Repository navigation
Conversation
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
Owner
Author
|
PR-cycle state — maintained automatically. Do not edit by hand. Mechanical PR-cycle state (JSON){
"approval": {
"candidate_revision_fingerprint": "sha256:c962c91fa3467509f52f5a4532c289d81373b432ae086359fa52b8706b499802",
"evidence": {
"attestations": [],
"candidate_revision_fingerprint": "sha256:c962c91fa3467509f52f5a4532c289d81373b432ae086359fa52b8706b499802",
"check_conclusions": [
{
"conclusion": "SUCCESS",
"name": "Bash native evidence checks",
"run_id": 124242901791
},
{
"conclusion": "SUCCESS",
"name": "Gitar",
"run_id": 124235406607
},
{
"conclusion": "SUCCESS",
"name": "Linux CI checks",
"run_id": 124235430678
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (darwin-amd64)",
"run_id": 124235431154
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (darwin-arm64)",
"run_id": 124235430855
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (linux-amd64)",
"run_id": 124235430848
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (linux-arm64)",
"run_id": 124235431090
},
{
"conclusion": "SUCCESS",
"name": "Windows host smoke (windows-amd64)",
"run_id": 124235430934
},
{
"conclusion": "SUCCESS",
"name": "Windows host smoke (windows-arm64)",
"run_id": 124235430845
}
],
"delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
"finding_dispositions_digest": "sha256:52e1cb85aa3beff2ddef35c43fe82d4d60ebe32792bf6e2f34d72b798380b325",
"operation_identity": "sha256:5fd516b81d2f139fda5d1b3c2a29c8e4bf2567fb64902d2750ecea37e000f07b",
"review_request": {
"body_digest": "sha256:5e177fc491e7265e7fdea414a7b8872b49b69fbd544cd6f50b508c5033918364",
"id": 6530400418
},
"review_result": {
"body_digest": "sha256:fb3d5d0fab34c975e59cf9535d2ee242e4ccdd09baed656da1c695dd6789efac",
"id": 6530433040
}
},
"evidence_fingerprint": "sha256:6b0e35e3e838869b8e31003d9b7e5ff6996200cc3cb2f425a14d3501a736009f",
"head_sha": "510519727082428ed08262650927272dc14c36b1",
"operation_identity": "sha256:5fd516b81d2f139fda5d1b3c2a29c8e4bf2567fb64902d2750ecea37e000f07b",
"review_request_id": 6530400418,
"review_result_id": 6530433040,
"status": "approved-evidence-recorded"
},
"candidate_revision_fingerprint": "sha256:c962c91fa3467509f52f5a4532c289d81373b432ae086359fa52b8706b499802",
"check_conclusions": [
{
"conclusion": "SUCCESS",
"name": "Bash native evidence checks",
"run_id": 124242901791
},
{
"conclusion": "SUCCESS",
"name": "Gitar",
"run_id": 124235406607
},
{
"conclusion": "SUCCESS",
"name": "Linux CI checks",
"run_id": 124235430678
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (darwin-amd64)",
"run_id": 124235431154
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (darwin-arm64)",
"run_id": 124235430855
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (linux-amd64)",
"run_id": 124235430848
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (linux-arm64)",
"run_id": 124235431090
},
{
"conclusion": "SUCCESS",
"name": "Windows host smoke (windows-amd64)",
"run_id": 124235430934
},
{
"conclusion": "SUCCESS",
"name": "Windows host smoke (windows-arm64)",
"run_id": 124235430845
}
],
"check_observations": [
{
"checks": [
{
"name": "Bash native evidence checks",
"reason": "missing",
"status": "pending"
},
{
"conclusion": "SUCCESS",
"name": "Gitar",
"run_id": 124218930481,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/runs/124218930481"
},
{
"name": "Linux CI checks",
"run_id": 124218927539,
"run_status": "in_progress",
"status": "pending",
"url": "https://github.com/omry/reploy/actions/runs/41101339951/job/124218927539"
},
{
"name": "Target smoke (darwin-amd64)",
"run_id": 124218927394,
"run_status": "in_progress",
"status": "pending",
"url": "https://github.com/omry/reploy/actions/runs/41101339951/job/124218927394"
