feat(vm): run the supervisor outside the guest workload

[drew]

Summary

Adopt the RFC 0012 split in the VM driver. openshell-supervisor runs on the host, while openshell-sandbox runs as guest init and owns the agent process tree.

The private guest channel uses the same pinned TLS server identity and launch-scoped sandbox JWT as every other driver, carried over vsock or the hypervisor Unix-socket mapping.

Related Issue

Part of #1737.

Changes

• Boot the guest with the sandbox runtime, TLS server material, and public JWT verification keys.
• Keep both supervisor JWTs and the pinned sandbox CA on the host.
• Run the external host supervisor with durable runtime state.
• Remove the guest NIC, TAP, gvproxy, nftables, and direct guest egress path.
• Carry lifecycle, process control, TCP, and DNS over the authenticated Sandbox Protocol.
• Keep gateway, provider, and upstream network access outside the guest.

Testing

• mise run pre-commit
• Focused VM isolation tests
• Full VM E2E validation delegated to remote CI

Checklist

• Follows Conventional Commits
• Authored commits are signed off (DCO)

Stack

1. feat(isolation): implement the RFC 0012 sandbox architecture #2942 — RFC 0012 core architecture
2. feat(vm): run the supervisor outside the guest workload #2945 — VM driver (this PR)
3. feat(docker): isolate workloads behind a companion supervisor #2965 — Docker driver
4. feat(kubernetes): isolate workloads behind a dedicated supervisor #3144 — Kubernetes driver
5. feat(podman): isolate workloads behind a separate supervisor #3230 — Podman driver
6. perf(isolation): add TCP and DNS benchmark harnesses #3229 — performance harnesses

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2945.docs.buildwithfern.com/openshell

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[johntmyers]

gator-agent

Maintainer Convergence Decision

The critical-only review of the current author delta found no newly introduced Critical defect. The two existing VM launch-contract obligations remain unchanged and unresolved, so a maintainer decision is still required before this stack layer can proceed.

Root-cause findings:

• GATOR-d88b8843-01: restart still reloads create-time launch authentication instead of consuming fresh StartSandboxRequest.launch_authentication; unresolved.
• GATOR-d88b8843-02: the boundary and host supervisor still derive fallback UID/GID instead of using the resolved image or overlay owner identity; unresolved.

Scope growth:

• None. The latest delta adjusts VM artifact selection, guest-init version/platform handling, schema bookkeeping, and dependency policy. It does not alter either affected launch path or the shared contracts consumed by downstream stack layers feat(docker): isolate workloads behind a companion supervisor #2965, feat(kubernetes): isolate workloads behind a dedicated supervisor #3144, feat(podman): isolate workloads behind a separate supervisor #3230, and perf(isolation): add TCP and DNS benchmark harnesses #3229.

Reviewer-quality signals:

• No duplicate, waived, resolved, or unchanged-code finding was proposed in this critical-only round.

Maintainer action: decide the disposition of GATOR-d88b8843-01 and GATOR-d88b8843-02: either confirm they remain required and direct @drew to implement the requested launch-authentication and resolved-identity fixes, or explicitly waive the applicable finding with rationale.

Gator metadata

• Validation: Implements the VM driver layer of accepted RFC 0012 / feat: establish the Isolation Backend interface #1737, stacked on feat(isolation): implement the RFC 0012 sandbox architecture #2942 and serving as the base for the remaining four stack layers.
• Docs: Architecture and Fern reference updates remain present; the latest delta adds no direct UX contract.
• Checks: Current-head Branch Checks and E2E are pending; Helm Lint and Trivy Changes are green. Pipeline handoff is not active while convergence is blocked.
• E2E: test:e2e is applied and the current-head E2E workflow is dispatched; the E2E Label Help bot has not requested a current-head rerun.
• Head SHA: 398e103abb349447eb7805e40aad152219f72598
• Base SHA: d3d92a7ccc70cebbd7f4e1148fb1cdbd5f7f705a
• Merge base SHA: d3d92a7ccc70cebbd7f4e1148fb1cdbd5f7f705a
• Patch ID: b94b62d249be24cdac4cf74e7ccab9d3f4086913
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: b1bffcd38d3f4e04d68eeb9acd4d5e4acf9b79cc
• Review budget exhausted: yes
• Maintainer decision required: yes — two prior launch-contract findings remain unresolved and unwaived.
• Next state: gator:blocked
• Blocked reason: review_convergence_decision_required

