Add container-local runtime identities

[omry]

---

Stack created with Sapling. Best reviewed with ReviewStack.

• Add controlled-session lifecycle state machine #18
• Add controlled-session framed protocol #17
• Define controlled-session authorization #16
• Make queued admission cancellation deterministic #15
• Enforce coarse application network policy #14
• Protect host system trees from runtime binds #13
• Enforce root host filesystem boundary #12
• -> Add container-local runtime identities #11
• Verify application sandbox at startup #10
• Harden application container identity and kernel policy #9
• Unify application sandbox planning #8
• Document controlled sessions and repositories #7

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2389588c4b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

This PR introduces a blueprint-defined container-local runtime account identity (name + numeric UID/GID) and threads it through build locking, validation, installation, and runtime verification so that staging vs installed generations can differ only in the identity-specific final runtime layer.

Changes:

• Add environment.runtime.user (default reploy) and enforce/propagate it into Docker execution planning and sandbox validation.
• Extend the locked application runtime layer to include a validated local account record, and update transaction digests / runtime-layer inspection invariants accordingly.
• Add Linux probe support to materialize /etc/passwd + /etc/group during runtime-layer build, plus Windows SID→stable non-root UID/GID mapping and install-time identity adaptation.

Reviewed changes

Copilot reviewed 56 out of 56 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
internal/probe/main.go	Adds install-local-account CLI action to the probe binary.
internal/probe/local_account_unsupported.go	Provides non-Linux stub for local account installation.
internal/probe/local_account_linux.go	Implements Linux /etc/passwd and /etc/group rewriting for the container-local account.
internal/probe/local_account_linux_test.go	Adds unit tests for local account file installation behavior.
internal/dockerdeploy/runtime_readiness.go	Extends runtime readiness matching to include the local account identity.
internal/dockerdeploy/runtime_readiness_test.go	Tests readiness invalidation on changed runtime identity.
internal/dockerdeploy/runtime_layer_test_helpers_test.go	Updates runtime-layer fixtures to include the local account and new transaction digest inputs.
internal/dockerdeploy/runtime_identity_windows.go	Adds Windows host runtime identity discovery using SID mapping.
internal/dockerdeploy/runtime_identity_windows_mapping.go	Implements deterministic SID→UID/GID mapping and constants.
internal/dockerdeploy/runtime_identity_unix.go	Adds non-Windows host runtime identity discovery via uid/gid/groups.
internal/dockerdeploy/provider_install_run.go	Adds install-time runtime-identity adaptation pipeline and lock plumbing.
internal/dockerdeploy/provider_install_run_test.go	Updates install-run ordering expectations and backend completeness checks.
internal/dockerdeploy/provider_install_prepare_destination.go	Publishes the install-adapted build lock during destination preparation.
internal/dockerdeploy/provider_install_prepare_destination_test.go	Updates fixture to supply the install build lock.
internal/dockerdeploy/provider_install_path_updates.go	Switches volume-copy command inputs to the install-adapted build lock.
internal/dockerdeploy/provider_install_path_updates_test.go	Updates path-update tests to set and assert install build lock usage.
internal/dockerdeploy/provider_install_path_updates_integration_test.go	Updates integration test fixture to include install build lock.
internal/dockerdeploy/provider_install_lifecycle_execute.go	Uses install build platform for lifecycle execution.
internal/dockerdeploy/provider_install_disk_requirements.go	Computes disk requirements and pending build state using the install build lock.
internal/dockerdeploy/provider_install_disk_requirements_test.go	Updates disk requirement tests to include the build lock field.
internal/dockerdeploy/provider_install_backend.go	Wires default backend to build install runtime identity.
internal/dockerdeploy/provider_build_run.go	Refactors host runtime identity discovery behind a shared helper and tightens Windows constraints.
