundation): drain unrelated watch events
  ebursztein
  committed
  ba38f9f
- test(core): retain coverage output for owner child
  ebursztein
  committed
  6f3a924
- test(service): preserve failures through owned child exit
  ebursztein
  committed
  46a45cf
- test(service): retain recovery child coverage output
  ebursztein
  committed
  b932a57
- test(foundation): retain scope child coverage output
  ebursztein
  committed
  6442187
- test(service): retain retirement child coverage output
  ebursztein
  committed
  2df4c20
- test(service): stop fixtures own their child exits
  ebursztein
  committed
  e0b41ac
- test(gate): ratchet improved Rust coverage
  ebursztein
  committed
  b7d2914
- fix(oci): bootstrap direct fixture launcher
  ebursztein
  committed
  c773c99
- fix(gate): forget retired artifact digests
  ebursztein
  committed
  bfdd068
- fix(oci): authenticate private GHCR fixture pulls
  ebursztein
  committed
  f33ae27
- style(oci): preserve launcher import ordering
  ebursztein
  committed
  79a9b5a
- test(oci): type private registry fixture
  ebursztein
  committed
  8a9a0e7
- test(gate): clear core coverage headroom
  ebursztein
  committed
  6412c2a
- fix(gate): recognize mirrored architecture products
  ebursztein
  committed
  b0cf283
- fix(cache): retain pinned fixture matrix
  ebursztein
  committed
  f6d55e8
- test(oci): refresh qualified amd64 fixtures
  ebursztein
  committed
  3d10dde
- test(gateway): track consolidated status contract
  ebursztein
  committed
  79f647b
- style(gateway): satisfy strict fixture lint
  ebursztein
  committed
  3db7266
- test(ironbank): drain exact ledger fixtures
  ebursztein
  committed
  2565e1b
- test(ironbank): centralize ledger drain barrier
  ebursztein
  committed
  65e9a33
- security(deps): update rustls for October advisories
  ebursztein
  committed
  e85ffcc
- test(ironbank): type model ledger client
  ebursztein
  committed
  d1f988c
- test(ironbank): retry live archive payload reads
  ebursztein
  committed
  ec000fd
- merge(0.7): preserve reconciled worker, credential and benchmark contracts
  ebursztein
  committed
  8a09011
- fix(logger): reject incomplete schema at flush boundaries
  ebursztein
  committed
  d581703
- refactor(logger): validate empty tables without aggregate SQL
  ebursztein
  committed
  8e1efc2
- chore(qualification): reconcile merged source inventories and lint
  ebursztein
  committed
  f8ab01a
- fix(gate): bind restart proof to runtime and reuse SDK preparation
  ebursztein
  committed
  c4bd494
- test(api): align proxy leases with the 0.7 contract version
  ebursztein
  committed
  cdb8154
- test(gate): compare execution identity and declared phases
  ebursztein
  committed
  558361c
- merge(assets): integrate OCI cache lease fix for 0.7 (#352)
  ebursztein
  committed
  8c87203

Commits

Commits on Oct 14, 2026