Admit checked restricted artifacts without individual code approvals

2026-10-07 21:43:44 -07:00
parent b5046ad680
commit b1397465ee
10 changed files with 209 additions and 91 deletions
@@ -96,18 +96,7 @@ let
      esbuild = "${pkgs.esbuild}/bin/esbuild";
      shell = "${pkgs.runtimeShell}";
      serviceAdapter = ./portable-service.mjs;
-      restricted =
-        if service.restricted or false then
-          let
-            executor = import ./restricted-execution { inherit pkgs core; };
-          in
-          {
-            runtime = "${executor.runtime}/bin/quixos-restricted-registry";
-            sdk = "${executor.sdk}/core.mjs";
-            limits = service.limits or { };
-          }
-        else
-          null;
+      restrictedSDK = "${(import ./restricted-execution { inherit pkgs core; }).sdk}/core.mjs";
    }
  );
  compiled =