Перейти к содержанию

Quarshell — актуальный остаток

Дата: 2026-10-23 (актуализация после 05:17 Samara)

Приоритет текущей работы

Актуальное продолжение M6c (23 октября 2026)

  • Исправлен host/guest supervisor control transport: из-за CLONE_NEWNS исходящий Unix connect из VM worker получал EACCES. Гость теперь принимает control соединение через vsock; host forwarder соединяет libkrun worker-side Unix listener с отдельным mTLS endpoint proxy. Разделение worker/proxy socket paths исключает конфликт владельцев listener.
  • На локальном Apple Silicon выполнен полный task vm:live-darwin: TestLiveMicroVMLifecycle, TestLiveLocalOCIEngineImport и Gateway TestLiveVMWatchSandboxComposition PASS. Проверены HVF boot/recovery, policy egress/revoke, supervisor mTLS/Gateway flow, OCI, worker/broker loss и shutdown.
  • Изменение в 00c52da опубликовано в master. Hosted matrix: push run и KVM follow-up; Linux/KVM acceptance ещё выполняется. Windows MXC runner собрал Windows VM/driver, но native MXC остаётся недоступен без SDK/runtime.

По запросу владельца репозитория сначала закрывается весь VM-функционал из закреплённого OpenShell v0.1.4, включая связанный Gateway/runtime контракт. Источник объёма работ — quarshell-driver-vm/vm/testdata/openshell-v0.1.4-parity.json и закреплённый checkout tools/upstream/openshell-v0.1.4; статус G04 сам по себе не означает полный VM parity. Остальные M-пункты не вытесняют этот приоритет до разбора всех VM parity rows. Inventory: 25 implemented, 3 partial, 0 blocked, 2 unsupported, 0 open. Локальный task vm:live-darwin на Mac PASS: TestLiveMicroVMLifecycle подтвердил HVF lifecycle, retained TTY, Gateway supervisor flow, естественное завершение и KILL канонического workload process group с сообщённым кодом 137. Linux ARM64 guest process-group regression test PASS в Docker; task test, task fmt:check, task vm:parity-check, task compat:proto, buf lint из quarshell-proto и git diff --check PASS. Foreground create подключает CLI через SDK/Gateway к retained canonical main TTY; allowlisted TERM/KILL/INT/HUP работает через authenticated VM control channel и Gateway extension. Hosted KVM run 39903797087 установил причину незавершённого mTLS control handshake: libkrun guest-to-host UnixProxy::connect к port 5503 получает EACCES: Permission denied, поэтому TLS listener не видит подключений. Follow-up run 39905259599 проверяет права и владельцев каждого компонента socket path внутри VM worker user namespace; live acceptance ещё выполняется. Остаются три partial VM parity rows: host-side BoundaryProcess/RunningBoundary, non-TTY main-process attachment, точная replica/session replay семантика. GPU/VFIO требуют физического оборудования и остаются unsupported.

Статусы: [x] готово, [~] частично, [ ] не начато/заблокировано.

VM parity: остаток по строкам

Строка Уже проверено Что ещё нужно для полного parity
vm.ssh-connect Живые SSH relay и direct TCP forward на HVF; Gateway relay; durable owner lease/UUID survives Gateway reopen, conflicting instance rejected, higher epoch reconnect accepted; every SSH/TCP/peer relay validates the shared durable owner at open and active streams are closed within 250 ms after owner handoff; exit RPCs validate the owner too; canonical guest main TTY reattaches through a new VM Driver to the same PID Совместить SSH attach owner handoff и session replay с upstream supervisor replica semantics
vm.host-supervisor-isolation Production descriptor-bound attach/confirm/start gate и HVF identity/mTLS acceptance; exec и canonical main-process PTY сохраняют stable IDs, ввод/resize и attach того же процесса после потери stream или пересоздания VM Driver; foreground CLI подключается к canonical PTY через Quarshell RPC extension; canonical main workload принимает TERM/KILL/INT/HUP через authenticated VM control и Gateway RPC Завершить upstream host-side BoundaryProcess/RunningBoundary handle и attachment parity для workload без TTY; полный live KVM прогон также блокирует незакрытый mTLS control handshake
vm.host-supervisor-bootstrap Generation-bound credential bundle, JWT validation, reconnect/refresh plumbing, Gateway create/start/stop/restart smoke, durable 45-second supervisor owner/session UUID record, higher-epoch reconnect and replay rejection across SQLite Gateway reopen, stale Gateway data-plane owner fencing Host-side supervisor process bootstrap and exact upstream replica/session lifecycle replay semantics
vm.gpu-vfio-inventory-allocation Unsupported capability is rejected before VM side effects Physical GPU/VFIO host required
vm.gpu-vfio-crash-recovery Explicitly unsupported; no claim of allocation/recovery parity Physical GPU/VFIO host and device recovery tests required

Что уже зелёное

  • vm.exec-pty-signals закрыт: Gateway durably maps an unchanged TTY request_id to a stable VM session ID and reattaches the same guest process after stream loss; a changed payload hash remains fenced. Driver ExecTerminalAttach and detached terminate use the same guest process handle. Detached output is capped at 256 KiB, completed session state expires after 15 minutes, and the guest holds at most 256 retained PTY sessions. Gateway admission/reopen and reconnect tests pass; Linux ARM64 guest-agent suite and Apple Silicon/HVF live acceptance prove reattach/terminate through a fresh VM driver. См. VM retained PTY evidence.

  • Policy: conformance 71/71, differential 71/71, parser/validation/evaluator.

  • Gateway: lifecycle stores (memory/Postgres/SQLite), use cases, HTTP API, gRPC surface для workspace/sandbox/policy chunks/templates/settings/providers/services.
  • Legacy httpapi, cmd/cautem-gateway и stale duplicate worktrees удалены.
  • Docker: live create/start/stop/delete, resources/GPU, rootless config, egress pass-through, PTY, logs, daemon reconcile.
  • macOS CI на GitHub-hosted macos-14: build-test PASS (final snapshot).
  • Linux CI на GitHub-hosted ubuntu-24.04: workspace/DAG, Linux isolation build, полный task test, conformance 71/71 PASS (final snapshot).
  • Docker и полный Podman acceptance на GitHub-hosted Linux PASS (run): rootful/rootless lifecycle, userns/binds, map ownership, proxy/network probes и rootless recovery. Rootful no-map пропущен ожидаемо как rootless-only; rootless private пропущен как неподдерживаемый explicit map mode.
  • Release dry-run и GitHub release workflow: cross-build PASS.
  • Helm chart: helm lint/helm template PASS.
  • SDK/CLI tests, TS bindings build PASS.
  • Evidence/DAG/workspace gates зелёные; standalone 20/20.

