 Kronecker
|
fc61e9d053
|
test(sandbox): verify repeated restart and failed capture lifecycle
|
2026-10-08 13:52:01 +08:00 |
|
|
Kronecker
|
32d94f3a66
|
feat(sandbox): recover service-owned tasks after supervisor restart
|
2026-10-08 13:46:02 +08:00 |
|
|
Kronecker
|
22cc427da9
|
test(sandbox): validate full isolation against live peer tasks
|
2026-10-08 10:27:32 +08:00 |
|
|
Kronecker
|
ddf1e0ca68
|
test(sandbox): verify complete user filesystem and descriptor boundaries
|
2026-10-08 10:12:49 +08:00 |
|
|
Kronecker
|
b5db44ba16
|
feat(sandbox): enforce trusted process event budgets and verify resource limits
|
2026-10-08 07:19:01 +08:00 |
|
|
Kronecker
|
057c02f39d
|
test(sandbox): verify complete native and compiler task workflows
|
2026-10-08 07:12:11 +08:00 |
|
|
Kronecker
|
f9789ea4c4
|
fix(sandbox): unwind every prepared owner before releasing resources
|
2026-10-08 04:49:02 +08:00 |
|
|
Kronecker
|
2e4d9d4ea2
|
feat(sandbox): supervise bounded root execution and final teardown
|
2026-10-08 04:38:08 +08:00 |
|
|
Kronecker
|
62b08fea5b
|
feat(sandbox): apply finite inherited resource limits before identity
|
2026-10-08 01:37:06 +08:00 |
|
|
Kronecker
|
4c7adda719
|
feat(sandbox): supervise aggregate CPU and monotonic wall budgets
|
2026-10-08 01:24:56 +08:00 |
|
|
Kronecker
|
cc6ee1bfa7
|
feat(sandbox): transport bounded stdio and close inherited user descriptors
|
2026-10-07 22:49:25 +08:00 |
|
|
Kronecker
|
89da9ffd9f
|
feat(sandbox): reap namespace descendants and cancel via init lifecycle
|
2026-10-07 22:28:13 +08:00 |
|
|
Kronecker
|
03eaab719e
|
feat(sandbox): restrict dangerous syscalls and verify GNU language profiles
|
2026-10-07 19:31:24 +08:00 |
|
|
Kronecker
|
9bb27f2e02
|
feat(sandbox): install profile seccomp with ABI and inheritance checks
|
2026-10-07 19:16:20 +08:00 |
|
|
Kronecker
|
46714bd9ea
|
feat(sandbox): lease task identities and drop initialization privileges
|
2026-10-07 18:22:58 +08:00 |
|
|
Kronecker
|
329c9222a3
|
feat(sandbox): bind readonly inputs through authenticated capabilities
|
2026-10-07 17:57:10 +08:00 |
|
|
Kronecker
|
9a2b1c071f
|
feat(sandbox): snapshot artifacts through bounded file capabilities
|
2026-10-07 16:19:05 +08:00 |
|
|
Kronecker
|
2b5e79dd39
|
feat(sandbox): restrict proc and devices in private roots
|
2026-10-07 13:21:37 +08:00 |
|
|
Kronecker
|
0f68eb5fb0
|
feat(sandbox): build private read-only roots with pivot_root
|
2026-10-07 10:02:21 +08:00 |
|
|
Kronecker
|
f22308080f
|
feat(sandbox): initialize isolated namespaces through gated helpers
|
2026-10-07 04:16:11 +08:00 |
|
|
Kronecker
|
1a91c2e0f6
|
feat(sandbox): gate target startup with verified task cgroups
|
2026-10-07 01:40:32 +08:00 |
|
|
Kronecker
|
605785edee
|
test(sandbox): allow launcher checks in independent VMs
|
2026-10-07 01:09:50 +08:00 |
|
|
Kronecker
|
08db00b56e
|
feat(sandbox): add bounded standalone launcher control
|
2026-10-06 22:04:29 +08:00 |
|
|
Kronecker
|
957135a112
|
feat(sandbox): enforce launcher lifecycle ordering
|
2026-10-06 11:02:55 +08:00 |
|
|
Kronecker
|
1f45266517
|
feat(sandbox): define runtime policy and preflight refusals
|
2026-10-06 03:58:19 +08:00 |
|
|
Kronecker
|
ee1f43a4cb
|
feat(sandbox): model execution outcomes and limit attribution
|
2026-10-06 01:00:04 +08:00 |
|
|
Kronecker
|
7ef77dfb34
|
feat(sandbox): validate bounded local execution specifications
|
2026-10-05 22:04:59 +08:00 |
|
|
Kronecker
|
b5b286c44f
|
chore(workspace): bootstrap platform, judge and frontend
|
2026-10-04 15:46:49 +08:00 |
|