Integrate controlled-session networking

[omry]

---

Stack created with Sapling. Best reviewed with ReviewStack.

• -> Integrate controlled-session networking #41
• Persist controlled-session network ownership #40
• Add controlled-session network adapter #39
• Plan controlled-session networking #38
• Retry controlled-session watchdog cleanup #37
• Persist controlled-session crash receipts #36
• Fail closed when session watchdog exits #35
• Launch controlled-session watchdog #34
• Prepare controlled-session cleanup manifest #33
• Record controlled-session resource ownership #32
• Prove controlled-session lifecycle in Docker #31
• Supervise controlled-session lifecycle #30
• Bridge controlled-session controller and workload I/O #29
• Add Docker controlled-session controller adapter #28
• Add Docker workload PTY adapter #27
• Add private controlled-session channel #26
• Freeze controlled-session execution plans #25
• Add bounded controlled-session PTY draining #24
• Enforce controlled-session output finalization #23
• Verify sandbox state on the execution thread #22
• Preserve base identity in direct installs #21
• Run application sandbox integration in CI #20
• Add controlled-session lifecycle state machine #18
• Add controlled-session framed protocol #17
• Define controlled-session authorization #16
• Make queued admission cancellation deterministic #15
• Enforce coarse application network policy #14
• Protect host system trees from runtime binds #13
• Enforce root host filesystem boundary #12
• Add container-local runtime identities #11
• Verify application sandbox at startup #10
• Harden application container identity and kernel policy #9
• Unify application sandbox planning #8
• Document controlled sessions and repositories #7

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3fbd0d2c3b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[omry]

@codex review

[omry]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cc7a2e9543

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[omry]

@codex review\n\nPlease review exact head f36126d after the exact-peer firewall and deny/deny DNS fixes.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f36126ddd7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[omry]

@codex review\n\nPlease review exact head e11e6d0 after preserving explicit ordinary network grants and correcting the existing release-note fragment.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e11e6d08c8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[omry]

@codex review\n\nPlease review exact head 7536f5a after binding inbound peer acceptance to both the exact peer source and exact lease-local destination.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: 7536f5a464

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".