feat: task isolation run as user - #99

Merged

uberware merged 42 commits into

mainfrom

feat/task-isolation-run-as-user

Jul 25, 2026

Commits on Jul 21, 2026

docs: reopen phase 3 for task isolation
uberware
committed
fd85353
feat: queue run-as-user identity fields
uberware
committed
7a927f4
feat: isolation.manage permission for run-as-user config
uberware
committed
0fe53ec

Commits on Jul 22, 2026

feat: expose queue run-as-user configuration
uberware
committed
41ae6af
feat: deliver queue run-as-user in task assignments
uberware
committed
6df3159
fix: stop leaking daemon environment into task processes
uberware
committed
6ecd43b
feat: posix run-as-user task isolation
uberware
committed
afd9227
feat: bind session security context to run-as-user
uberware
committed
0a9a190
test: containerised run-as-user integration suite
uberware
committed
0a48a13
fix: make run-as-user isolation functional and symlink-safe
uberware
committed
0c5a1e1
fix: surface pre-execution dispatch failures as task failures
uberware
committed
880e7c4
test: run isolation guard tests without a traversable-tmpdir skip
uberware
committed
412f42b
feat: windows run-as-user via logon_user
uberware
committed
9bf054a
fix: report windows task isolation as unsupported rather than half-enabled
uberware
committed
a3c52e9
ci: run isolation integration suite on both arches
uberware
committed
318e3bf
docs: task isolation and run-as-user configuration
uberware
committed
2cdbbaa
fix: contain stage-out transfers within the scratch boundary
uberware
committed
39eeb33
fix: reject run_as_group without run_as_user
uberware
committed
c60660c
test: prove gid 0 is stripped from supplementary groups on a real OS
uberware
committed
d31847d
ci: gate windows compilation and trim the isolation build context
uberware
committed
9700a76
docs: correct task isolation status and privileged group details
uberware
committed
5973b0c
fix: add isolation.manage to the web permission union
uberware
committed
0157538
fix: verify stage-out source on the opened descriptor
uberware
committed
71c5a66
fix: decide staging ancestor mode per worker not per assignment
uberware
committed
f4a38b4
docs: note that old workers silently ignore queue run-as-user
uberware
committed
cca1945

Commits on Jul 23, 2026

docs: drop the s4u windows credential provider
uberware
committed
69263b6
test: harness for running windows isolation tests as system
uberware
committed
cf50249
fix: lint the windows-only code that ci has never linted
uberware
committed
1c2f1c9
test: gate posix-only worker tests by platform
uberware
committed
72a5171
feat: store windows run-as-user credentials with dpapi
uberware
committed
d8a4ce9
feat: secure windows session directories with ntfs acls
uberware
committed
3a959df
feat: load the target user profile for isolated windows tasks
uberware
committed
03fc931
fix: reap orphaned windows task processes via job objects
uberware
committed
62cbaf3
feat: enable windows run-as-user task isolation
uberware
committed
148cdf6
ci: run the windows isolation integration suite
uberware
committed
048e774
docs: windows task isolation configuration
uberware
committed
ae63801
fix: correct windows isolation identity checks and stale claims
uberware
committed
4cb6e34