feat(isolation): split supervisor and sandbox runtimes - #3151

Merged

drew merged 19 commits into

codex/1737-rfc12-supervisor-primitivesfrom

codex/1737-rfc12-supervisor-modes

Sep 11, 2026

Commits on Sep 11, 2026

feat(isolation): split supervisor and sandbox runtimes
drew
committed
9791c8a
docs(agents): register supervisor runtime
drew
committed
99e192a
fix(sandbox): harden boundary isolation and lifecycle ownership
drew
committed
cb9c0e6
fix(sandbox): reject private root redirects and adopt typed errors
drew
committed
e00e263
fix(sandbox): preserve accept thread ownership on musl
drew
committed
6d357ae
test(sandbox): isolate credential probes from filtered threads
drew
committed
de86a4c
fix(sandbox): return retained exec exit status to independent waiters
drew
committed
1727994
fix(sandbox): bound network mediation and preserve socket authorization
drew
committed
07838b3
fix(sandbox): bound control admission and retire stale mediation
drew
committed
520aaeb
ci(e2e): select migrated drivers per stack layer
drew
committed
a4a6666
refactor(sandbox): implement loopback connector
drew
committed
b555923
feat(isolation): authenticate the Sandbox Protocol
drew
committed
7cf8f93
feat(supervisor): rotate launch-scoped authentication
drew
committed
d684ed3
refactor(sandbox): consume dedicated backend crate
drew
committed
4bdd742
test(sandbox): align topology session fixture
drew
committed
737628b
fix(auth): use valid default session token lifetime
drew
committed
0d749dc
fix(sandbox): align projected bootstrap bundle
drew
committed
c6b64dd
fix(auth): validate refreshed credentials before rotation
drew
committed
f7b4b85
fix(sandbox): fail closed across supervisor disconnects
drew
committed
57e7b2d