M5 — gateway

  • [~] Полный 83-RPC parity.
  • Готово: Health/Info, workspace, sandbox, bounded one-shot ExecSandbox для Docker/VM с timeout/stdin/env/output/exit; interactive TTY ExecSandboxInteractive для Docker/VM с stdin, half-close, resize, streamed output и exit; policy chunks/revision listing/status, templates, settings, provider definitions, sandbox provider listing, services.
  • В работе: HTTP token issue/refresh привязаны к durable runtime launch generation, отдельному от API Generation; каждый Gateway Start транзакционно увеличивает runtime generation и credential epoch, создаёт Gateway-owned session UUID, а reconcile переиспользует сохранённую launch identity. Gateway передаёт парные Gateway/Sandbox bearers, expiry, OpenShell runtime generation (g + 16 hex digits), session UUID, rotation, Gateway ID и verification keys через RuntimeCredentialStarter. VM доставляет verification-key bundle в root-owned guest control directory по аутентифицированному vsock до workload start. Гостевой supervisor проверяет права, JSON schema, уникальность key IDs и Ed25519 PEM, затем до старта workload проверяет Sandbox JWT подпись, JOSE-профиль, issuer/audience, sandbox ID, generation, auth epoch, component и временные claims. Токен, Gateway ID и key-file path удаляются из env workload. Session credentials подписываются Ed25519/EdDSA с OpenShell JOSE types и exact claims set; workspace не сериализуется, sandbox ID глобально уникален. VM использует те же generation/session claims в mTLS identity и mode-0600 SupervisorAuthBundle upstream JSON schema; bundle удаляется вместе с broker. Добавлены generation-scoped sandbox auth interceptors, ConnectSupervisor, RelayStream и loopback relay validation. Epoch подписывается в bearer и проверяется на refresh/control/relay. Gateway bearer обслуживает Gateway API, Sandbox bearer передаётся в host proxy relay для ConnectSupervisor/RelayStream; refresh обновляет оба bearer в relay, proxy server и Gateway SDK HTTP/gRPC clients. Проверка JWT пока выполняется только при старте supervisor, последующая ротация/replay semantics не реализованы. Authenticated host backend lifecycle отсутствует. Runtime validator остаётся fail-closed до end-to-end host/guest isolation handshake; bootstrap IssueSandboxToken остаётся fail-closed.
  • Частично: provider attach/detach/readiness, peer relay/report, logs/watch, вспомогательные supervisor status/config RPC, global policy history и часть policy analysis/config RPC. ReportMainProcessExit/FinalizeMainProcessExit теперь принимают только sandbox bearer от текущего supervisor instance и durable runtime generation; результат сохраняется идемпотентно, finalize закрывает supervisor owner. Gateway WatchSandbox поддерживает snapshot, bounded log/event replay, live logs/status/platform events, фильтры и общий per-sandbox cursor с merge/replay для логов и событий; cursor epoch хранится в durable lifecycle store, поэтому сохраняется после Gateway restart при том же store. Watcher опрашивает durable окно каждую секунду и подхватывает записи, опубликованные через другой Gateway instance с тем же store. VM state-store watches теперь опрашивают общий state directory, поэтому каждый активный Gateway observer видит межпроцессные lifecycle updates; если WatchSandbox не подписан, история событий не накапливается, а промежуточные статусы могут объединяться между опросами. VM state-store feed и Gateway event bridge перенесены. Unary и interactive exec атомарно резервируют непустой request_id в durable lifecycle store до запуска runtime: повторный ID не запускает команду ещё раз, неизвестный исход остаётся fenced, а подтверждённый terminal result удерживается 24 часа. Interactive non-TTY VM exec передаёт stdin/EOF, отдельные stdout/stderr и exit status; Gateway unit/RPC tests, Linux guest-agent tests and live macOS/HVF guest acceptance pass. PTY supports resize, Ctrl+C and allowlisted process-group signals over authenticated guest control; remaining vm.exec-pty-signals parity is retained process handles with attach/repeated wait/terminate semantics and its Gateway integration.
  • Оставшиеся runtime methods fail-closed Unimplemented/501. gRPC unary/stream interceptors проверяют общий QUARSHELL_TOKEN, а GetCurrentUser выдаёт статическую identity gateway-client; OIDC/per-user/sandbox claims, scope authorization и TLS остаются непокрыты, поэтому gRPC следует держать на loopback или доверенной private network.
  • [~] Runtime observed-activation wiring.
  • [~] Multi-gateway: shared lease store и cross-process peer RPC.
  • [~] Добавлен gRPC status fixture на все 83 public RPC: status проверяется через реальные generated handlers, новые методы без fixture падают; functional fixtures с валидными use cases для каждого RPC ещё нужны.

