feat(sandbox): add control and boundary supervisor modes - #3151

Open

drew wants to merge 20 commits into

codex/1737-rfc12-supervisor-primitivesfrom

codex/1737-rfc12-supervisor-modes

Commits on Sep 5, 2026

feat(sandbox): split capability-free supervisor runtime
drew
committed
3047690
fix(network): import portable DNS mapping errors
drew
committed
cc48db8
fix(sandbox): keep non-Linux workspace checks portable
drew
committed
26acae6
fix(sandbox): gate Linux boundary internals
drew
committed
b4deb7b
fix(sandbox): keep helper commands portable
drew
committed
a5a0516
fix(sandbox): gate Linux bootstrap helpers
drew
committed
492b171
test(sandbox): gate Linux exec coverage
drew
committed
81e48a2
test(process): gate Linux relay fixture
drew
committed
a540976
ci(supervisor): stage both runtime binaries
drew
committed
9658ccf
test(sandbox): accept non-Linux startup rejection
drew
committed
821805a
fix(images): preserve sandbox image entrypoint
drew
committed
666dcaa
fix(sandbox): retry ephemeral DNS relay binding
drew
committed
89a0b08
fix(isolation): resolve scratch command in sandbox
drew
committed
0e36df2
fix(sandbox): preserve process launcher fallbacks
drew
committed
33304c3
fix(supervisor): allow null device for child launchers
drew
committed
c9546f9
fix(sandbox): attribute wildcard DNS sources
drew
committed
2efbd4c
fix(sandbox): support UDP route probes
drew
committed
8ee7ca9
test(sandbox): model unbound UDP route probes
drew
committed
eaa410a
fix(sandbox): support repeated DNS relay sends
drew
committed
b51d798
fix(server): serve callbacks before sandbox restore
drew
committed
4ef32d6