fix(runtime): harden Crabfleet lifecycle boundaries - #78

Merged

vincentkoc merged 242 commits into

mainfrom

fix/crabfleet-audit-findings

Jul 12, 2026

Commits on Jul 12, 2026

fix(ci): pin coordinator source revision
vincentkoc
committed
f5dbcb2
fix(image): verify crabbox release archive
vincentkoc
committed
d9213f8
fix(terminal): confirm one-shot input delivery
vincentkoc
committed
c764890
fix(runtime): reject unroutable profile ids
vincentkoc
committed
d119c8f
fix(terminal): send attributed commands atomically
vincentkoc
committed
80c56dc
fix(actions): honor live relay availability
vincentkoc
committed
192e102
fix(app): reconcile browser history state
vincentkoc
committed
e14d408
fix(vnc): harden authentication and input keysyms
vincentkoc
committed
4e02e97
fix(cards): persist run claims atomically
vincentkoc
committed
0be23dd
fix(actions): fence concurrent session updates
vincentkoc
committed
ed40ea5
fix(events): reject lossy JSON values
vincentkoc
committed
ae7afc8
fix(routes): reject malformed session ids
vincentkoc
committed
3d21dc1
fix(terminal): retain shared input state
vincentkoc
committed
c3c7cf2
fix(auth): revoke session grants atomically
vincentkoc
committed
d419a86
fix(macos): harden private desktop sharing
vincentkoc
committed
48944ce
fix(vnc): harden protocol state transitions
vincentkoc
committed
15cc13a
fix(sandbox): preserve refreshed session ownership
vincentkoc
committed
eb5df98
fix(runtime): retain superseded workspace cleanup
vincentkoc
committed
3c2d6ef
docs(changelog): record audit hardening
vincentkoc
committed
e5b7fbb
style(terminal): format input dispatch
vincentkoc
committed
6bd3205
test(macos): use explicit token placeholder
vincentkoc
committed
c6641c9
fix(macos): normalize native broker schemes
vincentkoc
committed
54193ad
fix(terminal): negotiate input acknowledgements
vincentkoc
committed
40eb46b
fix(actions): fence blocked work states
vincentkoc
committed
7317e0f
fix(http): validate deeply nested JSON iteratively
vincentkoc
committed
0a81c81
fix(vnc): preserve ASCII keysyms in composed input
vincentkoc
committed
a897983
fix(runtime): preserve opaque fixed profile ids
vincentkoc
committed
aca2537
fix(runtime): clean reservation archives before rollback
vincentkoc
committed
74e04a2
fix(macos): preserve network and clipboard semantics
vincentkoc
committed
f461439
fix(terminal): keep established sockets alive
vincentkoc
committed
ceabb9b
fix(macos): serialize private share lifecycle
vincentkoc
committed
fc4862d
docs(changelog): expand audit compatibility notes
vincentkoc
committed
da26a14
fix(macos): refresh clipboard state before dedupe
vincentkoc
committed
d9bf41f
fix(vnc): validate authentication and format transitions
vincentkoc
committed
39e0ee4
fix(actions): fence registration against read state
vincentkoc
committed
01ab3dd
fix(macos): decode X11 Unicode keysyms
vincentkoc
committed
f1c145f
fix(macos): preserve empty clipboard notifications
vincentkoc
committed
a2b312c
fix(cards): classify duplicate claims before capacity
vincentkoc
committed
ec1f52f
docs(changelog): complete audit hardening notes
vincentkoc
committed
b2bdeaf
fix(terminal): return after empty confirmed input
vincentkoc
committed
a018a30
fix(macos): remove hosts after listener failure
vincentkoc
committed
654f0e4
fix(vnc): force idle pixel format boundaries
vincentkoc
committed
bc6648f
docs(changelog): record final audit fixes
vincentkoc
committed
5f9911e
fix(sandbox): rotate credential generations monotonically
vincentkoc
committed
1c3f71a
fix(terminal): bound input confirmation waits
vincentkoc
committed
2299f9c
fix(vnc): drain pixel format probe responses
vincentkoc
committed
2f27fc0
docs(changelog): complete audit lifecycle notes
vincentkoc
committed
f1298a1