[johntmyers]

gator-agent

Maintainer Convergence Decision

Thanks @drew. I checked the identity updates through current head ee02dcd9ecea97c735509e7c48f05a4cc328ef10: the VM boundary, guest account reconciliation, and host supervisor now share the persisted image/overlay UID and GID, so GATOR-d88b8843-02 is fixed and its Gator thread is resolved. The bounded critical-only review found no newly introduced Critical defect. One launch-contract obligation remains unresolved, so a maintainer decision is still required before this stack layer can proceed.

Root-cause findings:

• GATOR-d88b8843-01: the VM StartSandboxRequest handler still discards fresh launch_authentication; restart reloads the create-time bundle from sandbox.pb, whose session has been deactivated, so a stopped VM cannot reliably return to Ready. Unresolved and unwaived.
• GATOR-d88b8843-02: boundary and host-supervisor identity now use the already-resolved sandbox owner. Resolved at this head.

Scope growth:

• None. The remaining fix is contained to the existing VM restart launch-authentication path and regression coverage; it does not require changes to the downstream Docker, Kubernetes, Podman, or performance layers.

Reviewer-quality signals:

• The critical-only reviewer proposed no new findings and did not repeat resolved, waived, or unchanged-code findings.

Maintainer action: decide whether supported VM stop/start must consume the fresh StartSandboxRequest.launch_authentication. If yes, require that bundle to replace the persisted launch authentication before reprovisioning and cover session A → stop → session B → successful Ready; if the restart contract is intentionally unsupported for this VM layer, explicitly waive GATOR-d88b8843-01 and record that boundary.

Gator metadata

• Head SHA: ee02dcd9ecea97c735509e7c48f05a4cc328ef10
• Base SHA: d3d92a7ccc70cebbd7f4e1148fb1cdbd5f7f705a
• Merge base SHA: d3d92a7ccc70cebbd7f4e1148fb1cdbd5f7f705a
• Patch ID: f917aaeff2cf12885e2ede2664d2a6310b3faa7b
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: b1bffcd38d3f4e04d68eeb9acd4d5e4acf9b79cc
• Review budget exhausted: yes
• Checks: current-head Branch Checks and required E2E are running; Helm Lint and Trivy Changes are green.
• E2E: test:e2e is already applied and current-head run 34729165436 is queued; no current-head bot instruction requires /ok to test or a rerun.
• Next state: gator:blocked
• Blocked reason: review_convergence_decision_required

[johntmyers]

gator-agent

Maintainer Convergence Decision

The bounded critical-only review of current head 9558c18127e79c9a8ca7b220ce247a21abad02a7 found no newly introduced Critical defect. The latest author delta surfaces host-supervisor stderr when startup fails; it does not change the restart authentication path. The identity obligation remains fixed, while one launch-contract obligation is still unresolved, so a maintainer decision remains required before this VM layer and its downstream stack can proceed.

Root-cause findings:

• GATOR-d88b8843-01: the VM StartSandboxRequest handler still discards fresh launch_authentication and reprovisions from the create-time bundle in sandbox.pb; after that session is deactivated, a stopped VM cannot reliably return to Ready. Unresolved and unwaived.
• GATOR-d88b8843-02: the VM boundary, guest reconciliation, and host supervisor use the persisted image/overlay owner identity. Fixed; its Gator thread is resolved.

Scope growth:

• None. The current delta is limited to build/platform fixes, resolved-identity propagation, and startup diagnostics. It does not expand the shared contracts consumed by downstream PRs feat(docker): isolate workloads behind a companion supervisor #2965, feat(kubernetes): isolate workloads behind a dedicated supervisor #3144, feat(podman): isolate workloads behind a separate supervisor #3230, and perf(isolation): add TCP and DNS benchmark harnesses #3229.

Reviewer-quality signals:

• This critical-only round proposed no findings, including no duplicate, waived/resolved, or unchanged-code proposal.

Maintainer action: decide whether supported VM stop/start must consume fresh StartSandboxRequest.launch_authentication. If yes, direct @drew to replace persisted launch authentication before reprovisioning and cover session A → stop → session B → successful Ready. If restart is intentionally unsupported for this VM layer, explicitly waive GATOR-d88b8843-01 and record that boundary.

