Timothy J. Aveni dec3aa475a Expose workspace-scoped restricted artifact placement and live executor activity ...

Show per-export placement, static eligibility blockers, bounded metadata and live pool/idle/timing diagnostics. Attach inspector updates through one private shard stream and the existing authenticated SSE hub without waking graph views or VMs. Fix packed agent preparation to use OpenSSH and the worker’s own private systemd credential.

2026-10-08 04:31:16 -07:00

..

default.nix

Include canonical hashing in restricted package execution

2026-10-08 01:03:14 -07:00

identity-launcher.c

Admit checked restricted artifacts without individual code approvals

2026-10-07 21:43:44 -07:00

identity-module.nix

Admit checked restricted artifacts without individual code approvals

2026-10-07 21:43:44 -07:00

sandbox-probe.c

Confine restricted engines before launch and preserve the reader recovery baseline

2026-10-07 20:47:53 -07:00

sandbox.c

Admit checked restricted artifacts without individual code approvals

2026-10-07 21:43:44 -07:00

sandbox.nix

Confine restricted engines before launch and preserve the reader recovery baseline

2026-10-07 20:47:53 -07:00

seccomp.c

Confine restricted engines before launch and preserve the reader recovery baseline

2026-10-07 20:47:53 -07:00

service.mjs

Expose workspace-scoped restricted artifact placement and live executor activity

2026-10-08 04:31:16 -07:00

service.test.mjs

Expose workspace-scoped restricted artifact placement and live executor activity

2026-10-08 04:31:16 -07:00

worker.mjs

Reuse restricted engines with fresh invocation state and revocable ports

2026-10-07 16:14:15 -07:00

workerd.nix

Admit checked restricted artifacts without individual code approvals

2026-10-07 21:43:44 -07:00