M6 — runtime backends

  • [~] M6a Docker/Podman
  • Готово: Docker lifecycle, resources, rootless config, main-process and exec PTY, logs, reconcile; GitHub-hosted Linux Docker и rootful/rootless Podman acceptance PASS, включая userns/binds.
  • Egress доказан в ограниченном hosted профиле: allowed upstream CONNECT, deny TCP/UDP, прямой host-gateway bypass (Docker IPv4/IPv6, Podman rootful/rootless и proxy-down) закрыт; см. plans/evidence/runs/hosted-linux-acceptance-2026-10-22.md.
  • Добавлен filtered Engine PlatformEventStream для Docker/Podman с отказом от сырых actor attributes; mapping/cancel tests PASS. GitHub run 39684405826 подтвердил live Docker exec_create и Podman exec delivery.
  • Осталось: полный backend parity и host-level socket/DNS/UDS bypass.
  • [~] M6b Kubernetes
  • Готово: adapter, --runtime kubernetes, gateway-managed workspace, config plumbing.
  • Добавлен Kubernetes PlatformEventStream поверх Agent Sandbox LIST/WATCH с reconnect/relist; события привязаны к immutable runtime UID, проверяется gateway ownership, произвольные CR labels/annotations/condition messages не передаются. Driver tests + race tests и hosted Linux/macOS acceptance PASS; live cluster lane ещё нужен.
  • Осталось: RBAC/namespace, NetworkPolicy enforcement, GPU/CDI, logs/exec, persistent workspace verification, cleanup after API outage, live cluster.
  • [~] M6c VM (KVM/HVF)
  • На локальном Apple Silicon Mac прошёл реальный HVF TestLiveMicroVMLifecycle (task vm:live-darwin), включая boot/readiness, policy egress/revision ACK, ownership, recovery, registry pull, worker/broker loss и shutdown; подробности: plans/evidence/runs/vm-hvf-local-2026-10-22.md.
  • Повторный полный task vm:live-darwin на текущем product snapshot fc2f532 прошёл 2026-10-23 00:02 Samara: VM lifecycle 24.57 s, OCI import 1.15 s, Gateway watch + CLI archive transfer 11.68 s. GitHub platform matrix 39845031428 PASS на Windows/macOS/Linux; Linux live KVM acceptance корректно пропущен, потому что runner не имеет закреплённого runtime bundle/trust lock, macOS hosted не имеет HVF.
  • Latest local Mac acceptance после Gateway PTY и supervisor lease изменений, 2026-10-23 00:26 Samara: task vm:live-darwin PASS (HVF lifecycle 23.35 s, OCI import 1.12 s, Gateway watch/PTY/CLI composition 12.11 s). VM parity: 24 implemented, 4 partial, 2 physical GPU/VFIO unsupported.
  • VM PTY process handle продолжен: stable ID, attach к тому же guest PID после потери stream, ограниченный detached output и terminate по ID без активного подключения. Полный Linux ARM64 guest-agent набор в Linux container и Apple Silicon/HVF live acceptance прошли; свежий Driver instance с прежним state directory attach-ит тот же процесс. task test, task vm:parity-check, task fmt:check проходят.
  • Gateway-facing TTY reconnect is wired through durable exec admission: Gateway stores the VM session ID with the request hash and a repeated identical TTY request_id attaches to that process after stream loss. Changed payloads and executions whose session ID has not been durably recorded stay fenced; non-attachable runtimes retain the prior duplicate rejection. TestExecSandboxInteractiveReattachesOnDuplicateTTYRequestID, SQLite reopen, focused -race, and real Gateway→HVF disconnect/reconnect acceptance pass. vm.exec-pty-signals moves to implemented; inventory is 25 implemented, 3 partial, 2 hardware-specific unsupported. Latest live run (2026-10-23 01:04): VM 24.27 s, OCI 1.11 s, Gateway composition 9.52 s. Supervisor-owned main process/SSH attach remains open.
  • Canonical main workload TTY now launches under a retained guest PTY; the session ID is stored in private VM state, the process group receives foreground terminal ownership, and OpenMainProcessTTY reattaches after a transport loss or new VM Driver. Local Apple Silicon/HVF acceptance exchanges input/output, verifies resize to 101×41 and the same process PID after reattach. Latest run (2026-10-23 02:13): VM 24.75 s, OCI 1.17 s, Gateway watch composition 9.23 s. Upstream host-side RunningBoundary and initial AwaitMainProcessAttachment handshake remain partial; inventory is 25 implemented, 3 partial, 2 hardware-specific unsupported.
  • CreateSandboxRequest.await_main_process_attachment теперь проходит через durable Gateway record и backend launch spec в guest start request. Linux guest удерживает завершившийся TTY workload и его PTY output/exit до первого позднего attachment и закрытия канала, затем выключает VM; HVF acceptance проверяет короткий процесс, вышедший до подключения, сохранённый вывод и выключение после закрытия PTY. Полный локальный task vm:live-darwin прошёл 2026-10-23 02:25 (VM 22.66 s, OCI 1.14 s, Gateway composition 8.79 s). Остаются workload без TTY и upstream host-side RunningBoundary; inventory остаётся 25 implemented, 3 partial, 2 hardware-specific unsupported.
  • Hosted verification for aee7898: Linux, macOS, platform-backends, and secret-scan all PASS. Linux Docker/Podman and workspace tests pass; hosted VM package builds/tests pass on Linux, macOS and Windows. The Linux runner exposes a readable/writable /dev/kvm, but lacks a compatible libkrun runtime bundle and approved digest lock; hosted macOS lacks HVF, and Windows lacks MXC SDK. Local full workspace task test, task docs:strict, parity inventory, task fmt:check, and git diff --check also PASS.
  • VM backend, worker/guest-agent binaries, guest agent, OCI/rootfs, PTY/recovery и parity inventory вынесены в отдельный модуль quarshell-driver-vm, подключённый в Gateway composition root; это сохраняет однонаправленную зависимость VM → driver. После переноса повторно прошёл реальный macOS ARM64/HVF lifecycle acceptance; функциональный parity остаётся неполным.
  • Gateway sandbox create передаёт network configuration backend, а Start/Stop вызывают backend lifecycle после фиксации durable intent; startup reconcile повторно запускает sandbox с persisted running intent, если runtime потерял процесс. Gateway host preflight проверяет гипервизор, изоляцию worker, runtime assets и подпись macOS worker, затем VM Start использует production isolation.Registry для descriptor-bound Attach → Confirm → Start до открытия гостевого workload gate.
  • Требование переноса — вся VM-функциональность OpenShell v0.1.4: 29 upstream parity features плюс отдельная supplemental-строка host-supervisor bootstrap gap. Всего 30 entries: 25 implemented, 3 partial, 0 blocked, 2 hardware-specific unsupported, 0 open; task vm:parity-check проверяет pinned source anchors и наличие evidence files/symbols. Managed install и upgrade/rollback закрыты: install-vm-runtime.sh, rollback-vm-runtime.sh, task vm:install-check.
  • При запуске VM атомарно публикуется и повторно проверяется private isolation descriptor, привязанный к sandbox/session/generation, runtime/rootfs digest и mTLS credential files. Live HVF acceptance подтверждает descriptor из production lifecycle, сохранение generation при worker adoption и rotation generation при явном Stop/Start.
  • Gateway VM adapter выбирает persistent guest-overlay, передаёт настроенные host/guest runtime assets и proxy spec в Create/restore и вызывает runtime contract validator до Create/Start. Start/reconcile передают парные generation-bound credentials через RuntimeCredentialStarter; VM помещает их в private descriptor-bound broker bundle на время процесса и удаляет при завершении. Runtime preflight больше не содержит безусловный блок: пригодность подтверждается worker/hypervisor probe, а workload gate открывается только после проверки descriptor, worker/broker health, гостевого control ping и mTLS identity в isolation registry.
  • VM start сверяет заданные policy run_as_user/run_as_group с resolved non-root UID/GID гостя до открытия workload gate; Gateway сохраняет наблюдённые UID/GID в durable sandbox record и отдаёт WorkloadIdentity condition. Live HVF подтвердил 1000:1000 и сохранение /sandbox ownership через Stop/Start.
