Marius CiepluchandClaude Opus 5.5 03857c9bec search-with-proof: root-no-userns isolation mode for gVisor ...

The kube-ax probe showed bwrap cannot map uids in gVisor as an unprivileged user.
As root (gVisor is the outer boundary) the sandbox uses pid/ipc/uts/net/mount
namespaces without a user namespace and drops the artefact to its own uid via
setpriv; the mode is recorded. The probe reports each namespace kind separately.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-10-05 15:00:25 +02:00

..

experiments

learn: exp-005 graph slice -- slice in the prompt (opt-in), program-arm fill, manifest and units

2026-10-03 15:06:08 +02:00

models

feat(learn): metered embeddings and the cache (decision-engine 6.2)

2026-10-01 09:56:52 +02:00

runs

feat(learn): candidate feature schema and builders (decision-engine task 1)

2026-09-30 18:38:04 +02:00

tasks

plane(2.5): kind proof and record 02 -- artifacts through the store, one TLS rule

2026-10-03 07:45:19 +02:00

workspaces

feat(plane): scoring parity with the reference -- sites, ranges, triage cost

2026-09-29 19:49:28 +02:00

Dockerfile.engine-task

unseen-eval groups 4-6: generic AX batch dispatcher (engine_trace on it), replay task and image stage, scorer with adoption gate

2026-10-04 20:19:14 +02:00

Dockerfile.runner

release: v2.0.1 -- Apache-2.0 licence, GHCR images, CI green, front-door README

2026-10-02 20:18:39 +02:00

Dockerfile.runner.dockerignore

merge(plane): increment manifests for the 46-candidate validation run (task 7)

2026-09-29 18:58:32 +02:00

Dockerfile.search-task

search-with-proof: root-no-userns isolation mode for gVisor

2026-10-05 15:00:25 +02:00