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (darwin-arm64)",
"run_id": 124218927343,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41101339951/job/124218927343"
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (linux-amd64)",
"run_id": 124218927391,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41101339951/job/124218927391"
},
{
"name": "Target smoke (linux-arm64)",
"run_id": 124218927480,
"run_status": "in_progress",
"status": "pending",
"url": "https://github.com/omry/reploy/actions/runs/41101339951/job/124218927480"
},
{
"conclusion": "SUCCESS",
"name": "Windows host smoke (windows-amd64)",
"run_id": 124218927370,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41101339951/job/124218927370"
},
{
"conclusion": "FAILURE",
"name": "Windows host smoke (windows-arm64)",
"run_id": 124218927220,
"run_status": "completed",
"status": "failure",
"url": "https://github.com/omry/reploy/actions/runs/41101339951/job/124218927220"
}
],
"head_sha": "65d89da39d0088c5891b50991e8cbae6e337bfad",
"id": "sha256:0ebddac9b7741aeeefe29612be489acfd767e1d5f9493b1aeb1e20c8226bfed4",
"required_checks": [
"Bash native evidence checks",
"Gitar",
"Linux CI checks",
"Target smoke (darwin-amd64)",
"Target smoke (darwin-arm64)",
"Target smoke (linux-amd64)",
"Target smoke (linux-arm64)",
"Windows host smoke (windows-amd64)",
"Windows host smoke (windows-arm64)"
],
"status": "failure"
},
{
"checks": [
{
"conclusion": "SUCCESS",
"name": "Bash native evidence checks",
"run_id": 124242901791,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41105876482/job/124242901791"
},
{
"conclusion": "SUCCESS",
"name": "Gitar",
"run_id": 124235406607,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/runs/124235406607"
},
{
"conclusion": "SUCCESS",
"name": "Linux CI checks",
"run_id": 124235430678,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41105876482/job/124235430678"
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (darwin-amd64)",
"run_id": 124235431154,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41105876482/job/124235431154"
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (darwin-arm64)",
"run_id": 124235430855,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41105876482/job/124235430855"
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (linux-amd64)",
"run_id": 124235430848,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41105876482/job/124235430848"
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (linux-arm64)",
"run_id": 124235431090,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41105876482/job/124235431090"
},
{
"conclusion": "SUCCESS",
"name": "Windows host smoke (windows-amd64)",
"run_id": 124235430934,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41105876482/job/124235430934"
},
{
"conclusion": "SUCCESS",
"name": "Windows host smoke (windows-arm64)",
"run_id": 124235430845,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41105876482/job/124235430845"
}
],
"head_sha": "510519727082428ed08262650927272dc14c36b1",
"id": "sha256:d50c1d00a01c27e5d523b51b4bbe8f68eea6f452fc88f71a4336df2f813a4c27",
"required_checks": [
"Bash native evidence checks",
"Gitar",
"Linux CI checks",
"Target smoke (darwin-amd64)",
"Target smoke (darwin-arm64)",
"Target smoke (linux-amd64)",
"Target smoke (linux-arm64)",
"Windows host smoke (windows-amd64)",
"Windows host smoke (windows-arm64)"
],
"status": "success"
}
],
"delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
"delivery_deferrals": [],
"findings": [
{
"disposition": "superseded by all-success corrected-head CI; original timeout cause unproven",
"evidence": [
"https://github.com/omry/reploy/actions/runs/41101339951/job/124218927220",