  • Локальный Docker/Podman образ экспортируется по immutable Engine ID; Docker 29 multi-platform OCI layout export фильтруется по целевой платформе до rootfs preparation. Live acceptance на Mac импортировал linux/arm64 Alpine, подготовил VM rootfs и восстановил конфигурацию образа по тому же immutable ID.
  • VM передаёт private descriptor path host proxy и формирует mode-0600 bundle в формате upstream SupervisorAuthBundle: оба bearers и expiry, UUID session, runtime generation, session rotation и auth epoch; proxy проверяет descriptor/bundle/admission bindings, использует Gateway bearer для Gateway API и refresh, а Sandbox bearer для sandbox-only RPC (ConnectSupervisor, RelayStream, PushSandboxLogs, policy acknowledgement и main-process exit/finalize). RuntimeCredentialStarter передаёт credential pair в VM. Production VM Start вызывает isolation.Registry.Attach → Confirm → Start с descriptor-bound backend, проверкой live worker/broker, гостевого control ping, mTLS identity и non-root readiness до release one-shot start gate. Полный живой Gateway create/start/stop/restart smoke на локальном HVF теперь проходит (см. evidence ниже). Initial session rotation 1 совпадает с pinned OpenShell v0.1.4; последующая bearer rotation/replay lineage и HA owner replica routing/SessionRedirect не реализованы. Supervisor owner lease с UUID/connection epoch хранится в lifecycle store; durable semantics работают при --data/Postgres, а in-memory режим не сохраняет owner между Gateway restart. IssueSandboxToken остаётся fail-closed. Свежий HVF acceptance выполняет HTTPS workload request через локальный upstream CONNECT proxy (HTTP 200 после allow, CONNECT Forbidden после revoke). Live Gateway WatchSandbox composition теперь также проходит на реальной VM; cursor epoch сохраняется при рестарте Gateway с тем же lifecycle store, а watcher подхватывает durable log/event writes от другого Gateway instance. Каждый активный Gateway observer получает VM lifecycle updates через polling общего state directory (250 мс на sandbox); при отсутствии активного WatchSandbox события не архивируются, а короткие статусы могут коалесцироваться. Pinned VM runtime вызывает add_vsock(0) и не включает TSI; прямой IP/DNS NIC не является целью переноса.
  • Gateway control plane проверяет generation-bound bearer в refresh/control/relay methods; supervisor hello сверяется с sandbox record/generation, требует положительный connection_epoch, а RelayStream принимает только loopback TCP target. Owner lease на 45 секунд и текущий supervisor session UUID теперь атомарно хранятся в lifecycle store: heartbeat продлевает lease, повтор epoch отклоняется, тот же instance может reconnect только с большим epoch, Stop/finalize/Delete очищают owner. Интеграционный test проходит через два Gateway процесса и SQLite reopen. Локальный SupervisorHub держит только активные transport channels и relay pipes. Явный успешный Stop сразу освобождает owner, а transient stream loss сохраняет его до TTL. JSON schema auth bundle и JWT wire profile совпадают с upstream; Sandbox JWT проверяется ключом в гостевом supervisor при запуске. Live macOS/HVF acceptance с mock OpenShell Gateway проверяет пару Gateway/Sandbox credentials, mTLS control bridge, policy revision ACK с Sandbox bearer по OpenShell sandbox-only auth mode, production isolation registry attach/confirm/start, guest exec за start gate и Sandbox-authenticated process-event logs. Отдельный реальный Gateway composition smoke проходит create/start/stop/restart. Ротация bearers/replay lineage, replica routing и оставшиеся upstream running-boundary process handles требуют завершения; G04 остаётся открытым. Локальный HVF retest: plans/evidence/runs/vm-hvf-local-2026-10-22.md.
  • Полный Gateway composition на Apple Silicon/HVF прошёл живой create/start/stop/restart; все запросы вернули 200, новый supervisor instance подключился сразу после Stop, workload стал running. На актуальных Gateway/CLI бинарниках GetSandboxLogs вернул supervisor launch/exit events из реальной VM. Proxy SDK и supervisor использует выделенный Gateway gRPC endpoint; secrets lookup теперь корректно возвращает Unimplemented на отсутствующем GetSandboxProviderEnvironment handler.
  • Gateway Stop после успешного runtime stop освобождает supervisor owner lease, сохраняя 45-секундную защиту при случайном stream loss; regression tests покрывают замену owner после Stop. Supervisor process-event pusher, ReportPolicyStatus, ReportMainProcessExit и FinalizeMainProcessExit используют Sandbox bearer по контракту upstream; Gateway сверяет sandbox/runtime generation/credential epoch, активный instance и durable-итог процесса. Реализованы sandbox-bound PushSandboxLogs, SQLite-backed оконное хранение до 2000 строк/8 MiB и фильтры GetSandboxLogs; при --data строки переживают перезапуск Gateway. Gateway tests проверяют sandbox scope, durable reopen, policy/process result, idempotency, stale generation и log filters/limits. WatchSandbox теперь опрашивает shared durable log/event window, но VM driver watch теперь замечает изменения из общего state directory, но Gateway записывает platform event history только при активном WatchSandbox observer. GetSandboxProviderEnvironment остаётся.
  • Исторический hosted platform workflow PASS на предшествующем VM snapshot a519ad2 (run): VM package tests прошли на Linux и macOS; Windows cross-build и совместимые package tests PASS. На snapshot 590776d прошли task test по всем Go workspace modules, Linux ARM64 и Windows supervisor cross-compiles, parity/docs gates и локальный full-history Gitleaks scan. GitHub не запустил secret scan (run) и platform jobs (run); все jobs завершились до шагов из-за failed payments/spending-limit у GitHub account. Gateway macOS trust допускает Team ID либо точный SHA-256 закреплённого ad-hoc signed worker (дистрибутив всё равно требует Developer ID signing/notarization). Live Gateway composition теперь подтверждён локально на HVF; более ранняя ошибка sandbox.create: provision runtime исправлена. Live KVM hosted lane пропущен из-за отсутствия гипервизора; Windows runner не имеет требуемых Windows 11 Insider/MXC runtime; GPU/VFIO требуют совместимого физического устройства.
  • Latest VM work (2026-10-23 05:11 Samara): local macOS/HVF TestLiveMicroVMLifecycle, OCI import and Gateway watch composition PASS on the current worktree; full task test, conformance 71/71, strict docs, artifact/install rollback, format and parity checks PASS. Hosted platform run 39880734611 passed pinned libkrun build, /dev/kvm, namespace and mount isolation, but the supervisor did not publish readiness. Guest-agent mutex deadlock and supervisor readiness/exit race are fixed. Current code extends readiness to 45s and includes control-operation trace in live failures; platform run 39882558616 is validating that change. KVM remains unverified. Remaining partial rows: upstream managed host supervisor/BoundaryProcess, non-TTY main-process attachment and exact replica/session replay; GPU/VFIO requires physical passthrough hardware.
  • [~] M6d Windows MXC
  • quarshell-driver-mxc пока skeleton; GitHub-hosted Windows build общего driver + VM и совместимые package tests PASS в platform run. Runner не имеет требуемой MXC среды; wxc-exec.exe и IsoSessionApp.dll отсутствуют.
  • MXC implementation и live contract acceptance не готовы; штатный Windows runner не считается MXC host без требуемых runtime компонентов и Insider build.
  • [~] G04: локальная macOS/HVF Gateway composition прошла create/start/stop/restart по HTTP 200; явный Stop освобождает supervisor owner lease. SQLite-backed logs сохраняются при настроенном --data; HVF acceptance подтверждает разрешённый запрос через рабочий local upstream CONNECT proxy и policy revoke, а живой Gateway WatchSandbox получает состояние реальной VM. Остальные G04 APIs, KVM live lane и hardware-specific строки остаются.

