v3.2.7

What's Changed

• fix(sandbox): setgroups deny + euid rootfs prepare for setpriv CI by @emigmo in #333
• docs: post-release Sandbox GA host prep on website for v3.2.6 by @ZhiXiao-Lin in #334
• chore(deps): pin OCI Runtime to 931def0 for -Dwarnings agent build by @emigmo in #335
• feat: Box-owned Linux KVM OCI owner ensure (qualification-only) by @ZhiXiao-Lin in #336
• feat: Box-owned Windows WHPX OCI owner ensure (qualification-only) by @ZhiXiao-Lin in #337
• feat: force supervised create for Box-owned native Sandbox Host by @ZhiXiao-Lin in #338
• feat: reap orphaned supervised sessions on fresh Host ensure by @ZhiXiao-Lin in #339
• feat: reap KVM session-owner orphans on fresh Host ensure by @ZhiXiao-Lin in #340
• feat: fail-closed operator setuid launcher + evidence gate by @ZhiXiao-Lin in #341
• feat: fail-closed verifier for setuid launcher proof reports by @ZhiXiao-Lin in #343
• feat: journal keyed guest filesystem mutations for one retry by @ZhiXiao-Lin in #344
• fix: deliver MicroVM filesystem retry on the session path by @ZhiXiao-Lin in #345
• feat: keyed MicroVM file-upload journals + download transport retry by @ZhiXiao-Lin in #346
• test: fail-closed MicroVM transport-retry honesty gate by @ZhiXiao-Lin in #347
• feat: preserve file/FS request_id on Unavailable for retry by @ZhiXiao-Lin in #348
• test: require keyed file-upload identity in Live-session quals by @ZhiXiao-Lin in #349
• test: cross-process filesystem-session recovery fixture by @ZhiXiao-Lin in #350
• feat: Live v6/v4 keyed MakeDir continuity across owner reopen by @ZhiXiao-Lin in #351
• test: fail-closed Live-session tip schema alignment by @ZhiXiao-Lin in #352
• feat: return minted fs-* request_id on mutate success by @ZhiXiao-Lin in #353
• test: lock language SDK mutate request_id success and Unavailable retry by @ZhiXiao-Lin in #354
• docs(ci): label Native Live evidence as tip schema v6 by @ZhiXiao-Lin in #355
• test: lock Move/Remove Unavailable request_id retry across SDKs by @ZhiXiao-Lin in #356
• test: journal Move/Remove across process-restart filesystem fixture by @ZhiXiao-Lin in #357
• feat: Live v7/v5 keyed Move/Remove continuity across owner reopen by @ZhiXiao-Lin in #358
• docs: publish CI-greened Native Live v7 report digests by @ZhiXiao-Lin in #369
• fix(cli): force-rm/kill/stop abandoned Creating/Starting claims (#372) by @ZhiXiao-Lin in #375
• fix(network): stop TSI auto-publishing unpublished guest listeners (#371) by @ZhiXiao-Lin in #377
• fix(pool): reap orphan MicroVMs on pool start (#373) by @ZhiXiao-Lin in #376
• fix(runtime): keep unpublished MicroVM listeners in-guest for scale relay (#370) by @ZhiXiao-Lin in #378
• fix(runtime): publish R17 Service endpoints only after live URL probe by @ZhiXiao-Lin in #379
• fix(runtime): retire Service on failed R17 advertise probe during apply by @ZhiXiao-Lin in #380
• fix(scale): withdraw ready leases when advertised URL stops answering by @ZhiXiao-Lin in #381
• fix(runtime): re-probe retained R17 advertised URLs by @ZhiXiao-Lin in #382
• fix(runtime): retire R17 Service when inspect cannot re-prove endpoints by @ZhiXiao-Lin in #383
• fix(cli): reap home-fenced orphan shims on pool stop by @ZhiXiao-Lin in #384
• fix(cli): observe managed Starting before inspect/ps/prune by @ZhiXiao-Lin in #386
• fix(cli): wait honesty for managed Starting (no invent exit 0) by @ZhiXiao-Lin in #387
• fix(cli): observe abandoned managed Killing before inventory by @ZhiXiao-Lin in #388
