Kronecker
ebe71db564
fix(delivery): align postgres recovery runtime checks
2026-10-20 06:42:10 +08:00
Kronecker
0a27704fd4
fix(delivery): use installed postgres identity for recovery
2026-10-20 05:31:34 +08:00
Kronecker
ee9ebd6d24
perf(delivery): bound copy I/O and streamline metadata scans
2026-10-20 03:51:01 +08:00
Kronecker
02c1dadf67
perf(delivery): reduce verified installation and recovery I/O
2026-10-20 01:46:18 +08:00
Kronecker
95a6b0dc1e
perf(delivery): verify restored files before cache eviction
2026-10-19 23:28:25 +08:00
Kronecker
ecce953fbb
fix(delivery): validate the recovery broker as read-only
2026-10-19 22:19:15 +08:00
Kronecker
6071994695
fix(frontend): handle session 401 before reading error bodies
2026-10-19 04:51:56 +08:00
Kronecker
3b8d9a2e71
fix(release): close admission after maintenance helper failure
2026-10-18 23:03:10 +08:00
Kronecker
c60ccf6858
perf(sandbox): limit javac to the first JIT tier
...
Keep the short-lived compiler VM on the first JIT tier while preserving student runtime options and every resource budget. The closed profile validator rejects removed or overridden compiler tier options.
Validation: make contracts; make check. Actual isolated VM reacceptance remains pending.
2026-10-18 17:18:55 +08:00
Kronecker
d30043b99b
fix(release): keep backup and restore mounts private
2026-10-18 04:17:32 +08:00
Kronecker
75f781ee87
chore(delivery): pin Node.js 26.11.1
2026-10-17 17:35:03 +08:00
Kronecker
b181ca6bd6
fix(delivery): preserve established language resource budgets
2026-10-17 17:19:33 +08:00
Kronecker
09266df638
fix(delivery): enable I/O accounting for node observation
2026-10-16 18:11:50 +08:00
Kronecker
2cae75920d
fix(release): honor factory preparation startup deadline
2026-10-16 13:38:49 +08:00
Kronecker
e159576340
fix(delivery): align readiness with local database authority
2026-10-16 00:35:04 +08:00
Kronecker
721c293382
fix(delivery): fit bounded health probes into startup budgets
2026-10-15 21:50:57 +08:00
Kronecker
04e5fac311
perf(release): isolate read-only helper startup dependencies
2026-10-15 18:44:47 +08:00
Kronecker
1bd1746ef2
fix: allow bounded Erlang JIT file mappings in broker checks
2026-10-15 06:54:32 +08:00
Kronecker
72828c06e6
fix: budget health checks for bounded interpreter startup
2026-10-15 06:33:13 +08:00
Kronecker
b1e2c5a948
refactor: isolate read-only operator projections
2026-10-15 03:34:12 +08:00
Kronecker
cd9f2e17f7
fix: identify failed broker metadata queries
2026-10-15 02:05:09 +08:00
Kronecker
41d0e3d195
fix: close readiness before querying unavailable services
2026-10-14 22:02:31 +08:00
Kronecker
2023ca5de9
ci: run trusted engineering checks on GitHub
2026-10-14 21:07:13 +08:00
Kronecker
d3ef4f03aa
fix(proxy): preserve security headers across cache locations
2026-10-14 15:02:55 +08:00
Kronecker
f269a39bbe
fix(proxy): use a valid local syslog tag
2026-10-14 13:04:13 +08:00
Kronecker
c7b260adc2
fix(proxy): send bounded access records through namespace syslog
2026-10-14 10:21:39 +08:00
Kronecker
e742c3543d
docs(release): organize installation and operator guides by task
2026-10-14 10:14:35 +08:00
Kronecker
16bcce3f04
perf(release): bind proxy startup without loading judging policy
2026-10-14 09:23:15 +08:00
Kronecker
83d3bf8309
fix(release): confine all proxy temporary paths to bounded storage
2026-10-14 08:21:52 +08:00
Kronecker
ef0ea71d0a
perf(release): bound proxy startup to protected live configuration
2026-10-14 07:30:51 +08:00
Kronecker
f39a051d9f
fix(release): bind external postgres identity mapping file
2026-10-14 04:28:58 +08:00
Kronecker
5ff88047ff
fix(release): validate service-only systemd credential ACLs
2026-10-14 03:54:07 +08:00
Kronecker
be22dd9c12
fix(release): preserve initializer failure after verified cleanup
2026-10-14 02:58:22 +08:00
Kronecker
11a2b6643e
perf(release): verify selected service receipt once
2026-10-14 02:16:58 +08:00
Kronecker
d5cb46278d
