Prove controlled-session lifecycle in Docker

[omry]

---

• Record controlled-session resource ownership #32
• -> Prove controlled-session lifecycle in Docker #31
• Supervise controlled-session lifecycle #30
• Bridge controlled-session controller and workload I/O #29
• Add Docker controlled-session controller adapter #28
• Add Docker workload PTY adapter #27
• Add private controlled-session channel #26
• Freeze controlled-session execution plans #25
• Add bounded controlled-session PTY draining #24
• Enforce controlled-session output finalization #23
• Verify sandbox state on the execution thread #22
• Preserve base identity in direct installs #21
• Run application sandbox integration in CI #20
• Add controlled-session lifecycle state machine #18
• Add controlled-session framed protocol #17
• Define controlled-session authorization #16
• Make queued admission cancellation deterministic #15
• Enforce coarse application network policy #14
• Protect host system trees from runtime binds #13
• Enforce root host filesystem boundary #12
• Add container-local runtime identities #11
• Verify application sandbox at startup #10
• Harden application container identity and kernel policy #9
• Unify application sandbox planning #8
• Document controlled sessions and repositories #7

[omry]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: faa10ba33f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

This PR strengthens the Docker-based “controlled-session” lifecycle proof by injecting a payload that resembles a terminal “terminated” result into workload output and asserting that it survives output finalization—helping demonstrate that supervisor/controller lifecycle handling is not confused by forged in-band bytes.

Changes:

• Inject a forged “terminated” JSON payload (prefixed with 0x1e) into workload output during the resize step.
• Assert that the forged payload is present in the captured output at WorkloadOutputsFinalized, alongside existing exit/interrupt evidence.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.