Freeze controlled-session execution plans

[omry]

---

Stack created with Sapling. Best reviewed with ReviewStack.

• -> Freeze controlled-session execution plans #25
• Add bounded controlled-session PTY draining #24
• Enforce controlled-session output finalization #23
• Verify sandbox state on the execution thread #22
• Preserve base identity in direct installs #21
• Run application sandbox integration in CI #20
• Add controlled-session lifecycle state machine #18
• Add controlled-session framed protocol #17
• Define controlled-session authorization #16
• Make queued admission cancellation deterministic #15
• Enforce coarse application network policy #14
• Protect host system trees from runtime binds #13
• Enforce root host filesystem boundary #12
• Add container-local runtime identities #11
• Verify application sandbox at startup #10
• Harden application container identity and kernel policy #9
• Unify application sandbox planning #8
• Document controlled sessions and repositories #7

[omry]

@codex review

[Copilot]

Pull request overview

Adds an immutable, pre-admission Docker execution-plan format for controlled sessions, binding controller/workload container authority (identity, mounts/masks, commands, and lifecycle commands) into digested plans and embedding those digests into the controlled-session authorization record.

Changes:

• Extend private runtime masking to support multiple deployment roots (for cross-environment bind protection).
• Introduce controlled-session-* execution/container plan schemas, planning + validation, and unit/integration evidence.
• Restructure controlled-session authorization to carry per-participant environment authorization (controller + workload) including plan digests.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
internal/dockerdeploy/private_workload_environment.go	Generalize private runtime masking to accept multiple protected deployment roots.
internal/dockerdeploy/controlled_session_plan.go	New controlled-session execution/container plan types, plan derivation, digests, and validation to “freeze” Docker authority pre-admission.
internal/dockerdeploy/controlled_session_plan_test.go	Unit coverage for plan immutability, digest binding, mask derivation, and validation rejection cases.
internal/dockerdeploy/controlled_session_plan_integration_test.go	Docker-gated integration evidence that planned container create/start behaves as expected.
internal/controlledsession/authorization.go	Authorization schema change: embed controller/workload EnvironmentAuthorizationV1 with plan digests and identities.
internal/controlledsession/authorization_test.go	Update authorization fixtures and validation tests for the new nested authorization shape.
docs/CONTROLLED_SESSION_DESIGN.md	Update design doc to reflect two-environment immutable Docker planning and current implementation status.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: dd1f677bd5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".