fix(release): set new file permissions before durable sync
2026-10-14 01:16:19 +08:00
Kronecker
81c674a17e
perf(release): hash frozen bytes at complete destination readback
2026-10-14 00:10:41 +08:00
Kronecker
dbacbddf64
perf(release): reuse verified activation binding
2026-10-13 22:39:03 +08:00
Kronecker
11bfb3ff6f
perf(release): verify copied trees once per batch
2026-10-13 20:48:59 +08:00
Kronecker
a9b59e127f
fix(release): require a reachable system message bus
2026-10-13 20:12:07 +08:00
Kronecker
e95a25892f
perf(release): avoid redundant installation hashing
2026-10-13 19:31:43 +08:00
Kronecker
52adb7eab9
fix(release): honor layout modes under private umask
2026-10-13 16:53:05 +08:00
Kronecker
f5f99c9cae
fix(api): bound transient dependency failure responses
2026-10-13 12:01:30 +08:00
Kronecker
70f4c78905
feat(ops): add bounded owner and kernel observations
2026-10-13 11:32:57 +08:00
Kronecker
2e201ed7fb
feat(recovery): rotate database identities before reopening admission
2026-10-13 10:08:58 +08:00
Kronecker
13c548454b
feat(recovery): restore cold data with fresh runtime identities
2026-10-13 09:33:21 +08:00
Kronecker
b575462c95
fix(maintenance): continue confirmed drain before stopping dependencies
2026-10-13 08:49:23 +08:00
Kronecker
110a4952a8
feat(backup): enforce explicit expiry pruning and bounded verification
2026-10-13 08:45:55 +08:00
Kronecker
4f2513c93f
feat(backup): capture private cold snapshots with reference verification
2026-10-13 08:39:45 +08:00
Kronecker
9b3e49c909
fix(proxy): expose bounded process liveness for TLS readiness
2026-10-13 07:11:29 +08:00
Kronecker
8e6133a8d0
feat(release): install and supervise the bounded HTTPS entry
2026-10-13 06:36:14 +08:00
Kronecker
83e235567f
feat(release): bind services to isolated journal readiness
2026-10-13 06:09:49 +08:00
Kronecker
57f5819dfd
fix(release): close admission when maintenance confirmation fails
2026-10-13 05:56:12 +08:00
Kronecker
bb14f2616b
fix(logging): redact production diagnostics and disable API access logs
2026-10-13 05:36:59 +08:00
Kronecker
ad7eebee54
feat(release): add isolated journal profile installation
2026-10-13 05:25:10 +08:00
Kronecker
325ed08ed2
feat(release): add fail-closed admission and bounded service draining
2026-10-13 05:06:24 +08:00
Kronecker
71918399c9
feat(delivery): observe bounded node readiness and owner state
2026-10-13 04:11:58 +08:00
Kronecker
e94b6fc8ef
feat(delivery): initialize PostgreSQL in a bounded ordinary unit
2026-10-13 03:15:17 +08:00
Kronecker
fd1ad64692
feat(delivery): install bounded dependency configuration snapshots
2026-10-13 03:04:01 +08:00
Kronecker
480db0e74f
feat(delivery): compose bounded local database and broker services
2026-10-13 02:49:19 +08:00
Kronecker
40b9a69e5a
feat(delivery): install protected factory service snapshots
2026-10-13 02:33:43 +08:00
Kronecker
3a9d5e47d4
feat(sandbox): prepare protected single-node factory delegation
2026-10-13 02:10:11 +08:00
Kronecker
033d31d420
feat(sandbox): retain replay records across explicit factory cycles
2026-10-13 01:36:36 +08:00
Kronecker
a55de23fd6
feat(delivery): install versioned ordinary service units
2026-10-13 00:47:22 +08:00
Kronecker
743d6ef429
fix(delivery): verify ordinary service launch boundaries
2026-10-13 00:18:47 +08:00
Kronecker
5c7146d245
feat: compose bounded ordinary service units with private credentials
2026-10-12 23:56:59 +08:00
Kronecker
09af862957
fix: inherit scoped function ownership for Alembic migrations
2026-10-12 23:06:38 +08:00
Kronecker
5061084d4c
feat: preserve immutable configuration batches for controlled rotation
2026-10-12 22:45:21 +08:00
Kronecker
fdc4446206
feat: add bounded HTTPS proxy composition interface
2026-10-12 22:30:09 +08:00
Kronecker
68b5f36c9b
fix(delivery): share one node budget across services and tasks
2026-10-12 21:50:10 +08:00
Kronecker
474406702f
fix(delivery): apply role membership options explicitly
2026-10-12 21:31:19 +08:00