M7 — clients/tooling

  • [~] Go SDK: tests зелёные; подтвердить полный typed errors/cancel/auth refresh/pagination/streaming.
  • [~] CLI: команды/storage/TUI tests зелёные; сверить полное дерево с upstream inventory.
  • [~] TUI workflows: базовые есть; сверить с upstream inventory.
  • [~] Python/TS bindings: Python 23/23 tests и wheel build PASS (grpcio 1.84.0); TS build PASS; real gateway curated scenarios pending.
  • [~] Go prover: bounded/risk/Z3 plumbing есть; full symbolic model pending.
  • [~] EN/RU Gateway quickstarts приведены к проверенному Go/Compose запуску; в них описаны общий статический token для HTTP/gRPC, public Health и отсутствие TLS/per-user gRPC identity. Local и hosted strict build PASS (latest Linux run). Остальные upstream примеры и public agent skills (сейчас только policy-advisor) требуют parity review.

M8 — release/cleanup

  • [~] Удаление старого кода: httpapi/legacy command/stale copies удалены; старые runtime/driver packages ещё используются или не разобраны.
  • Защита локальных секретов: .gitignore покрывает env-файлы, private keys, SSH/GPG, package-manager credentials, cloud credentials и service-account files; Gitleaks CLI просканировал всю сведённую историю без совпадений (latest source scan).
  • [!] GitHub Secret Scanning/push protection выключены у private repo; для private organization repository GitHub указывает Secret Protection entitlement. Перед включением проверить план KLORQ, чтобы не включить платную функцию без решения владельца.
  • Удалён tracked opencode.jsonc с личными absolute paths; migration review paths приведены к repo-relative или pinned-upstream ссылкам.
  • Очистка generated output: task clean:generated удаляет также Rust target directories; всего освобождено около 3.0 GiB, pinned source checkout сохранён.
  • История сведена к одному root snapshot commit на remote и локально; backup refs и reflogs удалены, git gc --prune=now выполнен.

  • [~] Latest local and hosted VM migration: the latest task test, macOS/HVF lifecycle + Gateway watch composition, parity (30 entries), Linux guest-agent tests, format and docs checks pass. Current GitHub secret scan passes on ee4ff22; platform run 39880734611 passed runtime build/KVM/environment isolation then failed guest supervisor readiness. The current diagnostic follow-up is in platform run 39882558616. KVM, signing/notarization and remaining VM parity are incomplete. The single-root history and secret-aware .gitignore cleanup remain in place.

  • [~] Historical 2026-10-22 Mac VM retest; superseded by the later current-tree Gateway composition result below. Full Gateway → VM create/start now passes on local Apple Silicon/HVF; see the latest evidence section.

  • [~] Follow-up on 1619e99: guest JWT verifier now rejects exp: null (Go otherwise decodes it as numeric zero, which is the valid OpenShell non-expiring form) while preserving exp: 0. Supervisor unit tests, VM parity inventory (30 entries), Linux ARM64 and Windows AMD64 supervisor cross-compiles, and local Apple Silicon/HVF lifecycle PASS. GitHub secret scan 39763756651 and manual platform matrix 39763802132 failed before any job steps (no job logs were produced). One-root history scan: one commit, 18.21 MB, no Gitleaks findings. Real Gateway composition and remaining upstream running-boundary APIs remain incomplete; G04 remains open.

  • [~] JWT edge follow-up on 4aa3fcc: verifier now also requires iat to be present as a JSON integer, rejecting omitted or null values; exp follows the same strict numeric rule while upstream exp: 0 remains valid. Full workspace task test, Linux ARM64/Windows AMD64 cross-compiles, VM parity inventory, artifact/KVM fixture gates, and docs strict build PASS. GitHub secret-scan run 39764231486 failed before job steps with no logs. One-root local Gitleaks scan is clean. This closes JWT decoding edge cases only; complete Gateway composition and G04 remain open.

  • [~] macOS exec-timeout retest: task vm:live-darwin PASS (17.30s) after adding a live check that a timed-out Driver.Exec kills the guest process and prevents a delayed filesystem side effect. This extends vm.gateway-exec-timeout evidence but does not close the row's remaining Gateway streaming semantics or G04.

  • [~] Paired Gateway credential HVF probe: task vm:live-darwin PASS on macOS ARM64/HVF (27.29s). A signed Gateway/Sandbox token pair established two supervisor streams across instance rotation; mTLS control accepted the fresh instance, the mock Gateway acknowledged policy revision 2 with the Gateway bearer, and guest exec confirmed the workload passed the start gate. expires_at=0 remains valid as OpenShell's non-expiring sentinel through launch validation, env projection, and descriptor-bound broker auth bundle. This older probe used the driver gate before production registry integration; latest retest follows below.

  • [~] Hosted recheck on 59609c5: manually dispatched platform matrix 39764654224; Linux KVM, macOS HVF, and Windows MXC jobs all failed before steps and emitted no logs. Push-triggered secret scan 39764619947 failed before steps as well. Local task test, live HVF lifecycle including exec timeout cancellation, parity, artifact/KVM fixture gates, and one-root Gitleaks passed. No hosted result is available for this VM snapshot.