"/home/omry/.local/state/awd/reploy-E-delivery-20261030/pr311-Windows-arm64-job.log",
"/home/omry/.local/state/awd/reploy-E-delivery-20261030/pr311-R1-correction-proof.json",
"/home/omry/.local/state/awd/reploy-E-delivery-20261030/pr311-R2-full-validation.json",
"/home/omry/.local/state/awd/reploy-E-delivery-20261030/pr311-R2-checks-retry01-result.json",
"https://github.com/omry/reploy/pull/311#issuecomment-6530433040"
],
"id": "E232-CI-001",
"invariant": "All ci.yml jobs must pass at the exact final PR head.",
"proposed_fix_paths": [],
"qualification": "Blocking failure retained. No timeout increase, skipped test or passing claim. Re-evaluate actual CI on mandatory corrected head.",
"resolution": "Current corrected head has fresh clean remote review, all9applicable checks and complete6 local checks passed. Original qualification text is retained as historical pending assessment; no claim to have fixed or proven the cause of the old timeout.",
"resolution_evidence": [
"/home/omry/.local/state/awd/reploy-E-delivery-20261030/pr311-R1-correction-proof.json",
"/home/omry/.local/state/awd/reploy-E-delivery-20261030/pr311-R2-full-validation.json",
"/home/omry/.local/state/awd/reploy-E-delivery-20261030/pr311-R2-checks-retry01-result.json",
"https://github.com/omry/reploy/pull/311#issuecomment-6530433040"
],
"resolved_on_head": "510519727082428ed08262650927272dc14c36b1",
"root_cause": "Package-wide five-minute timeout while an existing provider cleanup test had run for zero seconds; stack in os.RemoveAll TempDir cleanup. Cause not established as flake or product defect.",
"source": "Exact-head Windows ARM64 required-check failure; not a remote-review finding",
"status": "resolved"
},
{
"disposition": "verified current-slice truth fix",
"evidence": [
"https://github.com/omry/reploy/pull/311#discussion_r4426728237",
"https://github.com/containers/podman/blob/main/libpod/container_inspect_linux.go",
"https://github.com/containers/podman/blob/main/libpod/container_inspect.go",
"/home/omry/.local/state/awd/reploy-E-delivery-20261030/pr311-R1-correction-proof.json",
"/home/omry/.local/state/awd/reploy-E-delivery-20261030/pr311-R2-full-validation.json",
"/home/omry/.local/state/awd/reploy-E-delivery-20261030/pr311-R2-checks-retry01-result.json",
"https://github.com/omry/reploy/pull/311#issuecomment-6530433040"
],
"id": "E232-GITAR-001",
"invariant": "A real supported Podman inspect response must preserve exact selected policy without requiring a create-request echo; missing or mismatched authority refuses before frame.",
"proposed_fix_paths": [
"internal/dockerdeploy/podman_mapped_waiter.go",
"internal/dockerdeploy/podman_mapped_waiter_test.go",
"internal/dockerdeploy/podman_mapped_policy_test.go"
],
"qualification": "Pending actual correction and validation. Use existing versioned native inspect to compare explicit bounding/effective capability sets, normalized NNP and constrained seccomp provenance; retain exact mandatory fresh F kernel proof.",
"resolution": "Current corrected head has fresh clean remote review, all9applicable checks and complete6 local checks passed. Original qualification text is retained as historical pending assessment; no claim to have fixed or proven the cause of the old timeout.",
"resolution_evidence": [
"/home/omry/.local/state/awd/reploy-E-delivery-20261030/pr311-R1-correction-proof.json",
"/home/omry/.local/state/awd/reploy-E-delivery-20261030/pr311-R2-full-validation.json",
"/home/omry/.local/state/awd/reploy-E-delivery-20261030/pr311-R2-checks-retry01-result.json",
"https://github.com/omry/reploy/pull/311#issuecomment-6530433040"
],
"resolved_on_head": "510519727082428ed08262650927272dc14c36b1",
