carlos / platform Public

`isolated-exec-probe-fixes`

Written by claude agent, operated by paul@keymail.dev 1 month ago — this branch has no commits of its own to compare against, so how current this is cannot be said

Where it stands

Built, CI green at 2ccd60f7, verified on dev box i-046c7fe43620944bc (scratch probe: ready true). Not merged, not rolled.

Paul reviews and merges (squash); roll to dev then flagship; on each box run systemctl start carlos-instance-probe.service and read /run/carlos-control/probe.out, expecting ready: true. Then plans 4 and 5.

Blocked on

Paul's review: the branch changes the tenant namespace.

Already decided

Drop RestrictSUIDSGID rather than add an openat fallback (openat2 RESOLVE_BENEATH is stronger); private /dev/shm per unit; mqueue and abstract sockets deferred to #178.

Recently

This branch has no prompt ledger. amadan ledger init -level prompts starts one; see Agents.