  • [~] M6c current-tree continuation: fixed VM Logs(follow=true) to tail console and worker logs concurrently, retain worker-only logs when console is missing, and return cancellation correctly when only one file is followed; regression test passes under -race. Gateway paired credentials now replace caller-provided proxy sandbox IDs with the Gateway sandbox ID. On macOS ARM64/HVF, latest task vm:live-darwin PASS (21.83s), task test, parity/format gates, and Linux ARM64 + Windows AMD64 cross-builds PASS. Inventory remains 4 implemented, 24 partial, 2 unsupported, 0 open. Full Gateway composition, session rotation/replay, upstream running-boundary APIs, KVM and GPU/VFIO remain incomplete. Evidence: plans/evidence/runs/vm-hvf-local-2026-10-22.md.

  • [~] Current continuation after those historical entries: full Gateway/HVF create/start/stop/restart now passes HTTP 200; explicit stop releases stale owner lease; Sandbox-authenticated supervisor process events now reach bounded Gateway log storage. Current task vm:live-darwin PASS (23.02s), full workspace task test PASS, task vm:parity-check PASS (30 pinned entries), task fmt:check PASS, and git diff --check PASS. This supersedes prior log entries that said Gateway composition had not yet succeeded. Remaining inventory: 4 implemented, 24 partial, 2 unsupported, 0 open; evidence: current VM evidence.
  • [~] Current-tree host endpoint continuation: restored OpenShell's host grpc_endpoint config contract and OPENSHELL_GRPC_ENDPOINT fallback, which had been discarded by the Go VM backend; host value now takes precedence when preparing guest proxy environment. Endpoint config tests, full task test, parity (30 entries), format gate, VM live macOS/HVF lifecycle, Linux ARM64 and Windows AMD64 cross-builds for VM/Gateway/runtime, and git diff --check pass. Full real Gateway→VM create/start/stop/restart passes locally. The inventory remains 4 implemented, 24 partial, 2 unsupported, 0 open; complete VM scope still includes logs/watch, running-boundary APIs, credential rotation/replay, durable logs/leases, install/upgrade rollback, KVM live acceptance and GPU/VFIO. Evidence: current VM evidence.
  • [~] Env aliases, dual schemas, функции вне baseline.
  • [~] Dockerfiles/charts/release workflow/generated clients: Gateway image build and Compose clean install (persistent SQLite, HTTP/gRPC, healthcheck) PASS locally and on GitHub-hosted Linux (latest acceptance); Helm, all 10 GitHub-hosted cross-builds, in-workflow manifest/SHA256/SBOM verification, and artifact upload PASS (release CI); registry image publish and regenerated clients remain pending.
  • [~] Signatures/notarization: workflow готов, нужны Apple secrets.
  • [~] Gateway-only Compose clean install прошёл локально (evidence); upgrade path и published consumer clean install остаются pending.
  • Published consumer без local replace: GOWORK=off gate выявил отсутствующие checksums/обновления go.mod и checksum mismatch опубликованного quarshell-core@v0.3.0; сначала согласовать исходники и release tags, затем повторить consumer build.
  • Финальный acceptance: peer/VM/MXC/prover/GPU rows.

Governance / contracts

  • [~] Inventory: SDK operations и часть release artifacts.
  • [~] Requirements synthesis в acceptance.
  • [~] Release status из evidence matrix.
  • [~] Strict ADR gate core → proto (сейчас красный).
  • [~] Exact межрепозиторные source pins не заданы: task ci:pins пока завершается с ошибкой, потому что в tools/modules.lock нет опубликованных авторитетных SHA. Не подставлять теги или предположительные текущие ревизии.
  • [~] TS/Python contract regeneration.
  • [~] ADR для VM/MXC/prover зависимостей.

Live gates

Gate Статус Что нужно
Linux Landlock/seccomp/network bypass partial GitHub-hosted Linux build/test PASS (latest recheck); host-level raw-socket and DNS/UDS bypass probes pending
Native Linux Docker/Podman pass GitHub-hosted ubuntu-24.04: Docker and rootful/rootless Podman E2E PASS, including userns/binds, egress probes, and backend events; see hosted acceptance runs
Kubernetes real cluster blocked cluster + runtime image + guest TLS
KVM/HVF + signed macOS partial Local Apple Silicon/HVF live acceptance passes. GitHub-hosted run 39874763824 passed the worker namespace probe, applied mountinfo-based propagation handling and reached VM lifecycle, then failed because broker validation ran before creation of its per-UID /tmp/cautem-vm-<uid> socket root. Startup now permits that one expected missing directory; the broker creates it mode 0700 and validates ownership and permissions before binding. KVM rerun pending push. Hosted macOS has no Hypervisor.framework. Distribution signing/notarization still needs Apple credentials.
Windows MXC blocked Windows-hosted probe; MXC Go implementation, supported Windows build, wxc-exec.exe and IsoSessionApp.dll
GPU/VFIO blocked physical hardware
Published consumer + clean install blocked registry/images

