v0.4 — SLURM job brokering

Your sandboxed agent can now submit and monitor SLURM jobs — without ever holding
the credentials to do it.

MUNGE and the network live in a trusted broker outside the sandbox. The agent
reaches it through a file spool and never gets a route to the scheduler. On a
machine without SLURM: no broker, no spool, no trace.

Highlights

• sbatch brokered. The broker doesn't forward the agent's command line — it
  builds the submission from an option allowlist. Unknown options, out-of-grammar
  values, getopt-glued short flags and --wrap all fail closed.
• Every job re-sandboxed on the compute node. Other users' homes hidden, root
  read-only, credentials masked, agent-config paths unplantable, network unshared —
  GPUs and NVLink still available.
• Read-only queries too — squeue, sinfo, sacct, sstat, sprio,
  sreport, sshare.
• One launcher. husk detects SLURM and brokers automatically.
• Fail-closed by construction. The agent only execs once the stub bind is
  verified; any setup failure aborts before it runs.

Install

tar xzf husk-v0.4.tar.gz && cd husk-v0.4
./install-husk.sh --slurm-partition <name>

The partition is forced onto every brokered job, so set it per machine —
Balfrin: preemptible · Santis: debug or shared. Pick a low-priority
queue where the site has one.

Verified

32/32 end-to-end on Balfrin (x86_64) and Santis (aarch64) — driven from the
trusted side, with the caged job's evidence read out-of-band rather than
self-reported.

Scope

Single node, no MPI. srun from inside a job is next — see ROADMAP.md.