• fix(cli): observe abandoned managed Pausing/Resuming before inventory by @ZhiXiao-Lin in #389
• fix(cli): resume abandoned managed Removing via remove-retry by @ZhiXiao-Lin in #390
• fix(cli,runtime): observe abandoned Snapshotting/UpdatingResources by @ZhiXiao-Lin in #391
• fix(cli): resume abandoned RestartStopping/RestartStarting via reconcile by @ZhiXiao-Lin in #392
• fix(cli): refresh inventory observe on info/df/events/compose wait by @ZhiXiao-Lin in #393
• fix(cli): refresh inventory observe on compose ps/logs by @ZhiXiao-Lin in #394
• fix(cli): refresh inventory observe on stats/top/port by @ZhiXiao-Lin in #395
• fix(cli): refresh inventory observe on logs/attach by @ZhiXiao-Lin in #396
• fix(cli): refuse invented wait exit 0 after managed terminal retire by @ZhiXiao-Lin in #397
• fix(cli): observe inventory in monitor; health fail-closed by @ZhiXiao-Lin in #398
• fix(cli): refresh inventory observe on exec/shell/cp by @ZhiXiao-Lin in #399
• fix(cli): stop inventing inspect ExitCode 0 when exit absent by @ZhiXiao-Lin in #400
• fix(runtime): refuse inventing Service Stopped when Failed exit absent by @ZhiXiao-Lin in #401
• fix(cli): refuse inventing Windows reconcile exit when guest result absent by @ZhiXiao-Lin in #402
• fix(cri): refuse inventing SPDY exec success without authenticated exit by @ZhiXiao-Lin in #403
• fix(runtime): refuse inventing guest exit 0 from clean provider when terminal absent by @ZhiXiao-Lin in #404
• fix(runtime): refuse inventing boot delayed exit from provider zero by @ZhiXiao-Lin in #405
• fix(runtime): refuse inventing Windows live boot-stop exit from provider zero by @ZhiXiao-Lin in #406
• fix(runtime): refuse inventing Windows destroy exit from provider zero by @ZhiXiao-Lin in #407
• fix(runtime): refuse inventing Windows exec-ready success on provider exit by @ZhiXiao-Lin in #408
• fix(runtime): refuse inventing managed terminal Stopped from cached shim zero by @ZhiXiao-Lin in #409
• fix(runtime): refuse inventing VmManager success from cached shim zero by @ZhiXiao-Lin in #410
• fix(runtime): refuse inventing Unix exec-ready Ready from guest exit before heartbeat by @ZhiXiao-Lin in #411
• fix(runtime): refuse inventing Windows Ready/Running from exec path presence by @ZhiXiao-Lin in #412
• fix(runtime): refuse inventing Ready from attach without exec heartbeat by @ZhiXiao-Lin in #413
• fix(runtime): refuse inventing Ready from Unix restore soft-probe without heartbeat by @ZhiXiao-Lin in #414
• fix(runtime): refuse inventing Ready from Sandbox recover without exec heartbeat by @ZhiXiao-Lin in #415
• fix(runtime): refuse inventing Running from start when boot left Created by @ZhiXiao-Lin in #416
• fix(runtime): refuse inventing Running/Paused from Pausing/Resuming + Creating by @ZhiXiao-Lin in #417
• fix(runtime): retain authenticated ExecClient in promote_if_ready by @ZhiXiao-Lin in #418
• fix(runtime): require exec heartbeat to sustain Ready health by @ZhiXiao-Lin in #419
• fix(runtime): require named-pipe heartbeat to sustain Windows Ready health by @ZhiXiao-Lin in #420
• fix(runtime): re-prove exec health before trusting Ready for start by @ZhiXiao-Lin in #421
• fix(runtime): require Ready before inventing LocalExecutionHandle (#422) by @ZhiXiao-Lin in #422
• fix(runtime): re-prove exec health before WarmPool idle acquire (#423) by @ZhiXiao-Lin in #423
• fix(runtime): demote MicroVM pause to Paused and re-auth on resume (#424) by @ZhiXiao-Lin in #424