Ближайший порядок работ

  1. Продолжить M6c upstream process ownership: supervisor-owned main process handle, SSH openshell-main attachment/reconnect и Gateway session lineage.
  2. Закрыть оставшиеся M6c auth/replay/replica lifecycle details; проверить исходно закреплённый runtime bundle и live KVM acceptance в run 39871271914.
  3. Разобрать M6d MXC по доступности Windows Insider/MXC SDK; hosted Windows job даёт build/package evidence, но не native runtime evidence.
  4. GPU/VFIO остаются hardware-specific; закрывать только на доступном совместимом устройстве.
  5. После закрытия VM parity вернуться к M5/M6a/M6b и затем M7/M8.
  6. [~] Historical endpoint/auth continuation; superseded by the VM event-watch continuation below. Remaining watch gap is cross-replica live event delivery; VM driver WatchSandboxes now provides initial snapshots plus process-local lifecycle updates/deletions.
  7. [~] Continuation: WatchSandbox now sends the upstream-required initial snapshot regardless of follow flags, replays a default 200-line tail, applies source/level/time filters consistently, deduplicates overlap, emits changed status snapshots including canonical process result and removes watchers on every exit path. Provider attach/detach validates definitions and reports accurate idempotent attachment state; refresh input validation and locking are fixed. Full workspace task test, 30-row parity, formatting/diff gates, focused watch/provider/rootfs tests, artifact digest/install-upgrade-rollback/KVM script fixtures, Linux ARM64 + Windows AMD64 cross-builds of VM/Gateway/runtime, and macOS ARM64/HVF live acceptance (23.07s) pass on the current tree. Inventory stays 4 implemented, 24 partial, 2 GPU/VFIO unsupported, 0 open. Latest GitHub secret-scan (39765226689) and platform matrix (39764654224) failed with no job steps, so they supply no hosted evidence; local macOS/HVF is the available live lane. Evidence: current VM evidence.
  8. [~] Hosted recheck on de12743: secret scan, macOS workflow, Linux workflow and platform matrix all PASS, including Linux workspace tests, Docker and rootful/rootless Podman. Hosted Linux/KVM and macOS/HVF jobs pass VM build/tests, but skip live hypervisor acceptance because those runner images expose neither usable /dev/kvm nor Hypervisor.framework. Windows driver and VM builds plus Windows-compatible package tests pass; MXC live acceptance remains unavailable because windows-2025 is build 26100 and has no wxc-exec.exe/IsoSessionApp.dll (MXC requires build >=26300). Local ARM64/HVF full live acceptance passes. Security fix f9438a1 rejects cross-sandbox/stale runtime report principals and withholds unbound provider secrets; full local workspace tests/parity/format/diff passed, and its GitHub secret-scan passes while Linux/macOS workflows run. Inventory remains 4 implemented, 24 partial, 2 unsupported (GPU/VFIO), 0 blocked, 0 open. Evidence: current VM evidence.
  9. [~] VM watch continuation: VM backend WatchPlatformEvents sends an initial state and polls persisted state for cross-process lifecycle updates/deletes. Gateway WatchSandbox(FollowEvents) persists bounded/deduplicated platform events in the same per-sandbox sequence space as logs, supports event_tail, cursor resume across both sources, sorted replay, atomic live catch-up, trim detection, and terminal-stop handling. Cursor epoch is durable in the lifecycle store. Watchers poll shared durable windows once per second, so logs and already-persisted events are delivered across Gateway instances using the same store; Gateway event history is collected only while a WatchSandbox observer is active. Focused tests cover durable reopen, epoch persistence, cross-instance catch-up, source interleaving, event dedup/trim, cursor resume, and live merge. task vm:parity-check inventory remains 7 implemented, 21 partial, 2 hardware-specific GPU/VFIO unsupported, 0 blocked, 0 open.
  10. [~] After VM event-watch changes: full workspace task test, VM and Gateway focused tests, task vm:parity-check (30 pinned rows), task fmt:check, and git diff --check PASS. Hosted follow-up on 972b308 passed macOS, Linux, secret scan, and platform-backends workflows. Local live HVF acceptance observes created, running, and terminal stopped; Gateway WatchSandbox merged event/log replay is covered by focused server tests, not by a live Gateway composition watch probe yet. Latest f5b05df workflows are queued and recorded after completion.
  11. [~] VM/Gateway watch follow-up: VM now exposes driver-wide WatchSandboxes initial snapshots plus persisted-state updates/deletions, alongside per-sandbox platform events. VM feeds deliver local changes immediately through bounded 128-entry queues and poll persisted state for cross-process updates; short transitions may coalesce. Gateway persists event tail records with log records, shares sequence numbers across both sources, validates source-specific retention gaps, merges replay/live catch-up by sequence, polls durable windows for cross-instance log/event writes, and deduplicates repeated VM snapshots. Cursor epoch is shared by Gateway instances using the same lifecycle store; Gateway event history still requires an active WatchSandbox observer.
  12. [~] Latest Mac verification after VM-wide watch and egress changes: task vm:live-darwin PASS on Apple Silicon/HVF (22.68s); live VM stream observed created, running, and stopped; an authenticated TLS workload request traversed HTTPS CONNECT to a local TLS upstream, used a resolved-IP CONNECT target, returned HTTP 200 after policy allow, and was denied before reaching the upstream after policy revoke. Gateway credential/session integration passed. vm.logs-watch remains partial because Gateway composition watch still needs a live test; durable cursor epoch survives restart and shared-store log/event writes and VM state changes are polled across Gateway instances. Inventory is now 7 implemented, 21 partial, 2 unsupported. vm.resource-capabilities, vm.corporate-proxy-ca, and vm.policy-egress are implemented for the tested configuration; GPU/VFIO remain unsupported.
  13. [~] VM watch cross-process continuation: WatchPlatformEvents and WatchSandboxes now poll persisted VM state (250 ms per-sandbox / 1 s driver-wide) as well as consume immediate local notifications. Separate processes using the same state directory therefore observe state updates and deletion; intermediate states may coalesce and there is no durable event replay. New direct-file-write tests verify both feeds without invoking the in-process publisher. Focused watch tests pass under -race; task vm:live-darwin passes on Apple Silicon/HVF (22 Oct, 20:15, 26.21 s), including lifecycle, policy allow/revoke over trusted HTTPS CONNECT, recovery, OCI pinning, and Gateway credential/process-event flow. Gateway composition WatchSandbox live acceptance and the other partial upstream VM contracts remain open; parity count remains 6 implemented, 22 partial, 2 GPU/VFIO unsupported.
  14. [~] HTTPS workload egress acceptance: task vm:live-darwin PASS at 20:33 (22.81 s). Guest made an actual TLS request through an authenticated HTTPS CONNECT proxy to a local TLS upstream; proxy Basic auth is read from a mode-0600 file and required by the fixture. Policy revision 2 allowed example.com:443 (HTTP 200), revision 3 denied the CONNECT before the TLS server. Like the pinned upstream test, the temporary TLS workload client skips destination certificate verification. This strengthens vm.policy-egress, which remains partial because upstream's no_proxy direct bypass and broader matrix are still uncovered.
  15. [~] OpenShell VM config, identity, local image, exec timeout, and Gateway restart intent continuation (2026-10-22 21:37 Europe/Samara): Gateway loads the selected TOML driver table and applies --runtime-config overrides before backend registration; VM host config validates and carries corporate proxy URL, no_proxy, auth-file, proxy CA, hostname CONNECT, and opt-in SPIFFE endpoint settings into the policy broker. Operator-owned proxy keys replace sandbox-supplied values; configured integrations fail closed when the broker is absent. Gateway execution timeout cancellation is covered through DeadlineExceeded; SQLite store reopen verifies running/stopped intent reconciliation after Gateway service reconstruction. Docker 29 OCI-layout export is now imported with a platform-selective save by immutable Engine ID; the live acceptance also verifies recovery config by that ID. VM start validates policy UID/GID selectors against the resolved non-root guest identity before releasing the workload start gate. Gateway persists observed UID/GID and exposes a WorkloadIdentity condition. Focused VM/Gateway tests, full workspace task test, task vm:parity-check (30 entries), task fmt:check, git diff --check, and task vm:live-darwin PASS; live ARM64/HVF lifecycle PASS (22.93s) and local OCI image import PASS (1.18s), including identity 1000:1000 and persistent /sandbox ownership across stop/start. CI on b0a3981: Linux is running (run); macOS (run), platform-backends (run), and secret-scan (run) PASS. Inventory: 19 implemented, 9 partial, 2 GPU/VFIO unsupported, 0 open. Evidence: current VM evidence. Config-to-broker/SPIFFE handoff is covered by focused tests; a separate live TOML launch and real SPIFFE endpoint were not exercised.

