Prepare controlled-session cleanup manifest

[omry]

Summary

• derive an immutable cleanup manifest from durably recorded session ownership
• bind it to the exact prepared containers and private channel before startup
• keep absent lease networks and volumes explicit and reject later resource selection
• use strict canonical encoding without a separate schema-version marker

Why

The upcoming short-lived watchdog must receive a frozen cleanup target instead of accepting resource choices after startup.

Validation

• full Go test suite
• focused race-enabled ownership and manifest tests
• live Docker controlled-session integration test

---

• -> Prepare controlled-session cleanup manifest #33
• Record controlled-session resource ownership #32
• Prove controlled-session lifecycle in Docker #31
• Supervise controlled-session lifecycle #30
• Bridge controlled-session controller and workload I/O #29
• Add Docker controlled-session controller adapter #28
• Add Docker workload PTY adapter #27
• Add private controlled-session channel #26
• Freeze controlled-session execution plans #25
• Add bounded controlled-session PTY draining #24
• Enforce controlled-session output finalization #23
• Verify sandbox state on the execution thread #22
• Preserve base identity in direct installs #21
• Run application sandbox integration in CI #20
• Add controlled-session lifecycle state machine #18
• Add controlled-session framed protocol #17
• Define controlled-session authorization #16
• Make queued admission cancellation deterministic #15
• Enforce coarse application network policy #14
• Protect host system trees from runtime binds #13
• Enforce root host filesystem boundary #12
• Add container-local runtime identities #11
• Verify application sandbox at startup #10
• Harden application container identity and kernel policy #9
• Unify application sandbox planning #8
• Document controlled sessions and repositories #7

[omry]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: ed5f4a187b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[omry]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: da288dd3a3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".