Gator metadata

• Validation: Implements the VM driver layer of accepted RFC 0012 / feat: establish the Isolation Backend interface #1737, stacked on feat(isolation): implement the RFC 0012 sandbox architecture #2942 and serving as the base for four downstream stack layers.
• Docs: Existing architecture and Fern reference updates remain present; this delta adds no direct user-facing contract.
• Checks: Current-head Branch Checks, Trivy Changes, and required E2E are running; Helm Lint is green.
• E2E: test:e2e is applied and current-head E2E run 34729983932 is active; no current-head E2E Label Help instruction requests /ok to test or a rerun.
• Head SHA: 9558c18127e79c9a8ca7b220ce247a21abad02a7
• Base SHA: d3d92a7ccc70cebbd7f4e1148fb1cdbd5f7f705a
• Merge base SHA: d3d92a7ccc70cebbd7f4e1148fb1cdbd5f7f705a
• Patch ID: 172b5917571945dc0ff2085beefdf93ca0c29bb2
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: b1bffcd38d3f4e04d68eeb9acd4d5e4acf9b79cc
• Review budget exhausted: yes
• Maintainer decision required: yes — GATOR-d88b8843-01 remains unresolved and unwaived.
• Next state: gator:blocked
• Blocked reason: review_convergence_decision_required

[johntmyers]

gator-agent

Maintainer Convergence Decision

The force-rebase of current head ddf93f6ce41322cf7170d4142a068f585d059d19 onto the updated #2942 base is author-patch-equivalent to the prior head; dependency-policy/schema bookkeeping moved into the base. The bounded critical-only review found no newly introduced Critical defect. The resolved identity obligation remains fixed, but one launch-contract obligation is unchanged and unwaived, so a maintainer decision remains required before this VM layer and its downstream stack can proceed.

Root-cause findings:

• GATOR-d88b8843-01: the VM StartSandboxRequest handler still discards fresh launch_authentication and reprovisions from the create-time bundle in sandbox.pb; after that session is deactivated, a stopped VM cannot reliably return to Ready. Unresolved and unwaived.
• GATOR-d88b8843-02: the VM boundary, guest reconciliation, and host supervisor use the persisted image/overlay owner identity. Resolved; its Gator thread remains resolved after the rebase.

Scope growth:

• None. The effective author patch is unchanged by the rebase, and the latest supervisor session-install ordering commit does not alter the VM restart handler or expand shared contracts used by feat(docker): isolate workloads behind a companion supervisor #2965, feat(kubernetes): isolate workloads behind a dedicated supervisor #3144, feat(podman): isolate workloads behind a separate supervisor #3230, and perf(isolation): add TCP and DNS benchmark harnesses #3229.

Reviewer-quality signals:

• The current critical-only reviewer proposed no finding, including no duplicate, resolved/waived, or unchanged-code proposal.

Maintainer action: decide whether supported VM stop/start must consume fresh StartSandboxRequest.launch_authentication. If yes, direct @drew to replace the persisted launch authentication before reprovisioning and cover session A → stop → session B → successful Ready. If restart is intentionally unsupported for this VM layer, explicitly waive GATOR-d88b8843-01 and record that boundary.

Gator metadata

• Validation: Implements the VM driver layer of accepted RFC 0012 / feat: establish the Isolation Backend interface #1737, stacked on current feat(isolation): implement the RFC 0012 sandbox architecture #2942 and serving as the base for the remaining four stack layers.
• Docs: Existing architecture and Fern reference updates remain present; the effective author delta adds no new direct UX contract.
• Checks: Current-head Branch Checks and required E2E are pending; Helm Lint and Trivy Changes are green. Pipeline handoff is not active while convergence is blocked.
• E2E: test:e2e is already applied and current-head E2E run 34731042575 is dispatched; no current-head E2E Label Help instruction requests /ok to test or a rerun.
• Head SHA: ddf93f6ce41322cf7170d4142a068f585d059d19
• Base SHA: de2b42c6e68f1ba4a5e5e72b973de927ba81394e
• Merge base SHA: de2b42c6e68f1ba4a5e5e72b973de927ba81394e
• Patch ID: 22617e0a0d609068cfa23ce535a7c865e0149003
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: b1bffcd38d3f4e04d68eeb9acd4d5e4acf9b79cc
• Review budget exhausted: yes
• Maintainer decision required: yes — GATOR-d88b8843-01 remains unresolved and unwaived.
• Next state: gator:blocked
• Blocked reason: review_convergence_decision_required