internal/dockerdeploy/provider_build_run_test.go	Updates Windows runtime identity expectations and adds SID mapping tests.
internal/dockerdeploy/provider_build_completion.go	Threads local account into final validation/finalization inputs.
internal/dockerdeploy/provider_build_completion_test.go	Updates completion tests for the added local account argument.
internal/dockerdeploy/installed_build_publication.go	Publishes an installed build using a potentially identity-adapted build lock and validates shape constraints.
internal/dockerdeploy/installed_build_publication_test.go	Updates publication tests to use an adapted install lock/final image.
internal/dockerdeploy/install_runtime_identity.go	Adds the install-time runtime identity rebuild path (reuse vs adapt + validate).
internal/dockerdeploy/install_runtime_identity_test.go	Adds tests for reuse/adaptation and validation of the planned account.
internal/dockerdeploy/final_validation_pipeline.go	Adds local account to runtime-layer build request and transaction digest inputs.
internal/dockerdeploy/final_validation_pipeline_test.go	Updates pipeline tests to pass a local account.
internal/dockerdeploy/execution_plan.go	Adds LocalUser to runtime user plan and derives it from blueprint runtime user + UID.
internal/dockerdeploy/execution_plan_test.go	Verifies LocalUser derivation and warning text updates.
internal/dockerdeploy/current_build_verify.go	Includes local account in runtime-layer verification request.
internal/dockerdeploy/current_build_verify_test.go	Updates runtime-layer diffID expectations for the new two-layer runtime image.
internal/dockerdeploy/current_build_reuse.go	Adds local account as a reuse boundary.
internal/dockerdeploy/current_build_reuse_test.go	Tests reuse invalidation on local account change.
internal/dockerdeploy/build_publication_test.go	Updates runtime diffID expectations for the two-layer runtime image.
internal/dockerdeploy/application_startup_verifier_integration_test.go	Adds runtime username assertions (id -un) and passes account into runtime-layer build.
internal/dockerdeploy/application_sandbox_plan.go	Enforces presence/consistency of LocalUser and derives local account from sandbox plan.
internal/dockerdeploy/application_runtime_layer.go	Builds runtime layer that installs the local account via probe and validates 2-layer filesystem delta.
internal/dockerdeploy/application_runtime_layer_test.go	Updates Dockerfile expectations and candidate validation for the two-layer runtime image.
internal/deploy/runtime_verifier.go	Introduces ApplicationLocalAccountV1 and includes it in runtime-layer locking/digests/validation.
internal/deploy/deployment_state_v1.go	Allows installed generations to differ from staged generation in identity-adapted fields.
internal/deploy/deployment_state_v1_test.go	Updates tests to accept identity-adapted installed generation while still rejecting platform drift.
internal/deploy/build_lock_test.go	Updates build-lock fixtures and negative tests for the new nested local account.
internal/blueprint/syntax.go	Adds blueprint YAML syntax for environment.runtime.user.
internal/blueprint/resolve.go	Adds runtime user defaulting + validation and wires into the resolved model.
internal/blueprint/resolve_test.go	Tests runtime user defaulting/validation behavior.
internal/blueprint/model.go	Adds EnvironmentRuntime to the typed model.
docs/CONTROLLED_SESSION_DESIGN.md	Updates design docs to describe container-local account contract and Windows mapping.
docs/BLUEPRINT_ENVIRONMENT_MODEL.md	Documents runtime.user semantics and identity-adapted runtime layer behavior.
docs/BLUEPRINT_ENVIRONMENT_IMPLEMENTATION_PLAN.md	Updates implementation plan for Unix/Windows identity rules and local account realization.
docs/BACKLOG.md	Updates backlog item to focus on completing Desktop identity evidence.
docs/APT_PROVIDER.md	Updates runtime identity documentation and testing expectations.
.changes/unreleased/+container-local-runtime-user.yaml	Adds a release-note fragment for the new feature.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[omry]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fa6609d4fe

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[omry]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: d9fec362fa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[omry]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: e6c1c03e55

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".