feat(docker): isolate workloads behind a companion supervisor - #2965

Merged

drew merged 19 commits into

codex/1737-rfc12-supervisor-primitivesfrom

codex/docker-host-supervisor

Sep 14, 2026

Commits on Sep 14, 2026

feat(docker): isolate workloads behind the host supervisor
drew
committed
8920181
feat(docker): rotate launch-scoped authentication
drew
committed
326f95e
refactor(docker): use sandbox backend protocol
drew
committed
7398c85
refactor(docker): use host networking for supervisor
drew
committed
eaa76f3
fix(docker): preserve host gateway alias resolution
drew
committed
2ace69d
feat(docker): use separate sandbox and supervisor images
drew
committed
dccdcbb
fix(docker): restore startup validation after rebase
drew
committed
ebd2cd2
refactor(docker): name the sandbox runtime directly
drew
committed
5857b3f
fix(docker): narrow supervisor CA runtime storage
drew
committed
ecab00b
fix(docker): close companion isolation gaps
drew
committed
9d25f43
test(docker): align mediated network expectations
drew
committed
2ecaa26
test(docker): exercise mediated network paths
drew
committed
2f84c20
fix(docker): attach supervisor to managed network
drew
committed
b8b7bb9
fix(docker): defer supervisor recovery until gateway is ready
drew
committed
0b177d8
fix(docker): make sandbox starts generation-aware
drew
committed
c78c5d1
fix(docker): rotate restored sandbox sessions
drew
committed
52a68f1
fix(docker): preserve workloads during session rotation
drew
committed
93355c2
refactor(docker): remove unrelated configuration RFC changes
drew
committed
6e067df
fix(docker): bind sandbox session lineage
drew
committed
a3ff2e7