[johntmyers]

gator-agent

Maintainer Convergence Decision

Thanks @drew. I checked current head 84f988612b61908e2b517f40cc2b555487162b23: the new delta adds the guest console tail when the host supervisor exits. The bounded critical-only review found no newly introduced Critical defect. This diagnostic improvement does not alter the VM restart authentication path, so one launch-contract obligation remains unresolved and a maintainer decision is still required before this VM layer and its four downstream stack layers can proceed.

Root-cause findings:

• GATOR-d88b8843-01: the VM StartSandboxRequest handler still discards fresh launch_authentication and reprovisions from the create-time bundle in sandbox.pb; after that session is deactivated, a stopped VM cannot reliably return to Ready. Unresolved and unwaived.
• GATOR-d88b8843-02: the VM boundary, guest reconciliation, and host supervisor use the persisted image/overlay owner identity. Resolved; its Gator thread remains resolved.

Scope growth:

• None. The current delta is limited to startup diagnostics and does not expand the shared protocol, authentication, lifecycle, or configuration contracts consumed by feat(docker): isolate workloads behind a companion supervisor #2965, feat(kubernetes): isolate workloads behind a dedicated supervisor #3144, feat(podman): isolate workloads behind a separate supervisor #3230, and perf(isolation): add TCP and DNS benchmark harnesses #3229.

Reviewer-quality signals:

• The critical-only reviewer proposed no finding, including no duplicate, resolved/waived, or unchanged-code proposal. Ledger telemetry remains 3 finding-bearing rounds, 2 unique findings, and 16 duplicate finding-ID occurrences across historical dispositions.

Maintainer action: decide whether supported VM stop/start must consume fresh StartSandboxRequest.launch_authentication. If yes, direct @drew to replace persisted launch authentication before reprovisioning and cover session A → stop → session B → successful Ready. If restart is intentionally unsupported for this VM layer, explicitly waive GATOR-d88b8843-01 and record that boundary.

Gator metadata

• Validation: Implements the VM driver layer of accepted RFC 0012 / feat: establish the Isolation Backend interface #1737, stacked on current feat(isolation): implement the RFC 0012 sandbox architecture #2942 and serving as the base for feat(docker): isolate workloads behind a companion supervisor #2965, feat(kubernetes): isolate workloads behind a dedicated supervisor #3144, feat(podman): isolate workloads behind a separate supervisor #3230, and perf(isolation): add TCP and DNS benchmark harnesses #3229.
• Docs: Existing architecture and Fern reference updates remain present; this diagnostic delta adds no direct UX contract.
• Checks: Current-head Branch Checks and required E2E are running; Helm Lint and Trivy Changes are green. Pipeline handoff is not active while convergence is blocked.
• E2E: test:e2e is already applied and current-head Branch E2E run 34731932917 is active; no current-head E2E Label Help instruction requests /ok to test or a rerun.
• Head SHA: 84f988612b61908e2b517f40cc2b555487162b23
• Base SHA: de2b42c6e68f1ba4a5e5e72b973de927ba81394e
• Merge base SHA: de2b42c6e68f1ba4a5e5e72b973de927ba81394e
• Patch ID: 13ba4e2cf69b33879aec970bab8a403503e01d7a
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: b1bffcd38d3f4e04d68eeb9acd4d5e4acf9b79cc
• Review budget exhausted: yes
• Maintainer decision required: yes — GATOR-d88b8843-01 remains unresolved and unwaived.
• Next state: gator:blocked
• Blocked reason: review_convergence_decision_required

[johntmyers]

gator-agent

Maintainer Convergence Decision

The bounded critical-only review of current head aa182e569c12aacfe81df3f8003dbe290ec27efe found no newly introduced Critical defect. The latest author delta confirms the isolation boundary before starting network mediation, preserving fail-closed ordering across the shared RFC 0012 supervisor contract used by this VM layer and downstream PRs #2965, #3144, #3230, and #3229. It does not change the VM restart authentication path, so one prior obligation remains unresolved and a maintainer decision is still required.