fix(vnc): synchronize pixel formats with RFB fences
vincentkoc
committed
62b5aeb
docs(changelog): note fenced VNC transitions
vincentkoc
committed
1919e62
fix(vnc): negotiate pixel format fences safely
vincentkoc
committed
a79bffd
fix(vnc): correlate fallback format boundaries
vincentkoc
committed
6ebb42d
fix(vnc): fail closed on partial fence support
vincentkoc
committed
fd52c2b
fix(vnc): reject unsafe legacy format switches
vincentkoc
committed
7df941d
docs(changelog): clarify legacy VNC handling
vincentkoc
committed
eedc469
fix(macos): clear stale non-text clipboard cache
vincentkoc
committed
b361ac7
fix(vnc): await initial fence negotiation
vincentkoc
committed
e75959a
test(events): follow ledger store contract
vincentkoc
committed
4cbb4f7
fix(events): defer request archive publication
vincentkoc
committed
6c6af3f
fix(macos): preserve unowned desktop registrations
vincentkoc
committed
98d4471
fix(vnc): require synchronized format boundaries
vincentkoc
committed
86e124d
fix(terminal): revalidate upstream before input ack
vincentkoc
committed
90b8f22
fix(vnc): bound fence capability probes
vincentkoc
committed
fc9b82a
fix(macos): decouple stop from registry cleanup
vincentkoc
committed
532bf52
fix(macos): use monotonic command deadlines
vincentkoc
committed
c4d8f3d
fix(vnc): preserve timeout synchronization boundaries
vincentkoc
committed
6c5aa55
fix(macos): preserve private share registration ownership
vincentkoc
committed
0876c2a
fix(actions): acknowledge runner input delivery
vincentkoc
committed
1054a76
fix(terminal): queue input acknowledgements
vincentkoc
committed
9232a35
fix(vnc): bound pixel format transition waits
vincentkoc
committed
f7a82cd
fix(actions): correlate runner input acknowledgements
vincentkoc
committed
307304c
fix(worker): fence desktop host cleanup ownership
vincentkoc
committed
b1410b2
fix(macos): harden private share teardown lifecycle
vincentkoc
committed
fe70513
fix(credentials): stage policy generation rotation
vincentkoc
committed
51260ee
docs(actions): document framed runner protocol
vincentkoc
committed
82ad6d7
fix(actions): fence registration and terminal races
vincentkoc
committed
35afbf2
fix(vnc): defer transition timeout until framebuffer boundary
vincentkoc
committed
e3fec6f
fix(vnc): release unresolved credential requests
vincentkoc
committed
8fcce0f
fix(credentials): restore failed policy rotations
vincentkoc
committed
b018ec3
fix(actions): negotiate framed runner io
vincentkoc
committed
4a3f93e
fix(actions): fence runner protocol negotiation
vincentkoc
committed
535c8fe
fix(vnc): accept late fence capability responses
vincentkoc
committed
af57733
fix(desktop): preserve legacy host cleanup
vincentkoc
committed
9246841
fix(worker): fence policy rollback and registration CAS
vincentkoc
committed
3d819a6
fix(macos): bound tailnet pipe draining
vincentkoc
committed
b63139b
fix(actions): negotiate runner protocol at connect
vincentkoc
committed
58ae424
docs(actions): describe legacy runner compatibility
vincentkoc
committed
6e60b01
fix(runtime): validate profile route templates
vincentkoc
committed
c5a9da8
fix(image): preserve verified version overrides
vincentkoc
committed
6dfc57b
fix(runtime): reject ambiguous adapter urls
vincentkoc
committed
a0113f0
fix(image): require pinned override checksums
vincentkoc
committed
6c8a0ba
docs(actions): clarify raw runner fallback
vincentkoc
committed
601ec04
fix(macos): await share cleanup on termination
vincentkoc
committed
84c7316
fix(credentials): claim rollback recovery ownership
vincentkoc
committed
bd0f7b7
fix(desktop): return atomic registration row
vincentkoc
committed
efe22a4
fix(terminal): route confirmations through one reader
vincentkoc
committed
0f7ac2d
docs(changelog): record final concurrency fixes
vincentkoc
