Repository navigation

orphan - #11938

Closed

briansrls wants to merge 46 commits into

mainfrom

fix/11751-merge-main

Closed

orphan#11938
briansrls wants to merge 46 commits into
mainfrom
fix/11751-merge-main

Commits on Sep 19, 2026
- microVM guest network: tap-grain default-deny egress, slot network readback, workspace staging gate
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  6a0d5c6
- Declare the readback and staging consumers as typed frontiers; drop the present-tense consumption claim
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  aaabe6b
- Bind the workspace standing once; one optional-returning readback selector instead of two singleton-list folds
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  2431ad6
- Fold the guest egress rules from one typed policy; narrow DNS to the booted resolver; filtered-egress consumes the policy
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  e5830d1
- Split per-host egress grain from the shared guest policy; admit replies in their own direction
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  4d701dd
- Consume std.types Port for nft dport and egress grants; compare digests through content_hash_eq_cryptographic
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  c8fba5b
- Take the nft ruleset out of the per-attempt plan; declare the host converge as its installer
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  145f93f
- Denied destinations are typed Ipv4Prefix rows rendered through the ipv4 authority
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  a75964b
- Drop prose denials that restate the typed guest policy and the forward chain
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  9af5eae
- Readbacks carry their subject; workspace readback bound to the planned image; denials precede every guest-side accept; tap v6 refused before conntrack
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  25574f8
- Sealed sanitation subject joined to a generation-bound ConvergedSlotNetwork receipt; v6 disabled on tap and guest; neighbour and expectation readbacks; helper standing over the effective host policy
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  f5be184
- Merge remote-tracking branch 'origin/main' into session/merry-ibex-866
  gunbc-ci-auto-heal
  committed
  b22f273
- Bind the slot network readback result to its sanitation subject
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  a86f37d
- Realize the guest policy in the input hook; one guest boot-argument spelling on every host
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  25b590e
- Refuse v6 toward a tap in forward and output; annotations name the direction each v6 rule covers
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  4791dd4
- Tap-scoped default-deny names the toward-a-tap direction: final oifname drop on the shared hosts
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  2ecfc09
- The slot install fold carries the v6 sysctl file it declares
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  3961ac5
- Merge remote-tracking branch 'origin/main' into session/merry-ibex-866
  gunbc-ci-auto-heal
  committed
  0b96a61
Commits on Sep 20, 2026
- microVM network converge: install the slot taps, ruleset and forwarding, then read the host back into a receipt
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  11fbe4d
- Merge remote-tracking branch 'origin/main' into session/merry-ibex-866
  gunbc-ci-auto-heal
  committed
  f15ac48
- Wire the converge's imports and slot roster; the network mode declares its ssh-key demand
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  60212fd
- Regenerate the sudoers rosters and fleet-converge workflow for the microVM network mode
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  65ca33b
- The two network frontiers name what landed and what a run must still establish
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  f9fc5fc
- Read every helper surface, match the route the kernel prints, bind the requested host, and persist the whole receipt
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  3edbc41
- Regenerate the sudoers rosters for the legacy xtables and userspace helper probes
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  68021c1
- An absent helper sysctl names the kernel it is absent from, or it is unread
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  d1b7d8e
- Supply the dispatched host to the step, reclassify the local mode, make the receipt a parseable value, and give ip_forward and the slot probes their own unread arms
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  58a70a4
- Regenerate fleet-converge.yml for the host binding and ssh-key reclassification
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  cc63588
- Merge remote-tracking branch 'origin/main' into session/merry-ibex-866
  gunbc-ci-auto-heal
  committed
  d6291a3
- Regenerate fleet-converge.yml at the merged head
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  e80a17b
- The persisted receipt leads with its schema and the claim parses the bytes the converge writes
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  74bf5ce
- Model the nft loader unit through the systemd unit-file authority; decode the fabric lifetime sample's digests through their optionals
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  784f6da
- Merge remote-tracking branch 'origin/main' into session/merry-ibex-866
  gunbc-ci-auto-heal
  committed
  6745f4e
- Regenerate fleet-converge.yml at the merged head
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  875fe8a
- The job user is granted the reads and none of the mutations; the mode observes and records
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  ecd954a
- Regenerate the rosters and workflow: reads granted, mutations withdrawn
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  bf587c2
- The mutation frontier names the folds it covers
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  a961870
- Merge remote-tracking branch 'origin/main' into session/merry-ibex-866
  gunbc-ci-auto-heal
  committed
  d1e175a
- The ssh-key classification is named as flipping with the mutation principal, not a standing fact
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  fc721c3
- The census row says what the observe fold does: it mutates nothing; the grant fold drops its unused slot roster
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  88b7671
- Restore the single SystemdServiceDirective header ahead of its full arm list
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  3cfea8e
- Merge main: take the union of the converge mode rosters and regenerate the workflow
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  b8dece7
- Merge main again: union the roster with MicrovmControllerAppKeyConverge and regenerate
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  f8f760f
- Merge main: union the roster with AppKeyVersionVerify and regenerate
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  c611e38
Commits on Sep 21, 2026
- Merge main: union the roster with MtCollins1CensusImagePublish and regenerate
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  701ac1d
- The wire-parse family carries a typed frontier row, not an annotation
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  cd2041c

Commits

Commits on Sep 19, 2026

Commits on Sep 20, 2026

Commits on Sep 21, 2026