v2: complete lease, fencing, and authenticated proxy candidate #16

Open

bryce wants to merge 13 commits from feature/proxy-fencing-next into feature/artifacts-placement-next

bryce commented

2026-10-26 22:19:44 -05:00

Owner

Scope

Completes the source candidate for v2-remote-execution.proxy-fencing without changing formal workflow state or publishing v2.

durable signed lease renewal and permanent node expiry fencing
signed operation catalogs and connection-bound route assertions
real delegated-cgroup routing and post-dispatch identity checks
bounded node-originated mTLS proxy stream with server-owned challenge
explicit ready/accepted publication handshake
canonical response correlation, stale/mixed denial, one-use stream and shutdown custody

Evidence

executable candidate: e81d19b315cd2fe5583e57e139c1b91c62f4d6bd
evidence/review head: ac487e0c88651fc169300af66b06c0b64f5b6789
full repository PASS; kernel 621.747s
affected race partitions PASS
vet, SDK, FreeBSD production build, workflow/docs and source manifest PASS

See workflow/features/v2-remote-execution.proxy-fencing/evidence/candidate-2026-10-26.md. Independent cold review is still required before formal admission.

## Scope Completes the source candidate for `v2-remote-execution.proxy-fencing` without changing formal workflow state or publishing v2. - durable signed lease renewal and permanent node expiry fencing - signed operation catalogs and connection-bound route assertions - real delegated-cgroup routing and post-dispatch identity checks - bounded node-originated mTLS proxy stream with server-owned challenge - explicit ready/accepted publication handshake - canonical response correlation, stale/mixed denial, one-use stream and shutdown custody ## Evidence - executable candidate: `e81d19b315cd2fe5583e57e139c1b91c62f4d6bd` - evidence/review head: `ac487e0c88651fc169300af66b06c0b64f5b6789` - full repository PASS; kernel 621.747s - affected race partitions PASS - vet, SDK, FreeBSD production build, workflow/docs and source manifest PASS See `workflow/features/v2-remote-execution.proxy-fencing/evidence/candidate-2026-10-26.md`. Independent cold review is still required before formal admission.

bryce added 13 commits

2026-10-26 22:19:44 -05:00

feat(remote): add canonical lease renewal assertion da47c48c79

feat(remote): persist bounded lease renewals 6ac46c8071

feat(remote): sign durable lease renewals d10301481e

feat(remote): persist node lease renewals a4fb40554d

feat(remote): enforce node lease expiry 8f1edd826e

feat(remote): issue connection-bound route assertions debc91663e

feat(remote): bind and dispatch assigned operations f4df5db36f

test(remote): classify routed application denial stage 6cff80ef6e

fix(remote): publish assigned application manager 2c950cbc34

feat(remote): carry fenced proxy calls 8b48d124f1

test(remote): reject stale proxy responses 540c9dcd6d

fix(remote): publish proxy only after node readiness e81d19b315

docs(remote): record proxy fencing candidate evidence ac487e0c88

bryce requested review from linus

2026-10-26 22:20:05 -05:00

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin "feature/proxy-fencing-next:feature/proxy-fencing-next"

git switch "feature/proxy-fencing-next"

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.