Root-cause findings:

• GATOR-d88b8843-01: the VM StartSandboxRequest handler still discards fresh launch_authentication and reprovisions from the create-time bundle in sandbox.pb; after that session is deactivated, a stopped VM cannot reliably return to Ready. Unresolved and unwaived.
• GATOR-d88b8843-02: the VM boundary, guest reconciliation, and host supervisor use the persisted image/overlay owner identity. Resolved; its Gator thread remains resolved.

Scope growth:

• None. The current commit changes shared supervisor startup ordering but does not expand the public configuration, protocol surface, or RFC non-goals.

Reviewer-quality signals:

• The reviewer proposed no finding, including no duplicate, resolved/waived, or unchanged-code proposal. Ledger telemetry remains 3 finding-bearing rounds, 2 unique findings, and 18 duplicate finding-ID occurrences across historical dispositions.

Maintainer action: decide whether supported VM stop/start must consume fresh StartSandboxRequest.launch_authentication. If yes, direct @drew to replace persisted launch authentication before reprovisioning and cover session A → stop → session B → successful Ready. If restart is intentionally unsupported for this VM layer, explicitly waive GATOR-d88b8843-01 and record that boundary.

Gator metadata

• Validation: Implements the VM driver layer of accepted RFC 0012 / feat: establish the Isolation Backend interface #1737, stacked on current feat(isolation): implement the RFC 0012 sandbox architecture #2942 and serving as the base for feat(docker): isolate workloads behind a companion supervisor #2965, feat(kubernetes): isolate workloads behind a dedicated supervisor #3144, feat(podman): isolate workloads behind a separate supervisor #3230, and perf(isolation): add TCP and DNS benchmark harnesses #3229.
• Docs: Existing architecture and Fern reference updates remain present; the latest startup-ordering delta adds no new direct UX contract.
• Checks: Current-head Branch Checks and required E2E are running; Helm Lint and Trivy Changes are green. Pipeline handoff is not active while convergence is blocked.
• E2E: test:e2e is already applied and current-head Branch E2E run 34732943168 is active; no current-head bot instruction requires /ok to test or a rerun.
• Head SHA: aa182e569c12aacfe81df3f8003dbe290ec27efe
• Base SHA: de2b42c6e68f1ba4a5e5e72b973de927ba81394e
• Merge base SHA: de2b42c6e68f1ba4a5e5e72b973de927ba81394e
• Patch ID: 03d2b4052d01f0e0a3ac9424b0d70329db609f46
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: b1bffcd38d3f4e04d68eeb9acd4d5e4acf9b79cc
• Review budget exhausted: yes
• Maintainer decision required: yes — GATOR-d88b8843-01 remains unresolved and unwaived.
• Next state: gator:blocked
• Blocked reason: review_convergence_decision_required

[johntmyers]

gator-agent

Maintainer Convergence Decision

The current head a8b780401e7e06273b1b32c4f5515957e344da08 is a force-rebase onto the updated #2942 base. Its author patch ID matches the already-reviewed aa182e569c12aacfe81df3f8003dbe290ec27efe patch, so there is no new effective delta to review. The resolved identity obligation remains fixed, but one launch-contract obligation is unchanged and unwaived, so a maintainer decision remains required before this VM layer and downstream PRs #2965, #3144, #3230, and #3229 can proceed.

Root-cause findings:

• GATOR-d88b8843-01: the VM StartSandboxRequest handler still discards fresh launch_authentication and reprovisions from the create-time bundle in sandbox.pb; after that session is deactivated, a stopped VM cannot reliably return to Ready. Unresolved and unwaived.
• GATOR-d88b8843-02: the VM boundary, guest reconciliation, and host supervisor use the persisted image/overlay owner identity. Resolved; its Gator thread remains resolved after the rebase.

Scope growth:

• None. The effective VM-layer patch is unchanged, and the updated stacked base does not alter the outstanding restart-authentication obligation.

Reviewer-quality signals:

• No reviewer run was needed for this patch-equivalent rebase. Ledger telemetry remains 3 finding-bearing rounds, 2 unique findings, and 20 duplicate finding-ID occurrences across historical dispositions.