"root_cause": "Compat inspect reconstructs CapAdd/CapDrop relative to configurable default capabilities and normalizes SecurityOpt. The fixture echoes request values, so it masks a production refusal.",
"source": "Gitar review thread 4426728237; coordinator independently verified Podman source; not a Codex finding",
"status": "resolved"
}
],
"pr": {
"base_ref": "pr309",
"base_sha": "5be35af35ca2ed25b327d9c905839410d2d0d819",
"body_digest": "sha256:c04c83bb71e167968fa01c454af5abe35e908dad4e4de9032f1d86dc9cd84f18",
"body_identity_version": 2,
"diff_digest": "sha256:e406a4b3f547408cd1b459847582bc5ad2d0922519f575ffd845853756c3706a",
"head_ref": "pr311",
"head_sha": "510519727082428ed08262650927272dc14c36b1",
"pr": 311,
"repository": "omry/reploy",
"scope_authority": [
{
"digest": "sha256:f5058bb465d6af9d58b98eb6fde19edd4ed710aff1cc2588173757d37cdbbc58",
"path": "docs/MULTI_IDENTITY_E_DESIGN.md"
},
{
"digest": "sha256:3ef44a7a0be43648f5df1faad39b16101978662c58c87d6fa8e7409093a58fe9",
"path": "docs/MULTI_IDENTITY_IMPLEMENTATION_PLAN.md"
},
{
"digest": "sha256:b049714f4a85d0f3fb204615897374377690564627bfcdd03e50c945fb042826",
"path": "docs/MULTI_IDENTITY_SECURITY_CONTRACT.md"
}
],
"title_digest": "sha256:01873c9744c72714b2bc331328ed9174b18f2653c9e15c16a0437483726d220a"
},
"record_version": 6,
"review_observations": [],
"review_requests": [
{
"base_established_at": "2026-10-30T17:45:47Z",
"base_ref": "pr309",
"base_sha": "5be35af35ca2ed25b327d9c905839410d2d0d819",
"body_digest": "sha256:ee226f74809957d44643dd096fabc855cbad1a6ea160f19a0f35db5e328d04ad",
"created_at": "2026-10-30T17:58:22Z",
"head_sha": "65d89da39d0088c5891b50991e8cbae6e337bfad",
"id": 6529822602,
"kind": "regular-review"
},
{
"base_established_at": "2026-10-30T17:45:47Z",
"base_ref": "pr309",
"base_sha": "5be35af35ca2ed25b327d9c905839410d2d0d819",
"body_digest": "sha256:5e177fc491e7265e7fdea414a7b8872b49b69fbd544cd6f50b508c5033918364",
"created_at": "2026-10-30T18:25:05Z",
"head_sha": "510519727082428ed08262650927272dc14c36b1",
"id": 6530400418,
"kind": "regular-review"
}
],
"review_results": [
{
"base_ref": "pr309",
"base_sha": "5be35af35ca2ed25b327d9c905839410d2d0d819",
"body_digest": "sha256:0ba4af46d51c09c8cc6ba8f126f6d3ff95baa8fa2c460e649dc7dd87d8984774",
"commit_id": "65d89da39d0088c5891b50991e8cbae6e337bfad",
"id": 6529849230,
"inline_message_ids": [],
"request_comment_id": 6529822602,
"result_kind": "clean",
"status": "result",
"submitted_at": "2026-10-30T17:59:42Z",
"unresolved_thread_ids": [
"PRRT_kwDOTFQCkM6yFDIi"
]
},
{
"base_ref": "pr309",
"base_sha": "5be35af35ca2ed25b327d9c905839410d2d0d819",
"body_digest": "sha256:fb3d5d0fab34c975e59cf9535d2ee242e4ccdd09baed656da1c695dd6789efac",
"commit_id": "510519727082428ed08262650927272dc14c36b1",
"id": 6530433040,
"inline_message_ids": [],
"request_comment_id": 6530400418,
"result_kind": "clean",
"status": "result",
"submitted_at": "2026-10-30T18:26:34Z",
"unresolved_thread_ids": []
}
],
"revision_fingerprint": "sha256:c962c91fa3467509f52f5a4532c289d81373b432ae086359fa52b8706b499802",
"rounds": [
{
"applied_fix_paths": [
"internal/dockerdeploy/podman_mapped_waiter.go",
"internal/dockerdeploy/podman_mapped_waiter_test.go",
"internal/dockerdeploy/podman_mapped_policy_test.go"
],
"disposition_changes": [],
"effective_diff_digest": "sha256:e406a4b3f547408cd1b459847582bc5ad2d0922519f575ffd845853756c3706a",
"finding_ids": [
"E232-GITAR-001",
"E232-CI-001"
],
"invariants": [
"Accept supported native Podman inspect while preserving exact compiled capability/NNP/policy admission.",
"Preserve immutable image, exact owner/command and no-removal/restart/process/cleanup fences.",
"Require fresh exact instance-bound F proof before frame; engine annotations are provenance only.",
"Every final-head ci.yml job and fresh regular review must pass before approval."
