Kronecker
c60ccf6858
perf(sandbox): limit javac to the first JIT tier
...
Keep the short-lived compiler VM on the first JIT tier while preserving student runtime options and every resource budget. The closed profile validator rejects removed or overridden compiler tier options.
Validation: make contracts; make check. Actual isolated VM reacceptance remains pending.
2026-10-18 17:18:55 +08:00
Kronecker
325ed08ed2
feat(release): add fail-closed admission and bounded service draining
2026-10-13 05:06:24 +08:00
Kronecker
71918399c9
feat(delivery): observe bounded node readiness and owner state
2026-10-13 04:11:58 +08:00
Kronecker
3a9d5e47d4
feat(sandbox): prepare protected single-node factory delegation
2026-10-13 02:10:11 +08:00
Kronecker
033d31d420
feat(sandbox): retain replay records across explicit factory cycles
2026-10-13 01:36:36 +08:00
Kronecker
c8cac766c7
test(submissions): verify exact performance cohort boundaries
2026-10-11 07:45:56 +08:00
Kronecker
fce7522267
feat(submissions): bind final performance to trusted measurement epochs
2026-10-11 03:46:16 +08:00
Kronecker
029585739c
fix(worker): bound configurable control request deadlines
2026-10-10 02:15:52 +08:00
Kronecker
67c3bc55ba
chore(judge): document explicit managed runtime rollout
2026-10-09 23:29:23 +08:00
Kronecker
d20721313e
test(judge): verify managed worker faults and sealed programs
2026-10-09 22:49:57 +08:00
Kronecker
643a8d342e
fix(judge): bind managed inputs and confirm artifact cleanup
2026-10-09 21:45:21 +08:00
Kronecker
802e019699
feat(worker): judge versioned sealed runtime programs
2026-10-09 20:15:17 +08:00
Kronecker
2f1166954a
feat(sandbox): route pinned runtimes through one bounded factory
2026-10-09 18:50:10 +08:00
Kronecker
38ee332a3e
test(sandbox): verify managed file quotas and live wall deadlines
2026-10-09 18:12:37 +08:00
Kronecker
9394a914f8
feat(sandbox): bind managed requests to pinned runtime identities
2026-10-09 17:49:30 +08:00
Kronecker
1dd6d1f971
feat(sandbox): add immutable Python and Java execution profiles
2026-10-09 17:02:27 +08:00
Kronecker
53caafc157
feat(coordinator): dispatch versioned runtime leases and reports
2026-10-09 15:18:08 +08:00
Kronecker
4b8f255180
feat(judging): persist immutable per-language problem configurations
2026-10-09 14:53:09 +08:00
Kronecker
a5a7e40308
feat(contracts): add versioned multi-runtime judging contracts
2026-10-09 14:15:24 +08:00
Kronecker
19a071573b
feat(worker): consume durable jobs with fenced execution and recovery
2026-10-09 08:38:20 +08:00
Kronecker
76b565cce8
fix(contracts): reject unfulfillable output capture budgets
2026-10-09 08:25:39 +08:00
Kronecker
f838008c71
feat(coordinator): persist fenced execution authority and atomic results
2026-10-09 07:15:24 +08:00
Kronecker
8a01081cc9
feat(judge): compile once and run isolated points through helper factory
2026-10-09 04:12:22 +08:00
Kronecker
93fb41c608
feat(engine): judge immutable submissions through bounded execution ports
2026-10-09 03:34:04 +08:00
Kronecker
996dbc5144
feat(problems): publish immutable versions and fence artifact access
2026-10-09 01:51:13 +08:00
Kronecker
df52446dac
feat(contracts): validate fenced judging jobs and bounded results
2026-10-09 00:43:17 +08:00
Kronecker
ea0bc2b578
feat(worker): inject engine port for authenticated sandbox execution
2026-10-08 17:28:26 +08:00
Kronecker
ee6371f269
feat(sandbox): enable verified ordinary execution entry
2026-10-08 17:00:13 +08:00
Kronecker
fc61e9d053
test(sandbox): verify repeated restart and failed capture lifecycle
2026-10-08 13:52:01 +08:00
Kronecker
32d94f3a66
feat(sandbox): recover service-owned tasks after supervisor restart
2026-10-08 13:46:02 +08:00
Kronecker
22cc427da9
test(sandbox): validate full isolation against live peer tasks
2026-10-08 10:27:32 +08:00
Kronecker
ddf1e0ca68
test(sandbox): verify complete user filesystem and descriptor boundaries
2026-10-08 10:12:49 +08:00
Kronecker
b5db44ba16
feat(sandbox): enforce trusted process event budgets and verify resource limits
2026-10-08 07:19:01 +08:00
Kronecker
057c02f39d
test(sandbox): verify complete native and compiler task workflows
2026-10-08 07:12:11 +08:00
Kronecker
f9789ea4c4
fix(sandbox): unwind every prepared owner before releasing resources
2026-10-08 04:49:02 +08:00
Kronecker
2e4d9d4ea2
feat(sandbox): supervise bounded root execution and final teardown
2026-10-08 04:38:08 +08:00
Kronecker
62b08fea5b
feat(sandbox): apply finite inherited resource limits before identity
2026-10-08 01:37:06 +08:00
Kronecker
4c7adda719
feat(sandbox): supervise aggregate CPU and monotonic wall budgets
2026-10-08 01:24:56 +08:00
Kronecker
cc6ee1bfa7
feat(sandbox): transport bounded stdio and close inherited user descriptors
2026-10-07 22:49:25 +08:00
Kronecker
89da9ffd9f
feat(sandbox): reap namespace descendants and cancel via init lifecycle
2026-10-07 22:28:13 +08:00
Kronecker
03eaab719e
feat(sandbox): restrict dangerous syscalls and verify GNU language profiles
2026-10-07 19:31:24 +08:00
Kronecker
9bb27f2e02
feat(sandbox): install profile seccomp with ABI and inheritance checks
2026-10-07 19:16:20 +08:00
Kronecker
46714bd9ea
feat(sandbox): lease task identities and drop initialization privileges
2026-10-07 18:22:58 +08:00
Kronecker
329c9222a3
feat(sandbox): bind readonly inputs through authenticated capabilities
2026-10-07 17:57:10 +08:00
Kronecker
9a2b1c071f
feat(sandbox): snapshot artifacts through bounded file capabilities
2026-10-07 16:19:05 +08:00
Kronecker
2b5e79dd39
feat(sandbox): restrict proc and devices in private roots
2026-10-07 13:21:37 +08:00
Kronecker
0f68eb5fb0
feat(sandbox): build private read-only roots with pivot_root
2026-10-07 10:02:21 +08:00
Kronecker
f22308080f
feat(sandbox): initialize isolated namespaces through gated helpers
2026-10-07 04:16:11 +08:00
Kronecker
1a91c2e0f6
feat(sandbox): gate target startup with verified task cgroups
2026-10-07 01:40:32 +08:00
Kronecker
605785edee
test(sandbox): allow launcher checks in independent VMs
2026-10-07 01:09:50 +08:00
Kronecker