committed
658efdf
fix(image): keep default digest immutable
vincentkoc
committed
0f879b7
docs(actions): reject split utf8 input frames
vincentkoc
committed
4a0adef
test(actions): enforce byte-safe runner docs
vincentkoc
committed
437a4f4
fix(macos): retry pending input releases
vincentkoc
committed
461b200
fix(terminal): defer output ack until attach
vincentkoc
committed
2c98e22
fix(macos): bound successful command drain
vincentkoc
committed
515af60
fix(actions): negotiate viewer relay protocol
vincentkoc
committed
d49d0e3
fix(actions): confirm viewer relay negotiation
vincentkoc
committed
35931c0
docs(changelog): record final audit fixes
vincentkoc
committed
b317dc7
test(macos): stabilize descendant drain fixture
vincentkoc
committed
b52c3a6
fix(terminal): serialize confirmed input delivery
vincentkoc
committed
270ca5b
fix(macos): await concurrent share teardown
vincentkoc
committed
bd51d0e
fix(runtime): preserve adapter migration fallback
vincentkoc
committed
a372e51
docs(actions): clarify viewer relay negotiation
vincentkoc
committed
adf45ce
fix(actions): fence writes to authenticated revision
vincentkoc
committed
1bc0689
fix(desktop): negotiate registration ownership
vincentkoc
committed
66ab009
fix(credentials): fence legacy registration claims
vincentkoc
committed
9660fe7
docs(changelog): record rollout safety fixes
vincentkoc
committed
7a441e4
fix(actions): keep authenticated revisions monotonic
vincentkoc
committed
2d64d0c
fix(terminal): unblock confirmed message delivery
vincentkoc
committed
a30a750
fix(terminal): serialize client input completions
vincentkoc
committed
27058ad
fix(http): reject rounded integer literals
vincentkoc
committed
867647e
docs(actions): close runner socket on PTY exit
vincentkoc
committed
b19dde9
fix(macos): retry cleanup and unwind canceled starts
vincentkoc
committed
9131ced
docs(changelog): record final audit repairs
vincentkoc
committed
5b74e41
fix(terminal): wake confirmed input delivery
vincentkoc
committed
1705470
fix(macos): clear completed stop coordination
vincentkoc
committed
d522fbd
fix(vnc): close parser and credential lifetime gaps
vincentkoc
committed
e947561
docs(changelog): record final race repairs
vincentkoc
committed
139dd14
fix(desktop): preserve legacy ownership fences
vincentkoc
committed
6c53bcc
fix(terminal): close remaining delivery races
vincentkoc
committed
b17c5c8
fix(macos): retain teardown input releases
vincentkoc
committed
b200f1f
fix(vnc): arm transition fences before writes
vincentkoc
committed
7d7dd97
docs(actions): make framed runner byte-safe
vincentkoc
committed
64deb48
docs(changelog): record remaining audit repairs
vincentkoc
committed
394aeaa
fix(ssh): snapshot connection limits before handlers
vincentkoc
committed
3052af1
docs(changelog): record ssh limit snapshotting
vincentkoc
committed
255825a
fix(migrations): fence mixed-version ownership
vincentkoc
committed
c2600f1
fix(terminal): bound confirmation serialization
vincentkoc
committed
3f9185c
docs(actions): acknowledge only delivered input
vincentkoc
committed
8bd9aa8
fix(vnc): publish fence capability atomically
vincentkoc
committed
db2bd15
docs(changelog): record rollout boundary fixes
vincentkoc
committed
d1808ef
fix(macos): skip empty input release retries
vincentkoc
committed
b30814e
fix(terminal): await attachment frame consumer
vincentkoc
committed
cc7ff39
docs(actions): bound framed runner buffering
vincentkoc
committed
66251dd
fix(credentials): fence staged rotations from legacy writers
vincentkoc
committed
5b71ba1
docs(changelog): record final audit repairs
vincentkoc
committed
0d0c32c
fix(credentials): repair incomplete lookup sets
vincentkoc
committed
999797c
fix(terminal): bound serialized input backlog
vincentkoc
committed
a238dd8
