Part of #830. The epic's merge-readiness gate: multi-login isolation + negative cross-user proxy access; hard-kill containment with a non-cooperative raw executable (per-user) + per-machine per-platform containment proof (systemd cgroup kill; Windows Job-Object wrapper); cold reboot at the unlink/recreate interval; unattended-reboot proofs on real systemd AND Windows SCM from switching/starting/rolling-back; cross-session update; two-app port policy; proves SD-5/SD-6 in flow.
Depends on: #832 #831 #833 #834 #835 #836 #837.
Design source: PR #822 (rfc.md + plan.md rev 10, 9-cycle adversarial trail) in .llm/runs/rfc-single-deployment--orchestrator/.
Part of #830. The epic's merge-readiness gate: multi-login isolation + negative cross-user proxy access; hard-kill containment with a non-cooperative raw executable (per-user) + per-machine per-platform containment proof (systemd cgroup kill; Windows Job-Object wrapper); cold reboot at the unlink/recreate interval; unattended-reboot proofs on real systemd AND Windows SCM from
switching/starting/rolling-back; cross-session update; two-app port policy; proves SD-5/SD-6 in flow.Depends on: #832 #831 #833 #834 #835 #836 #837.
e2e-cli-prodDesign source: PR #822 (
rfc.md+plan.mdrev 10, 9-cycle adversarial trail) in.llm/runs/rfc-single-deployment--orchestrator/.