  16. [~] Rootfs staging parity closed after tracing the CLI source path through Gateway staging-slot creation, SDK bounded file write, single-use workspace-bound token consumption on CreateSandbox, and VM descriptor-relative regular-file/path/size validation plus bounded extraction. Focused tests passed in CLI (TestSandboxCreateStagesRootfsTarIntoNativeVMDriverConfig), Gateway (TestRootfsTarStagingConsumedByCreate), Go SDK (TestUploadRootfsTarWritesOpenShellStagingPath and size rejection), and VM (TestVMCreateRejectsRootfsTarOutsideStagingRoot and path/open safety suite). task vm:parity-check PASS (30 entries). Inventory: 20 implemented, 8 partial, 2 unsupported (physical GPU/VFIO). Code snapshot under CI was 2a46a41; latest pushed code is 0976656 (local Gateway installer/auth startup and durable exec admission). GitHub platform-backends PASS (run), including Windows build/package tests; Linux workspace, Docker E2E, docs, and Gateway image jobs pass while Podman E2E runs (run). Hosted hypervisor jobs build/test but skip live acceptance because the hosted VMs do not expose KVM/HVF; local Apple Silicon/HVF remains the live lane.

  17. [~] Gateway exec durable admission checkpoint: unary and interactive exec validate nonzero UUID request IDs and atomically reserve them in the shared lifecycle store before runtime launch. Duplicate IDs fail without a second runtime call; unknown/incomplete outcomes remain fenced, while terminal completions are retained for 24 hours. Added SQLite transaction delete support so an expired completed admission can be atomically replaced. Concurrent admission, completion/expiry, restart persistence and RPC duplicate behavior pass targeted tests under race; full task test passes across workspace modules. At that checkpoint interactive non-TTY and full upstream PTY/process-signal coverage remained partial; the subsequent exec-stream continuation closes non-TTY stdin/stdout/stderr/exit behavior. Rootfs staging remains closed. Current inventory: 20 implemented, 8 partial, 2 unsupported (GPU/VFIO).

  18. [~] Interactive VM exec continuation: added a non-TTY full-duplex guest control stream with separate stdout/stderr frames, stdin half-close and normalized exit status; Gateway interactive exec routes tty=false into the optional backend stream contract and keeps durable request_id fencing. RPC tests verify stdin, distinct output streams, completion and duplicate suppression. Linux guest-agent tests passed in a local Alpine container; latest Apple Silicon task vm:live-darwin PASS (22.83s lifecycle + 1.21s OCI import), including non-TTY input/output/exit. On the exact current HEAD d1b904d, task test, task vm:parity-check (30 entries), task fmt:check, and git diff --check all PASS. vm.exec-pty-signals remains partial pending the broader upstream running-boundary signal contract. Inventory remains 20 implemented, 8 partial, 2 unsupported (GPU/VFIO).
  19. [~] Exec transport-loss cleanup: added a Linux guest-agent regression test that starts a child process in the exec process group, drops the authenticated control connection, and verifies the handler exits and the child is no longer running (zombie state is treated as terminated because minimal containers may not reap immediately). Ten repeated executions passed inside local alpine:3.22 on Linux ARM64. This strengthens vm.exec-pty-signals; it does not implement the remaining OpenShell running-boundary signal API. Current exact-Mac retest on d1b904d remains valid for the previous tree; this test/evidence update is uncommitted and is undergoing full verification.
  20. VM file-transfer parity: CopyTo opens the source without following a final symlink on macOS/Linux, validates the opened descriptor is a regular file, and enforces the frame limit while reading; Windows-compatible reads are bounded too. Live HVF acceptance starts a real Gateway gRPC server on loopback, runs the built cautem CLI as a separate process, and performs sandbox upload plus sandbox download against the running VM. The round-trip preserves a nested file and relative symlink. task vm:live-darwin passed on 2026-10-22; the Gateway composition test completed in 19.63s.
  21. [~] VM exec stream output reliability: repeated live archive streaming exposed that exec.Cmd.Wait could close StdoutPipe/StderrPipe before readers drained. Guest non-TTY exec now uses explicit OS pipes and drains both before emitting exit. Fast-process stdout/stderr regression passed 90 times in Linux ARM64 Alpine; full guest-agent suite passed (BusyBox login profile fixture skipped). Full workspace tests, parity, format/diff and live Apple Silicon/HVF lifecycle + OCI import passed; evidence: plans/evidence/runs/vm-hvf-local-2026-10-22.md.
  22. VM logs/watch composition: live macOS/HVF acceptance now creates and starts a VM through Gateway's sandbox service, streams its actual running/stopped state through WatchSandbox, and stops on the terminal event. This uncovered and fixed Gateway filtering runtime platform events by the logical Sandbox ID instead of the record-bound runtime UUID; regression test accepts the matching runtime ID and drops another runtime's event. Existing durable cursor, replay and cross-Gateway tests cover persisted watch semantics. Evidence: quarshell-gateway/internal/transport/applicationgrpc/live_vm_watch_acceptance_test.go::TestLiveVMWatchSandboxComposition.
  23. VM authenticated vsock identity rotation: live HVF lifecycle captures the guest supervisor's mTLS client certificate and SPIFFE identity, verifies that worker adoption preserves the identity, then Stop/Start creates a new certificate bound to the new runtime generation; the restarted guest completes its supervisor readiness handshake. Existing supervisor integration test covers reconnect after a dropped control stream. Evidence: quarshell-driver-vm/vm/live_acceptance_test.go::liveVMControlClientIdentity and TestLiveMicroVMLifecycle.