fix(actions): retire acknowledgements on runner failover
vincentkoc
committed
0eac78f
docs(changelog): record migration and relay fixes
vincentkoc
committed
cc38033
fix(credentials): persist staged lookup identity
vincentkoc
committed
e33d43d
fix(macos): reconcile uncertain desktop publication
vincentkoc
committed
52f1828
fix(credentials): recover staged rotations idempotently
vincentkoc
committed
ebd81b7
fix(macos): bound teardown input release retries
vincentkoc
committed
286e059
fix(terminal): fence runner input generations
vincentkoc
committed
f9b06f7
fix(runtime): persist superseded workspace cleanup
vincentkoc
committed
59e251c
docs(changelog): record final lifecycle hardening
vincentkoc
committed
6d0216c
fix(desktop): recover publication ownership safely
vincentkoc
committed
aeb10c8
fix(macos): reconcile uncertain desktop publications
vincentkoc
committed
b11b9b5
fix(actions): fence relay runner generations
vincentkoc
committed
816dc73
docs(actions): define generation-fenced relay protocol
vincentkoc
committed
a7630a2
docs(changelog): record ownership race fixes
vincentkoc
committed
10d912c
fix(api): reject malformed desktop recovery ids
vincentkoc
committed
b907745
docs(actions): align generation and recovery contracts
vincentkoc
committed
8a4588a
fix(actions): serialize runner input delivery
vincentkoc
committed
5d63e48
fix(terminal): bound blocked attachment shutdown
vincentkoc
committed
45270f4
fix(macos): preserve legacy uncertain publications
vincentkoc
committed
25791a1
fix(actions): carry initial viewer generation
vincentkoc
committed
351acb9
docs(changelog): record final race fixes
vincentkoc
committed
88664d6
fix(desktop): preserve idempotent publication recovery
vincentkoc
committed
c1f477b
fix(actions): bound runner input delivery
vincentkoc
committed
f5f3bda
fix(terminal): serialize raw input acknowledgements
vincentkoc
committed
c44c367
docs(changelog): record protocol follow-up fixes
vincentkoc
committed
31e6983
docs(actions): restrict runner input to steering
vincentkoc
committed
f543d27
fix(terminal): fence retired attachment delivery
vincentkoc
committed
66a2e5d
fix(actions): retire stale runner input queues
vincentkoc
committed
1907d7f
fix(runtime): make cleanup deletion crash-idempotent
vincentkoc
committed
647ee25
fix(terminal): capture relay replacement during authorization
vincentkoc
committed
95b7390
fix(actions): negotiate runner protocol explicitly
vincentkoc
committed
a89ba66
fix(macos): validate ARD Diffie-Hellman parameters
vincentkoc
committed
249751b
fix(credentials): recover namespace rotation safely
vincentkoc
committed
e85c048
fix(macos): key publication cleanup by host ID
vincentkoc
committed
6476c81
docs(changelog): record final audit fixes
vincentkoc
committed
c9d055b
docs(actions): serialize negotiated steering example
vincentkoc
committed
6773dae
fix(desktop): require token publication identity
vincentkoc
committed
490d07d
fix(terminal): report ambiguous steering timeouts
vincentkoc
committed
eefc11b
fix(macos): republish rotated desktop identities
vincentkoc
committed
339e0dd
fix(runtime): persist idempotent cleanup deletes
vincentkoc
committed
1654b80
docs(actions): harden runner input fallback
vincentkoc
committed
160e393
fix(runtime): require replayable delete tombstones
vincentkoc
committed
790f7cf
docs(changelog): record final recovery contracts
vincentkoc
committed
9ec7b69
test(docs): verify embedded spec generation
vincentkoc
committed
55acdb5
fix(credentials): fence staging claim renewal
vincentkoc
committed
43e61bc
test(credentials): prove single claim ownership
vincentkoc
committed
54e7dd7
fix(vnc): renegotiate pixel format encodings
vincentkoc
committed
e8d0075
fix(terminal): harden input completion races
vincentkoc
committed