Maintainer action: decide whether supported VM stop/start must consume fresh StartSandboxRequest.launch_authentication. If yes, direct @drew to replace persisted launch authentication before reprovisioning and cover session A → stop → session B → successful Ready. If restart is intentionally unsupported for this VM layer, explicitly waive GATOR-d88b8843-01 and record that boundary.

Gator metadata

• Validation: Implements the VM driver layer of accepted RFC 0012 / feat: establish the Isolation Backend interface #1737, stacked on current feat(isolation): implement the RFC 0012 sandbox architecture #2942 and serving as the base for feat(docker): isolate workloads behind a companion supervisor #2965, feat(kubernetes): isolate workloads behind a dedicated supervisor #3144, feat(podman): isolate workloads behind a separate supervisor #3230, and perf(isolation): add TCP and DNS benchmark harnesses #3229.
• Docs: Existing architecture and Fern reference updates remain present; this patch-equivalent rebase adds no new direct UX contract.
• Checks: Current-head Branch Checks and required E2E are running; Helm Lint and Trivy Changes are green. Pipeline handoff is not active while convergence is blocked.
• E2E: test:e2e is already applied and current-head Branch E2E run 34801616236 is active; no current-head bot instruction requires /ok to test or a rerun.
• Head SHA: a8b780401e7e06273b1b32c4f5515957e344da08
• Base SHA: 0835f6908265111ad25f7751f9ca55337b11474f
• Merge base SHA: 0835f6908265111ad25f7751f9ca55337b11474f
• Patch ID: 03d2b4052d01f0e0a3ac9424b0d70329db609f46
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: b1bffcd38d3f4e04d68eeb9acd4d5e4acf9b79cc
• Review budget exhausted: yes
• Maintainer decision required: yes — GATOR-d88b8843-01 remains unresolved and unwaived.
• Next state: gator:blocked
• Blocked reason: review_convergence_decision_required

[johntmyers]

gator-agent

Maintainer Convergence Decision

Current head 717f28327275987b788c0d86218b780f46a8afbf is another force-rebase onto the updated #2942 base. Its author patch ID still matches the already-reviewed a8b780401e7e06273b1b32c4f5515957e344da08 patch, so there is no new effective VM-layer delta to review. The resolved identity obligation remains fixed, but one launch-contract obligation is unchanged and unwaived, so a maintainer decision remains required before this layer and downstream PRs #2965, #3144, #3230, and #3229 can proceed.

Root-cause findings:

• GATOR-d88b8843-01: the VM StartSandboxRequest handler still discards fresh launch_authentication and reprovisions from the create-time bundle in sandbox.pb; after that session is deactivated, a stopped VM cannot reliably return to Ready. Unresolved and unwaived.
• GATOR-d88b8843-02: the VM boundary, guest reconciliation, and host supervisor use the persisted image/overlay owner identity. Resolved; its Gator thread remains resolved after the rebase.

Scope growth:

• None. The effective PR feat(vm): run the supervisor outside the guest workload #2945 patch is unchanged; the stacked-base update adds Kubernetes runtime RBAC documentation and policy metadata without changing this VM restart-authentication obligation.

Reviewer-quality signals:

• No reviewer run was needed for this patch-equivalent rebase. Ledger telemetry remains 3 finding-bearing rounds, 2 unique findings, and 22 duplicate finding-ID occurrences across historical dispositions.

Maintainer action: decide whether supported VM stop/start must consume fresh StartSandboxRequest.launch_authentication. If yes, direct @drew to replace persisted launch authentication before reprovisioning and cover session A → stop → session B → successful Ready. If restart is intentionally unsupported for this VM layer, explicitly waive GATOR-d88b8843-01 and record that boundary.

