Admit checked restricted artifacts without individual code approvals

2026-10-07 21:43:44 -07:00
parent b5046ad680
commit b1397465ee
10 changed files with 209 additions and 91 deletions
@@ -1,6 +1,6 @@
 # Pinned upstream engine. This binary supplies an import/capability boundary;
-# production execution additionally requires OS limits and platform approval
-# for shared placement, or a workspace VM for unreviewed application code.
+# production execution additionally requires the qualified OS identity,
+# namespace, syscall, cgroup and invocation-broker boundaries.
 { pkgs }:
 let
  version = "1.20261005.1";