docs(adr): openab-pty composable runtime (3 deployment profiles) - #1478

Merged

thepagent merged 15 commits into

mainfrom

adr/openab-pty-sidecar

Aug 16, 2026

Commits on Aug 15, 2026

docs(adr): propose openab-pty optional sidecar runtime (supersedes in-process PTY mode)
chaodu-agent
committed
34d6224
docs(adr): reframe openab-pty as composable runtime with three deployment profiles
chaodu-agent
committed
b562c38
docs(adr): address round-1 review - isolation tiers, credential delivery contract, token control plane
chaodu-agent
committed
b55d5fc
docs(adr): round-2 fixes - admin credential plane, key delivery MUST, attach CAS, frame validation
chaodu-agent
committed
50085af
docs(adr): mandate runtime/child UID privilege separation for key and credential protection
chaodu-agent
committed
7ad09cc
docs(adr): keyless MVP token model - CSPRNG opaque tokens with in-memory hashes, no signing key
chaodu-agent
committed
d4df522
docs(adr): ground MVP containment in keyless model; demote child-UID separation to optional hardening
chaodu-agent
committed
28ed874
docs(adr): address round-3 findings F1-F7
chaodu-agent
committed
7b54b30
docs(adr): address round-4 findings F1-F17
chaodu-agent
committed
27ee5b3
docs(adr): address round-6 group-review findings F1-F13 + O5/O7/O8
chaodu-agent
committed
b931d94
docs(adr): address late round-6 safety findings S3/S9/S10 (B7)
chaodu-agent
committed
7c09cdb
docs(adr): consolidate keyless-model trade-offs in Consequences (B11)
chaodu-agent
committed
9df59bf
docs(adr): dumpable must precede FD possession, splice-only CLI included (B7 F1')
chaodu-agent
committed
b205928
docs(adr): adversary tests explicitly cover the splice CLI's FDs (B7 F1' item 3)
chaodu-agent
committed
3baa557

Commits on Aug 16, 2026

docs(adr): scope MVP to separate pods; cgroup-per-session kill domain; resolve round-7 F1-F8
chaodu-agent
committed
a70b41f

Navigation Menu

Uh oh!

docs(adr): openab-pty composable runtime (3 deployment profiles) - #1478

docs(adr): openab-pty composable runtime (3 deployment profiles)#1478
thepagent merged 15 commits into
mainfrom
adr/openab-pty-sidecar

Commits on Aug 15, 2026

docs(adr): propose openab-pty optional sidecar runtime (supersedes in-process PTY mode)

docs(adr): reframe openab-pty as composable runtime with three deployment profiles

docs(adr): address round-1 review - isolation tiers, credential delivery contract, token control plane

docs(adr): round-2 fixes - admin credential plane, key delivery MUST, attach CAS, frame validation

docs(adr): mandate runtime/child UID privilege separation for key and credential protection

docs(adr): keyless MVP token model - CSPRNG opaque tokens with in-memory hashes, no signing key

docs(adr): ground MVP containment in keyless model; demote child-UID separation to optional hardening

docs(adr): address round-3 findings F1-F7

docs(adr): address round-4 findings F1-F17

docs(adr): address round-6 group-review findings F1-F13 + O5/O7/O8

docs(adr): address late round-6 safety findings S3/S9/S10 (B7)

docs(adr): consolidate keyless-model trade-offs in Consequences (B11)

docs(adr): dumpable must precede FD possession, splice-only CLI included (B7 F1')

docs(adr): adversary tests explicitly cover the splice CLI's FDs (B7 F1' item 3)

Commits on Aug 16, 2026

docs(adr): scope MVP to separate pods; cgroup-per-session kill domain; resolve round-7 F1-F8