Gator metadata

• Validation: Implements the VM driver layer of accepted RFC 0012 / feat: establish the Isolation Backend interface #1737, stacked on current feat(isolation): implement the RFC 0012 sandbox architecture #2942 and serving as the base for feat(docker): isolate workloads behind a companion supervisor #2965, feat(kubernetes): isolate workloads behind a dedicated supervisor #3144, feat(podman): isolate workloads behind a separate supervisor #3230, and perf(isolation): add TCP and DNS benchmark harnesses #3229.
• Docs: Existing architecture and Fern reference updates remain present; this patch-equivalent rebase adds no new direct UX contract.
• Checks: Current-head Branch Checks and required E2E are running; Helm Lint and Trivy Changes are green. Pipeline handoff is not active while convergence is blocked.
• E2E: test:e2e is already applied and current-head Branch E2E run 34804842056 is active; no current-head bot instruction requires /ok to test or a rerun.
• Head SHA: 717f28327275987b788c0d86218b780f46a8afbf
• Base SHA: 821ec38fc0229d31321aad88a9bc3ed3823e6a9e
• Merge base SHA: 821ec38fc0229d31321aad88a9bc3ed3823e6a9e
• Patch ID: 03d2b4052d01f0e0a3ac9424b0d70329db609f46
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: b1bffcd38d3f4e04d68eeb9acd4d5e4acf9b79cc
• Review budget exhausted: yes
• Maintainer decision required: yes — GATOR-d88b8843-01 remains unresolved and unwaived.
• Next state: gator:blocked
• Blocked reason: review_convergence_decision_required

[johntmyers]

gator-agent

Maintainer Convergence Decision

Current head f4deea5c3c475c194af2b4fcdf1d9ec9f48bf216 is another force-rebase onto the updated #2942 base. Its author patch ID still matches the already-reviewed 717f28327275987b788c0d86218b780f46a8afbf patch, so there is no new effective VM-layer delta to review. The resolved identity obligation remains fixed, but one launch-contract obligation is unchanged and unwaived, so a maintainer decision remains required before this layer and downstream PRs #2965, #3144, #3230, and #3229 can proceed.

Root-cause findings:

• GATOR-d88b8843-01: the VM StartSandboxRequest handler still discards fresh launch_authentication and reprovisions from the create-time bundle in sandbox.pb; after that session is deactivated, a stopped VM cannot reliably return to Ready. Unresolved and unwaived.
• GATOR-d88b8843-02: the VM boundary, guest reconciliation, and host supervisor use the persisted image/overlay owner identity. Resolved; its Gator thread remains resolved after the rebase.

Scope growth:

• None. The effective PR feat(vm): run the supervisor outside the guest workload #2945 patch is unchanged; the stacked-base update touches sandbox-backend runtime RBAC handling without changing this VM restart-authentication obligation or the six-PR RFC 0012 architecture.

Reviewer-quality signals:

• No reviewer run was needed for this patch-equivalent rebase. Ledger telemetry remains 3 finding-bearing rounds, 2 unique findings, and 24 duplicate finding-ID occurrences across historical dispositions.

Maintainer action: decide whether supported VM stop/start must consume fresh StartSandboxRequest.launch_authentication. If yes, direct @drew to replace persisted launch authentication before reprovisioning and cover session A → stop → session B → successful Ready. If restart is intentionally unsupported for this VM layer, explicitly waive GATOR-d88b8843-01 and record that boundary.

Gator metadata

• Validation: Implements the VM driver layer of accepted RFC 0012 / feat: establish the Isolation Backend interface #1737, stacked on current feat(isolation): implement the RFC 0012 sandbox architecture #2942 and serving as the base for feat(docker): isolate workloads behind a companion supervisor #2965, feat(kubernetes): isolate workloads behind a dedicated supervisor #3144, feat(podman): isolate workloads behind a separate supervisor #3230, and perf(isolation): add TCP and DNS benchmark harnesses #3229.
• Docs: Existing architecture and Fern reference updates remain present; this patch-equivalent rebase adds no new direct UX contract.
• Checks: Current-head Branch Checks and required E2E are running; Helm Lint and Trivy Changes are green. Pipeline handoff is not active while convergence is blocked.
• E2E: test:e2e is already applied and current-head Branch E2E run 34810068977 is active; no current-head bot instruction requires /ok to test or a rerun.
• Head SHA: f4deea5c3c475c194af2b4fcdf1d9ec9f48bf216
• Base SHA: d081b458ac4dbd8f4f4a4cf10d6a9ad75fcbb26a
• Merge base SHA: d081b458ac4dbd8f4f4a4cf10d6a9ad75fcbb26a
• Patch ID: 03d2b4052d01f0e0a3ac9424b0d70329db609f46
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: b1bffcd38d3f4e04d68eeb9acd4d5e4acf9b79cc
• Review budget exhausted: yes
• Maintainer decision required: yes — GATOR-d88b8843-01 remains unresolved and unwaived.
• Next state: gator:blocked
• Blocked reason: review_convergence_decision_required