a01a279
fix(macos): persist desktop cleanup recovery
vincentkoc
committed
39495b6
fix(actions): retain runner generation authority
vincentkoc
committed
85f0976
fix(credentials): preserve legacy lookup recovery
vincentkoc
committed
006757b
fix(vnc): synchronize encoding transitions
vincentkoc
committed
67de7e3
fix(macos): quiesce remote input teardown
vincentkoc
committed
4877ee5
fix(macos): scope desktop recovery authority
vincentkoc
committed
3837413
docs(changelog): record final protocol fences
vincentkoc
committed
51c712b
fix(vnc): reject weak UltraVNC DH elements
vincentkoc
committed
653df8f
fix(macos): allow idle quit after recovery lookup failure
vincentkoc
committed
a0bb61d
fix(macos): terminate Tailscale process groups
vincentkoc
committed
d74852c
docs(changelog): record final teardown hardening
vincentkoc
committed
e472f64
test(assets): generate ignored fixtures before import
vincentkoc
committed
420acb6
fix(terminal): keep viewer timeouts passive
vincentkoc
committed
0b813a4
docs(actions): fence queued runner steering
vincentkoc
committed
e3b0e4b
fix(vnc): reset ZRLE on pixel format changes
vincentkoc
committed
997d004
fix(credentials): fence stale rollback recovery
vincentkoc
committed
8a6a6da
docs(changelog): record final audit follow-up
vincentkoc
committed
f325326
fix(macos): harden share shutdown recovery
vincentkoc
committed
d2347e5
fix(http): classify body stream failures
vincentkoc
committed
c971c6a
fix(app): preserve session grid terminals
vincentkoc
committed
d75e8c2
fix(credentials): fence final policy promotion
vincentkoc
committed
12688ba
fix(runtime): negotiate delete tombstones
vincentkoc
committed
90259d7
fix(vnc): fail closed on probe timeout
vincentkoc
committed
2b9e2d4
docs(changelog): record review blocker fixes
vincentkoc
committed
d2f8b1e
test(assets): serialize generated fixtures
vincentkoc
committed
dcbf92b
test(assets): avoid unsafe stale lock recovery
vincentkoc
committed
ac74a0b
test(assets): hold a crash-released generation lock
vincentkoc
committed
98a444b
fix(terminal): preserve ambiguous input outcomes
vincentkoc
committed
88c2c25
fix(credentials): preserve rollback recovery fences
vincentkoc
committed
73076ab
fix(vnc): validate ARD safe-prime groups
vincentkoc
committed
44c6315
fix(macos): complete ambiguous desktop cleanup
vincentkoc
committed
916a60c
fix(database): surface desktop ownership conflicts
vincentkoc
committed
1bc9a2f
docs(changelog): record final audit hardening
vincentkoc
committed
9f82340
fix(credentials): permit staged namespace retirement
vincentkoc
committed
17447ab
test(credentials): prove interrupted upgrade recovery
vincentkoc
committed
4da3119
fix(terminal): preserve attachment handoff state
vincentkoc
committed
8569b6f
fix(vnc): defer ZRLE reset for partial fences
vincentkoc
committed
6bf5b19
docs(changelog): record final review fixes
vincentkoc
committed
92c0e93
docs(api): clarify publication id contract
vincentkoc
committed
414eb46
fix(terminal): preserve disconnect delivery ambiguity
vincentkoc
committed
21f6e8f
fix(terminal): mark post-write input ambiguity
vincentkoc
committed
b1a358f
fix(desktop): reject legacy ownership conflicts
vincentkoc
committed
af362b1
fix(macos): discard negative publication recovery
vincentkoc
committed
4cc0ce7
docs(changelog): record delivery and ownership fixes
vincentkoc
committed
7b5bcd2
fix(terminal): preserve upstream delivery ambiguity
vincentkoc
committed
4fa0be3
fix(vnc): bound validated safe-prime cache
vincentkoc
committed
8dff7f1
docs(changelog): record final cache and delivery fixes
vincentkoc
committed
ed6b9e1
fix(credentials): preserve rotation recovery invariants
vincentkoc
committed
41140f5
docs(changelog): record credential recovery invariants
vincentkoc
committed
75f76bf