• fix(runtime): refuse Windows Ready without retained exec auth proof (#425) by @ZhiXiao-Lin in #426
• fix(runtime): refuse scale Ready from inspect Running alone (#427) by @ZhiXiao-Lin in #427
• fix(cri): refuse Sandbox Ready without authenticated VM Ready by @ZhiXiao-Lin in #428
• fix(runtime): refuse WarmPool idle release without exec re-auth by @ZhiXiao-Lin in #429
• fix(runtime): refuse Sandbox Ready without authenticated exec wait by @ZhiXiao-Lin in #430
• fix(cri): refuse PodSandboxStatus Ready without VM health re-proof by @ZhiXiao-Lin in #431
• fix(cri): refuse ListPodSandbox Ready without VM health re-proof by @ZhiXiao-Lin in #432
• fix(runtime): refuse maintenance Ready without boot-completion proof by @ZhiXiao-Lin in #433
• fix(cri): refuse ContainerRunning without sandbox VM health re-proof by @ZhiXiao-Lin in #434
• fix(cri): refuse Status Ready/Running counts without VM health re-proof by @ZhiXiao-Lin in #435
• fix(cri): refuse ListPodSandboxMetrics Ready/Running without VM health re-proof by @ZhiXiao-Lin in #436
• fix(cri): refuse CreateContainer Ready without VM health re-proof by @ZhiXiao-Lin in #437
• fix(cri): refuse Exec/Attach Running without VM health re-proof by @ZhiXiao-Lin in #438
• test(cri): attach stdin/TTY gates need authenticated VM after #438 by @ZhiXiao-Lin in #439
• test(cri): UpdateContainerResources Unimplemented gate needs auth VM by @ZhiXiao-Lin in #440
• fix(cri): refuse StartContainer inventing already-running without VM health by @ZhiXiao-Lin in #441
• fix(cri): refuse ContainerStats Running without VM health re-proof by @ZhiXiao-Lin in #442
• fix(cri): refuse PodSandboxStats Ready/Running without VM health (#443) by @ZhiXiao-Lin in #443
• fix(cri): refuse inventable Ready/Running on Stop/Remove/Create (#444) by @ZhiXiao-Lin in #444
• fix(cri): refuse inventable Running on RemoveContainer/StopContainer (#445/#446) by @ZhiXiao-Lin in #445
• fix(cri): refuse inventable ReopenContainerLog without VM health (#447) by @ZhiXiao-Lin in #449
• fix(cri): refuse inventing SIGKILL for Created on StopPodSandbox (#448) by @ZhiXiao-Lin in #450
• fix(cri): refuse inventing exit 255 for Created on load_state (#449) by @ZhiXiao-Lin in #451
• fix(cri): refuse inventing VM usage from PID without health (#450) by @ZhiXiao-Lin in #452
• fix(cri): refuse inventing UpdatePodSandboxResources Ok for unsupported resize by @ZhiXiao-Lin in #453
• fix(cri): refuse inventing UpdateRuntimeConfig Ok for ignored pod_cidr by @ZhiXiao-Lin in #457
• fix(dns): filter host loopback stubs from guest resolv.conf (#455) by @ZhiXiao-Lin in #459
• fix(guest-init): avoid TSI port-forward recv/send deadlock (#446) by @ZhiXiao-Lin in #460
• fix(cli): make snapshot rm/inspect honest like restore (#456) by @ZhiXiao-Lin in #463
• fix(cri): refuse inventing PullImage anonymous fallback for unused token auth by @ZhiXiao-Lin in #458
• docs: align ROADMAP a3s-runtime pin with workspace lock by @ZhiXiao-Lin in #467
• fix(tsi): hairpin in-guest loopback to published -p ports (#448) by @ZhiXiao-Lin in #465
• fix(network): keep peer bridge and surface passt backend loss (#454) by @ZhiXiao-Lin in #461
• fix(runtime): advertise NetworkMode::Outbound only on MicroVM (#172) by @ZhiXiao-Lin in #466
• fix(runtime): advertise Outbound only on MicroVM TSI (#172) by @ZhiXiao-Lin in #468
• docs(runtime): document Outbound as MicroVM/TSI-only by @ZhiXiao-Lin in #469
• release: prepare a3s-box 3.2.7 by @ZhiXiao-Lin in #470

Full Changelog: v3.2.6...v3.2.7