Kronecker
7145fb3fa4
fix(delivery): derive installation reserve from verified inventory
2026-10-12 20:50:11 +08:00
Kronecker
3cde198358
feat(delivery): add guarded offline installation and node configuration
2026-10-12 20:44:40 +08:00
Kronecker
5d127ad4db
fix(delivery): exclude wheel development header records
2026-10-12 16:05:15 +08:00
Kronecker
53f9e55fd8
fix(delivery): bind dependency records to shipped files
2026-10-12 16:01:41 +08:00
Kronecker
eef732e2ad
fix(delivery): keep server-only plugins outside application runtime
2026-10-12 15:47:03 +08:00
Kronecker
e34ad78329
fix(delivery): include verified base runtime library closure
2026-10-12 15:39:36 +08:00
Kronecker
4b02cb2c84
fix(delivery): resolve verified library aliases inside guest inputs
2026-10-12 15:31:35 +08:00
Kronecker
41c3334568
fix(delivery): resolve build workspace paths before invoking tools
2026-10-12 15:19:09 +08:00
Kronecker
6733d4e435
feat(delivery): add bounded offline release tooling
2026-10-12 15:15:00 +08:00
Kronecker
f576756359
test(admin): isolate import recovery acceptance from candidate checks
2026-10-12 05:05:00 +08:00
Kronecker
445affb63d
test(admin): verify cross-process import admission and recovery
2026-10-12 04:01:51 +08:00
Kronecker
3536ef1fbb
test(admin): preserve baseline data through maintenance migrations
2026-10-12 03:48:26 +08:00
Kronecker
676781223d
test(admin): verify bounded archive and private storage refusals
2026-10-12 03:28:41 +08:00
Kronecker
2f860a17c9
docs(admin): document bounded problem maintenance operations
2026-10-12 03:15:51 +08:00
Kronecker
835df6b7e7
feat(admin): connect authenticated problem maintenance console
2026-10-12 02:33:15 +08:00
Kronecker
5366418881
feat(problems): publish immutable candidates with audited maintenance
2026-10-11 23:29:21 +08:00
Kronecker
3152d59056
feat(problems): add bounded administrator package imports
...
Use live maintenance sessions, durable capacity reservations and streamed SHA-bound ZIP uploads. An ordinary capped import worker validates stored/deflated v1/v2 packages, persists immutable unpublished candidates and finite audit events, and recovers or releases capacity after interruption and expiry.
Validate actual PG/HTTP/worker/storage fault paths in an isolated capped VM (2 passed, 0 skipped), reuse unchanged actual migration roundtrip evidence, and pass affected backend/architecture checks plus the prior full engineering checks.
2026-10-11 22:19:38 +08:00
Kronecker
234ab23155
feat(identity): protect administrator bootstrap and recovery
2026-10-11 19:22:55 +08:00
Kronecker
a7b2324a3e
feat(identity): expose live maintenance capabilities and transaction authorization
2026-10-11 12:31:08 +08:00
Kronecker
3ed5b72459
feat(identity): persist administrator authority with scoped database roles
2026-10-11 12:20:10 +08:00
Kronecker
8143a7f665
fix(frontend): adapt submission summaries to workbench width
2026-10-11 11:17:06 +08:00
Kronecker
08f2db616f
fix(frontend): separate submission time and version link
2026-10-11 11:10:46 +08:00
Kronecker
c8cac766c7
test(submissions): verify exact performance cohort boundaries
2026-10-11 07:45:56 +08:00
Kronecker
bc5cd12056
feat(frontend): share real submission details and performance in workbench
2026-10-11 03:55:23 +08:00
Kronecker
218fa38f8e
feat(submissions): query bounded anonymous performance snapshots
2026-10-11 03:51:33 +08:00
Kronecker
fce7522267
feat(submissions): bind final performance to trusted measurement epochs
2026-10-11 03:46:16 +08:00
Kronecker
3cc90e4573
feat(submissions): define bounded performance and scoped history contracts
2026-10-11 03:35:12 +08:00
Kronecker
5df3c370aa
docs(frontend): document managed language submission
2026-10-10 04:09:41 +08:00
Kronecker
029585739c
fix(worker): bound configurable control request deadlines
2026-10-10 02:15:52 +08:00
Kronecker
47f535ea79
docs(frontend): clarify connected judging services
2026-10-10 00:24:08 +08:00
Kronecker