],
"outcome": "corrected-head-needs-review",
"proposed_fix_paths": [
"internal/dockerdeploy/podman_mapped_waiter.go",
"internal/dockerdeploy/podman_mapped_waiter_test.go",
"internal/dockerdeploy/podman_mapped_policy_test.go"
],
"resulting_head": "510519727082428ed08262650927272dc14c36b1",
"review_observation_id": null,
"review_request_id": 6529822602,
"review_result_id": 6529849230,
"reviewed_head": "65d89da39d0088c5891b50991e8cbae6e337bfad",
"root_cause": "Compat CapAdd/CapDrop are deltas from configurable defaults and SecurityOpt is normalized; a request-echo fixture masked false refusal. Reused versioned native inspect with full capability sets and normalized provenance, retaining mandatory fresh exact F policy proof. Focused old-observer regression and complete repaired-candidate validation passed. Prior Windows ARM64 package-timeout failure remains blocking until all final-head jobs pass; no flake or waiver claimed.",
"round": 1,
"unresolved_current_slice_findings": 1,
"unresolved_design_blockers": 0
},
{
"applied_fix_paths": [],
"disposition_changes": [],
"effective_diff_digest": "sha256:e406a4b3f547408cd1b459847582bc5ad2d0922519f575ffd845853756c3706a",
"finding_ids": [],
"invariants": [
"Exact mapped policy create/native inspection and mandatory fresh kernel proof, original image/owner/cleanup fences preserved.",
"Public mapped activation remains inhibited.",
"Fresh same-head review, full local validation and all ci.yml jobs successful."
],
"outcome": "clean",
"proposed_fix_paths": [],
"resulting_head": "510519727082428ed08262650927272dc14c36b1",
"review_observation_id": null,
"review_request_id": 6530400418,
"review_result_id": 6530433040,
"reviewed_head": "510519727082428ed08262650927272dc14c36b1",
"root_cause": "No new findings or corrections in round2. Prior native-inspect compatibility truth fix confirmed by current full local validation and clean regular review; current Windows ARM64 and every other required CI job pass. Prior timeout cause is not inferred.",
"round": 2,
"unresolved_current_slice_findings": 0,
"unresolved_design_blockers": 0
}
],
"schema": "awd:swe:pr-cycle-state",
"version": 2
} |
omry
marked this pull request as ready for review
October 30, 2026 17:56
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins. |
Owner
Author
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Mapped creation must carry the exact compiled kernel policy through preparation, inhibited startup and trusted pre-release observation. Add one typed overlay over the existing strict ordinary parser, require independently supplied startup capability equality, and bind the full ABI/capability/policy tuple to the existing sandbox proof. Transmit and verify explicit no-removal/no-restart policy while preserving ordinary request serialization. Keep public mapped execution inhibited and leave production F observations, effective runtime qualification and final entry-plan construction behind their existing gates. Retain the C1 diagnostic with a real production waiter and a host regression over its generated binding, create stdin and causal EOF. Validation: fresh independent full review; Python packaging and CI-tool tests; targeted Go vet; all shipping/conformance Go packages; linux-amd64 build and CLI smoke. Retained WSL ordinary-tmpfs exclusion and explicit Docker skip apply; live runtime and exact-head PR CI remain separate gates.
Code Review ✅ Approved 1 closed / 1 findings🔴 High risk · Mapped creation now applies capability/seccomp policy and gates release on kernel-policy evidence; errors could expose workloads to excess kernel authority. Applies and verifies the mapped kernel policy through preparation, inhibited startup, and pre-release observation, with explicit no-removal/no-restart policy transmitted and checked. Public mapped execution stays inhibited and production gates remain in place. Resolved the Inspect request-echo check mismatch where Podman rebuilds CapDrop/SecurityOpt. No open issues found. ✅ 1 closed✅ Bug: Inspect check expects request echo; Podman rebuilds CapDrop/SecurityOpt
VerificationRules No rules evaluated Functional validation Not enabledFor more verification details, comment OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source |
Owner
Author
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
This was referenced Oct 30, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mapped creation must carry the exact compiled kernel policy through preparation, inhibited startup and trusted pre-release observation. Add one typed overlay over the existing strict ordinary parser, require independently supplied startup capability equality, and bind the full ABI/capability/policy tuple to the existing sandbox proof. Transmit and verify explicit no-removal/no-restart policy while preserving ordinary request serialization.
Keep public mapped execution inhibited and leave production F observations, effective runtime qualification and final entry-plan construction behind their existing gates. Retain the C1 diagnostic with a real production waiter and a host regression over its generated binding, create stdin and causal EOF.
Validation: fresh independent full review; Python packaging and CI-tool tests; targeted Go vet; all shipping/conformance Go packages; linux-amd64 build and CLI smoke. Retained WSL ordinary-tmpfs exclusion and explicit Docker skip apply; live runtime and exact-head PR CI remain separate gates.