[johntmyers]

gator-agent

PR Review Status

Thanks @drew. I checked the two new VM generation commits on current head 6b0457f8fbe755e6779fdba34e85c2cf9b17666d against the current #2942 stacked base and the contracts consumed by #2965, #3144, #3230, and #3229. Restart now validates the fresh start bundle, atomically replaces the persisted launch authentication before reprovisioning, and carries a stable start generation through VM boundary material. This resolves the remaining launch-authentication obligation, and the bounded critical-only review found no newly introduced Critical defect.

Blocking findings:

• No blocking findings remain.

Carried findings:

• None. GATOR-d88b8843-01 and GATOR-d88b8843-02 are resolved, and both Gator-owned threads are closed.

Gator metadata

• Validation: Implements the VM driver layer of accepted RFC 0012 / feat: establish the Isolation Backend interface #1737, stacked directly on current feat(isolation): implement the RFC 0012 sandbox architecture #2942 and serving as the base for the remaining four stack layers.
• Docs: Existing architecture and Fern reference updates cover the VM topology; the latest generation/authentication fix adds no separate direct UX contract.
• Checks: Current-head Branch Checks, Helm Lint, and Trivy Changes are green; required E2E is running.
• E2E: test:e2e is applied and current-head Branch E2E run 34814068077 is in progress. No current-head bot instruction requires /ok to test or a rerun.
• Head SHA: 6b0457f8fbe755e6779fdba34e85c2cf9b17666d
• Base SHA: 707cf0606bc18a1b38768c571810aaa1da320d2a
• Merge base SHA: 707cf0606bc18a1b38768c571810aaa1da320d2a
• Patch ID: f495d2941912d161f3f263fe7d3609c5be66d25c
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: b1bffcd38d3f4e04d68eeb9acd4d5e4acf9b79cc
• Review budget exhausted: yes
• Maintainer decision required: no — all prior findings are resolved, there is no qualifying scope growth, and no new Critical was found.
• Next state: gator:watch-pipeline

[johntmyers]

gator-agent

PR Review Status

Thanks @drew. I checked the new restored-session rotation commit on current head 0caeda261ed0321a11662ab3fd4e066cf1540352 against the current #2942 stacked base and the shared generation/session contracts consumed by downstream PRs #2965, #3144, #3230, and #3229. The change restarts an already-running restored VM before installing freshly minted launch authentication, and the bounded critical-only review found no newly introduced Critical defect.

Blocking findings:

• No blocking findings remain.

Carried findings:

• None. GATOR-d88b8843-01 and GATOR-d88b8843-02 remain resolved, and both Gator-owned threads are closed.

Gator metadata

• Validation: Implements the VM driver layer of accepted RFC 0012 / feat: establish the Isolation Backend interface #1737, stacked directly on current feat(isolation): implement the RFC 0012 sandbox architecture #2942 and serving as the base for the remaining four stack layers.
• Docs: Existing architecture and Fern reference updates cover the VM topology; this restored-session rotation delta adds no separate direct UX contract.
• Checks: Current-head Branch Checks and required E2E are in progress; Helm Lint and Trivy Changes are green.
• E2E: test:e2e is applied and current-head Branch E2E run 34816518643 is in progress. No current-head bot instruction requires /ok to test or a rerun.
• Head SHA: 0caeda261ed0321a11662ab3fd4e066cf1540352
• Base SHA: e882ac017fc1555a29ef267d28f5d1facc947d29
• Merge base SHA: e882ac017fc1555a29ef267d28f5d1facc947d29
• Patch ID: 93f3a0de998cd5aa94e91bf2562e90600bd6e138
• Gator payload: 8
• Review mode: critical_only
• Previous reviewed SHA: 6b0457f8fbe755e6779fdba34e85c2cf9b17666d
• Review budget exhausted: yes
• Maintainer decision required: no — all prior findings remain resolved, there is no qualifying scope growth, and no new Critical was found.
• Next state: gator:watch-pipeline