feat: microVM isolation per role with a validated runbook (0.20.0) - #108

Merged

naashw merged 36 commits into

feat/microvm-runbook

Aug 29, 2026

Commits on Aug 28, 2026

feat: microvm isolation, runbook scan and mechanical verification
Hasan TASKIN
committed
92f4e5e
fix: microvm review findings on ship, checks, review, turn and scan lease
Hasan TASKIN
committed
8f51827
test: never spawn claude setup-token from autoconfig tests
Hasan TASKIN
committed
b63e5a9

Commits on Aug 29, 2026

fix: never set a boot user on the microvm turn sandbox spec
Hasan TASKIN
committed
e77f715
fix: tar directory trees for microsandbox copyFromHost/copyToHost
Hasan TASKIN
committed
e0664f4
fix: stop double-parsing the runbook proposal before sanitizing it
Hasan TASKIN
committed
658215f
feat: add microvm guest-user and agent-install bootstrap
Hasan TASKIN
committed
efa454d
feat: install the agent CLI in a cold-booted microvm dev turn
Hasan TASKIN
committed
54f8687
feat: bake the agent CLI into the microvm project snapshot
Hasan TASKIN
committed
16b5513
fix: pass the agent id when snapshotting after a runbook scan
Hasan TASKIN
committed
e94b2c9
feat: install the agent CLI in the microvm review sandbox
Hasan TASKIN
committed
60eeb50
fix: fold the agent id into every microvm snapshot resolution
Hasan TASKIN
committed
1a762b2
docs: list runbook scan in the CLI help text
Hasan TASKIN
committed
d2af449
fix: forward provider secrets to the microvm runbook scan proposal
Hasan TASKIN
committed
1e7732f
fix: cap the microvm sandbox list request at the SDK's own limit
Hasan TASKIN
committed
c612a4c
fix: never set a boot workdir on the microvm review sandbox
Hasan TASKIN
committed
df18e09
fix: remove a microvm sandbox the SDK provisioned before create failed
Hasan TASKIN
committed
ec2905d
fix: probe microvm capability at boot so a microvm project never degrades to policy
Hasan TASKIN
committed
cbb6b9c
fix: never set a boot workdir on the gitops sandbox
Hasan TASKIN
committed
d8ba33d
fix: read the validated runbook from the project root, never the task worktree
Hasan TASKIN
committed
97ff43b
fix: sweep orphaned microvm sandboxes whenever the machine can run them
Hasan TASKIN
committed
dc2ec9d
fix: take the validated sha from the local runbook validation written by the scan
Hasan TASKIN
committed
ba82953
fix: retry a sandbox create() that fails with a transient store database error
Hasan TASKIN
committed
554a1e5
fix: rebuild the single-use sandbox builder on every create() retry
Hasan TASKIN
committed
693e3c0
fix: bump microsandbox SDK to 0.6.16, fixes a host-side zombie leak after destroy()
Hasan TASKIN
committed
eeaca01
Revert "fix: bump microsandbox SDK to 0.6.16, fixes a host-side zombie leak after destroy()"
Hasan TASKIN
committed
9530270
Reapply "fix: bump microsandbox SDK to 0.6.16, fixes a host-side zombie leak after destroy()"
Hasan TASKIN
committed
b0356f8
Revert "Reapply "fix: bump microsandbox SDK to 0.6.16, fixes a host-side zombie leak after destroy()""
Hasan TASKIN
committed
dbe2642
fix: mark the gitops sandbox worktree a safe.directory before any git command
Hasan TASKIN
committed
ce23ced
docs: note the real microvm run fixes in the changelog
Hasan TASKIN
committed
2c128ef
fix: share one microsandbox driver per process
Hasan TASKIN
committed
0d6636e
fix: stop native sandbox instance and scrub store before sdk use
Hasan TASKIN
committed
fb61610
fix: mount the package cache volume atomically
Hasan TASKIN
committed
6391288
test: make the kvm probe test host-independent
Hasan TASKIN
committed
b5e936e
chore: bump microsandbox to 0.6.16
Hasan TASKIN
committed
fefa70e
test: reset process.exitCode after the failed scan test
Hasan TASKIN
committed
4082d00