feat(kubernetes): isolate workloads behind a dedicated supervisor - #3144

Merged

drew merged 16 commits into

codex/1737-rfc12-supervisor-primitivesfrom

codex/kubernetes-proxy-pod-isolation

Sep 14, 2026

Commits on Sep 14, 2026

feat(kubernetes): add proxy-pod isolation topology
drew
committed
e7e6726
refactor(kubernetes): use sandbox backend protocol
drew
committed
3c10d8a
fix(kubernetes): use stable sandbox service authority
drew
committed
84ad146
feat(kubernetes): split sandbox and supervisor images
drew
committed
3af92fe
fix(kubernetes): adapt proxy pods to current runtime APIs
drew
committed
9b68279
refactor(kubernetes): describe the single runtime placement
drew
committed
477d5be
refactor(kubernetes): simplify sandbox orchestration
drew
committed
d33dd35
fix(kubernetes): validate deployment prerequisites
drew
committed
d4cefa1
fix(kubernetes): update Trivy Helm profile inventory
drew
committed
072fca9
test(kubernetes): update Trivy scan inventory count
drew
committed
e5b7461
fix(kubernetes): reuse preloaded runtime images in e2e
drew
committed
370ae0e
fix(kubernetes): type and clean runtime resources
drew
committed
e148c1d
fix(kubernetes): make sandbox restarts recoverable
drew
committed
2f8250d
fix(kubernetes): rotate restored sandbox sessions
drew
committed
9ad014e
fix(kubernetes): preserve supervisor egress
drew
committed
d5024ef
fix(kubernetes): bind sandbox session lineage
drew
committed
dc47f15