fix(supervisor): preserve standard sbin paths in sandbox shells - #2846

Open

elezar wants to merge 14 commits into

feat/1606-derive-cdi-sandbox-requirements/elezarfrom

codex/orin-nvidia-smi-path

Commits on Aug 20, 2026

feat(core): add CDI policy resolver
elezar
committed
99e80d1
fix(core): reject unsafe CDI requirements
elezar
committed
67aea81
chore(core): update CDI dependency
elezar
committed
1878d3a
feat(sandbox): derive policy from CDI context
elezar
committed
eb72ad2
fix(sandbox): attest CDI mount projection
elezar
committed
573d4f1
fix(sandbox): satisfy macOS CDI lint
elezar
committed
fa2423f
fix(process): simplify platform-specific imports
elezar
committed
4e59ffd
fix(process): limit supplemental groups to Linux
elezar
committed
ef30893
feat(docker): supply CDI context for GPU sandboxes
elezar
committed
3765a38
fix(docker): bind CDI context read-only
elezar
committed
2dd7d3c
fix(docker): document CDI context mount
elezar
committed
9a23111
fix(supervisor): preserve standard sbin paths in sandbox shells
elezar
committed
61e0289

Commits on Aug 21, 2026

fix(supervisor): harden sandbox path startup repair
elezar
committed
7480b9b
fix(supervisor): gate sbin path repair on CDI policy
elezar
committed
1c6b125