Governed package installation for kernels, on bounded network egress by KB-syntheticsciences · Pull Request #281 · synthetic-sciences/openscience

feat(sandbox,package): governed package installs under a network-policy sandbox

KB (KB-syntheticsciences)

committed

9cf66df

fix(sandbox): re-seat the egress shim on main's empty-root namespace

KB (KB-syntheticsciences)

committed

e7f16a2

fix(sandbox): stop readBind re-exposing masked paths, align the network default

KB (KB-syntheticsciences)

committed

8dbbe6f

feat(package): resolve managed environments through main's kernel resolver

KB (KB-syntheticsciences)

committed

3fd0eb7

fix(package,sandbox): grant the base prefix, and rebind kernels after a mutation

KB (KB-syntheticsciences)

committed

80b0ffe

fix(sandbox): say that "allow" reaches nothing, and rebuild two files the rebase corrupted

KB (KB-syntheticsciences)

committed

88f8853

fix(ci): restore the macos-runtime job body the conflict resolution swallowed

KB (KB-syntheticsciences)

committed

96d8acc

fix(sandbox): grant Windows exactly what the caller named, and nothing else

KB (KB-syntheticsciences)

committed

f33105b

fix(package): let the sandbox supply pip's scratch directory

KB (KB-syntheticsciences)

committed

2e9ea43

fix(sandbox): grant Windows the name the caller used, not just what it resolves to

KB (KB-syntheticsciences)

committed

37ba194

test(sandbox): stop the reconstruction drifting, and correct a wrong conclusion

KB (KB-syntheticsciences)

committed

241e157

fix(package): install through uv on Windows, and stop install() hanging past its abort

KB (KB-syntheticsciences)

committed

7d8dd0d

test(sandbox): ask uv what it could not open, instead of guessing again

KB (KB-syntheticsciences)

committed

0a6da5e

test(sandbox): does a process INSIDE the container execute the interpreter?

KB (KB-syntheticsciences)

committed

6712751

Navigation Menu

Uh oh!

Governed package installation for kernels, on bounded network egress - #281

Governed package installation for kernels, on bounded network egress#281
KB (KB-syntheticsciences) wants to merge 14 commits into
mainfrom
feat/kernel-package-install

Commits on Aug 15, 2026

feat(sandbox,package): governed package installs under a network-policy sandbox

fix(sandbox): re-seat the egress shim on main's empty-root namespace

fix(sandbox): stop readBind re-exposing masked paths, align the network default

feat(package): resolve managed environments through main's kernel resolver

fix(package,sandbox): grant the base prefix, and rebind kernels after a mutation

fix(sandbox): say that "allow" reaches nothing, and rebuild two files the rebase corrupted

fix(ci): restore the macos-runtime job body the conflict resolution swallowed

fix(sandbox): grant Windows exactly what the caller named, and nothing else

fix(package): let the sandbox supply pip's scratch directory

fix(sandbox): grant Windows the name the caller used, not just what it resolves to

test(sandbox): stop the reconstruction drifting, and correct a wrong conclusion

fix(package): install through uv on Windows, and stop install() hanging past its abort

test(sandbox): ask uv what it could not open, instead of guessing again

test(sandbox): does a process INSIDE the container execute the interpreter?